diff --git a/README.md b/README.md
index 3bb92632..de0168b9 100644
--- a/README.md
+++ b/README.md
@@ -1,113 +1,210 @@
-# Ansible Platform Collection
-
-## Changelog for v2.7.20260313
-
-* Added OIDC User Identity support for Ansible Automation Platform Gateway
-* New modules: feature_flag, ca_certificates, role_team_assignment, role_definition
-* Add request_timeout_seconds and idle_timeout_seconds to route modules
-* Add enable_mtls attribute to route module for mutual TLS support
-* Add associated_authenticators parameter to users module
-* Add Gateway UI plugin Route Collection Module
-* Enhanced organization association logic and auditor user support
-* Multiple bug fixes for role assignment, object deletion, and URL handling
-* Deprecated authenticator_uid and authenticators fields
+# Ansible Platform Collection (`ansible.platform`)
 
 ## Description
 
-This collection contains modules that can be used to automate the creation of resources on an install of Ansible Automation Platform.
+The `ansible.platform` collection provides idempotent resource modules for managing
+[Red Hat Ansible Automation Platform](https://www.redhat.com/en/technologies/management/ansible)
+(AAP) Gateway resources. It targets the AAP Gateway API and enables teams to define
+infrastructure-as-code for users, organizations, teams, authentication, services,
+routing, and access control — all through standard Ansible playbooks.
 
+The collection follows the **resource module** pattern: each module accepts a desired
+`config` list and a `state` (`merged`, `replaced`, `overridden`, `deleted`, or
+`gathered`), making it easy to enforce declarative configuration at scale.
 
 ## Requirements
 
-This collection supports python versions >=3.11 and requires an ansible-core version of >=2.16.0. 
-
-It also requires an existing install of Ansible Automation Platform as a target. 
+| Requirement | Version |
+|---|---|
+| Python | >= 3.11 |
+| ansible-core | >= 2.16.0 |
+| Red Hat Ansible Automation Platform | Current release |
 
+No additional Python package dependencies are required beyond what is bundled with
+`ansible-core`.
 
 ## Installation
 
-Before using this collection, you need to install it with the Ansible Galaxy command-line tool:
+Install the collection from Ansible Galaxy:
 
-```
+```bash
 ansible-galaxy collection install ansible.platform
 ```
 
-You can also include it in a requirements.yml file and install it with ansible-galaxy collection install -r requirements.yml, using the format:
+To pin a specific version:
 
-
-```yaml
-collections:
-  - name: ansible.platform.
+```bash
+ansible-galaxy collection install ansible.platform:==2.7.20260313
 ```
 
-Note that if you install any collections from Ansible Galaxy, they will not be upgraded automatically when you upgrade the Ansible package.
-To upgrade the collection to the latest available version, run the following command:
+To upgrade an already-installed collection:
 
-```
+```bash
 ansible-galaxy collection install ansible.platform --upgrade
 ```
 
-You can also install a specific version of the collection, for example, if you need to downgrade when something is broken in the latest version (please report an issue in this repository). Use the following syntax to install version 2.5.0:
+You can also declare it in a `requirements.yml` file:
 
-```
-ansible-galaxy collection install ansible.platform:==2.5.0
+```yaml
+collections:
+  - name: ansible.platform
 ```
 
-See [using Ansible collections](https://docs.ansible.com/ansible/devel/user_guide/collections_using.html) for more details.
+Then install with:
 
-## Use Cases
-
-This collection can be used to automate to the creation of resources inside of the Ansible Automation Platform. Things such as users, organizations and teams can be created using this collection. 
+```bash
+ansible-galaxy collection install -r requirements.yml
+```
 
-Adding services (Controller, Event Driven Automation, Automation) can also be done with this collection. Nodes for those services can also be added. 
+See [Using Ansible collections](https://docs.ansible.com/ansible/devel/user_guide/collections_using.html)
+for further details.
 
-## Authenticating to AAP in a playbook
+## Use Cases
 
-Connecting to AAP requires specifying authentication variables (the ones prefixed by `aap_` here) in the task. Alternatively, `AAP_` environment variables can also be set. For a complete list of authentication variables that can be used, please refer to the module specific documentations.
+The collection is intended for platform engineers and automation architects who need to
+manage AAP Gateway configuration programmatically. Common use cases include:
+
+- **Day-0 provisioning** — bootstrap a fresh AAP installation with organizations,
+  teams, users, and authenticators defined in source control.
+- **Day-2 operations** — enforce desired state across environments; detect and
+  remediate configuration drift with `state: overridden`.
+- **Audit and reporting** — use `state: gathered` to read current platform state
+  into Ansible variables for downstream processing.
+- **CI/CD pipelines** — gate deployments on AAP configuration being exactly as
+  expected before running automation.
+
+## Included Content
+
+### Modules
+
+| Module | Description |
+|---|---|
+| `ansible.platform.applications` | Manage Gateway application (OAuth2 app) resources |
+| `ansible.platform.authenticators` | Manage Gateway authenticator resources |
+| `ansible.platform.authenticator_maps` | Manage Gateway authenticator map resources |
+| `ansible.platform.authenticator_users` | Manage Gateway authenticator user resources |
+| `ansible.platform.ca_certificates` | Manage Gateway CA certificate resources |
+| `ansible.platform.feature_flags` | Manage Gateway feature flag resources |
+| `ansible.platform.http_ports` | Manage Gateway HTTP port resources |
+| `ansible.platform.organizations` | Manage Gateway organization resources |
+| `ansible.platform.role_definitions` | Manage Gateway role definition resources |
+| `ansible.platform.role_team_assignments` | Manage Gateway role-to-team assignment resources |
+| `ansible.platform.role_user_assignments` | Manage Gateway role-to-user assignment resources |
+| `ansible.platform.routes` | Manage Gateway route resources |
+| `ansible.platform.services` | Manage Gateway service resources |
+| `ansible.platform.service_clusters` | Manage Gateway service cluster resources |
+| `ansible.platform.service_keys` | Manage Gateway service key resources |
+| `ansible.platform.service_nodes` | Manage Gateway service node resources |
+| `ansible.platform.service_types` | Manage Gateway service type resources |
+| `ansible.platform.settings` | Manage Gateway settings resources |
+| `ansible.platform.teams` | Manage Gateway team resources |
+| `ansible.platform.tokens` | Manage Gateway OAuth2 token resources |
+| `ansible.platform.ui_plugin_routes` | Manage Gateway UI plugin route resources |
+| `ansible.platform.users` | Manage Gateway user resources |
+
+### Connection Plugins
+
+| Plugin | Description |
+|---|---|
+| `ansible.platform.http` | Persistent HTTP connection plugin for the AAP Gateway API |
+
+## Authenticating to AAP Gateway
+
+Each module accepts connection parameters directly in the task. You can also export
+them as environment variables (prefixed `AAP_`).
 
 ```yaml
-- name: Manage AAP
+- name: Manage AAP Gateway resources
   hosts: localhost
   tasks:
-    - name: Example for auth
-      ansible.platform.<module-name>:
-        your-module-parameters: parameter-values
-        aap_hostname: your-hostname
-        aap_username: your-username
-        aap_password: your-password
+    - name: Ensure an organization exists
+      ansible.platform.organizations:
+        config:
+          - name: "my-org"
+            description: "Managed by Ansible"
+        state: merged
+        gateway_hostname: "https://your-aap-hostname"
+        gateway_username: "admin"
+        gateway_password: "{{ vault_aap_password }}"
+        gateway_validate_certs: true
 ```
 
+### Supported connection parameters
+
+| Parameter | Environment variable | Description |
+|---|---|---|
+| `gateway_hostname` | `GATEWAY_HOSTNAME` | URL of the AAP Gateway |
+| `gateway_username` | `GATEWAY_USERNAME` | Username for authentication |
+| `gateway_password` | `GATEWAY_PASSWORD` | Password for authentication |
+| `gateway_validate_certs` | `GATEWAY_VALIDATE_CERTS` | Validate TLS certificates (default: `true`) |
+
 ## Testing
 
-This collection is tested using integration tests which can be called via `ansible-test integration`. If you wish to run the tests manually, we recommend using the parent Makefile via `make collection-test`. It will require a running version of Ansible Automation Platform.
+The collection is tested with:
+
+- **Sanity tests** — PEP8, pylint, validate-modules, yamllint, and shebang checks via
+  `ansible-test sanity`.
+- **Molecule integration tests** — per-state scenarios (`merged`, `replaced`,
+  `overridden`, `gathered`, `deleted`, and `check` mode) for every module, run against
+  a mock Gateway server.
+
+To run sanity tests locally, the collection must reside under the correct namespace
+path:
+
+```bash
+mkdir -p ~/ansible_collections/ansible/platform
+ln -s /path/to/this/repo ~/ansible_collections/ansible/platform
+
+cd ~/ansible_collections/ansible/platform
+ansible-test sanity --python 3.12
+```
+
+To run the full lint suite (matches CI):
+
+```bash
+make collection-lint
+```
 
-The collection is tested against current version of Ansible Automation Platform.
+To run Molecule integration tests:
 
+```bash
+make collection-test
+```
+
+A running Ansible Automation Platform instance is required for integration tests.
 
 ## Support
 
-This collection is supported by RedHat Engineering. Support cases can be opened at: https://access.redhat.com/support/
+This collection is supported by Red Hat Engineering. Support cases can be opened at
+<https://access.redhat.com/support/>.
+
+For bugs and feature requests, open an issue in the
+[project repository](https://github.com/ansible/ansible.platform).
 
 ## Release Notes and Roadmap
 
-Changelogs can be found in the changelogs directory. 
+Full release notes are available in [CHANGELOG.rst](https://github.com/ansible/ansible.platform/blob/main/CHANGELOG.rst).
 
+The `changelogs/` directory contains individual release fragments and the compiled
+`changelog.yaml`.
 
 ## Related Information
 
-Please refer to Ansible Automation Platform Documentation for further documentation needs: https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.5
-
+- [Red Hat Ansible Automation Platform Documentation](https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform)
+- [Using Ansible Collections](https://docs.ansible.com/ansible/devel/user_guide/collections_using.html)
+- [Ansible Resource Modules](https://docs.ansible.com/ansible/latest/network/user_guide/network_resource_modules.html)
+- [AAP Gateway API Reference](https://access.redhat.com/documentation/en-us/red_hat_ansible_automation_platform)
 
 ## License Information
 
-[GPLv3](https://github.com/ansible/ansible.platform/COPYING)
+[GPL-3.0-or-later](https://github.com/ansible/ansible.platform/blob/main/COPYING)
 
 ## Authors
 
-[Sean Sullivan](https://github.com/sean-m-sullivan)
-[Martin Slemr](https://github.com/slemrmartin)
-[Jake Jackson](https://github.com/thedboubl3j)
-[Brennan Paciorek](https://github.com/brennanpaciorek)
-[John Westcott](https://github.com/john-westcott-iv)
-[Jessica Steurer](https://github.com/jay-steurer)
-[Bryan Havenstein](https://github.com/bhavenst)
+- [Sean Sullivan](https://github.com/sean-m-sullivan)
+- [Martin Slemr](https://github.com/slemrmartin)
+- [Jake Jackson](https://github.com/thedboubl3j)
+- [Brennan Paciorek](https://github.com/brennanpaciorek)
+- [John Westcott](https://github.com/john-westcott-iv)
+- [Jessica Steurer](https://github.com/jay-steurer)
+- [Bryan Havenstein](https://github.com/bhavenst)
diff --git a/docs/01-overview.md b/docs/01-overview.md
index 784be3ed..03a6ca5b 100644
--- a/docs/01-overview.md
+++ b/docs/01-overview.md
@@ -68,7 +68,7 @@ whether the underlying API has changed between AAP versions.
 **Example:**
 ```yaml
 - name: Ensure engineering team exists in the platform
-  ansible.platform.team:
+  ansible.platform.teams:
     name: engineering
     organization: Red Hat
     state: present
diff --git a/docs/02-resource-module-pattern.md b/docs/02-resource-module-pattern.md
index 01225da3..732bc6e4 100644
--- a/docs/02-resource-module-pattern.md
+++ b/docs/02-resource-module-pattern.md
@@ -37,7 +37,7 @@ Fields you do **not** specify are left exactly as they are.
 ```yaml
 # First run — user does not exist → POST → changed: true
 - name: Create user alice
-  ansible.platform.user:
+  ansible.platform.users:
     config:
       - username: "alice"
         email: "alice@example.com"
@@ -58,7 +58,7 @@ Fields you do **not** specify are left exactly as they are.
 ```yaml
 # Second run — user exists, nothing changed → changed: false
 - name: Create user alice (idempotency)
-  ansible.platform.user:
+  ansible.platform.users:
     config:
       - username: "alice"
         email: "alice@example.com"
@@ -74,7 +74,7 @@ Fields you do **not** specify are left exactly as they are.
 ```yaml
 # Update one field — alice exists but email changed → PATCH → changed: true
 - name: Update alice's email
-  ansible.platform.user:
+  ansible.platform.users:
     config:
       - username: "alice"
         email: "alice-new@example.com"
@@ -100,7 +100,7 @@ return `changed: true`. Running deleted twice is always idempotent.
 ```yaml
 # First run — alice exists → DELETE → changed: true
 - name: Remove user alice
-  ansible.platform.user:
+  ansible.platform.users:
     config:
       - username: "alice"
     state: deleted
@@ -113,7 +113,7 @@ return `changed: true`. Running deleted twice is always idempotent.
 ```yaml
 # Second run — alice is already gone → changed: false
 - name: Remove user alice again (idempotency)
-  ansible.platform.user:
+  ansible.platform.users:
     config:
       - username: "alice"
     state: deleted
@@ -136,7 +136,7 @@ updates, or deletes anything. Always returns `changed: false`.
 ```yaml
 # Gather all users
 - name: Read all users
-  ansible.platform.user:
+  ansible.platform.users:
     state: gathered
     gateway_hostname: "https://gateway.example.com"
     gateway_username: "admin"
@@ -155,7 +155,7 @@ updates, or deletes anything. Always returns `changed: false`.
 ```yaml
 # Gather a specific user (filter by config)
 - name: Check if alice exists
-  ansible.platform.user:
+  ansible.platform.users:
     config:
       - username: "alice"
     state: gathered
@@ -178,7 +178,7 @@ resource to have exactly and only the fields you declare.
 ```yaml
 # alice currently has: first_name=Alice, last_name=Smith, is_superuser=false
 - name: Replace alice's record (unspecified fields will be nulled)
-  ansible.platform.user:
+  ansible.platform.users:
     config:
       - username: "alice"
         email: "alice-replaced@example.com"
@@ -210,7 +210,7 @@ exist are created. Existing resources that differ are updated.
 # Current platform state: [admin, alice, charlie]
 # After overridden, ONLY alice and bob will exist
 - name: Enforce exact user set
-  ansible.platform.user:
+  ansible.platform.users:
     config:
       - username: "alice"
         email: "alice@example.com"
@@ -253,11 +253,11 @@ Without the resource module pattern, a playbook author would need to:
 3. If creating, call the POST endpoint.
 4. If updating, call the PATCH endpoint with only changed fields.
 
-The `ansible.platform.user` module encapsulates all of this:
+The `ansible.platform.users` module encapsulates all of this:
 
 ```yaml
 - name: Ensure user alice exists          # one task
-  ansible.platform.user:
+  ansible.platform.users:
     username: alice
     email: alice@example.com
     organizations: [engineering, ops]
@@ -398,7 +398,7 @@ collection that works across all of them. The resource module pattern, combined
 the versioned data model, makes this possible. The playbook author writes:
 
 ```yaml
-ansible.platform.user:
+ansible.platform.users:
   username: alice
   state: present
 ```
@@ -413,7 +413,7 @@ baseline. `state: enforced` on a resource module is their tool:
 
 ```yaml
 - name: Enforce approved HTTP ports only
-  ansible.platform.http_port:
+  ansible.platform.http_ports:
     port: 443
     state: enforced
   loop: "{{ approved_ports }}"
diff --git a/docs/04-data-model-transformation.md b/docs/04-data-model-transformation.md
index 0f0ece0e..e6fd1bea 100644
--- a/docs/04-data-model-transformation.md
+++ b/docs/04-data-model-transformation.md
@@ -40,7 +40,7 @@ place where version-specific and resource-specific logic lives.
 
 ### Concrete Example: User Create (`state: merged`)
 
-The same data as it appears at each tier for `ansible.platform.user`:
+The same data as it appears at each tier for `ansible.platform.users`:
 
 **Tier 1 — what the playbook author writes:**
 ```yaml
diff --git a/docs/07-adding-resources.md b/docs/07-adding-resources.md
index 12b8c557..ff8a39dd 100644
--- a/docs/07-adding-resources.md
+++ b/docs/07-adding-resources.md
@@ -96,7 +96,7 @@ extends_documentation_fragment:
 
 EXAMPLES = """
 - name: Create user resources (merged)
-  ansible.platform.user:
+  ansible.platform.users:
     config:
       - username: "alice"
         email: "alice@example.com"
@@ -107,18 +107,18 @@ EXAMPLES = """
     state: merged
 
 - name: Gather current user state
-  ansible.platform.user:
+  ansible.platform.users:
     state: gathered
   register: result
 
 - name: Delete specific user resources
-  ansible.platform.user:
+  ansible.platform.users:
     config:
       - username: "alice"
     state: deleted
 
 - name: Override — ensure only these user resources exist
-  ansible.platform.user:
+  ansible.platform.users:
     config:
       - username: "alice"
         email: "alice@example.com"
@@ -126,7 +126,7 @@ EXAMPLES = """
 """
 ```
 
-**Quality check**: Run `ansible-doc -t module ansible.platform.user`
+**Quality check**: Run `ansible-doc -t module ansible.platform.users`
 and verify all options render correctly.
 
 Expected `ansible-doc` output:
diff --git a/docs/08-testing-strategy.md b/docs/08-testing-strategy.md
index 1754077a..1527b0e5 100644
--- a/docs/08-testing-strategy.md
+++ b/docs/08-testing-strategy.md
@@ -167,7 +167,7 @@ All mock scenarios follow the resource module pattern. Here is the **actual
   tasks:
     # ── 1. Create ───────────────────────────────────────────────────────────
     - name: Create user (connection local)
-      ansible.platform.user:
+      ansible.platform.users:
         config:
           - username: "{{ molecule_username }}"
             first_name: Molecule
@@ -191,7 +191,7 @@ All mock scenarios follow the resource module pattern. Here is the **actual
 
     # ── 2. Idempotency (no change) ──────────────────────────────────────────
     - name: Run again idempotency (connection local)
-      ansible.platform.user:
+      ansible.platform.users:
         config:
           - username: "{{ molecule_username }}"
             first_name: Molecule
@@ -209,7 +209,7 @@ All mock scenarios follow the resource module pattern. Here is the **actual
 
     # ── 3. Update ───────────────────────────────────────────────────────────
     - name: Update user email and last_name (connection local)
-      ansible.platform.user:
+      ansible.platform.users:
         config:
           - username: "{{ molecule_username }}"
             last_name: UpdatedUser
@@ -225,7 +225,7 @@ All mock scenarios follow the resource module pattern. Here is the **actual
 
     # ── 4. Gathered (read-only) ─────────────────────────────────────────────
     - name: Check user exists (state gathered)
-      ansible.platform.user:
+      ansible.platform.users:
         config:
           - username: "{{ molecule_username }}"
         state: gathered
@@ -241,7 +241,7 @@ All mock scenarios follow the resource module pattern. Here is the **actual
 
     # ── 5. Delete ───────────────────────────────────────────────────────────
     - name: Delete user (connection local)
-      ansible.platform.user:
+      ansible.platform.users:
         config:
           - username: "{{ molecule_username }}"
         state: deleted
@@ -255,7 +255,7 @@ All mock scenarios follow the resource module pattern. Here is the **actual
 
     # ── 6. Delete idempotency ───────────────────────────────────────────────
     - name: Delete again (idempotency)
-      ansible.platform.user:
+      ansible.platform.users:
         config:
           - username: "{{ molecule_username }}"
         state: deleted
@@ -593,7 +593,7 @@ Each integration test target follows this sequence:
 1. **Pre-cleanup**: Delete any resources left over from previous failed runs
    ```yaml
    - name: Delete test user if exists (pre-cleanup)
-     ansible.platform.user:
+     ansible.platform.users:
        username: "test-{{ test_id }}"
        state: absent
      failed_when: false
diff --git a/extensions/molecule/application/check/cleanup.yml b/extensions/molecule/application/check/cleanup.yml
deleted file mode 100644
index ca20cb7b..00000000
--- a/extensions/molecule/application/check/cleanup.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Cleanup — application (check)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove int-app-alpha (test teardown)
-      ansible.platform.application:
-        config:
-          - name: "int-app-alpha"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/application/check/converge.yml b/extensions/molecule/application/check/converge.yml
deleted file mode 100644
index c405362d..00000000
--- a/extensions/molecule/application/check/converge.yml
+++ /dev/null
@@ -1,36 +0,0 @@
----
-- name: "Converge — application (check)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.application with state=merged
-      ansible.platform.application:
-        config:
-          - "{{ expected_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      check_mode: true
-      diff: true
-      register: result
-
-    - name: Assert check mode predicted a change
-      ansible.builtin.assert:
-        that:
-          - result.changed == true
-          - result.before is defined
-          - result.after is defined
-        fail_msg: "check mode should predict a change. got={{ result }}"
-
-    - name: Assert diff output is present
-      ansible.builtin.assert:
-        that:
-          - result.diff is defined
-        fail_msg: "diff output missing from check result"
-      when: result.diff is defined
-
-...
diff --git a/extensions/molecule/application/check/prepare.yml b/extensions/molecule/application/check/prepare.yml
deleted file mode 100644
index 25dbdffc..00000000
--- a/extensions/molecule/application/check/prepare.yml
+++ /dev/null
@@ -1,18 +0,0 @@
----
-- name: "Prepare — application (check)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed application as check-mode baseline (prerequisite for check)
-      ansible.platform.application:
-        config:
-          - "{{ prepare_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/application/check/verify.yml b/extensions/molecule/application/check/verify.yml
deleted file mode 100644
index 2e6da01a..00000000
--- a/extensions/molecule/application/check/verify.yml
+++ /dev/null
@@ -1,27 +0,0 @@
----
-- name: "Verify — application (check)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather application (check mode must not have applied changes)
-      ansible.platform.application:
-        config:
-          - name: "{{ expected_config.name }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert int-app-alpha still has prepare_config values (check did not apply)
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length > 0
-          - (gathered.gathered | first).description == prepare_config.description
-        fail_msg: "check mode should not alter resource. got: {{ gathered.gathered }}"
-
-...
diff --git a/extensions/molecule/application/deleted/cleanup.yml b/extensions/molecule/application/deleted/cleanup.yml
deleted file mode 100644
index cb1aea52..00000000
--- a/extensions/molecule/application/deleted/cleanup.yml
+++ /dev/null
@@ -1,12 +0,0 @@
----
-- name: "Cleanup — application (deleted)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: No-op — int-app-alpha already deleted by converge
-      ansible.builtin.debug:
-        msg: "int-app-alpha was deleted in converge — nothing to clean up"
-
-...
diff --git a/extensions/molecule/application/deleted/converge.yml b/extensions/molecule/application/deleted/converge.yml
deleted file mode 100644
index 9b7dde28..00000000
--- a/extensions/molecule/application/deleted/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — application (deleted)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.application with state=deleted
-      ansible.platform.application:
-        config:
-          - "{{ expected_config }}"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/application/deleted/prepare.yml b/extensions/molecule/application/deleted/prepare.yml
deleted file mode 100644
index 88dd860f..00000000
--- a/extensions/molecule/application/deleted/prepare.yml
+++ /dev/null
@@ -1,18 +0,0 @@
----
-- name: "Prepare — application (deleted)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed application to be deleted (prerequisite for deleted)
-      ansible.platform.application:
-        config:
-          - "{{ prepare_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/application/deleted/verify.yml b/extensions/molecule/application/deleted/verify.yml
deleted file mode 100644
index 29f84f63..00000000
--- a/extensions/molecule/application/deleted/verify.yml
+++ /dev/null
@@ -1,26 +0,0 @@
----
-- name: "Verify — application (deleted)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather application (should be absent after deleted)
-      ansible.platform.application:
-        config:
-          - name: "int-app-alpha"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert int-app-alpha no longer exists (deleted)
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length == 0
-        fail_msg: "Expected empty after deleted, got: {{ gathered.gathered }}"
-
-...
diff --git a/extensions/molecule/application/gathered/cleanup.yml b/extensions/molecule/application/gathered/cleanup.yml
deleted file mode 100644
index 7af42549..00000000
--- a/extensions/molecule/application/gathered/cleanup.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Cleanup — application (gathered)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove int-app-alpha (test teardown)
-      ansible.platform.application:
-        config:
-          - name: "int-app-alpha"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/application/gathered/converge.yml b/extensions/molecule/application/gathered/converge.yml
deleted file mode 100644
index 1816e8ad..00000000
--- a/extensions/molecule/application/gathered/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — application (gathered)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.application with state=gathered
-      ansible.platform.application:
-        config:
-          - "{{ expected_config }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/application/gathered/prepare.yml b/extensions/molecule/application/gathered/prepare.yml
deleted file mode 100644
index 5d22e775..00000000
--- a/extensions/molecule/application/gathered/prepare.yml
+++ /dev/null
@@ -1,18 +0,0 @@
----
-- name: "Prepare — application (gathered)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed application to be gathered (prerequisite for gathered)
-      ansible.platform.application:
-        config:
-          - "{{ prepare_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/application/gathered/verify.yml b/extensions/molecule/application/gathered/verify.yml
deleted file mode 100644
index 4f2bad1b..00000000
--- a/extensions/molecule/application/gathered/verify.yml
+++ /dev/null
@@ -1,26 +0,0 @@
----
-- name: "Verify — application (gathered)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather application (assert present after gathered)
-      ansible.platform.application:
-        config:
-          - name: "{{ expected_config.name }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert configuration exists after gathered
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length > 0
-        fail_msg: "Expected resource after gathered. got: {{ gathered.gathered }}"
-
-...
diff --git a/extensions/molecule/application/merged/cleanup.yml b/extensions/molecule/application/merged/cleanup.yml
deleted file mode 100644
index 2a02d6d3..00000000
--- a/extensions/molecule/application/merged/cleanup.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Cleanup — application (merged)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove int-app-alpha (test teardown)
-      ansible.platform.application:
-        config:
-          - name: "int-app-alpha"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/application/merged/converge.yml b/extensions/molecule/application/merged/converge.yml
deleted file mode 100644
index 98b2f4cf..00000000
--- a/extensions/molecule/application/merged/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — application (merged)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.application with state=merged
-      ansible.platform.application:
-        config:
-          - "{{ expected_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/application/merged/verify.yml b/extensions/molecule/application/merged/verify.yml
deleted file mode 100644
index 099141b7..00000000
--- a/extensions/molecule/application/merged/verify.yml
+++ /dev/null
@@ -1,26 +0,0 @@
----
-- name: "Verify — application (merged)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather application (assert present after merged)
-      ansible.platform.application:
-        config:
-          - name: "{{ expected_config.name }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert configuration exists after merged
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length > 0
-        fail_msg: "Expected resource after merged. got: {{ gathered.gathered }}"
-
-...
diff --git a/extensions/molecule/application/overridden/cleanup.yml b/extensions/molecule/application/overridden/cleanup.yml
deleted file mode 100644
index fdb0823c..00000000
--- a/extensions/molecule/application/overridden/cleanup.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Cleanup — application (overridden)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove int-app-alpha (test teardown)
-      ansible.platform.application:
-        config:
-          - name: "int-app-alpha"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/application/overridden/converge.yml b/extensions/molecule/application/overridden/converge.yml
deleted file mode 100644
index cfe10c3b..00000000
--- a/extensions/molecule/application/overridden/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — application (overridden)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.application with state=overridden
-      ansible.platform.application:
-        config:
-          - "{{ expected_config }}"
-        state: overridden
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/application/overridden/prepare.yml b/extensions/molecule/application/overridden/prepare.yml
deleted file mode 100644
index 219ba64a..00000000
--- a/extensions/molecule/application/overridden/prepare.yml
+++ /dev/null
@@ -1,17 +0,0 @@
----
-- name: "Prepare — application (overridden)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed prerequisite resources via merged (r0 + r1 + extras for overridden)
-      ansible.platform.application:
-        config: "{{ prepare_configs }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/application/overridden/verify.yml b/extensions/molecule/application/overridden/verify.yml
deleted file mode 100644
index 42b251d6..00000000
--- a/extensions/molecule/application/overridden/verify.yml
+++ /dev/null
@@ -1,31 +0,0 @@
----
-- name: "Verify — application (overridden)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather all application resources (verify overridden final state)
-      ansible.platform.application:
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered_all
-
-    - name: Assert int-app-alpha still exists after overridden
-      ansible.builtin.assert:
-        that:
-          - gathered_all.gathered is defined
-          - gathered_all.gathered | selectattr("name", "equalto", "int-app-alpha") | list | length == 1
-        fail_msg: "Expected int-app-alpha to exist after overridden. got: {{ gathered_all.gathered }}"
-
-    - name: Assert int-app-beta was deleted by overridden (not in desired config)
-      ansible.builtin.assert:
-        that:
-          - gathered_all.gathered is defined
-          - gathered_all.gathered | selectattr("name", "equalto", "int-app-beta") | list | length == 0
-        fail_msg: "overridden should have deleted int-app-beta. got: {{ gathered_all.gathered }}"
-
-...
diff --git a/extensions/molecule/application/replaced/cleanup.yml b/extensions/molecule/application/replaced/cleanup.yml
deleted file mode 100644
index 3573b35b..00000000
--- a/extensions/molecule/application/replaced/cleanup.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Cleanup — application (replaced)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove int-app-alpha (test teardown)
-      ansible.platform.application:
-        config:
-          - name: "int-app-alpha"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/application/replaced/converge.yml b/extensions/molecule/application/replaced/converge.yml
deleted file mode 100644
index 7786a46d..00000000
--- a/extensions/molecule/application/replaced/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — application (replaced)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.application with state=replaced
-      ansible.platform.application:
-        config:
-          - "{{ expected_config }}"
-        state: replaced
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/application/replaced/prepare.yml b/extensions/molecule/application/replaced/prepare.yml
deleted file mode 100644
index c7ff2740..00000000
--- a/extensions/molecule/application/replaced/prepare.yml
+++ /dev/null
@@ -1,18 +0,0 @@
----
-- name: "Prepare — application (replaced)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed application to be replaced (prerequisite for replaced)
-      ansible.platform.application:
-        config:
-          - "{{ prepare_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/application/replaced/verify.yml b/extensions/molecule/application/replaced/verify.yml
deleted file mode 100644
index 1bdf1696..00000000
--- a/extensions/molecule/application/replaced/verify.yml
+++ /dev/null
@@ -1,32 +0,0 @@
----
-- name: "Verify — application (replaced)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather application (assert present after replaced)
-      ansible.platform.application:
-        config:
-          - name: "{{ expected_config.name }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert configuration exists after replaced
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length > 0
-        fail_msg: "Expected resource after replaced. got: {{ gathered.gathered }}"
-
-    - name: Assert description was updated by replaced
-      ansible.builtin.assert:
-        that:
-          - (gathered.gathered | first).description == expected_config.description
-        fail_msg: "replaced should have set description='Alpha application replaced'. got: {{ (gathered.gathered | first).description }}"
-
-...
diff --git a/extensions/molecule/applications/check/cleanup.yml b/extensions/molecule/applications/check/cleanup.yml
new file mode 100644
index 00000000..14741377
--- /dev/null
+++ b/extensions/molecule/applications/check/cleanup.yml
@@ -0,0 +1,19 @@
+---
+- name: "Cleanup — applications (check)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove int-app-alpha (test teardown)
+      ansible.platform.applications:
+        config:
+          - name: "int-app-alpha"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/applications/check/converge.yml b/extensions/molecule/applications/check/converge.yml
new file mode 100644
index 00000000..81c9ac03
--- /dev/null
+++ b/extensions/molecule/applications/check/converge.yml
@@ -0,0 +1,36 @@
+---
+- name: "Converge — applications (check)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.applications with state=merged
+      ansible.platform.applications:
+        config:
+          - "{{ expected_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      check_mode: true
+      diff: true
+      register: result
+
+    - name: Assert check mode predicted a change
+      ansible.builtin.assert:
+        that:
+          - result.changed == true
+          - result.before is defined
+          - result.after is defined
+        fail_msg: "check mode should predict a change. got={{ result }}"
+
+    - name: Assert diff output is present
+      ansible.builtin.assert:
+        that:
+          - result.diff is defined
+        fail_msg: "diff output missing from check result"
+      when: result.diff is defined
+
+...
diff --git a/extensions/molecule/application/check/molecule.yml b/extensions/molecule/applications/check/molecule.yml
similarity index 100%
rename from extensions/molecule/application/check/molecule.yml
rename to extensions/molecule/applications/check/molecule.yml
diff --git a/extensions/molecule/applications/check/prepare.yml b/extensions/molecule/applications/check/prepare.yml
new file mode 100644
index 00000000..18661b77
--- /dev/null
+++ b/extensions/molecule/applications/check/prepare.yml
@@ -0,0 +1,18 @@
+---
+- name: "Prepare — applications (check)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed applications as check-mode baseline (prerequisite for check)
+      ansible.platform.applications:
+        config:
+          - "{{ prepare_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/application/check/vars.yml b/extensions/molecule/applications/check/vars.yml
similarity index 100%
rename from extensions/molecule/application/check/vars.yml
rename to extensions/molecule/applications/check/vars.yml
diff --git a/extensions/molecule/applications/check/verify.yml b/extensions/molecule/applications/check/verify.yml
new file mode 100644
index 00000000..d2d58e35
--- /dev/null
+++ b/extensions/molecule/applications/check/verify.yml
@@ -0,0 +1,27 @@
+---
+- name: "Verify — applications (check)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather applications (check mode must not have applied changes)
+      ansible.platform.applications:
+        config:
+          - name: "{{ expected_config.name }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert int-app-alpha still has prepare_config values (check did not apply)
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length > 0
+          - (gathered.gathered | first).description == prepare_config.description
+        fail_msg: "check mode should not alter resource. got: {{ gathered.gathered }}"
+
+...
diff --git a/extensions/molecule/applications/deleted/cleanup.yml b/extensions/molecule/applications/deleted/cleanup.yml
new file mode 100644
index 00000000..13201812
--- /dev/null
+++ b/extensions/molecule/applications/deleted/cleanup.yml
@@ -0,0 +1,12 @@
+---
+- name: "Cleanup — applications (deleted)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: No-op — int-app-alpha already deleted by converge
+      ansible.builtin.debug:
+        msg: "int-app-alpha was deleted in converge — nothing to clean up"
+
+...
diff --git a/extensions/molecule/applications/deleted/converge.yml b/extensions/molecule/applications/deleted/converge.yml
new file mode 100644
index 00000000..e68a33d2
--- /dev/null
+++ b/extensions/molecule/applications/deleted/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — applications (deleted)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.applications with state=deleted
+      ansible.platform.applications:
+        config:
+          - "{{ expected_config }}"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/application/deleted/molecule.yml b/extensions/molecule/applications/deleted/molecule.yml
similarity index 100%
rename from extensions/molecule/application/deleted/molecule.yml
rename to extensions/molecule/applications/deleted/molecule.yml
diff --git a/extensions/molecule/applications/deleted/prepare.yml b/extensions/molecule/applications/deleted/prepare.yml
new file mode 100644
index 00000000..dd58b597
--- /dev/null
+++ b/extensions/molecule/applications/deleted/prepare.yml
@@ -0,0 +1,18 @@
+---
+- name: "Prepare — applications (deleted)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed applications to be deleted (prerequisite for deleted)
+      ansible.platform.applications:
+        config:
+          - "{{ prepare_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/application/deleted/vars.yml b/extensions/molecule/applications/deleted/vars.yml
similarity index 100%
rename from extensions/molecule/application/deleted/vars.yml
rename to extensions/molecule/applications/deleted/vars.yml
diff --git a/extensions/molecule/applications/deleted/verify.yml b/extensions/molecule/applications/deleted/verify.yml
new file mode 100644
index 00000000..e9b0e3d9
--- /dev/null
+++ b/extensions/molecule/applications/deleted/verify.yml
@@ -0,0 +1,26 @@
+---
+- name: "Verify — applications (deleted)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather applications (should be absent after deleted)
+      ansible.platform.applications:
+        config:
+          - name: "int-app-alpha"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert int-app-alpha no longer exists (deleted)
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length == 0
+        fail_msg: "Expected empty after deleted, got: {{ gathered.gathered }}"
+
+...
diff --git a/extensions/molecule/applications/gathered/cleanup.yml b/extensions/molecule/applications/gathered/cleanup.yml
new file mode 100644
index 00000000..32c898e6
--- /dev/null
+++ b/extensions/molecule/applications/gathered/cleanup.yml
@@ -0,0 +1,19 @@
+---
+- name: "Cleanup — applications (gathered)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove int-app-alpha (test teardown)
+      ansible.platform.applications:
+        config:
+          - name: "int-app-alpha"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/applications/gathered/converge.yml b/extensions/molecule/applications/gathered/converge.yml
new file mode 100644
index 00000000..10b5ef07
--- /dev/null
+++ b/extensions/molecule/applications/gathered/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — applications (gathered)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.applications with state=gathered
+      ansible.platform.applications:
+        config:
+          - "{{ expected_config }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/application/gathered/molecule.yml b/extensions/molecule/applications/gathered/molecule.yml
similarity index 100%
rename from extensions/molecule/application/gathered/molecule.yml
rename to extensions/molecule/applications/gathered/molecule.yml
diff --git a/extensions/molecule/applications/gathered/prepare.yml b/extensions/molecule/applications/gathered/prepare.yml
new file mode 100644
index 00000000..4984e7e9
--- /dev/null
+++ b/extensions/molecule/applications/gathered/prepare.yml
@@ -0,0 +1,18 @@
+---
+- name: "Prepare — applications (gathered)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed applications to be gathered (prerequisite for gathered)
+      ansible.platform.applications:
+        config:
+          - "{{ prepare_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/application/gathered/vars.yml b/extensions/molecule/applications/gathered/vars.yml
similarity index 100%
rename from extensions/molecule/application/gathered/vars.yml
rename to extensions/molecule/applications/gathered/vars.yml
diff --git a/extensions/molecule/applications/gathered/verify.yml b/extensions/molecule/applications/gathered/verify.yml
new file mode 100644
index 00000000..654ca3ec
--- /dev/null
+++ b/extensions/molecule/applications/gathered/verify.yml
@@ -0,0 +1,26 @@
+---
+- name: "Verify — applications (gathered)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather applications (assert present after gathered)
+      ansible.platform.applications:
+        config:
+          - name: "{{ expected_config.name }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert configuration exists after gathered
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length > 0
+        fail_msg: "Expected resource after gathered. got: {{ gathered.gathered }}"
+
+...
diff --git a/extensions/molecule/application/inventory.yml b/extensions/molecule/applications/inventory.yml
similarity index 100%
rename from extensions/molecule/application/inventory.yml
rename to extensions/molecule/applications/inventory.yml
diff --git a/extensions/molecule/applications/merged/cleanup.yml b/extensions/molecule/applications/merged/cleanup.yml
new file mode 100644
index 00000000..c9964d5b
--- /dev/null
+++ b/extensions/molecule/applications/merged/cleanup.yml
@@ -0,0 +1,19 @@
+---
+- name: "Cleanup — applications (merged)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove int-app-alpha (test teardown)
+      ansible.platform.applications:
+        config:
+          - name: "int-app-alpha"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/applications/merged/converge.yml b/extensions/molecule/applications/merged/converge.yml
new file mode 100644
index 00000000..0c8b64f1
--- /dev/null
+++ b/extensions/molecule/applications/merged/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — applications (merged)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.applications with state=merged
+      ansible.platform.applications:
+        config:
+          - "{{ expected_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/application/merged/molecule.yml b/extensions/molecule/applications/merged/molecule.yml
similarity index 100%
rename from extensions/molecule/application/merged/molecule.yml
rename to extensions/molecule/applications/merged/molecule.yml
diff --git a/extensions/molecule/application/merged/vars.yml b/extensions/molecule/applications/merged/vars.yml
similarity index 100%
rename from extensions/molecule/application/merged/vars.yml
rename to extensions/molecule/applications/merged/vars.yml
diff --git a/extensions/molecule/applications/merged/verify.yml b/extensions/molecule/applications/merged/verify.yml
new file mode 100644
index 00000000..394e4dd7
--- /dev/null
+++ b/extensions/molecule/applications/merged/verify.yml
@@ -0,0 +1,26 @@
+---
+- name: "Verify — applications (merged)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather applications (assert present after merged)
+      ansible.platform.applications:
+        config:
+          - name: "{{ expected_config.name }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert configuration exists after merged
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length > 0
+        fail_msg: "Expected resource after merged. got: {{ gathered.gathered }}"
+
+...
diff --git a/extensions/molecule/applications/overridden/cleanup.yml b/extensions/molecule/applications/overridden/cleanup.yml
new file mode 100644
index 00000000..9253531d
--- /dev/null
+++ b/extensions/molecule/applications/overridden/cleanup.yml
@@ -0,0 +1,19 @@
+---
+- name: "Cleanup — applications (overridden)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove int-app-alpha (test teardown)
+      ansible.platform.applications:
+        config:
+          - name: "int-app-alpha"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/applications/overridden/converge.yml b/extensions/molecule/applications/overridden/converge.yml
new file mode 100644
index 00000000..f0ba75c6
--- /dev/null
+++ b/extensions/molecule/applications/overridden/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — applications (overridden)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.applications with state=overridden
+      ansible.platform.applications:
+        config:
+          - "{{ expected_config }}"
+        state: overridden
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/application/overridden/molecule.yml b/extensions/molecule/applications/overridden/molecule.yml
similarity index 100%
rename from extensions/molecule/application/overridden/molecule.yml
rename to extensions/molecule/applications/overridden/molecule.yml
diff --git a/extensions/molecule/applications/overridden/prepare.yml b/extensions/molecule/applications/overridden/prepare.yml
new file mode 100644
index 00000000..c148c5dd
--- /dev/null
+++ b/extensions/molecule/applications/overridden/prepare.yml
@@ -0,0 +1,17 @@
+---
+- name: "Prepare — applications (overridden)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed prerequisite resources via merged (r0 + r1 + extras for overridden)
+      ansible.platform.applications:
+        config: "{{ prepare_configs }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/application/overridden/vars.yml b/extensions/molecule/applications/overridden/vars.yml
similarity index 100%
rename from extensions/molecule/application/overridden/vars.yml
rename to extensions/molecule/applications/overridden/vars.yml
diff --git a/extensions/molecule/applications/overridden/verify.yml b/extensions/molecule/applications/overridden/verify.yml
new file mode 100644
index 00000000..dbc8466b
--- /dev/null
+++ b/extensions/molecule/applications/overridden/verify.yml
@@ -0,0 +1,31 @@
+---
+- name: "Verify — applications (overridden)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather all applications resources (verify overridden final state)
+      ansible.platform.applications:
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered_all
+
+    - name: Assert int-app-alpha still exists after overridden
+      ansible.builtin.assert:
+        that:
+          - gathered_all.gathered is defined
+          - gathered_all.gathered | selectattr("name", "equalto", "int-app-alpha") | list | length == 1
+        fail_msg: "Expected int-app-alpha to exist after overridden. got: {{ gathered_all.gathered }}"
+
+    - name: Assert int-app-beta was deleted by overridden (not in desired config)
+      ansible.builtin.assert:
+        that:
+          - gathered_all.gathered is defined
+          - gathered_all.gathered | selectattr("name", "equalto", "int-app-beta") | list | length == 0
+        fail_msg: "overridden should have deleted int-app-beta. got: {{ gathered_all.gathered }}"
+
+...
diff --git a/extensions/molecule/applications/replaced/cleanup.yml b/extensions/molecule/applications/replaced/cleanup.yml
new file mode 100644
index 00000000..b12b8fb0
--- /dev/null
+++ b/extensions/molecule/applications/replaced/cleanup.yml
@@ -0,0 +1,19 @@
+---
+- name: "Cleanup — applications (replaced)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove int-app-alpha (test teardown)
+      ansible.platform.applications:
+        config:
+          - name: "int-app-alpha"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/applications/replaced/converge.yml b/extensions/molecule/applications/replaced/converge.yml
new file mode 100644
index 00000000..fc445fc1
--- /dev/null
+++ b/extensions/molecule/applications/replaced/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — applications (replaced)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.applications with state=replaced
+      ansible.platform.applications:
+        config:
+          - "{{ expected_config }}"
+        state: replaced
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/application/replaced/molecule.yml b/extensions/molecule/applications/replaced/molecule.yml
similarity index 100%
rename from extensions/molecule/application/replaced/molecule.yml
rename to extensions/molecule/applications/replaced/molecule.yml
diff --git a/extensions/molecule/applications/replaced/prepare.yml b/extensions/molecule/applications/replaced/prepare.yml
new file mode 100644
index 00000000..4f66d590
--- /dev/null
+++ b/extensions/molecule/applications/replaced/prepare.yml
@@ -0,0 +1,18 @@
+---
+- name: "Prepare — applications (replaced)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed applications to be replaced (prerequisite for replaced)
+      ansible.platform.applications:
+        config:
+          - "{{ prepare_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/application/replaced/vars.yml b/extensions/molecule/applications/replaced/vars.yml
similarity index 100%
rename from extensions/molecule/application/replaced/vars.yml
rename to extensions/molecule/applications/replaced/vars.yml
diff --git a/extensions/molecule/applications/replaced/verify.yml b/extensions/molecule/applications/replaced/verify.yml
new file mode 100644
index 00000000..fc556219
--- /dev/null
+++ b/extensions/molecule/applications/replaced/verify.yml
@@ -0,0 +1,32 @@
+---
+- name: "Verify — applications (replaced)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather applications (assert present after replaced)
+      ansible.platform.applications:
+        config:
+          - name: "{{ expected_config.name }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert configuration exists after replaced
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length > 0
+        fail_msg: "Expected resource after replaced. got: {{ gathered.gathered }}"
+
+    - name: Assert description was updated by replaced
+      ansible.builtin.assert:
+        that:
+          - (gathered.gathered | first).description == expected_config.description
+        fail_msg: "replaced should have set description='Alpha application replaced'. got: {{ (gathered.gathered | first).description }}"
+
+...
diff --git a/extensions/molecule/authenticator/check/cleanup.yml b/extensions/molecule/authenticator/check/cleanup.yml
deleted file mode 100644
index dbed40b8..00000000
--- a/extensions/molecule/authenticator/check/cleanup.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Cleanup — authenticator (check)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove int-auth-alpha (test teardown)
-      ansible.platform.authenticator:
-        config:
-          - name: "int-auth-alpha"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/authenticator/check/converge.yml b/extensions/molecule/authenticator/check/converge.yml
deleted file mode 100644
index 8e2a48d7..00000000
--- a/extensions/molecule/authenticator/check/converge.yml
+++ /dev/null
@@ -1,36 +0,0 @@
----
-- name: "Converge — authenticator (check)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.authenticator with state=merged
-      ansible.platform.authenticator:
-        config:
-          - "{{ expected_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      check_mode: true
-      diff: true
-      register: result
-
-    - name: Assert check mode predicted a change
-      ansible.builtin.assert:
-        that:
-          - result.changed == true
-          - result.before is defined
-          - result.after is defined
-        fail_msg: "check mode should predict a change. got={{ result }}"
-
-    - name: Assert diff output is present
-      ansible.builtin.assert:
-        that:
-          - result.diff is defined
-        fail_msg: "diff output missing from check result"
-      when: result.diff is defined
-
-...
diff --git a/extensions/molecule/authenticator/check/prepare.yml b/extensions/molecule/authenticator/check/prepare.yml
deleted file mode 100644
index 570dc95a..00000000
--- a/extensions/molecule/authenticator/check/prepare.yml
+++ /dev/null
@@ -1,18 +0,0 @@
----
-- name: "Prepare — authenticator (check)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed authenticator as check-mode baseline (prerequisite for check)
-      ansible.platform.authenticator:
-        config:
-          - "{{ prepare_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/authenticator/check/verify.yml b/extensions/molecule/authenticator/check/verify.yml
deleted file mode 100644
index 8288039d..00000000
--- a/extensions/molecule/authenticator/check/verify.yml
+++ /dev/null
@@ -1,27 +0,0 @@
----
-- name: "Verify — authenticator (check)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather authenticator (check mode must not have applied changes)
-      ansible.platform.authenticator:
-        config:
-          - name: "{{ expected_config.name }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert int-auth-alpha still has prepare_config values (check did not apply)
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length > 0
-          - (gathered.gathered | first).enabled == prepare_config.enabled
-        fail_msg: "check mode should not alter resource. got: {{ gathered.gathered }}"
-
-...
diff --git a/extensions/molecule/authenticator/deleted/cleanup.yml b/extensions/molecule/authenticator/deleted/cleanup.yml
deleted file mode 100644
index 30807568..00000000
--- a/extensions/molecule/authenticator/deleted/cleanup.yml
+++ /dev/null
@@ -1,12 +0,0 @@
----
-- name: "Cleanup — authenticator (deleted)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: No-op — int-auth-alpha already deleted by converge
-      ansible.builtin.debug:
-        msg: "int-auth-alpha was deleted in converge — nothing to clean up"
-
-...
diff --git a/extensions/molecule/authenticator/deleted/converge.yml b/extensions/molecule/authenticator/deleted/converge.yml
deleted file mode 100644
index 55bf99bd..00000000
--- a/extensions/molecule/authenticator/deleted/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — authenticator (deleted)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.authenticator with state=deleted
-      ansible.platform.authenticator:
-        config:
-          - "{{ expected_config }}"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/authenticator/deleted/prepare.yml b/extensions/molecule/authenticator/deleted/prepare.yml
deleted file mode 100644
index 4dcae323..00000000
--- a/extensions/molecule/authenticator/deleted/prepare.yml
+++ /dev/null
@@ -1,18 +0,0 @@
----
-- name: "Prepare — authenticator (deleted)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed authenticator to be deleted (prerequisite for deleted)
-      ansible.platform.authenticator:
-        config:
-          - "{{ prepare_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/authenticator/deleted/verify.yml b/extensions/molecule/authenticator/deleted/verify.yml
deleted file mode 100644
index 129f9c77..00000000
--- a/extensions/molecule/authenticator/deleted/verify.yml
+++ /dev/null
@@ -1,26 +0,0 @@
----
-- name: "Verify — authenticator (deleted)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather authenticator (should be absent after deleted)
-      ansible.platform.authenticator:
-        config:
-          - name: "int-auth-alpha"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert int-auth-alpha no longer exists (deleted)
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length == 0
-        fail_msg: "Expected empty after deleted, got: {{ gathered.gathered }}"
-
-...
diff --git a/extensions/molecule/authenticator/gathered/cleanup.yml b/extensions/molecule/authenticator/gathered/cleanup.yml
deleted file mode 100644
index d6d449cd..00000000
--- a/extensions/molecule/authenticator/gathered/cleanup.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Cleanup — authenticator (gathered)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove int-auth-alpha (test teardown)
-      ansible.platform.authenticator:
-        config:
-          - name: "int-auth-alpha"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/authenticator/gathered/converge.yml b/extensions/molecule/authenticator/gathered/converge.yml
deleted file mode 100644
index 42302d78..00000000
--- a/extensions/molecule/authenticator/gathered/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — authenticator (gathered)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.authenticator with state=gathered
-      ansible.platform.authenticator:
-        config:
-          - "{{ expected_config }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/authenticator/gathered/prepare.yml b/extensions/molecule/authenticator/gathered/prepare.yml
deleted file mode 100644
index 27507172..00000000
--- a/extensions/molecule/authenticator/gathered/prepare.yml
+++ /dev/null
@@ -1,18 +0,0 @@
----
-- name: "Prepare — authenticator (gathered)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed authenticator to be gathered (prerequisite for gathered)
-      ansible.platform.authenticator:
-        config:
-          - "{{ prepare_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/authenticator/gathered/verify.yml b/extensions/molecule/authenticator/gathered/verify.yml
deleted file mode 100644
index ce4b6408..00000000
--- a/extensions/molecule/authenticator/gathered/verify.yml
+++ /dev/null
@@ -1,26 +0,0 @@
----
-- name: "Verify — authenticator (gathered)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather authenticator (assert present after gathered)
-      ansible.platform.authenticator:
-        config:
-          - name: "{{ expected_config.name }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert configuration exists after gathered
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length > 0
-        fail_msg: "Expected resource after gathered. got: {{ gathered.gathered }}"
-
-...
diff --git a/extensions/molecule/authenticator/merged/cleanup.yml b/extensions/molecule/authenticator/merged/cleanup.yml
deleted file mode 100644
index de1cb5f5..00000000
--- a/extensions/molecule/authenticator/merged/cleanup.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Cleanup — authenticator (merged)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove int-auth-alpha (test teardown)
-      ansible.platform.authenticator:
-        config:
-          - name: "int-auth-alpha"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/authenticator/merged/converge.yml b/extensions/molecule/authenticator/merged/converge.yml
deleted file mode 100644
index 6aa81656..00000000
--- a/extensions/molecule/authenticator/merged/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — authenticator (merged)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.authenticator with state=merged
-      ansible.platform.authenticator:
-        config:
-          - "{{ expected_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/authenticator/merged/verify.yml b/extensions/molecule/authenticator/merged/verify.yml
deleted file mode 100644
index cbe3897c..00000000
--- a/extensions/molecule/authenticator/merged/verify.yml
+++ /dev/null
@@ -1,26 +0,0 @@
----
-- name: "Verify — authenticator (merged)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather authenticator (assert present after merged)
-      ansible.platform.authenticator:
-        config:
-          - name: "{{ expected_config.name }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert configuration exists after merged
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length > 0
-        fail_msg: "Expected resource after merged. got: {{ gathered.gathered }}"
-
-...
diff --git a/extensions/molecule/authenticator/overridden/cleanup.yml b/extensions/molecule/authenticator/overridden/cleanup.yml
deleted file mode 100644
index 855e04e1..00000000
--- a/extensions/molecule/authenticator/overridden/cleanup.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Cleanup — authenticator (overridden)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove int-auth-alpha (test teardown)
-      ansible.platform.authenticator:
-        config:
-          - name: "int-auth-alpha"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/authenticator/overridden/converge.yml b/extensions/molecule/authenticator/overridden/converge.yml
deleted file mode 100644
index db35db1e..00000000
--- a/extensions/molecule/authenticator/overridden/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — authenticator (overridden)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.authenticator with state=overridden
-      ansible.platform.authenticator:
-        config:
-          - "{{ expected_config }}"
-        state: overridden
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/authenticator/overridden/prepare.yml b/extensions/molecule/authenticator/overridden/prepare.yml
deleted file mode 100644
index 7c30d367..00000000
--- a/extensions/molecule/authenticator/overridden/prepare.yml
+++ /dev/null
@@ -1,17 +0,0 @@
----
-- name: "Prepare — authenticator (overridden)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed prerequisite resources via merged (r0 + r1 + extras for overridden)
-      ansible.platform.authenticator:
-        config: "{{ prepare_configs }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/authenticator/overridden/verify.yml b/extensions/molecule/authenticator/overridden/verify.yml
deleted file mode 100644
index 34e561a6..00000000
--- a/extensions/molecule/authenticator/overridden/verify.yml
+++ /dev/null
@@ -1,31 +0,0 @@
----
-- name: "Verify — authenticator (overridden)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather all authenticator resources (verify overridden final state)
-      ansible.platform.authenticator:
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered_all
-
-    - name: Assert int-auth-alpha still exists after overridden
-      ansible.builtin.assert:
-        that:
-          - gathered_all.gathered is defined
-          - gathered_all.gathered | selectattr("name", "equalto", "int-auth-alpha") | list | length == 1
-        fail_msg: "Expected int-auth-alpha to exist after overridden. got: {{ gathered_all.gathered }}"
-
-    - name: Assert int-auth-beta was deleted by overridden (not in desired config)
-      ansible.builtin.assert:
-        that:
-          - gathered_all.gathered is defined
-          - gathered_all.gathered | selectattr("name", "equalto", "int-auth-beta") | list | length == 0
-        fail_msg: "overridden should have deleted int-auth-beta. got: {{ gathered_all.gathered }}"
-
-...
diff --git a/extensions/molecule/authenticator/replaced/cleanup.yml b/extensions/molecule/authenticator/replaced/cleanup.yml
deleted file mode 100644
index b9ec207e..00000000
--- a/extensions/molecule/authenticator/replaced/cleanup.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Cleanup — authenticator (replaced)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove int-auth-alpha (test teardown)
-      ansible.platform.authenticator:
-        config:
-          - name: "int-auth-alpha"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/authenticator/replaced/converge.yml b/extensions/molecule/authenticator/replaced/converge.yml
deleted file mode 100644
index 6fe08cf2..00000000
--- a/extensions/molecule/authenticator/replaced/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — authenticator (replaced)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.authenticator with state=replaced
-      ansible.platform.authenticator:
-        config:
-          - "{{ expected_config }}"
-        state: replaced
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/authenticator/replaced/prepare.yml b/extensions/molecule/authenticator/replaced/prepare.yml
deleted file mode 100644
index a1f65365..00000000
--- a/extensions/molecule/authenticator/replaced/prepare.yml
+++ /dev/null
@@ -1,18 +0,0 @@
----
-- name: "Prepare — authenticator (replaced)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed authenticator to be replaced (prerequisite for replaced)
-      ansible.platform.authenticator:
-        config:
-          - "{{ prepare_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/authenticator/replaced/verify.yml b/extensions/molecule/authenticator/replaced/verify.yml
deleted file mode 100644
index 8f4c0dce..00000000
--- a/extensions/molecule/authenticator/replaced/verify.yml
+++ /dev/null
@@ -1,32 +0,0 @@
----
-- name: "Verify — authenticator (replaced)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather authenticator (assert present after replaced)
-      ansible.platform.authenticator:
-        config:
-          - name: "{{ expected_config.name }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert configuration exists after replaced
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length > 0
-        fail_msg: "Expected resource after replaced. got: {{ gathered.gathered }}"
-
-    - name: Assert type was updated by replaced
-      ansible.builtin.assert:
-        that:
-          - (gathered.gathered | first).type == expected_config.type
-        fail_msg: "replaced should have set type='ansible_base.authentication.authenticator_plugins.local'. got: {{ (gathered.gathered | first).type }}"
-
-...
diff --git a/extensions/molecule/authenticator_map/check/cleanup.yml b/extensions/molecule/authenticator_map/check/cleanup.yml
deleted file mode 100644
index bc17596a..00000000
--- a/extensions/molecule/authenticator_map/check/cleanup.yml
+++ /dev/null
@@ -1,30 +0,0 @@
----
-- name: "Cleanup — authenticator_map (check)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove int-authmap-alpha (test teardown)
-      ansible.platform.authenticator_map:
-        config:
-          - name: "int-authmap-alpha"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-    - name: Remove prerequisite authenticator (test teardown)
-      ansible.platform.authenticator:
-        config:
-          - name: "int-prereq-authn"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/authenticator_map/check/converge.yml b/extensions/molecule/authenticator_map/check/converge.yml
deleted file mode 100644
index 92017f08..00000000
--- a/extensions/molecule/authenticator_map/check/converge.yml
+++ /dev/null
@@ -1,36 +0,0 @@
----
-- name: "Converge — authenticator_map (check)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.authenticator_map with state=merged
-      ansible.platform.authenticator_map:
-        config:
-          - "{{ expected_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      check_mode: true
-      diff: true
-      register: result
-
-    - name: Assert check mode predicted a change
-      ansible.builtin.assert:
-        that:
-          - result.changed == true
-          - result.before is defined
-          - result.after is defined
-        fail_msg: "check mode should predict a change. got={{ result }}"
-
-    - name: Assert diff output is present
-      ansible.builtin.assert:
-        that:
-          - result.diff is defined
-        fail_msg: "diff output missing from check result"
-      when: result.diff is defined
-
-...
diff --git a/extensions/molecule/authenticator_map/check/prepare.yml b/extensions/molecule/authenticator_map/check/prepare.yml
deleted file mode 100644
index 6f0bb324..00000000
--- a/extensions/molecule/authenticator_map/check/prepare.yml
+++ /dev/null
@@ -1,29 +0,0 @@
----
-- name: "Prepare — authenticator_map (check)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed prerequisite authenticator (required by all authenticator_map tests)
-      ansible.platform.authenticator:
-        config:
-          - name: "int-prereq-authn"
-            type: "ansible_base.authentication.authenticator_plugins.local"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-    - name: Seed authenticator_map as check-mode baseline (prerequisite for check)
-      ansible.platform.authenticator_map:
-        config:
-          - "{{ prepare_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/authenticator_map/check/verify.yml b/extensions/molecule/authenticator_map/check/verify.yml
deleted file mode 100644
index 8a8a2faf..00000000
--- a/extensions/molecule/authenticator_map/check/verify.yml
+++ /dev/null
@@ -1,27 +0,0 @@
----
-- name: "Verify — authenticator_map (check)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather authenticator_map (check mode must not have applied changes)
-      ansible.platform.authenticator_map:
-        config:
-          - name: "{{ expected_config.name }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert int-authmap-alpha still has prepare_config values (check did not apply)
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length > 0
-          - (gathered.gathered | first).revoke == prepare_config.revoke
-        fail_msg: "check mode should not alter resource. got: {{ gathered.gathered }}"
-
-...
diff --git a/extensions/molecule/authenticator_map/deleted/cleanup.yml b/extensions/molecule/authenticator_map/deleted/cleanup.yml
deleted file mode 100644
index c4aed982..00000000
--- a/extensions/molecule/authenticator_map/deleted/cleanup.yml
+++ /dev/null
@@ -1,23 +0,0 @@
----
-- name: "Cleanup — authenticator_map (deleted)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: No-op — int-authmap-alpha already deleted by converge
-      ansible.builtin.debug:
-        msg: "int-authmap-alpha was deleted in converge — nothing to clean up"
-
-    - name: Remove prerequisite authenticator (test teardown)
-      ansible.platform.authenticator:
-        config:
-          - name: "int-prereq-authn"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/authenticator_map/deleted/converge.yml b/extensions/molecule/authenticator_map/deleted/converge.yml
deleted file mode 100644
index 875116de..00000000
--- a/extensions/molecule/authenticator_map/deleted/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — authenticator_map (deleted)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.authenticator_map with state=deleted
-      ansible.platform.authenticator_map:
-        config:
-          - "{{ expected_config }}"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/authenticator_map/deleted/prepare.yml b/extensions/molecule/authenticator_map/deleted/prepare.yml
deleted file mode 100644
index fd6629e4..00000000
--- a/extensions/molecule/authenticator_map/deleted/prepare.yml
+++ /dev/null
@@ -1,29 +0,0 @@
----
-- name: "Prepare — authenticator_map (deleted)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed prerequisite authenticator (required by all authenticator_map tests)
-      ansible.platform.authenticator:
-        config:
-          - name: "int-prereq-authn"
-            type: "ansible_base.authentication.authenticator_plugins.local"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-    - name: Seed authenticator_map to be deleted (prerequisite for deleted)
-      ansible.platform.authenticator_map:
-        config:
-          - "{{ prepare_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/authenticator_map/deleted/verify.yml b/extensions/molecule/authenticator_map/deleted/verify.yml
deleted file mode 100644
index cd623159..00000000
--- a/extensions/molecule/authenticator_map/deleted/verify.yml
+++ /dev/null
@@ -1,26 +0,0 @@
----
-- name: "Verify — authenticator_map (deleted)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather authenticator_map (should be absent after deleted)
-      ansible.platform.authenticator_map:
-        config:
-          - name: "int-authmap-alpha"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert int-authmap-alpha no longer exists (deleted)
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length == 0
-        fail_msg: "Expected empty after deleted, got: {{ gathered.gathered }}"
-
-...
diff --git a/extensions/molecule/authenticator_map/gathered/cleanup.yml b/extensions/molecule/authenticator_map/gathered/cleanup.yml
deleted file mode 100644
index 11aff18c..00000000
--- a/extensions/molecule/authenticator_map/gathered/cleanup.yml
+++ /dev/null
@@ -1,30 +0,0 @@
----
-- name: "Cleanup — authenticator_map (gathered)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove int-authmap-alpha (test teardown)
-      ansible.platform.authenticator_map:
-        config:
-          - name: "int-authmap-alpha"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-    - name: Remove prerequisite authenticator (test teardown)
-      ansible.platform.authenticator:
-        config:
-          - name: "int-prereq-authn"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/authenticator_map/gathered/converge.yml b/extensions/molecule/authenticator_map/gathered/converge.yml
deleted file mode 100644
index 8ab533ff..00000000
--- a/extensions/molecule/authenticator_map/gathered/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — authenticator_map (gathered)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.authenticator_map with state=gathered
-      ansible.platform.authenticator_map:
-        config:
-          - "{{ expected_config }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/authenticator_map/gathered/prepare.yml b/extensions/molecule/authenticator_map/gathered/prepare.yml
deleted file mode 100644
index 71364359..00000000
--- a/extensions/molecule/authenticator_map/gathered/prepare.yml
+++ /dev/null
@@ -1,29 +0,0 @@
----
-- name: "Prepare — authenticator_map (gathered)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed prerequisite authenticator (required by all authenticator_map tests)
-      ansible.platform.authenticator:
-        config:
-          - name: "int-prereq-authn"
-            type: "ansible_base.authentication.authenticator_plugins.local"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-    - name: Seed authenticator_map to be gathered (prerequisite for gathered)
-      ansible.platform.authenticator_map:
-        config:
-          - "{{ prepare_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/authenticator_map/gathered/verify.yml b/extensions/molecule/authenticator_map/gathered/verify.yml
deleted file mode 100644
index 3411df27..00000000
--- a/extensions/molecule/authenticator_map/gathered/verify.yml
+++ /dev/null
@@ -1,26 +0,0 @@
----
-- name: "Verify — authenticator_map (gathered)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather authenticator_map (assert present after gathered)
-      ansible.platform.authenticator_map:
-        config:
-          - name: "{{ expected_config.name }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert configuration exists after gathered
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length > 0
-        fail_msg: "Expected resource after gathered. got: {{ gathered.gathered }}"
-
-...
diff --git a/extensions/molecule/authenticator_map/merged/cleanup.yml b/extensions/molecule/authenticator_map/merged/cleanup.yml
deleted file mode 100644
index e74e8089..00000000
--- a/extensions/molecule/authenticator_map/merged/cleanup.yml
+++ /dev/null
@@ -1,30 +0,0 @@
----
-- name: "Cleanup — authenticator_map (merged)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove int-authmap-alpha (test teardown)
-      ansible.platform.authenticator_map:
-        config:
-          - name: "int-authmap-alpha"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-    - name: Remove prerequisite authenticator (test teardown)
-      ansible.platform.authenticator:
-        config:
-          - name: "int-prereq-authn"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/authenticator_map/merged/converge.yml b/extensions/molecule/authenticator_map/merged/converge.yml
deleted file mode 100644
index 856f52e4..00000000
--- a/extensions/molecule/authenticator_map/merged/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — authenticator_map (merged)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.authenticator_map with state=merged
-      ansible.platform.authenticator_map:
-        config:
-          - "{{ expected_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/authenticator_map/merged/prepare.yml b/extensions/molecule/authenticator_map/merged/prepare.yml
deleted file mode 100644
index b905560d..00000000
--- a/extensions/molecule/authenticator_map/merged/prepare.yml
+++ /dev/null
@@ -1,20 +0,0 @@
----
-- name: "Prepare — authenticator_map (merged)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed prerequisite authenticator (required by all authenticator_map tests)
-      ansible.platform.authenticator:
-        config:
-          - name: "int-prereq-authn"
-            type: "ansible_base.authentication.authenticator_plugins.local"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-
-...
diff --git a/extensions/molecule/authenticator_map/merged/verify.yml b/extensions/molecule/authenticator_map/merged/verify.yml
deleted file mode 100644
index 228128f4..00000000
--- a/extensions/molecule/authenticator_map/merged/verify.yml
+++ /dev/null
@@ -1,26 +0,0 @@
----
-- name: "Verify — authenticator_map (merged)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather authenticator_map (assert present after merged)
-      ansible.platform.authenticator_map:
-        config:
-          - name: "{{ expected_config.name }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert configuration exists after merged
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length > 0
-        fail_msg: "Expected resource after merged. got: {{ gathered.gathered }}"
-
-...
diff --git a/extensions/molecule/authenticator_map/overridden/cleanup.yml b/extensions/molecule/authenticator_map/overridden/cleanup.yml
deleted file mode 100644
index 642f8854..00000000
--- a/extensions/molecule/authenticator_map/overridden/cleanup.yml
+++ /dev/null
@@ -1,30 +0,0 @@
----
-- name: "Cleanup — authenticator_map (overridden)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove int-authmap-alpha (test teardown)
-      ansible.platform.authenticator_map:
-        config:
-          - name: "int-authmap-alpha"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-    - name: Remove prerequisite authenticator (test teardown)
-      ansible.platform.authenticator:
-        config:
-          - name: "int-prereq-authn"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/authenticator_map/overridden/converge.yml b/extensions/molecule/authenticator_map/overridden/converge.yml
deleted file mode 100644
index eb2363c4..00000000
--- a/extensions/molecule/authenticator_map/overridden/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — authenticator_map (overridden)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.authenticator_map with state=overridden
-      ansible.platform.authenticator_map:
-        config:
-          - "{{ expected_config }}"
-        state: overridden
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/authenticator_map/overridden/prepare.yml b/extensions/molecule/authenticator_map/overridden/prepare.yml
deleted file mode 100644
index 17ba8f9d..00000000
--- a/extensions/molecule/authenticator_map/overridden/prepare.yml
+++ /dev/null
@@ -1,28 +0,0 @@
----
-- name: "Prepare — authenticator_map (overridden)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed prerequisite authenticator (required by all authenticator_map tests)
-      ansible.platform.authenticator:
-        config:
-          - name: "int-prereq-authn"
-            type: "ansible_base.authentication.authenticator_plugins.local"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-    - name: Seed prerequisite resources via merged (r0 + r1 + extras for overridden)
-      ansible.platform.authenticator_map:
-        config: "{{ prepare_configs }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/authenticator_map/overridden/verify.yml b/extensions/molecule/authenticator_map/overridden/verify.yml
deleted file mode 100644
index 3213217c..00000000
--- a/extensions/molecule/authenticator_map/overridden/verify.yml
+++ /dev/null
@@ -1,31 +0,0 @@
----
-- name: "Verify — authenticator_map (overridden)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather all authenticator_map resources (verify overridden final state)
-      ansible.platform.authenticator_map:
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered_all
-
-    - name: Assert int-authmap-alpha still exists after overridden
-      ansible.builtin.assert:
-        that:
-          - gathered_all.gathered is defined
-          - gathered_all.gathered | selectattr("name", "equalto", "int-authmap-alpha") | list | length == 1
-        fail_msg: "Expected int-authmap-alpha to exist after overridden. got: {{ gathered_all.gathered }}"
-
-    - name: Assert int-authmap-beta was deleted by overridden (not in desired config)
-      ansible.builtin.assert:
-        that:
-          - gathered_all.gathered is defined
-          - gathered_all.gathered | selectattr("name", "equalto", "int-authmap-beta") | list | length == 0
-        fail_msg: "overridden should have deleted int-authmap-beta. got: {{ gathered_all.gathered }}"
-
-...
diff --git a/extensions/molecule/authenticator_map/replaced/cleanup.yml b/extensions/molecule/authenticator_map/replaced/cleanup.yml
deleted file mode 100644
index 600e5dab..00000000
--- a/extensions/molecule/authenticator_map/replaced/cleanup.yml
+++ /dev/null
@@ -1,30 +0,0 @@
----
-- name: "Cleanup — authenticator_map (replaced)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove int-authmap-alpha (test teardown)
-      ansible.platform.authenticator_map:
-        config:
-          - name: "int-authmap-alpha"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-    - name: Remove prerequisite authenticator (test teardown)
-      ansible.platform.authenticator:
-        config:
-          - name: "int-prereq-authn"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/authenticator_map/replaced/converge.yml b/extensions/molecule/authenticator_map/replaced/converge.yml
deleted file mode 100644
index 59f80481..00000000
--- a/extensions/molecule/authenticator_map/replaced/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — authenticator_map (replaced)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.authenticator_map with state=replaced
-      ansible.platform.authenticator_map:
-        config:
-          - "{{ expected_config }}"
-        state: replaced
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/authenticator_map/replaced/prepare.yml b/extensions/molecule/authenticator_map/replaced/prepare.yml
deleted file mode 100644
index de5ea96e..00000000
--- a/extensions/molecule/authenticator_map/replaced/prepare.yml
+++ /dev/null
@@ -1,29 +0,0 @@
----
-- name: "Prepare — authenticator_map (replaced)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed prerequisite authenticator (required by all authenticator_map tests)
-      ansible.platform.authenticator:
-        config:
-          - name: "int-prereq-authn"
-            type: "ansible_base.authentication.authenticator_plugins.local"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-    - name: Seed authenticator_map to be replaced (prerequisite for replaced)
-      ansible.platform.authenticator_map:
-        config:
-          - "{{ prepare_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/authenticator_map/replaced/verify.yml b/extensions/molecule/authenticator_map/replaced/verify.yml
deleted file mode 100644
index d6444d4c..00000000
--- a/extensions/molecule/authenticator_map/replaced/verify.yml
+++ /dev/null
@@ -1,32 +0,0 @@
----
-- name: "Verify — authenticator_map (replaced)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather authenticator_map (assert present after replaced)
-      ansible.platform.authenticator_map:
-        config:
-          - name: "{{ expected_config.name }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert configuration exists after replaced
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length > 0
-        fail_msg: "Expected resource after replaced. got: {{ gathered.gathered }}"
-
-    - name: Assert authenticator was updated by replaced
-      ansible.builtin.assert:
-        that:
-          - (gathered.gathered | first).authenticator == expected_config.authenticator
-        fail_msg: "replaced should have set authenticator=3100. got: {{ (gathered.gathered | first).authenticator }}"
-
-...
diff --git a/extensions/molecule/authenticator_maps/check/cleanup.yml b/extensions/molecule/authenticator_maps/check/cleanup.yml
new file mode 100644
index 00000000..6cca5c96
--- /dev/null
+++ b/extensions/molecule/authenticator_maps/check/cleanup.yml
@@ -0,0 +1,30 @@
+---
+- name: "Cleanup — authenticator_maps (check)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove int-authmap-alpha (test teardown)
+      ansible.platform.authenticator_maps:
+        config:
+          - name: "int-authmap-alpha"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+    - name: Remove prerequisite authenticator (test teardown)
+      ansible.platform.authenticators:
+        config:
+          - name: "int-prereq-authn"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/authenticator_maps/check/converge.yml b/extensions/molecule/authenticator_maps/check/converge.yml
new file mode 100644
index 00000000..5cf16727
--- /dev/null
+++ b/extensions/molecule/authenticator_maps/check/converge.yml
@@ -0,0 +1,36 @@
+---
+- name: "Converge — authenticator_maps (check)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.authenticator_maps with state=merged
+      ansible.platform.authenticator_maps:
+        config:
+          - "{{ expected_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      check_mode: true
+      diff: true
+      register: result
+
+    - name: Assert check mode predicted a change
+      ansible.builtin.assert:
+        that:
+          - result.changed == true
+          - result.before is defined
+          - result.after is defined
+        fail_msg: "check mode should predict a change. got={{ result }}"
+
+    - name: Assert diff output is present
+      ansible.builtin.assert:
+        that:
+          - result.diff is defined
+        fail_msg: "diff output missing from check result"
+      when: result.diff is defined
+
+...
diff --git a/extensions/molecule/authenticator/check/molecule.yml b/extensions/molecule/authenticator_maps/check/molecule.yml
similarity index 100%
rename from extensions/molecule/authenticator/check/molecule.yml
rename to extensions/molecule/authenticator_maps/check/molecule.yml
diff --git a/extensions/molecule/authenticator_maps/check/prepare.yml b/extensions/molecule/authenticator_maps/check/prepare.yml
new file mode 100644
index 00000000..adc07117
--- /dev/null
+++ b/extensions/molecule/authenticator_maps/check/prepare.yml
@@ -0,0 +1,29 @@
+---
+- name: "Prepare — authenticator_maps (check)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed prerequisite authenticator (required by all authenticator_map tests)
+      ansible.platform.authenticators:
+        config:
+          - name: "int-prereq-authn"
+            type: "ansible_base.authentication.authenticator_plugins.local"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+    - name: Seed authenticator_maps as check-mode baseline (prerequisite for check)
+      ansible.platform.authenticator_maps:
+        config:
+          - "{{ prepare_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/authenticator_map/check/vars.yml b/extensions/molecule/authenticator_maps/check/vars.yml
similarity index 100%
rename from extensions/molecule/authenticator_map/check/vars.yml
rename to extensions/molecule/authenticator_maps/check/vars.yml
diff --git a/extensions/molecule/authenticator_maps/check/verify.yml b/extensions/molecule/authenticator_maps/check/verify.yml
new file mode 100644
index 00000000..91a44256
--- /dev/null
+++ b/extensions/molecule/authenticator_maps/check/verify.yml
@@ -0,0 +1,27 @@
+---
+- name: "Verify — authenticator_maps (check)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather authenticator_maps (check mode must not have applied changes)
+      ansible.platform.authenticator_maps:
+        config:
+          - name: "{{ expected_config.name }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert int-authmap-alpha still has prepare_config values (check did not apply)
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length > 0
+          - (gathered.gathered | first).revoke == prepare_config.revoke
+        fail_msg: "check mode should not alter resource. got: {{ gathered.gathered }}"
+
+...
diff --git a/extensions/molecule/authenticator_maps/deleted/cleanup.yml b/extensions/molecule/authenticator_maps/deleted/cleanup.yml
new file mode 100644
index 00000000..8e426de6
--- /dev/null
+++ b/extensions/molecule/authenticator_maps/deleted/cleanup.yml
@@ -0,0 +1,23 @@
+---
+- name: "Cleanup — authenticator_maps (deleted)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: No-op — int-authmap-alpha already deleted by converge
+      ansible.builtin.debug:
+        msg: "int-authmap-alpha was deleted in converge — nothing to clean up"
+
+    - name: Remove prerequisite authenticator (test teardown)
+      ansible.platform.authenticators:
+        config:
+          - name: "int-prereq-authn"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/authenticator_maps/deleted/converge.yml b/extensions/molecule/authenticator_maps/deleted/converge.yml
new file mode 100644
index 00000000..0d63ab29
--- /dev/null
+++ b/extensions/molecule/authenticator_maps/deleted/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — authenticator_maps (deleted)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.authenticator_maps with state=deleted
+      ansible.platform.authenticator_maps:
+        config:
+          - "{{ expected_config }}"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/authenticator/deleted/molecule.yml b/extensions/molecule/authenticator_maps/deleted/molecule.yml
similarity index 100%
rename from extensions/molecule/authenticator/deleted/molecule.yml
rename to extensions/molecule/authenticator_maps/deleted/molecule.yml
diff --git a/extensions/molecule/authenticator_maps/deleted/prepare.yml b/extensions/molecule/authenticator_maps/deleted/prepare.yml
new file mode 100644
index 00000000..affe96a7
--- /dev/null
+++ b/extensions/molecule/authenticator_maps/deleted/prepare.yml
@@ -0,0 +1,29 @@
+---
+- name: "Prepare — authenticator_maps (deleted)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed prerequisite authenticator (required by all authenticator_map tests)
+      ansible.platform.authenticators:
+        config:
+          - name: "int-prereq-authn"
+            type: "ansible_base.authentication.authenticator_plugins.local"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+    - name: Seed authenticator_maps to be deleted (prerequisite for deleted)
+      ansible.platform.authenticator_maps:
+        config:
+          - "{{ prepare_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/authenticator_map/deleted/vars.yml b/extensions/molecule/authenticator_maps/deleted/vars.yml
similarity index 100%
rename from extensions/molecule/authenticator_map/deleted/vars.yml
rename to extensions/molecule/authenticator_maps/deleted/vars.yml
diff --git a/extensions/molecule/authenticator_maps/deleted/verify.yml b/extensions/molecule/authenticator_maps/deleted/verify.yml
new file mode 100644
index 00000000..28db5095
--- /dev/null
+++ b/extensions/molecule/authenticator_maps/deleted/verify.yml
@@ -0,0 +1,26 @@
+---
+- name: "Verify — authenticator_maps (deleted)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather authenticator_maps (should be absent after deleted)
+      ansible.platform.authenticator_maps:
+        config:
+          - name: "int-authmap-alpha"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert int-authmap-alpha no longer exists (deleted)
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length == 0
+        fail_msg: "Expected empty after deleted, got: {{ gathered.gathered }}"
+
+...
diff --git a/extensions/molecule/authenticator_maps/gathered/cleanup.yml b/extensions/molecule/authenticator_maps/gathered/cleanup.yml
new file mode 100644
index 00000000..1c61d301
--- /dev/null
+++ b/extensions/molecule/authenticator_maps/gathered/cleanup.yml
@@ -0,0 +1,30 @@
+---
+- name: "Cleanup — authenticator_maps (gathered)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove int-authmap-alpha (test teardown)
+      ansible.platform.authenticator_maps:
+        config:
+          - name: "int-authmap-alpha"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+    - name: Remove prerequisite authenticator (test teardown)
+      ansible.platform.authenticators:
+        config:
+          - name: "int-prereq-authn"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/authenticator_maps/gathered/converge.yml b/extensions/molecule/authenticator_maps/gathered/converge.yml
new file mode 100644
index 00000000..6573f9f0
--- /dev/null
+++ b/extensions/molecule/authenticator_maps/gathered/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — authenticator_maps (gathered)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.authenticator_maps with state=gathered
+      ansible.platform.authenticator_maps:
+        config:
+          - "{{ expected_config }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/authenticator/gathered/molecule.yml b/extensions/molecule/authenticator_maps/gathered/molecule.yml
similarity index 100%
rename from extensions/molecule/authenticator/gathered/molecule.yml
rename to extensions/molecule/authenticator_maps/gathered/molecule.yml
diff --git a/extensions/molecule/authenticator_maps/gathered/prepare.yml b/extensions/molecule/authenticator_maps/gathered/prepare.yml
new file mode 100644
index 00000000..dc84c9b7
--- /dev/null
+++ b/extensions/molecule/authenticator_maps/gathered/prepare.yml
@@ -0,0 +1,29 @@
+---
+- name: "Prepare — authenticator_maps (gathered)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed prerequisite authenticator (required by all authenticator_map tests)
+      ansible.platform.authenticators:
+        config:
+          - name: "int-prereq-authn"
+            type: "ansible_base.authentication.authenticator_plugins.local"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+    - name: Seed authenticator_maps to be gathered (prerequisite for gathered)
+      ansible.platform.authenticator_maps:
+        config:
+          - "{{ prepare_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/authenticator_map/gathered/vars.yml b/extensions/molecule/authenticator_maps/gathered/vars.yml
similarity index 100%
rename from extensions/molecule/authenticator_map/gathered/vars.yml
rename to extensions/molecule/authenticator_maps/gathered/vars.yml
diff --git a/extensions/molecule/authenticator_maps/gathered/verify.yml b/extensions/molecule/authenticator_maps/gathered/verify.yml
new file mode 100644
index 00000000..909610ba
--- /dev/null
+++ b/extensions/molecule/authenticator_maps/gathered/verify.yml
@@ -0,0 +1,26 @@
+---
+- name: "Verify — authenticator_maps (gathered)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather authenticator_maps (assert present after gathered)
+      ansible.platform.authenticator_maps:
+        config:
+          - name: "{{ expected_config.name }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert configuration exists after gathered
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length > 0
+        fail_msg: "Expected resource after gathered. got: {{ gathered.gathered }}"
+
+...
diff --git a/extensions/molecule/authenticator/inventory.yml b/extensions/molecule/authenticator_maps/inventory.yml
similarity index 100%
rename from extensions/molecule/authenticator/inventory.yml
rename to extensions/molecule/authenticator_maps/inventory.yml
diff --git a/extensions/molecule/authenticator_maps/merged/cleanup.yml b/extensions/molecule/authenticator_maps/merged/cleanup.yml
new file mode 100644
index 00000000..d324caf9
--- /dev/null
+++ b/extensions/molecule/authenticator_maps/merged/cleanup.yml
@@ -0,0 +1,30 @@
+---
+- name: "Cleanup — authenticator_maps (merged)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove int-authmap-alpha (test teardown)
+      ansible.platform.authenticator_maps:
+        config:
+          - name: "int-authmap-alpha"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+    - name: Remove prerequisite authenticator (test teardown)
+      ansible.platform.authenticators:
+        config:
+          - name: "int-prereq-authn"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/authenticator_maps/merged/converge.yml b/extensions/molecule/authenticator_maps/merged/converge.yml
new file mode 100644
index 00000000..ae77571d
--- /dev/null
+++ b/extensions/molecule/authenticator_maps/merged/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — authenticator_maps (merged)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.authenticator_maps with state=merged
+      ansible.platform.authenticator_maps:
+        config:
+          - "{{ expected_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/authenticator/overridden/molecule.yml b/extensions/molecule/authenticator_maps/merged/molecule.yml
similarity index 100%
rename from extensions/molecule/authenticator/overridden/molecule.yml
rename to extensions/molecule/authenticator_maps/merged/molecule.yml
diff --git a/extensions/molecule/authenticator_maps/merged/prepare.yml b/extensions/molecule/authenticator_maps/merged/prepare.yml
new file mode 100644
index 00000000..d5ba38bd
--- /dev/null
+++ b/extensions/molecule/authenticator_maps/merged/prepare.yml
@@ -0,0 +1,20 @@
+---
+- name: "Prepare — authenticator_maps (merged)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed prerequisite authenticator (required by all authenticator_map tests)
+      ansible.platform.authenticators:
+        config:
+          - name: "int-prereq-authn"
+            type: "ansible_base.authentication.authenticator_plugins.local"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+
+...
diff --git a/extensions/molecule/authenticator_map/merged/vars.yml b/extensions/molecule/authenticator_maps/merged/vars.yml
similarity index 100%
rename from extensions/molecule/authenticator_map/merged/vars.yml
rename to extensions/molecule/authenticator_maps/merged/vars.yml
diff --git a/extensions/molecule/authenticator_maps/merged/verify.yml b/extensions/molecule/authenticator_maps/merged/verify.yml
new file mode 100644
index 00000000..7f7f1e9d
--- /dev/null
+++ b/extensions/molecule/authenticator_maps/merged/verify.yml
@@ -0,0 +1,26 @@
+---
+- name: "Verify — authenticator_maps (merged)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather authenticator_maps (assert present after merged)
+      ansible.platform.authenticator_maps:
+        config:
+          - name: "{{ expected_config.name }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert configuration exists after merged
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length > 0
+        fail_msg: "Expected resource after merged. got: {{ gathered.gathered }}"
+
+...
diff --git a/extensions/molecule/authenticator_maps/overridden/cleanup.yml b/extensions/molecule/authenticator_maps/overridden/cleanup.yml
new file mode 100644
index 00000000..ab1cbbe1
--- /dev/null
+++ b/extensions/molecule/authenticator_maps/overridden/cleanup.yml
@@ -0,0 +1,30 @@
+---
+- name: "Cleanup — authenticator_maps (overridden)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove int-authmap-alpha (test teardown)
+      ansible.platform.authenticator_maps:
+        config:
+          - name: "int-authmap-alpha"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+    - name: Remove prerequisite authenticator (test teardown)
+      ansible.platform.authenticators:
+        config:
+          - name: "int-prereq-authn"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/authenticator_maps/overridden/converge.yml b/extensions/molecule/authenticator_maps/overridden/converge.yml
new file mode 100644
index 00000000..7811c5bd
--- /dev/null
+++ b/extensions/molecule/authenticator_maps/overridden/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — authenticator_maps (overridden)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.authenticator_maps with state=overridden
+      ansible.platform.authenticator_maps:
+        config:
+          - "{{ expected_config }}"
+        state: overridden
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/authenticator/replaced/molecule.yml b/extensions/molecule/authenticator_maps/overridden/molecule.yml
similarity index 100%
rename from extensions/molecule/authenticator/replaced/molecule.yml
rename to extensions/molecule/authenticator_maps/overridden/molecule.yml
diff --git a/extensions/molecule/authenticator_maps/overridden/prepare.yml b/extensions/molecule/authenticator_maps/overridden/prepare.yml
new file mode 100644
index 00000000..04130d49
--- /dev/null
+++ b/extensions/molecule/authenticator_maps/overridden/prepare.yml
@@ -0,0 +1,28 @@
+---
+- name: "Prepare — authenticator_maps (overridden)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed prerequisite authenticator (required by all authenticator_map tests)
+      ansible.platform.authenticators:
+        config:
+          - name: "int-prereq-authn"
+            type: "ansible_base.authentication.authenticator_plugins.local"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+    - name: Seed prerequisite resources via merged (r0 + r1 + extras for overridden)
+      ansible.platform.authenticator_maps:
+        config: "{{ prepare_configs }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/authenticator_map/overridden/vars.yml b/extensions/molecule/authenticator_maps/overridden/vars.yml
similarity index 100%
rename from extensions/molecule/authenticator_map/overridden/vars.yml
rename to extensions/molecule/authenticator_maps/overridden/vars.yml
diff --git a/extensions/molecule/authenticator_maps/overridden/verify.yml b/extensions/molecule/authenticator_maps/overridden/verify.yml
new file mode 100644
index 00000000..3555c732
--- /dev/null
+++ b/extensions/molecule/authenticator_maps/overridden/verify.yml
@@ -0,0 +1,31 @@
+---
+- name: "Verify — authenticator_maps (overridden)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather all authenticator_maps resources (verify overridden final state)
+      ansible.platform.authenticator_maps:
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered_all
+
+    - name: Assert int-authmap-alpha still exists after overridden
+      ansible.builtin.assert:
+        that:
+          - gathered_all.gathered is defined
+          - gathered_all.gathered | selectattr("name", "equalto", "int-authmap-alpha") | list | length == 1
+        fail_msg: "Expected int-authmap-alpha to exist after overridden. got: {{ gathered_all.gathered }}"
+
+    - name: Assert int-authmap-beta was deleted by overridden (not in desired config)
+      ansible.builtin.assert:
+        that:
+          - gathered_all.gathered is defined
+          - gathered_all.gathered | selectattr("name", "equalto", "int-authmap-beta") | list | length == 0
+        fail_msg: "overridden should have deleted int-authmap-beta. got: {{ gathered_all.gathered }}"
+
+...
diff --git a/extensions/molecule/authenticator_maps/replaced/cleanup.yml b/extensions/molecule/authenticator_maps/replaced/cleanup.yml
new file mode 100644
index 00000000..d42f8e88
--- /dev/null
+++ b/extensions/molecule/authenticator_maps/replaced/cleanup.yml
@@ -0,0 +1,30 @@
+---
+- name: "Cleanup — authenticator_maps (replaced)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove int-authmap-alpha (test teardown)
+      ansible.platform.authenticator_maps:
+        config:
+          - name: "int-authmap-alpha"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+    - name: Remove prerequisite authenticator (test teardown)
+      ansible.platform.authenticators:
+        config:
+          - name: "int-prereq-authn"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/authenticator_maps/replaced/converge.yml b/extensions/molecule/authenticator_maps/replaced/converge.yml
new file mode 100644
index 00000000..51730c04
--- /dev/null
+++ b/extensions/molecule/authenticator_maps/replaced/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — authenticator_maps (replaced)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.authenticator_maps with state=replaced
+      ansible.platform.authenticator_maps:
+        config:
+          - "{{ expected_config }}"
+        state: replaced
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/authenticator_map/deleted/molecule.yml b/extensions/molecule/authenticator_maps/replaced/molecule.yml
similarity index 100%
rename from extensions/molecule/authenticator_map/deleted/molecule.yml
rename to extensions/molecule/authenticator_maps/replaced/molecule.yml
diff --git a/extensions/molecule/authenticator_maps/replaced/prepare.yml b/extensions/molecule/authenticator_maps/replaced/prepare.yml
new file mode 100644
index 00000000..dec12bc6
--- /dev/null
+++ b/extensions/molecule/authenticator_maps/replaced/prepare.yml
@@ -0,0 +1,29 @@
+---
+- name: "Prepare — authenticator_maps (replaced)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed prerequisite authenticator (required by all authenticator_map tests)
+      ansible.platform.authenticators:
+        config:
+          - name: "int-prereq-authn"
+            type: "ansible_base.authentication.authenticator_plugins.local"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+    - name: Seed authenticator_maps to be replaced (prerequisite for replaced)
+      ansible.platform.authenticator_maps:
+        config:
+          - "{{ prepare_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/authenticator_map/replaced/vars.yml b/extensions/molecule/authenticator_maps/replaced/vars.yml
similarity index 100%
rename from extensions/molecule/authenticator_map/replaced/vars.yml
rename to extensions/molecule/authenticator_maps/replaced/vars.yml
diff --git a/extensions/molecule/authenticator_maps/replaced/verify.yml b/extensions/molecule/authenticator_maps/replaced/verify.yml
new file mode 100644
index 00000000..78b59879
--- /dev/null
+++ b/extensions/molecule/authenticator_maps/replaced/verify.yml
@@ -0,0 +1,32 @@
+---
+- name: "Verify — authenticator_maps (replaced)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather authenticator_maps (assert present after replaced)
+      ansible.platform.authenticator_maps:
+        config:
+          - name: "{{ expected_config.name }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert configuration exists after replaced
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length > 0
+        fail_msg: "Expected resource after replaced. got: {{ gathered.gathered }}"
+
+    - name: Assert authenticator was updated by replaced
+      ansible.builtin.assert:
+        that:
+          - (gathered.gathered | first).authenticator == expected_config.authenticator
+        fail_msg: "replaced should have set authenticator=3100. got: {{ (gathered.gathered | first).authenticator }}"
+
+...
diff --git a/extensions/molecule/authenticators/check/cleanup.yml b/extensions/molecule/authenticators/check/cleanup.yml
new file mode 100644
index 00000000..d1af9a10
--- /dev/null
+++ b/extensions/molecule/authenticators/check/cleanup.yml
@@ -0,0 +1,19 @@
+---
+- name: "Cleanup — authenticators (check)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove int-auth-alpha (test teardown)
+      ansible.platform.authenticators:
+        config:
+          - name: "int-auth-alpha"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/authenticators/check/converge.yml b/extensions/molecule/authenticators/check/converge.yml
new file mode 100644
index 00000000..109d8847
--- /dev/null
+++ b/extensions/molecule/authenticators/check/converge.yml
@@ -0,0 +1,36 @@
+---
+- name: "Converge — authenticators (check)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.authenticators with state=merged
+      ansible.platform.authenticators:
+        config:
+          - "{{ expected_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      check_mode: true
+      diff: true
+      register: result
+
+    - name: Assert check mode predicted a change
+      ansible.builtin.assert:
+        that:
+          - result.changed == true
+          - result.before is defined
+          - result.after is defined
+        fail_msg: "check mode should predict a change. got={{ result }}"
+
+    - name: Assert diff output is present
+      ansible.builtin.assert:
+        that:
+          - result.diff is defined
+        fail_msg: "diff output missing from check result"
+      when: result.diff is defined
+
+...
diff --git a/extensions/molecule/authenticator_map/check/molecule.yml b/extensions/molecule/authenticators/check/molecule.yml
similarity index 100%
rename from extensions/molecule/authenticator_map/check/molecule.yml
rename to extensions/molecule/authenticators/check/molecule.yml
diff --git a/extensions/molecule/authenticators/check/prepare.yml b/extensions/molecule/authenticators/check/prepare.yml
new file mode 100644
index 00000000..3ceab464
--- /dev/null
+++ b/extensions/molecule/authenticators/check/prepare.yml
@@ -0,0 +1,18 @@
+---
+- name: "Prepare — authenticators (check)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed authenticators as check-mode baseline (prerequisite for check)
+      ansible.platform.authenticators:
+        config:
+          - "{{ prepare_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/authenticator/check/vars.yml b/extensions/molecule/authenticators/check/vars.yml
similarity index 100%
rename from extensions/molecule/authenticator/check/vars.yml
rename to extensions/molecule/authenticators/check/vars.yml
diff --git a/extensions/molecule/authenticators/check/verify.yml b/extensions/molecule/authenticators/check/verify.yml
new file mode 100644
index 00000000..64dc4041
--- /dev/null
+++ b/extensions/molecule/authenticators/check/verify.yml
@@ -0,0 +1,27 @@
+---
+- name: "Verify — authenticators (check)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather authenticators (check mode must not have applied changes)
+      ansible.platform.authenticators:
+        config:
+          - name: "{{ expected_config.name }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert int-auth-alpha still has prepare_config values (check did not apply)
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length > 0
+          - (gathered.gathered | first).enabled == prepare_config.enabled
+        fail_msg: "check mode should not alter resource. got: {{ gathered.gathered }}"
+
+...
diff --git a/extensions/molecule/authenticators/deleted/cleanup.yml b/extensions/molecule/authenticators/deleted/cleanup.yml
new file mode 100644
index 00000000..8c7571c1
--- /dev/null
+++ b/extensions/molecule/authenticators/deleted/cleanup.yml
@@ -0,0 +1,12 @@
+---
+- name: "Cleanup — authenticators (deleted)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: No-op — int-auth-alpha already deleted by converge
+      ansible.builtin.debug:
+        msg: "int-auth-alpha was deleted in converge — nothing to clean up"
+
+...
diff --git a/extensions/molecule/authenticators/deleted/converge.yml b/extensions/molecule/authenticators/deleted/converge.yml
new file mode 100644
index 00000000..191ee5fc
--- /dev/null
+++ b/extensions/molecule/authenticators/deleted/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — authenticators (deleted)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.authenticators with state=deleted
+      ansible.platform.authenticators:
+        config:
+          - "{{ expected_config }}"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/authenticator_map/gathered/molecule.yml b/extensions/molecule/authenticators/deleted/molecule.yml
similarity index 100%
rename from extensions/molecule/authenticator_map/gathered/molecule.yml
rename to extensions/molecule/authenticators/deleted/molecule.yml
diff --git a/extensions/molecule/authenticators/deleted/prepare.yml b/extensions/molecule/authenticators/deleted/prepare.yml
new file mode 100644
index 00000000..8608db62
--- /dev/null
+++ b/extensions/molecule/authenticators/deleted/prepare.yml
@@ -0,0 +1,18 @@
+---
+- name: "Prepare — authenticators (deleted)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed authenticators to be deleted (prerequisite for deleted)
+      ansible.platform.authenticators:
+        config:
+          - "{{ prepare_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/authenticator/deleted/vars.yml b/extensions/molecule/authenticators/deleted/vars.yml
similarity index 100%
rename from extensions/molecule/authenticator/deleted/vars.yml
rename to extensions/molecule/authenticators/deleted/vars.yml
diff --git a/extensions/molecule/authenticators/deleted/verify.yml b/extensions/molecule/authenticators/deleted/verify.yml
new file mode 100644
index 00000000..1ffe1713
--- /dev/null
+++ b/extensions/molecule/authenticators/deleted/verify.yml
@@ -0,0 +1,26 @@
+---
+- name: "Verify — authenticators (deleted)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather authenticators (should be absent after deleted)
+      ansible.platform.authenticators:
+        config:
+          - name: "int-auth-alpha"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert int-auth-alpha no longer exists (deleted)
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length == 0
+        fail_msg: "Expected empty after deleted, got: {{ gathered.gathered }}"
+
+...
diff --git a/extensions/molecule/authenticators/gathered/cleanup.yml b/extensions/molecule/authenticators/gathered/cleanup.yml
new file mode 100644
index 00000000..73431edd
--- /dev/null
+++ b/extensions/molecule/authenticators/gathered/cleanup.yml
@@ -0,0 +1,19 @@
+---
+- name: "Cleanup — authenticators (gathered)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove int-auth-alpha (test teardown)
+      ansible.platform.authenticators:
+        config:
+          - name: "int-auth-alpha"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/authenticators/gathered/converge.yml b/extensions/molecule/authenticators/gathered/converge.yml
new file mode 100644
index 00000000..fdaeef7c
--- /dev/null
+++ b/extensions/molecule/authenticators/gathered/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — authenticators (gathered)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.authenticators with state=gathered
+      ansible.platform.authenticators:
+        config:
+          - "{{ expected_config }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/authenticator_map/merged/molecule.yml b/extensions/molecule/authenticators/gathered/molecule.yml
similarity index 100%
rename from extensions/molecule/authenticator_map/merged/molecule.yml
rename to extensions/molecule/authenticators/gathered/molecule.yml
diff --git a/extensions/molecule/authenticators/gathered/prepare.yml b/extensions/molecule/authenticators/gathered/prepare.yml
new file mode 100644
index 00000000..7f9f19df
--- /dev/null
+++ b/extensions/molecule/authenticators/gathered/prepare.yml
@@ -0,0 +1,18 @@
+---
+- name: "Prepare — authenticators (gathered)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed authenticators to be gathered (prerequisite for gathered)
+      ansible.platform.authenticators:
+        config:
+          - "{{ prepare_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/authenticator/gathered/vars.yml b/extensions/molecule/authenticators/gathered/vars.yml
similarity index 100%
rename from extensions/molecule/authenticator/gathered/vars.yml
rename to extensions/molecule/authenticators/gathered/vars.yml
diff --git a/extensions/molecule/authenticators/gathered/verify.yml b/extensions/molecule/authenticators/gathered/verify.yml
new file mode 100644
index 00000000..deb52b44
--- /dev/null
+++ b/extensions/molecule/authenticators/gathered/verify.yml
@@ -0,0 +1,26 @@
+---
+- name: "Verify — authenticators (gathered)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather authenticators (assert present after gathered)
+      ansible.platform.authenticators:
+        config:
+          - name: "{{ expected_config.name }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert configuration exists after gathered
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length > 0
+        fail_msg: "Expected resource after gathered. got: {{ gathered.gathered }}"
+
+...
diff --git a/extensions/molecule/authenticator_map/inventory.yml b/extensions/molecule/authenticators/inventory.yml
similarity index 100%
rename from extensions/molecule/authenticator_map/inventory.yml
rename to extensions/molecule/authenticators/inventory.yml
diff --git a/extensions/molecule/authenticators/merged/cleanup.yml b/extensions/molecule/authenticators/merged/cleanup.yml
new file mode 100644
index 00000000..5bf1d988
--- /dev/null
+++ b/extensions/molecule/authenticators/merged/cleanup.yml
@@ -0,0 +1,19 @@
+---
+- name: "Cleanup — authenticators (merged)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove int-auth-alpha (test teardown)
+      ansible.platform.authenticators:
+        config:
+          - name: "int-auth-alpha"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/authenticators/merged/converge.yml b/extensions/molecule/authenticators/merged/converge.yml
new file mode 100644
index 00000000..d3090eca
--- /dev/null
+++ b/extensions/molecule/authenticators/merged/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — authenticators (merged)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.authenticators with state=merged
+      ansible.platform.authenticators:
+        config:
+          - "{{ expected_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/authenticator/merged/molecule.yml b/extensions/molecule/authenticators/merged/molecule.yml
similarity index 100%
rename from extensions/molecule/authenticator/merged/molecule.yml
rename to extensions/molecule/authenticators/merged/molecule.yml
diff --git a/extensions/molecule/authenticator/merged/vars.yml b/extensions/molecule/authenticators/merged/vars.yml
similarity index 100%
rename from extensions/molecule/authenticator/merged/vars.yml
rename to extensions/molecule/authenticators/merged/vars.yml
diff --git a/extensions/molecule/authenticators/merged/verify.yml b/extensions/molecule/authenticators/merged/verify.yml
new file mode 100644
index 00000000..dac97254
--- /dev/null
+++ b/extensions/molecule/authenticators/merged/verify.yml
@@ -0,0 +1,26 @@
+---
+- name: "Verify — authenticators (merged)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather authenticators (assert present after merged)
+      ansible.platform.authenticators:
+        config:
+          - name: "{{ expected_config.name }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert configuration exists after merged
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length > 0
+        fail_msg: "Expected resource after merged. got: {{ gathered.gathered }}"
+
+...
diff --git a/extensions/molecule/authenticators/overridden/cleanup.yml b/extensions/molecule/authenticators/overridden/cleanup.yml
new file mode 100644
index 00000000..6a6924e6
--- /dev/null
+++ b/extensions/molecule/authenticators/overridden/cleanup.yml
@@ -0,0 +1,19 @@
+---
+- name: "Cleanup — authenticators (overridden)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove int-auth-alpha (test teardown)
+      ansible.platform.authenticators:
+        config:
+          - name: "int-auth-alpha"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/authenticators/overridden/converge.yml b/extensions/molecule/authenticators/overridden/converge.yml
new file mode 100644
index 00000000..e7ac2f19
--- /dev/null
+++ b/extensions/molecule/authenticators/overridden/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — authenticators (overridden)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.authenticators with state=overridden
+      ansible.platform.authenticators:
+        config:
+          - "{{ expected_config }}"
+        state: overridden
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/authenticator_map/overridden/molecule.yml b/extensions/molecule/authenticators/overridden/molecule.yml
similarity index 100%
rename from extensions/molecule/authenticator_map/overridden/molecule.yml
rename to extensions/molecule/authenticators/overridden/molecule.yml
diff --git a/extensions/molecule/authenticators/overridden/prepare.yml b/extensions/molecule/authenticators/overridden/prepare.yml
new file mode 100644
index 00000000..cbb636c5
--- /dev/null
+++ b/extensions/molecule/authenticators/overridden/prepare.yml
@@ -0,0 +1,17 @@
+---
+- name: "Prepare — authenticators (overridden)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed prerequisite resources via merged (r0 + r1 + extras for overridden)
+      ansible.platform.authenticators:
+        config: "{{ prepare_configs }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/authenticator/overridden/vars.yml b/extensions/molecule/authenticators/overridden/vars.yml
similarity index 100%
rename from extensions/molecule/authenticator/overridden/vars.yml
rename to extensions/molecule/authenticators/overridden/vars.yml
diff --git a/extensions/molecule/authenticators/overridden/verify.yml b/extensions/molecule/authenticators/overridden/verify.yml
new file mode 100644
index 00000000..967ff705
--- /dev/null
+++ b/extensions/molecule/authenticators/overridden/verify.yml
@@ -0,0 +1,31 @@
+---
+- name: "Verify — authenticators (overridden)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather all authenticators resources (verify overridden final state)
+      ansible.platform.authenticators:
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered_all
+
+    - name: Assert int-auth-alpha still exists after overridden
+      ansible.builtin.assert:
+        that:
+          - gathered_all.gathered is defined
+          - gathered_all.gathered | selectattr("name", "equalto", "int-auth-alpha") | list | length == 1
+        fail_msg: "Expected int-auth-alpha to exist after overridden. got: {{ gathered_all.gathered }}"
+
+    - name: Assert int-auth-beta was deleted by overridden (not in desired config)
+      ansible.builtin.assert:
+        that:
+          - gathered_all.gathered is defined
+          - gathered_all.gathered | selectattr("name", "equalto", "int-auth-beta") | list | length == 0
+        fail_msg: "overridden should have deleted int-auth-beta. got: {{ gathered_all.gathered }}"
+
+...
diff --git a/extensions/molecule/authenticators/replaced/cleanup.yml b/extensions/molecule/authenticators/replaced/cleanup.yml
new file mode 100644
index 00000000..41a94b46
--- /dev/null
+++ b/extensions/molecule/authenticators/replaced/cleanup.yml
@@ -0,0 +1,19 @@
+---
+- name: "Cleanup — authenticators (replaced)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove int-auth-alpha (test teardown)
+      ansible.platform.authenticators:
+        config:
+          - name: "int-auth-alpha"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/authenticators/replaced/converge.yml b/extensions/molecule/authenticators/replaced/converge.yml
new file mode 100644
index 00000000..c325eb3a
--- /dev/null
+++ b/extensions/molecule/authenticators/replaced/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — authenticators (replaced)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.authenticators with state=replaced
+      ansible.platform.authenticators:
+        config:
+          - "{{ expected_config }}"
+        state: replaced
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/authenticator_map/replaced/molecule.yml b/extensions/molecule/authenticators/replaced/molecule.yml
similarity index 100%
rename from extensions/molecule/authenticator_map/replaced/molecule.yml
rename to extensions/molecule/authenticators/replaced/molecule.yml
diff --git a/extensions/molecule/authenticators/replaced/prepare.yml b/extensions/molecule/authenticators/replaced/prepare.yml
new file mode 100644
index 00000000..842ee4f1
--- /dev/null
+++ b/extensions/molecule/authenticators/replaced/prepare.yml
@@ -0,0 +1,18 @@
+---
+- name: "Prepare — authenticators (replaced)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed authenticators to be replaced (prerequisite for replaced)
+      ansible.platform.authenticators:
+        config:
+          - "{{ prepare_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/authenticator/replaced/vars.yml b/extensions/molecule/authenticators/replaced/vars.yml
similarity index 100%
rename from extensions/molecule/authenticator/replaced/vars.yml
rename to extensions/molecule/authenticators/replaced/vars.yml
diff --git a/extensions/molecule/authenticators/replaced/verify.yml b/extensions/molecule/authenticators/replaced/verify.yml
new file mode 100644
index 00000000..1876e053
--- /dev/null
+++ b/extensions/molecule/authenticators/replaced/verify.yml
@@ -0,0 +1,32 @@
+---
+- name: "Verify — authenticators (replaced)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather authenticators (assert present after replaced)
+      ansible.platform.authenticators:
+        config:
+          - name: "{{ expected_config.name }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert configuration exists after replaced
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length > 0
+        fail_msg: "Expected resource after replaced. got: {{ gathered.gathered }}"
+
+    - name: Assert type was updated by replaced
+      ansible.builtin.assert:
+        that:
+          - (gathered.gathered | first).type == expected_config.type
+        fail_msg: "replaced should have set type='ansible_base.authentication.authenticator_plugins.local'. got: {{ (gathered.gathered | first).type }}"
+
+...
diff --git a/extensions/molecule/ca_certificate/check/cleanup.yml b/extensions/molecule/ca_certificate/check/cleanup.yml
deleted file mode 100644
index eef25482..00000000
--- a/extensions/molecule/ca_certificate/check/cleanup.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Cleanup — ca_certificate (check)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove int-cert-alpha (test teardown)
-      ansible.platform.ca_certificate:
-        config:
-          - name: "int-cert-alpha"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/ca_certificate/check/converge.yml b/extensions/molecule/ca_certificate/check/converge.yml
deleted file mode 100644
index e4715c65..00000000
--- a/extensions/molecule/ca_certificate/check/converge.yml
+++ /dev/null
@@ -1,36 +0,0 @@
----
-- name: "Converge — ca_certificate (check)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.ca_certificate with state=merged
-      ansible.platform.ca_certificate:
-        config:
-          - "{{ expected_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      check_mode: true
-      diff: true
-      register: result
-
-    - name: Assert check mode predicted a change
-      ansible.builtin.assert:
-        that:
-          - result.changed == true
-          - result.before is defined
-          - result.after is defined
-        fail_msg: "check mode should predict a change. got={{ result }}"
-
-    - name: Assert diff output is present
-      ansible.builtin.assert:
-        that:
-          - result.diff is defined
-        fail_msg: "diff output missing from check result"
-      when: result.diff is defined
-
-...
diff --git a/extensions/molecule/ca_certificate/check/prepare.yml b/extensions/molecule/ca_certificate/check/prepare.yml
deleted file mode 100644
index d5a7c38f..00000000
--- a/extensions/molecule/ca_certificate/check/prepare.yml
+++ /dev/null
@@ -1,18 +0,0 @@
----
-- name: "Prepare — ca_certificate (check)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed ca_certificate as check-mode baseline (prerequisite for check)
-      ansible.platform.ca_certificate:
-        config:
-          - "{{ prepare_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/ca_certificate/check/verify.yml b/extensions/molecule/ca_certificate/check/verify.yml
deleted file mode 100644
index 4c52c352..00000000
--- a/extensions/molecule/ca_certificate/check/verify.yml
+++ /dev/null
@@ -1,27 +0,0 @@
----
-- name: "Verify — ca_certificate (check)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather ca_certificate (check mode must not have applied changes)
-      ansible.platform.ca_certificate:
-        config:
-          - name: "{{ expected_config.name }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert int-cert-alpha still has prepare_config values (check did not apply)
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length > 0
-          - (gathered.gathered | first).pem_data == prepare_config.pem_data
-        fail_msg: "check mode should not alter resource. got: {{ gathered.gathered }}"
-
-...
diff --git a/extensions/molecule/ca_certificate/deleted/cleanup.yml b/extensions/molecule/ca_certificate/deleted/cleanup.yml
deleted file mode 100644
index b8562204..00000000
--- a/extensions/molecule/ca_certificate/deleted/cleanup.yml
+++ /dev/null
@@ -1,12 +0,0 @@
----
-- name: "Cleanup — ca_certificate (deleted)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: No-op — int-cert-alpha already deleted by converge
-      ansible.builtin.debug:
-        msg: "int-cert-alpha was deleted in converge — nothing to clean up"
-
-...
diff --git a/extensions/molecule/ca_certificate/deleted/converge.yml b/extensions/molecule/ca_certificate/deleted/converge.yml
deleted file mode 100644
index d1b4886d..00000000
--- a/extensions/molecule/ca_certificate/deleted/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — ca_certificate (deleted)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.ca_certificate with state=deleted
-      ansible.platform.ca_certificate:
-        config:
-          - "{{ expected_config }}"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/ca_certificate/deleted/prepare.yml b/extensions/molecule/ca_certificate/deleted/prepare.yml
deleted file mode 100644
index e96301eb..00000000
--- a/extensions/molecule/ca_certificate/deleted/prepare.yml
+++ /dev/null
@@ -1,18 +0,0 @@
----
-- name: "Prepare — ca_certificate (deleted)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed ca_certificate to be deleted (prerequisite for deleted)
-      ansible.platform.ca_certificate:
-        config:
-          - "{{ prepare_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/ca_certificate/deleted/verify.yml b/extensions/molecule/ca_certificate/deleted/verify.yml
deleted file mode 100644
index 60923050..00000000
--- a/extensions/molecule/ca_certificate/deleted/verify.yml
+++ /dev/null
@@ -1,26 +0,0 @@
----
-- name: "Verify — ca_certificate (deleted)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather ca_certificate (should be absent after deleted)
-      ansible.platform.ca_certificate:
-        config:
-          - name: "int-cert-alpha"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert int-cert-alpha no longer exists (deleted)
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length == 0
-        fail_msg: "Expected empty after deleted, got: {{ gathered.gathered }}"
-
-...
diff --git a/extensions/molecule/ca_certificate/gathered/cleanup.yml b/extensions/molecule/ca_certificate/gathered/cleanup.yml
deleted file mode 100644
index a3f48f4a..00000000
--- a/extensions/molecule/ca_certificate/gathered/cleanup.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Cleanup — ca_certificate (gathered)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove int-cert-alpha (test teardown)
-      ansible.platform.ca_certificate:
-        config:
-          - name: "int-cert-alpha"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/ca_certificate/gathered/converge.yml b/extensions/molecule/ca_certificate/gathered/converge.yml
deleted file mode 100644
index d1d27c18..00000000
--- a/extensions/molecule/ca_certificate/gathered/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — ca_certificate (gathered)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.ca_certificate with state=gathered
-      ansible.platform.ca_certificate:
-        config:
-          - "{{ expected_config }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/ca_certificate/gathered/prepare.yml b/extensions/molecule/ca_certificate/gathered/prepare.yml
deleted file mode 100644
index 8022cf90..00000000
--- a/extensions/molecule/ca_certificate/gathered/prepare.yml
+++ /dev/null
@@ -1,18 +0,0 @@
----
-- name: "Prepare — ca_certificate (gathered)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed ca_certificate to be gathered (prerequisite for gathered)
-      ansible.platform.ca_certificate:
-        config:
-          - "{{ prepare_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/ca_certificate/gathered/verify.yml b/extensions/molecule/ca_certificate/gathered/verify.yml
deleted file mode 100644
index 8468d3a3..00000000
--- a/extensions/molecule/ca_certificate/gathered/verify.yml
+++ /dev/null
@@ -1,26 +0,0 @@
----
-- name: "Verify — ca_certificate (gathered)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather ca_certificate (assert present after gathered)
-      ansible.platform.ca_certificate:
-        config:
-          - name: "{{ expected_config.name }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert configuration exists after gathered
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length > 0
-        fail_msg: "Expected resource after gathered. got: {{ gathered.gathered }}"
-
-...
diff --git a/extensions/molecule/ca_certificate/merged/cleanup.yml b/extensions/molecule/ca_certificate/merged/cleanup.yml
deleted file mode 100644
index 35ca802c..00000000
--- a/extensions/molecule/ca_certificate/merged/cleanup.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Cleanup — ca_certificate (merged)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove int-cert-alpha (test teardown)
-      ansible.platform.ca_certificate:
-        config:
-          - name: "int-cert-alpha"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/ca_certificate/merged/converge.yml b/extensions/molecule/ca_certificate/merged/converge.yml
deleted file mode 100644
index 66a2ec40..00000000
--- a/extensions/molecule/ca_certificate/merged/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — ca_certificate (merged)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.ca_certificate with state=merged
-      ansible.platform.ca_certificate:
-        config:
-          - "{{ expected_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/ca_certificate/merged/verify.yml b/extensions/molecule/ca_certificate/merged/verify.yml
deleted file mode 100644
index 026e4277..00000000
--- a/extensions/molecule/ca_certificate/merged/verify.yml
+++ /dev/null
@@ -1,26 +0,0 @@
----
-- name: "Verify — ca_certificate (merged)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather ca_certificate (assert present after merged)
-      ansible.platform.ca_certificate:
-        config:
-          - name: "{{ expected_config.name }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert configuration exists after merged
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length > 0
-        fail_msg: "Expected resource after merged. got: {{ gathered.gathered }}"
-
-...
diff --git a/extensions/molecule/ca_certificate/overridden/cleanup.yml b/extensions/molecule/ca_certificate/overridden/cleanup.yml
deleted file mode 100644
index 5b8cc808..00000000
--- a/extensions/molecule/ca_certificate/overridden/cleanup.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Cleanup — ca_certificate (overridden)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove int-cert-alpha (test teardown)
-      ansible.platform.ca_certificate:
-        config:
-          - name: "int-cert-alpha"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/ca_certificate/overridden/converge.yml b/extensions/molecule/ca_certificate/overridden/converge.yml
deleted file mode 100644
index 3a439d64..00000000
--- a/extensions/molecule/ca_certificate/overridden/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — ca_certificate (overridden)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.ca_certificate with state=overridden
-      ansible.platform.ca_certificate:
-        config:
-          - "{{ expected_config }}"
-        state: overridden
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/ca_certificate/overridden/prepare.yml b/extensions/molecule/ca_certificate/overridden/prepare.yml
deleted file mode 100644
index 6d1a303b..00000000
--- a/extensions/molecule/ca_certificate/overridden/prepare.yml
+++ /dev/null
@@ -1,17 +0,0 @@
----
-- name: "Prepare — ca_certificate (overridden)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed prerequisite resources via merged (r0 + r1 + extras for overridden)
-      ansible.platform.ca_certificate:
-        config: "{{ prepare_configs }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/ca_certificate/overridden/verify.yml b/extensions/molecule/ca_certificate/overridden/verify.yml
deleted file mode 100644
index f844fa86..00000000
--- a/extensions/molecule/ca_certificate/overridden/verify.yml
+++ /dev/null
@@ -1,31 +0,0 @@
----
-- name: "Verify — ca_certificate (overridden)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather all ca_certificate resources (verify overridden final state)
-      ansible.platform.ca_certificate:
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered_all
-
-    - name: Assert int-cert-alpha still exists after overridden
-      ansible.builtin.assert:
-        that:
-          - gathered_all.gathered is defined
-          - gathered_all.gathered | selectattr("name", "equalto", "int-cert-alpha") | list | length == 1
-        fail_msg: "Expected int-cert-alpha to exist after overridden. got: {{ gathered_all.gathered }}"
-
-    - name: Assert int-cert-beta was deleted by overridden (not in desired config)
-      ansible.builtin.assert:
-        that:
-          - gathered_all.gathered is defined
-          - gathered_all.gathered | selectattr("name", "equalto", "int-cert-beta") | list | length == 0
-        fail_msg: "overridden should have deleted int-cert-beta. got: {{ gathered_all.gathered }}"
-
-...
diff --git a/extensions/molecule/ca_certificate/replaced/cleanup.yml b/extensions/molecule/ca_certificate/replaced/cleanup.yml
deleted file mode 100644
index 711c2ac0..00000000
--- a/extensions/molecule/ca_certificate/replaced/cleanup.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Cleanup — ca_certificate (replaced)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove int-cert-alpha (test teardown)
-      ansible.platform.ca_certificate:
-        config:
-          - name: "int-cert-alpha"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/ca_certificate/replaced/converge.yml b/extensions/molecule/ca_certificate/replaced/converge.yml
deleted file mode 100644
index 45d8b099..00000000
--- a/extensions/molecule/ca_certificate/replaced/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — ca_certificate (replaced)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.ca_certificate with state=replaced
-      ansible.platform.ca_certificate:
-        config:
-          - "{{ expected_config }}"
-        state: replaced
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/ca_certificate/replaced/prepare.yml b/extensions/molecule/ca_certificate/replaced/prepare.yml
deleted file mode 100644
index 34a7d3d7..00000000
--- a/extensions/molecule/ca_certificate/replaced/prepare.yml
+++ /dev/null
@@ -1,18 +0,0 @@
----
-- name: "Prepare — ca_certificate (replaced)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed ca_certificate to be replaced (prerequisite for replaced)
-      ansible.platform.ca_certificate:
-        config:
-          - "{{ prepare_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/ca_certificate/replaced/verify.yml b/extensions/molecule/ca_certificate/replaced/verify.yml
deleted file mode 100644
index 6c2462a3..00000000
--- a/extensions/molecule/ca_certificate/replaced/verify.yml
+++ /dev/null
@@ -1,32 +0,0 @@
----
-- name: "Verify — ca_certificate (replaced)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather ca_certificate (assert present after replaced)
-      ansible.platform.ca_certificate:
-        config:
-          - name: "{{ expected_config.name }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert configuration exists after replaced
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length > 0
-        fail_msg: "Expected resource after replaced. got: {{ gathered.gathered }}"
-
-    - name: Assert pem_data was updated by replaced
-      ansible.builtin.assert:
-        that:
-          - (gathered.gathered | first).pem_data == expected_config.pem_data
-        fail_msg: "replaced should have set pem_data='LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0t'. got: {{ (gathered.gathered | first).pem_data }}"
-
-...
diff --git a/extensions/molecule/ca_certificates/check/cleanup.yml b/extensions/molecule/ca_certificates/check/cleanup.yml
new file mode 100644
index 00000000..5d263097
--- /dev/null
+++ b/extensions/molecule/ca_certificates/check/cleanup.yml
@@ -0,0 +1,19 @@
+---
+- name: "Cleanup — ca_certificates (check)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove int-cert-alpha (test teardown)
+      ansible.platform.ca_certificates:
+        config:
+          - name: "int-cert-alpha"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/ca_certificates/check/converge.yml b/extensions/molecule/ca_certificates/check/converge.yml
new file mode 100644
index 00000000..64dd3629
--- /dev/null
+++ b/extensions/molecule/ca_certificates/check/converge.yml
@@ -0,0 +1,36 @@
+---
+- name: "Converge — ca_certificates (check)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.ca_certificates with state=merged
+      ansible.platform.ca_certificates:
+        config:
+          - "{{ expected_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      check_mode: true
+      diff: true
+      register: result
+
+    - name: Assert check mode predicted a change
+      ansible.builtin.assert:
+        that:
+          - result.changed == true
+          - result.before is defined
+          - result.after is defined
+        fail_msg: "check mode should predict a change. got={{ result }}"
+
+    - name: Assert diff output is present
+      ansible.builtin.assert:
+        that:
+          - result.diff is defined
+        fail_msg: "diff output missing from check result"
+      when: result.diff is defined
+
+...
diff --git a/extensions/molecule/ca_certificate/check/molecule.yml b/extensions/molecule/ca_certificates/check/molecule.yml
similarity index 100%
rename from extensions/molecule/ca_certificate/check/molecule.yml
rename to extensions/molecule/ca_certificates/check/molecule.yml
diff --git a/extensions/molecule/ca_certificates/check/prepare.yml b/extensions/molecule/ca_certificates/check/prepare.yml
new file mode 100644
index 00000000..5d0eda05
--- /dev/null
+++ b/extensions/molecule/ca_certificates/check/prepare.yml
@@ -0,0 +1,18 @@
+---
+- name: "Prepare — ca_certificates (check)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed ca_certificates as check-mode baseline (prerequisite for check)
+      ansible.platform.ca_certificates:
+        config:
+          - "{{ prepare_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/ca_certificate/check/vars.yml b/extensions/molecule/ca_certificates/check/vars.yml
similarity index 100%
rename from extensions/molecule/ca_certificate/check/vars.yml
rename to extensions/molecule/ca_certificates/check/vars.yml
diff --git a/extensions/molecule/ca_certificates/check/verify.yml b/extensions/molecule/ca_certificates/check/verify.yml
new file mode 100644
index 00000000..98fdee0d
--- /dev/null
+++ b/extensions/molecule/ca_certificates/check/verify.yml
@@ -0,0 +1,27 @@
+---
+- name: "Verify — ca_certificates (check)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather ca_certificates (check mode must not have applied changes)
+      ansible.platform.ca_certificates:
+        config:
+          - name: "{{ expected_config.name }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert int-cert-alpha still has prepare_config values (check did not apply)
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length > 0
+          - (gathered.gathered | first).pem_data == prepare_config.pem_data
+        fail_msg: "check mode should not alter resource. got: {{ gathered.gathered }}"
+
+...
diff --git a/extensions/molecule/ca_certificates/deleted/cleanup.yml b/extensions/molecule/ca_certificates/deleted/cleanup.yml
new file mode 100644
index 00000000..c29a6b94
--- /dev/null
+++ b/extensions/molecule/ca_certificates/deleted/cleanup.yml
@@ -0,0 +1,12 @@
+---
+- name: "Cleanup — ca_certificates (deleted)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: No-op — int-cert-alpha already deleted by converge
+      ansible.builtin.debug:
+        msg: "int-cert-alpha was deleted in converge — nothing to clean up"
+
+...
diff --git a/extensions/molecule/ca_certificates/deleted/converge.yml b/extensions/molecule/ca_certificates/deleted/converge.yml
new file mode 100644
index 00000000..2750e147
--- /dev/null
+++ b/extensions/molecule/ca_certificates/deleted/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — ca_certificates (deleted)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.ca_certificates with state=deleted
+      ansible.platform.ca_certificates:
+        config:
+          - "{{ expected_config }}"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/ca_certificate/deleted/molecule.yml b/extensions/molecule/ca_certificates/deleted/molecule.yml
similarity index 100%
rename from extensions/molecule/ca_certificate/deleted/molecule.yml
rename to extensions/molecule/ca_certificates/deleted/molecule.yml
diff --git a/extensions/molecule/ca_certificates/deleted/prepare.yml b/extensions/molecule/ca_certificates/deleted/prepare.yml
new file mode 100644
index 00000000..4b84880c
--- /dev/null
+++ b/extensions/molecule/ca_certificates/deleted/prepare.yml
@@ -0,0 +1,18 @@
+---
+- name: "Prepare — ca_certificates (deleted)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed ca_certificates to be deleted (prerequisite for deleted)
+      ansible.platform.ca_certificates:
+        config:
+          - "{{ prepare_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/ca_certificate/deleted/vars.yml b/extensions/molecule/ca_certificates/deleted/vars.yml
similarity index 100%
rename from extensions/molecule/ca_certificate/deleted/vars.yml
rename to extensions/molecule/ca_certificates/deleted/vars.yml
diff --git a/extensions/molecule/ca_certificates/deleted/verify.yml b/extensions/molecule/ca_certificates/deleted/verify.yml
new file mode 100644
index 00000000..3c60949d
--- /dev/null
+++ b/extensions/molecule/ca_certificates/deleted/verify.yml
@@ -0,0 +1,26 @@
+---
+- name: "Verify — ca_certificates (deleted)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather ca_certificates (should be absent after deleted)
+      ansible.platform.ca_certificates:
+        config:
+          - name: "int-cert-alpha"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert int-cert-alpha no longer exists (deleted)
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length == 0
+        fail_msg: "Expected empty after deleted, got: {{ gathered.gathered }}"
+
+...
diff --git a/extensions/molecule/ca_certificates/gathered/cleanup.yml b/extensions/molecule/ca_certificates/gathered/cleanup.yml
new file mode 100644
index 00000000..ceeaf7a1
--- /dev/null
+++ b/extensions/molecule/ca_certificates/gathered/cleanup.yml
@@ -0,0 +1,19 @@
+---
+- name: "Cleanup — ca_certificates (gathered)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove int-cert-alpha (test teardown)
+      ansible.platform.ca_certificates:
+        config:
+          - name: "int-cert-alpha"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/ca_certificates/gathered/converge.yml b/extensions/molecule/ca_certificates/gathered/converge.yml
new file mode 100644
index 00000000..e07e1739
--- /dev/null
+++ b/extensions/molecule/ca_certificates/gathered/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — ca_certificates (gathered)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.ca_certificates with state=gathered
+      ansible.platform.ca_certificates:
+        config:
+          - "{{ expected_config }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/ca_certificate/gathered/molecule.yml b/extensions/molecule/ca_certificates/gathered/molecule.yml
similarity index 100%
rename from extensions/molecule/ca_certificate/gathered/molecule.yml
rename to extensions/molecule/ca_certificates/gathered/molecule.yml
diff --git a/extensions/molecule/ca_certificates/gathered/prepare.yml b/extensions/molecule/ca_certificates/gathered/prepare.yml
new file mode 100644
index 00000000..b815d2eb
--- /dev/null
+++ b/extensions/molecule/ca_certificates/gathered/prepare.yml
@@ -0,0 +1,18 @@
+---
+- name: "Prepare — ca_certificates (gathered)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed ca_certificates to be gathered (prerequisite for gathered)
+      ansible.platform.ca_certificates:
+        config:
+          - "{{ prepare_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/ca_certificate/gathered/vars.yml b/extensions/molecule/ca_certificates/gathered/vars.yml
similarity index 100%
rename from extensions/molecule/ca_certificate/gathered/vars.yml
rename to extensions/molecule/ca_certificates/gathered/vars.yml
diff --git a/extensions/molecule/ca_certificates/gathered/verify.yml b/extensions/molecule/ca_certificates/gathered/verify.yml
new file mode 100644
index 00000000..7bc98ee9
--- /dev/null
+++ b/extensions/molecule/ca_certificates/gathered/verify.yml
@@ -0,0 +1,26 @@
+---
+- name: "Verify — ca_certificates (gathered)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather ca_certificates (assert present after gathered)
+      ansible.platform.ca_certificates:
+        config:
+          - name: "{{ expected_config.name }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert configuration exists after gathered
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length > 0
+        fail_msg: "Expected resource after gathered. got: {{ gathered.gathered }}"
+
+...
diff --git a/extensions/molecule/ca_certificate/inventory.yml b/extensions/molecule/ca_certificates/inventory.yml
similarity index 100%
rename from extensions/molecule/ca_certificate/inventory.yml
rename to extensions/molecule/ca_certificates/inventory.yml
diff --git a/extensions/molecule/ca_certificates/merged/cleanup.yml b/extensions/molecule/ca_certificates/merged/cleanup.yml
new file mode 100644
index 00000000..9094aca9
--- /dev/null
+++ b/extensions/molecule/ca_certificates/merged/cleanup.yml
@@ -0,0 +1,19 @@
+---
+- name: "Cleanup — ca_certificates (merged)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove int-cert-alpha (test teardown)
+      ansible.platform.ca_certificates:
+        config:
+          - name: "int-cert-alpha"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/ca_certificates/merged/converge.yml b/extensions/molecule/ca_certificates/merged/converge.yml
new file mode 100644
index 00000000..50bc1a95
--- /dev/null
+++ b/extensions/molecule/ca_certificates/merged/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — ca_certificates (merged)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.ca_certificates with state=merged
+      ansible.platform.ca_certificates:
+        config:
+          - "{{ expected_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/ca_certificate/merged/molecule.yml b/extensions/molecule/ca_certificates/merged/molecule.yml
similarity index 100%
rename from extensions/molecule/ca_certificate/merged/molecule.yml
rename to extensions/molecule/ca_certificates/merged/molecule.yml
diff --git a/extensions/molecule/ca_certificate/merged/vars.yml b/extensions/molecule/ca_certificates/merged/vars.yml
similarity index 100%
rename from extensions/molecule/ca_certificate/merged/vars.yml
rename to extensions/molecule/ca_certificates/merged/vars.yml
diff --git a/extensions/molecule/ca_certificates/merged/verify.yml b/extensions/molecule/ca_certificates/merged/verify.yml
new file mode 100644
index 00000000..8d718833
--- /dev/null
+++ b/extensions/molecule/ca_certificates/merged/verify.yml
@@ -0,0 +1,26 @@
+---
+- name: "Verify — ca_certificates (merged)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather ca_certificates (assert present after merged)
+      ansible.platform.ca_certificates:
+        config:
+          - name: "{{ expected_config.name }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert configuration exists after merged
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length > 0
+        fail_msg: "Expected resource after merged. got: {{ gathered.gathered }}"
+
+...
diff --git a/extensions/molecule/ca_certificates/overridden/cleanup.yml b/extensions/molecule/ca_certificates/overridden/cleanup.yml
new file mode 100644
index 00000000..30d21591
--- /dev/null
+++ b/extensions/molecule/ca_certificates/overridden/cleanup.yml
@@ -0,0 +1,19 @@
+---
+- name: "Cleanup — ca_certificates (overridden)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove int-cert-alpha (test teardown)
+      ansible.platform.ca_certificates:
+        config:
+          - name: "int-cert-alpha"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/ca_certificates/overridden/converge.yml b/extensions/molecule/ca_certificates/overridden/converge.yml
new file mode 100644
index 00000000..1b777a6f
--- /dev/null
+++ b/extensions/molecule/ca_certificates/overridden/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — ca_certificates (overridden)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.ca_certificates with state=overridden
+      ansible.platform.ca_certificates:
+        config:
+          - "{{ expected_config }}"
+        state: overridden
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/ca_certificate/overridden/molecule.yml b/extensions/molecule/ca_certificates/overridden/molecule.yml
similarity index 100%
rename from extensions/molecule/ca_certificate/overridden/molecule.yml
rename to extensions/molecule/ca_certificates/overridden/molecule.yml
diff --git a/extensions/molecule/ca_certificates/overridden/prepare.yml b/extensions/molecule/ca_certificates/overridden/prepare.yml
new file mode 100644
index 00000000..766303c7
--- /dev/null
+++ b/extensions/molecule/ca_certificates/overridden/prepare.yml
@@ -0,0 +1,17 @@
+---
+- name: "Prepare — ca_certificates (overridden)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed prerequisite resources via merged (r0 + r1 + extras for overridden)
+      ansible.platform.ca_certificates:
+        config: "{{ prepare_configs }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/ca_certificate/overridden/vars.yml b/extensions/molecule/ca_certificates/overridden/vars.yml
similarity index 100%
rename from extensions/molecule/ca_certificate/overridden/vars.yml
rename to extensions/molecule/ca_certificates/overridden/vars.yml
diff --git a/extensions/molecule/ca_certificates/overridden/verify.yml b/extensions/molecule/ca_certificates/overridden/verify.yml
new file mode 100644
index 00000000..62cad631
--- /dev/null
+++ b/extensions/molecule/ca_certificates/overridden/verify.yml
@@ -0,0 +1,31 @@
+---
+- name: "Verify — ca_certificates (overridden)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather all ca_certificates resources (verify overridden final state)
+      ansible.platform.ca_certificates:
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered_all
+
+    - name: Assert int-cert-alpha still exists after overridden
+      ansible.builtin.assert:
+        that:
+          - gathered_all.gathered is defined
+          - gathered_all.gathered | selectattr("name", "equalto", "int-cert-alpha") | list | length == 1
+        fail_msg: "Expected int-cert-alpha to exist after overridden. got: {{ gathered_all.gathered }}"
+
+    - name: Assert int-cert-beta was deleted by overridden (not in desired config)
+      ansible.builtin.assert:
+        that:
+          - gathered_all.gathered is defined
+          - gathered_all.gathered | selectattr("name", "equalto", "int-cert-beta") | list | length == 0
+        fail_msg: "overridden should have deleted int-cert-beta. got: {{ gathered_all.gathered }}"
+
+...
diff --git a/extensions/molecule/ca_certificates/replaced/cleanup.yml b/extensions/molecule/ca_certificates/replaced/cleanup.yml
new file mode 100644
index 00000000..c06f4346
--- /dev/null
+++ b/extensions/molecule/ca_certificates/replaced/cleanup.yml
@@ -0,0 +1,19 @@
+---
+- name: "Cleanup — ca_certificates (replaced)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove int-cert-alpha (test teardown)
+      ansible.platform.ca_certificates:
+        config:
+          - name: "int-cert-alpha"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/ca_certificates/replaced/converge.yml b/extensions/molecule/ca_certificates/replaced/converge.yml
new file mode 100644
index 00000000..3ad2ba7f
--- /dev/null
+++ b/extensions/molecule/ca_certificates/replaced/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — ca_certificates (replaced)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.ca_certificates with state=replaced
+      ansible.platform.ca_certificates:
+        config:
+          - "{{ expected_config }}"
+        state: replaced
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/ca_certificate/replaced/molecule.yml b/extensions/molecule/ca_certificates/replaced/molecule.yml
similarity index 100%
rename from extensions/molecule/ca_certificate/replaced/molecule.yml
rename to extensions/molecule/ca_certificates/replaced/molecule.yml
diff --git a/extensions/molecule/ca_certificates/replaced/prepare.yml b/extensions/molecule/ca_certificates/replaced/prepare.yml
new file mode 100644
index 00000000..6d07a8b7
--- /dev/null
+++ b/extensions/molecule/ca_certificates/replaced/prepare.yml
@@ -0,0 +1,18 @@
+---
+- name: "Prepare — ca_certificates (replaced)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed ca_certificates to be replaced (prerequisite for replaced)
+      ansible.platform.ca_certificates:
+        config:
+          - "{{ prepare_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/ca_certificate/replaced/vars.yml b/extensions/molecule/ca_certificates/replaced/vars.yml
similarity index 100%
rename from extensions/molecule/ca_certificate/replaced/vars.yml
rename to extensions/molecule/ca_certificates/replaced/vars.yml
diff --git a/extensions/molecule/ca_certificates/replaced/verify.yml b/extensions/molecule/ca_certificates/replaced/verify.yml
new file mode 100644
index 00000000..a7c4dcee
--- /dev/null
+++ b/extensions/molecule/ca_certificates/replaced/verify.yml
@@ -0,0 +1,32 @@
+---
+- name: "Verify — ca_certificates (replaced)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather ca_certificates (assert present after replaced)
+      ansible.platform.ca_certificates:
+        config:
+          - name: "{{ expected_config.name }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert configuration exists after replaced
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length > 0
+        fail_msg: "Expected resource after replaced. got: {{ gathered.gathered }}"
+
+    - name: Assert pem_data was updated by replaced
+      ansible.builtin.assert:
+        that:
+          - (gathered.gathered | first).pem_data == expected_config.pem_data
+        fail_msg: "replaced should have set pem_data='LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0t'. got: {{ (gathered.gathered | first).pem_data }}"
+
+...
diff --git a/extensions/molecule/http_port/check/cleanup.yml b/extensions/molecule/http_port/check/cleanup.yml
deleted file mode 100644
index 6830e862..00000000
--- a/extensions/molecule/http_port/check/cleanup.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Cleanup — http_port (check)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove int-port-alpha (test teardown)
-      ansible.platform.http_port:
-        config:
-          - name: "int-port-alpha"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/http_port/check/converge.yml b/extensions/molecule/http_port/check/converge.yml
deleted file mode 100644
index f2af6b03..00000000
--- a/extensions/molecule/http_port/check/converge.yml
+++ /dev/null
@@ -1,36 +0,0 @@
----
-- name: "Converge — http_port (check)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.http_port with state=merged
-      ansible.platform.http_port:
-        config:
-          - "{{ expected_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      check_mode: true
-      diff: true
-      register: result
-
-    - name: Assert check mode predicted a change
-      ansible.builtin.assert:
-        that:
-          - result.changed == true
-          - result.before is defined
-          - result.after is defined
-        fail_msg: "check mode should predict a change. got={{ result }}"
-
-    - name: Assert diff output is present
-      ansible.builtin.assert:
-        that:
-          - result.diff is defined
-        fail_msg: "diff output missing from check result"
-      when: result.diff is defined
-
-...
diff --git a/extensions/molecule/http_port/check/prepare.yml b/extensions/molecule/http_port/check/prepare.yml
deleted file mode 100644
index 5ebe7fa6..00000000
--- a/extensions/molecule/http_port/check/prepare.yml
+++ /dev/null
@@ -1,18 +0,0 @@
----
-- name: "Prepare — http_port (check)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed http_port as check-mode baseline (prerequisite for check)
-      ansible.platform.http_port:
-        config:
-          - "{{ prepare_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/http_port/check/verify.yml b/extensions/molecule/http_port/check/verify.yml
deleted file mode 100644
index 31d2a55c..00000000
--- a/extensions/molecule/http_port/check/verify.yml
+++ /dev/null
@@ -1,27 +0,0 @@
----
-- name: "Verify — http_port (check)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather http_port (check mode must not have applied changes)
-      ansible.platform.http_port:
-        config:
-          - name: "{{ expected_config.name }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert int-port-alpha still has prepare_config values (check did not apply)
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length > 0
-          - (gathered.gathered | first).use_https == prepare_config.use_https
-        fail_msg: "check mode should not alter resource. got: {{ gathered.gathered }}"
-
-...
diff --git a/extensions/molecule/http_port/deleted/cleanup.yml b/extensions/molecule/http_port/deleted/cleanup.yml
deleted file mode 100644
index a672564e..00000000
--- a/extensions/molecule/http_port/deleted/cleanup.yml
+++ /dev/null
@@ -1,12 +0,0 @@
----
-- name: "Cleanup — http_port (deleted)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: No-op — int-port-alpha already deleted by converge
-      ansible.builtin.debug:
-        msg: "int-port-alpha was deleted in converge — nothing to clean up"
-
-...
diff --git a/extensions/molecule/http_port/deleted/converge.yml b/extensions/molecule/http_port/deleted/converge.yml
deleted file mode 100644
index d57a27a5..00000000
--- a/extensions/molecule/http_port/deleted/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — http_port (deleted)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.http_port with state=deleted
-      ansible.platform.http_port:
-        config:
-          - "{{ expected_config }}"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/http_port/deleted/prepare.yml b/extensions/molecule/http_port/deleted/prepare.yml
deleted file mode 100644
index 513fcbac..00000000
--- a/extensions/molecule/http_port/deleted/prepare.yml
+++ /dev/null
@@ -1,18 +0,0 @@
----
-- name: "Prepare — http_port (deleted)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed http_port to be deleted (prerequisite for deleted)
-      ansible.platform.http_port:
-        config:
-          - "{{ prepare_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/http_port/deleted/verify.yml b/extensions/molecule/http_port/deleted/verify.yml
deleted file mode 100644
index 98ff97be..00000000
--- a/extensions/molecule/http_port/deleted/verify.yml
+++ /dev/null
@@ -1,26 +0,0 @@
----
-- name: "Verify — http_port (deleted)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather http_port (should be absent after deleted)
-      ansible.platform.http_port:
-        config:
-          - name: "int-port-alpha"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert int-port-alpha no longer exists (deleted)
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length == 0
-        fail_msg: "Expected empty after deleted, got: {{ gathered.gathered }}"
-
-...
diff --git a/extensions/molecule/http_port/gathered/cleanup.yml b/extensions/molecule/http_port/gathered/cleanup.yml
deleted file mode 100644
index 46d49208..00000000
--- a/extensions/molecule/http_port/gathered/cleanup.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Cleanup — http_port (gathered)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove int-port-alpha (test teardown)
-      ansible.platform.http_port:
-        config:
-          - name: "int-port-alpha"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/http_port/gathered/converge.yml b/extensions/molecule/http_port/gathered/converge.yml
deleted file mode 100644
index 60a26150..00000000
--- a/extensions/molecule/http_port/gathered/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — http_port (gathered)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.http_port with state=gathered
-      ansible.platform.http_port:
-        config:
-          - "{{ expected_config }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/http_port/gathered/prepare.yml b/extensions/molecule/http_port/gathered/prepare.yml
deleted file mode 100644
index 6d9fc225..00000000
--- a/extensions/molecule/http_port/gathered/prepare.yml
+++ /dev/null
@@ -1,18 +0,0 @@
----
-- name: "Prepare — http_port (gathered)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed http_port to be gathered (prerequisite for gathered)
-      ansible.platform.http_port:
-        config:
-          - "{{ prepare_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/http_port/gathered/verify.yml b/extensions/molecule/http_port/gathered/verify.yml
deleted file mode 100644
index aced5c6b..00000000
--- a/extensions/molecule/http_port/gathered/verify.yml
+++ /dev/null
@@ -1,26 +0,0 @@
----
-- name: "Verify — http_port (gathered)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather http_port (assert present after gathered)
-      ansible.platform.http_port:
-        config:
-          - name: "{{ expected_config.name }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert configuration exists after gathered
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length > 0
-        fail_msg: "Expected resource after gathered. got: {{ gathered.gathered }}"
-
-...
diff --git a/extensions/molecule/http_port/merged/cleanup.yml b/extensions/molecule/http_port/merged/cleanup.yml
deleted file mode 100644
index eab7bfee..00000000
--- a/extensions/molecule/http_port/merged/cleanup.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Cleanup — http_port (merged)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove int-port-alpha (test teardown)
-      ansible.platform.http_port:
-        config:
-          - name: "int-port-alpha"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/http_port/merged/converge.yml b/extensions/molecule/http_port/merged/converge.yml
deleted file mode 100644
index c9328c18..00000000
--- a/extensions/molecule/http_port/merged/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — http_port (merged)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.http_port with state=merged
-      ansible.platform.http_port:
-        config:
-          - "{{ expected_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/http_port/merged/verify.yml b/extensions/molecule/http_port/merged/verify.yml
deleted file mode 100644
index 2ac3c67e..00000000
--- a/extensions/molecule/http_port/merged/verify.yml
+++ /dev/null
@@ -1,26 +0,0 @@
----
-- name: "Verify — http_port (merged)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather http_port (assert present after merged)
-      ansible.platform.http_port:
-        config:
-          - name: "{{ expected_config.name }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert configuration exists after merged
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length > 0
-        fail_msg: "Expected resource after merged. got: {{ gathered.gathered }}"
-
-...
diff --git a/extensions/molecule/http_port/overridden/cleanup.yml b/extensions/molecule/http_port/overridden/cleanup.yml
deleted file mode 100644
index c97e2125..00000000
--- a/extensions/molecule/http_port/overridden/cleanup.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Cleanup — http_port (overridden)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove int-port-alpha (test teardown)
-      ansible.platform.http_port:
-        config:
-          - name: "int-port-alpha"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/http_port/overridden/converge.yml b/extensions/molecule/http_port/overridden/converge.yml
deleted file mode 100644
index 46d6be24..00000000
--- a/extensions/molecule/http_port/overridden/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — http_port (overridden)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.http_port with state=overridden
-      ansible.platform.http_port:
-        config:
-          - "{{ expected_config }}"
-        state: overridden
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/http_port/overridden/prepare.yml b/extensions/molecule/http_port/overridden/prepare.yml
deleted file mode 100644
index 7dc95686..00000000
--- a/extensions/molecule/http_port/overridden/prepare.yml
+++ /dev/null
@@ -1,17 +0,0 @@
----
-- name: "Prepare — http_port (overridden)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed prerequisite resources via merged (r0 + r1 + extras for overridden)
-      ansible.platform.http_port:
-        config: "{{ prepare_configs }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/http_port/overridden/verify.yml b/extensions/molecule/http_port/overridden/verify.yml
deleted file mode 100644
index 0987e000..00000000
--- a/extensions/molecule/http_port/overridden/verify.yml
+++ /dev/null
@@ -1,31 +0,0 @@
----
-- name: "Verify — http_port (overridden)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather all http_port resources (verify overridden final state)
-      ansible.platform.http_port:
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered_all
-
-    - name: Assert int-port-alpha still exists after overridden
-      ansible.builtin.assert:
-        that:
-          - gathered_all.gathered is defined
-          - gathered_all.gathered | selectattr("name", "equalto", "int-port-alpha") | list | length == 1
-        fail_msg: "Expected int-port-alpha to exist after overridden. got: {{ gathered_all.gathered }}"
-
-    - name: Assert int-port-beta was deleted by overridden (not in desired config)
-      ansible.builtin.assert:
-        that:
-          - gathered_all.gathered is defined
-          - gathered_all.gathered | selectattr("name", "equalto", "int-port-beta") | list | length == 0
-        fail_msg: "overridden should have deleted int-port-beta. got: {{ gathered_all.gathered }}"
-
-...
diff --git a/extensions/molecule/http_port/replaced/cleanup.yml b/extensions/molecule/http_port/replaced/cleanup.yml
deleted file mode 100644
index 5cf8b43f..00000000
--- a/extensions/molecule/http_port/replaced/cleanup.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Cleanup — http_port (replaced)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove int-port-alpha (test teardown)
-      ansible.platform.http_port:
-        config:
-          - name: "int-port-alpha"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/http_port/replaced/converge.yml b/extensions/molecule/http_port/replaced/converge.yml
deleted file mode 100644
index b036e098..00000000
--- a/extensions/molecule/http_port/replaced/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — http_port (replaced)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.http_port with state=replaced
-      ansible.platform.http_port:
-        config:
-          - "{{ expected_config }}"
-        state: replaced
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/http_port/replaced/prepare.yml b/extensions/molecule/http_port/replaced/prepare.yml
deleted file mode 100644
index bdce5b1b..00000000
--- a/extensions/molecule/http_port/replaced/prepare.yml
+++ /dev/null
@@ -1,18 +0,0 @@
----
-- name: "Prepare — http_port (replaced)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed http_port to be replaced (prerequisite for replaced)
-      ansible.platform.http_port:
-        config:
-          - "{{ prepare_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/http_port/replaced/verify.yml b/extensions/molecule/http_port/replaced/verify.yml
deleted file mode 100644
index d1a77cc3..00000000
--- a/extensions/molecule/http_port/replaced/verify.yml
+++ /dev/null
@@ -1,32 +0,0 @@
----
-- name: "Verify — http_port (replaced)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather http_port (assert present after replaced)
-      ansible.platform.http_port:
-        config:
-          - name: "{{ expected_config.name }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert configuration exists after replaced
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length > 0
-        fail_msg: "Expected resource after replaced. got: {{ gathered.gathered }}"
-
-    - name: Assert use_https was updated by replaced
-      ansible.builtin.assert:
-        that:
-          - (gathered.gathered | first).use_https == expected_config.use_https
-        fail_msg: "replaced should have set use_https=False. got: {{ (gathered.gathered | first).use_https }}"
-
-...
diff --git a/extensions/molecule/http_ports/check/cleanup.yml b/extensions/molecule/http_ports/check/cleanup.yml
new file mode 100644
index 00000000..1626d092
--- /dev/null
+++ b/extensions/molecule/http_ports/check/cleanup.yml
@@ -0,0 +1,19 @@
+---
+- name: "Cleanup — http_ports (check)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove int-port-alpha (test teardown)
+      ansible.platform.http_ports:
+        config:
+          - name: "int-port-alpha"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/http_ports/check/converge.yml b/extensions/molecule/http_ports/check/converge.yml
new file mode 100644
index 00000000..86bd2c0f
--- /dev/null
+++ b/extensions/molecule/http_ports/check/converge.yml
@@ -0,0 +1,36 @@
+---
+- name: "Converge — http_ports (check)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.http_ports with state=merged
+      ansible.platform.http_ports:
+        config:
+          - "{{ expected_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      check_mode: true
+      diff: true
+      register: result
+
+    - name: Assert check mode predicted a change
+      ansible.builtin.assert:
+        that:
+          - result.changed == true
+          - result.before is defined
+          - result.after is defined
+        fail_msg: "check mode should predict a change. got={{ result }}"
+
+    - name: Assert diff output is present
+      ansible.builtin.assert:
+        that:
+          - result.diff is defined
+        fail_msg: "diff output missing from check result"
+      when: result.diff is defined
+
+...
diff --git a/extensions/molecule/http_port/check/molecule.yml b/extensions/molecule/http_ports/check/molecule.yml
similarity index 100%
rename from extensions/molecule/http_port/check/molecule.yml
rename to extensions/molecule/http_ports/check/molecule.yml
diff --git a/extensions/molecule/http_ports/check/prepare.yml b/extensions/molecule/http_ports/check/prepare.yml
new file mode 100644
index 00000000..e18cf134
--- /dev/null
+++ b/extensions/molecule/http_ports/check/prepare.yml
@@ -0,0 +1,18 @@
+---
+- name: "Prepare — http_ports (check)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed http_ports as check-mode baseline (prerequisite for check)
+      ansible.platform.http_ports:
+        config:
+          - "{{ prepare_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/http_port/check/vars.yml b/extensions/molecule/http_ports/check/vars.yml
similarity index 100%
rename from extensions/molecule/http_port/check/vars.yml
rename to extensions/molecule/http_ports/check/vars.yml
diff --git a/extensions/molecule/http_ports/check/verify.yml b/extensions/molecule/http_ports/check/verify.yml
new file mode 100644
index 00000000..dc06a45e
--- /dev/null
+++ b/extensions/molecule/http_ports/check/verify.yml
@@ -0,0 +1,27 @@
+---
+- name: "Verify — http_ports (check)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather http_ports (check mode must not have applied changes)
+      ansible.platform.http_ports:
+        config:
+          - name: "{{ expected_config.name }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert int-port-alpha still has prepare_config values (check did not apply)
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length > 0
+          - (gathered.gathered | first).use_https == prepare_config.use_https
+        fail_msg: "check mode should not alter resource. got: {{ gathered.gathered }}"
+
+...
diff --git a/extensions/molecule/http_ports/deleted/cleanup.yml b/extensions/molecule/http_ports/deleted/cleanup.yml
new file mode 100644
index 00000000..0f420f26
--- /dev/null
+++ b/extensions/molecule/http_ports/deleted/cleanup.yml
@@ -0,0 +1,12 @@
+---
+- name: "Cleanup — http_ports (deleted)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: No-op — int-port-alpha already deleted by converge
+      ansible.builtin.debug:
+        msg: "int-port-alpha was deleted in converge — nothing to clean up"
+
+...
diff --git a/extensions/molecule/http_ports/deleted/converge.yml b/extensions/molecule/http_ports/deleted/converge.yml
new file mode 100644
index 00000000..21792d93
--- /dev/null
+++ b/extensions/molecule/http_ports/deleted/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — http_ports (deleted)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.http_ports with state=deleted
+      ansible.platform.http_ports:
+        config:
+          - "{{ expected_config }}"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/http_port/deleted/molecule.yml b/extensions/molecule/http_ports/deleted/molecule.yml
similarity index 100%
rename from extensions/molecule/http_port/deleted/molecule.yml
rename to extensions/molecule/http_ports/deleted/molecule.yml
diff --git a/extensions/molecule/http_ports/deleted/prepare.yml b/extensions/molecule/http_ports/deleted/prepare.yml
new file mode 100644
index 00000000..8382797d
--- /dev/null
+++ b/extensions/molecule/http_ports/deleted/prepare.yml
@@ -0,0 +1,18 @@
+---
+- name: "Prepare — http_ports (deleted)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed http_ports to be deleted (prerequisite for deleted)
+      ansible.platform.http_ports:
+        config:
+          - "{{ prepare_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/http_port/deleted/vars.yml b/extensions/molecule/http_ports/deleted/vars.yml
similarity index 100%
rename from extensions/molecule/http_port/deleted/vars.yml
rename to extensions/molecule/http_ports/deleted/vars.yml
diff --git a/extensions/molecule/http_ports/deleted/verify.yml b/extensions/molecule/http_ports/deleted/verify.yml
new file mode 100644
index 00000000..ed8c4d26
--- /dev/null
+++ b/extensions/molecule/http_ports/deleted/verify.yml
@@ -0,0 +1,26 @@
+---
+- name: "Verify — http_ports (deleted)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather http_ports (should be absent after deleted)
+      ansible.platform.http_ports:
+        config:
+          - name: "int-port-alpha"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert int-port-alpha no longer exists (deleted)
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length == 0
+        fail_msg: "Expected empty after deleted, got: {{ gathered.gathered }}"
+
+...
diff --git a/extensions/molecule/http_ports/gathered/cleanup.yml b/extensions/molecule/http_ports/gathered/cleanup.yml
new file mode 100644
index 00000000..41b9bc1a
--- /dev/null
+++ b/extensions/molecule/http_ports/gathered/cleanup.yml
@@ -0,0 +1,19 @@
+---
+- name: "Cleanup — http_ports (gathered)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove int-port-alpha (test teardown)
+      ansible.platform.http_ports:
+        config:
+          - name: "int-port-alpha"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/http_ports/gathered/converge.yml b/extensions/molecule/http_ports/gathered/converge.yml
new file mode 100644
index 00000000..c81196f4
--- /dev/null
+++ b/extensions/molecule/http_ports/gathered/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — http_ports (gathered)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.http_ports with state=gathered
+      ansible.platform.http_ports:
+        config:
+          - "{{ expected_config }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/http_port/gathered/molecule.yml b/extensions/molecule/http_ports/gathered/molecule.yml
similarity index 100%
rename from extensions/molecule/http_port/gathered/molecule.yml
rename to extensions/molecule/http_ports/gathered/molecule.yml
diff --git a/extensions/molecule/http_ports/gathered/prepare.yml b/extensions/molecule/http_ports/gathered/prepare.yml
new file mode 100644
index 00000000..4c57f713
--- /dev/null
+++ b/extensions/molecule/http_ports/gathered/prepare.yml
@@ -0,0 +1,18 @@
+---
+- name: "Prepare — http_ports (gathered)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed http_ports to be gathered (prerequisite for gathered)
+      ansible.platform.http_ports:
+        config:
+          - "{{ prepare_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/http_port/gathered/vars.yml b/extensions/molecule/http_ports/gathered/vars.yml
similarity index 100%
rename from extensions/molecule/http_port/gathered/vars.yml
rename to extensions/molecule/http_ports/gathered/vars.yml
diff --git a/extensions/molecule/http_ports/gathered/verify.yml b/extensions/molecule/http_ports/gathered/verify.yml
new file mode 100644
index 00000000..dd07592f
--- /dev/null
+++ b/extensions/molecule/http_ports/gathered/verify.yml
@@ -0,0 +1,26 @@
+---
+- name: "Verify — http_ports (gathered)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather http_ports (assert present after gathered)
+      ansible.platform.http_ports:
+        config:
+          - name: "{{ expected_config.name }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert configuration exists after gathered
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length > 0
+        fail_msg: "Expected resource after gathered. got: {{ gathered.gathered }}"
+
+...
diff --git a/extensions/molecule/http_port/inventory.yml b/extensions/molecule/http_ports/inventory.yml
similarity index 100%
rename from extensions/molecule/http_port/inventory.yml
rename to extensions/molecule/http_ports/inventory.yml
diff --git a/extensions/molecule/http_ports/merged/cleanup.yml b/extensions/molecule/http_ports/merged/cleanup.yml
new file mode 100644
index 00000000..4c84014b
--- /dev/null
+++ b/extensions/molecule/http_ports/merged/cleanup.yml
@@ -0,0 +1,19 @@
+---
+- name: "Cleanup — http_ports (merged)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove int-port-alpha (test teardown)
+      ansible.platform.http_ports:
+        config:
+          - name: "int-port-alpha"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/http_ports/merged/converge.yml b/extensions/molecule/http_ports/merged/converge.yml
new file mode 100644
index 00000000..ff80061f
--- /dev/null
+++ b/extensions/molecule/http_ports/merged/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — http_ports (merged)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.http_ports with state=merged
+      ansible.platform.http_ports:
+        config:
+          - "{{ expected_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/http_port/merged/molecule.yml b/extensions/molecule/http_ports/merged/molecule.yml
similarity index 100%
rename from extensions/molecule/http_port/merged/molecule.yml
rename to extensions/molecule/http_ports/merged/molecule.yml
diff --git a/extensions/molecule/http_port/merged/vars.yml b/extensions/molecule/http_ports/merged/vars.yml
similarity index 100%
rename from extensions/molecule/http_port/merged/vars.yml
rename to extensions/molecule/http_ports/merged/vars.yml
diff --git a/extensions/molecule/http_ports/merged/verify.yml b/extensions/molecule/http_ports/merged/verify.yml
new file mode 100644
index 00000000..f3294e3c
--- /dev/null
+++ b/extensions/molecule/http_ports/merged/verify.yml
@@ -0,0 +1,26 @@
+---
+- name: "Verify — http_ports (merged)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather http_ports (assert present after merged)
+      ansible.platform.http_ports:
+        config:
+          - name: "{{ expected_config.name }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert configuration exists after merged
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length > 0
+        fail_msg: "Expected resource after merged. got: {{ gathered.gathered }}"
+
+...
diff --git a/extensions/molecule/http_ports/overridden/cleanup.yml b/extensions/molecule/http_ports/overridden/cleanup.yml
new file mode 100644
index 00000000..cb9f8821
--- /dev/null
+++ b/extensions/molecule/http_ports/overridden/cleanup.yml
@@ -0,0 +1,19 @@
+---
+- name: "Cleanup — http_ports (overridden)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove int-port-alpha (test teardown)
+      ansible.platform.http_ports:
+        config:
+          - name: "int-port-alpha"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/http_ports/overridden/converge.yml b/extensions/molecule/http_ports/overridden/converge.yml
new file mode 100644
index 00000000..9eaef6e3
--- /dev/null
+++ b/extensions/molecule/http_ports/overridden/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — http_ports (overridden)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.http_ports with state=overridden
+      ansible.platform.http_ports:
+        config:
+          - "{{ expected_config }}"
+        state: overridden
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/http_port/overridden/molecule.yml b/extensions/molecule/http_ports/overridden/molecule.yml
similarity index 100%
rename from extensions/molecule/http_port/overridden/molecule.yml
rename to extensions/molecule/http_ports/overridden/molecule.yml
diff --git a/extensions/molecule/http_ports/overridden/prepare.yml b/extensions/molecule/http_ports/overridden/prepare.yml
new file mode 100644
index 00000000..8f5dbbb3
--- /dev/null
+++ b/extensions/molecule/http_ports/overridden/prepare.yml
@@ -0,0 +1,17 @@
+---
+- name: "Prepare — http_ports (overridden)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed prerequisite resources via merged (r0 + r1 + extras for overridden)
+      ansible.platform.http_ports:
+        config: "{{ prepare_configs }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/http_port/overridden/vars.yml b/extensions/molecule/http_ports/overridden/vars.yml
similarity index 100%
rename from extensions/molecule/http_port/overridden/vars.yml
rename to extensions/molecule/http_ports/overridden/vars.yml
diff --git a/extensions/molecule/http_ports/overridden/verify.yml b/extensions/molecule/http_ports/overridden/verify.yml
new file mode 100644
index 00000000..d1d316df
--- /dev/null
+++ b/extensions/molecule/http_ports/overridden/verify.yml
@@ -0,0 +1,31 @@
+---
+- name: "Verify — http_ports (overridden)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather all http_ports resources (verify overridden final state)
+      ansible.platform.http_ports:
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered_all
+
+    - name: Assert int-port-alpha still exists after overridden
+      ansible.builtin.assert:
+        that:
+          - gathered_all.gathered is defined
+          - gathered_all.gathered | selectattr("name", "equalto", "int-port-alpha") | list | length == 1
+        fail_msg: "Expected int-port-alpha to exist after overridden. got: {{ gathered_all.gathered }}"
+
+    - name: Assert int-port-beta was deleted by overridden (not in desired config)
+      ansible.builtin.assert:
+        that:
+          - gathered_all.gathered is defined
+          - gathered_all.gathered | selectattr("name", "equalto", "int-port-beta") | list | length == 0
+        fail_msg: "overridden should have deleted int-port-beta. got: {{ gathered_all.gathered }}"
+
+...
diff --git a/extensions/molecule/http_ports/replaced/cleanup.yml b/extensions/molecule/http_ports/replaced/cleanup.yml
new file mode 100644
index 00000000..200076d1
--- /dev/null
+++ b/extensions/molecule/http_ports/replaced/cleanup.yml
@@ -0,0 +1,19 @@
+---
+- name: "Cleanup — http_ports (replaced)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove int-port-alpha (test teardown)
+      ansible.platform.http_ports:
+        config:
+          - name: "int-port-alpha"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/http_ports/replaced/converge.yml b/extensions/molecule/http_ports/replaced/converge.yml
new file mode 100644
index 00000000..2c64f46a
--- /dev/null
+++ b/extensions/molecule/http_ports/replaced/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — http_ports (replaced)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.http_ports with state=replaced
+      ansible.platform.http_ports:
+        config:
+          - "{{ expected_config }}"
+        state: replaced
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/http_port/replaced/molecule.yml b/extensions/molecule/http_ports/replaced/molecule.yml
similarity index 100%
rename from extensions/molecule/http_port/replaced/molecule.yml
rename to extensions/molecule/http_ports/replaced/molecule.yml
diff --git a/extensions/molecule/http_ports/replaced/prepare.yml b/extensions/molecule/http_ports/replaced/prepare.yml
new file mode 100644
index 00000000..71692ec5
--- /dev/null
+++ b/extensions/molecule/http_ports/replaced/prepare.yml
@@ -0,0 +1,18 @@
+---
+- name: "Prepare — http_ports (replaced)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed http_ports to be replaced (prerequisite for replaced)
+      ansible.platform.http_ports:
+        config:
+          - "{{ prepare_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/http_port/replaced/vars.yml b/extensions/molecule/http_ports/replaced/vars.yml
similarity index 100%
rename from extensions/molecule/http_port/replaced/vars.yml
rename to extensions/molecule/http_ports/replaced/vars.yml
diff --git a/extensions/molecule/http_ports/replaced/verify.yml b/extensions/molecule/http_ports/replaced/verify.yml
new file mode 100644
index 00000000..990d45c0
--- /dev/null
+++ b/extensions/molecule/http_ports/replaced/verify.yml
@@ -0,0 +1,32 @@
+---
+- name: "Verify — http_ports (replaced)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather http_ports (assert present after replaced)
+      ansible.platform.http_ports:
+        config:
+          - name: "{{ expected_config.name }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert configuration exists after replaced
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length > 0
+        fail_msg: "Expected resource after replaced. got: {{ gathered.gathered }}"
+
+    - name: Assert use_https was updated by replaced
+      ansible.builtin.assert:
+        that:
+          - (gathered.gathered | first).use_https == expected_config.use_https
+        fail_msg: "replaced should have set use_https=False. got: {{ (gathered.gathered | first).use_https }}"
+
+...
diff --git a/extensions/molecule/organization/check/cleanup.yml b/extensions/molecule/organization/check/cleanup.yml
deleted file mode 100644
index 482c62d8..00000000
--- a/extensions/molecule/organization/check/cleanup.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Cleanup — organization (check)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove int-org-alpha (test teardown)
-      ansible.platform.organization:
-        config:
-          - name: "int-org-alpha"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/organization/check/converge.yml b/extensions/molecule/organization/check/converge.yml
deleted file mode 100644
index 2c2261ed..00000000
--- a/extensions/molecule/organization/check/converge.yml
+++ /dev/null
@@ -1,36 +0,0 @@
----
-- name: "Converge — organization (check)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.organization with state=merged
-      ansible.platform.organization:
-        config:
-          - "{{ expected_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      check_mode: true
-      diff: true
-      register: result
-
-    - name: Assert check mode predicted a change
-      ansible.builtin.assert:
-        that:
-          - result.changed == true
-          - result.before is defined
-          - result.after is defined
-        fail_msg: "check mode should predict a change. got={{ result }}"
-
-    - name: Assert diff output is present
-      ansible.builtin.assert:
-        that:
-          - result.diff is defined
-        fail_msg: "diff output missing from check result"
-      when: result.diff is defined
-
-...
diff --git a/extensions/molecule/organization/check/prepare.yml b/extensions/molecule/organization/check/prepare.yml
deleted file mode 100644
index 752d5e8d..00000000
--- a/extensions/molecule/organization/check/prepare.yml
+++ /dev/null
@@ -1,18 +0,0 @@
----
-- name: "Prepare — organization (check)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed organization as check-mode baseline (prerequisite for check)
-      ansible.platform.organization:
-        config:
-          - "{{ prepare_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/organization/check/verify.yml b/extensions/molecule/organization/check/verify.yml
deleted file mode 100644
index 2910c958..00000000
--- a/extensions/molecule/organization/check/verify.yml
+++ /dev/null
@@ -1,27 +0,0 @@
----
-- name: "Verify — organization (check)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather organization (check mode must not have applied changes)
-      ansible.platform.organization:
-        config:
-          - name: "{{ expected_config.name }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert int-org-alpha still has prepare_config values (check did not apply)
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length > 0
-          - (gathered.gathered | first).description == prepare_config.description
-        fail_msg: "check mode should not alter resource. got: {{ gathered.gathered }}"
-
-...
diff --git a/extensions/molecule/organization/deleted/cleanup.yml b/extensions/molecule/organization/deleted/cleanup.yml
deleted file mode 100644
index 03cfe21a..00000000
--- a/extensions/molecule/organization/deleted/cleanup.yml
+++ /dev/null
@@ -1,12 +0,0 @@
----
-- name: "Cleanup — organization (deleted)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: No-op — int-org-alpha already deleted by converge
-      ansible.builtin.debug:
-        msg: "int-org-alpha was deleted in converge — nothing to clean up"
-
-...
diff --git a/extensions/molecule/organization/deleted/converge.yml b/extensions/molecule/organization/deleted/converge.yml
deleted file mode 100644
index c8244804..00000000
--- a/extensions/molecule/organization/deleted/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — organization (deleted)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.organization with state=deleted
-      ansible.platform.organization:
-        config:
-          - "{{ expected_config }}"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/organization/deleted/prepare.yml b/extensions/molecule/organization/deleted/prepare.yml
deleted file mode 100644
index b54ed135..00000000
--- a/extensions/molecule/organization/deleted/prepare.yml
+++ /dev/null
@@ -1,18 +0,0 @@
----
-- name: "Prepare — organization (deleted)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed organization to be deleted (prerequisite for deleted)
-      ansible.platform.organization:
-        config:
-          - "{{ prepare_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/organization/deleted/verify.yml b/extensions/molecule/organization/deleted/verify.yml
deleted file mode 100644
index 8df0a544..00000000
--- a/extensions/molecule/organization/deleted/verify.yml
+++ /dev/null
@@ -1,26 +0,0 @@
----
-- name: "Verify — organization (deleted)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather organization (should be absent after deleted)
-      ansible.platform.organization:
-        config:
-          - name: "int-org-alpha"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert int-org-alpha no longer exists (deleted)
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length == 0
-        fail_msg: "Expected empty after deleted, got: {{ gathered.gathered }}"
-
-...
diff --git a/extensions/molecule/organization/gathered/cleanup.yml b/extensions/molecule/organization/gathered/cleanup.yml
deleted file mode 100644
index e020a3c9..00000000
--- a/extensions/molecule/organization/gathered/cleanup.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Cleanup — organization (gathered)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove int-org-alpha (test teardown)
-      ansible.platform.organization:
-        config:
-          - name: "int-org-alpha"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/organization/gathered/converge.yml b/extensions/molecule/organization/gathered/converge.yml
deleted file mode 100644
index 85552480..00000000
--- a/extensions/molecule/organization/gathered/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — organization (gathered)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.organization with state=gathered
-      ansible.platform.organization:
-        config:
-          - "{{ expected_config }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/organization/gathered/prepare.yml b/extensions/molecule/organization/gathered/prepare.yml
deleted file mode 100644
index ef47e30f..00000000
--- a/extensions/molecule/organization/gathered/prepare.yml
+++ /dev/null
@@ -1,18 +0,0 @@
----
-- name: "Prepare — organization (gathered)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed organization to be gathered (prerequisite for gathered)
-      ansible.platform.organization:
-        config:
-          - "{{ prepare_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/organization/gathered/verify.yml b/extensions/molecule/organization/gathered/verify.yml
deleted file mode 100644
index 39687d9d..00000000
--- a/extensions/molecule/organization/gathered/verify.yml
+++ /dev/null
@@ -1,26 +0,0 @@
----
-- name: "Verify — organization (gathered)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather organization (assert present after gathered)
-      ansible.platform.organization:
-        config:
-          - name: "{{ expected_config.name }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert configuration exists after gathered
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length > 0
-        fail_msg: "Expected resource after gathered. got: {{ gathered.gathered }}"
-
-...
diff --git a/extensions/molecule/organization/merged/cleanup.yml b/extensions/molecule/organization/merged/cleanup.yml
deleted file mode 100644
index 02349f78..00000000
--- a/extensions/molecule/organization/merged/cleanup.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Cleanup — organization (merged)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove int-org-alpha (test teardown)
-      ansible.platform.organization:
-        config:
-          - name: "int-org-alpha"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/organization/merged/converge.yml b/extensions/molecule/organization/merged/converge.yml
deleted file mode 100644
index 51c23da5..00000000
--- a/extensions/molecule/organization/merged/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — organization (merged)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.organization with state=merged
-      ansible.platform.organization:
-        config:
-          - "{{ expected_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/organization/merged/verify.yml b/extensions/molecule/organization/merged/verify.yml
deleted file mode 100644
index 44ea2d97..00000000
--- a/extensions/molecule/organization/merged/verify.yml
+++ /dev/null
@@ -1,26 +0,0 @@
----
-- name: "Verify — organization (merged)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather organization (assert present after merged)
-      ansible.platform.organization:
-        config:
-          - name: "{{ expected_config.name }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert configuration exists after merged
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length > 0
-        fail_msg: "Expected resource after merged. got: {{ gathered.gathered }}"
-
-...
diff --git a/extensions/molecule/organization/overridden/cleanup.yml b/extensions/molecule/organization/overridden/cleanup.yml
deleted file mode 100644
index 343dddca..00000000
--- a/extensions/molecule/organization/overridden/cleanup.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Cleanup — organization (overridden)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove int-org-alpha (test teardown)
-      ansible.platform.organization:
-        config:
-          - name: "int-org-alpha"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/organization/overridden/converge.yml b/extensions/molecule/organization/overridden/converge.yml
deleted file mode 100644
index 0ffbd13f..00000000
--- a/extensions/molecule/organization/overridden/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — organization (overridden)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.organization with state=overridden
-      ansible.platform.organization:
-        config:
-          - "{{ expected_config }}"
-        state: overridden
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/organization/overridden/prepare.yml b/extensions/molecule/organization/overridden/prepare.yml
deleted file mode 100644
index 219d288b..00000000
--- a/extensions/molecule/organization/overridden/prepare.yml
+++ /dev/null
@@ -1,17 +0,0 @@
----
-- name: "Prepare — organization (overridden)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed prerequisite resources via merged (r0 + r1 + extras for overridden)
-      ansible.platform.organization:
-        config: "{{ prepare_configs }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/organization/overridden/verify.yml b/extensions/molecule/organization/overridden/verify.yml
deleted file mode 100644
index decf56db..00000000
--- a/extensions/molecule/organization/overridden/verify.yml
+++ /dev/null
@@ -1,31 +0,0 @@
----
-- name: "Verify — organization (overridden)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather all organization resources (verify overridden final state)
-      ansible.platform.organization:
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered_all
-
-    - name: Assert int-org-alpha still exists after overridden
-      ansible.builtin.assert:
-        that:
-          - gathered_all.gathered is defined
-          - gathered_all.gathered | selectattr("name", "equalto", "int-org-alpha") | list | length == 1
-        fail_msg: "Expected int-org-alpha to exist after overridden. got: {{ gathered_all.gathered }}"
-
-    - name: Assert int-org-beta was deleted by overridden (not in desired config)
-      ansible.builtin.assert:
-        that:
-          - gathered_all.gathered is defined
-          - gathered_all.gathered | selectattr("name", "equalto", "int-org-beta") | list | length == 0
-        fail_msg: "overridden should have deleted int-org-beta. got: {{ gathered_all.gathered }}"
-
-...
diff --git a/extensions/molecule/organization/replaced/cleanup.yml b/extensions/molecule/organization/replaced/cleanup.yml
deleted file mode 100644
index c303495b..00000000
--- a/extensions/molecule/organization/replaced/cleanup.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Cleanup — organization (replaced)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove int-org-alpha (test teardown)
-      ansible.platform.organization:
-        config:
-          - name: "int-org-alpha"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/organization/replaced/converge.yml b/extensions/molecule/organization/replaced/converge.yml
deleted file mode 100644
index 7cd3d97c..00000000
--- a/extensions/molecule/organization/replaced/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — organization (replaced)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.organization with state=replaced
-      ansible.platform.organization:
-        config:
-          - "{{ expected_config }}"
-        state: replaced
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/organization/replaced/prepare.yml b/extensions/molecule/organization/replaced/prepare.yml
deleted file mode 100644
index a7f144f0..00000000
--- a/extensions/molecule/organization/replaced/prepare.yml
+++ /dev/null
@@ -1,18 +0,0 @@
----
-- name: "Prepare — organization (replaced)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed organization to be replaced (prerequisite for replaced)
-      ansible.platform.organization:
-        config:
-          - "{{ prepare_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/organization/replaced/verify.yml b/extensions/molecule/organization/replaced/verify.yml
deleted file mode 100644
index 0ae1e1c5..00000000
--- a/extensions/molecule/organization/replaced/verify.yml
+++ /dev/null
@@ -1,32 +0,0 @@
----
-- name: "Verify — organization (replaced)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather organization (assert present after replaced)
-      ansible.platform.organization:
-        config:
-          - name: "{{ expected_config.name }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert configuration exists after replaced
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length > 0
-        fail_msg: "Expected resource after replaced. got: {{ gathered.gathered }}"
-
-    - name: Assert description was updated by replaced
-      ansible.builtin.assert:
-        that:
-          - (gathered.gathered | first).description == expected_config.description
-        fail_msg: "replaced should have set description='Alpha replaced'. got: {{ (gathered.gathered | first).description }}"
-
-...
diff --git a/extensions/molecule/organizations/check/cleanup.yml b/extensions/molecule/organizations/check/cleanup.yml
new file mode 100644
index 00000000..4b9af034
--- /dev/null
+++ b/extensions/molecule/organizations/check/cleanup.yml
@@ -0,0 +1,19 @@
+---
+- name: "Cleanup — organizations (check)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove int-org-alpha (test teardown)
+      ansible.platform.organizations:
+        config:
+          - name: "int-org-alpha"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/organizations/check/converge.yml b/extensions/molecule/organizations/check/converge.yml
new file mode 100644
index 00000000..ab40d0f4
--- /dev/null
+++ b/extensions/molecule/organizations/check/converge.yml
@@ -0,0 +1,36 @@
+---
+- name: "Converge — organizations (check)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.organizations with state=merged
+      ansible.platform.organizations:
+        config:
+          - "{{ expected_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      check_mode: true
+      diff: true
+      register: result
+
+    - name: Assert check mode predicted a change
+      ansible.builtin.assert:
+        that:
+          - result.changed == true
+          - result.before is defined
+          - result.after is defined
+        fail_msg: "check mode should predict a change. got={{ result }}"
+
+    - name: Assert diff output is present
+      ansible.builtin.assert:
+        that:
+          - result.diff is defined
+        fail_msg: "diff output missing from check result"
+      when: result.diff is defined
+
+...
diff --git a/extensions/molecule/organization/check/molecule.yml b/extensions/molecule/organizations/check/molecule.yml
similarity index 100%
rename from extensions/molecule/organization/check/molecule.yml
rename to extensions/molecule/organizations/check/molecule.yml
diff --git a/extensions/molecule/organizations/check/prepare.yml b/extensions/molecule/organizations/check/prepare.yml
new file mode 100644
index 00000000..e6b2083e
--- /dev/null
+++ b/extensions/molecule/organizations/check/prepare.yml
@@ -0,0 +1,18 @@
+---
+- name: "Prepare — organizations (check)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed organizations as check-mode baseline (prerequisite for check)
+      ansible.platform.organizations:
+        config:
+          - "{{ prepare_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/organization/check/vars.yml b/extensions/molecule/organizations/check/vars.yml
similarity index 100%
rename from extensions/molecule/organization/check/vars.yml
rename to extensions/molecule/organizations/check/vars.yml
diff --git a/extensions/molecule/organizations/check/verify.yml b/extensions/molecule/organizations/check/verify.yml
new file mode 100644
index 00000000..79a9e073
--- /dev/null
+++ b/extensions/molecule/organizations/check/verify.yml
@@ -0,0 +1,27 @@
+---
+- name: "Verify — organizations (check)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather organizations (check mode must not have applied changes)
+      ansible.platform.organizations:
+        config:
+          - name: "{{ expected_config.name }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert int-org-alpha still has prepare_config values (check did not apply)
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length > 0
+          - (gathered.gathered | first).description == prepare_config.description
+        fail_msg: "check mode should not alter resource. got: {{ gathered.gathered }}"
+
+...
diff --git a/extensions/molecule/organizations/deleted/cleanup.yml b/extensions/molecule/organizations/deleted/cleanup.yml
new file mode 100644
index 00000000..d45968fb
--- /dev/null
+++ b/extensions/molecule/organizations/deleted/cleanup.yml
@@ -0,0 +1,12 @@
+---
+- name: "Cleanup — organizations (deleted)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: No-op — int-org-alpha already deleted by converge
+      ansible.builtin.debug:
+        msg: "int-org-alpha was deleted in converge — nothing to clean up"
+
+...
diff --git a/extensions/molecule/organizations/deleted/converge.yml b/extensions/molecule/organizations/deleted/converge.yml
new file mode 100644
index 00000000..458482e0
--- /dev/null
+++ b/extensions/molecule/organizations/deleted/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — organizations (deleted)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.organizations with state=deleted
+      ansible.platform.organizations:
+        config:
+          - "{{ expected_config }}"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/organization/deleted/molecule.yml b/extensions/molecule/organizations/deleted/molecule.yml
similarity index 100%
rename from extensions/molecule/organization/deleted/molecule.yml
rename to extensions/molecule/organizations/deleted/molecule.yml
diff --git a/extensions/molecule/organizations/deleted/prepare.yml b/extensions/molecule/organizations/deleted/prepare.yml
new file mode 100644
index 00000000..f8d2ac91
--- /dev/null
+++ b/extensions/molecule/organizations/deleted/prepare.yml
@@ -0,0 +1,18 @@
+---
+- name: "Prepare — organizations (deleted)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed organizations to be deleted (prerequisite for deleted)
+      ansible.platform.organizations:
+        config:
+          - "{{ prepare_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/organization/deleted/vars.yml b/extensions/molecule/organizations/deleted/vars.yml
similarity index 100%
rename from extensions/molecule/organization/deleted/vars.yml
rename to extensions/molecule/organizations/deleted/vars.yml
diff --git a/extensions/molecule/organizations/deleted/verify.yml b/extensions/molecule/organizations/deleted/verify.yml
new file mode 100644
index 00000000..64db29da
--- /dev/null
+++ b/extensions/molecule/organizations/deleted/verify.yml
@@ -0,0 +1,26 @@
+---
+- name: "Verify — organizations (deleted)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather organizations (should be absent after deleted)
+      ansible.platform.organizations:
+        config:
+          - name: "int-org-alpha"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert int-org-alpha no longer exists (deleted)
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length == 0
+        fail_msg: "Expected empty after deleted, got: {{ gathered.gathered }}"
+
+...
diff --git a/extensions/molecule/organizations/gathered/cleanup.yml b/extensions/molecule/organizations/gathered/cleanup.yml
new file mode 100644
index 00000000..f22ca732
--- /dev/null
+++ b/extensions/molecule/organizations/gathered/cleanup.yml
@@ -0,0 +1,19 @@
+---
+- name: "Cleanup — organizations (gathered)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove int-org-alpha (test teardown)
+      ansible.platform.organizations:
+        config:
+          - name: "int-org-alpha"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/organizations/gathered/converge.yml b/extensions/molecule/organizations/gathered/converge.yml
new file mode 100644
index 00000000..c333c187
--- /dev/null
+++ b/extensions/molecule/organizations/gathered/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — organizations (gathered)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.organizations with state=gathered
+      ansible.platform.organizations:
+        config:
+          - "{{ expected_config }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/organization/gathered/molecule.yml b/extensions/molecule/organizations/gathered/molecule.yml
similarity index 100%
rename from extensions/molecule/organization/gathered/molecule.yml
rename to extensions/molecule/organizations/gathered/molecule.yml
diff --git a/extensions/molecule/organizations/gathered/prepare.yml b/extensions/molecule/organizations/gathered/prepare.yml
new file mode 100644
index 00000000..df0f7ace
--- /dev/null
+++ b/extensions/molecule/organizations/gathered/prepare.yml
@@ -0,0 +1,18 @@
+---
+- name: "Prepare — organizations (gathered)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed organizations to be gathered (prerequisite for gathered)
+      ansible.platform.organizations:
+        config:
+          - "{{ prepare_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/organization/gathered/vars.yml b/extensions/molecule/organizations/gathered/vars.yml
similarity index 100%
rename from extensions/molecule/organization/gathered/vars.yml
rename to extensions/molecule/organizations/gathered/vars.yml
diff --git a/extensions/molecule/organizations/gathered/verify.yml b/extensions/molecule/organizations/gathered/verify.yml
new file mode 100644
index 00000000..7fbfcac4
--- /dev/null
+++ b/extensions/molecule/organizations/gathered/verify.yml
@@ -0,0 +1,26 @@
+---
+- name: "Verify — organizations (gathered)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather organizations (assert present after gathered)
+      ansible.platform.organizations:
+        config:
+          - name: "{{ expected_config.name }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert configuration exists after gathered
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length > 0
+        fail_msg: "Expected resource after gathered. got: {{ gathered.gathered }}"
+
+...
diff --git a/extensions/molecule/organization/inventory.yml b/extensions/molecule/organizations/inventory.yml
similarity index 100%
rename from extensions/molecule/organization/inventory.yml
rename to extensions/molecule/organizations/inventory.yml
diff --git a/extensions/molecule/organizations/merged/cleanup.yml b/extensions/molecule/organizations/merged/cleanup.yml
new file mode 100644
index 00000000..d33f1845
--- /dev/null
+++ b/extensions/molecule/organizations/merged/cleanup.yml
@@ -0,0 +1,19 @@
+---
+- name: "Cleanup — organizations (merged)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove int-org-alpha (test teardown)
+      ansible.platform.organizations:
+        config:
+          - name: "int-org-alpha"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/organizations/merged/converge.yml b/extensions/molecule/organizations/merged/converge.yml
new file mode 100644
index 00000000..caaa4386
--- /dev/null
+++ b/extensions/molecule/organizations/merged/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — organizations (merged)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.organizations with state=merged
+      ansible.platform.organizations:
+        config:
+          - "{{ expected_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/organization/merged/molecule.yml b/extensions/molecule/organizations/merged/molecule.yml
similarity index 100%
rename from extensions/molecule/organization/merged/molecule.yml
rename to extensions/molecule/organizations/merged/molecule.yml
diff --git a/extensions/molecule/organization/merged/vars.yml b/extensions/molecule/organizations/merged/vars.yml
similarity index 100%
rename from extensions/molecule/organization/merged/vars.yml
rename to extensions/molecule/organizations/merged/vars.yml
diff --git a/extensions/molecule/organizations/merged/verify.yml b/extensions/molecule/organizations/merged/verify.yml
new file mode 100644
index 00000000..70136b86
--- /dev/null
+++ b/extensions/molecule/organizations/merged/verify.yml
@@ -0,0 +1,26 @@
+---
+- name: "Verify — organizations (merged)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather organizations (assert present after merged)
+      ansible.platform.organizations:
+        config:
+          - name: "{{ expected_config.name }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert configuration exists after merged
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length > 0
+        fail_msg: "Expected resource after merged. got: {{ gathered.gathered }}"
+
+...
diff --git a/extensions/molecule/organizations/overridden/cleanup.yml b/extensions/molecule/organizations/overridden/cleanup.yml
new file mode 100644
index 00000000..c083e9f3
--- /dev/null
+++ b/extensions/molecule/organizations/overridden/cleanup.yml
@@ -0,0 +1,19 @@
+---
+- name: "Cleanup — organizations (overridden)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove int-org-alpha (test teardown)
+      ansible.platform.organizations:
+        config:
+          - name: "int-org-alpha"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/organizations/overridden/converge.yml b/extensions/molecule/organizations/overridden/converge.yml
new file mode 100644
index 00000000..c8f68471
--- /dev/null
+++ b/extensions/molecule/organizations/overridden/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — organizations (overridden)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.organizations with state=overridden
+      ansible.platform.organizations:
+        config:
+          - "{{ expected_config }}"
+        state: overridden
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/organization/overridden/molecule.yml b/extensions/molecule/organizations/overridden/molecule.yml
similarity index 100%
rename from extensions/molecule/organization/overridden/molecule.yml
rename to extensions/molecule/organizations/overridden/molecule.yml
diff --git a/extensions/molecule/organizations/overridden/prepare.yml b/extensions/molecule/organizations/overridden/prepare.yml
new file mode 100644
index 00000000..9edf2ad7
--- /dev/null
+++ b/extensions/molecule/organizations/overridden/prepare.yml
@@ -0,0 +1,17 @@
+---
+- name: "Prepare — organizations (overridden)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed prerequisite resources via merged (r0 + r1 + extras for overridden)
+      ansible.platform.organizations:
+        config: "{{ prepare_configs }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/organization/overridden/vars.yml b/extensions/molecule/organizations/overridden/vars.yml
similarity index 100%
rename from extensions/molecule/organization/overridden/vars.yml
rename to extensions/molecule/organizations/overridden/vars.yml
diff --git a/extensions/molecule/organizations/overridden/verify.yml b/extensions/molecule/organizations/overridden/verify.yml
new file mode 100644
index 00000000..a71c57f2
--- /dev/null
+++ b/extensions/molecule/organizations/overridden/verify.yml
@@ -0,0 +1,31 @@
+---
+- name: "Verify — organizations (overridden)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather all organizations resources (verify overridden final state)
+      ansible.platform.organizations:
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered_all
+
+    - name: Assert int-org-alpha still exists after overridden
+      ansible.builtin.assert:
+        that:
+          - gathered_all.gathered is defined
+          - gathered_all.gathered | selectattr("name", "equalto", "int-org-alpha") | list | length == 1
+        fail_msg: "Expected int-org-alpha to exist after overridden. got: {{ gathered_all.gathered }}"
+
+    - name: Assert int-org-beta was deleted by overridden (not in desired config)
+      ansible.builtin.assert:
+        that:
+          - gathered_all.gathered is defined
+          - gathered_all.gathered | selectattr("name", "equalto", "int-org-beta") | list | length == 0
+        fail_msg: "overridden should have deleted int-org-beta. got: {{ gathered_all.gathered }}"
+
+...
diff --git a/extensions/molecule/organizations/replaced/cleanup.yml b/extensions/molecule/organizations/replaced/cleanup.yml
new file mode 100644
index 00000000..6114d577
--- /dev/null
+++ b/extensions/molecule/organizations/replaced/cleanup.yml
@@ -0,0 +1,19 @@
+---
+- name: "Cleanup — organizations (replaced)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove int-org-alpha (test teardown)
+      ansible.platform.organizations:
+        config:
+          - name: "int-org-alpha"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/organizations/replaced/converge.yml b/extensions/molecule/organizations/replaced/converge.yml
new file mode 100644
index 00000000..daf0c11c
--- /dev/null
+++ b/extensions/molecule/organizations/replaced/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — organizations (replaced)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.organizations with state=replaced
+      ansible.platform.organizations:
+        config:
+          - "{{ expected_config }}"
+        state: replaced
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/organization/replaced/molecule.yml b/extensions/molecule/organizations/replaced/molecule.yml
similarity index 100%
rename from extensions/molecule/organization/replaced/molecule.yml
rename to extensions/molecule/organizations/replaced/molecule.yml
diff --git a/extensions/molecule/organizations/replaced/prepare.yml b/extensions/molecule/organizations/replaced/prepare.yml
new file mode 100644
index 00000000..bc6b65eb
--- /dev/null
+++ b/extensions/molecule/organizations/replaced/prepare.yml
@@ -0,0 +1,18 @@
+---
+- name: "Prepare — organizations (replaced)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed organizations to be replaced (prerequisite for replaced)
+      ansible.platform.organizations:
+        config:
+          - "{{ prepare_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/organization/replaced/vars.yml b/extensions/molecule/organizations/replaced/vars.yml
similarity index 100%
rename from extensions/molecule/organization/replaced/vars.yml
rename to extensions/molecule/organizations/replaced/vars.yml
diff --git a/extensions/molecule/organizations/replaced/verify.yml b/extensions/molecule/organizations/replaced/verify.yml
new file mode 100644
index 00000000..c2707a10
--- /dev/null
+++ b/extensions/molecule/organizations/replaced/verify.yml
@@ -0,0 +1,32 @@
+---
+- name: "Verify — organizations (replaced)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather organizations (assert present after replaced)
+      ansible.platform.organizations:
+        config:
+          - name: "{{ expected_config.name }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert configuration exists after replaced
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length > 0
+        fail_msg: "Expected resource after replaced. got: {{ gathered.gathered }}"
+
+    - name: Assert description was updated by replaced
+      ansible.builtin.assert:
+        that:
+          - (gathered.gathered | first).description == expected_config.description
+        fail_msg: "replaced should have set description='Alpha replaced'. got: {{ (gathered.gathered | first).description }}"
+
+...
diff --git a/extensions/molecule/role_definition/check/cleanup.yml b/extensions/molecule/role_definition/check/cleanup.yml
deleted file mode 100644
index 8523809d..00000000
--- a/extensions/molecule/role_definition/check/cleanup.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Cleanup — role_definition (check)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove int-roledef-alpha (test teardown)
-      ansible.platform.role_definition:
-        config:
-          - name: "int-roledef-alpha"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/role_definition/check/converge.yml b/extensions/molecule/role_definition/check/converge.yml
deleted file mode 100644
index c141d7e6..00000000
--- a/extensions/molecule/role_definition/check/converge.yml
+++ /dev/null
@@ -1,36 +0,0 @@
----
-- name: "Converge — role_definition (check)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.role_definition with state=merged
-      ansible.platform.role_definition:
-        config:
-          - "{{ expected_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      check_mode: true
-      diff: true
-      register: result
-
-    - name: Assert check mode predicted a change
-      ansible.builtin.assert:
-        that:
-          - result.changed == true
-          - result.before is defined
-          - result.after is defined
-        fail_msg: "check mode should predict a change. got={{ result }}"
-
-    - name: Assert diff output is present
-      ansible.builtin.assert:
-        that:
-          - result.diff is defined
-        fail_msg: "diff output missing from check result"
-      when: result.diff is defined
-
-...
diff --git a/extensions/molecule/role_definition/check/prepare.yml b/extensions/molecule/role_definition/check/prepare.yml
deleted file mode 100644
index bbaf64cd..00000000
--- a/extensions/molecule/role_definition/check/prepare.yml
+++ /dev/null
@@ -1,18 +0,0 @@
----
-- name: "Prepare — role_definition (check)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed role_definition as check-mode baseline (prerequisite for check)
-      ansible.platform.role_definition:
-        config:
-          - "{{ prepare_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/role_definition/check/verify.yml b/extensions/molecule/role_definition/check/verify.yml
deleted file mode 100644
index 25c391d7..00000000
--- a/extensions/molecule/role_definition/check/verify.yml
+++ /dev/null
@@ -1,27 +0,0 @@
----
-- name: "Verify — role_definition (check)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather role_definition (check mode must not have applied changes)
-      ansible.platform.role_definition:
-        config:
-          - name: "{{ expected_config.name }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert int-roledef-alpha still has prepare_config values (check did not apply)
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length > 0
-          - (gathered.gathered | first).description == prepare_config.description
-        fail_msg: "check mode should not alter resource. got: {{ gathered.gathered }}"
-
-...
diff --git a/extensions/molecule/role_definition/deleted/cleanup.yml b/extensions/molecule/role_definition/deleted/cleanup.yml
deleted file mode 100644
index ac8aaaf6..00000000
--- a/extensions/molecule/role_definition/deleted/cleanup.yml
+++ /dev/null
@@ -1,12 +0,0 @@
----
-- name: "Cleanup — role_definition (deleted)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: No-op — int-roledef-alpha already deleted by converge
-      ansible.builtin.debug:
-        msg: "int-roledef-alpha was deleted in converge — nothing to clean up"
-
-...
diff --git a/extensions/molecule/role_definition/deleted/converge.yml b/extensions/molecule/role_definition/deleted/converge.yml
deleted file mode 100644
index f76667f7..00000000
--- a/extensions/molecule/role_definition/deleted/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — role_definition (deleted)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.role_definition with state=deleted
-      ansible.platform.role_definition:
-        config:
-          - "{{ expected_config }}"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/role_definition/deleted/prepare.yml b/extensions/molecule/role_definition/deleted/prepare.yml
deleted file mode 100644
index ff536839..00000000
--- a/extensions/molecule/role_definition/deleted/prepare.yml
+++ /dev/null
@@ -1,18 +0,0 @@
----
-- name: "Prepare — role_definition (deleted)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed role_definition to be deleted (prerequisite for deleted)
-      ansible.platform.role_definition:
-        config:
-          - "{{ prepare_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/role_definition/deleted/verify.yml b/extensions/molecule/role_definition/deleted/verify.yml
deleted file mode 100644
index 0dc39269..00000000
--- a/extensions/molecule/role_definition/deleted/verify.yml
+++ /dev/null
@@ -1,26 +0,0 @@
----
-- name: "Verify — role_definition (deleted)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather role_definition (should be absent after deleted)
-      ansible.platform.role_definition:
-        config:
-          - name: "int-roledef-alpha"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert int-roledef-alpha no longer exists (deleted)
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length == 0
-        fail_msg: "Expected empty after deleted, got: {{ gathered.gathered }}"
-
-...
diff --git a/extensions/molecule/role_definition/gathered/cleanup.yml b/extensions/molecule/role_definition/gathered/cleanup.yml
deleted file mode 100644
index 89432393..00000000
--- a/extensions/molecule/role_definition/gathered/cleanup.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Cleanup — role_definition (gathered)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove int-roledef-alpha (test teardown)
-      ansible.platform.role_definition:
-        config:
-          - name: "int-roledef-alpha"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/role_definition/gathered/converge.yml b/extensions/molecule/role_definition/gathered/converge.yml
deleted file mode 100644
index 2504df5d..00000000
--- a/extensions/molecule/role_definition/gathered/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — role_definition (gathered)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.role_definition with state=gathered
-      ansible.platform.role_definition:
-        config:
-          - "{{ expected_config }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/role_definition/gathered/prepare.yml b/extensions/molecule/role_definition/gathered/prepare.yml
deleted file mode 100644
index 23199f41..00000000
--- a/extensions/molecule/role_definition/gathered/prepare.yml
+++ /dev/null
@@ -1,18 +0,0 @@
----
-- name: "Prepare — role_definition (gathered)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed role_definition to be gathered (prerequisite for gathered)
-      ansible.platform.role_definition:
-        config:
-          - "{{ prepare_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/role_definition/gathered/verify.yml b/extensions/molecule/role_definition/gathered/verify.yml
deleted file mode 100644
index a6daf193..00000000
--- a/extensions/molecule/role_definition/gathered/verify.yml
+++ /dev/null
@@ -1,26 +0,0 @@
----
-- name: "Verify — role_definition (gathered)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather role_definition (assert present after gathered)
-      ansible.platform.role_definition:
-        config:
-          - name: "{{ expected_config.name }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert configuration exists after gathered
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length > 0
-        fail_msg: "Expected resource after gathered. got: {{ gathered.gathered }}"
-
-...
diff --git a/extensions/molecule/role_definition/merged/cleanup.yml b/extensions/molecule/role_definition/merged/cleanup.yml
deleted file mode 100644
index 3dd907df..00000000
--- a/extensions/molecule/role_definition/merged/cleanup.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Cleanup — role_definition (merged)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove int-roledef-alpha (test teardown)
-      ansible.platform.role_definition:
-        config:
-          - name: "int-roledef-alpha"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/role_definition/merged/converge.yml b/extensions/molecule/role_definition/merged/converge.yml
deleted file mode 100644
index 504f7509..00000000
--- a/extensions/molecule/role_definition/merged/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — role_definition (merged)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.role_definition with state=merged
-      ansible.platform.role_definition:
-        config:
-          - "{{ expected_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/role_definition/merged/verify.yml b/extensions/molecule/role_definition/merged/verify.yml
deleted file mode 100644
index 921a1de5..00000000
--- a/extensions/molecule/role_definition/merged/verify.yml
+++ /dev/null
@@ -1,26 +0,0 @@
----
-- name: "Verify — role_definition (merged)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather role_definition (assert present after merged)
-      ansible.platform.role_definition:
-        config:
-          - name: "{{ expected_config.name }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert configuration exists after merged
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length > 0
-        fail_msg: "Expected resource after merged. got: {{ gathered.gathered }}"
-
-...
diff --git a/extensions/molecule/role_definition/overridden/cleanup.yml b/extensions/molecule/role_definition/overridden/cleanup.yml
deleted file mode 100644
index 0aa33982..00000000
--- a/extensions/molecule/role_definition/overridden/cleanup.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Cleanup — role_definition (overridden)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove int-roledef-alpha (test teardown)
-      ansible.platform.role_definition:
-        config:
-          - name: "int-roledef-alpha"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/role_definition/overridden/converge.yml b/extensions/molecule/role_definition/overridden/converge.yml
deleted file mode 100644
index 9f7018c4..00000000
--- a/extensions/molecule/role_definition/overridden/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — role_definition (overridden)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.role_definition with state=overridden
-      ansible.platform.role_definition:
-        config:
-          - "{{ expected_config }}"
-        state: overridden
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/role_definition/overridden/prepare.yml b/extensions/molecule/role_definition/overridden/prepare.yml
deleted file mode 100644
index cd848b0c..00000000
--- a/extensions/molecule/role_definition/overridden/prepare.yml
+++ /dev/null
@@ -1,17 +0,0 @@
----
-- name: "Prepare — role_definition (overridden)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed prerequisite resources via merged (r0 + r1 + extras for overridden)
-      ansible.platform.role_definition:
-        config: "{{ prepare_configs }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/role_definition/overridden/verify.yml b/extensions/molecule/role_definition/overridden/verify.yml
deleted file mode 100644
index 08866d3d..00000000
--- a/extensions/molecule/role_definition/overridden/verify.yml
+++ /dev/null
@@ -1,31 +0,0 @@
----
-- name: "Verify — role_definition (overridden)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather all role_definition resources (verify overridden final state)
-      ansible.platform.role_definition:
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered_all
-
-    - name: Assert int-roledef-alpha still exists after overridden
-      ansible.builtin.assert:
-        that:
-          - gathered_all.gathered is defined
-          - gathered_all.gathered | selectattr("name", "equalto", "int-roledef-alpha") | list | length == 1
-        fail_msg: "Expected int-roledef-alpha to exist after overridden. got: {{ gathered_all.gathered }}"
-
-    - name: Assert int-roledef-beta was deleted by overridden (not in desired config)
-      ansible.builtin.assert:
-        that:
-          - gathered_all.gathered is defined
-          - gathered_all.gathered | selectattr("name", "equalto", "int-roledef-beta") | list | length == 0
-        fail_msg: "overridden should have deleted int-roledef-beta. got: {{ gathered_all.gathered }}"
-
-...
diff --git a/extensions/molecule/role_definition/replaced/cleanup.yml b/extensions/molecule/role_definition/replaced/cleanup.yml
deleted file mode 100644
index 7e137cc6..00000000
--- a/extensions/molecule/role_definition/replaced/cleanup.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Cleanup — role_definition (replaced)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove int-roledef-alpha (test teardown)
-      ansible.platform.role_definition:
-        config:
-          - name: "int-roledef-alpha"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/role_definition/replaced/converge.yml b/extensions/molecule/role_definition/replaced/converge.yml
deleted file mode 100644
index d9c21ff5..00000000
--- a/extensions/molecule/role_definition/replaced/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — role_definition (replaced)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.role_definition with state=replaced
-      ansible.platform.role_definition:
-        config:
-          - "{{ expected_config }}"
-        state: replaced
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/role_definition/replaced/prepare.yml b/extensions/molecule/role_definition/replaced/prepare.yml
deleted file mode 100644
index d239a86e..00000000
--- a/extensions/molecule/role_definition/replaced/prepare.yml
+++ /dev/null
@@ -1,18 +0,0 @@
----
-- name: "Prepare — role_definition (replaced)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed role_definition to be replaced (prerequisite for replaced)
-      ansible.platform.role_definition:
-        config:
-          - "{{ prepare_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/role_definition/replaced/verify.yml b/extensions/molecule/role_definition/replaced/verify.yml
deleted file mode 100644
index e99b2a03..00000000
--- a/extensions/molecule/role_definition/replaced/verify.yml
+++ /dev/null
@@ -1,32 +0,0 @@
----
-- name: "Verify — role_definition (replaced)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather role_definition (assert present after replaced)
-      ansible.platform.role_definition:
-        config:
-          - name: "{{ expected_config.name }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert configuration exists after replaced
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length > 0
-        fail_msg: "Expected resource after replaced. got: {{ gathered.gathered }}"
-
-    - name: Assert description was updated by replaced
-      ansible.builtin.assert:
-        that:
-          - (gathered.gathered | first).description == expected_config.description
-        fail_msg: "replaced should have set description='Alpha role definition replaced'. got: {{ (gathered.gathered | first).description }}"
-
-...
diff --git a/extensions/molecule/role_definitions/check/cleanup.yml b/extensions/molecule/role_definitions/check/cleanup.yml
new file mode 100644
index 00000000..07fe608d
--- /dev/null
+++ b/extensions/molecule/role_definitions/check/cleanup.yml
@@ -0,0 +1,19 @@
+---
+- name: "Cleanup — role_definitions (check)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove int-roledef-alpha (test teardown)
+      ansible.platform.role_definitions:
+        config:
+          - name: "int-roledef-alpha"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/role_definitions/check/converge.yml b/extensions/molecule/role_definitions/check/converge.yml
new file mode 100644
index 00000000..74db82cc
--- /dev/null
+++ b/extensions/molecule/role_definitions/check/converge.yml
@@ -0,0 +1,36 @@
+---
+- name: "Converge — role_definitions (check)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.role_definitions with state=merged
+      ansible.platform.role_definitions:
+        config:
+          - "{{ expected_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      check_mode: true
+      diff: true
+      register: result
+
+    - name: Assert check mode predicted a change
+      ansible.builtin.assert:
+        that:
+          - result.changed == true
+          - result.before is defined
+          - result.after is defined
+        fail_msg: "check mode should predict a change. got={{ result }}"
+
+    - name: Assert diff output is present
+      ansible.builtin.assert:
+        that:
+          - result.diff is defined
+        fail_msg: "diff output missing from check result"
+      when: result.diff is defined
+
+...
diff --git a/extensions/molecule/role_definition/check/molecule.yml b/extensions/molecule/role_definitions/check/molecule.yml
similarity index 100%
rename from extensions/molecule/role_definition/check/molecule.yml
rename to extensions/molecule/role_definitions/check/molecule.yml
diff --git a/extensions/molecule/role_definitions/check/prepare.yml b/extensions/molecule/role_definitions/check/prepare.yml
new file mode 100644
index 00000000..67ef9daf
--- /dev/null
+++ b/extensions/molecule/role_definitions/check/prepare.yml
@@ -0,0 +1,18 @@
+---
+- name: "Prepare — role_definitions (check)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed role_definitions as check-mode baseline (prerequisite for check)
+      ansible.platform.role_definitions:
+        config:
+          - "{{ prepare_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/role_definition/check/vars.yml b/extensions/molecule/role_definitions/check/vars.yml
similarity index 100%
rename from extensions/molecule/role_definition/check/vars.yml
rename to extensions/molecule/role_definitions/check/vars.yml
diff --git a/extensions/molecule/role_definitions/check/verify.yml b/extensions/molecule/role_definitions/check/verify.yml
new file mode 100644
index 00000000..db7daf89
--- /dev/null
+++ b/extensions/molecule/role_definitions/check/verify.yml
@@ -0,0 +1,27 @@
+---
+- name: "Verify — role_definitions (check)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather role_definitions (check mode must not have applied changes)
+      ansible.platform.role_definitions:
+        config:
+          - name: "{{ expected_config.name }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert int-roledef-alpha still has prepare_config values (check did not apply)
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length > 0
+          - (gathered.gathered | first).description == prepare_config.description
+        fail_msg: "check mode should not alter resource. got: {{ gathered.gathered }}"
+
+...
diff --git a/extensions/molecule/role_definitions/deleted/cleanup.yml b/extensions/molecule/role_definitions/deleted/cleanup.yml
new file mode 100644
index 00000000..0e91f70a
--- /dev/null
+++ b/extensions/molecule/role_definitions/deleted/cleanup.yml
@@ -0,0 +1,12 @@
+---
+- name: "Cleanup — role_definitions (deleted)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: No-op — int-roledef-alpha already deleted by converge
+      ansible.builtin.debug:
+        msg: "int-roledef-alpha was deleted in converge — nothing to clean up"
+
+...
diff --git a/extensions/molecule/role_definitions/deleted/converge.yml b/extensions/molecule/role_definitions/deleted/converge.yml
new file mode 100644
index 00000000..35cbd085
--- /dev/null
+++ b/extensions/molecule/role_definitions/deleted/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — role_definitions (deleted)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.role_definitions with state=deleted
+      ansible.platform.role_definitions:
+        config:
+          - "{{ expected_config }}"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/role_definition/deleted/molecule.yml b/extensions/molecule/role_definitions/deleted/molecule.yml
similarity index 100%
rename from extensions/molecule/role_definition/deleted/molecule.yml
rename to extensions/molecule/role_definitions/deleted/molecule.yml
diff --git a/extensions/molecule/role_definitions/deleted/prepare.yml b/extensions/molecule/role_definitions/deleted/prepare.yml
new file mode 100644
index 00000000..be267315
--- /dev/null
+++ b/extensions/molecule/role_definitions/deleted/prepare.yml
@@ -0,0 +1,18 @@
+---
+- name: "Prepare — role_definitions (deleted)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed role_definitions to be deleted (prerequisite for deleted)
+      ansible.platform.role_definitions:
+        config:
+          - "{{ prepare_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/role_definition/deleted/vars.yml b/extensions/molecule/role_definitions/deleted/vars.yml
similarity index 100%
rename from extensions/molecule/role_definition/deleted/vars.yml
rename to extensions/molecule/role_definitions/deleted/vars.yml
diff --git a/extensions/molecule/role_definitions/deleted/verify.yml b/extensions/molecule/role_definitions/deleted/verify.yml
new file mode 100644
index 00000000..0eceaf15
--- /dev/null
+++ b/extensions/molecule/role_definitions/deleted/verify.yml
@@ -0,0 +1,26 @@
+---
+- name: "Verify — role_definitions (deleted)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather role_definitions (should be absent after deleted)
+      ansible.platform.role_definitions:
+        config:
+          - name: "int-roledef-alpha"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert int-roledef-alpha no longer exists (deleted)
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length == 0
+        fail_msg: "Expected empty after deleted, got: {{ gathered.gathered }}"
+
+...
diff --git a/extensions/molecule/role_definitions/gathered/cleanup.yml b/extensions/molecule/role_definitions/gathered/cleanup.yml
new file mode 100644
index 00000000..42346a15
--- /dev/null
+++ b/extensions/molecule/role_definitions/gathered/cleanup.yml
@@ -0,0 +1,19 @@
+---
+- name: "Cleanup — role_definitions (gathered)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove int-roledef-alpha (test teardown)
+      ansible.platform.role_definitions:
+        config:
+          - name: "int-roledef-alpha"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/role_definitions/gathered/converge.yml b/extensions/molecule/role_definitions/gathered/converge.yml
new file mode 100644
index 00000000..c9d327e0
--- /dev/null
+++ b/extensions/molecule/role_definitions/gathered/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — role_definitions (gathered)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.role_definitions with state=gathered
+      ansible.platform.role_definitions:
+        config:
+          - "{{ expected_config }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/role_definition/gathered/molecule.yml b/extensions/molecule/role_definitions/gathered/molecule.yml
similarity index 100%
rename from extensions/molecule/role_definition/gathered/molecule.yml
rename to extensions/molecule/role_definitions/gathered/molecule.yml
diff --git a/extensions/molecule/role_definitions/gathered/prepare.yml b/extensions/molecule/role_definitions/gathered/prepare.yml
new file mode 100644
index 00000000..405b2433
--- /dev/null
+++ b/extensions/molecule/role_definitions/gathered/prepare.yml
@@ -0,0 +1,18 @@
+---
+- name: "Prepare — role_definitions (gathered)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed role_definitions to be gathered (prerequisite for gathered)
+      ansible.platform.role_definitions:
+        config:
+          - "{{ prepare_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/role_definition/gathered/vars.yml b/extensions/molecule/role_definitions/gathered/vars.yml
similarity index 100%
rename from extensions/molecule/role_definition/gathered/vars.yml
rename to extensions/molecule/role_definitions/gathered/vars.yml
diff --git a/extensions/molecule/role_definitions/gathered/verify.yml b/extensions/molecule/role_definitions/gathered/verify.yml
new file mode 100644
index 00000000..1b39045c
--- /dev/null
+++ b/extensions/molecule/role_definitions/gathered/verify.yml
@@ -0,0 +1,26 @@
+---
+- name: "Verify — role_definitions (gathered)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather role_definitions (assert present after gathered)
+      ansible.platform.role_definitions:
+        config:
+          - name: "{{ expected_config.name }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert configuration exists after gathered
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length > 0
+        fail_msg: "Expected resource after gathered. got: {{ gathered.gathered }}"
+
+...
diff --git a/extensions/molecule/role_definition/inventory.yml b/extensions/molecule/role_definitions/inventory.yml
similarity index 100%
rename from extensions/molecule/role_definition/inventory.yml
rename to extensions/molecule/role_definitions/inventory.yml
diff --git a/extensions/molecule/role_definitions/merged/cleanup.yml b/extensions/molecule/role_definitions/merged/cleanup.yml
new file mode 100644
index 00000000..455b32bd
--- /dev/null
+++ b/extensions/molecule/role_definitions/merged/cleanup.yml
@@ -0,0 +1,19 @@
+---
+- name: "Cleanup — role_definitions (merged)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove int-roledef-alpha (test teardown)
+      ansible.platform.role_definitions:
+        config:
+          - name: "int-roledef-alpha"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/role_definitions/merged/converge.yml b/extensions/molecule/role_definitions/merged/converge.yml
new file mode 100644
index 00000000..13a3dd46
--- /dev/null
+++ b/extensions/molecule/role_definitions/merged/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — role_definitions (merged)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.role_definitions with state=merged
+      ansible.platform.role_definitions:
+        config:
+          - "{{ expected_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/role_definition/merged/molecule.yml b/extensions/molecule/role_definitions/merged/molecule.yml
similarity index 100%
rename from extensions/molecule/role_definition/merged/molecule.yml
rename to extensions/molecule/role_definitions/merged/molecule.yml
diff --git a/extensions/molecule/role_definition/merged/vars.yml b/extensions/molecule/role_definitions/merged/vars.yml
similarity index 100%
rename from extensions/molecule/role_definition/merged/vars.yml
rename to extensions/molecule/role_definitions/merged/vars.yml
diff --git a/extensions/molecule/role_definitions/merged/verify.yml b/extensions/molecule/role_definitions/merged/verify.yml
new file mode 100644
index 00000000..b871b448
--- /dev/null
+++ b/extensions/molecule/role_definitions/merged/verify.yml
@@ -0,0 +1,26 @@
+---
+- name: "Verify — role_definitions (merged)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather role_definitions (assert present after merged)
+      ansible.platform.role_definitions:
+        config:
+          - name: "{{ expected_config.name }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert configuration exists after merged
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length > 0
+        fail_msg: "Expected resource after merged. got: {{ gathered.gathered }}"
+
+...
diff --git a/extensions/molecule/role_definitions/overridden/cleanup.yml b/extensions/molecule/role_definitions/overridden/cleanup.yml
new file mode 100644
index 00000000..b7d22250
--- /dev/null
+++ b/extensions/molecule/role_definitions/overridden/cleanup.yml
@@ -0,0 +1,19 @@
+---
+- name: "Cleanup — role_definitions (overridden)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove int-roledef-alpha (test teardown)
+      ansible.platform.role_definitions:
+        config:
+          - name: "int-roledef-alpha"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/role_definitions/overridden/converge.yml b/extensions/molecule/role_definitions/overridden/converge.yml
new file mode 100644
index 00000000..a106d82c
--- /dev/null
+++ b/extensions/molecule/role_definitions/overridden/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — role_definitions (overridden)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.role_definitions with state=overridden
+      ansible.platform.role_definitions:
+        config:
+          - "{{ expected_config }}"
+        state: overridden
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/role_definition/overridden/molecule.yml b/extensions/molecule/role_definitions/overridden/molecule.yml
similarity index 100%
rename from extensions/molecule/role_definition/overridden/molecule.yml
rename to extensions/molecule/role_definitions/overridden/molecule.yml
diff --git a/extensions/molecule/role_definitions/overridden/prepare.yml b/extensions/molecule/role_definitions/overridden/prepare.yml
new file mode 100644
index 00000000..44ef5492
--- /dev/null
+++ b/extensions/molecule/role_definitions/overridden/prepare.yml
@@ -0,0 +1,17 @@
+---
+- name: "Prepare — role_definitions (overridden)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed prerequisite resources via merged (r0 + r1 + extras for overridden)
+      ansible.platform.role_definitions:
+        config: "{{ prepare_configs }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/role_definition/overridden/vars.yml b/extensions/molecule/role_definitions/overridden/vars.yml
similarity index 100%
rename from extensions/molecule/role_definition/overridden/vars.yml
rename to extensions/molecule/role_definitions/overridden/vars.yml
diff --git a/extensions/molecule/role_definitions/overridden/verify.yml b/extensions/molecule/role_definitions/overridden/verify.yml
new file mode 100644
index 00000000..21b02eb3
--- /dev/null
+++ b/extensions/molecule/role_definitions/overridden/verify.yml
@@ -0,0 +1,31 @@
+---
+- name: "Verify — role_definitions (overridden)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather all role_definitions resources (verify overridden final state)
+      ansible.platform.role_definitions:
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered_all
+
+    - name: Assert int-roledef-alpha still exists after overridden
+      ansible.builtin.assert:
+        that:
+          - gathered_all.gathered is defined
+          - gathered_all.gathered | selectattr("name", "equalto", "int-roledef-alpha") | list | length == 1
+        fail_msg: "Expected int-roledef-alpha to exist after overridden. got: {{ gathered_all.gathered }}"
+
+    - name: Assert int-roledef-beta was deleted by overridden (not in desired config)
+      ansible.builtin.assert:
+        that:
+          - gathered_all.gathered is defined
+          - gathered_all.gathered | selectattr("name", "equalto", "int-roledef-beta") | list | length == 0
+        fail_msg: "overridden should have deleted int-roledef-beta. got: {{ gathered_all.gathered }}"
+
+...
diff --git a/extensions/molecule/role_definitions/replaced/cleanup.yml b/extensions/molecule/role_definitions/replaced/cleanup.yml
new file mode 100644
index 00000000..9e59371b
--- /dev/null
+++ b/extensions/molecule/role_definitions/replaced/cleanup.yml
@@ -0,0 +1,19 @@
+---
+- name: "Cleanup — role_definitions (replaced)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove int-roledef-alpha (test teardown)
+      ansible.platform.role_definitions:
+        config:
+          - name: "int-roledef-alpha"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/role_definitions/replaced/converge.yml b/extensions/molecule/role_definitions/replaced/converge.yml
new file mode 100644
index 00000000..6cf7c8c1
--- /dev/null
+++ b/extensions/molecule/role_definitions/replaced/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — role_definitions (replaced)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.role_definitions with state=replaced
+      ansible.platform.role_definitions:
+        config:
+          - "{{ expected_config }}"
+        state: replaced
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/role_definition/replaced/molecule.yml b/extensions/molecule/role_definitions/replaced/molecule.yml
similarity index 100%
rename from extensions/molecule/role_definition/replaced/molecule.yml
rename to extensions/molecule/role_definitions/replaced/molecule.yml
diff --git a/extensions/molecule/role_definitions/replaced/prepare.yml b/extensions/molecule/role_definitions/replaced/prepare.yml
new file mode 100644
index 00000000..78a0a59a
--- /dev/null
+++ b/extensions/molecule/role_definitions/replaced/prepare.yml
@@ -0,0 +1,18 @@
+---
+- name: "Prepare — role_definitions (replaced)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed role_definitions to be replaced (prerequisite for replaced)
+      ansible.platform.role_definitions:
+        config:
+          - "{{ prepare_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/role_definition/replaced/vars.yml b/extensions/molecule/role_definitions/replaced/vars.yml
similarity index 100%
rename from extensions/molecule/role_definition/replaced/vars.yml
rename to extensions/molecule/role_definitions/replaced/vars.yml
diff --git a/extensions/molecule/role_definitions/replaced/verify.yml b/extensions/molecule/role_definitions/replaced/verify.yml
new file mode 100644
index 00000000..84902d86
--- /dev/null
+++ b/extensions/molecule/role_definitions/replaced/verify.yml
@@ -0,0 +1,32 @@
+---
+- name: "Verify — role_definitions (replaced)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather role_definitions (assert present after replaced)
+      ansible.platform.role_definitions:
+        config:
+          - name: "{{ expected_config.name }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert configuration exists after replaced
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length > 0
+        fail_msg: "Expected resource after replaced. got: {{ gathered.gathered }}"
+
+    - name: Assert description was updated by replaced
+      ansible.builtin.assert:
+        that:
+          - (gathered.gathered | first).description == expected_config.description
+        fail_msg: "replaced should have set description='Alpha role definition replaced'. got: {{ (gathered.gathered | first).description }}"
+
+...
diff --git a/extensions/molecule/route/check/cleanup.yml b/extensions/molecule/route/check/cleanup.yml
deleted file mode 100644
index 4a434daa..00000000
--- a/extensions/molecule/route/check/cleanup.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Cleanup — route (check)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove int-route-alpha (test teardown)
-      ansible.platform.route:
-        config:
-          - name: "int-route-alpha"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/route/check/converge.yml b/extensions/molecule/route/check/converge.yml
deleted file mode 100644
index 92f1dc74..00000000
--- a/extensions/molecule/route/check/converge.yml
+++ /dev/null
@@ -1,36 +0,0 @@
----
-- name: "Converge — route (check)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.route with state=merged
-      ansible.platform.route:
-        config:
-          - "{{ expected_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      check_mode: true
-      diff: true
-      register: result
-
-    - name: Assert check mode predicted a change
-      ansible.builtin.assert:
-        that:
-          - result.changed == true
-          - result.before is defined
-          - result.after is defined
-        fail_msg: "check mode should predict a change. got={{ result }}"
-
-    - name: Assert diff output is present
-      ansible.builtin.assert:
-        that:
-          - result.diff is defined
-        fail_msg: "diff output missing from check result"
-      when: result.diff is defined
-
-...
diff --git a/extensions/molecule/route/check/prepare.yml b/extensions/molecule/route/check/prepare.yml
deleted file mode 100644
index 3b27eccd..00000000
--- a/extensions/molecule/route/check/prepare.yml
+++ /dev/null
@@ -1,18 +0,0 @@
----
-- name: "Prepare — route (check)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed route as check-mode baseline (prerequisite for check)
-      ansible.platform.route:
-        config:
-          - "{{ prepare_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/route/check/verify.yml b/extensions/molecule/route/check/verify.yml
deleted file mode 100644
index ab729a6c..00000000
--- a/extensions/molecule/route/check/verify.yml
+++ /dev/null
@@ -1,27 +0,0 @@
----
-- name: "Verify — route (check)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather route (check mode must not have applied changes)
-      ansible.platform.route:
-        config:
-          - name: "{{ expected_config.name }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert int-route-alpha still has prepare_config values (check did not apply)
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length > 0
-          - (gathered.gathered | first).description == prepare_config.description
-        fail_msg: "check mode should not alter resource. got: {{ gathered.gathered }}"
-
-...
diff --git a/extensions/molecule/route/deleted/cleanup.yml b/extensions/molecule/route/deleted/cleanup.yml
deleted file mode 100644
index 868ee7c4..00000000
--- a/extensions/molecule/route/deleted/cleanup.yml
+++ /dev/null
@@ -1,12 +0,0 @@
----
-- name: "Cleanup — route (deleted)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: No-op — int-route-alpha already deleted by converge
-      ansible.builtin.debug:
-        msg: "int-route-alpha was deleted in converge — nothing to clean up"
-
-...
diff --git a/extensions/molecule/route/deleted/converge.yml b/extensions/molecule/route/deleted/converge.yml
deleted file mode 100644
index 7eec3d99..00000000
--- a/extensions/molecule/route/deleted/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — route (deleted)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.route with state=deleted
-      ansible.platform.route:
-        config:
-          - "{{ expected_config }}"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/route/deleted/prepare.yml b/extensions/molecule/route/deleted/prepare.yml
deleted file mode 100644
index 8c032a8c..00000000
--- a/extensions/molecule/route/deleted/prepare.yml
+++ /dev/null
@@ -1,18 +0,0 @@
----
-- name: "Prepare — route (deleted)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed route to be deleted (prerequisite for deleted)
-      ansible.platform.route:
-        config:
-          - "{{ prepare_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/route/deleted/verify.yml b/extensions/molecule/route/deleted/verify.yml
deleted file mode 100644
index c6d53abb..00000000
--- a/extensions/molecule/route/deleted/verify.yml
+++ /dev/null
@@ -1,26 +0,0 @@
----
-- name: "Verify — route (deleted)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather route (should be absent after deleted)
-      ansible.platform.route:
-        config:
-          - name: "int-route-alpha"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert int-route-alpha no longer exists (deleted)
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length == 0
-        fail_msg: "Expected empty after deleted, got: {{ gathered.gathered }}"
-
-...
diff --git a/extensions/molecule/route/gathered/cleanup.yml b/extensions/molecule/route/gathered/cleanup.yml
deleted file mode 100644
index 0593cedf..00000000
--- a/extensions/molecule/route/gathered/cleanup.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Cleanup — route (gathered)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove int-route-alpha (test teardown)
-      ansible.platform.route:
-        config:
-          - name: "int-route-alpha"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/route/gathered/converge.yml b/extensions/molecule/route/gathered/converge.yml
deleted file mode 100644
index 0e2fd82a..00000000
--- a/extensions/molecule/route/gathered/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — route (gathered)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.route with state=gathered
-      ansible.platform.route:
-        config:
-          - "{{ expected_config }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/route/gathered/prepare.yml b/extensions/molecule/route/gathered/prepare.yml
deleted file mode 100644
index c9e42ef3..00000000
--- a/extensions/molecule/route/gathered/prepare.yml
+++ /dev/null
@@ -1,18 +0,0 @@
----
-- name: "Prepare — route (gathered)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed route to be gathered (prerequisite for gathered)
-      ansible.platform.route:
-        config:
-          - "{{ prepare_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/route/gathered/verify.yml b/extensions/molecule/route/gathered/verify.yml
deleted file mode 100644
index 1dacca3c..00000000
--- a/extensions/molecule/route/gathered/verify.yml
+++ /dev/null
@@ -1,26 +0,0 @@
----
-- name: "Verify — route (gathered)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather route (assert present after gathered)
-      ansible.platform.route:
-        config:
-          - name: "{{ expected_config.name }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert configuration exists after gathered
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length > 0
-        fail_msg: "Expected resource after gathered. got: {{ gathered.gathered }}"
-
-...
diff --git a/extensions/molecule/route/merged/cleanup.yml b/extensions/molecule/route/merged/cleanup.yml
deleted file mode 100644
index a842d9cc..00000000
--- a/extensions/molecule/route/merged/cleanup.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Cleanup — route (merged)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove int-route-alpha (test teardown)
-      ansible.platform.route:
-        config:
-          - name: "int-route-alpha"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/route/merged/converge.yml b/extensions/molecule/route/merged/converge.yml
deleted file mode 100644
index f674dc32..00000000
--- a/extensions/molecule/route/merged/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — route (merged)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.route with state=merged
-      ansible.platform.route:
-        config:
-          - "{{ expected_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/route/merged/verify.yml b/extensions/molecule/route/merged/verify.yml
deleted file mode 100644
index f79bd7ae..00000000
--- a/extensions/molecule/route/merged/verify.yml
+++ /dev/null
@@ -1,26 +0,0 @@
----
-- name: "Verify — route (merged)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather route (assert present after merged)
-      ansible.platform.route:
-        config:
-          - name: "{{ expected_config.name }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert configuration exists after merged
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length > 0
-        fail_msg: "Expected resource after merged. got: {{ gathered.gathered }}"
-
-...
diff --git a/extensions/molecule/route/overridden/cleanup.yml b/extensions/molecule/route/overridden/cleanup.yml
deleted file mode 100644
index 067a6c49..00000000
--- a/extensions/molecule/route/overridden/cleanup.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Cleanup — route (overridden)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove int-route-alpha (test teardown)
-      ansible.platform.route:
-        config:
-          - name: "int-route-alpha"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/route/overridden/converge.yml b/extensions/molecule/route/overridden/converge.yml
deleted file mode 100644
index 7be62978..00000000
--- a/extensions/molecule/route/overridden/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — route (overridden)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.route with state=overridden
-      ansible.platform.route:
-        config:
-          - "{{ expected_config }}"
-        state: overridden
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/route/overridden/prepare.yml b/extensions/molecule/route/overridden/prepare.yml
deleted file mode 100644
index 68fd15c6..00000000
--- a/extensions/molecule/route/overridden/prepare.yml
+++ /dev/null
@@ -1,17 +0,0 @@
----
-- name: "Prepare — route (overridden)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed prerequisite resources via merged (r0 + r1 + extras for overridden)
-      ansible.platform.route:
-        config: "{{ prepare_configs }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/route/overridden/verify.yml b/extensions/molecule/route/overridden/verify.yml
deleted file mode 100644
index 497ae8fe..00000000
--- a/extensions/molecule/route/overridden/verify.yml
+++ /dev/null
@@ -1,31 +0,0 @@
----
-- name: "Verify — route (overridden)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather all route resources (verify overridden final state)
-      ansible.platform.route:
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered_all
-
-    - name: Assert int-route-alpha still exists after overridden
-      ansible.builtin.assert:
-        that:
-          - gathered_all.gathered is defined
-          - gathered_all.gathered | selectattr("name", "equalto", "int-route-alpha") | list | length == 1
-        fail_msg: "Expected int-route-alpha to exist after overridden. got: {{ gathered_all.gathered }}"
-
-    - name: Assert int-route-beta was deleted by overridden (not in desired config)
-      ansible.builtin.assert:
-        that:
-          - gathered_all.gathered is defined
-          - gathered_all.gathered | selectattr("name", "equalto", "int-route-beta") | list | length == 0
-        fail_msg: "overridden should have deleted int-route-beta. got: {{ gathered_all.gathered }}"
-
-...
diff --git a/extensions/molecule/route/replaced/cleanup.yml b/extensions/molecule/route/replaced/cleanup.yml
deleted file mode 100644
index 3c6c7648..00000000
--- a/extensions/molecule/route/replaced/cleanup.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Cleanup — route (replaced)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove int-route-alpha (test teardown)
-      ansible.platform.route:
-        config:
-          - name: "int-route-alpha"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/route/replaced/converge.yml b/extensions/molecule/route/replaced/converge.yml
deleted file mode 100644
index 47eaebf9..00000000
--- a/extensions/molecule/route/replaced/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — route (replaced)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.route with state=replaced
-      ansible.platform.route:
-        config:
-          - "{{ expected_config }}"
-        state: replaced
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/route/replaced/prepare.yml b/extensions/molecule/route/replaced/prepare.yml
deleted file mode 100644
index c21d1755..00000000
--- a/extensions/molecule/route/replaced/prepare.yml
+++ /dev/null
@@ -1,18 +0,0 @@
----
-- name: "Prepare — route (replaced)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed route to be replaced (prerequisite for replaced)
-      ansible.platform.route:
-        config:
-          - "{{ prepare_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/route/replaced/verify.yml b/extensions/molecule/route/replaced/verify.yml
deleted file mode 100644
index 362e4d8b..00000000
--- a/extensions/molecule/route/replaced/verify.yml
+++ /dev/null
@@ -1,32 +0,0 @@
----
-- name: "Verify — route (replaced)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather route (assert present after replaced)
-      ansible.platform.route:
-        config:
-          - name: "{{ expected_config.name }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert configuration exists after replaced
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length > 0
-        fail_msg: "Expected resource after replaced. got: {{ gathered.gathered }}"
-
-    - name: Assert description was updated by replaced
-      ansible.builtin.assert:
-        that:
-          - (gathered.gathered | first).description == expected_config.description
-        fail_msg: "replaced should have set description='Alpha route'. got: {{ (gathered.gathered | first).description }}"
-
-...
diff --git a/extensions/molecule/routes/check/cleanup.yml b/extensions/molecule/routes/check/cleanup.yml
new file mode 100644
index 00000000..0a9a071a
--- /dev/null
+++ b/extensions/molecule/routes/check/cleanup.yml
@@ -0,0 +1,19 @@
+---
+- name: "Cleanup — routes (check)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove int-route-alpha (test teardown)
+      ansible.platform.routes:
+        config:
+          - name: "int-route-alpha"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/routes/check/converge.yml b/extensions/molecule/routes/check/converge.yml
new file mode 100644
index 00000000..3b1ed86b
--- /dev/null
+++ b/extensions/molecule/routes/check/converge.yml
@@ -0,0 +1,36 @@
+---
+- name: "Converge — routes (check)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.routes with state=merged
+      ansible.platform.routes:
+        config:
+          - "{{ expected_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      check_mode: true
+      diff: true
+      register: result
+
+    - name: Assert check mode predicted a change
+      ansible.builtin.assert:
+        that:
+          - result.changed == true
+          - result.before is defined
+          - result.after is defined
+        fail_msg: "check mode should predict a change. got={{ result }}"
+
+    - name: Assert diff output is present
+      ansible.builtin.assert:
+        that:
+          - result.diff is defined
+        fail_msg: "diff output missing from check result"
+      when: result.diff is defined
+
+...
diff --git a/extensions/molecule/route/check/molecule.yml b/extensions/molecule/routes/check/molecule.yml
similarity index 100%
rename from extensions/molecule/route/check/molecule.yml
rename to extensions/molecule/routes/check/molecule.yml
diff --git a/extensions/molecule/routes/check/prepare.yml b/extensions/molecule/routes/check/prepare.yml
new file mode 100644
index 00000000..df410750
--- /dev/null
+++ b/extensions/molecule/routes/check/prepare.yml
@@ -0,0 +1,18 @@
+---
+- name: "Prepare — routes (check)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed routes as check-mode baseline (prerequisite for check)
+      ansible.platform.routes:
+        config:
+          - "{{ prepare_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/route/check/vars.yml b/extensions/molecule/routes/check/vars.yml
similarity index 100%
rename from extensions/molecule/route/check/vars.yml
rename to extensions/molecule/routes/check/vars.yml
diff --git a/extensions/molecule/routes/check/verify.yml b/extensions/molecule/routes/check/verify.yml
new file mode 100644
index 00000000..6e37596a
--- /dev/null
+++ b/extensions/molecule/routes/check/verify.yml
@@ -0,0 +1,27 @@
+---
+- name: "Verify — routes (check)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather routes (check mode must not have applied changes)
+      ansible.platform.routes:
+        config:
+          - name: "{{ expected_config.name }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert int-route-alpha still has prepare_config values (check did not apply)
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length > 0
+          - (gathered.gathered | first).description == prepare_config.description
+        fail_msg: "check mode should not alter resource. got: {{ gathered.gathered }}"
+
+...
diff --git a/extensions/molecule/routes/deleted/cleanup.yml b/extensions/molecule/routes/deleted/cleanup.yml
new file mode 100644
index 00000000..a8bea5c5
--- /dev/null
+++ b/extensions/molecule/routes/deleted/cleanup.yml
@@ -0,0 +1,12 @@
+---
+- name: "Cleanup — routes (deleted)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: No-op — int-route-alpha already deleted by converge
+      ansible.builtin.debug:
+        msg: "int-route-alpha was deleted in converge — nothing to clean up"
+
+...
diff --git a/extensions/molecule/routes/deleted/converge.yml b/extensions/molecule/routes/deleted/converge.yml
new file mode 100644
index 00000000..6a731e9c
--- /dev/null
+++ b/extensions/molecule/routes/deleted/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — routes (deleted)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.routes with state=deleted
+      ansible.platform.routes:
+        config:
+          - "{{ expected_config }}"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/route/deleted/molecule.yml b/extensions/molecule/routes/deleted/molecule.yml
similarity index 100%
rename from extensions/molecule/route/deleted/molecule.yml
rename to extensions/molecule/routes/deleted/molecule.yml
diff --git a/extensions/molecule/routes/deleted/prepare.yml b/extensions/molecule/routes/deleted/prepare.yml
new file mode 100644
index 00000000..1c450c55
--- /dev/null
+++ b/extensions/molecule/routes/deleted/prepare.yml
@@ -0,0 +1,18 @@
+---
+- name: "Prepare — routes (deleted)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed routes to be deleted (prerequisite for deleted)
+      ansible.platform.routes:
+        config:
+          - "{{ prepare_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/route/deleted/vars.yml b/extensions/molecule/routes/deleted/vars.yml
similarity index 100%
rename from extensions/molecule/route/deleted/vars.yml
rename to extensions/molecule/routes/deleted/vars.yml
diff --git a/extensions/molecule/routes/deleted/verify.yml b/extensions/molecule/routes/deleted/verify.yml
new file mode 100644
index 00000000..d97a3625
--- /dev/null
+++ b/extensions/molecule/routes/deleted/verify.yml
@@ -0,0 +1,26 @@
+---
+- name: "Verify — routes (deleted)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather routes (should be absent after deleted)
+      ansible.platform.routes:
+        config:
+          - name: "int-route-alpha"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert int-route-alpha no longer exists (deleted)
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length == 0
+        fail_msg: "Expected empty after deleted, got: {{ gathered.gathered }}"
+
+...
diff --git a/extensions/molecule/routes/gathered/cleanup.yml b/extensions/molecule/routes/gathered/cleanup.yml
new file mode 100644
index 00000000..0343137f
--- /dev/null
+++ b/extensions/molecule/routes/gathered/cleanup.yml
@@ -0,0 +1,19 @@
+---
+- name: "Cleanup — routes (gathered)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove int-route-alpha (test teardown)
+      ansible.platform.routes:
+        config:
+          - name: "int-route-alpha"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/routes/gathered/converge.yml b/extensions/molecule/routes/gathered/converge.yml
new file mode 100644
index 00000000..ef452669
--- /dev/null
+++ b/extensions/molecule/routes/gathered/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — routes (gathered)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.routes with state=gathered
+      ansible.platform.routes:
+        config:
+          - "{{ expected_config }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/route/gathered/molecule.yml b/extensions/molecule/routes/gathered/molecule.yml
similarity index 100%
rename from extensions/molecule/route/gathered/molecule.yml
rename to extensions/molecule/routes/gathered/molecule.yml
diff --git a/extensions/molecule/routes/gathered/prepare.yml b/extensions/molecule/routes/gathered/prepare.yml
new file mode 100644
index 00000000..198df1c1
--- /dev/null
+++ b/extensions/molecule/routes/gathered/prepare.yml
@@ -0,0 +1,18 @@
+---
+- name: "Prepare — routes (gathered)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed routes to be gathered (prerequisite for gathered)
+      ansible.platform.routes:
+        config:
+          - "{{ prepare_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/route/gathered/vars.yml b/extensions/molecule/routes/gathered/vars.yml
similarity index 100%
rename from extensions/molecule/route/gathered/vars.yml
rename to extensions/molecule/routes/gathered/vars.yml
diff --git a/extensions/molecule/routes/gathered/verify.yml b/extensions/molecule/routes/gathered/verify.yml
new file mode 100644
index 00000000..9bca9594
--- /dev/null
+++ b/extensions/molecule/routes/gathered/verify.yml
@@ -0,0 +1,26 @@
+---
+- name: "Verify — routes (gathered)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather routes (assert present after gathered)
+      ansible.platform.routes:
+        config:
+          - name: "{{ expected_config.name }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert configuration exists after gathered
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length > 0
+        fail_msg: "Expected resource after gathered. got: {{ gathered.gathered }}"
+
+...
diff --git a/extensions/molecule/route/inventory.yml b/extensions/molecule/routes/inventory.yml
similarity index 100%
rename from extensions/molecule/route/inventory.yml
rename to extensions/molecule/routes/inventory.yml
diff --git a/extensions/molecule/routes/merged/cleanup.yml b/extensions/molecule/routes/merged/cleanup.yml
new file mode 100644
index 00000000..0eadcf1c
--- /dev/null
+++ b/extensions/molecule/routes/merged/cleanup.yml
@@ -0,0 +1,19 @@
+---
+- name: "Cleanup — routes (merged)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove int-route-alpha (test teardown)
+      ansible.platform.routes:
+        config:
+          - name: "int-route-alpha"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/routes/merged/converge.yml b/extensions/molecule/routes/merged/converge.yml
new file mode 100644
index 00000000..994630c9
--- /dev/null
+++ b/extensions/molecule/routes/merged/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — routes (merged)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.routes with state=merged
+      ansible.platform.routes:
+        config:
+          - "{{ expected_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/route/merged/molecule.yml b/extensions/molecule/routes/merged/molecule.yml
similarity index 100%
rename from extensions/molecule/route/merged/molecule.yml
rename to extensions/molecule/routes/merged/molecule.yml
diff --git a/extensions/molecule/route/merged/vars.yml b/extensions/molecule/routes/merged/vars.yml
similarity index 100%
rename from extensions/molecule/route/merged/vars.yml
rename to extensions/molecule/routes/merged/vars.yml
diff --git a/extensions/molecule/routes/merged/verify.yml b/extensions/molecule/routes/merged/verify.yml
new file mode 100644
index 00000000..0c0a1c8e
--- /dev/null
+++ b/extensions/molecule/routes/merged/verify.yml
@@ -0,0 +1,26 @@
+---
+- name: "Verify — routes (merged)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather routes (assert present after merged)
+      ansible.platform.routes:
+        config:
+          - name: "{{ expected_config.name }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert configuration exists after merged
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length > 0
+        fail_msg: "Expected resource after merged. got: {{ gathered.gathered }}"
+
+...
diff --git a/extensions/molecule/routes/overridden/cleanup.yml b/extensions/molecule/routes/overridden/cleanup.yml
new file mode 100644
index 00000000..15b2d798
--- /dev/null
+++ b/extensions/molecule/routes/overridden/cleanup.yml
@@ -0,0 +1,19 @@
+---
+- name: "Cleanup — routes (overridden)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove int-route-alpha (test teardown)
+      ansible.platform.routes:
+        config:
+          - name: "int-route-alpha"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/routes/overridden/converge.yml b/extensions/molecule/routes/overridden/converge.yml
new file mode 100644
index 00000000..635ee64f
--- /dev/null
+++ b/extensions/molecule/routes/overridden/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — routes (overridden)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.routes with state=overridden
+      ansible.platform.routes:
+        config:
+          - "{{ expected_config }}"
+        state: overridden
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/route/overridden/molecule.yml b/extensions/molecule/routes/overridden/molecule.yml
similarity index 100%
rename from extensions/molecule/route/overridden/molecule.yml
rename to extensions/molecule/routes/overridden/molecule.yml
diff --git a/extensions/molecule/routes/overridden/prepare.yml b/extensions/molecule/routes/overridden/prepare.yml
new file mode 100644
index 00000000..30ce1fe0
--- /dev/null
+++ b/extensions/molecule/routes/overridden/prepare.yml
@@ -0,0 +1,17 @@
+---
+- name: "Prepare — routes (overridden)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed prerequisite resources via merged (r0 + r1 + extras for overridden)
+      ansible.platform.routes:
+        config: "{{ prepare_configs }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/route/overridden/vars.yml b/extensions/molecule/routes/overridden/vars.yml
similarity index 100%
rename from extensions/molecule/route/overridden/vars.yml
rename to extensions/molecule/routes/overridden/vars.yml
diff --git a/extensions/molecule/routes/overridden/verify.yml b/extensions/molecule/routes/overridden/verify.yml
new file mode 100644
index 00000000..43c08b65
--- /dev/null
+++ b/extensions/molecule/routes/overridden/verify.yml
@@ -0,0 +1,31 @@
+---
+- name: "Verify — routes (overridden)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather all routes resources (verify overridden final state)
+      ansible.platform.routes:
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered_all
+
+    - name: Assert int-route-alpha still exists after overridden
+      ansible.builtin.assert:
+        that:
+          - gathered_all.gathered is defined
+          - gathered_all.gathered | selectattr("name", "equalto", "int-route-alpha") | list | length == 1
+        fail_msg: "Expected int-route-alpha to exist after overridden. got: {{ gathered_all.gathered }}"
+
+    - name: Assert int-route-beta was deleted by overridden (not in desired config)
+      ansible.builtin.assert:
+        that:
+          - gathered_all.gathered is defined
+          - gathered_all.gathered | selectattr("name", "equalto", "int-route-beta") | list | length == 0
+        fail_msg: "overridden should have deleted int-route-beta. got: {{ gathered_all.gathered }}"
+
+...
diff --git a/extensions/molecule/routes/replaced/cleanup.yml b/extensions/molecule/routes/replaced/cleanup.yml
new file mode 100644
index 00000000..b488aaab
--- /dev/null
+++ b/extensions/molecule/routes/replaced/cleanup.yml
@@ -0,0 +1,19 @@
+---
+- name: "Cleanup — routes (replaced)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove int-route-alpha (test teardown)
+      ansible.platform.routes:
+        config:
+          - name: "int-route-alpha"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/routes/replaced/converge.yml b/extensions/molecule/routes/replaced/converge.yml
new file mode 100644
index 00000000..9adf0c7d
--- /dev/null
+++ b/extensions/molecule/routes/replaced/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — routes (replaced)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.routes with state=replaced
+      ansible.platform.routes:
+        config:
+          - "{{ expected_config }}"
+        state: replaced
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/route/replaced/molecule.yml b/extensions/molecule/routes/replaced/molecule.yml
similarity index 100%
rename from extensions/molecule/route/replaced/molecule.yml
rename to extensions/molecule/routes/replaced/molecule.yml
diff --git a/extensions/molecule/routes/replaced/prepare.yml b/extensions/molecule/routes/replaced/prepare.yml
new file mode 100644
index 00000000..d6ce280e
--- /dev/null
+++ b/extensions/molecule/routes/replaced/prepare.yml
@@ -0,0 +1,18 @@
+---
+- name: "Prepare — routes (replaced)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed routes to be replaced (prerequisite for replaced)
+      ansible.platform.routes:
+        config:
+          - "{{ prepare_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/route/replaced/vars.yml b/extensions/molecule/routes/replaced/vars.yml
similarity index 100%
rename from extensions/molecule/route/replaced/vars.yml
rename to extensions/molecule/routes/replaced/vars.yml
diff --git a/extensions/molecule/routes/replaced/verify.yml b/extensions/molecule/routes/replaced/verify.yml
new file mode 100644
index 00000000..8deb24d9
--- /dev/null
+++ b/extensions/molecule/routes/replaced/verify.yml
@@ -0,0 +1,32 @@
+---
+- name: "Verify — routes (replaced)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather routes (assert present after replaced)
+      ansible.platform.routes:
+        config:
+          - name: "{{ expected_config.name }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert configuration exists after replaced
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length > 0
+        fail_msg: "Expected resource after replaced. got: {{ gathered.gathered }}"
+
+    - name: Assert description was updated by replaced
+      ansible.builtin.assert:
+        that:
+          - (gathered.gathered | first).description == expected_config.description
+        fail_msg: "replaced should have set description='Alpha route'. got: {{ (gathered.gathered | first).description }}"
+
+...
diff --git a/extensions/molecule/service/check/cleanup.yml b/extensions/molecule/service/check/cleanup.yml
deleted file mode 100644
index 76bf1ee2..00000000
--- a/extensions/molecule/service/check/cleanup.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Cleanup — service (check)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove int-svc-alpha (test teardown)
-      ansible.platform.service:
-        config:
-          - name: "int-svc-alpha"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/service/check/converge.yml b/extensions/molecule/service/check/converge.yml
deleted file mode 100644
index f37c53c8..00000000
--- a/extensions/molecule/service/check/converge.yml
+++ /dev/null
@@ -1,36 +0,0 @@
----
-- name: "Converge — service (check)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.service with state=merged
-      ansible.platform.service:
-        config:
-          - "{{ expected_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      check_mode: true
-      diff: true
-      register: result
-
-    - name: Assert check mode predicted a change
-      ansible.builtin.assert:
-        that:
-          - result.changed == true
-          - result.before is defined
-          - result.after is defined
-        fail_msg: "check mode should predict a change. got={{ result }}"
-
-    - name: Assert diff output is present
-      ansible.builtin.assert:
-        that:
-          - result.diff is defined
-        fail_msg: "diff output missing from check result"
-      when: result.diff is defined
-
-...
diff --git a/extensions/molecule/service/check/prepare.yml b/extensions/molecule/service/check/prepare.yml
deleted file mode 100644
index 6cb14305..00000000
--- a/extensions/molecule/service/check/prepare.yml
+++ /dev/null
@@ -1,18 +0,0 @@
----
-- name: "Prepare — service (check)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed service as check-mode baseline (prerequisite for check)
-      ansible.platform.service:
-        config:
-          - "{{ prepare_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/service/check/verify.yml b/extensions/molecule/service/check/verify.yml
deleted file mode 100644
index fe8ae69c..00000000
--- a/extensions/molecule/service/check/verify.yml
+++ /dev/null
@@ -1,27 +0,0 @@
----
-- name: "Verify — service (check)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather service (check mode must not have applied changes)
-      ansible.platform.service:
-        config:
-          - name: "{{ expected_config.name }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert int-svc-alpha still has prepare_config values (check did not apply)
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length > 0
-          - (gathered.gathered | first).description == prepare_config.description
-        fail_msg: "check mode should not alter resource. got: {{ gathered.gathered }}"
-
-...
diff --git a/extensions/molecule/service/deleted/cleanup.yml b/extensions/molecule/service/deleted/cleanup.yml
deleted file mode 100644
index f372b2f2..00000000
--- a/extensions/molecule/service/deleted/cleanup.yml
+++ /dev/null
@@ -1,12 +0,0 @@
----
-- name: "Cleanup — service (deleted)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: No-op — int-svc-alpha already deleted by converge
-      ansible.builtin.debug:
-        msg: "int-svc-alpha was deleted in converge — nothing to clean up"
-
-...
diff --git a/extensions/molecule/service/deleted/converge.yml b/extensions/molecule/service/deleted/converge.yml
deleted file mode 100644
index 2e263969..00000000
--- a/extensions/molecule/service/deleted/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — service (deleted)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.service with state=deleted
-      ansible.platform.service:
-        config:
-          - "{{ expected_config }}"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/service/deleted/prepare.yml b/extensions/molecule/service/deleted/prepare.yml
deleted file mode 100644
index 06fed9c6..00000000
--- a/extensions/molecule/service/deleted/prepare.yml
+++ /dev/null
@@ -1,18 +0,0 @@
----
-- name: "Prepare — service (deleted)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed service to be deleted (prerequisite for deleted)
-      ansible.platform.service:
-        config:
-          - "{{ prepare_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/service/deleted/verify.yml b/extensions/molecule/service/deleted/verify.yml
deleted file mode 100644
index f6c45c1a..00000000
--- a/extensions/molecule/service/deleted/verify.yml
+++ /dev/null
@@ -1,26 +0,0 @@
----
-- name: "Verify — service (deleted)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather service (should be absent after deleted)
-      ansible.platform.service:
-        config:
-          - name: "int-svc-alpha"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert int-svc-alpha no longer exists (deleted)
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length == 0
-        fail_msg: "Expected empty after deleted, got: {{ gathered.gathered }}"
-
-...
diff --git a/extensions/molecule/service/gathered/cleanup.yml b/extensions/molecule/service/gathered/cleanup.yml
deleted file mode 100644
index 6848cb35..00000000
--- a/extensions/molecule/service/gathered/cleanup.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Cleanup — service (gathered)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove int-svc-alpha (test teardown)
-      ansible.platform.service:
-        config:
-          - name: "int-svc-alpha"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/service/gathered/converge.yml b/extensions/molecule/service/gathered/converge.yml
deleted file mode 100644
index c05de88e..00000000
--- a/extensions/molecule/service/gathered/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — service (gathered)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.service with state=gathered
-      ansible.platform.service:
-        config:
-          - "{{ expected_config }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/service/gathered/prepare.yml b/extensions/molecule/service/gathered/prepare.yml
deleted file mode 100644
index 466408dd..00000000
--- a/extensions/molecule/service/gathered/prepare.yml
+++ /dev/null
@@ -1,18 +0,0 @@
----
-- name: "Prepare — service (gathered)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed service to be gathered (prerequisite for gathered)
-      ansible.platform.service:
-        config:
-          - "{{ prepare_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/service/gathered/verify.yml b/extensions/molecule/service/gathered/verify.yml
deleted file mode 100644
index 18d663fb..00000000
--- a/extensions/molecule/service/gathered/verify.yml
+++ /dev/null
@@ -1,26 +0,0 @@
----
-- name: "Verify — service (gathered)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather service (assert present after gathered)
-      ansible.platform.service:
-        config:
-          - name: "{{ expected_config.name }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert configuration exists after gathered
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length > 0
-        fail_msg: "Expected resource after gathered. got: {{ gathered.gathered }}"
-
-...
diff --git a/extensions/molecule/service/merged/cleanup.yml b/extensions/molecule/service/merged/cleanup.yml
deleted file mode 100644
index dd343a16..00000000
--- a/extensions/molecule/service/merged/cleanup.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Cleanup — service (merged)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove int-svc-alpha (test teardown)
-      ansible.platform.service:
-        config:
-          - name: "int-svc-alpha"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/service/merged/converge.yml b/extensions/molecule/service/merged/converge.yml
deleted file mode 100644
index be2b3166..00000000
--- a/extensions/molecule/service/merged/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — service (merged)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.service with state=merged
-      ansible.platform.service:
-        config:
-          - "{{ expected_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/service/merged/verify.yml b/extensions/molecule/service/merged/verify.yml
deleted file mode 100644
index 8828957b..00000000
--- a/extensions/molecule/service/merged/verify.yml
+++ /dev/null
@@ -1,26 +0,0 @@
----
-- name: "Verify — service (merged)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather service (assert present after merged)
-      ansible.platform.service:
-        config:
-          - name: "{{ expected_config.name }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert configuration exists after merged
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length > 0
-        fail_msg: "Expected resource after merged. got: {{ gathered.gathered }}"
-
-...
diff --git a/extensions/molecule/service/overridden/cleanup.yml b/extensions/molecule/service/overridden/cleanup.yml
deleted file mode 100644
index 0071c26c..00000000
--- a/extensions/molecule/service/overridden/cleanup.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Cleanup — service (overridden)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove int-svc-alpha (test teardown)
-      ansible.platform.service:
-        config:
-          - name: "int-svc-alpha"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/service/overridden/converge.yml b/extensions/molecule/service/overridden/converge.yml
deleted file mode 100644
index 9ac04d2f..00000000
--- a/extensions/molecule/service/overridden/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — service (overridden)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.service with state=overridden
-      ansible.platform.service:
-        config:
-          - "{{ expected_config }}"
-        state: overridden
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/service/overridden/prepare.yml b/extensions/molecule/service/overridden/prepare.yml
deleted file mode 100644
index 5f7cb6b1..00000000
--- a/extensions/molecule/service/overridden/prepare.yml
+++ /dev/null
@@ -1,17 +0,0 @@
----
-- name: "Prepare — service (overridden)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed prerequisite resources via merged (r0 + r1 + extras for overridden)
-      ansible.platform.service:
-        config: "{{ prepare_configs }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/service/overridden/verify.yml b/extensions/molecule/service/overridden/verify.yml
deleted file mode 100644
index 0f863922..00000000
--- a/extensions/molecule/service/overridden/verify.yml
+++ /dev/null
@@ -1,31 +0,0 @@
----
-- name: "Verify — service (overridden)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather all service resources (verify overridden final state)
-      ansible.platform.service:
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered_all
-
-    - name: Assert int-svc-alpha still exists after overridden
-      ansible.builtin.assert:
-        that:
-          - gathered_all.gathered is defined
-          - gathered_all.gathered | selectattr("name", "equalto", "int-svc-alpha") | list | length == 1
-        fail_msg: "Expected int-svc-alpha to exist after overridden. got: {{ gathered_all.gathered }}"
-
-    - name: Assert int-svc-beta was deleted by overridden (not in desired config)
-      ansible.builtin.assert:
-        that:
-          - gathered_all.gathered is defined
-          - gathered_all.gathered | selectattr("name", "equalto", "int-svc-beta") | list | length == 0
-        fail_msg: "overridden should have deleted int-svc-beta. got: {{ gathered_all.gathered }}"
-
-...
diff --git a/extensions/molecule/service/replaced/cleanup.yml b/extensions/molecule/service/replaced/cleanup.yml
deleted file mode 100644
index 103c9738..00000000
--- a/extensions/molecule/service/replaced/cleanup.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Cleanup — service (replaced)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove int-svc-alpha (test teardown)
-      ansible.platform.service:
-        config:
-          - name: "int-svc-alpha"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/service/replaced/converge.yml b/extensions/molecule/service/replaced/converge.yml
deleted file mode 100644
index 07860fe5..00000000
--- a/extensions/molecule/service/replaced/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — service (replaced)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.service with state=replaced
-      ansible.platform.service:
-        config:
-          - "{{ expected_config }}"
-        state: replaced
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/service/replaced/prepare.yml b/extensions/molecule/service/replaced/prepare.yml
deleted file mode 100644
index d83eb846..00000000
--- a/extensions/molecule/service/replaced/prepare.yml
+++ /dev/null
@@ -1,18 +0,0 @@
----
-- name: "Prepare — service (replaced)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed service to be replaced (prerequisite for replaced)
-      ansible.platform.service:
-        config:
-          - "{{ prepare_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/service/replaced/verify.yml b/extensions/molecule/service/replaced/verify.yml
deleted file mode 100644
index 6636472f..00000000
--- a/extensions/molecule/service/replaced/verify.yml
+++ /dev/null
@@ -1,32 +0,0 @@
----
-- name: "Verify — service (replaced)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather service (assert present after replaced)
-      ansible.platform.service:
-        config:
-          - name: "{{ expected_config.name }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert configuration exists after replaced
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length > 0
-        fail_msg: "Expected resource after replaced. got: {{ gathered.gathered }}"
-
-    - name: Assert description was updated by replaced
-      ansible.builtin.assert:
-        that:
-          - (gathered.gathered | first).description == expected_config.description
-        fail_msg: "replaced should have set description='Alpha service'. got: {{ (gathered.gathered | first).description }}"
-
-...
diff --git a/extensions/molecule/service_cluster/check/cleanup.yml b/extensions/molecule/service_cluster/check/cleanup.yml
deleted file mode 100644
index f2bb7f3d..00000000
--- a/extensions/molecule/service_cluster/check/cleanup.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Cleanup — service_cluster (check)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove int-cluster-alpha (test teardown)
-      ansible.platform.service_cluster:
-        config:
-          - name: "int-cluster-alpha"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/service_cluster/check/converge.yml b/extensions/molecule/service_cluster/check/converge.yml
deleted file mode 100644
index 55747213..00000000
--- a/extensions/molecule/service_cluster/check/converge.yml
+++ /dev/null
@@ -1,36 +0,0 @@
----
-- name: "Converge — service_cluster (check)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.service_cluster with state=merged
-      ansible.platform.service_cluster:
-        config:
-          - "{{ expected_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      check_mode: true
-      diff: true
-      register: result
-
-    - name: Assert check mode predicted a change
-      ansible.builtin.assert:
-        that:
-          - result.changed == true
-          - result.before is defined
-          - result.after is defined
-        fail_msg: "check mode should predict a change. got={{ result }}"
-
-    - name: Assert diff output is present
-      ansible.builtin.assert:
-        that:
-          - result.diff is defined
-        fail_msg: "diff output missing from check result"
-      when: result.diff is defined
-
-...
diff --git a/extensions/molecule/service_cluster/check/prepare.yml b/extensions/molecule/service_cluster/check/prepare.yml
deleted file mode 100644
index eb62f7ac..00000000
--- a/extensions/molecule/service_cluster/check/prepare.yml
+++ /dev/null
@@ -1,18 +0,0 @@
----
-- name: "Prepare — service_cluster (check)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed service_cluster as check-mode baseline (prerequisite for check)
-      ansible.platform.service_cluster:
-        config:
-          - "{{ prepare_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/service_cluster/check/verify.yml b/extensions/molecule/service_cluster/check/verify.yml
deleted file mode 100644
index e09a579b..00000000
--- a/extensions/molecule/service_cluster/check/verify.yml
+++ /dev/null
@@ -1,27 +0,0 @@
----
-- name: "Verify — service_cluster (check)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather service_cluster (check mode must not have applied changes)
-      ansible.platform.service_cluster:
-        config:
-          - name: "{{ expected_config.name }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert int-cluster-alpha still has prepare_config values (check did not apply)
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length > 0
-          - (gathered.gathered | first).outlier_detection_enabled == prepare_config.outlier_detection_enabled
-        fail_msg: "check mode should not alter resource. got: {{ gathered.gathered }}"
-
-...
diff --git a/extensions/molecule/service_cluster/deleted/cleanup.yml b/extensions/molecule/service_cluster/deleted/cleanup.yml
deleted file mode 100644
index 774f1f20..00000000
--- a/extensions/molecule/service_cluster/deleted/cleanup.yml
+++ /dev/null
@@ -1,12 +0,0 @@
----
-- name: "Cleanup — service_cluster (deleted)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: No-op — int-cluster-alpha already deleted by converge
-      ansible.builtin.debug:
-        msg: "int-cluster-alpha was deleted in converge — nothing to clean up"
-
-...
diff --git a/extensions/molecule/service_cluster/deleted/converge.yml b/extensions/molecule/service_cluster/deleted/converge.yml
deleted file mode 100644
index 4571c87e..00000000
--- a/extensions/molecule/service_cluster/deleted/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — service_cluster (deleted)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.service_cluster with state=deleted
-      ansible.platform.service_cluster:
-        config:
-          - "{{ expected_config }}"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/service_cluster/deleted/prepare.yml b/extensions/molecule/service_cluster/deleted/prepare.yml
deleted file mode 100644
index 8c80de29..00000000
--- a/extensions/molecule/service_cluster/deleted/prepare.yml
+++ /dev/null
@@ -1,18 +0,0 @@
----
-- name: "Prepare — service_cluster (deleted)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed service_cluster to be deleted (prerequisite for deleted)
-      ansible.platform.service_cluster:
-        config:
-          - "{{ prepare_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/service_cluster/deleted/verify.yml b/extensions/molecule/service_cluster/deleted/verify.yml
deleted file mode 100644
index a1fbeb4b..00000000
--- a/extensions/molecule/service_cluster/deleted/verify.yml
+++ /dev/null
@@ -1,26 +0,0 @@
----
-- name: "Verify — service_cluster (deleted)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather service_cluster (should be absent after deleted)
-      ansible.platform.service_cluster:
-        config:
-          - name: "int-cluster-alpha"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert int-cluster-alpha no longer exists (deleted)
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length == 0
-        fail_msg: "Expected empty after deleted, got: {{ gathered.gathered }}"
-
-...
diff --git a/extensions/molecule/service_cluster/gathered/cleanup.yml b/extensions/molecule/service_cluster/gathered/cleanup.yml
deleted file mode 100644
index ef7cde00..00000000
--- a/extensions/molecule/service_cluster/gathered/cleanup.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Cleanup — service_cluster (gathered)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove int-cluster-alpha (test teardown)
-      ansible.platform.service_cluster:
-        config:
-          - name: "int-cluster-alpha"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/service_cluster/gathered/converge.yml b/extensions/molecule/service_cluster/gathered/converge.yml
deleted file mode 100644
index 1933e80e..00000000
--- a/extensions/molecule/service_cluster/gathered/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — service_cluster (gathered)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.service_cluster with state=gathered
-      ansible.platform.service_cluster:
-        config:
-          - "{{ expected_config }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/service_cluster/gathered/prepare.yml b/extensions/molecule/service_cluster/gathered/prepare.yml
deleted file mode 100644
index b3fda93b..00000000
--- a/extensions/molecule/service_cluster/gathered/prepare.yml
+++ /dev/null
@@ -1,18 +0,0 @@
----
-- name: "Prepare — service_cluster (gathered)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed service_cluster to be gathered (prerequisite for gathered)
-      ansible.platform.service_cluster:
-        config:
-          - "{{ prepare_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/service_cluster/gathered/verify.yml b/extensions/molecule/service_cluster/gathered/verify.yml
deleted file mode 100644
index 9323c409..00000000
--- a/extensions/molecule/service_cluster/gathered/verify.yml
+++ /dev/null
@@ -1,26 +0,0 @@
----
-- name: "Verify — service_cluster (gathered)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather service_cluster (assert present after gathered)
-      ansible.platform.service_cluster:
-        config:
-          - name: "{{ expected_config.name }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert configuration exists after gathered
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length > 0
-        fail_msg: "Expected resource after gathered. got: {{ gathered.gathered }}"
-
-...
diff --git a/extensions/molecule/service_cluster/merged/cleanup.yml b/extensions/molecule/service_cluster/merged/cleanup.yml
deleted file mode 100644
index e61ad23d..00000000
--- a/extensions/molecule/service_cluster/merged/cleanup.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Cleanup — service_cluster (merged)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove int-cluster-alpha (test teardown)
-      ansible.platform.service_cluster:
-        config:
-          - name: "int-cluster-alpha"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/service_cluster/merged/converge.yml b/extensions/molecule/service_cluster/merged/converge.yml
deleted file mode 100644
index 04cf3efd..00000000
--- a/extensions/molecule/service_cluster/merged/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — service_cluster (merged)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.service_cluster with state=merged
-      ansible.platform.service_cluster:
-        config:
-          - "{{ expected_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/service_cluster/merged/verify.yml b/extensions/molecule/service_cluster/merged/verify.yml
deleted file mode 100644
index 0217c1b3..00000000
--- a/extensions/molecule/service_cluster/merged/verify.yml
+++ /dev/null
@@ -1,26 +0,0 @@
----
-- name: "Verify — service_cluster (merged)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather service_cluster (assert present after merged)
-      ansible.platform.service_cluster:
-        config:
-          - name: "{{ expected_config.name }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert configuration exists after merged
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length > 0
-        fail_msg: "Expected resource after merged. got: {{ gathered.gathered }}"
-
-...
diff --git a/extensions/molecule/service_cluster/overridden/cleanup.yml b/extensions/molecule/service_cluster/overridden/cleanup.yml
deleted file mode 100644
index 97c2373e..00000000
--- a/extensions/molecule/service_cluster/overridden/cleanup.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Cleanup — service_cluster (overridden)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove int-cluster-alpha (test teardown)
-      ansible.platform.service_cluster:
-        config:
-          - name: "int-cluster-alpha"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/service_cluster/overridden/converge.yml b/extensions/molecule/service_cluster/overridden/converge.yml
deleted file mode 100644
index 3d34a962..00000000
--- a/extensions/molecule/service_cluster/overridden/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — service_cluster (overridden)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.service_cluster with state=overridden
-      ansible.platform.service_cluster:
-        config:
-          - "{{ expected_config }}"
-        state: overridden
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/service_cluster/overridden/prepare.yml b/extensions/molecule/service_cluster/overridden/prepare.yml
deleted file mode 100644
index 0c3c75ee..00000000
--- a/extensions/molecule/service_cluster/overridden/prepare.yml
+++ /dev/null
@@ -1,17 +0,0 @@
----
-- name: "Prepare — service_cluster (overridden)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed prerequisite resources via merged (r0 + r1 + extras for overridden)
-      ansible.platform.service_cluster:
-        config: "{{ prepare_configs }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/service_cluster/overridden/verify.yml b/extensions/molecule/service_cluster/overridden/verify.yml
deleted file mode 100644
index e8f378ee..00000000
--- a/extensions/molecule/service_cluster/overridden/verify.yml
+++ /dev/null
@@ -1,31 +0,0 @@
----
-- name: "Verify — service_cluster (overridden)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather all service_cluster resources (verify overridden final state)
-      ansible.platform.service_cluster:
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered_all
-
-    - name: Assert int-cluster-alpha still exists after overridden
-      ansible.builtin.assert:
-        that:
-          - gathered_all.gathered is defined
-          - gathered_all.gathered | selectattr("name", "equalto", "int-cluster-alpha") | list | length == 1
-        fail_msg: "Expected int-cluster-alpha to exist after overridden. got: {{ gathered_all.gathered }}"
-
-    - name: Assert int-cluster-beta was deleted by overridden (not in desired config)
-      ansible.builtin.assert:
-        that:
-          - gathered_all.gathered is defined
-          - gathered_all.gathered | selectattr("name", "equalto", "int-cluster-beta") | list | length == 0
-        fail_msg: "overridden should have deleted int-cluster-beta. got: {{ gathered_all.gathered }}"
-
-...
diff --git a/extensions/molecule/service_cluster/replaced/cleanup.yml b/extensions/molecule/service_cluster/replaced/cleanup.yml
deleted file mode 100644
index bab16ade..00000000
--- a/extensions/molecule/service_cluster/replaced/cleanup.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Cleanup — service_cluster (replaced)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove int-cluster-alpha (test teardown)
-      ansible.platform.service_cluster:
-        config:
-          - name: "int-cluster-alpha"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/service_cluster/replaced/converge.yml b/extensions/molecule/service_cluster/replaced/converge.yml
deleted file mode 100644
index 8535e1a1..00000000
--- a/extensions/molecule/service_cluster/replaced/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — service_cluster (replaced)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.service_cluster with state=replaced
-      ansible.platform.service_cluster:
-        config:
-          - "{{ expected_config }}"
-        state: replaced
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/service_cluster/replaced/prepare.yml b/extensions/molecule/service_cluster/replaced/prepare.yml
deleted file mode 100644
index 4d417bca..00000000
--- a/extensions/molecule/service_cluster/replaced/prepare.yml
+++ /dev/null
@@ -1,18 +0,0 @@
----
-- name: "Prepare — service_cluster (replaced)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed service_cluster to be replaced (prerequisite for replaced)
-      ansible.platform.service_cluster:
-        config:
-          - "{{ prepare_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/service_cluster/replaced/verify.yml b/extensions/molecule/service_cluster/replaced/verify.yml
deleted file mode 100644
index 691f3e7d..00000000
--- a/extensions/molecule/service_cluster/replaced/verify.yml
+++ /dev/null
@@ -1,32 +0,0 @@
----
-- name: "Verify — service_cluster (replaced)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather service_cluster (assert present after replaced)
-      ansible.platform.service_cluster:
-        config:
-          - name: "{{ expected_config.name }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert configuration exists after replaced
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length > 0
-        fail_msg: "Expected resource after replaced. got: {{ gathered.gathered }}"
-
-    - name: Assert outlier_detection_enabled was updated by replaced
-      ansible.builtin.assert:
-        that:
-          - (gathered.gathered | first).outlier_detection_enabled == expected_config.outlier_detection_enabled
-        fail_msg: "replaced should have set outlier_detection_enabled=False. got: {{ (gathered.gathered | first).outlier_detection_enabled }}"
-
-...
diff --git a/extensions/molecule/service_clusters/check/cleanup.yml b/extensions/molecule/service_clusters/check/cleanup.yml
new file mode 100644
index 00000000..2830446e
--- /dev/null
+++ b/extensions/molecule/service_clusters/check/cleanup.yml
@@ -0,0 +1,19 @@
+---
+- name: "Cleanup — service_clusters (check)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove int-cluster-alpha (test teardown)
+      ansible.platform.service_clusters:
+        config:
+          - name: "int-cluster-alpha"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/service_clusters/check/converge.yml b/extensions/molecule/service_clusters/check/converge.yml
new file mode 100644
index 00000000..649dc340
--- /dev/null
+++ b/extensions/molecule/service_clusters/check/converge.yml
@@ -0,0 +1,36 @@
+---
+- name: "Converge — service_clusters (check)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.service_clusters with state=merged
+      ansible.platform.service_clusters:
+        config:
+          - "{{ expected_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      check_mode: true
+      diff: true
+      register: result
+
+    - name: Assert check mode predicted a change
+      ansible.builtin.assert:
+        that:
+          - result.changed == true
+          - result.before is defined
+          - result.after is defined
+        fail_msg: "check mode should predict a change. got={{ result }}"
+
+    - name: Assert diff output is present
+      ansible.builtin.assert:
+        that:
+          - result.diff is defined
+        fail_msg: "diff output missing from check result"
+      when: result.diff is defined
+
+...
diff --git a/extensions/molecule/service/check/molecule.yml b/extensions/molecule/service_clusters/check/molecule.yml
similarity index 100%
rename from extensions/molecule/service/check/molecule.yml
rename to extensions/molecule/service_clusters/check/molecule.yml
diff --git a/extensions/molecule/service_clusters/check/prepare.yml b/extensions/molecule/service_clusters/check/prepare.yml
new file mode 100644
index 00000000..9228d250
--- /dev/null
+++ b/extensions/molecule/service_clusters/check/prepare.yml
@@ -0,0 +1,18 @@
+---
+- name: "Prepare — service_clusters (check)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed service_clusters as check-mode baseline (prerequisite for check)
+      ansible.platform.service_clusters:
+        config:
+          - "{{ prepare_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/service_cluster/check/vars.yml b/extensions/molecule/service_clusters/check/vars.yml
similarity index 100%
rename from extensions/molecule/service_cluster/check/vars.yml
rename to extensions/molecule/service_clusters/check/vars.yml
diff --git a/extensions/molecule/service_clusters/check/verify.yml b/extensions/molecule/service_clusters/check/verify.yml
new file mode 100644
index 00000000..a3473e00
--- /dev/null
+++ b/extensions/molecule/service_clusters/check/verify.yml
@@ -0,0 +1,27 @@
+---
+- name: "Verify — service_clusters (check)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather service_clusters (check mode must not have applied changes)
+      ansible.platform.service_clusters:
+        config:
+          - name: "{{ expected_config.name }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert int-cluster-alpha still has prepare_config values (check did not apply)
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length > 0
+          - (gathered.gathered | first).outlier_detection_enabled == prepare_config.outlier_detection_enabled
+        fail_msg: "check mode should not alter resource. got: {{ gathered.gathered }}"
+
+...
diff --git a/extensions/molecule/service_clusters/deleted/cleanup.yml b/extensions/molecule/service_clusters/deleted/cleanup.yml
new file mode 100644
index 00000000..3e15dcdb
--- /dev/null
+++ b/extensions/molecule/service_clusters/deleted/cleanup.yml
@@ -0,0 +1,12 @@
+---
+- name: "Cleanup — service_clusters (deleted)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: No-op — int-cluster-alpha already deleted by converge
+      ansible.builtin.debug:
+        msg: "int-cluster-alpha was deleted in converge — nothing to clean up"
+
+...
diff --git a/extensions/molecule/service_clusters/deleted/converge.yml b/extensions/molecule/service_clusters/deleted/converge.yml
new file mode 100644
index 00000000..0ebaf8a8
--- /dev/null
+++ b/extensions/molecule/service_clusters/deleted/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — service_clusters (deleted)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.service_clusters with state=deleted
+      ansible.platform.service_clusters:
+        config:
+          - "{{ expected_config }}"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/service/deleted/molecule.yml b/extensions/molecule/service_clusters/deleted/molecule.yml
similarity index 100%
rename from extensions/molecule/service/deleted/molecule.yml
rename to extensions/molecule/service_clusters/deleted/molecule.yml
diff --git a/extensions/molecule/service_clusters/deleted/prepare.yml b/extensions/molecule/service_clusters/deleted/prepare.yml
new file mode 100644
index 00000000..68a9f310
--- /dev/null
+++ b/extensions/molecule/service_clusters/deleted/prepare.yml
@@ -0,0 +1,18 @@
+---
+- name: "Prepare — service_clusters (deleted)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed service_clusters to be deleted (prerequisite for deleted)
+      ansible.platform.service_clusters:
+        config:
+          - "{{ prepare_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/service_cluster/deleted/vars.yml b/extensions/molecule/service_clusters/deleted/vars.yml
similarity index 100%
rename from extensions/molecule/service_cluster/deleted/vars.yml
rename to extensions/molecule/service_clusters/deleted/vars.yml
diff --git a/extensions/molecule/service_clusters/deleted/verify.yml b/extensions/molecule/service_clusters/deleted/verify.yml
new file mode 100644
index 00000000..bcb61acb
--- /dev/null
+++ b/extensions/molecule/service_clusters/deleted/verify.yml
@@ -0,0 +1,26 @@
+---
+- name: "Verify — service_clusters (deleted)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather service_clusters (should be absent after deleted)
+      ansible.platform.service_clusters:
+        config:
+          - name: "int-cluster-alpha"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert int-cluster-alpha no longer exists (deleted)
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length == 0
+        fail_msg: "Expected empty after deleted, got: {{ gathered.gathered }}"
+
+...
diff --git a/extensions/molecule/service_clusters/gathered/cleanup.yml b/extensions/molecule/service_clusters/gathered/cleanup.yml
new file mode 100644
index 00000000..48a3c0e4
--- /dev/null
+++ b/extensions/molecule/service_clusters/gathered/cleanup.yml
@@ -0,0 +1,19 @@
+---
+- name: "Cleanup — service_clusters (gathered)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove int-cluster-alpha (test teardown)
+      ansible.platform.service_clusters:
+        config:
+          - name: "int-cluster-alpha"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/service_clusters/gathered/converge.yml b/extensions/molecule/service_clusters/gathered/converge.yml
new file mode 100644
index 00000000..11cced2f
--- /dev/null
+++ b/extensions/molecule/service_clusters/gathered/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — service_clusters (gathered)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.service_clusters with state=gathered
+      ansible.platform.service_clusters:
+        config:
+          - "{{ expected_config }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/service/gathered/molecule.yml b/extensions/molecule/service_clusters/gathered/molecule.yml
similarity index 100%
rename from extensions/molecule/service/gathered/molecule.yml
rename to extensions/molecule/service_clusters/gathered/molecule.yml
diff --git a/extensions/molecule/service_clusters/gathered/prepare.yml b/extensions/molecule/service_clusters/gathered/prepare.yml
new file mode 100644
index 00000000..9d4b4e05
--- /dev/null
+++ b/extensions/molecule/service_clusters/gathered/prepare.yml
@@ -0,0 +1,18 @@
+---
+- name: "Prepare — service_clusters (gathered)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed service_clusters to be gathered (prerequisite for gathered)
+      ansible.platform.service_clusters:
+        config:
+          - "{{ prepare_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/service_cluster/gathered/vars.yml b/extensions/molecule/service_clusters/gathered/vars.yml
similarity index 100%
rename from extensions/molecule/service_cluster/gathered/vars.yml
rename to extensions/molecule/service_clusters/gathered/vars.yml
diff --git a/extensions/molecule/service_clusters/gathered/verify.yml b/extensions/molecule/service_clusters/gathered/verify.yml
new file mode 100644
index 00000000..ac944e20
--- /dev/null
+++ b/extensions/molecule/service_clusters/gathered/verify.yml
@@ -0,0 +1,26 @@
+---
+- name: "Verify — service_clusters (gathered)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather service_clusters (assert present after gathered)
+      ansible.platform.service_clusters:
+        config:
+          - name: "{{ expected_config.name }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert configuration exists after gathered
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length > 0
+        fail_msg: "Expected resource after gathered. got: {{ gathered.gathered }}"
+
+...
diff --git a/extensions/molecule/service/inventory.yml b/extensions/molecule/service_clusters/inventory.yml
similarity index 100%
rename from extensions/molecule/service/inventory.yml
rename to extensions/molecule/service_clusters/inventory.yml
diff --git a/extensions/molecule/service_clusters/merged/cleanup.yml b/extensions/molecule/service_clusters/merged/cleanup.yml
new file mode 100644
index 00000000..b2f38352
--- /dev/null
+++ b/extensions/molecule/service_clusters/merged/cleanup.yml
@@ -0,0 +1,19 @@
+---
+- name: "Cleanup — service_clusters (merged)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove int-cluster-alpha (test teardown)
+      ansible.platform.service_clusters:
+        config:
+          - name: "int-cluster-alpha"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/service_clusters/merged/converge.yml b/extensions/molecule/service_clusters/merged/converge.yml
new file mode 100644
index 00000000..a21df754
--- /dev/null
+++ b/extensions/molecule/service_clusters/merged/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — service_clusters (merged)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.service_clusters with state=merged
+      ansible.platform.service_clusters:
+        config:
+          - "{{ expected_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/service/merged/molecule.yml b/extensions/molecule/service_clusters/merged/molecule.yml
similarity index 100%
rename from extensions/molecule/service/merged/molecule.yml
rename to extensions/molecule/service_clusters/merged/molecule.yml
diff --git a/extensions/molecule/service_cluster/merged/vars.yml b/extensions/molecule/service_clusters/merged/vars.yml
similarity index 100%
rename from extensions/molecule/service_cluster/merged/vars.yml
rename to extensions/molecule/service_clusters/merged/vars.yml
diff --git a/extensions/molecule/service_clusters/merged/verify.yml b/extensions/molecule/service_clusters/merged/verify.yml
new file mode 100644
index 00000000..19f8db6a
--- /dev/null
+++ b/extensions/molecule/service_clusters/merged/verify.yml
@@ -0,0 +1,26 @@
+---
+- name: "Verify — service_clusters (merged)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather service_clusters (assert present after merged)
+      ansible.platform.service_clusters:
+        config:
+          - name: "{{ expected_config.name }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert configuration exists after merged
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length > 0
+        fail_msg: "Expected resource after merged. got: {{ gathered.gathered }}"
+
+...
diff --git a/extensions/molecule/service_clusters/overridden/cleanup.yml b/extensions/molecule/service_clusters/overridden/cleanup.yml
new file mode 100644
index 00000000..d6322f40
--- /dev/null
+++ b/extensions/molecule/service_clusters/overridden/cleanup.yml
@@ -0,0 +1,19 @@
+---
+- name: "Cleanup — service_clusters (overridden)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove int-cluster-alpha (test teardown)
+      ansible.platform.service_clusters:
+        config:
+          - name: "int-cluster-alpha"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/service_clusters/overridden/converge.yml b/extensions/molecule/service_clusters/overridden/converge.yml
new file mode 100644
index 00000000..21f8e3f3
--- /dev/null
+++ b/extensions/molecule/service_clusters/overridden/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — service_clusters (overridden)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.service_clusters with state=overridden
+      ansible.platform.service_clusters:
+        config:
+          - "{{ expected_config }}"
+        state: overridden
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/service/overridden/molecule.yml b/extensions/molecule/service_clusters/overridden/molecule.yml
similarity index 100%
rename from extensions/molecule/service/overridden/molecule.yml
rename to extensions/molecule/service_clusters/overridden/molecule.yml
diff --git a/extensions/molecule/service_clusters/overridden/prepare.yml b/extensions/molecule/service_clusters/overridden/prepare.yml
new file mode 100644
index 00000000..0436785b
--- /dev/null
+++ b/extensions/molecule/service_clusters/overridden/prepare.yml
@@ -0,0 +1,17 @@
+---
+- name: "Prepare — service_clusters (overridden)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed prerequisite resources via merged (r0 + r1 + extras for overridden)
+      ansible.platform.service_clusters:
+        config: "{{ prepare_configs }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/service_cluster/overridden/vars.yml b/extensions/molecule/service_clusters/overridden/vars.yml
similarity index 100%
rename from extensions/molecule/service_cluster/overridden/vars.yml
rename to extensions/molecule/service_clusters/overridden/vars.yml
diff --git a/extensions/molecule/service_clusters/overridden/verify.yml b/extensions/molecule/service_clusters/overridden/verify.yml
new file mode 100644
index 00000000..52fe7deb
--- /dev/null
+++ b/extensions/molecule/service_clusters/overridden/verify.yml
@@ -0,0 +1,31 @@
+---
+- name: "Verify — service_clusters (overridden)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather all service_clusters resources (verify overridden final state)
+      ansible.platform.service_clusters:
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered_all
+
+    - name: Assert int-cluster-alpha still exists after overridden
+      ansible.builtin.assert:
+        that:
+          - gathered_all.gathered is defined
+          - gathered_all.gathered | selectattr("name", "equalto", "int-cluster-alpha") | list | length == 1
+        fail_msg: "Expected int-cluster-alpha to exist after overridden. got: {{ gathered_all.gathered }}"
+
+    - name: Assert int-cluster-beta was deleted by overridden (not in desired config)
+      ansible.builtin.assert:
+        that:
+          - gathered_all.gathered is defined
+          - gathered_all.gathered | selectattr("name", "equalto", "int-cluster-beta") | list | length == 0
+        fail_msg: "overridden should have deleted int-cluster-beta. got: {{ gathered_all.gathered }}"
+
+...
diff --git a/extensions/molecule/service_clusters/replaced/cleanup.yml b/extensions/molecule/service_clusters/replaced/cleanup.yml
new file mode 100644
index 00000000..3bf7ffd7
--- /dev/null
+++ b/extensions/molecule/service_clusters/replaced/cleanup.yml
@@ -0,0 +1,19 @@
+---
+- name: "Cleanup — service_clusters (replaced)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove int-cluster-alpha (test teardown)
+      ansible.platform.service_clusters:
+        config:
+          - name: "int-cluster-alpha"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/service_clusters/replaced/converge.yml b/extensions/molecule/service_clusters/replaced/converge.yml
new file mode 100644
index 00000000..19850b5e
--- /dev/null
+++ b/extensions/molecule/service_clusters/replaced/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — service_clusters (replaced)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.service_clusters with state=replaced
+      ansible.platform.service_clusters:
+        config:
+          - "{{ expected_config }}"
+        state: replaced
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/service/replaced/molecule.yml b/extensions/molecule/service_clusters/replaced/molecule.yml
similarity index 100%
rename from extensions/molecule/service/replaced/molecule.yml
rename to extensions/molecule/service_clusters/replaced/molecule.yml
diff --git a/extensions/molecule/service_clusters/replaced/prepare.yml b/extensions/molecule/service_clusters/replaced/prepare.yml
new file mode 100644
index 00000000..ebbad5b4
--- /dev/null
+++ b/extensions/molecule/service_clusters/replaced/prepare.yml
@@ -0,0 +1,18 @@
+---
+- name: "Prepare — service_clusters (replaced)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed service_clusters to be replaced (prerequisite for replaced)
+      ansible.platform.service_clusters:
+        config:
+          - "{{ prepare_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/service_cluster/replaced/vars.yml b/extensions/molecule/service_clusters/replaced/vars.yml
similarity index 100%
rename from extensions/molecule/service_cluster/replaced/vars.yml
rename to extensions/molecule/service_clusters/replaced/vars.yml
diff --git a/extensions/molecule/service_clusters/replaced/verify.yml b/extensions/molecule/service_clusters/replaced/verify.yml
new file mode 100644
index 00000000..3307f618
--- /dev/null
+++ b/extensions/molecule/service_clusters/replaced/verify.yml
@@ -0,0 +1,32 @@
+---
+- name: "Verify — service_clusters (replaced)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather service_clusters (assert present after replaced)
+      ansible.platform.service_clusters:
+        config:
+          - name: "{{ expected_config.name }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert configuration exists after replaced
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length > 0
+        fail_msg: "Expected resource after replaced. got: {{ gathered.gathered }}"
+
+    - name: Assert outlier_detection_enabled was updated by replaced
+      ansible.builtin.assert:
+        that:
+          - (gathered.gathered | first).outlier_detection_enabled == expected_config.outlier_detection_enabled
+        fail_msg: "replaced should have set outlier_detection_enabled=False. got: {{ (gathered.gathered | first).outlier_detection_enabled }}"
+
+...
diff --git a/extensions/molecule/service_key/check/cleanup.yml b/extensions/molecule/service_key/check/cleanup.yml
deleted file mode 100644
index 78cc2d5c..00000000
--- a/extensions/molecule/service_key/check/cleanup.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Cleanup — service_key (check)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove int-skey-alpha (test teardown)
-      ansible.platform.service_key:
-        config:
-          - name: "int-skey-alpha"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/service_key/check/converge.yml b/extensions/molecule/service_key/check/converge.yml
deleted file mode 100644
index 458678be..00000000
--- a/extensions/molecule/service_key/check/converge.yml
+++ /dev/null
@@ -1,36 +0,0 @@
----
-- name: "Converge — service_key (check)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.service_key with state=merged
-      ansible.platform.service_key:
-        config:
-          - "{{ expected_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      check_mode: true
-      diff: true
-      register: result
-
-    - name: Assert check mode predicted a change
-      ansible.builtin.assert:
-        that:
-          - result.changed == true
-          - result.before is defined
-          - result.after is defined
-        fail_msg: "check mode should predict a change. got={{ result }}"
-
-    - name: Assert diff output is present
-      ansible.builtin.assert:
-        that:
-          - result.diff is defined
-        fail_msg: "diff output missing from check result"
-      when: result.diff is defined
-
-...
diff --git a/extensions/molecule/service_key/check/prepare.yml b/extensions/molecule/service_key/check/prepare.yml
deleted file mode 100644
index fd19bb5a..00000000
--- a/extensions/molecule/service_key/check/prepare.yml
+++ /dev/null
@@ -1,18 +0,0 @@
----
-- name: "Prepare — service_key (check)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed service_key as check-mode baseline (prerequisite for check)
-      ansible.platform.service_key:
-        config:
-          - "{{ prepare_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/service_key/check/verify.yml b/extensions/molecule/service_key/check/verify.yml
deleted file mode 100644
index 0db240bb..00000000
--- a/extensions/molecule/service_key/check/verify.yml
+++ /dev/null
@@ -1,27 +0,0 @@
----
-- name: "Verify — service_key (check)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather service_key (check mode must not have applied changes)
-      ansible.platform.service_key:
-        config:
-          - name: "{{ expected_config.name }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert int-skey-alpha still has prepare_config values (check did not apply)
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length > 0
-          - (gathered.gathered | first).is_active == prepare_config.is_active
-        fail_msg: "check mode should not alter resource. got: {{ gathered.gathered }}"
-
-...
diff --git a/extensions/molecule/service_key/deleted/cleanup.yml b/extensions/molecule/service_key/deleted/cleanup.yml
deleted file mode 100644
index 5d6ec6cf..00000000
--- a/extensions/molecule/service_key/deleted/cleanup.yml
+++ /dev/null
@@ -1,12 +0,0 @@
----
-- name: "Cleanup — service_key (deleted)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: No-op — int-skey-alpha already deleted by converge
-      ansible.builtin.debug:
-        msg: "int-skey-alpha was deleted in converge — nothing to clean up"
-
-...
diff --git a/extensions/molecule/service_key/deleted/converge.yml b/extensions/molecule/service_key/deleted/converge.yml
deleted file mode 100644
index b4ce005e..00000000
--- a/extensions/molecule/service_key/deleted/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — service_key (deleted)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.service_key with state=deleted
-      ansible.platform.service_key:
-        config:
-          - "{{ expected_config }}"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/service_key/deleted/prepare.yml b/extensions/molecule/service_key/deleted/prepare.yml
deleted file mode 100644
index 1251ec80..00000000
--- a/extensions/molecule/service_key/deleted/prepare.yml
+++ /dev/null
@@ -1,18 +0,0 @@
----
-- name: "Prepare — service_key (deleted)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed service_key to be deleted (prerequisite for deleted)
-      ansible.platform.service_key:
-        config:
-          - "{{ prepare_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/service_key/deleted/verify.yml b/extensions/molecule/service_key/deleted/verify.yml
deleted file mode 100644
index 5dfd8dd9..00000000
--- a/extensions/molecule/service_key/deleted/verify.yml
+++ /dev/null
@@ -1,26 +0,0 @@
----
-- name: "Verify — service_key (deleted)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather service_key (should be absent after deleted)
-      ansible.platform.service_key:
-        config:
-          - name: "int-skey-alpha"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert int-skey-alpha no longer exists (deleted)
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length == 0
-        fail_msg: "Expected empty after deleted, got: {{ gathered.gathered }}"
-
-...
diff --git a/extensions/molecule/service_key/gathered/cleanup.yml b/extensions/molecule/service_key/gathered/cleanup.yml
deleted file mode 100644
index a87c7be1..00000000
--- a/extensions/molecule/service_key/gathered/cleanup.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Cleanup — service_key (gathered)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove int-skey-alpha (test teardown)
-      ansible.platform.service_key:
-        config:
-          - name: "int-skey-alpha"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/service_key/gathered/converge.yml b/extensions/molecule/service_key/gathered/converge.yml
deleted file mode 100644
index 1f7ac393..00000000
--- a/extensions/molecule/service_key/gathered/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — service_key (gathered)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.service_key with state=gathered
-      ansible.platform.service_key:
-        config:
-          - "{{ expected_config }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/service_key/gathered/prepare.yml b/extensions/molecule/service_key/gathered/prepare.yml
deleted file mode 100644
index 12322968..00000000
--- a/extensions/molecule/service_key/gathered/prepare.yml
+++ /dev/null
@@ -1,18 +0,0 @@
----
-- name: "Prepare — service_key (gathered)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed service_key to be gathered (prerequisite for gathered)
-      ansible.platform.service_key:
-        config:
-          - "{{ prepare_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/service_key/gathered/verify.yml b/extensions/molecule/service_key/gathered/verify.yml
deleted file mode 100644
index 7f9f0125..00000000
--- a/extensions/molecule/service_key/gathered/verify.yml
+++ /dev/null
@@ -1,26 +0,0 @@
----
-- name: "Verify — service_key (gathered)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather service_key (assert present after gathered)
-      ansible.platform.service_key:
-        config:
-          - name: "{{ expected_config.name }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert configuration exists after gathered
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length > 0
-        fail_msg: "Expected resource after gathered. got: {{ gathered.gathered }}"
-
-...
diff --git a/extensions/molecule/service_key/merged/cleanup.yml b/extensions/molecule/service_key/merged/cleanup.yml
deleted file mode 100644
index 76e85164..00000000
--- a/extensions/molecule/service_key/merged/cleanup.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Cleanup — service_key (merged)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove int-skey-alpha (test teardown)
-      ansible.platform.service_key:
-        config:
-          - name: "int-skey-alpha"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/service_key/merged/converge.yml b/extensions/molecule/service_key/merged/converge.yml
deleted file mode 100644
index 082a4ecc..00000000
--- a/extensions/molecule/service_key/merged/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — service_key (merged)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.service_key with state=merged
-      ansible.platform.service_key:
-        config:
-          - "{{ expected_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/service_key/merged/verify.yml b/extensions/molecule/service_key/merged/verify.yml
deleted file mode 100644
index b271ad97..00000000
--- a/extensions/molecule/service_key/merged/verify.yml
+++ /dev/null
@@ -1,26 +0,0 @@
----
-- name: "Verify — service_key (merged)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather service_key (assert present after merged)
-      ansible.platform.service_key:
-        config:
-          - name: "{{ expected_config.name }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert configuration exists after merged
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length > 0
-        fail_msg: "Expected resource after merged. got: {{ gathered.gathered }}"
-
-...
diff --git a/extensions/molecule/service_key/overridden/cleanup.yml b/extensions/molecule/service_key/overridden/cleanup.yml
deleted file mode 100644
index dafc0c7e..00000000
--- a/extensions/molecule/service_key/overridden/cleanup.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Cleanup — service_key (overridden)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove int-skey-alpha (test teardown)
-      ansible.platform.service_key:
-        config:
-          - name: "int-skey-alpha"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/service_key/overridden/converge.yml b/extensions/molecule/service_key/overridden/converge.yml
deleted file mode 100644
index 14fd9797..00000000
--- a/extensions/molecule/service_key/overridden/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — service_key (overridden)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.service_key with state=overridden
-      ansible.platform.service_key:
-        config:
-          - "{{ expected_config }}"
-        state: overridden
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/service_key/overridden/prepare.yml b/extensions/molecule/service_key/overridden/prepare.yml
deleted file mode 100644
index 345783b0..00000000
--- a/extensions/molecule/service_key/overridden/prepare.yml
+++ /dev/null
@@ -1,17 +0,0 @@
----
-- name: "Prepare — service_key (overridden)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed prerequisite resources via merged (r0 + r1 + extras for overridden)
-      ansible.platform.service_key:
-        config: "{{ prepare_configs }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/service_key/overridden/verify.yml b/extensions/molecule/service_key/overridden/verify.yml
deleted file mode 100644
index 66439bc4..00000000
--- a/extensions/molecule/service_key/overridden/verify.yml
+++ /dev/null
@@ -1,31 +0,0 @@
----
-- name: "Verify — service_key (overridden)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather all service_key resources (verify overridden final state)
-      ansible.platform.service_key:
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered_all
-
-    - name: Assert int-skey-alpha still exists after overridden
-      ansible.builtin.assert:
-        that:
-          - gathered_all.gathered is defined
-          - gathered_all.gathered | selectattr("name", "equalto", "int-skey-alpha") | list | length == 1
-        fail_msg: "Expected int-skey-alpha to exist after overridden. got: {{ gathered_all.gathered }}"
-
-    - name: Assert int-skey-beta was deleted by overridden (not in desired config)
-      ansible.builtin.assert:
-        that:
-          - gathered_all.gathered is defined
-          - gathered_all.gathered | selectattr("name", "equalto", "int-skey-beta") | list | length == 0
-        fail_msg: "overridden should have deleted int-skey-beta. got: {{ gathered_all.gathered }}"
-
-...
diff --git a/extensions/molecule/service_key/replaced/cleanup.yml b/extensions/molecule/service_key/replaced/cleanup.yml
deleted file mode 100644
index b15d6e1f..00000000
--- a/extensions/molecule/service_key/replaced/cleanup.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Cleanup — service_key (replaced)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove int-skey-alpha (test teardown)
-      ansible.platform.service_key:
-        config:
-          - name: "int-skey-alpha"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/service_key/replaced/converge.yml b/extensions/molecule/service_key/replaced/converge.yml
deleted file mode 100644
index bda45ec4..00000000
--- a/extensions/molecule/service_key/replaced/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — service_key (replaced)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.service_key with state=replaced
-      ansible.platform.service_key:
-        config:
-          - "{{ expected_config }}"
-        state: replaced
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/service_key/replaced/prepare.yml b/extensions/molecule/service_key/replaced/prepare.yml
deleted file mode 100644
index 00e64d4e..00000000
--- a/extensions/molecule/service_key/replaced/prepare.yml
+++ /dev/null
@@ -1,18 +0,0 @@
----
-- name: "Prepare — service_key (replaced)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed service_key to be replaced (prerequisite for replaced)
-      ansible.platform.service_key:
-        config:
-          - "{{ prepare_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/service_key/replaced/verify.yml b/extensions/molecule/service_key/replaced/verify.yml
deleted file mode 100644
index c95cd0e5..00000000
--- a/extensions/molecule/service_key/replaced/verify.yml
+++ /dev/null
@@ -1,32 +0,0 @@
----
-- name: "Verify — service_key (replaced)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather service_key (assert present after replaced)
-      ansible.platform.service_key:
-        config:
-          - name: "{{ expected_config.name }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert configuration exists after replaced
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length > 0
-        fail_msg: "Expected resource after replaced. got: {{ gathered.gathered }}"
-
-    - name: Assert is_active was updated by replaced
-      ansible.builtin.assert:
-        that:
-          - (gathered.gathered | first).is_active == expected_config.is_active
-        fail_msg: "replaced should have set is_active=True. got: {{ (gathered.gathered | first).is_active }}"
-
-...
diff --git a/extensions/molecule/service_keys/check/cleanup.yml b/extensions/molecule/service_keys/check/cleanup.yml
new file mode 100644
index 00000000..608ee26c
--- /dev/null
+++ b/extensions/molecule/service_keys/check/cleanup.yml
@@ -0,0 +1,19 @@
+---
+- name: "Cleanup — service_keys (check)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove int-skey-alpha (test teardown)
+      ansible.platform.service_keys:
+        config:
+          - name: "int-skey-alpha"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/service_keys/check/converge.yml b/extensions/molecule/service_keys/check/converge.yml
new file mode 100644
index 00000000..e1a13638
--- /dev/null
+++ b/extensions/molecule/service_keys/check/converge.yml
@@ -0,0 +1,36 @@
+---
+- name: "Converge — service_keys (check)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.service_keys with state=merged
+      ansible.platform.service_keys:
+        config:
+          - "{{ expected_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      check_mode: true
+      diff: true
+      register: result
+
+    - name: Assert check mode predicted a change
+      ansible.builtin.assert:
+        that:
+          - result.changed == true
+          - result.before is defined
+          - result.after is defined
+        fail_msg: "check mode should predict a change. got={{ result }}"
+
+    - name: Assert diff output is present
+      ansible.builtin.assert:
+        that:
+          - result.diff is defined
+        fail_msg: "diff output missing from check result"
+      when: result.diff is defined
+
+...
diff --git a/extensions/molecule/service_cluster/check/molecule.yml b/extensions/molecule/service_keys/check/molecule.yml
similarity index 100%
rename from extensions/molecule/service_cluster/check/molecule.yml
rename to extensions/molecule/service_keys/check/molecule.yml
diff --git a/extensions/molecule/service_keys/check/prepare.yml b/extensions/molecule/service_keys/check/prepare.yml
new file mode 100644
index 00000000..96a8e88d
--- /dev/null
+++ b/extensions/molecule/service_keys/check/prepare.yml
@@ -0,0 +1,18 @@
+---
+- name: "Prepare — service_keys (check)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed service_keys as check-mode baseline (prerequisite for check)
+      ansible.platform.service_keys:
+        config:
+          - "{{ prepare_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/service_key/check/vars.yml b/extensions/molecule/service_keys/check/vars.yml
similarity index 100%
rename from extensions/molecule/service_key/check/vars.yml
rename to extensions/molecule/service_keys/check/vars.yml
diff --git a/extensions/molecule/service_keys/check/verify.yml b/extensions/molecule/service_keys/check/verify.yml
new file mode 100644
index 00000000..9d5ae239
--- /dev/null
+++ b/extensions/molecule/service_keys/check/verify.yml
@@ -0,0 +1,27 @@
+---
+- name: "Verify — service_keys (check)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather service_keys (check mode must not have applied changes)
+      ansible.platform.service_keys:
+        config:
+          - name: "{{ expected_config.name }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert int-skey-alpha still has prepare_config values (check did not apply)
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length > 0
+          - (gathered.gathered | first).is_active == prepare_config.is_active
+        fail_msg: "check mode should not alter resource. got: {{ gathered.gathered }}"
+
+...
diff --git a/extensions/molecule/service_keys/deleted/cleanup.yml b/extensions/molecule/service_keys/deleted/cleanup.yml
new file mode 100644
index 00000000..11948ae1
--- /dev/null
+++ b/extensions/molecule/service_keys/deleted/cleanup.yml
@@ -0,0 +1,12 @@
+---
+- name: "Cleanup — service_keys (deleted)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: No-op — int-skey-alpha already deleted by converge
+      ansible.builtin.debug:
+        msg: "int-skey-alpha was deleted in converge — nothing to clean up"
+
+...
diff --git a/extensions/molecule/service_keys/deleted/converge.yml b/extensions/molecule/service_keys/deleted/converge.yml
new file mode 100644
index 00000000..44968a79
--- /dev/null
+++ b/extensions/molecule/service_keys/deleted/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — service_keys (deleted)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.service_keys with state=deleted
+      ansible.platform.service_keys:
+        config:
+          - "{{ expected_config }}"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/service_cluster/deleted/molecule.yml b/extensions/molecule/service_keys/deleted/molecule.yml
similarity index 100%
rename from extensions/molecule/service_cluster/deleted/molecule.yml
rename to extensions/molecule/service_keys/deleted/molecule.yml
diff --git a/extensions/molecule/service_keys/deleted/prepare.yml b/extensions/molecule/service_keys/deleted/prepare.yml
new file mode 100644
index 00000000..a8da72e2
--- /dev/null
+++ b/extensions/molecule/service_keys/deleted/prepare.yml
@@ -0,0 +1,18 @@
+---
+- name: "Prepare — service_keys (deleted)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed service_keys to be deleted (prerequisite for deleted)
+      ansible.platform.service_keys:
+        config:
+          - "{{ prepare_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/service_key/deleted/vars.yml b/extensions/molecule/service_keys/deleted/vars.yml
similarity index 100%
rename from extensions/molecule/service_key/deleted/vars.yml
rename to extensions/molecule/service_keys/deleted/vars.yml
diff --git a/extensions/molecule/service_keys/deleted/verify.yml b/extensions/molecule/service_keys/deleted/verify.yml
new file mode 100644
index 00000000..c231a453
--- /dev/null
+++ b/extensions/molecule/service_keys/deleted/verify.yml
@@ -0,0 +1,26 @@
+---
+- name: "Verify — service_keys (deleted)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather service_keys (should be absent after deleted)
+      ansible.platform.service_keys:
+        config:
+          - name: "int-skey-alpha"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert int-skey-alpha no longer exists (deleted)
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length == 0
+        fail_msg: "Expected empty after deleted, got: {{ gathered.gathered }}"
+
+...
diff --git a/extensions/molecule/service_keys/gathered/cleanup.yml b/extensions/molecule/service_keys/gathered/cleanup.yml
new file mode 100644
index 00000000..e4eaab8a
--- /dev/null
+++ b/extensions/molecule/service_keys/gathered/cleanup.yml
@@ -0,0 +1,19 @@
+---
+- name: "Cleanup — service_keys (gathered)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove int-skey-alpha (test teardown)
+      ansible.platform.service_keys:
+        config:
+          - name: "int-skey-alpha"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/service_keys/gathered/converge.yml b/extensions/molecule/service_keys/gathered/converge.yml
new file mode 100644
index 00000000..079379b6
--- /dev/null
+++ b/extensions/molecule/service_keys/gathered/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — service_keys (gathered)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.service_keys with state=gathered
+      ansible.platform.service_keys:
+        config:
+          - "{{ expected_config }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/service_cluster/gathered/molecule.yml b/extensions/molecule/service_keys/gathered/molecule.yml
similarity index 100%
rename from extensions/molecule/service_cluster/gathered/molecule.yml
rename to extensions/molecule/service_keys/gathered/molecule.yml
diff --git a/extensions/molecule/service_keys/gathered/prepare.yml b/extensions/molecule/service_keys/gathered/prepare.yml
new file mode 100644
index 00000000..7ad98077
--- /dev/null
+++ b/extensions/molecule/service_keys/gathered/prepare.yml
@@ -0,0 +1,18 @@
+---
+- name: "Prepare — service_keys (gathered)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed service_keys to be gathered (prerequisite for gathered)
+      ansible.platform.service_keys:
+        config:
+          - "{{ prepare_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/service_key/gathered/vars.yml b/extensions/molecule/service_keys/gathered/vars.yml
similarity index 100%
rename from extensions/molecule/service_key/gathered/vars.yml
rename to extensions/molecule/service_keys/gathered/vars.yml
diff --git a/extensions/molecule/service_keys/gathered/verify.yml b/extensions/molecule/service_keys/gathered/verify.yml
new file mode 100644
index 00000000..27fe0e3e
--- /dev/null
+++ b/extensions/molecule/service_keys/gathered/verify.yml
@@ -0,0 +1,26 @@
+---
+- name: "Verify — service_keys (gathered)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather service_keys (assert present after gathered)
+      ansible.platform.service_keys:
+        config:
+          - name: "{{ expected_config.name }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert configuration exists after gathered
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length > 0
+        fail_msg: "Expected resource after gathered. got: {{ gathered.gathered }}"
+
+...
diff --git a/extensions/molecule/service_cluster/inventory.yml b/extensions/molecule/service_keys/inventory.yml
similarity index 100%
rename from extensions/molecule/service_cluster/inventory.yml
rename to extensions/molecule/service_keys/inventory.yml
diff --git a/extensions/molecule/service_keys/merged/cleanup.yml b/extensions/molecule/service_keys/merged/cleanup.yml
new file mode 100644
index 00000000..05ecebbb
--- /dev/null
+++ b/extensions/molecule/service_keys/merged/cleanup.yml
@@ -0,0 +1,19 @@
+---
+- name: "Cleanup — service_keys (merged)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove int-skey-alpha (test teardown)
+      ansible.platform.service_keys:
+        config:
+          - name: "int-skey-alpha"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/service_keys/merged/converge.yml b/extensions/molecule/service_keys/merged/converge.yml
new file mode 100644
index 00000000..74523c23
--- /dev/null
+++ b/extensions/molecule/service_keys/merged/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — service_keys (merged)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.service_keys with state=merged
+      ansible.platform.service_keys:
+        config:
+          - "{{ expected_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/service_cluster/merged/molecule.yml b/extensions/molecule/service_keys/merged/molecule.yml
similarity index 100%
rename from extensions/molecule/service_cluster/merged/molecule.yml
rename to extensions/molecule/service_keys/merged/molecule.yml
diff --git a/extensions/molecule/service_key/merged/vars.yml b/extensions/molecule/service_keys/merged/vars.yml
similarity index 100%
rename from extensions/molecule/service_key/merged/vars.yml
rename to extensions/molecule/service_keys/merged/vars.yml
diff --git a/extensions/molecule/service_keys/merged/verify.yml b/extensions/molecule/service_keys/merged/verify.yml
new file mode 100644
index 00000000..e81964fe
--- /dev/null
+++ b/extensions/molecule/service_keys/merged/verify.yml
@@ -0,0 +1,26 @@
+---
+- name: "Verify — service_keys (merged)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather service_keys (assert present after merged)
+      ansible.platform.service_keys:
+        config:
+          - name: "{{ expected_config.name }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert configuration exists after merged
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length > 0
+        fail_msg: "Expected resource after merged. got: {{ gathered.gathered }}"
+
+...
diff --git a/extensions/molecule/service_keys/overridden/cleanup.yml b/extensions/molecule/service_keys/overridden/cleanup.yml
new file mode 100644
index 00000000..b4083e3f
--- /dev/null
+++ b/extensions/molecule/service_keys/overridden/cleanup.yml
@@ -0,0 +1,19 @@
+---
+- name: "Cleanup — service_keys (overridden)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove int-skey-alpha (test teardown)
+      ansible.platform.service_keys:
+        config:
+          - name: "int-skey-alpha"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/service_keys/overridden/converge.yml b/extensions/molecule/service_keys/overridden/converge.yml
new file mode 100644
index 00000000..7c31640c
--- /dev/null
+++ b/extensions/molecule/service_keys/overridden/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — service_keys (overridden)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.service_keys with state=overridden
+      ansible.platform.service_keys:
+        config:
+          - "{{ expected_config }}"
+        state: overridden
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/service_cluster/overridden/molecule.yml b/extensions/molecule/service_keys/overridden/molecule.yml
similarity index 100%
rename from extensions/molecule/service_cluster/overridden/molecule.yml
rename to extensions/molecule/service_keys/overridden/molecule.yml
diff --git a/extensions/molecule/service_keys/overridden/prepare.yml b/extensions/molecule/service_keys/overridden/prepare.yml
new file mode 100644
index 00000000..86c46ff6
--- /dev/null
+++ b/extensions/molecule/service_keys/overridden/prepare.yml
@@ -0,0 +1,17 @@
+---
+- name: "Prepare — service_keys (overridden)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed prerequisite resources via merged (r0 + r1 + extras for overridden)
+      ansible.platform.service_keys:
+        config: "{{ prepare_configs }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/service_key/overridden/vars.yml b/extensions/molecule/service_keys/overridden/vars.yml
similarity index 100%
rename from extensions/molecule/service_key/overridden/vars.yml
rename to extensions/molecule/service_keys/overridden/vars.yml
diff --git a/extensions/molecule/service_keys/overridden/verify.yml b/extensions/molecule/service_keys/overridden/verify.yml
new file mode 100644
index 00000000..7b4a0576
--- /dev/null
+++ b/extensions/molecule/service_keys/overridden/verify.yml
@@ -0,0 +1,31 @@
+---
+- name: "Verify — service_keys (overridden)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather all service_keys resources (verify overridden final state)
+      ansible.platform.service_keys:
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered_all
+
+    - name: Assert int-skey-alpha still exists after overridden
+      ansible.builtin.assert:
+        that:
+          - gathered_all.gathered is defined
+          - gathered_all.gathered | selectattr("name", "equalto", "int-skey-alpha") | list | length == 1
+        fail_msg: "Expected int-skey-alpha to exist after overridden. got: {{ gathered_all.gathered }}"
+
+    - name: Assert int-skey-beta was deleted by overridden (not in desired config)
+      ansible.builtin.assert:
+        that:
+          - gathered_all.gathered is defined
+          - gathered_all.gathered | selectattr("name", "equalto", "int-skey-beta") | list | length == 0
+        fail_msg: "overridden should have deleted int-skey-beta. got: {{ gathered_all.gathered }}"
+
+...
diff --git a/extensions/molecule/service_keys/replaced/cleanup.yml b/extensions/molecule/service_keys/replaced/cleanup.yml
new file mode 100644
index 00000000..8b480891
--- /dev/null
+++ b/extensions/molecule/service_keys/replaced/cleanup.yml
@@ -0,0 +1,19 @@
+---
+- name: "Cleanup — service_keys (replaced)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove int-skey-alpha (test teardown)
+      ansible.platform.service_keys:
+        config:
+          - name: "int-skey-alpha"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/service_keys/replaced/converge.yml b/extensions/molecule/service_keys/replaced/converge.yml
new file mode 100644
index 00000000..72348c78
--- /dev/null
+++ b/extensions/molecule/service_keys/replaced/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — service_keys (replaced)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.service_keys with state=replaced
+      ansible.platform.service_keys:
+        config:
+          - "{{ expected_config }}"
+        state: replaced
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/service_cluster/replaced/molecule.yml b/extensions/molecule/service_keys/replaced/molecule.yml
similarity index 100%
rename from extensions/molecule/service_cluster/replaced/molecule.yml
rename to extensions/molecule/service_keys/replaced/molecule.yml
diff --git a/extensions/molecule/service_keys/replaced/prepare.yml b/extensions/molecule/service_keys/replaced/prepare.yml
new file mode 100644
index 00000000..895715b4
--- /dev/null
+++ b/extensions/molecule/service_keys/replaced/prepare.yml
@@ -0,0 +1,18 @@
+---
+- name: "Prepare — service_keys (replaced)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed service_keys to be replaced (prerequisite for replaced)
+      ansible.platform.service_keys:
+        config:
+          - "{{ prepare_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/service_key/replaced/vars.yml b/extensions/molecule/service_keys/replaced/vars.yml
similarity index 100%
rename from extensions/molecule/service_key/replaced/vars.yml
rename to extensions/molecule/service_keys/replaced/vars.yml
diff --git a/extensions/molecule/service_keys/replaced/verify.yml b/extensions/molecule/service_keys/replaced/verify.yml
new file mode 100644
index 00000000..48fdf77f
--- /dev/null
+++ b/extensions/molecule/service_keys/replaced/verify.yml
@@ -0,0 +1,32 @@
+---
+- name: "Verify — service_keys (replaced)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather service_keys (assert present after replaced)
+      ansible.platform.service_keys:
+        config:
+          - name: "{{ expected_config.name }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert configuration exists after replaced
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length > 0
+        fail_msg: "Expected resource after replaced. got: {{ gathered.gathered }}"
+
+    - name: Assert is_active was updated by replaced
+      ansible.builtin.assert:
+        that:
+          - (gathered.gathered | first).is_active == expected_config.is_active
+        fail_msg: "replaced should have set is_active=True. got: {{ (gathered.gathered | first).is_active }}"
+
+...
diff --git a/extensions/molecule/service_node/check/cleanup.yml b/extensions/molecule/service_node/check/cleanup.yml
deleted file mode 100644
index 55203bd0..00000000
--- a/extensions/molecule/service_node/check/cleanup.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Cleanup — service_node (check)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove int-snode-alpha (test teardown)
-      ansible.platform.service_node:
-        config:
-          - name: "int-snode-alpha"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/service_node/check/converge.yml b/extensions/molecule/service_node/check/converge.yml
deleted file mode 100644
index 0c37ae7e..00000000
--- a/extensions/molecule/service_node/check/converge.yml
+++ /dev/null
@@ -1,36 +0,0 @@
----
-- name: "Converge — service_node (check)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.service_node with state=merged
-      ansible.platform.service_node:
-        config:
-          - "{{ expected_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      check_mode: true
-      diff: true
-      register: result
-
-    - name: Assert check mode predicted a change
-      ansible.builtin.assert:
-        that:
-          - result.changed == true
-          - result.before is defined
-          - result.after is defined
-        fail_msg: "check mode should predict a change. got={{ result }}"
-
-    - name: Assert diff output is present
-      ansible.builtin.assert:
-        that:
-          - result.diff is defined
-        fail_msg: "diff output missing from check result"
-      when: result.diff is defined
-
-...
diff --git a/extensions/molecule/service_node/check/prepare.yml b/extensions/molecule/service_node/check/prepare.yml
deleted file mode 100644
index 9c66a145..00000000
--- a/extensions/molecule/service_node/check/prepare.yml
+++ /dev/null
@@ -1,18 +0,0 @@
----
-- name: "Prepare — service_node (check)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed service_node as check-mode baseline (prerequisite for check)
-      ansible.platform.service_node:
-        config:
-          - "{{ prepare_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/service_node/check/verify.yml b/extensions/molecule/service_node/check/verify.yml
deleted file mode 100644
index a5354d02..00000000
--- a/extensions/molecule/service_node/check/verify.yml
+++ /dev/null
@@ -1,27 +0,0 @@
----
-- name: "Verify — service_node (check)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather service_node (check mode must not have applied changes)
-      ansible.platform.service_node:
-        config:
-          - name: "{{ expected_config.name }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert int-snode-alpha still has prepare_config values (check did not apply)
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length > 0
-          - (gathered.gathered | first).address == prepare_config.address
-        fail_msg: "check mode should not alter resource. got: {{ gathered.gathered }}"
-
-...
diff --git a/extensions/molecule/service_node/deleted/cleanup.yml b/extensions/molecule/service_node/deleted/cleanup.yml
deleted file mode 100644
index 9941068e..00000000
--- a/extensions/molecule/service_node/deleted/cleanup.yml
+++ /dev/null
@@ -1,12 +0,0 @@
----
-- name: "Cleanup — service_node (deleted)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: No-op — int-snode-alpha already deleted by converge
-      ansible.builtin.debug:
-        msg: "int-snode-alpha was deleted in converge — nothing to clean up"
-
-...
diff --git a/extensions/molecule/service_node/deleted/converge.yml b/extensions/molecule/service_node/deleted/converge.yml
deleted file mode 100644
index 8591fd68..00000000
--- a/extensions/molecule/service_node/deleted/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — service_node (deleted)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.service_node with state=deleted
-      ansible.platform.service_node:
-        config:
-          - "{{ expected_config }}"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/service_node/deleted/prepare.yml b/extensions/molecule/service_node/deleted/prepare.yml
deleted file mode 100644
index 33aa48ff..00000000
--- a/extensions/molecule/service_node/deleted/prepare.yml
+++ /dev/null
@@ -1,18 +0,0 @@
----
-- name: "Prepare — service_node (deleted)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed service_node to be deleted (prerequisite for deleted)
-      ansible.platform.service_node:
-        config:
-          - "{{ prepare_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/service_node/deleted/verify.yml b/extensions/molecule/service_node/deleted/verify.yml
deleted file mode 100644
index 0b6e652d..00000000
--- a/extensions/molecule/service_node/deleted/verify.yml
+++ /dev/null
@@ -1,26 +0,0 @@
----
-- name: "Verify — service_node (deleted)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather service_node (should be absent after deleted)
-      ansible.platform.service_node:
-        config:
-          - name: "int-snode-alpha"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert int-snode-alpha no longer exists (deleted)
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length == 0
-        fail_msg: "Expected empty after deleted, got: {{ gathered.gathered }}"
-
-...
diff --git a/extensions/molecule/service_node/gathered/cleanup.yml b/extensions/molecule/service_node/gathered/cleanup.yml
deleted file mode 100644
index 0814e372..00000000
--- a/extensions/molecule/service_node/gathered/cleanup.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Cleanup — service_node (gathered)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove int-snode-alpha (test teardown)
-      ansible.platform.service_node:
-        config:
-          - name: "int-snode-alpha"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/service_node/gathered/converge.yml b/extensions/molecule/service_node/gathered/converge.yml
deleted file mode 100644
index 694b0feb..00000000
--- a/extensions/molecule/service_node/gathered/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — service_node (gathered)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.service_node with state=gathered
-      ansible.platform.service_node:
-        config:
-          - "{{ expected_config }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/service_node/gathered/prepare.yml b/extensions/molecule/service_node/gathered/prepare.yml
deleted file mode 100644
index d24d2576..00000000
--- a/extensions/molecule/service_node/gathered/prepare.yml
+++ /dev/null
@@ -1,18 +0,0 @@
----
-- name: "Prepare — service_node (gathered)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed service_node to be gathered (prerequisite for gathered)
-      ansible.platform.service_node:
-        config:
-          - "{{ prepare_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/service_node/gathered/verify.yml b/extensions/molecule/service_node/gathered/verify.yml
deleted file mode 100644
index ca0b3e38..00000000
--- a/extensions/molecule/service_node/gathered/verify.yml
+++ /dev/null
@@ -1,26 +0,0 @@
----
-- name: "Verify — service_node (gathered)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather service_node (assert present after gathered)
-      ansible.platform.service_node:
-        config:
-          - name: "{{ expected_config.name }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert configuration exists after gathered
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length > 0
-        fail_msg: "Expected resource after gathered. got: {{ gathered.gathered }}"
-
-...
diff --git a/extensions/molecule/service_node/merged/cleanup.yml b/extensions/molecule/service_node/merged/cleanup.yml
deleted file mode 100644
index ca0712a2..00000000
--- a/extensions/molecule/service_node/merged/cleanup.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Cleanup — service_node (merged)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove int-snode-alpha (test teardown)
-      ansible.platform.service_node:
-        config:
-          - name: "int-snode-alpha"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/service_node/merged/converge.yml b/extensions/molecule/service_node/merged/converge.yml
deleted file mode 100644
index dfda94be..00000000
--- a/extensions/molecule/service_node/merged/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — service_node (merged)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.service_node with state=merged
-      ansible.platform.service_node:
-        config:
-          - "{{ expected_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/service_node/merged/verify.yml b/extensions/molecule/service_node/merged/verify.yml
deleted file mode 100644
index 2a6d785b..00000000
--- a/extensions/molecule/service_node/merged/verify.yml
+++ /dev/null
@@ -1,26 +0,0 @@
----
-- name: "Verify — service_node (merged)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather service_node (assert present after merged)
-      ansible.platform.service_node:
-        config:
-          - name: "{{ expected_config.name }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert configuration exists after merged
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length > 0
-        fail_msg: "Expected resource after merged. got: {{ gathered.gathered }}"
-
-...
diff --git a/extensions/molecule/service_node/overridden/cleanup.yml b/extensions/molecule/service_node/overridden/cleanup.yml
deleted file mode 100644
index 61ae8ced..00000000
--- a/extensions/molecule/service_node/overridden/cleanup.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Cleanup — service_node (overridden)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove int-snode-alpha (test teardown)
-      ansible.platform.service_node:
-        config:
-          - name: "int-snode-alpha"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/service_node/overridden/converge.yml b/extensions/molecule/service_node/overridden/converge.yml
deleted file mode 100644
index 46010985..00000000
--- a/extensions/molecule/service_node/overridden/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — service_node (overridden)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.service_node with state=overridden
-      ansible.platform.service_node:
-        config:
-          - "{{ expected_config }}"
-        state: overridden
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/service_node/overridden/prepare.yml b/extensions/molecule/service_node/overridden/prepare.yml
deleted file mode 100644
index 16442200..00000000
--- a/extensions/molecule/service_node/overridden/prepare.yml
+++ /dev/null
@@ -1,17 +0,0 @@
----
-- name: "Prepare — service_node (overridden)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed prerequisite resources via merged (r0 + r1 + extras for overridden)
-      ansible.platform.service_node:
-        config: "{{ prepare_configs }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/service_node/overridden/verify.yml b/extensions/molecule/service_node/overridden/verify.yml
deleted file mode 100644
index 8ad20738..00000000
--- a/extensions/molecule/service_node/overridden/verify.yml
+++ /dev/null
@@ -1,31 +0,0 @@
----
-- name: "Verify — service_node (overridden)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather all service_node resources (verify overridden final state)
-      ansible.platform.service_node:
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered_all
-
-    - name: Assert int-snode-alpha still exists after overridden
-      ansible.builtin.assert:
-        that:
-          - gathered_all.gathered is defined
-          - gathered_all.gathered | selectattr("name", "equalto", "int-snode-alpha") | list | length == 1
-        fail_msg: "Expected int-snode-alpha to exist after overridden. got: {{ gathered_all.gathered }}"
-
-    - name: Assert int-snode-beta was deleted by overridden (not in desired config)
-      ansible.builtin.assert:
-        that:
-          - gathered_all.gathered is defined
-          - gathered_all.gathered | selectattr("name", "equalto", "int-snode-beta") | list | length == 0
-        fail_msg: "overridden should have deleted int-snode-beta. got: {{ gathered_all.gathered }}"
-
-...
diff --git a/extensions/molecule/service_node/replaced/cleanup.yml b/extensions/molecule/service_node/replaced/cleanup.yml
deleted file mode 100644
index eab89983..00000000
--- a/extensions/molecule/service_node/replaced/cleanup.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Cleanup — service_node (replaced)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove int-snode-alpha (test teardown)
-      ansible.platform.service_node:
-        config:
-          - name: "int-snode-alpha"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/service_node/replaced/converge.yml b/extensions/molecule/service_node/replaced/converge.yml
deleted file mode 100644
index a9e977d0..00000000
--- a/extensions/molecule/service_node/replaced/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — service_node (replaced)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.service_node with state=replaced
-      ansible.platform.service_node:
-        config:
-          - "{{ expected_config }}"
-        state: replaced
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/service_node/replaced/prepare.yml b/extensions/molecule/service_node/replaced/prepare.yml
deleted file mode 100644
index be2c5641..00000000
--- a/extensions/molecule/service_node/replaced/prepare.yml
+++ /dev/null
@@ -1,18 +0,0 @@
----
-- name: "Prepare — service_node (replaced)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed service_node to be replaced (prerequisite for replaced)
-      ansible.platform.service_node:
-        config:
-          - "{{ prepare_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/service_node/replaced/verify.yml b/extensions/molecule/service_node/replaced/verify.yml
deleted file mode 100644
index 115471bb..00000000
--- a/extensions/molecule/service_node/replaced/verify.yml
+++ /dev/null
@@ -1,32 +0,0 @@
----
-- name: "Verify — service_node (replaced)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather service_node (assert present after replaced)
-      ansible.platform.service_node:
-        config:
-          - name: "{{ expected_config.name }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert configuration exists after replaced
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length > 0
-        fail_msg: "Expected resource after replaced. got: {{ gathered.gathered }}"
-
-    - name: Assert address was updated by replaced
-      ansible.builtin.assert:
-        that:
-          - (gathered.gathered | first).address == expected_config.address
-        fail_msg: "replaced should have set address='10.0.0.1'. got: {{ (gathered.gathered | first).address }}"
-
-...
diff --git a/extensions/molecule/service_nodes/check/cleanup.yml b/extensions/molecule/service_nodes/check/cleanup.yml
new file mode 100644
index 00000000..14b8ff91
--- /dev/null
+++ b/extensions/molecule/service_nodes/check/cleanup.yml
@@ -0,0 +1,19 @@
+---
+- name: "Cleanup — service_nodes (check)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove int-snode-alpha (test teardown)
+      ansible.platform.service_nodes:
+        config:
+          - name: "int-snode-alpha"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/service_nodes/check/converge.yml b/extensions/molecule/service_nodes/check/converge.yml
new file mode 100644
index 00000000..c2c4f7a0
--- /dev/null
+++ b/extensions/molecule/service_nodes/check/converge.yml
@@ -0,0 +1,36 @@
+---
+- name: "Converge — service_nodes (check)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.service_nodes with state=merged
+      ansible.platform.service_nodes:
+        config:
+          - "{{ expected_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      check_mode: true
+      diff: true
+      register: result
+
+    - name: Assert check mode predicted a change
+      ansible.builtin.assert:
+        that:
+          - result.changed == true
+          - result.before is defined
+          - result.after is defined
+        fail_msg: "check mode should predict a change. got={{ result }}"
+
+    - name: Assert diff output is present
+      ansible.builtin.assert:
+        that:
+          - result.diff is defined
+        fail_msg: "diff output missing from check result"
+      when: result.diff is defined
+
+...
diff --git a/extensions/molecule/service_key/check/molecule.yml b/extensions/molecule/service_nodes/check/molecule.yml
similarity index 100%
rename from extensions/molecule/service_key/check/molecule.yml
rename to extensions/molecule/service_nodes/check/molecule.yml
diff --git a/extensions/molecule/service_nodes/check/prepare.yml b/extensions/molecule/service_nodes/check/prepare.yml
new file mode 100644
index 00000000..e3a10542
--- /dev/null
+++ b/extensions/molecule/service_nodes/check/prepare.yml
@@ -0,0 +1,18 @@
+---
+- name: "Prepare — service_nodes (check)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed service_nodes as check-mode baseline (prerequisite for check)
+      ansible.platform.service_nodes:
+        config:
+          - "{{ prepare_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/service_node/check/vars.yml b/extensions/molecule/service_nodes/check/vars.yml
similarity index 100%
rename from extensions/molecule/service_node/check/vars.yml
rename to extensions/molecule/service_nodes/check/vars.yml
diff --git a/extensions/molecule/service_nodes/check/verify.yml b/extensions/molecule/service_nodes/check/verify.yml
new file mode 100644
index 00000000..20fc42cf
--- /dev/null
+++ b/extensions/molecule/service_nodes/check/verify.yml
@@ -0,0 +1,27 @@
+---
+- name: "Verify — service_nodes (check)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather service_nodes (check mode must not have applied changes)
+      ansible.platform.service_nodes:
+        config:
+          - name: "{{ expected_config.name }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert int-snode-alpha still has prepare_config values (check did not apply)
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length > 0
+          - (gathered.gathered | first).address == prepare_config.address
+        fail_msg: "check mode should not alter resource. got: {{ gathered.gathered }}"
+
+...
diff --git a/extensions/molecule/service_nodes/deleted/cleanup.yml b/extensions/molecule/service_nodes/deleted/cleanup.yml
new file mode 100644
index 00000000..9898d01e
--- /dev/null
+++ b/extensions/molecule/service_nodes/deleted/cleanup.yml
@@ -0,0 +1,12 @@
+---
+- name: "Cleanup — service_nodes (deleted)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: No-op — int-snode-alpha already deleted by converge
+      ansible.builtin.debug:
+        msg: "int-snode-alpha was deleted in converge — nothing to clean up"
+
+...
diff --git a/extensions/molecule/service_nodes/deleted/converge.yml b/extensions/molecule/service_nodes/deleted/converge.yml
new file mode 100644
index 00000000..8993e9f6
--- /dev/null
+++ b/extensions/molecule/service_nodes/deleted/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — service_nodes (deleted)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.service_nodes with state=deleted
+      ansible.platform.service_nodes:
+        config:
+          - "{{ expected_config }}"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/service_key/deleted/molecule.yml b/extensions/molecule/service_nodes/deleted/molecule.yml
similarity index 100%
rename from extensions/molecule/service_key/deleted/molecule.yml
rename to extensions/molecule/service_nodes/deleted/molecule.yml
diff --git a/extensions/molecule/service_nodes/deleted/prepare.yml b/extensions/molecule/service_nodes/deleted/prepare.yml
new file mode 100644
index 00000000..37a58d0d
--- /dev/null
+++ b/extensions/molecule/service_nodes/deleted/prepare.yml
@@ -0,0 +1,18 @@
+---
+- name: "Prepare — service_nodes (deleted)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed service_nodes to be deleted (prerequisite for deleted)
+      ansible.platform.service_nodes:
+        config:
+          - "{{ prepare_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/service_node/deleted/vars.yml b/extensions/molecule/service_nodes/deleted/vars.yml
similarity index 100%
rename from extensions/molecule/service_node/deleted/vars.yml
rename to extensions/molecule/service_nodes/deleted/vars.yml
diff --git a/extensions/molecule/service_nodes/deleted/verify.yml b/extensions/molecule/service_nodes/deleted/verify.yml
new file mode 100644
index 00000000..429a33e3
--- /dev/null
+++ b/extensions/molecule/service_nodes/deleted/verify.yml
@@ -0,0 +1,26 @@
+---
+- name: "Verify — service_nodes (deleted)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather service_nodes (should be absent after deleted)
+      ansible.platform.service_nodes:
+        config:
+          - name: "int-snode-alpha"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert int-snode-alpha no longer exists (deleted)
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length == 0
+        fail_msg: "Expected empty after deleted, got: {{ gathered.gathered }}"
+
+...
diff --git a/extensions/molecule/service_nodes/gathered/cleanup.yml b/extensions/molecule/service_nodes/gathered/cleanup.yml
new file mode 100644
index 00000000..5d0763d3
--- /dev/null
+++ b/extensions/molecule/service_nodes/gathered/cleanup.yml
@@ -0,0 +1,19 @@
+---
+- name: "Cleanup — service_nodes (gathered)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove int-snode-alpha (test teardown)
+      ansible.platform.service_nodes:
+        config:
+          - name: "int-snode-alpha"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/service_nodes/gathered/converge.yml b/extensions/molecule/service_nodes/gathered/converge.yml
new file mode 100644
index 00000000..6ac02b9d
--- /dev/null
+++ b/extensions/molecule/service_nodes/gathered/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — service_nodes (gathered)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.service_nodes with state=gathered
+      ansible.platform.service_nodes:
+        config:
+          - "{{ expected_config }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/service_key/gathered/molecule.yml b/extensions/molecule/service_nodes/gathered/molecule.yml
similarity index 100%
rename from extensions/molecule/service_key/gathered/molecule.yml
rename to extensions/molecule/service_nodes/gathered/molecule.yml
diff --git a/extensions/molecule/service_nodes/gathered/prepare.yml b/extensions/molecule/service_nodes/gathered/prepare.yml
new file mode 100644
index 00000000..a3751f44
--- /dev/null
+++ b/extensions/molecule/service_nodes/gathered/prepare.yml
@@ -0,0 +1,18 @@
+---
+- name: "Prepare — service_nodes (gathered)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed service_nodes to be gathered (prerequisite for gathered)
+      ansible.platform.service_nodes:
+        config:
+          - "{{ prepare_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/service_node/gathered/vars.yml b/extensions/molecule/service_nodes/gathered/vars.yml
similarity index 100%
rename from extensions/molecule/service_node/gathered/vars.yml
rename to extensions/molecule/service_nodes/gathered/vars.yml
diff --git a/extensions/molecule/service_nodes/gathered/verify.yml b/extensions/molecule/service_nodes/gathered/verify.yml
new file mode 100644
index 00000000..6853aee6
--- /dev/null
+++ b/extensions/molecule/service_nodes/gathered/verify.yml
@@ -0,0 +1,26 @@
+---
+- name: "Verify — service_nodes (gathered)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather service_nodes (assert present after gathered)
+      ansible.platform.service_nodes:
+        config:
+          - name: "{{ expected_config.name }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert configuration exists after gathered
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length > 0
+        fail_msg: "Expected resource after gathered. got: {{ gathered.gathered }}"
+
+...
diff --git a/extensions/molecule/service_key/inventory.yml b/extensions/molecule/service_nodes/inventory.yml
similarity index 100%
rename from extensions/molecule/service_key/inventory.yml
rename to extensions/molecule/service_nodes/inventory.yml
diff --git a/extensions/molecule/service_nodes/merged/cleanup.yml b/extensions/molecule/service_nodes/merged/cleanup.yml
new file mode 100644
index 00000000..d2b2c4d4
--- /dev/null
+++ b/extensions/molecule/service_nodes/merged/cleanup.yml
@@ -0,0 +1,19 @@
+---
+- name: "Cleanup — service_nodes (merged)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove int-snode-alpha (test teardown)
+      ansible.platform.service_nodes:
+        config:
+          - name: "int-snode-alpha"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/service_nodes/merged/converge.yml b/extensions/molecule/service_nodes/merged/converge.yml
new file mode 100644
index 00000000..78dc5b4a
--- /dev/null
+++ b/extensions/molecule/service_nodes/merged/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — service_nodes (merged)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.service_nodes with state=merged
+      ansible.platform.service_nodes:
+        config:
+          - "{{ expected_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/service_key/merged/molecule.yml b/extensions/molecule/service_nodes/merged/molecule.yml
similarity index 100%
rename from extensions/molecule/service_key/merged/molecule.yml
rename to extensions/molecule/service_nodes/merged/molecule.yml
diff --git a/extensions/molecule/service_node/merged/vars.yml b/extensions/molecule/service_nodes/merged/vars.yml
similarity index 100%
rename from extensions/molecule/service_node/merged/vars.yml
rename to extensions/molecule/service_nodes/merged/vars.yml
diff --git a/extensions/molecule/service_nodes/merged/verify.yml b/extensions/molecule/service_nodes/merged/verify.yml
new file mode 100644
index 00000000..02582976
--- /dev/null
+++ b/extensions/molecule/service_nodes/merged/verify.yml
@@ -0,0 +1,26 @@
+---
+- name: "Verify — service_nodes (merged)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather service_nodes (assert present after merged)
+      ansible.platform.service_nodes:
+        config:
+          - name: "{{ expected_config.name }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert configuration exists after merged
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length > 0
+        fail_msg: "Expected resource after merged. got: {{ gathered.gathered }}"
+
+...
diff --git a/extensions/molecule/service_nodes/overridden/cleanup.yml b/extensions/molecule/service_nodes/overridden/cleanup.yml
new file mode 100644
index 00000000..c250a18a
--- /dev/null
+++ b/extensions/molecule/service_nodes/overridden/cleanup.yml
@@ -0,0 +1,19 @@
+---
+- name: "Cleanup — service_nodes (overridden)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove int-snode-alpha (test teardown)
+      ansible.platform.service_nodes:
+        config:
+          - name: "int-snode-alpha"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/service_nodes/overridden/converge.yml b/extensions/molecule/service_nodes/overridden/converge.yml
new file mode 100644
index 00000000..6c5ddf2c
--- /dev/null
+++ b/extensions/molecule/service_nodes/overridden/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — service_nodes (overridden)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.service_nodes with state=overridden
+      ansible.platform.service_nodes:
+        config:
+          - "{{ expected_config }}"
+        state: overridden
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/service_key/overridden/molecule.yml b/extensions/molecule/service_nodes/overridden/molecule.yml
similarity index 100%
rename from extensions/molecule/service_key/overridden/molecule.yml
rename to extensions/molecule/service_nodes/overridden/molecule.yml
diff --git a/extensions/molecule/service_nodes/overridden/prepare.yml b/extensions/molecule/service_nodes/overridden/prepare.yml
new file mode 100644
index 00000000..0662c3df
--- /dev/null
+++ b/extensions/molecule/service_nodes/overridden/prepare.yml
@@ -0,0 +1,17 @@
+---
+- name: "Prepare — service_nodes (overridden)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed prerequisite resources via merged (r0 + r1 + extras for overridden)
+      ansible.platform.service_nodes:
+        config: "{{ prepare_configs }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/service_node/overridden/vars.yml b/extensions/molecule/service_nodes/overridden/vars.yml
similarity index 100%
rename from extensions/molecule/service_node/overridden/vars.yml
rename to extensions/molecule/service_nodes/overridden/vars.yml
diff --git a/extensions/molecule/service_nodes/overridden/verify.yml b/extensions/molecule/service_nodes/overridden/verify.yml
new file mode 100644
index 00000000..e8dbbd9a
--- /dev/null
+++ b/extensions/molecule/service_nodes/overridden/verify.yml
@@ -0,0 +1,31 @@
+---
+- name: "Verify — service_nodes (overridden)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather all service_nodes resources (verify overridden final state)
+      ansible.platform.service_nodes:
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered_all
+
+    - name: Assert int-snode-alpha still exists after overridden
+      ansible.builtin.assert:
+        that:
+          - gathered_all.gathered is defined
+          - gathered_all.gathered | selectattr("name", "equalto", "int-snode-alpha") | list | length == 1
+        fail_msg: "Expected int-snode-alpha to exist after overridden. got: {{ gathered_all.gathered }}"
+
+    - name: Assert int-snode-beta was deleted by overridden (not in desired config)
+      ansible.builtin.assert:
+        that:
+          - gathered_all.gathered is defined
+          - gathered_all.gathered | selectattr("name", "equalto", "int-snode-beta") | list | length == 0
+        fail_msg: "overridden should have deleted int-snode-beta. got: {{ gathered_all.gathered }}"
+
+...
diff --git a/extensions/molecule/service_nodes/replaced/cleanup.yml b/extensions/molecule/service_nodes/replaced/cleanup.yml
new file mode 100644
index 00000000..d10c510c
--- /dev/null
+++ b/extensions/molecule/service_nodes/replaced/cleanup.yml
@@ -0,0 +1,19 @@
+---
+- name: "Cleanup — service_nodes (replaced)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove int-snode-alpha (test teardown)
+      ansible.platform.service_nodes:
+        config:
+          - name: "int-snode-alpha"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/service_nodes/replaced/converge.yml b/extensions/molecule/service_nodes/replaced/converge.yml
new file mode 100644
index 00000000..3cbea155
--- /dev/null
+++ b/extensions/molecule/service_nodes/replaced/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — service_nodes (replaced)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.service_nodes with state=replaced
+      ansible.platform.service_nodes:
+        config:
+          - "{{ expected_config }}"
+        state: replaced
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/service_key/replaced/molecule.yml b/extensions/molecule/service_nodes/replaced/molecule.yml
similarity index 100%
rename from extensions/molecule/service_key/replaced/molecule.yml
rename to extensions/molecule/service_nodes/replaced/molecule.yml
diff --git a/extensions/molecule/service_nodes/replaced/prepare.yml b/extensions/molecule/service_nodes/replaced/prepare.yml
new file mode 100644
index 00000000..f47b8226
--- /dev/null
+++ b/extensions/molecule/service_nodes/replaced/prepare.yml
@@ -0,0 +1,18 @@
+---
+- name: "Prepare — service_nodes (replaced)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed service_nodes to be replaced (prerequisite for replaced)
+      ansible.platform.service_nodes:
+        config:
+          - "{{ prepare_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/service_node/replaced/vars.yml b/extensions/molecule/service_nodes/replaced/vars.yml
similarity index 100%
rename from extensions/molecule/service_node/replaced/vars.yml
rename to extensions/molecule/service_nodes/replaced/vars.yml
diff --git a/extensions/molecule/service_nodes/replaced/verify.yml b/extensions/molecule/service_nodes/replaced/verify.yml
new file mode 100644
index 00000000..7a965abc
--- /dev/null
+++ b/extensions/molecule/service_nodes/replaced/verify.yml
@@ -0,0 +1,32 @@
+---
+- name: "Verify — service_nodes (replaced)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather service_nodes (assert present after replaced)
+      ansible.platform.service_nodes:
+        config:
+          - name: "{{ expected_config.name }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert configuration exists after replaced
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length > 0
+        fail_msg: "Expected resource after replaced. got: {{ gathered.gathered }}"
+
+    - name: Assert address was updated by replaced
+      ansible.builtin.assert:
+        that:
+          - (gathered.gathered | first).address == expected_config.address
+        fail_msg: "replaced should have set address='10.0.0.1'. got: {{ (gathered.gathered | first).address }}"
+
+...
diff --git a/extensions/molecule/service_type/check/cleanup.yml b/extensions/molecule/service_type/check/cleanup.yml
deleted file mode 100644
index 30650b73..00000000
--- a/extensions/molecule/service_type/check/cleanup.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Cleanup — service_type (check)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove int-stype-alpha (test teardown)
-      ansible.platform.service_type:
-        config:
-          - name: "int-stype-alpha"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/service_type/check/converge.yml b/extensions/molecule/service_type/check/converge.yml
deleted file mode 100644
index 49b64481..00000000
--- a/extensions/molecule/service_type/check/converge.yml
+++ /dev/null
@@ -1,36 +0,0 @@
----
-- name: "Converge — service_type (check)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.service_type with state=merged
-      ansible.platform.service_type:
-        config:
-          - "{{ expected_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      check_mode: true
-      diff: true
-      register: result
-
-    - name: Assert check mode predicted a change
-      ansible.builtin.assert:
-        that:
-          - result.changed == true
-          - result.before is defined
-          - result.after is defined
-        fail_msg: "check mode should predict a change. got={{ result }}"
-
-    - name: Assert diff output is present
-      ansible.builtin.assert:
-        that:
-          - result.diff is defined
-        fail_msg: "diff output missing from check result"
-      when: result.diff is defined
-
-...
diff --git a/extensions/molecule/service_type/check/prepare.yml b/extensions/molecule/service_type/check/prepare.yml
deleted file mode 100644
index 3d84e1b8..00000000
--- a/extensions/molecule/service_type/check/prepare.yml
+++ /dev/null
@@ -1,18 +0,0 @@
----
-- name: "Prepare — service_type (check)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed service_type as check-mode baseline (prerequisite for check)
-      ansible.platform.service_type:
-        config:
-          - "{{ prepare_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/service_type/check/verify.yml b/extensions/molecule/service_type/check/verify.yml
deleted file mode 100644
index dbc62b35..00000000
--- a/extensions/molecule/service_type/check/verify.yml
+++ /dev/null
@@ -1,27 +0,0 @@
----
-- name: "Verify — service_type (check)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather service_type (check mode must not have applied changes)
-      ansible.platform.service_type:
-        config:
-          - name: "{{ expected_config.name }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert int-stype-alpha still has prepare_config values (check did not apply)
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length > 0
-          - (gathered.gathered | first).login_path == prepare_config.login_path
-        fail_msg: "check mode should not alter resource. got: {{ gathered.gathered }}"
-
-...
diff --git a/extensions/molecule/service_type/deleted/cleanup.yml b/extensions/molecule/service_type/deleted/cleanup.yml
deleted file mode 100644
index e437efa8..00000000
--- a/extensions/molecule/service_type/deleted/cleanup.yml
+++ /dev/null
@@ -1,12 +0,0 @@
----
-- name: "Cleanup — service_type (deleted)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: No-op — int-stype-alpha already deleted by converge
-      ansible.builtin.debug:
-        msg: "int-stype-alpha was deleted in converge — nothing to clean up"
-
-...
diff --git a/extensions/molecule/service_type/deleted/converge.yml b/extensions/molecule/service_type/deleted/converge.yml
deleted file mode 100644
index ad266364..00000000
--- a/extensions/molecule/service_type/deleted/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — service_type (deleted)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.service_type with state=deleted
-      ansible.platform.service_type:
-        config:
-          - "{{ expected_config }}"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/service_type/deleted/prepare.yml b/extensions/molecule/service_type/deleted/prepare.yml
deleted file mode 100644
index 63cfc2db..00000000
--- a/extensions/molecule/service_type/deleted/prepare.yml
+++ /dev/null
@@ -1,18 +0,0 @@
----
-- name: "Prepare — service_type (deleted)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed service_type to be deleted (prerequisite for deleted)
-      ansible.platform.service_type:
-        config:
-          - "{{ prepare_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/service_type/deleted/verify.yml b/extensions/molecule/service_type/deleted/verify.yml
deleted file mode 100644
index 71401ac9..00000000
--- a/extensions/molecule/service_type/deleted/verify.yml
+++ /dev/null
@@ -1,26 +0,0 @@
----
-- name: "Verify — service_type (deleted)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather service_type (should be absent after deleted)
-      ansible.platform.service_type:
-        config:
-          - name: "int-stype-alpha"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert int-stype-alpha no longer exists (deleted)
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length == 0
-        fail_msg: "Expected empty after deleted, got: {{ gathered.gathered }}"
-
-...
diff --git a/extensions/molecule/service_type/gathered/cleanup.yml b/extensions/molecule/service_type/gathered/cleanup.yml
deleted file mode 100644
index ba8c7988..00000000
--- a/extensions/molecule/service_type/gathered/cleanup.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Cleanup — service_type (gathered)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove int-stype-alpha (test teardown)
-      ansible.platform.service_type:
-        config:
-          - name: "int-stype-alpha"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/service_type/gathered/converge.yml b/extensions/molecule/service_type/gathered/converge.yml
deleted file mode 100644
index 5ca46040..00000000
--- a/extensions/molecule/service_type/gathered/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — service_type (gathered)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.service_type with state=gathered
-      ansible.platform.service_type:
-        config:
-          - "{{ expected_config }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/service_type/gathered/prepare.yml b/extensions/molecule/service_type/gathered/prepare.yml
deleted file mode 100644
index 4c963148..00000000
--- a/extensions/molecule/service_type/gathered/prepare.yml
+++ /dev/null
@@ -1,18 +0,0 @@
----
-- name: "Prepare — service_type (gathered)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed service_type to be gathered (prerequisite for gathered)
-      ansible.platform.service_type:
-        config:
-          - "{{ prepare_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/service_type/gathered/verify.yml b/extensions/molecule/service_type/gathered/verify.yml
deleted file mode 100644
index 25e558d5..00000000
--- a/extensions/molecule/service_type/gathered/verify.yml
+++ /dev/null
@@ -1,26 +0,0 @@
----
-- name: "Verify — service_type (gathered)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather service_type (assert present after gathered)
-      ansible.platform.service_type:
-        config:
-          - name: "{{ expected_config.name }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert configuration exists after gathered
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length > 0
-        fail_msg: "Expected resource after gathered. got: {{ gathered.gathered }}"
-
-...
diff --git a/extensions/molecule/service_type/merged/cleanup.yml b/extensions/molecule/service_type/merged/cleanup.yml
deleted file mode 100644
index 623cbeba..00000000
--- a/extensions/molecule/service_type/merged/cleanup.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Cleanup — service_type (merged)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove int-stype-alpha (test teardown)
-      ansible.platform.service_type:
-        config:
-          - name: "int-stype-alpha"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/service_type/merged/converge.yml b/extensions/molecule/service_type/merged/converge.yml
deleted file mode 100644
index 3b5776a5..00000000
--- a/extensions/molecule/service_type/merged/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — service_type (merged)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.service_type with state=merged
-      ansible.platform.service_type:
-        config:
-          - "{{ expected_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/service_type/merged/verify.yml b/extensions/molecule/service_type/merged/verify.yml
deleted file mode 100644
index dbfde258..00000000
--- a/extensions/molecule/service_type/merged/verify.yml
+++ /dev/null
@@ -1,26 +0,0 @@
----
-- name: "Verify — service_type (merged)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather service_type (assert present after merged)
-      ansible.platform.service_type:
-        config:
-          - name: "{{ expected_config.name }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert configuration exists after merged
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length > 0
-        fail_msg: "Expected resource after merged. got: {{ gathered.gathered }}"
-
-...
diff --git a/extensions/molecule/service_type/overridden/cleanup.yml b/extensions/molecule/service_type/overridden/cleanup.yml
deleted file mode 100644
index 2df00422..00000000
--- a/extensions/molecule/service_type/overridden/cleanup.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Cleanup — service_type (overridden)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove int-stype-alpha (test teardown)
-      ansible.platform.service_type:
-        config:
-          - name: "int-stype-alpha"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/service_type/overridden/converge.yml b/extensions/molecule/service_type/overridden/converge.yml
deleted file mode 100644
index f6796a5d..00000000
--- a/extensions/molecule/service_type/overridden/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — service_type (overridden)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.service_type with state=overridden
-      ansible.platform.service_type:
-        config:
-          - "{{ expected_config }}"
-        state: overridden
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/service_type/overridden/prepare.yml b/extensions/molecule/service_type/overridden/prepare.yml
deleted file mode 100644
index 5214a653..00000000
--- a/extensions/molecule/service_type/overridden/prepare.yml
+++ /dev/null
@@ -1,17 +0,0 @@
----
-- name: "Prepare — service_type (overridden)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed prerequisite resources via merged (r0 + r1 + extras for overridden)
-      ansible.platform.service_type:
-        config: "{{ prepare_configs }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/service_type/overridden/verify.yml b/extensions/molecule/service_type/overridden/verify.yml
deleted file mode 100644
index edf8fb36..00000000
--- a/extensions/molecule/service_type/overridden/verify.yml
+++ /dev/null
@@ -1,31 +0,0 @@
----
-- name: "Verify — service_type (overridden)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather all service_type resources (verify overridden final state)
-      ansible.platform.service_type:
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered_all
-
-    - name: Assert int-stype-alpha still exists after overridden
-      ansible.builtin.assert:
-        that:
-          - gathered_all.gathered is defined
-          - gathered_all.gathered | selectattr("name", "equalto", "int-stype-alpha") | list | length == 1
-        fail_msg: "Expected int-stype-alpha to exist after overridden. got: {{ gathered_all.gathered }}"
-
-    - name: Assert int-stype-beta was deleted by overridden (not in desired config)
-      ansible.builtin.assert:
-        that:
-          - gathered_all.gathered is defined
-          - gathered_all.gathered | selectattr("name", "equalto", "int-stype-beta") | list | length == 0
-        fail_msg: "overridden should have deleted int-stype-beta. got: {{ gathered_all.gathered }}"
-
-...
diff --git a/extensions/molecule/service_type/replaced/cleanup.yml b/extensions/molecule/service_type/replaced/cleanup.yml
deleted file mode 100644
index ec605a90..00000000
--- a/extensions/molecule/service_type/replaced/cleanup.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Cleanup — service_type (replaced)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove int-stype-alpha (test teardown)
-      ansible.platform.service_type:
-        config:
-          - name: "int-stype-alpha"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/service_type/replaced/converge.yml b/extensions/molecule/service_type/replaced/converge.yml
deleted file mode 100644
index d4874a38..00000000
--- a/extensions/molecule/service_type/replaced/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — service_type (replaced)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.service_type with state=replaced
-      ansible.platform.service_type:
-        config:
-          - "{{ expected_config }}"
-        state: replaced
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/service_type/replaced/prepare.yml b/extensions/molecule/service_type/replaced/prepare.yml
deleted file mode 100644
index 6755f467..00000000
--- a/extensions/molecule/service_type/replaced/prepare.yml
+++ /dev/null
@@ -1,18 +0,0 @@
----
-- name: "Prepare — service_type (replaced)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed service_type to be replaced (prerequisite for replaced)
-      ansible.platform.service_type:
-        config:
-          - "{{ prepare_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/service_type/replaced/verify.yml b/extensions/molecule/service_type/replaced/verify.yml
deleted file mode 100644
index 67f25fbb..00000000
--- a/extensions/molecule/service_type/replaced/verify.yml
+++ /dev/null
@@ -1,32 +0,0 @@
----
-- name: "Verify — service_type (replaced)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather service_type (assert present after replaced)
-      ansible.platform.service_type:
-        config:
-          - name: "{{ expected_config.name }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert configuration exists after replaced
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length > 0
-        fail_msg: "Expected resource after replaced. got: {{ gathered.gathered }}"
-
-    - name: Assert login_path was updated by replaced
-      ansible.builtin.assert:
-        that:
-          - (gathered.gathered | first).login_path == expected_config.login_path
-        fail_msg: "replaced should have set login_path='/login'. got: {{ (gathered.gathered | first).login_path }}"
-
-...
diff --git a/extensions/molecule/service_types/check/cleanup.yml b/extensions/molecule/service_types/check/cleanup.yml
new file mode 100644
index 00000000..219c2d77
--- /dev/null
+++ b/extensions/molecule/service_types/check/cleanup.yml
@@ -0,0 +1,19 @@
+---
+- name: "Cleanup — service_types (check)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove int-stype-alpha (test teardown)
+      ansible.platform.service_types:
+        config:
+          - name: "int-stype-alpha"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/service_types/check/converge.yml b/extensions/molecule/service_types/check/converge.yml
new file mode 100644
index 00000000..69c6e606
--- /dev/null
+++ b/extensions/molecule/service_types/check/converge.yml
@@ -0,0 +1,36 @@
+---
+- name: "Converge — service_types (check)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.service_types with state=merged
+      ansible.platform.service_types:
+        config:
+          - "{{ expected_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      check_mode: true
+      diff: true
+      register: result
+
+    - name: Assert check mode predicted a change
+      ansible.builtin.assert:
+        that:
+          - result.changed == true
+          - result.before is defined
+          - result.after is defined
+        fail_msg: "check mode should predict a change. got={{ result }}"
+
+    - name: Assert diff output is present
+      ansible.builtin.assert:
+        that:
+          - result.diff is defined
+        fail_msg: "diff output missing from check result"
+      when: result.diff is defined
+
+...
diff --git a/extensions/molecule/service_node/check/molecule.yml b/extensions/molecule/service_types/check/molecule.yml
similarity index 100%
rename from extensions/molecule/service_node/check/molecule.yml
rename to extensions/molecule/service_types/check/molecule.yml
diff --git a/extensions/molecule/service_types/check/prepare.yml b/extensions/molecule/service_types/check/prepare.yml
new file mode 100644
index 00000000..a5cc56d8
--- /dev/null
+++ b/extensions/molecule/service_types/check/prepare.yml
@@ -0,0 +1,18 @@
+---
+- name: "Prepare — service_types (check)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed service_types as check-mode baseline (prerequisite for check)
+      ansible.platform.service_types:
+        config:
+          - "{{ prepare_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/service_type/check/vars.yml b/extensions/molecule/service_types/check/vars.yml
similarity index 100%
rename from extensions/molecule/service_type/check/vars.yml
rename to extensions/molecule/service_types/check/vars.yml
diff --git a/extensions/molecule/service_types/check/verify.yml b/extensions/molecule/service_types/check/verify.yml
new file mode 100644
index 00000000..d81c40d8
--- /dev/null
+++ b/extensions/molecule/service_types/check/verify.yml
@@ -0,0 +1,27 @@
+---
+- name: "Verify — service_types (check)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather service_types (check mode must not have applied changes)
+      ansible.platform.service_types:
+        config:
+          - name: "{{ expected_config.name }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert int-stype-alpha still has prepare_config values (check did not apply)
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length > 0
+          - (gathered.gathered | first).login_path == prepare_config.login_path
+        fail_msg: "check mode should not alter resource. got: {{ gathered.gathered }}"
+
+...
diff --git a/extensions/molecule/service_types/deleted/cleanup.yml b/extensions/molecule/service_types/deleted/cleanup.yml
new file mode 100644
index 00000000..c87ed1d4
--- /dev/null
+++ b/extensions/molecule/service_types/deleted/cleanup.yml
@@ -0,0 +1,12 @@
+---
+- name: "Cleanup — service_types (deleted)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: No-op — int-stype-alpha already deleted by converge
+      ansible.builtin.debug:
+        msg: "int-stype-alpha was deleted in converge — nothing to clean up"
+
+...
diff --git a/extensions/molecule/service_types/deleted/converge.yml b/extensions/molecule/service_types/deleted/converge.yml
new file mode 100644
index 00000000..f2fdd35e
--- /dev/null
+++ b/extensions/molecule/service_types/deleted/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — service_types (deleted)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.service_types with state=deleted
+      ansible.platform.service_types:
+        config:
+          - "{{ expected_config }}"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/service_node/deleted/molecule.yml b/extensions/molecule/service_types/deleted/molecule.yml
similarity index 100%
rename from extensions/molecule/service_node/deleted/molecule.yml
rename to extensions/molecule/service_types/deleted/molecule.yml
diff --git a/extensions/molecule/service_types/deleted/prepare.yml b/extensions/molecule/service_types/deleted/prepare.yml
new file mode 100644
index 00000000..e45df2ef
--- /dev/null
+++ b/extensions/molecule/service_types/deleted/prepare.yml
@@ -0,0 +1,18 @@
+---
+- name: "Prepare — service_types (deleted)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed service_types to be deleted (prerequisite for deleted)
+      ansible.platform.service_types:
+        config:
+          - "{{ prepare_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/service_type/deleted/vars.yml b/extensions/molecule/service_types/deleted/vars.yml
similarity index 100%
rename from extensions/molecule/service_type/deleted/vars.yml
rename to extensions/molecule/service_types/deleted/vars.yml
diff --git a/extensions/molecule/service_types/deleted/verify.yml b/extensions/molecule/service_types/deleted/verify.yml
new file mode 100644
index 00000000..f4779c85
--- /dev/null
+++ b/extensions/molecule/service_types/deleted/verify.yml
@@ -0,0 +1,26 @@
+---
+- name: "Verify — service_types (deleted)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather service_types (should be absent after deleted)
+      ansible.platform.service_types:
+        config:
+          - name: "int-stype-alpha"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert int-stype-alpha no longer exists (deleted)
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length == 0
+        fail_msg: "Expected empty after deleted, got: {{ gathered.gathered }}"
+
+...
diff --git a/extensions/molecule/service_types/gathered/cleanup.yml b/extensions/molecule/service_types/gathered/cleanup.yml
new file mode 100644
index 00000000..4ffe9350
--- /dev/null
+++ b/extensions/molecule/service_types/gathered/cleanup.yml
@@ -0,0 +1,19 @@
+---
+- name: "Cleanup — service_types (gathered)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove int-stype-alpha (test teardown)
+      ansible.platform.service_types:
+        config:
+          - name: "int-stype-alpha"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/service_types/gathered/converge.yml b/extensions/molecule/service_types/gathered/converge.yml
new file mode 100644
index 00000000..4eddc766
--- /dev/null
+++ b/extensions/molecule/service_types/gathered/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — service_types (gathered)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.service_types with state=gathered
+      ansible.platform.service_types:
+        config:
+          - "{{ expected_config }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/service_node/gathered/molecule.yml b/extensions/molecule/service_types/gathered/molecule.yml
similarity index 100%
rename from extensions/molecule/service_node/gathered/molecule.yml
rename to extensions/molecule/service_types/gathered/molecule.yml
diff --git a/extensions/molecule/service_types/gathered/prepare.yml b/extensions/molecule/service_types/gathered/prepare.yml
new file mode 100644
index 00000000..3776d29e
--- /dev/null
+++ b/extensions/molecule/service_types/gathered/prepare.yml
@@ -0,0 +1,18 @@
+---
+- name: "Prepare — service_types (gathered)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed service_types to be gathered (prerequisite for gathered)
+      ansible.platform.service_types:
+        config:
+          - "{{ prepare_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/service_type/gathered/vars.yml b/extensions/molecule/service_types/gathered/vars.yml
similarity index 100%
rename from extensions/molecule/service_type/gathered/vars.yml
rename to extensions/molecule/service_types/gathered/vars.yml
diff --git a/extensions/molecule/service_types/gathered/verify.yml b/extensions/molecule/service_types/gathered/verify.yml
new file mode 100644
index 00000000..b849bbb4
--- /dev/null
+++ b/extensions/molecule/service_types/gathered/verify.yml
@@ -0,0 +1,26 @@
+---
+- name: "Verify — service_types (gathered)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather service_types (assert present after gathered)
+      ansible.platform.service_types:
+        config:
+          - name: "{{ expected_config.name }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert configuration exists after gathered
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length > 0
+        fail_msg: "Expected resource after gathered. got: {{ gathered.gathered }}"
+
+...
diff --git a/extensions/molecule/service_node/inventory.yml b/extensions/molecule/service_types/inventory.yml
similarity index 100%
rename from extensions/molecule/service_node/inventory.yml
rename to extensions/molecule/service_types/inventory.yml
diff --git a/extensions/molecule/service_types/merged/cleanup.yml b/extensions/molecule/service_types/merged/cleanup.yml
new file mode 100644
index 00000000..13b65f8d
--- /dev/null
+++ b/extensions/molecule/service_types/merged/cleanup.yml
@@ -0,0 +1,19 @@
+---
+- name: "Cleanup — service_types (merged)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove int-stype-alpha (test teardown)
+      ansible.platform.service_types:
+        config:
+          - name: "int-stype-alpha"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/service_types/merged/converge.yml b/extensions/molecule/service_types/merged/converge.yml
new file mode 100644
index 00000000..ea66e999
--- /dev/null
+++ b/extensions/molecule/service_types/merged/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — service_types (merged)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.service_types with state=merged
+      ansible.platform.service_types:
+        config:
+          - "{{ expected_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/service_node/merged/molecule.yml b/extensions/molecule/service_types/merged/molecule.yml
similarity index 100%
rename from extensions/molecule/service_node/merged/molecule.yml
rename to extensions/molecule/service_types/merged/molecule.yml
diff --git a/extensions/molecule/service_type/merged/vars.yml b/extensions/molecule/service_types/merged/vars.yml
similarity index 100%
rename from extensions/molecule/service_type/merged/vars.yml
rename to extensions/molecule/service_types/merged/vars.yml
diff --git a/extensions/molecule/service_types/merged/verify.yml b/extensions/molecule/service_types/merged/verify.yml
new file mode 100644
index 00000000..16e5a5e0
--- /dev/null
+++ b/extensions/molecule/service_types/merged/verify.yml
@@ -0,0 +1,26 @@
+---
+- name: "Verify — service_types (merged)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather service_types (assert present after merged)
+      ansible.platform.service_types:
+        config:
+          - name: "{{ expected_config.name }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert configuration exists after merged
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length > 0
+        fail_msg: "Expected resource after merged. got: {{ gathered.gathered }}"
+
+...
diff --git a/extensions/molecule/service_types/overridden/cleanup.yml b/extensions/molecule/service_types/overridden/cleanup.yml
new file mode 100644
index 00000000..bb720a68
--- /dev/null
+++ b/extensions/molecule/service_types/overridden/cleanup.yml
@@ -0,0 +1,19 @@
+---
+- name: "Cleanup — service_types (overridden)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove int-stype-alpha (test teardown)
+      ansible.platform.service_types:
+        config:
+          - name: "int-stype-alpha"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/service_types/overridden/converge.yml b/extensions/molecule/service_types/overridden/converge.yml
new file mode 100644
index 00000000..bdd526a3
--- /dev/null
+++ b/extensions/molecule/service_types/overridden/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — service_types (overridden)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.service_types with state=overridden
+      ansible.platform.service_types:
+        config:
+          - "{{ expected_config }}"
+        state: overridden
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/service_node/overridden/molecule.yml b/extensions/molecule/service_types/overridden/molecule.yml
similarity index 100%
rename from extensions/molecule/service_node/overridden/molecule.yml
rename to extensions/molecule/service_types/overridden/molecule.yml
diff --git a/extensions/molecule/service_types/overridden/prepare.yml b/extensions/molecule/service_types/overridden/prepare.yml
new file mode 100644
index 00000000..9cea1e82
--- /dev/null
+++ b/extensions/molecule/service_types/overridden/prepare.yml
@@ -0,0 +1,17 @@
+---
+- name: "Prepare — service_types (overridden)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed prerequisite resources via merged (r0 + r1 + extras for overridden)
+      ansible.platform.service_types:
+        config: "{{ prepare_configs }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/service_type/overridden/vars.yml b/extensions/molecule/service_types/overridden/vars.yml
similarity index 100%
rename from extensions/molecule/service_type/overridden/vars.yml
rename to extensions/molecule/service_types/overridden/vars.yml
diff --git a/extensions/molecule/service_types/overridden/verify.yml b/extensions/molecule/service_types/overridden/verify.yml
new file mode 100644
index 00000000..4746d8b5
--- /dev/null
+++ b/extensions/molecule/service_types/overridden/verify.yml
@@ -0,0 +1,31 @@
+---
+- name: "Verify — service_types (overridden)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather all service_types resources (verify overridden final state)
+      ansible.platform.service_types:
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered_all
+
+    - name: Assert int-stype-alpha still exists after overridden
+      ansible.builtin.assert:
+        that:
+          - gathered_all.gathered is defined
+          - gathered_all.gathered | selectattr("name", "equalto", "int-stype-alpha") | list | length == 1
+        fail_msg: "Expected int-stype-alpha to exist after overridden. got: {{ gathered_all.gathered }}"
+
+    - name: Assert int-stype-beta was deleted by overridden (not in desired config)
+      ansible.builtin.assert:
+        that:
+          - gathered_all.gathered is defined
+          - gathered_all.gathered | selectattr("name", "equalto", "int-stype-beta") | list | length == 0
+        fail_msg: "overridden should have deleted int-stype-beta. got: {{ gathered_all.gathered }}"
+
+...
diff --git a/extensions/molecule/service_types/replaced/cleanup.yml b/extensions/molecule/service_types/replaced/cleanup.yml
new file mode 100644
index 00000000..55737090
--- /dev/null
+++ b/extensions/molecule/service_types/replaced/cleanup.yml
@@ -0,0 +1,19 @@
+---
+- name: "Cleanup — service_types (replaced)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove int-stype-alpha (test teardown)
+      ansible.platform.service_types:
+        config:
+          - name: "int-stype-alpha"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/service_types/replaced/converge.yml b/extensions/molecule/service_types/replaced/converge.yml
new file mode 100644
index 00000000..c98384f7
--- /dev/null
+++ b/extensions/molecule/service_types/replaced/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — service_types (replaced)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.service_types with state=replaced
+      ansible.platform.service_types:
+        config:
+          - "{{ expected_config }}"
+        state: replaced
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/service_node/replaced/molecule.yml b/extensions/molecule/service_types/replaced/molecule.yml
similarity index 100%
rename from extensions/molecule/service_node/replaced/molecule.yml
rename to extensions/molecule/service_types/replaced/molecule.yml
diff --git a/extensions/molecule/service_types/replaced/prepare.yml b/extensions/molecule/service_types/replaced/prepare.yml
new file mode 100644
index 00000000..165d409c
--- /dev/null
+++ b/extensions/molecule/service_types/replaced/prepare.yml
@@ -0,0 +1,18 @@
+---
+- name: "Prepare — service_types (replaced)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed service_types to be replaced (prerequisite for replaced)
+      ansible.platform.service_types:
+        config:
+          - "{{ prepare_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/service_type/replaced/vars.yml b/extensions/molecule/service_types/replaced/vars.yml
similarity index 100%
rename from extensions/molecule/service_type/replaced/vars.yml
rename to extensions/molecule/service_types/replaced/vars.yml
diff --git a/extensions/molecule/service_types/replaced/verify.yml b/extensions/molecule/service_types/replaced/verify.yml
new file mode 100644
index 00000000..f45c471e
--- /dev/null
+++ b/extensions/molecule/service_types/replaced/verify.yml
@@ -0,0 +1,32 @@
+---
+- name: "Verify — service_types (replaced)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather service_types (assert present after replaced)
+      ansible.platform.service_types:
+        config:
+          - name: "{{ expected_config.name }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert configuration exists after replaced
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length > 0
+        fail_msg: "Expected resource after replaced. got: {{ gathered.gathered }}"
+
+    - name: Assert login_path was updated by replaced
+      ansible.builtin.assert:
+        that:
+          - (gathered.gathered | first).login_path == expected_config.login_path
+        fail_msg: "replaced should have set login_path='/login'. got: {{ (gathered.gathered | first).login_path }}"
+
+...
diff --git a/extensions/molecule/services/check/cleanup.yml b/extensions/molecule/services/check/cleanup.yml
new file mode 100644
index 00000000..1aef0197
--- /dev/null
+++ b/extensions/molecule/services/check/cleanup.yml
@@ -0,0 +1,19 @@
+---
+- name: "Cleanup — services (check)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove int-svc-alpha (test teardown)
+      ansible.platform.services:
+        config:
+          - name: "int-svc-alpha"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/services/check/converge.yml b/extensions/molecule/services/check/converge.yml
new file mode 100644
index 00000000..a433f2d9
--- /dev/null
+++ b/extensions/molecule/services/check/converge.yml
@@ -0,0 +1,36 @@
+---
+- name: "Converge — services (check)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.services with state=merged
+      ansible.platform.services:
+        config:
+          - "{{ expected_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      check_mode: true
+      diff: true
+      register: result
+
+    - name: Assert check mode predicted a change
+      ansible.builtin.assert:
+        that:
+          - result.changed == true
+          - result.before is defined
+          - result.after is defined
+        fail_msg: "check mode should predict a change. got={{ result }}"
+
+    - name: Assert diff output is present
+      ansible.builtin.assert:
+        that:
+          - result.diff is defined
+        fail_msg: "diff output missing from check result"
+      when: result.diff is defined
+
+...
diff --git a/extensions/molecule/service_type/check/molecule.yml b/extensions/molecule/services/check/molecule.yml
similarity index 100%
rename from extensions/molecule/service_type/check/molecule.yml
rename to extensions/molecule/services/check/molecule.yml
diff --git a/extensions/molecule/services/check/prepare.yml b/extensions/molecule/services/check/prepare.yml
new file mode 100644
index 00000000..087f5b46
--- /dev/null
+++ b/extensions/molecule/services/check/prepare.yml
@@ -0,0 +1,18 @@
+---
+- name: "Prepare — services (check)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed services as check-mode baseline (prerequisite for check)
+      ansible.platform.services:
+        config:
+          - "{{ prepare_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/service/check/vars.yml b/extensions/molecule/services/check/vars.yml
similarity index 100%
rename from extensions/molecule/service/check/vars.yml
rename to extensions/molecule/services/check/vars.yml
diff --git a/extensions/molecule/services/check/verify.yml b/extensions/molecule/services/check/verify.yml
new file mode 100644
index 00000000..dd34cd13
--- /dev/null
+++ b/extensions/molecule/services/check/verify.yml
@@ -0,0 +1,27 @@
+---
+- name: "Verify — services (check)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather services (check mode must not have applied changes)
+      ansible.platform.services:
+        config:
+          - name: "{{ expected_config.name }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert int-svc-alpha still has prepare_config values (check did not apply)
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length > 0
+          - (gathered.gathered | first).description == prepare_config.description
+        fail_msg: "check mode should not alter resource. got: {{ gathered.gathered }}"
+
+...
diff --git a/extensions/molecule/services/deleted/cleanup.yml b/extensions/molecule/services/deleted/cleanup.yml
new file mode 100644
index 00000000..ac773658
--- /dev/null
+++ b/extensions/molecule/services/deleted/cleanup.yml
@@ -0,0 +1,12 @@
+---
+- name: "Cleanup — services (deleted)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: No-op — int-svc-alpha already deleted by converge
+      ansible.builtin.debug:
+        msg: "int-svc-alpha was deleted in converge — nothing to clean up"
+
+...
diff --git a/extensions/molecule/services/deleted/converge.yml b/extensions/molecule/services/deleted/converge.yml
new file mode 100644
index 00000000..84e7271f
--- /dev/null
+++ b/extensions/molecule/services/deleted/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — services (deleted)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.services with state=deleted
+      ansible.platform.services:
+        config:
+          - "{{ expected_config }}"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/service_type/deleted/molecule.yml b/extensions/molecule/services/deleted/molecule.yml
similarity index 100%
rename from extensions/molecule/service_type/deleted/molecule.yml
rename to extensions/molecule/services/deleted/molecule.yml
diff --git a/extensions/molecule/services/deleted/prepare.yml b/extensions/molecule/services/deleted/prepare.yml
new file mode 100644
index 00000000..91367edd
--- /dev/null
+++ b/extensions/molecule/services/deleted/prepare.yml
@@ -0,0 +1,18 @@
+---
+- name: "Prepare — services (deleted)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed services to be deleted (prerequisite for deleted)
+      ansible.platform.services:
+        config:
+          - "{{ prepare_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/service/deleted/vars.yml b/extensions/molecule/services/deleted/vars.yml
similarity index 100%
rename from extensions/molecule/service/deleted/vars.yml
rename to extensions/molecule/services/deleted/vars.yml
diff --git a/extensions/molecule/services/deleted/verify.yml b/extensions/molecule/services/deleted/verify.yml
new file mode 100644
index 00000000..abbde122
--- /dev/null
+++ b/extensions/molecule/services/deleted/verify.yml
@@ -0,0 +1,26 @@
+---
+- name: "Verify — services (deleted)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather services (should be absent after deleted)
+      ansible.platform.services:
+        config:
+          - name: "int-svc-alpha"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert int-svc-alpha no longer exists (deleted)
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length == 0
+        fail_msg: "Expected empty after deleted, got: {{ gathered.gathered }}"
+
+...
diff --git a/extensions/molecule/services/gathered/cleanup.yml b/extensions/molecule/services/gathered/cleanup.yml
new file mode 100644
index 00000000..9e7bf49d
--- /dev/null
+++ b/extensions/molecule/services/gathered/cleanup.yml
@@ -0,0 +1,19 @@
+---
+- name: "Cleanup — services (gathered)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove int-svc-alpha (test teardown)
+      ansible.platform.services:
+        config:
+          - name: "int-svc-alpha"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/services/gathered/converge.yml b/extensions/molecule/services/gathered/converge.yml
new file mode 100644
index 00000000..8f8ef99f
--- /dev/null
+++ b/extensions/molecule/services/gathered/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — services (gathered)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.services with state=gathered
+      ansible.platform.services:
+        config:
+          - "{{ expected_config }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/service_type/gathered/molecule.yml b/extensions/molecule/services/gathered/molecule.yml
similarity index 100%
rename from extensions/molecule/service_type/gathered/molecule.yml
rename to extensions/molecule/services/gathered/molecule.yml
diff --git a/extensions/molecule/services/gathered/prepare.yml b/extensions/molecule/services/gathered/prepare.yml
new file mode 100644
index 00000000..7a3bcc71
--- /dev/null
+++ b/extensions/molecule/services/gathered/prepare.yml
@@ -0,0 +1,18 @@
+---
+- name: "Prepare — services (gathered)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed services to be gathered (prerequisite for gathered)
+      ansible.platform.services:
+        config:
+          - "{{ prepare_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/service/gathered/vars.yml b/extensions/molecule/services/gathered/vars.yml
similarity index 100%
rename from extensions/molecule/service/gathered/vars.yml
rename to extensions/molecule/services/gathered/vars.yml
diff --git a/extensions/molecule/services/gathered/verify.yml b/extensions/molecule/services/gathered/verify.yml
new file mode 100644
index 00000000..4d85bbe9
--- /dev/null
+++ b/extensions/molecule/services/gathered/verify.yml
@@ -0,0 +1,26 @@
+---
+- name: "Verify — services (gathered)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather services (assert present after gathered)
+      ansible.platform.services:
+        config:
+          - name: "{{ expected_config.name }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert configuration exists after gathered
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length > 0
+        fail_msg: "Expected resource after gathered. got: {{ gathered.gathered }}"
+
+...
diff --git a/extensions/molecule/service_type/inventory.yml b/extensions/molecule/services/inventory.yml
similarity index 100%
rename from extensions/molecule/service_type/inventory.yml
rename to extensions/molecule/services/inventory.yml
diff --git a/extensions/molecule/services/merged/cleanup.yml b/extensions/molecule/services/merged/cleanup.yml
new file mode 100644
index 00000000..944a0c8c
--- /dev/null
+++ b/extensions/molecule/services/merged/cleanup.yml
@@ -0,0 +1,19 @@
+---
+- name: "Cleanup — services (merged)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove int-svc-alpha (test teardown)
+      ansible.platform.services:
+        config:
+          - name: "int-svc-alpha"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/services/merged/converge.yml b/extensions/molecule/services/merged/converge.yml
new file mode 100644
index 00000000..3b550c0f
--- /dev/null
+++ b/extensions/molecule/services/merged/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — services (merged)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.services with state=merged
+      ansible.platform.services:
+        config:
+          - "{{ expected_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/service_type/merged/molecule.yml b/extensions/molecule/services/merged/molecule.yml
similarity index 100%
rename from extensions/molecule/service_type/merged/molecule.yml
rename to extensions/molecule/services/merged/molecule.yml
diff --git a/extensions/molecule/service/merged/vars.yml b/extensions/molecule/services/merged/vars.yml
similarity index 100%
rename from extensions/molecule/service/merged/vars.yml
rename to extensions/molecule/services/merged/vars.yml
diff --git a/extensions/molecule/services/merged/verify.yml b/extensions/molecule/services/merged/verify.yml
new file mode 100644
index 00000000..72ee3de3
--- /dev/null
+++ b/extensions/molecule/services/merged/verify.yml
@@ -0,0 +1,26 @@
+---
+- name: "Verify — services (merged)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather services (assert present after merged)
+      ansible.platform.services:
+        config:
+          - name: "{{ expected_config.name }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert configuration exists after merged
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length > 0
+        fail_msg: "Expected resource after merged. got: {{ gathered.gathered }}"
+
+...
diff --git a/extensions/molecule/services/overridden/cleanup.yml b/extensions/molecule/services/overridden/cleanup.yml
new file mode 100644
index 00000000..ac059804
--- /dev/null
+++ b/extensions/molecule/services/overridden/cleanup.yml
@@ -0,0 +1,19 @@
+---
+- name: "Cleanup — services (overridden)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove int-svc-alpha (test teardown)
+      ansible.platform.services:
+        config:
+          - name: "int-svc-alpha"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/services/overridden/converge.yml b/extensions/molecule/services/overridden/converge.yml
new file mode 100644
index 00000000..a5104d5c
--- /dev/null
+++ b/extensions/molecule/services/overridden/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — services (overridden)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.services with state=overridden
+      ansible.platform.services:
+        config:
+          - "{{ expected_config }}"
+        state: overridden
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/service_type/overridden/molecule.yml b/extensions/molecule/services/overridden/molecule.yml
similarity index 100%
rename from extensions/molecule/service_type/overridden/molecule.yml
rename to extensions/molecule/services/overridden/molecule.yml
diff --git a/extensions/molecule/services/overridden/prepare.yml b/extensions/molecule/services/overridden/prepare.yml
new file mode 100644
index 00000000..222b4530
--- /dev/null
+++ b/extensions/molecule/services/overridden/prepare.yml
@@ -0,0 +1,17 @@
+---
+- name: "Prepare — services (overridden)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed prerequisite resources via merged (r0 + r1 + extras for overridden)
+      ansible.platform.services:
+        config: "{{ prepare_configs }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/service/overridden/vars.yml b/extensions/molecule/services/overridden/vars.yml
similarity index 100%
rename from extensions/molecule/service/overridden/vars.yml
rename to extensions/molecule/services/overridden/vars.yml
diff --git a/extensions/molecule/services/overridden/verify.yml b/extensions/molecule/services/overridden/verify.yml
new file mode 100644
index 00000000..75707bbf
--- /dev/null
+++ b/extensions/molecule/services/overridden/verify.yml
@@ -0,0 +1,31 @@
+---
+- name: "Verify — services (overridden)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather all services resources (verify overridden final state)
+      ansible.platform.services:
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered_all
+
+    - name: Assert int-svc-alpha still exists after overridden
+      ansible.builtin.assert:
+        that:
+          - gathered_all.gathered is defined
+          - gathered_all.gathered | selectattr("name", "equalto", "int-svc-alpha") | list | length == 1
+        fail_msg: "Expected int-svc-alpha to exist after overridden. got: {{ gathered_all.gathered }}"
+
+    - name: Assert int-svc-beta was deleted by overridden (not in desired config)
+      ansible.builtin.assert:
+        that:
+          - gathered_all.gathered is defined
+          - gathered_all.gathered | selectattr("name", "equalto", "int-svc-beta") | list | length == 0
+        fail_msg: "overridden should have deleted int-svc-beta. got: {{ gathered_all.gathered }}"
+
+...
diff --git a/extensions/molecule/services/replaced/cleanup.yml b/extensions/molecule/services/replaced/cleanup.yml
new file mode 100644
index 00000000..4a29e08a
--- /dev/null
+++ b/extensions/molecule/services/replaced/cleanup.yml
@@ -0,0 +1,19 @@
+---
+- name: "Cleanup — services (replaced)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove int-svc-alpha (test teardown)
+      ansible.platform.services:
+        config:
+          - name: "int-svc-alpha"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/services/replaced/converge.yml b/extensions/molecule/services/replaced/converge.yml
new file mode 100644
index 00000000..8b8e1e99
--- /dev/null
+++ b/extensions/molecule/services/replaced/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — services (replaced)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.services with state=replaced
+      ansible.platform.services:
+        config:
+          - "{{ expected_config }}"
+        state: replaced
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/service_type/replaced/molecule.yml b/extensions/molecule/services/replaced/molecule.yml
similarity index 100%
rename from extensions/molecule/service_type/replaced/molecule.yml
rename to extensions/molecule/services/replaced/molecule.yml
diff --git a/extensions/molecule/services/replaced/prepare.yml b/extensions/molecule/services/replaced/prepare.yml
new file mode 100644
index 00000000..e2c73580
--- /dev/null
+++ b/extensions/molecule/services/replaced/prepare.yml
@@ -0,0 +1,18 @@
+---
+- name: "Prepare — services (replaced)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed services to be replaced (prerequisite for replaced)
+      ansible.platform.services:
+        config:
+          - "{{ prepare_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/service/replaced/vars.yml b/extensions/molecule/services/replaced/vars.yml
similarity index 100%
rename from extensions/molecule/service/replaced/vars.yml
rename to extensions/molecule/services/replaced/vars.yml
diff --git a/extensions/molecule/services/replaced/verify.yml b/extensions/molecule/services/replaced/verify.yml
new file mode 100644
index 00000000..04776ca5
--- /dev/null
+++ b/extensions/molecule/services/replaced/verify.yml
@@ -0,0 +1,32 @@
+---
+- name: "Verify — services (replaced)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather services (assert present after replaced)
+      ansible.platform.services:
+        config:
+          - name: "{{ expected_config.name }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert configuration exists after replaced
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length > 0
+        fail_msg: "Expected resource after replaced. got: {{ gathered.gathered }}"
+
+    - name: Assert description was updated by replaced
+      ansible.builtin.assert:
+        that:
+          - (gathered.gathered | first).description == expected_config.description
+        fail_msg: "replaced should have set description='Alpha service'. got: {{ (gathered.gathered | first).description }}"
+
+...
diff --git a/extensions/molecule/team/check/cleanup.yml b/extensions/molecule/team/check/cleanup.yml
deleted file mode 100644
index 1bece8db..00000000
--- a/extensions/molecule/team/check/cleanup.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Cleanup — team (check)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove int-team-alpha (test teardown)
-      ansible.platform.team:
-        config:
-          - name: "int-team-alpha"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/team/check/converge.yml b/extensions/molecule/team/check/converge.yml
deleted file mode 100644
index 1c0e6188..00000000
--- a/extensions/molecule/team/check/converge.yml
+++ /dev/null
@@ -1,36 +0,0 @@
----
-- name: "Converge — team (check)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.team with state=merged
-      ansible.platform.team:
-        config:
-          - "{{ expected_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      check_mode: true
-      diff: true
-      register: result
-
-    - name: Assert check mode predicted a change
-      ansible.builtin.assert:
-        that:
-          - result.changed == true
-          - result.before is defined
-          - result.after is defined
-        fail_msg: "check mode should predict a change. got={{ result }}"
-
-    - name: Assert diff output is present
-      ansible.builtin.assert:
-        that:
-          - result.diff is defined
-        fail_msg: "diff output missing from check result"
-      when: result.diff is defined
-
-...
diff --git a/extensions/molecule/team/check/prepare.yml b/extensions/molecule/team/check/prepare.yml
deleted file mode 100644
index ee998d07..00000000
--- a/extensions/molecule/team/check/prepare.yml
+++ /dev/null
@@ -1,18 +0,0 @@
----
-- name: "Prepare — team (check)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed team as check-mode baseline (prerequisite for check)
-      ansible.platform.team:
-        config:
-          - "{{ prepare_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/team/check/verify.yml b/extensions/molecule/team/check/verify.yml
deleted file mode 100644
index c4c56b4d..00000000
--- a/extensions/molecule/team/check/verify.yml
+++ /dev/null
@@ -1,27 +0,0 @@
----
-- name: "Verify — team (check)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather team (check mode must not have applied changes)
-      ansible.platform.team:
-        config:
-          - name: "{{ expected_config.name }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert int-team-alpha still has prepare_config values (check did not apply)
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length > 0
-          - (gathered.gathered | first).description == prepare_config.description
-        fail_msg: "check mode should not alter resource. got: {{ gathered.gathered }}"
-
-...
diff --git a/extensions/molecule/team/deleted/cleanup.yml b/extensions/molecule/team/deleted/cleanup.yml
deleted file mode 100644
index f8ec8eb1..00000000
--- a/extensions/molecule/team/deleted/cleanup.yml
+++ /dev/null
@@ -1,12 +0,0 @@
----
-- name: "Cleanup — team (deleted)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: No-op — int-team-alpha already deleted by converge
-      ansible.builtin.debug:
-        msg: "int-team-alpha was deleted in converge — nothing to clean up"
-
-...
diff --git a/extensions/molecule/team/deleted/converge.yml b/extensions/molecule/team/deleted/converge.yml
deleted file mode 100644
index d1333388..00000000
--- a/extensions/molecule/team/deleted/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — team (deleted)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.team with state=deleted
-      ansible.platform.team:
-        config:
-          - "{{ expected_config }}"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/team/deleted/prepare.yml b/extensions/molecule/team/deleted/prepare.yml
deleted file mode 100644
index de701f48..00000000
--- a/extensions/molecule/team/deleted/prepare.yml
+++ /dev/null
@@ -1,18 +0,0 @@
----
-- name: "Prepare — team (deleted)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed team to be deleted (prerequisite for deleted)
-      ansible.platform.team:
-        config:
-          - "{{ prepare_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/team/deleted/verify.yml b/extensions/molecule/team/deleted/verify.yml
deleted file mode 100644
index 8ee1ebc9..00000000
--- a/extensions/molecule/team/deleted/verify.yml
+++ /dev/null
@@ -1,26 +0,0 @@
----
-- name: "Verify — team (deleted)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather team (should be absent after deleted)
-      ansible.platform.team:
-        config:
-          - name: "int-team-alpha"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert int-team-alpha no longer exists (deleted)
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length == 0
-        fail_msg: "Expected empty after deleted, got: {{ gathered.gathered }}"
-
-...
diff --git a/extensions/molecule/team/gathered/cleanup.yml b/extensions/molecule/team/gathered/cleanup.yml
deleted file mode 100644
index 323248f2..00000000
--- a/extensions/molecule/team/gathered/cleanup.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Cleanup — team (gathered)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove int-team-alpha (test teardown)
-      ansible.platform.team:
-        config:
-          - name: "int-team-alpha"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/team/gathered/converge.yml b/extensions/molecule/team/gathered/converge.yml
deleted file mode 100644
index 1e73247a..00000000
--- a/extensions/molecule/team/gathered/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — team (gathered)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.team with state=gathered
-      ansible.platform.team:
-        config:
-          - "{{ expected_config }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/team/gathered/prepare.yml b/extensions/molecule/team/gathered/prepare.yml
deleted file mode 100644
index e8b670f7..00000000
--- a/extensions/molecule/team/gathered/prepare.yml
+++ /dev/null
@@ -1,18 +0,0 @@
----
-- name: "Prepare — team (gathered)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed team to be gathered (prerequisite for gathered)
-      ansible.platform.team:
-        config:
-          - "{{ prepare_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/team/gathered/verify.yml b/extensions/molecule/team/gathered/verify.yml
deleted file mode 100644
index 53feaf66..00000000
--- a/extensions/molecule/team/gathered/verify.yml
+++ /dev/null
@@ -1,26 +0,0 @@
----
-- name: "Verify — team (gathered)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather team (assert present after gathered)
-      ansible.platform.team:
-        config:
-          - name: "{{ expected_config.name }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert configuration exists after gathered
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length > 0
-        fail_msg: "Expected resource after gathered. got: {{ gathered.gathered }}"
-
-...
diff --git a/extensions/molecule/team/merged/cleanup.yml b/extensions/molecule/team/merged/cleanup.yml
deleted file mode 100644
index 09bae7fc..00000000
--- a/extensions/molecule/team/merged/cleanup.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Cleanup — team (merged)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove int-team-alpha (test teardown)
-      ansible.platform.team:
-        config:
-          - name: "int-team-alpha"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/team/merged/converge.yml b/extensions/molecule/team/merged/converge.yml
deleted file mode 100644
index c1ce8240..00000000
--- a/extensions/molecule/team/merged/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — team (merged)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.team with state=merged
-      ansible.platform.team:
-        config:
-          - "{{ expected_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/team/merged/verify.yml b/extensions/molecule/team/merged/verify.yml
deleted file mode 100644
index bc607fbb..00000000
--- a/extensions/molecule/team/merged/verify.yml
+++ /dev/null
@@ -1,26 +0,0 @@
----
-- name: "Verify — team (merged)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather team (assert present after merged)
-      ansible.platform.team:
-        config:
-          - name: "{{ expected_config.name }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert configuration exists after merged
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length > 0
-        fail_msg: "Expected resource after merged. got: {{ gathered.gathered }}"
-
-...
diff --git a/extensions/molecule/team/overridden/cleanup.yml b/extensions/molecule/team/overridden/cleanup.yml
deleted file mode 100644
index e4349cac..00000000
--- a/extensions/molecule/team/overridden/cleanup.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Cleanup — team (overridden)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove int-team-alpha (test teardown)
-      ansible.platform.team:
-        config:
-          - name: "int-team-alpha"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/team/overridden/converge.yml b/extensions/molecule/team/overridden/converge.yml
deleted file mode 100644
index 1d9b35c6..00000000
--- a/extensions/molecule/team/overridden/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — team (overridden)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.team with state=overridden
-      ansible.platform.team:
-        config:
-          - "{{ expected_config }}"
-        state: overridden
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/team/overridden/prepare.yml b/extensions/molecule/team/overridden/prepare.yml
deleted file mode 100644
index f1fcfd32..00000000
--- a/extensions/molecule/team/overridden/prepare.yml
+++ /dev/null
@@ -1,17 +0,0 @@
----
-- name: "Prepare — team (overridden)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed prerequisite resources via merged (r0 + r1 + extras for overridden)
-      ansible.platform.team:
-        config: "{{ prepare_configs }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/team/overridden/verify.yml b/extensions/molecule/team/overridden/verify.yml
deleted file mode 100644
index 2938a3e5..00000000
--- a/extensions/molecule/team/overridden/verify.yml
+++ /dev/null
@@ -1,31 +0,0 @@
----
-- name: "Verify — team (overridden)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather all team resources (verify overridden final state)
-      ansible.platform.team:
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered_all
-
-    - name: Assert int-team-alpha still exists after overridden
-      ansible.builtin.assert:
-        that:
-          - gathered_all.gathered is defined
-          - gathered_all.gathered | selectattr("name", "equalto", "int-team-alpha") | list | length == 1
-        fail_msg: "Expected int-team-alpha to exist after overridden. got: {{ gathered_all.gathered }}"
-
-    - name: Assert int-team-beta was deleted by overridden (not in desired config)
-      ansible.builtin.assert:
-        that:
-          - gathered_all.gathered is defined
-          - gathered_all.gathered | selectattr("name", "equalto", "int-team-beta") | list | length == 0
-        fail_msg: "overridden should have deleted int-team-beta. got: {{ gathered_all.gathered }}"
-
-...
diff --git a/extensions/molecule/team/replaced/cleanup.yml b/extensions/molecule/team/replaced/cleanup.yml
deleted file mode 100644
index cd1a45f4..00000000
--- a/extensions/molecule/team/replaced/cleanup.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Cleanup — team (replaced)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove int-team-alpha (test teardown)
-      ansible.platform.team:
-        config:
-          - name: "int-team-alpha"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/team/replaced/converge.yml b/extensions/molecule/team/replaced/converge.yml
deleted file mode 100644
index 092e3fc3..00000000
--- a/extensions/molecule/team/replaced/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — team (replaced)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.team with state=replaced
-      ansible.platform.team:
-        config:
-          - "{{ expected_config }}"
-        state: replaced
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/team/replaced/prepare.yml b/extensions/molecule/team/replaced/prepare.yml
deleted file mode 100644
index a1ad16e7..00000000
--- a/extensions/molecule/team/replaced/prepare.yml
+++ /dev/null
@@ -1,18 +0,0 @@
----
-- name: "Prepare — team (replaced)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed team to be replaced (prerequisite for replaced)
-      ansible.platform.team:
-        config:
-          - "{{ prepare_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/team/replaced/verify.yml b/extensions/molecule/team/replaced/verify.yml
deleted file mode 100644
index de9a66c0..00000000
--- a/extensions/molecule/team/replaced/verify.yml
+++ /dev/null
@@ -1,32 +0,0 @@
----
-- name: "Verify — team (replaced)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather team (assert present after replaced)
-      ansible.platform.team:
-        config:
-          - name: "{{ expected_config.name }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert configuration exists after replaced
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length > 0
-        fail_msg: "Expected resource after replaced. got: {{ gathered.gathered }}"
-
-    - name: Assert description was updated by replaced
-      ansible.builtin.assert:
-        that:
-          - (gathered.gathered | first).description == expected_config.description
-        fail_msg: "replaced should have set description='Alpha team replaced'. got: {{ (gathered.gathered | first).description }}"
-
-...
diff --git a/extensions/molecule/teams/check/cleanup.yml b/extensions/molecule/teams/check/cleanup.yml
new file mode 100644
index 00000000..82563349
--- /dev/null
+++ b/extensions/molecule/teams/check/cleanup.yml
@@ -0,0 +1,19 @@
+---
+- name: "Cleanup — teams (check)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove int-team-alpha (test teardown)
+      ansible.platform.teams:
+        config:
+          - name: "int-team-alpha"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/teams/check/converge.yml b/extensions/molecule/teams/check/converge.yml
new file mode 100644
index 00000000..f11e0249
--- /dev/null
+++ b/extensions/molecule/teams/check/converge.yml
@@ -0,0 +1,36 @@
+---
+- name: "Converge — teams (check)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.teams with state=merged
+      ansible.platform.teams:
+        config:
+          - "{{ expected_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      check_mode: true
+      diff: true
+      register: result
+
+    - name: Assert check mode predicted a change
+      ansible.builtin.assert:
+        that:
+          - result.changed == true
+          - result.before is defined
+          - result.after is defined
+        fail_msg: "check mode should predict a change. got={{ result }}"
+
+    - name: Assert diff output is present
+      ansible.builtin.assert:
+        that:
+          - result.diff is defined
+        fail_msg: "diff output missing from check result"
+      when: result.diff is defined
+
+...
diff --git a/extensions/molecule/team/check/molecule.yml b/extensions/molecule/teams/check/molecule.yml
similarity index 100%
rename from extensions/molecule/team/check/molecule.yml
rename to extensions/molecule/teams/check/molecule.yml
diff --git a/extensions/molecule/teams/check/prepare.yml b/extensions/molecule/teams/check/prepare.yml
new file mode 100644
index 00000000..9f5e99b0
--- /dev/null
+++ b/extensions/molecule/teams/check/prepare.yml
@@ -0,0 +1,18 @@
+---
+- name: "Prepare — teams (check)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed teams as check-mode baseline (prerequisite for check)
+      ansible.platform.teams:
+        config:
+          - "{{ prepare_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/team/check/vars.yml b/extensions/molecule/teams/check/vars.yml
similarity index 100%
rename from extensions/molecule/team/check/vars.yml
rename to extensions/molecule/teams/check/vars.yml
diff --git a/extensions/molecule/teams/check/verify.yml b/extensions/molecule/teams/check/verify.yml
new file mode 100644
index 00000000..d1d40595
--- /dev/null
+++ b/extensions/molecule/teams/check/verify.yml
@@ -0,0 +1,27 @@
+---
+- name: "Verify — teams (check)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather teams (check mode must not have applied changes)
+      ansible.platform.teams:
+        config:
+          - name: "{{ expected_config.name }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert int-team-alpha still has prepare_config values (check did not apply)
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length > 0
+          - (gathered.gathered | first).description == prepare_config.description
+        fail_msg: "check mode should not alter resource. got: {{ gathered.gathered }}"
+
+...
diff --git a/extensions/molecule/teams/deleted/cleanup.yml b/extensions/molecule/teams/deleted/cleanup.yml
new file mode 100644
index 00000000..105d82c3
--- /dev/null
+++ b/extensions/molecule/teams/deleted/cleanup.yml
@@ -0,0 +1,12 @@
+---
+- name: "Cleanup — teams (deleted)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: No-op — int-team-alpha already deleted by converge
+      ansible.builtin.debug:
+        msg: "int-team-alpha was deleted in converge — nothing to clean up"
+
+...
diff --git a/extensions/molecule/teams/deleted/converge.yml b/extensions/molecule/teams/deleted/converge.yml
new file mode 100644
index 00000000..c73a92ff
--- /dev/null
+++ b/extensions/molecule/teams/deleted/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — teams (deleted)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.teams with state=deleted
+      ansible.platform.teams:
+        config:
+          - "{{ expected_config }}"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/team/deleted/molecule.yml b/extensions/molecule/teams/deleted/molecule.yml
similarity index 100%
rename from extensions/molecule/team/deleted/molecule.yml
rename to extensions/molecule/teams/deleted/molecule.yml
diff --git a/extensions/molecule/teams/deleted/prepare.yml b/extensions/molecule/teams/deleted/prepare.yml
new file mode 100644
index 00000000..1ff20006
--- /dev/null
+++ b/extensions/molecule/teams/deleted/prepare.yml
@@ -0,0 +1,18 @@
+---
+- name: "Prepare — teams (deleted)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed teams to be deleted (prerequisite for deleted)
+      ansible.platform.teams:
+        config:
+          - "{{ prepare_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/team/deleted/vars.yml b/extensions/molecule/teams/deleted/vars.yml
similarity index 100%
rename from extensions/molecule/team/deleted/vars.yml
rename to extensions/molecule/teams/deleted/vars.yml
diff --git a/extensions/molecule/teams/deleted/verify.yml b/extensions/molecule/teams/deleted/verify.yml
new file mode 100644
index 00000000..942058ec
--- /dev/null
+++ b/extensions/molecule/teams/deleted/verify.yml
@@ -0,0 +1,26 @@
+---
+- name: "Verify — teams (deleted)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather teams (should be absent after deleted)
+      ansible.platform.teams:
+        config:
+          - name: "int-team-alpha"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert int-team-alpha no longer exists (deleted)
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length == 0
+        fail_msg: "Expected empty after deleted, got: {{ gathered.gathered }}"
+
+...
diff --git a/extensions/molecule/teams/gathered/cleanup.yml b/extensions/molecule/teams/gathered/cleanup.yml
new file mode 100644
index 00000000..bb0c745a
--- /dev/null
+++ b/extensions/molecule/teams/gathered/cleanup.yml
@@ -0,0 +1,19 @@
+---
+- name: "Cleanup — teams (gathered)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove int-team-alpha (test teardown)
+      ansible.platform.teams:
+        config:
+          - name: "int-team-alpha"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/teams/gathered/converge.yml b/extensions/molecule/teams/gathered/converge.yml
new file mode 100644
index 00000000..d2644a0e
--- /dev/null
+++ b/extensions/molecule/teams/gathered/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — teams (gathered)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.teams with state=gathered
+      ansible.platform.teams:
+        config:
+          - "{{ expected_config }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/team/gathered/molecule.yml b/extensions/molecule/teams/gathered/molecule.yml
similarity index 100%
rename from extensions/molecule/team/gathered/molecule.yml
rename to extensions/molecule/teams/gathered/molecule.yml
diff --git a/extensions/molecule/teams/gathered/prepare.yml b/extensions/molecule/teams/gathered/prepare.yml
new file mode 100644
index 00000000..272d54b5
--- /dev/null
+++ b/extensions/molecule/teams/gathered/prepare.yml
@@ -0,0 +1,18 @@
+---
+- name: "Prepare — teams (gathered)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed teams to be gathered (prerequisite for gathered)
+      ansible.platform.teams:
+        config:
+          - "{{ prepare_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/team/gathered/vars.yml b/extensions/molecule/teams/gathered/vars.yml
similarity index 100%
rename from extensions/molecule/team/gathered/vars.yml
rename to extensions/molecule/teams/gathered/vars.yml
diff --git a/extensions/molecule/teams/gathered/verify.yml b/extensions/molecule/teams/gathered/verify.yml
new file mode 100644
index 00000000..c3cbb53d
--- /dev/null
+++ b/extensions/molecule/teams/gathered/verify.yml
@@ -0,0 +1,26 @@
+---
+- name: "Verify — teams (gathered)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather teams (assert present after gathered)
+      ansible.platform.teams:
+        config:
+          - name: "{{ expected_config.name }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert configuration exists after gathered
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length > 0
+        fail_msg: "Expected resource after gathered. got: {{ gathered.gathered }}"
+
+...
diff --git a/extensions/molecule/team/inventory.yml b/extensions/molecule/teams/inventory.yml
similarity index 100%
rename from extensions/molecule/team/inventory.yml
rename to extensions/molecule/teams/inventory.yml
diff --git a/extensions/molecule/teams/merged/cleanup.yml b/extensions/molecule/teams/merged/cleanup.yml
new file mode 100644
index 00000000..be68227e
--- /dev/null
+++ b/extensions/molecule/teams/merged/cleanup.yml
@@ -0,0 +1,19 @@
+---
+- name: "Cleanup — teams (merged)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove int-team-alpha (test teardown)
+      ansible.platform.teams:
+        config:
+          - name: "int-team-alpha"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/teams/merged/converge.yml b/extensions/molecule/teams/merged/converge.yml
new file mode 100644
index 00000000..c798b886
--- /dev/null
+++ b/extensions/molecule/teams/merged/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — teams (merged)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.teams with state=merged
+      ansible.platform.teams:
+        config:
+          - "{{ expected_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/team/merged/molecule.yml b/extensions/molecule/teams/merged/molecule.yml
similarity index 100%
rename from extensions/molecule/team/merged/molecule.yml
rename to extensions/molecule/teams/merged/molecule.yml
diff --git a/extensions/molecule/team/merged/vars.yml b/extensions/molecule/teams/merged/vars.yml
similarity index 100%
rename from extensions/molecule/team/merged/vars.yml
rename to extensions/molecule/teams/merged/vars.yml
diff --git a/extensions/molecule/teams/merged/verify.yml b/extensions/molecule/teams/merged/verify.yml
new file mode 100644
index 00000000..3cefe839
--- /dev/null
+++ b/extensions/molecule/teams/merged/verify.yml
@@ -0,0 +1,26 @@
+---
+- name: "Verify — teams (merged)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather teams (assert present after merged)
+      ansible.platform.teams:
+        config:
+          - name: "{{ expected_config.name }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert configuration exists after merged
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length > 0
+        fail_msg: "Expected resource after merged. got: {{ gathered.gathered }}"
+
+...
diff --git a/extensions/molecule/teams/overridden/cleanup.yml b/extensions/molecule/teams/overridden/cleanup.yml
new file mode 100644
index 00000000..152e9730
--- /dev/null
+++ b/extensions/molecule/teams/overridden/cleanup.yml
@@ -0,0 +1,19 @@
+---
+- name: "Cleanup — teams (overridden)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove int-team-alpha (test teardown)
+      ansible.platform.teams:
+        config:
+          - name: "int-team-alpha"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/teams/overridden/converge.yml b/extensions/molecule/teams/overridden/converge.yml
new file mode 100644
index 00000000..474e6077
--- /dev/null
+++ b/extensions/molecule/teams/overridden/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — teams (overridden)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.teams with state=overridden
+      ansible.platform.teams:
+        config:
+          - "{{ expected_config }}"
+        state: overridden
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/team/overridden/molecule.yml b/extensions/molecule/teams/overridden/molecule.yml
similarity index 100%
rename from extensions/molecule/team/overridden/molecule.yml
rename to extensions/molecule/teams/overridden/molecule.yml
diff --git a/extensions/molecule/teams/overridden/prepare.yml b/extensions/molecule/teams/overridden/prepare.yml
new file mode 100644
index 00000000..25cf603b
--- /dev/null
+++ b/extensions/molecule/teams/overridden/prepare.yml
@@ -0,0 +1,17 @@
+---
+- name: "Prepare — teams (overridden)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed prerequisite resources via merged (r0 + r1 + extras for overridden)
+      ansible.platform.teams:
+        config: "{{ prepare_configs }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/team/overridden/vars.yml b/extensions/molecule/teams/overridden/vars.yml
similarity index 100%
rename from extensions/molecule/team/overridden/vars.yml
rename to extensions/molecule/teams/overridden/vars.yml
diff --git a/extensions/molecule/teams/overridden/verify.yml b/extensions/molecule/teams/overridden/verify.yml
new file mode 100644
index 00000000..021fc8b0
--- /dev/null
+++ b/extensions/molecule/teams/overridden/verify.yml
@@ -0,0 +1,31 @@
+---
+- name: "Verify — teams (overridden)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather all teams resources (verify overridden final state)
+      ansible.platform.teams:
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered_all
+
+    - name: Assert int-team-alpha still exists after overridden
+      ansible.builtin.assert:
+        that:
+          - gathered_all.gathered is defined
+          - gathered_all.gathered | selectattr("name", "equalto", "int-team-alpha") | list | length == 1
+        fail_msg: "Expected int-team-alpha to exist after overridden. got: {{ gathered_all.gathered }}"
+
+    - name: Assert int-team-beta was deleted by overridden (not in desired config)
+      ansible.builtin.assert:
+        that:
+          - gathered_all.gathered is defined
+          - gathered_all.gathered | selectattr("name", "equalto", "int-team-beta") | list | length == 0
+        fail_msg: "overridden should have deleted int-team-beta. got: {{ gathered_all.gathered }}"
+
+...
diff --git a/extensions/molecule/teams/replaced/cleanup.yml b/extensions/molecule/teams/replaced/cleanup.yml
new file mode 100644
index 00000000..ff9d4a72
--- /dev/null
+++ b/extensions/molecule/teams/replaced/cleanup.yml
@@ -0,0 +1,19 @@
+---
+- name: "Cleanup — teams (replaced)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove int-team-alpha (test teardown)
+      ansible.platform.teams:
+        config:
+          - name: "int-team-alpha"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/teams/replaced/converge.yml b/extensions/molecule/teams/replaced/converge.yml
new file mode 100644
index 00000000..9af5eb15
--- /dev/null
+++ b/extensions/molecule/teams/replaced/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — teams (replaced)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.teams with state=replaced
+      ansible.platform.teams:
+        config:
+          - "{{ expected_config }}"
+        state: replaced
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/team/replaced/molecule.yml b/extensions/molecule/teams/replaced/molecule.yml
similarity index 100%
rename from extensions/molecule/team/replaced/molecule.yml
rename to extensions/molecule/teams/replaced/molecule.yml
diff --git a/extensions/molecule/teams/replaced/prepare.yml b/extensions/molecule/teams/replaced/prepare.yml
new file mode 100644
index 00000000..a9da08d8
--- /dev/null
+++ b/extensions/molecule/teams/replaced/prepare.yml
@@ -0,0 +1,18 @@
+---
+- name: "Prepare — teams (replaced)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed teams to be replaced (prerequisite for replaced)
+      ansible.platform.teams:
+        config:
+          - "{{ prepare_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/team/replaced/vars.yml b/extensions/molecule/teams/replaced/vars.yml
similarity index 100%
rename from extensions/molecule/team/replaced/vars.yml
rename to extensions/molecule/teams/replaced/vars.yml
diff --git a/extensions/molecule/teams/replaced/verify.yml b/extensions/molecule/teams/replaced/verify.yml
new file mode 100644
index 00000000..248d65e7
--- /dev/null
+++ b/extensions/molecule/teams/replaced/verify.yml
@@ -0,0 +1,32 @@
+---
+- name: "Verify — teams (replaced)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather teams (assert present after replaced)
+      ansible.platform.teams:
+        config:
+          - name: "{{ expected_config.name }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert configuration exists after replaced
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length > 0
+        fail_msg: "Expected resource after replaced. got: {{ gathered.gathered }}"
+
+    - name: Assert description was updated by replaced
+      ansible.builtin.assert:
+        that:
+          - (gathered.gathered | first).description == expected_config.description
+        fail_msg: "replaced should have set description='Alpha team replaced'. got: {{ (gathered.gathered | first).description }}"
+
+...
diff --git a/extensions/molecule/token/check/cleanup.yml b/extensions/molecule/token/check/cleanup.yml
deleted file mode 100644
index 40d240fd..00000000
--- a/extensions/molecule/token/check/cleanup.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Cleanup — token (check)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove Alpha token (test teardown)
-      ansible.platform.token:
-        config:
-          - description: "Alpha token"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/token/check/converge.yml b/extensions/molecule/token/check/converge.yml
deleted file mode 100644
index ebc24743..00000000
--- a/extensions/molecule/token/check/converge.yml
+++ /dev/null
@@ -1,36 +0,0 @@
----
-- name: "Converge — token (check)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.token with state=merged
-      ansible.platform.token:
-        config:
-          - "{{ expected_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      check_mode: true
-      diff: true
-      register: result
-
-    - name: Assert check mode predicted a change
-      ansible.builtin.assert:
-        that:
-          - result.changed == true
-          - result.before is defined
-          - result.after is defined
-        fail_msg: "check mode should predict a change. got={{ result }}"
-
-    - name: Assert diff output is present
-      ansible.builtin.assert:
-        that:
-          - result.diff is defined
-        fail_msg: "diff output missing from check result"
-      when: result.diff is defined
-
-...
diff --git a/extensions/molecule/token/check/prepare.yml b/extensions/molecule/token/check/prepare.yml
deleted file mode 100644
index 66cefc72..00000000
--- a/extensions/molecule/token/check/prepare.yml
+++ /dev/null
@@ -1,18 +0,0 @@
----
-- name: "Prepare — token (check)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed token as check-mode baseline (prerequisite for check)
-      ansible.platform.token:
-        config:
-          - "{{ prepare_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/token/check/verify.yml b/extensions/molecule/token/check/verify.yml
deleted file mode 100644
index 3fe4a0d9..00000000
--- a/extensions/molecule/token/check/verify.yml
+++ /dev/null
@@ -1,27 +0,0 @@
----
-- name: "Verify — token (check)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather token (check mode must not have applied changes)
-      ansible.platform.token:
-        config:
-          - description: "{{ expected_config.description }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert Alpha token still has prepare_config values (check did not apply)
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length > 0
-          - (gathered.gathered | first).scope == prepare_config.scope
-        fail_msg: "check mode should not alter resource. got: {{ gathered.gathered }}"
-
-...
diff --git a/extensions/molecule/token/deleted/cleanup.yml b/extensions/molecule/token/deleted/cleanup.yml
deleted file mode 100644
index 386fe984..00000000
--- a/extensions/molecule/token/deleted/cleanup.yml
+++ /dev/null
@@ -1,12 +0,0 @@
----
-- name: "Cleanup — token (deleted)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: No-op — Alpha token already deleted by converge
-      ansible.builtin.debug:
-        msg: "Alpha token was deleted in converge — nothing to clean up"
-
-...
diff --git a/extensions/molecule/token/deleted/converge.yml b/extensions/molecule/token/deleted/converge.yml
deleted file mode 100644
index d7ce7a45..00000000
--- a/extensions/molecule/token/deleted/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — token (deleted)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.token with state=deleted
-      ansible.platform.token:
-        config:
-          - "{{ expected_config }}"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/token/deleted/prepare.yml b/extensions/molecule/token/deleted/prepare.yml
deleted file mode 100644
index a93c814b..00000000
--- a/extensions/molecule/token/deleted/prepare.yml
+++ /dev/null
@@ -1,18 +0,0 @@
----
-- name: "Prepare — token (deleted)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed token to be deleted (prerequisite for deleted)
-      ansible.platform.token:
-        config:
-          - "{{ prepare_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/token/deleted/verify.yml b/extensions/molecule/token/deleted/verify.yml
deleted file mode 100644
index c0f4f7cf..00000000
--- a/extensions/molecule/token/deleted/verify.yml
+++ /dev/null
@@ -1,26 +0,0 @@
----
-- name: "Verify — token (deleted)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather token (should be absent after deleted)
-      ansible.platform.token:
-        config:
-          - description: "Alpha token"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert Alpha token no longer exists (deleted)
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length == 0
-        fail_msg: "Expected empty after deleted, got: {{ gathered.gathered }}"
-
-...
diff --git a/extensions/molecule/token/gathered/cleanup.yml b/extensions/molecule/token/gathered/cleanup.yml
deleted file mode 100644
index 8189b65c..00000000
--- a/extensions/molecule/token/gathered/cleanup.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Cleanup — token (gathered)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove Alpha token (test teardown)
-      ansible.platform.token:
-        config:
-          - description: "Alpha token"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/token/gathered/converge.yml b/extensions/molecule/token/gathered/converge.yml
deleted file mode 100644
index b916faac..00000000
--- a/extensions/molecule/token/gathered/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — token (gathered)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.token with state=gathered
-      ansible.platform.token:
-        config:
-          - "{{ expected_config }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/token/gathered/prepare.yml b/extensions/molecule/token/gathered/prepare.yml
deleted file mode 100644
index 9c8891cc..00000000
--- a/extensions/molecule/token/gathered/prepare.yml
+++ /dev/null
@@ -1,18 +0,0 @@
----
-- name: "Prepare — token (gathered)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed token to be gathered (prerequisite for gathered)
-      ansible.platform.token:
-        config:
-          - "{{ prepare_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/token/gathered/verify.yml b/extensions/molecule/token/gathered/verify.yml
deleted file mode 100644
index abd5008e..00000000
--- a/extensions/molecule/token/gathered/verify.yml
+++ /dev/null
@@ -1,26 +0,0 @@
----
-- name: "Verify — token (gathered)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather token (assert present after gathered)
-      ansible.platform.token:
-        config:
-          - description: "{{ expected_config.description }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert configuration exists after gathered
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length > 0
-        fail_msg: "Expected resource after gathered. got: {{ gathered.gathered }}"
-
-...
diff --git a/extensions/molecule/token/merged/cleanup.yml b/extensions/molecule/token/merged/cleanup.yml
deleted file mode 100644
index 1828a4fa..00000000
--- a/extensions/molecule/token/merged/cleanup.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Cleanup — token (merged)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove Alpha token (test teardown)
-      ansible.platform.token:
-        config:
-          - description: "Alpha token"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/token/merged/converge.yml b/extensions/molecule/token/merged/converge.yml
deleted file mode 100644
index 71ca6781..00000000
--- a/extensions/molecule/token/merged/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — token (merged)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.token with state=merged
-      ansible.platform.token:
-        config:
-          - "{{ expected_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/token/merged/verify.yml b/extensions/molecule/token/merged/verify.yml
deleted file mode 100644
index 13d87223..00000000
--- a/extensions/molecule/token/merged/verify.yml
+++ /dev/null
@@ -1,26 +0,0 @@
----
-- name: "Verify — token (merged)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather token (assert present after merged)
-      ansible.platform.token:
-        config:
-          - description: "{{ expected_config.description }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert configuration exists after merged
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length > 0
-        fail_msg: "Expected resource after merged. got: {{ gathered.gathered }}"
-
-...
diff --git a/extensions/molecule/token/overridden/.verify.yml.swp b/extensions/molecule/token/overridden/.verify.yml.swp
deleted file mode 100644
index 23fa71d9..00000000
Binary files a/extensions/molecule/token/overridden/.verify.yml.swp and /dev/null differ
diff --git a/extensions/molecule/token/overridden/cleanup.yml b/extensions/molecule/token/overridden/cleanup.yml
deleted file mode 100644
index 8bb05898..00000000
--- a/extensions/molecule/token/overridden/cleanup.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Cleanup — token (overridden)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove Alpha token (test teardown)
-      ansible.platform.token:
-        config:
-          - description: "Alpha token"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/token/overridden/converge.yml b/extensions/molecule/token/overridden/converge.yml
deleted file mode 100644
index 691328f9..00000000
--- a/extensions/molecule/token/overridden/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — token (overridden)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.token with state=overridden
-      ansible.platform.token:
-        config:
-          - "{{ expected_config }}"
-        state: overridden
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/token/overridden/prepare.yml b/extensions/molecule/token/overridden/prepare.yml
deleted file mode 100644
index 5d1c86a5..00000000
--- a/extensions/molecule/token/overridden/prepare.yml
+++ /dev/null
@@ -1,17 +0,0 @@
----
-- name: "Prepare — token (overridden)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed prerequisite resources via merged (r0 + r1 + extras for overridden)
-      ansible.platform.token:
-        config: "{{ prepare_configs }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/token/overridden/verify.yml b/extensions/molecule/token/overridden/verify.yml
deleted file mode 100644
index 99700703..00000000
--- a/extensions/molecule/token/overridden/verify.yml
+++ /dev/null
@@ -1,31 +0,0 @@
----
-- name: "Verify — token (overridden)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather all token resources (verify overridden final state)
-      ansible.platform.token:
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered_all
-
-    - name: Assert Alpha token still exists after overridden
-      ansible.builtin.assert:
-        that:
-          - gathered_all.gathered is defined
-          - gathered_all.gathered | selectattr("description", "equalto", "Alpha token") | list | length == 1
-        fail_msg: "Expected Alpha token to exist after overridden. got: {{ gathered_all.gathered }}"
-
-    - name: Assert Beta token was deleted by overridden (not in desired config)
-      ansible.builtin.assert:
-        that:
-          - gathered_all.gathered is defined
-          - gathered_all.gathered | selectattr("description", "equalto", "Beta token") | list | length == 0
-        fail_msg: "overridden should have deleted Beta token. got: {{ gathered_all.gathered }}"
-
-...
diff --git a/extensions/molecule/token/replaced/cleanup.yml b/extensions/molecule/token/replaced/cleanup.yml
deleted file mode 100644
index 85a95bc1..00000000
--- a/extensions/molecule/token/replaced/cleanup.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Cleanup — token (replaced)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove Alpha token (test teardown)
-      ansible.platform.token:
-        config:
-          - description: "Alpha token"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/token/replaced/converge.yml b/extensions/molecule/token/replaced/converge.yml
deleted file mode 100644
index f51c0ac2..00000000
--- a/extensions/molecule/token/replaced/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — token (replaced)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.token with state=replaced
-      ansible.platform.token:
-        config:
-          - "{{ expected_config }}"
-        state: replaced
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/token/replaced/prepare.yml b/extensions/molecule/token/replaced/prepare.yml
deleted file mode 100644
index 7aef514d..00000000
--- a/extensions/molecule/token/replaced/prepare.yml
+++ /dev/null
@@ -1,18 +0,0 @@
----
-- name: "Prepare — token (replaced)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed token to be replaced (prerequisite for replaced)
-      ansible.platform.token:
-        config:
-          - "{{ prepare_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/token/replaced/verify.yml b/extensions/molecule/token/replaced/verify.yml
deleted file mode 100644
index 3b0397e7..00000000
--- a/extensions/molecule/token/replaced/verify.yml
+++ /dev/null
@@ -1,32 +0,0 @@
----
-- name: "Verify — token (replaced)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather token (assert present after replaced)
-      ansible.platform.token:
-        config:
-          - description: "{{ expected_config.description }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert configuration exists after replaced
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length > 0
-        fail_msg: "Expected resource after replaced. got: {{ gathered.gathered }}"
-
-    - name: Assert scope was updated by replaced
-      ansible.builtin.assert:
-        that:
-          - (gathered.gathered | first).scope == expected_config.scope
-        fail_msg: "replaced should have set scope='read'. got: {{ (gathered.gathered | first).scope }}"
-
-...
diff --git a/extensions/molecule/tokens/check/cleanup.yml b/extensions/molecule/tokens/check/cleanup.yml
new file mode 100644
index 00000000..0dc6217d
--- /dev/null
+++ b/extensions/molecule/tokens/check/cleanup.yml
@@ -0,0 +1,19 @@
+---
+- name: "Cleanup — tokens (check)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove Alpha token (test teardown)
+      ansible.platform.tokens:
+        config:
+          - description: "Alpha token"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/tokens/check/converge.yml b/extensions/molecule/tokens/check/converge.yml
new file mode 100644
index 00000000..b58ba72c
--- /dev/null
+++ b/extensions/molecule/tokens/check/converge.yml
@@ -0,0 +1,36 @@
+---
+- name: "Converge — tokens (check)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.tokens with state=merged
+      ansible.platform.tokens:
+        config:
+          - "{{ expected_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      check_mode: true
+      diff: true
+      register: result
+
+    - name: Assert check mode predicted a change
+      ansible.builtin.assert:
+        that:
+          - result.changed == true
+          - result.before is defined
+          - result.after is defined
+        fail_msg: "check mode should predict a change. got={{ result }}"
+
+    - name: Assert diff output is present
+      ansible.builtin.assert:
+        that:
+          - result.diff is defined
+        fail_msg: "diff output missing from check result"
+      when: result.diff is defined
+
+...
diff --git a/extensions/molecule/token/check/molecule.yml b/extensions/molecule/tokens/check/molecule.yml
similarity index 100%
rename from extensions/molecule/token/check/molecule.yml
rename to extensions/molecule/tokens/check/molecule.yml
diff --git a/extensions/molecule/tokens/check/prepare.yml b/extensions/molecule/tokens/check/prepare.yml
new file mode 100644
index 00000000..98e56b03
--- /dev/null
+++ b/extensions/molecule/tokens/check/prepare.yml
@@ -0,0 +1,18 @@
+---
+- name: "Prepare — tokens (check)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed tokens as check-mode baseline (prerequisite for check)
+      ansible.platform.tokens:
+        config:
+          - "{{ prepare_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/token/check/vars.yml b/extensions/molecule/tokens/check/vars.yml
similarity index 100%
rename from extensions/molecule/token/check/vars.yml
rename to extensions/molecule/tokens/check/vars.yml
diff --git a/extensions/molecule/tokens/check/verify.yml b/extensions/molecule/tokens/check/verify.yml
new file mode 100644
index 00000000..2de74be0
--- /dev/null
+++ b/extensions/molecule/tokens/check/verify.yml
@@ -0,0 +1,27 @@
+---
+- name: "Verify — tokens (check)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather tokens (check mode must not have applied changes)
+      ansible.platform.tokens:
+        config:
+          - description: "{{ expected_config.description }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert Alpha token still has prepare_config values (check did not apply)
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length > 0
+          - (gathered.gathered | first).scope == prepare_config.scope
+        fail_msg: "check mode should not alter resource. got: {{ gathered.gathered }}"
+
+...
diff --git a/extensions/molecule/tokens/deleted/cleanup.yml b/extensions/molecule/tokens/deleted/cleanup.yml
new file mode 100644
index 00000000..47b2a266
--- /dev/null
+++ b/extensions/molecule/tokens/deleted/cleanup.yml
@@ -0,0 +1,12 @@
+---
+- name: "Cleanup — tokens (deleted)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: No-op — Alpha token already deleted by converge
+      ansible.builtin.debug:
+        msg: "Alpha token was deleted in converge — nothing to clean up"
+
+...
diff --git a/extensions/molecule/tokens/deleted/converge.yml b/extensions/molecule/tokens/deleted/converge.yml
new file mode 100644
index 00000000..fa0bc7cb
--- /dev/null
+++ b/extensions/molecule/tokens/deleted/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — tokens (deleted)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.tokens with state=deleted
+      ansible.platform.tokens:
+        config:
+          - "{{ expected_config }}"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/token/deleted/molecule.yml b/extensions/molecule/tokens/deleted/molecule.yml
similarity index 100%
rename from extensions/molecule/token/deleted/molecule.yml
rename to extensions/molecule/tokens/deleted/molecule.yml
diff --git a/extensions/molecule/tokens/deleted/prepare.yml b/extensions/molecule/tokens/deleted/prepare.yml
new file mode 100644
index 00000000..8f3b6f46
--- /dev/null
+++ b/extensions/molecule/tokens/deleted/prepare.yml
@@ -0,0 +1,18 @@
+---
+- name: "Prepare — tokens (deleted)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed tokens to be deleted (prerequisite for deleted)
+      ansible.platform.tokens:
+        config:
+          - "{{ prepare_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/token/deleted/vars.yml b/extensions/molecule/tokens/deleted/vars.yml
similarity index 100%
rename from extensions/molecule/token/deleted/vars.yml
rename to extensions/molecule/tokens/deleted/vars.yml
diff --git a/extensions/molecule/tokens/deleted/verify.yml b/extensions/molecule/tokens/deleted/verify.yml
new file mode 100644
index 00000000..0fd99d3f
--- /dev/null
+++ b/extensions/molecule/tokens/deleted/verify.yml
@@ -0,0 +1,26 @@
+---
+- name: "Verify — tokens (deleted)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather tokens (should be absent after deleted)
+      ansible.platform.tokens:
+        config:
+          - description: "Alpha token"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert Alpha token no longer exists (deleted)
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length == 0
+        fail_msg: "Expected empty after deleted, got: {{ gathered.gathered }}"
+
+...
diff --git a/extensions/molecule/tokens/gathered/cleanup.yml b/extensions/molecule/tokens/gathered/cleanup.yml
new file mode 100644
index 00000000..718511f4
--- /dev/null
+++ b/extensions/molecule/tokens/gathered/cleanup.yml
@@ -0,0 +1,19 @@
+---
+- name: "Cleanup — tokens (gathered)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove Alpha token (test teardown)
+      ansible.platform.tokens:
+        config:
+          - description: "Alpha token"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/tokens/gathered/converge.yml b/extensions/molecule/tokens/gathered/converge.yml
new file mode 100644
index 00000000..2364d8f8
--- /dev/null
+++ b/extensions/molecule/tokens/gathered/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — tokens (gathered)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.tokens with state=gathered
+      ansible.platform.tokens:
+        config:
+          - "{{ expected_config }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/token/gathered/molecule.yml b/extensions/molecule/tokens/gathered/molecule.yml
similarity index 100%
rename from extensions/molecule/token/gathered/molecule.yml
rename to extensions/molecule/tokens/gathered/molecule.yml
diff --git a/extensions/molecule/tokens/gathered/prepare.yml b/extensions/molecule/tokens/gathered/prepare.yml
new file mode 100644
index 00000000..6768fd6d
--- /dev/null
+++ b/extensions/molecule/tokens/gathered/prepare.yml
@@ -0,0 +1,18 @@
+---
+- name: "Prepare — tokens (gathered)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed tokens to be gathered (prerequisite for gathered)
+      ansible.platform.tokens:
+        config:
+          - "{{ prepare_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/token/gathered/vars.yml b/extensions/molecule/tokens/gathered/vars.yml
similarity index 100%
rename from extensions/molecule/token/gathered/vars.yml
rename to extensions/molecule/tokens/gathered/vars.yml
diff --git a/extensions/molecule/tokens/gathered/verify.yml b/extensions/molecule/tokens/gathered/verify.yml
new file mode 100644
index 00000000..962f426c
--- /dev/null
+++ b/extensions/molecule/tokens/gathered/verify.yml
@@ -0,0 +1,26 @@
+---
+- name: "Verify — tokens (gathered)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather tokens (assert present after gathered)
+      ansible.platform.tokens:
+        config:
+          - description: "{{ expected_config.description }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert configuration exists after gathered
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length > 0
+        fail_msg: "Expected resource after gathered. got: {{ gathered.gathered }}"
+
+...
diff --git a/extensions/molecule/token/inventory.yml b/extensions/molecule/tokens/inventory.yml
similarity index 100%
rename from extensions/molecule/token/inventory.yml
rename to extensions/molecule/tokens/inventory.yml
diff --git a/extensions/molecule/tokens/merged/cleanup.yml b/extensions/molecule/tokens/merged/cleanup.yml
new file mode 100644
index 00000000..75004636
--- /dev/null
+++ b/extensions/molecule/tokens/merged/cleanup.yml
@@ -0,0 +1,19 @@
+---
+- name: "Cleanup — tokens (merged)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove Alpha token (test teardown)
+      ansible.platform.tokens:
+        config:
+          - description: "Alpha token"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/tokens/merged/converge.yml b/extensions/molecule/tokens/merged/converge.yml
new file mode 100644
index 00000000..e92fcaae
--- /dev/null
+++ b/extensions/molecule/tokens/merged/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — tokens (merged)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.tokens with state=merged
+      ansible.platform.tokens:
+        config:
+          - "{{ expected_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/token/merged/molecule.yml b/extensions/molecule/tokens/merged/molecule.yml
similarity index 100%
rename from extensions/molecule/token/merged/molecule.yml
rename to extensions/molecule/tokens/merged/molecule.yml
diff --git a/extensions/molecule/token/merged/vars.yml b/extensions/molecule/tokens/merged/vars.yml
similarity index 100%
rename from extensions/molecule/token/merged/vars.yml
rename to extensions/molecule/tokens/merged/vars.yml
diff --git a/extensions/molecule/tokens/merged/verify.yml b/extensions/molecule/tokens/merged/verify.yml
new file mode 100644
index 00000000..79fab4e8
--- /dev/null
+++ b/extensions/molecule/tokens/merged/verify.yml
@@ -0,0 +1,26 @@
+---
+- name: "Verify — tokens (merged)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather tokens (assert present after merged)
+      ansible.platform.tokens:
+        config:
+          - description: "{{ expected_config.description }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert configuration exists after merged
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length > 0
+        fail_msg: "Expected resource after merged. got: {{ gathered.gathered }}"
+
+...
diff --git a/extensions/molecule/tokens/overridden/cleanup.yml b/extensions/molecule/tokens/overridden/cleanup.yml
new file mode 100644
index 00000000..ba4e2644
--- /dev/null
+++ b/extensions/molecule/tokens/overridden/cleanup.yml
@@ -0,0 +1,19 @@
+---
+- name: "Cleanup — tokens (overridden)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove Alpha token (test teardown)
+      ansible.platform.tokens:
+        config:
+          - description: "Alpha token"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/tokens/overridden/converge.yml b/extensions/molecule/tokens/overridden/converge.yml
new file mode 100644
index 00000000..fd18bc23
--- /dev/null
+++ b/extensions/molecule/tokens/overridden/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — tokens (overridden)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.tokens with state=overridden
+      ansible.platform.tokens:
+        config:
+          - "{{ expected_config }}"
+        state: overridden
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/token/overridden/molecule.yml b/extensions/molecule/tokens/overridden/molecule.yml
similarity index 100%
rename from extensions/molecule/token/overridden/molecule.yml
rename to extensions/molecule/tokens/overridden/molecule.yml
diff --git a/extensions/molecule/tokens/overridden/prepare.yml b/extensions/molecule/tokens/overridden/prepare.yml
new file mode 100644
index 00000000..282e9ebc
--- /dev/null
+++ b/extensions/molecule/tokens/overridden/prepare.yml
@@ -0,0 +1,17 @@
+---
+- name: "Prepare — tokens (overridden)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed prerequisite resources via merged (r0 + r1 + extras for overridden)
+      ansible.platform.tokens:
+        config: "{{ prepare_configs }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/token/overridden/vars.yml b/extensions/molecule/tokens/overridden/vars.yml
similarity index 100%
rename from extensions/molecule/token/overridden/vars.yml
rename to extensions/molecule/tokens/overridden/vars.yml
diff --git a/extensions/molecule/tokens/overridden/verify.yml b/extensions/molecule/tokens/overridden/verify.yml
new file mode 100644
index 00000000..a90ea055
--- /dev/null
+++ b/extensions/molecule/tokens/overridden/verify.yml
@@ -0,0 +1,31 @@
+---
+- name: "Verify — tokens (overridden)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather all tokens resources (verify overridden final state)
+      ansible.platform.tokens:
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered_all
+
+    - name: Assert Alpha token still exists after overridden
+      ansible.builtin.assert:
+        that:
+          - gathered_all.gathered is defined
+          - gathered_all.gathered | selectattr("description", "equalto", "Alpha token") | list | length == 1
+        fail_msg: "Expected Alpha token to exist after overridden. got: {{ gathered_all.gathered }}"
+
+    - name: Assert Beta token was deleted by overridden (not in desired config)
+      ansible.builtin.assert:
+        that:
+          - gathered_all.gathered is defined
+          - gathered_all.gathered | selectattr("description", "equalto", "Beta token") | list | length == 0
+        fail_msg: "overridden should have deleted Beta token. got: {{ gathered_all.gathered }}"
+
+...
diff --git a/extensions/molecule/tokens/replaced/cleanup.yml b/extensions/molecule/tokens/replaced/cleanup.yml
new file mode 100644
index 00000000..bd20c215
--- /dev/null
+++ b/extensions/molecule/tokens/replaced/cleanup.yml
@@ -0,0 +1,19 @@
+---
+- name: "Cleanup — tokens (replaced)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove Alpha token (test teardown)
+      ansible.platform.tokens:
+        config:
+          - description: "Alpha token"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/tokens/replaced/converge.yml b/extensions/molecule/tokens/replaced/converge.yml
new file mode 100644
index 00000000..6a768e19
--- /dev/null
+++ b/extensions/molecule/tokens/replaced/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — tokens (replaced)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.tokens with state=replaced
+      ansible.platform.tokens:
+        config:
+          - "{{ expected_config }}"
+        state: replaced
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/token/replaced/molecule.yml b/extensions/molecule/tokens/replaced/molecule.yml
similarity index 100%
rename from extensions/molecule/token/replaced/molecule.yml
rename to extensions/molecule/tokens/replaced/molecule.yml
diff --git a/extensions/molecule/tokens/replaced/prepare.yml b/extensions/molecule/tokens/replaced/prepare.yml
new file mode 100644
index 00000000..ac59bd62
--- /dev/null
+++ b/extensions/molecule/tokens/replaced/prepare.yml
@@ -0,0 +1,18 @@
+---
+- name: "Prepare — tokens (replaced)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed tokens to be replaced (prerequisite for replaced)
+      ansible.platform.tokens:
+        config:
+          - "{{ prepare_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/token/replaced/vars.yml b/extensions/molecule/tokens/replaced/vars.yml
similarity index 100%
rename from extensions/molecule/token/replaced/vars.yml
rename to extensions/molecule/tokens/replaced/vars.yml
diff --git a/extensions/molecule/tokens/replaced/verify.yml b/extensions/molecule/tokens/replaced/verify.yml
new file mode 100644
index 00000000..c3024025
--- /dev/null
+++ b/extensions/molecule/tokens/replaced/verify.yml
@@ -0,0 +1,32 @@
+---
+- name: "Verify — tokens (replaced)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather tokens (assert present after replaced)
+      ansible.platform.tokens:
+        config:
+          - description: "{{ expected_config.description }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert configuration exists after replaced
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length > 0
+        fail_msg: "Expected resource after replaced. got: {{ gathered.gathered }}"
+
+    - name: Assert scope was updated by replaced
+      ansible.builtin.assert:
+        that:
+          - (gathered.gathered | first).scope == expected_config.scope
+        fail_msg: "replaced should have set scope='read'. got: {{ (gathered.gathered | first).scope }}"
+
+...
diff --git a/extensions/molecule/ui_plugin_route/check/cleanup.yml b/extensions/molecule/ui_plugin_route/check/cleanup.yml
deleted file mode 100644
index b06b10d8..00000000
--- a/extensions/molecule/ui_plugin_route/check/cleanup.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Cleanup — ui_plugin_route (check)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove int-uipr-alpha (test teardown)
-      ansible.platform.ui_plugin_route:
-        config:
-          - name: "int-uipr-alpha"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/ui_plugin_route/check/converge.yml b/extensions/molecule/ui_plugin_route/check/converge.yml
deleted file mode 100644
index ec7f6cc9..00000000
--- a/extensions/molecule/ui_plugin_route/check/converge.yml
+++ /dev/null
@@ -1,36 +0,0 @@
----
-- name: "Converge — ui_plugin_route (check)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.ui_plugin_route with state=merged
-      ansible.platform.ui_plugin_route:
-        config:
-          - "{{ expected_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      check_mode: true
-      diff: true
-      register: result
-
-    - name: Assert check mode predicted a change
-      ansible.builtin.assert:
-        that:
-          - result.changed == true
-          - result.before is defined
-          - result.after is defined
-        fail_msg: "check mode should predict a change. got={{ result }}"
-
-    - name: Assert diff output is present
-      ansible.builtin.assert:
-        that:
-          - result.diff is defined
-        fail_msg: "diff output missing from check result"
-      when: result.diff is defined
-
-...
diff --git a/extensions/molecule/ui_plugin_route/check/prepare.yml b/extensions/molecule/ui_plugin_route/check/prepare.yml
deleted file mode 100644
index 012e6fe5..00000000
--- a/extensions/molecule/ui_plugin_route/check/prepare.yml
+++ /dev/null
@@ -1,18 +0,0 @@
----
-- name: "Prepare — ui_plugin_route (check)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed ui_plugin_route as check-mode baseline (prerequisite for check)
-      ansible.platform.ui_plugin_route:
-        config:
-          - "{{ prepare_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/ui_plugin_route/check/verify.yml b/extensions/molecule/ui_plugin_route/check/verify.yml
deleted file mode 100644
index 3a6c7e84..00000000
--- a/extensions/molecule/ui_plugin_route/check/verify.yml
+++ /dev/null
@@ -1,27 +0,0 @@
----
-- name: "Verify — ui_plugin_route (check)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather ui_plugin_route (check mode must not have applied changes)
-      ansible.platform.ui_plugin_route:
-        config:
-          - name: "{{ expected_config.name }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert int-uipr-alpha still has prepare_config values (check did not apply)
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length > 0
-          - (gathered.gathered | first).description == prepare_config.description
-        fail_msg: "check mode should not alter resource. got: {{ gathered.gathered }}"
-
-...
diff --git a/extensions/molecule/ui_plugin_route/deleted/cleanup.yml b/extensions/molecule/ui_plugin_route/deleted/cleanup.yml
deleted file mode 100644
index a18701e7..00000000
--- a/extensions/molecule/ui_plugin_route/deleted/cleanup.yml
+++ /dev/null
@@ -1,12 +0,0 @@
----
-- name: "Cleanup — ui_plugin_route (deleted)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: No-op — int-uipr-alpha already deleted by converge
-      ansible.builtin.debug:
-        msg: "int-uipr-alpha was deleted in converge — nothing to clean up"
-
-...
diff --git a/extensions/molecule/ui_plugin_route/deleted/converge.yml b/extensions/molecule/ui_plugin_route/deleted/converge.yml
deleted file mode 100644
index 6d3174dc..00000000
--- a/extensions/molecule/ui_plugin_route/deleted/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — ui_plugin_route (deleted)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.ui_plugin_route with state=deleted
-      ansible.platform.ui_plugin_route:
-        config:
-          - "{{ expected_config }}"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/ui_plugin_route/deleted/prepare.yml b/extensions/molecule/ui_plugin_route/deleted/prepare.yml
deleted file mode 100644
index 6f173908..00000000
--- a/extensions/molecule/ui_plugin_route/deleted/prepare.yml
+++ /dev/null
@@ -1,18 +0,0 @@
----
-- name: "Prepare — ui_plugin_route (deleted)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed ui_plugin_route to be deleted (prerequisite for deleted)
-      ansible.platform.ui_plugin_route:
-        config:
-          - "{{ prepare_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/ui_plugin_route/deleted/verify.yml b/extensions/molecule/ui_plugin_route/deleted/verify.yml
deleted file mode 100644
index b911c400..00000000
--- a/extensions/molecule/ui_plugin_route/deleted/verify.yml
+++ /dev/null
@@ -1,26 +0,0 @@
----
-- name: "Verify — ui_plugin_route (deleted)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather ui_plugin_route (should be absent after deleted)
-      ansible.platform.ui_plugin_route:
-        config:
-          - name: "int-uipr-alpha"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert int-uipr-alpha no longer exists (deleted)
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length == 0
-        fail_msg: "Expected empty after deleted, got: {{ gathered.gathered }}"
-
-...
diff --git a/extensions/molecule/ui_plugin_route/gathered/cleanup.yml b/extensions/molecule/ui_plugin_route/gathered/cleanup.yml
deleted file mode 100644
index 406a051a..00000000
--- a/extensions/molecule/ui_plugin_route/gathered/cleanup.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Cleanup — ui_plugin_route (gathered)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove int-uipr-alpha (test teardown)
-      ansible.platform.ui_plugin_route:
-        config:
-          - name: "int-uipr-alpha"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/ui_plugin_route/gathered/converge.yml b/extensions/molecule/ui_plugin_route/gathered/converge.yml
deleted file mode 100644
index b93ba725..00000000
--- a/extensions/molecule/ui_plugin_route/gathered/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — ui_plugin_route (gathered)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.ui_plugin_route with state=gathered
-      ansible.platform.ui_plugin_route:
-        config:
-          - "{{ expected_config }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/ui_plugin_route/gathered/prepare.yml b/extensions/molecule/ui_plugin_route/gathered/prepare.yml
deleted file mode 100644
index 1058c80f..00000000
--- a/extensions/molecule/ui_plugin_route/gathered/prepare.yml
+++ /dev/null
@@ -1,18 +0,0 @@
----
-- name: "Prepare — ui_plugin_route (gathered)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed ui_plugin_route to be gathered (prerequisite for gathered)
-      ansible.platform.ui_plugin_route:
-        config:
-          - "{{ prepare_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/ui_plugin_route/gathered/verify.yml b/extensions/molecule/ui_plugin_route/gathered/verify.yml
deleted file mode 100644
index 8051ba89..00000000
--- a/extensions/molecule/ui_plugin_route/gathered/verify.yml
+++ /dev/null
@@ -1,26 +0,0 @@
----
-- name: "Verify — ui_plugin_route (gathered)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather ui_plugin_route (assert present after gathered)
-      ansible.platform.ui_plugin_route:
-        config:
-          - name: "{{ expected_config.name }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert configuration exists after gathered
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length > 0
-        fail_msg: "Expected resource after gathered. got: {{ gathered.gathered }}"
-
-...
diff --git a/extensions/molecule/ui_plugin_route/merged/cleanup.yml b/extensions/molecule/ui_plugin_route/merged/cleanup.yml
deleted file mode 100644
index d5020ddb..00000000
--- a/extensions/molecule/ui_plugin_route/merged/cleanup.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Cleanup — ui_plugin_route (merged)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove int-uipr-alpha (test teardown)
-      ansible.platform.ui_plugin_route:
-        config:
-          - name: "int-uipr-alpha"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/ui_plugin_route/merged/converge.yml b/extensions/molecule/ui_plugin_route/merged/converge.yml
deleted file mode 100644
index 27552a74..00000000
--- a/extensions/molecule/ui_plugin_route/merged/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — ui_plugin_route (merged)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.ui_plugin_route with state=merged
-      ansible.platform.ui_plugin_route:
-        config:
-          - "{{ expected_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/ui_plugin_route/merged/verify.yml b/extensions/molecule/ui_plugin_route/merged/verify.yml
deleted file mode 100644
index 249f70f0..00000000
--- a/extensions/molecule/ui_plugin_route/merged/verify.yml
+++ /dev/null
@@ -1,26 +0,0 @@
----
-- name: "Verify — ui_plugin_route (merged)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather ui_plugin_route (assert present after merged)
-      ansible.platform.ui_plugin_route:
-        config:
-          - name: "{{ expected_config.name }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert configuration exists after merged
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length > 0
-        fail_msg: "Expected resource after merged. got: {{ gathered.gathered }}"
-
-...
diff --git a/extensions/molecule/ui_plugin_route/overridden/cleanup.yml b/extensions/molecule/ui_plugin_route/overridden/cleanup.yml
deleted file mode 100644
index 4d78fff4..00000000
--- a/extensions/molecule/ui_plugin_route/overridden/cleanup.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Cleanup — ui_plugin_route (overridden)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove int-uipr-alpha (test teardown)
-      ansible.platform.ui_plugin_route:
-        config:
-          - name: "int-uipr-alpha"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/ui_plugin_route/overridden/converge.yml b/extensions/molecule/ui_plugin_route/overridden/converge.yml
deleted file mode 100644
index ba8fb903..00000000
--- a/extensions/molecule/ui_plugin_route/overridden/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — ui_plugin_route (overridden)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.ui_plugin_route with state=overridden
-      ansible.platform.ui_plugin_route:
-        config:
-          - "{{ expected_config }}"
-        state: overridden
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/ui_plugin_route/overridden/prepare.yml b/extensions/molecule/ui_plugin_route/overridden/prepare.yml
deleted file mode 100644
index cff76407..00000000
--- a/extensions/molecule/ui_plugin_route/overridden/prepare.yml
+++ /dev/null
@@ -1,17 +0,0 @@
----
-- name: "Prepare — ui_plugin_route (overridden)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed prerequisite resources via merged (r0 + r1 + extras for overridden)
-      ansible.platform.ui_plugin_route:
-        config: "{{ prepare_configs }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/ui_plugin_route/overridden/verify.yml b/extensions/molecule/ui_plugin_route/overridden/verify.yml
deleted file mode 100644
index 73dc22d5..00000000
--- a/extensions/molecule/ui_plugin_route/overridden/verify.yml
+++ /dev/null
@@ -1,31 +0,0 @@
----
-- name: "Verify — ui_plugin_route (overridden)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather all ui_plugin_route resources (verify overridden final state)
-      ansible.platform.ui_plugin_route:
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered_all
-
-    - name: Assert int-uipr-alpha still exists after overridden
-      ansible.builtin.assert:
-        that:
-          - gathered_all.gathered is defined
-          - gathered_all.gathered | selectattr("name", "equalto", "int-uipr-alpha") | list | length == 1
-        fail_msg: "Expected int-uipr-alpha to exist after overridden. got: {{ gathered_all.gathered }}"
-
-    - name: Assert int-uipr-beta was deleted by overridden (not in desired config)
-      ansible.builtin.assert:
-        that:
-          - gathered_all.gathered is defined
-          - gathered_all.gathered | selectattr("name", "equalto", "int-uipr-beta") | list | length == 0
-        fail_msg: "overridden should have deleted int-uipr-beta. got: {{ gathered_all.gathered }}"
-
-...
diff --git a/extensions/molecule/ui_plugin_route/replaced/cleanup.yml b/extensions/molecule/ui_plugin_route/replaced/cleanup.yml
deleted file mode 100644
index 12d7d0fc..00000000
--- a/extensions/molecule/ui_plugin_route/replaced/cleanup.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Cleanup — ui_plugin_route (replaced)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove int-uipr-alpha (test teardown)
-      ansible.platform.ui_plugin_route:
-        config:
-          - name: "int-uipr-alpha"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/ui_plugin_route/replaced/converge.yml b/extensions/molecule/ui_plugin_route/replaced/converge.yml
deleted file mode 100644
index b058c777..00000000
--- a/extensions/molecule/ui_plugin_route/replaced/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — ui_plugin_route (replaced)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.ui_plugin_route with state=replaced
-      ansible.platform.ui_plugin_route:
-        config:
-          - "{{ expected_config }}"
-        state: replaced
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/ui_plugin_route/replaced/prepare.yml b/extensions/molecule/ui_plugin_route/replaced/prepare.yml
deleted file mode 100644
index 55ddc32b..00000000
--- a/extensions/molecule/ui_plugin_route/replaced/prepare.yml
+++ /dev/null
@@ -1,18 +0,0 @@
----
-- name: "Prepare — ui_plugin_route (replaced)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed ui_plugin_route to be replaced (prerequisite for replaced)
-      ansible.platform.ui_plugin_route:
-        config:
-          - "{{ prepare_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/ui_plugin_route/replaced/verify.yml b/extensions/molecule/ui_plugin_route/replaced/verify.yml
deleted file mode 100644
index eb57e691..00000000
--- a/extensions/molecule/ui_plugin_route/replaced/verify.yml
+++ /dev/null
@@ -1,32 +0,0 @@
----
-- name: "Verify — ui_plugin_route (replaced)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather ui_plugin_route (assert present after replaced)
-      ansible.platform.ui_plugin_route:
-        config:
-          - name: "{{ expected_config.name }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert configuration exists after replaced
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length > 0
-        fail_msg: "Expected resource after replaced. got: {{ gathered.gathered }}"
-
-    - name: Assert description was updated by replaced
-      ansible.builtin.assert:
-        that:
-          - (gathered.gathered | first).description == expected_config.description
-        fail_msg: "replaced should have set description='Alpha ui plugin route'. got: {{ (gathered.gathered | first).description }}"
-
-...
diff --git a/extensions/molecule/ui_plugin_routes/check/cleanup.yml b/extensions/molecule/ui_plugin_routes/check/cleanup.yml
new file mode 100644
index 00000000..d59cb807
--- /dev/null
+++ b/extensions/molecule/ui_plugin_routes/check/cleanup.yml
@@ -0,0 +1,19 @@
+---
+- name: "Cleanup — ui_plugin_routes (check)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove int-uipr-alpha (test teardown)
+      ansible.platform.ui_plugin_routes:
+        config:
+          - name: "int-uipr-alpha"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/ui_plugin_routes/check/converge.yml b/extensions/molecule/ui_plugin_routes/check/converge.yml
new file mode 100644
index 00000000..931dd115
--- /dev/null
+++ b/extensions/molecule/ui_plugin_routes/check/converge.yml
@@ -0,0 +1,36 @@
+---
+- name: "Converge — ui_plugin_routes (check)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.ui_plugin_routes with state=merged
+      ansible.platform.ui_plugin_routes:
+        config:
+          - "{{ expected_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      check_mode: true
+      diff: true
+      register: result
+
+    - name: Assert check mode predicted a change
+      ansible.builtin.assert:
+        that:
+          - result.changed == true
+          - result.before is defined
+          - result.after is defined
+        fail_msg: "check mode should predict a change. got={{ result }}"
+
+    - name: Assert diff output is present
+      ansible.builtin.assert:
+        that:
+          - result.diff is defined
+        fail_msg: "diff output missing from check result"
+      when: result.diff is defined
+
+...
diff --git a/extensions/molecule/ui_plugin_route/check/molecule.yml b/extensions/molecule/ui_plugin_routes/check/molecule.yml
similarity index 100%
rename from extensions/molecule/ui_plugin_route/check/molecule.yml
rename to extensions/molecule/ui_plugin_routes/check/molecule.yml
diff --git a/extensions/molecule/ui_plugin_routes/check/prepare.yml b/extensions/molecule/ui_plugin_routes/check/prepare.yml
new file mode 100644
index 00000000..6133a197
--- /dev/null
+++ b/extensions/molecule/ui_plugin_routes/check/prepare.yml
@@ -0,0 +1,18 @@
+---
+- name: "Prepare — ui_plugin_routes (check)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed ui_plugin_routes as check-mode baseline (prerequisite for check)
+      ansible.platform.ui_plugin_routes:
+        config:
+          - "{{ prepare_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/ui_plugin_route/check/vars.yml b/extensions/molecule/ui_plugin_routes/check/vars.yml
similarity index 100%
rename from extensions/molecule/ui_plugin_route/check/vars.yml
rename to extensions/molecule/ui_plugin_routes/check/vars.yml
diff --git a/extensions/molecule/ui_plugin_routes/check/verify.yml b/extensions/molecule/ui_plugin_routes/check/verify.yml
new file mode 100644
index 00000000..6e8c6a25
--- /dev/null
+++ b/extensions/molecule/ui_plugin_routes/check/verify.yml
@@ -0,0 +1,27 @@
+---
+- name: "Verify — ui_plugin_routes (check)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather ui_plugin_routes (check mode must not have applied changes)
+      ansible.platform.ui_plugin_routes:
+        config:
+          - name: "{{ expected_config.name }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert int-uipr-alpha still has prepare_config values (check did not apply)
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length > 0
+          - (gathered.gathered | first).description == prepare_config.description
+        fail_msg: "check mode should not alter resource. got: {{ gathered.gathered }}"
+
+...
diff --git a/extensions/molecule/ui_plugin_routes/deleted/cleanup.yml b/extensions/molecule/ui_plugin_routes/deleted/cleanup.yml
new file mode 100644
index 00000000..97797310
--- /dev/null
+++ b/extensions/molecule/ui_plugin_routes/deleted/cleanup.yml
@@ -0,0 +1,12 @@
+---
+- name: "Cleanup — ui_plugin_routes (deleted)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: No-op — int-uipr-alpha already deleted by converge
+      ansible.builtin.debug:
+        msg: "int-uipr-alpha was deleted in converge — nothing to clean up"
+
+...
diff --git a/extensions/molecule/ui_plugin_routes/deleted/converge.yml b/extensions/molecule/ui_plugin_routes/deleted/converge.yml
new file mode 100644
index 00000000..d15e753a
--- /dev/null
+++ b/extensions/molecule/ui_plugin_routes/deleted/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — ui_plugin_routes (deleted)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.ui_plugin_routes with state=deleted
+      ansible.platform.ui_plugin_routes:
+        config:
+          - "{{ expected_config }}"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/ui_plugin_route/deleted/molecule.yml b/extensions/molecule/ui_plugin_routes/deleted/molecule.yml
similarity index 100%
rename from extensions/molecule/ui_plugin_route/deleted/molecule.yml
rename to extensions/molecule/ui_plugin_routes/deleted/molecule.yml
diff --git a/extensions/molecule/ui_plugin_routes/deleted/prepare.yml b/extensions/molecule/ui_plugin_routes/deleted/prepare.yml
new file mode 100644
index 00000000..0af0cddf
--- /dev/null
+++ b/extensions/molecule/ui_plugin_routes/deleted/prepare.yml
@@ -0,0 +1,18 @@
+---
+- name: "Prepare — ui_plugin_routes (deleted)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed ui_plugin_routes to be deleted (prerequisite for deleted)
+      ansible.platform.ui_plugin_routes:
+        config:
+          - "{{ prepare_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/ui_plugin_route/deleted/vars.yml b/extensions/molecule/ui_plugin_routes/deleted/vars.yml
similarity index 100%
rename from extensions/molecule/ui_plugin_route/deleted/vars.yml
rename to extensions/molecule/ui_plugin_routes/deleted/vars.yml
diff --git a/extensions/molecule/ui_plugin_routes/deleted/verify.yml b/extensions/molecule/ui_plugin_routes/deleted/verify.yml
new file mode 100644
index 00000000..0649409c
--- /dev/null
+++ b/extensions/molecule/ui_plugin_routes/deleted/verify.yml
@@ -0,0 +1,26 @@
+---
+- name: "Verify — ui_plugin_routes (deleted)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather ui_plugin_routes (should be absent after deleted)
+      ansible.platform.ui_plugin_routes:
+        config:
+          - name: "int-uipr-alpha"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert int-uipr-alpha no longer exists (deleted)
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length == 0
+        fail_msg: "Expected empty after deleted, got: {{ gathered.gathered }}"
+
+...
diff --git a/extensions/molecule/ui_plugin_routes/gathered/cleanup.yml b/extensions/molecule/ui_plugin_routes/gathered/cleanup.yml
new file mode 100644
index 00000000..cba2e8c0
--- /dev/null
+++ b/extensions/molecule/ui_plugin_routes/gathered/cleanup.yml
@@ -0,0 +1,19 @@
+---
+- name: "Cleanup — ui_plugin_routes (gathered)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove int-uipr-alpha (test teardown)
+      ansible.platform.ui_plugin_routes:
+        config:
+          - name: "int-uipr-alpha"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/ui_plugin_routes/gathered/converge.yml b/extensions/molecule/ui_plugin_routes/gathered/converge.yml
new file mode 100644
index 00000000..131cd4a6
--- /dev/null
+++ b/extensions/molecule/ui_plugin_routes/gathered/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — ui_plugin_routes (gathered)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.ui_plugin_routes with state=gathered
+      ansible.platform.ui_plugin_routes:
+        config:
+          - "{{ expected_config }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/ui_plugin_route/gathered/molecule.yml b/extensions/molecule/ui_plugin_routes/gathered/molecule.yml
similarity index 100%
rename from extensions/molecule/ui_plugin_route/gathered/molecule.yml
rename to extensions/molecule/ui_plugin_routes/gathered/molecule.yml
diff --git a/extensions/molecule/ui_plugin_routes/gathered/prepare.yml b/extensions/molecule/ui_plugin_routes/gathered/prepare.yml
new file mode 100644
index 00000000..a4cc98bb
--- /dev/null
+++ b/extensions/molecule/ui_plugin_routes/gathered/prepare.yml
@@ -0,0 +1,18 @@
+---
+- name: "Prepare — ui_plugin_routes (gathered)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed ui_plugin_routes to be gathered (prerequisite for gathered)
+      ansible.platform.ui_plugin_routes:
+        config:
+          - "{{ prepare_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/ui_plugin_route/gathered/vars.yml b/extensions/molecule/ui_plugin_routes/gathered/vars.yml
similarity index 100%
rename from extensions/molecule/ui_plugin_route/gathered/vars.yml
rename to extensions/molecule/ui_plugin_routes/gathered/vars.yml
diff --git a/extensions/molecule/ui_plugin_routes/gathered/verify.yml b/extensions/molecule/ui_plugin_routes/gathered/verify.yml
new file mode 100644
index 00000000..1509acc4
--- /dev/null
+++ b/extensions/molecule/ui_plugin_routes/gathered/verify.yml
@@ -0,0 +1,26 @@
+---
+- name: "Verify — ui_plugin_routes (gathered)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather ui_plugin_routes (assert present after gathered)
+      ansible.platform.ui_plugin_routes:
+        config:
+          - name: "{{ expected_config.name }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert configuration exists after gathered
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length > 0
+        fail_msg: "Expected resource after gathered. got: {{ gathered.gathered }}"
+
+...
diff --git a/extensions/molecule/ui_plugin_route/inventory.yml b/extensions/molecule/ui_plugin_routes/inventory.yml
similarity index 100%
rename from extensions/molecule/ui_plugin_route/inventory.yml
rename to extensions/molecule/ui_plugin_routes/inventory.yml
diff --git a/extensions/molecule/ui_plugin_routes/merged/cleanup.yml b/extensions/molecule/ui_plugin_routes/merged/cleanup.yml
new file mode 100644
index 00000000..8fe21e88
--- /dev/null
+++ b/extensions/molecule/ui_plugin_routes/merged/cleanup.yml
@@ -0,0 +1,19 @@
+---
+- name: "Cleanup — ui_plugin_routes (merged)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove int-uipr-alpha (test teardown)
+      ansible.platform.ui_plugin_routes:
+        config:
+          - name: "int-uipr-alpha"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/ui_plugin_routes/merged/converge.yml b/extensions/molecule/ui_plugin_routes/merged/converge.yml
new file mode 100644
index 00000000..39b9bfe6
--- /dev/null
+++ b/extensions/molecule/ui_plugin_routes/merged/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — ui_plugin_routes (merged)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.ui_plugin_routes with state=merged
+      ansible.platform.ui_plugin_routes:
+        config:
+          - "{{ expected_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/ui_plugin_route/merged/molecule.yml b/extensions/molecule/ui_plugin_routes/merged/molecule.yml
similarity index 100%
rename from extensions/molecule/ui_plugin_route/merged/molecule.yml
rename to extensions/molecule/ui_plugin_routes/merged/molecule.yml
diff --git a/extensions/molecule/ui_plugin_route/merged/vars.yml b/extensions/molecule/ui_plugin_routes/merged/vars.yml
similarity index 100%
rename from extensions/molecule/ui_plugin_route/merged/vars.yml
rename to extensions/molecule/ui_plugin_routes/merged/vars.yml
diff --git a/extensions/molecule/ui_plugin_routes/merged/verify.yml b/extensions/molecule/ui_plugin_routes/merged/verify.yml
new file mode 100644
index 00000000..2c6312bc
--- /dev/null
+++ b/extensions/molecule/ui_plugin_routes/merged/verify.yml
@@ -0,0 +1,26 @@
+---
+- name: "Verify — ui_plugin_routes (merged)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather ui_plugin_routes (assert present after merged)
+      ansible.platform.ui_plugin_routes:
+        config:
+          - name: "{{ expected_config.name }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert configuration exists after merged
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length > 0
+        fail_msg: "Expected resource after merged. got: {{ gathered.gathered }}"
+
+...
diff --git a/extensions/molecule/ui_plugin_routes/overridden/cleanup.yml b/extensions/molecule/ui_plugin_routes/overridden/cleanup.yml
new file mode 100644
index 00000000..cb35cf7a
--- /dev/null
+++ b/extensions/molecule/ui_plugin_routes/overridden/cleanup.yml
@@ -0,0 +1,19 @@
+---
+- name: "Cleanup — ui_plugin_routes (overridden)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove int-uipr-alpha (test teardown)
+      ansible.platform.ui_plugin_routes:
+        config:
+          - name: "int-uipr-alpha"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/ui_plugin_routes/overridden/converge.yml b/extensions/molecule/ui_plugin_routes/overridden/converge.yml
new file mode 100644
index 00000000..12f44708
--- /dev/null
+++ b/extensions/molecule/ui_plugin_routes/overridden/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — ui_plugin_routes (overridden)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.ui_plugin_routes with state=overridden
+      ansible.platform.ui_plugin_routes:
+        config:
+          - "{{ expected_config }}"
+        state: overridden
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/ui_plugin_route/overridden/molecule.yml b/extensions/molecule/ui_plugin_routes/overridden/molecule.yml
similarity index 100%
rename from extensions/molecule/ui_plugin_route/overridden/molecule.yml
rename to extensions/molecule/ui_plugin_routes/overridden/molecule.yml
diff --git a/extensions/molecule/ui_plugin_routes/overridden/prepare.yml b/extensions/molecule/ui_plugin_routes/overridden/prepare.yml
new file mode 100644
index 00000000..a016a975
--- /dev/null
+++ b/extensions/molecule/ui_plugin_routes/overridden/prepare.yml
@@ -0,0 +1,17 @@
+---
+- name: "Prepare — ui_plugin_routes (overridden)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed prerequisite resources via merged (r0 + r1 + extras for overridden)
+      ansible.platform.ui_plugin_routes:
+        config: "{{ prepare_configs }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/ui_plugin_route/overridden/vars.yml b/extensions/molecule/ui_plugin_routes/overridden/vars.yml
similarity index 100%
rename from extensions/molecule/ui_plugin_route/overridden/vars.yml
rename to extensions/molecule/ui_plugin_routes/overridden/vars.yml
diff --git a/extensions/molecule/ui_plugin_routes/overridden/verify.yml b/extensions/molecule/ui_plugin_routes/overridden/verify.yml
new file mode 100644
index 00000000..142d3d41
--- /dev/null
+++ b/extensions/molecule/ui_plugin_routes/overridden/verify.yml
@@ -0,0 +1,31 @@
+---
+- name: "Verify — ui_plugin_routes (overridden)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather all ui_plugin_routes resources (verify overridden final state)
+      ansible.platform.ui_plugin_routes:
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered_all
+
+    - name: Assert int-uipr-alpha still exists after overridden
+      ansible.builtin.assert:
+        that:
+          - gathered_all.gathered is defined
+          - gathered_all.gathered | selectattr("name", "equalto", "int-uipr-alpha") | list | length == 1
+        fail_msg: "Expected int-uipr-alpha to exist after overridden. got: {{ gathered_all.gathered }}"
+
+    - name: Assert int-uipr-beta was deleted by overridden (not in desired config)
+      ansible.builtin.assert:
+        that:
+          - gathered_all.gathered is defined
+          - gathered_all.gathered | selectattr("name", "equalto", "int-uipr-beta") | list | length == 0
+        fail_msg: "overridden should have deleted int-uipr-beta. got: {{ gathered_all.gathered }}"
+
+...
diff --git a/extensions/molecule/ui_plugin_routes/replaced/cleanup.yml b/extensions/molecule/ui_plugin_routes/replaced/cleanup.yml
new file mode 100644
index 00000000..7e07a810
--- /dev/null
+++ b/extensions/molecule/ui_plugin_routes/replaced/cleanup.yml
@@ -0,0 +1,19 @@
+---
+- name: "Cleanup — ui_plugin_routes (replaced)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove int-uipr-alpha (test teardown)
+      ansible.platform.ui_plugin_routes:
+        config:
+          - name: "int-uipr-alpha"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/ui_plugin_routes/replaced/converge.yml b/extensions/molecule/ui_plugin_routes/replaced/converge.yml
new file mode 100644
index 00000000..42157c23
--- /dev/null
+++ b/extensions/molecule/ui_plugin_routes/replaced/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — ui_plugin_routes (replaced)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.ui_plugin_routes with state=replaced
+      ansible.platform.ui_plugin_routes:
+        config:
+          - "{{ expected_config }}"
+        state: replaced
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/ui_plugin_route/replaced/molecule.yml b/extensions/molecule/ui_plugin_routes/replaced/molecule.yml
similarity index 100%
rename from extensions/molecule/ui_plugin_route/replaced/molecule.yml
rename to extensions/molecule/ui_plugin_routes/replaced/molecule.yml
diff --git a/extensions/molecule/ui_plugin_routes/replaced/prepare.yml b/extensions/molecule/ui_plugin_routes/replaced/prepare.yml
new file mode 100644
index 00000000..f7461f42
--- /dev/null
+++ b/extensions/molecule/ui_plugin_routes/replaced/prepare.yml
@@ -0,0 +1,18 @@
+---
+- name: "Prepare — ui_plugin_routes (replaced)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed ui_plugin_routes to be replaced (prerequisite for replaced)
+      ansible.platform.ui_plugin_routes:
+        config:
+          - "{{ prepare_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/ui_plugin_route/replaced/vars.yml b/extensions/molecule/ui_plugin_routes/replaced/vars.yml
similarity index 100%
rename from extensions/molecule/ui_plugin_route/replaced/vars.yml
rename to extensions/molecule/ui_plugin_routes/replaced/vars.yml
diff --git a/extensions/molecule/ui_plugin_routes/replaced/verify.yml b/extensions/molecule/ui_plugin_routes/replaced/verify.yml
new file mode 100644
index 00000000..c42baf78
--- /dev/null
+++ b/extensions/molecule/ui_plugin_routes/replaced/verify.yml
@@ -0,0 +1,32 @@
+---
+- name: "Verify — ui_plugin_routes (replaced)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather ui_plugin_routes (assert present after replaced)
+      ansible.platform.ui_plugin_routes:
+        config:
+          - name: "{{ expected_config.name }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert configuration exists after replaced
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length > 0
+        fail_msg: "Expected resource after replaced. got: {{ gathered.gathered }}"
+
+    - name: Assert description was updated by replaced
+      ansible.builtin.assert:
+        that:
+          - (gathered.gathered | first).description == expected_config.description
+        fail_msg: "replaced should have set description='Alpha ui plugin route'. got: {{ (gathered.gathered | first).description }}"
+
+...
diff --git a/extensions/molecule/user/check/cleanup.yml b/extensions/molecule/user/check/cleanup.yml
deleted file mode 100644
index 82e28f86..00000000
--- a/extensions/molecule/user/check/cleanup.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Cleanup — user (check)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove int-user-alice (test teardown)
-      ansible.platform.user:
-        config:
-          - username: "int-user-alice"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/user/check/converge.yml b/extensions/molecule/user/check/converge.yml
deleted file mode 100644
index 48f74f0e..00000000
--- a/extensions/molecule/user/check/converge.yml
+++ /dev/null
@@ -1,36 +0,0 @@
----
-- name: "Converge — user (check)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.user with state=merged
-      ansible.platform.user:
-        config:
-          - "{{ expected_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      check_mode: true
-      diff: true
-      register: result
-
-    - name: Assert check mode predicted a change
-      ansible.builtin.assert:
-        that:
-          - result.changed == true
-          - result.before is defined
-          - result.after is defined
-        fail_msg: "check mode should predict a change. got={{ result }}"
-
-    - name: Assert diff output is present
-      ansible.builtin.assert:
-        that:
-          - result.diff is defined
-        fail_msg: "diff output missing from check result"
-      when: result.diff is defined
-
-...
diff --git a/extensions/molecule/user/check/prepare.yml b/extensions/molecule/user/check/prepare.yml
deleted file mode 100644
index fca7a449..00000000
--- a/extensions/molecule/user/check/prepare.yml
+++ /dev/null
@@ -1,18 +0,0 @@
----
-- name: "Prepare — user (check)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed user as check-mode baseline (prerequisite for check)
-      ansible.platform.user:
-        config:
-          - "{{ prepare_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/user/check/verify.yml b/extensions/molecule/user/check/verify.yml
deleted file mode 100644
index 69d5d34c..00000000
--- a/extensions/molecule/user/check/verify.yml
+++ /dev/null
@@ -1,27 +0,0 @@
----
-- name: "Verify — user (check)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather user (check mode must not have applied changes)
-      ansible.platform.user:
-        config:
-          - username: "{{ expected_config.username }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert int-user-alice still has prepare_config values (check did not apply)
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length > 0
-          - (gathered.gathered | first).last_name == prepare_config.last_name
-        fail_msg: "check mode should not alter resource. got: {{ gathered.gathered }}"
-
-...
diff --git a/extensions/molecule/user/deleted/cleanup.yml b/extensions/molecule/user/deleted/cleanup.yml
deleted file mode 100644
index fef21316..00000000
--- a/extensions/molecule/user/deleted/cleanup.yml
+++ /dev/null
@@ -1,12 +0,0 @@
----
-- name: "Cleanup — user (deleted)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: No-op — int-user-alice already deleted by converge
-      ansible.builtin.debug:
-        msg: "int-user-alice was deleted in converge — nothing to clean up"
-
-...
diff --git a/extensions/molecule/user/deleted/converge.yml b/extensions/molecule/user/deleted/converge.yml
deleted file mode 100644
index 7015338b..00000000
--- a/extensions/molecule/user/deleted/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — user (deleted)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.user with state=deleted
-      ansible.platform.user:
-        config:
-          - "{{ expected_config }}"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/user/deleted/prepare.yml b/extensions/molecule/user/deleted/prepare.yml
deleted file mode 100644
index e800c7e9..00000000
--- a/extensions/molecule/user/deleted/prepare.yml
+++ /dev/null
@@ -1,18 +0,0 @@
----
-- name: "Prepare — user (deleted)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed user to be deleted (prerequisite for deleted)
-      ansible.platform.user:
-        config:
-          - "{{ prepare_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/user/deleted/verify.yml b/extensions/molecule/user/deleted/verify.yml
deleted file mode 100644
index 665491ac..00000000
--- a/extensions/molecule/user/deleted/verify.yml
+++ /dev/null
@@ -1,26 +0,0 @@
----
-- name: "Verify — user (deleted)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather user (should be absent after deleted)
-      ansible.platform.user:
-        config:
-          - username: "int-user-alice"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert int-user-alice no longer exists (deleted)
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length == 0
-        fail_msg: "Expected empty after deleted, got: {{ gathered.gathered }}"
-
-...
diff --git a/extensions/molecule/user/gathered/cleanup.yml b/extensions/molecule/user/gathered/cleanup.yml
deleted file mode 100644
index bd5a4dfb..00000000
--- a/extensions/molecule/user/gathered/cleanup.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Cleanup — user (gathered)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove int-user-alice (test teardown)
-      ansible.platform.user:
-        config:
-          - username: "int-user-alice"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/user/gathered/converge.yml b/extensions/molecule/user/gathered/converge.yml
deleted file mode 100644
index 9d100a46..00000000
--- a/extensions/molecule/user/gathered/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — user (gathered)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.user with state=gathered
-      ansible.platform.user:
-        config:
-          - "{{ expected_config }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/user/gathered/prepare.yml b/extensions/molecule/user/gathered/prepare.yml
deleted file mode 100644
index db825849..00000000
--- a/extensions/molecule/user/gathered/prepare.yml
+++ /dev/null
@@ -1,18 +0,0 @@
----
-- name: "Prepare — user (gathered)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed user to be gathered (prerequisite for gathered)
-      ansible.platform.user:
-        config:
-          - "{{ prepare_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/user/gathered/verify.yml b/extensions/molecule/user/gathered/verify.yml
deleted file mode 100644
index 65aacb77..00000000
--- a/extensions/molecule/user/gathered/verify.yml
+++ /dev/null
@@ -1,26 +0,0 @@
----
-- name: "Verify — user (gathered)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather user (assert present after gathered)
-      ansible.platform.user:
-        config:
-          - username: "{{ expected_config.username }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert configuration exists after gathered
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length > 0
-        fail_msg: "Expected resource after gathered. got: {{ gathered.gathered }}"
-
-...
diff --git a/extensions/molecule/user/merged/cleanup.yml b/extensions/molecule/user/merged/cleanup.yml
deleted file mode 100644
index 530ffebb..00000000
--- a/extensions/molecule/user/merged/cleanup.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Cleanup — user (merged)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove int-user-alice (test teardown)
-      ansible.platform.user:
-        config:
-          - username: "int-user-alice"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/user/merged/converge.yml b/extensions/molecule/user/merged/converge.yml
deleted file mode 100644
index 8b50056b..00000000
--- a/extensions/molecule/user/merged/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — user (merged)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.user with state=merged
-      ansible.platform.user:
-        config:
-          - "{{ expected_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/user/merged/verify.yml b/extensions/molecule/user/merged/verify.yml
deleted file mode 100644
index 097c215f..00000000
--- a/extensions/molecule/user/merged/verify.yml
+++ /dev/null
@@ -1,26 +0,0 @@
----
-- name: "Verify — user (merged)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather user (assert present after merged)
-      ansible.platform.user:
-        config:
-          - username: "{{ expected_config.username }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert configuration exists after merged
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length > 0
-        fail_msg: "Expected resource after merged. got: {{ gathered.gathered }}"
-
-...
diff --git a/extensions/molecule/user/overridden/cleanup.yml b/extensions/molecule/user/overridden/cleanup.yml
deleted file mode 100644
index 6e9784cf..00000000
--- a/extensions/molecule/user/overridden/cleanup.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Cleanup — user (overridden)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove int-user-alice (test teardown)
-      ansible.platform.user:
-        config:
-          - username: "int-user-alice"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/user/overridden/converge.yml b/extensions/molecule/user/overridden/converge.yml
deleted file mode 100644
index 98fc78f6..00000000
--- a/extensions/molecule/user/overridden/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — user (overridden)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.user with state=overridden
-      ansible.platform.user:
-        config:
-          - "{{ expected_config }}"
-        state: overridden
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/user/overridden/prepare.yml b/extensions/molecule/user/overridden/prepare.yml
deleted file mode 100644
index 657b0842..00000000
--- a/extensions/molecule/user/overridden/prepare.yml
+++ /dev/null
@@ -1,17 +0,0 @@
----
-- name: "Prepare — user (overridden)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed prerequisite resources via merged (r0 + r1 + extras for overridden)
-      ansible.platform.user:
-        config: "{{ prepare_configs }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/user/overridden/verify.yml b/extensions/molecule/user/overridden/verify.yml
deleted file mode 100644
index 050b118b..00000000
--- a/extensions/molecule/user/overridden/verify.yml
+++ /dev/null
@@ -1,31 +0,0 @@
----
-- name: "Verify — user (overridden)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather all user resources (verify overridden final state)
-      ansible.platform.user:
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered_all
-
-    - name: Assert int-user-alice still exists after overridden
-      ansible.builtin.assert:
-        that:
-          - gathered_all.gathered is defined
-          - gathered_all.gathered | selectattr("username", "equalto", "int-user-alice") | list | length == 1
-        fail_msg: "Expected int-user-alice to exist after overridden. got: {{ gathered_all.gathered }}"
-
-    - name: Assert int-user-bob was deleted by overridden (not in desired config)
-      ansible.builtin.assert:
-        that:
-          - gathered_all.gathered is defined
-          - gathered_all.gathered | selectattr("username", "equalto", "int-user-bob") | list | length == 0
-        fail_msg: "overridden should have deleted int-user-bob. got: {{ gathered_all.gathered }}"
-
-...
diff --git a/extensions/molecule/user/replaced/cleanup.yml b/extensions/molecule/user/replaced/cleanup.yml
deleted file mode 100644
index 4a49d896..00000000
--- a/extensions/molecule/user/replaced/cleanup.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Cleanup — user (replaced)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Remove int-user-alice (test teardown)
-      ansible.platform.user:
-        config:
-          - username: "int-user-alice"
-        state: deleted
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      failed_when: false
-
-...
diff --git a/extensions/molecule/user/replaced/converge.yml b/extensions/molecule/user/replaced/converge.yml
deleted file mode 100644
index dbdd981c..00000000
--- a/extensions/molecule/user/replaced/converge.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: "Converge — user (replaced)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Run ansible.platform.user with state=replaced
-      ansible.platform.user:
-        config:
-          - "{{ expected_config }}"
-        state: replaced
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: result
-
-...
diff --git a/extensions/molecule/user/replaced/prepare.yml b/extensions/molecule/user/replaced/prepare.yml
deleted file mode 100644
index 63dc64f1..00000000
--- a/extensions/molecule/user/replaced/prepare.yml
+++ /dev/null
@@ -1,18 +0,0 @@
----
-- name: "Prepare — user (replaced)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Seed user to be replaced (prerequisite for replaced)
-      ansible.platform.user:
-        config:
-          - "{{ prepare_config }}"
-        state: merged
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-
-...
diff --git a/extensions/molecule/user/replaced/verify.yml b/extensions/molecule/user/replaced/verify.yml
deleted file mode 100644
index 20fb3bf8..00000000
--- a/extensions/molecule/user/replaced/verify.yml
+++ /dev/null
@@ -1,32 +0,0 @@
----
-- name: "Verify — user (replaced)"
-  hosts: localhost
-  gather_facts: false
-  vars_files:
-    - vars.yml
-  tasks:
-    - name: Gather user (assert present after replaced)
-      ansible.platform.user:
-        config:
-          - username: "{{ expected_config.username }}"
-        state: gathered
-        gateway_hostname: "{{ gateway_hostname }}"
-        gateway_username: "{{ gateway_username }}"
-        gateway_password: "{{ gateway_password }}"
-        gateway_validate_certs: "{{ gateway_validate_certs }}"
-      register: gathered
-
-    - name: Assert configuration exists after replaced
-      ansible.builtin.assert:
-        that:
-          - gathered.gathered is defined
-          - gathered.gathered | length > 0
-        fail_msg: "Expected resource after replaced. got: {{ gathered.gathered }}"
-
-    - name: Assert last_name was updated by replaced
-      ansible.builtin.assert:
-        that:
-          - (gathered.gathered | first).last_name == expected_config.last_name
-        fail_msg: "replaced should have set last_name='Johnson'. got: {{ (gathered.gathered | first).last_name }}"
-
-...
diff --git a/extensions/molecule/users/check/cleanup.yml b/extensions/molecule/users/check/cleanup.yml
new file mode 100644
index 00000000..1fc401bd
--- /dev/null
+++ b/extensions/molecule/users/check/cleanup.yml
@@ -0,0 +1,19 @@
+---
+- name: "Cleanup — users (check)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove int-user-alice (test teardown)
+      ansible.platform.users:
+        config:
+          - username: "int-user-alice"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/users/check/converge.yml b/extensions/molecule/users/check/converge.yml
new file mode 100644
index 00000000..38d59829
--- /dev/null
+++ b/extensions/molecule/users/check/converge.yml
@@ -0,0 +1,36 @@
+---
+- name: "Converge — users (check)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.users with state=merged
+      ansible.platform.users:
+        config:
+          - "{{ expected_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      check_mode: true
+      diff: true
+      register: result
+
+    - name: Assert check mode predicted a change
+      ansible.builtin.assert:
+        that:
+          - result.changed == true
+          - result.before is defined
+          - result.after is defined
+        fail_msg: "check mode should predict a change. got={{ result }}"
+
+    - name: Assert diff output is present
+      ansible.builtin.assert:
+        that:
+          - result.diff is defined
+        fail_msg: "diff output missing from check result"
+      when: result.diff is defined
+
+...
diff --git a/extensions/molecule/user/check/molecule.yml b/extensions/molecule/users/check/molecule.yml
similarity index 100%
rename from extensions/molecule/user/check/molecule.yml
rename to extensions/molecule/users/check/molecule.yml
diff --git a/extensions/molecule/users/check/prepare.yml b/extensions/molecule/users/check/prepare.yml
new file mode 100644
index 00000000..7f69e9e6
--- /dev/null
+++ b/extensions/molecule/users/check/prepare.yml
@@ -0,0 +1,18 @@
+---
+- name: "Prepare — users (check)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed users as check-mode baseline (prerequisite for check)
+      ansible.platform.users:
+        config:
+          - "{{ prepare_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/user/check/vars.yml b/extensions/molecule/users/check/vars.yml
similarity index 100%
rename from extensions/molecule/user/check/vars.yml
rename to extensions/molecule/users/check/vars.yml
diff --git a/extensions/molecule/users/check/verify.yml b/extensions/molecule/users/check/verify.yml
new file mode 100644
index 00000000..7c96ee17
--- /dev/null
+++ b/extensions/molecule/users/check/verify.yml
@@ -0,0 +1,27 @@
+---
+- name: "Verify — users (check)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather users (check mode must not have applied changes)
+      ansible.platform.users:
+        config:
+          - username: "{{ expected_config.username }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert int-user-alice still has prepare_config values (check did not apply)
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length > 0
+          - (gathered.gathered | first).last_name == prepare_config.last_name
+        fail_msg: "check mode should not alter resource. got: {{ gathered.gathered }}"
+
+...
diff --git a/extensions/molecule/users/deleted/cleanup.yml b/extensions/molecule/users/deleted/cleanup.yml
new file mode 100644
index 00000000..c63739f7
--- /dev/null
+++ b/extensions/molecule/users/deleted/cleanup.yml
@@ -0,0 +1,12 @@
+---
+- name: "Cleanup — users (deleted)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: No-op — int-user-alice already deleted by converge
+      ansible.builtin.debug:
+        msg: "int-user-alice was deleted in converge — nothing to clean up"
+
+...
diff --git a/extensions/molecule/users/deleted/converge.yml b/extensions/molecule/users/deleted/converge.yml
new file mode 100644
index 00000000..4f246505
--- /dev/null
+++ b/extensions/molecule/users/deleted/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — users (deleted)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.users with state=deleted
+      ansible.platform.users:
+        config:
+          - "{{ expected_config }}"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/user/deleted/molecule.yml b/extensions/molecule/users/deleted/molecule.yml
similarity index 100%
rename from extensions/molecule/user/deleted/molecule.yml
rename to extensions/molecule/users/deleted/molecule.yml
diff --git a/extensions/molecule/users/deleted/prepare.yml b/extensions/molecule/users/deleted/prepare.yml
new file mode 100644
index 00000000..98926f24
--- /dev/null
+++ b/extensions/molecule/users/deleted/prepare.yml
@@ -0,0 +1,18 @@
+---
+- name: "Prepare — users (deleted)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed users to be deleted (prerequisite for deleted)
+      ansible.platform.users:
+        config:
+          - "{{ prepare_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/user/deleted/vars.yml b/extensions/molecule/users/deleted/vars.yml
similarity index 100%
rename from extensions/molecule/user/deleted/vars.yml
rename to extensions/molecule/users/deleted/vars.yml
diff --git a/extensions/molecule/users/deleted/verify.yml b/extensions/molecule/users/deleted/verify.yml
new file mode 100644
index 00000000..df38d957
--- /dev/null
+++ b/extensions/molecule/users/deleted/verify.yml
@@ -0,0 +1,26 @@
+---
+- name: "Verify — users (deleted)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather users (should be absent after deleted)
+      ansible.platform.users:
+        config:
+          - username: "int-user-alice"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert int-user-alice no longer exists (deleted)
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length == 0
+        fail_msg: "Expected empty after deleted, got: {{ gathered.gathered }}"
+
+...
diff --git a/extensions/molecule/users/gathered/cleanup.yml b/extensions/molecule/users/gathered/cleanup.yml
new file mode 100644
index 00000000..d3693f1a
--- /dev/null
+++ b/extensions/molecule/users/gathered/cleanup.yml
@@ -0,0 +1,19 @@
+---
+- name: "Cleanup — users (gathered)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove int-user-alice (test teardown)
+      ansible.platform.users:
+        config:
+          - username: "int-user-alice"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/users/gathered/converge.yml b/extensions/molecule/users/gathered/converge.yml
new file mode 100644
index 00000000..96b502ac
--- /dev/null
+++ b/extensions/molecule/users/gathered/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — users (gathered)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.users with state=gathered
+      ansible.platform.users:
+        config:
+          - "{{ expected_config }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/user/gathered/molecule.yml b/extensions/molecule/users/gathered/molecule.yml
similarity index 100%
rename from extensions/molecule/user/gathered/molecule.yml
rename to extensions/molecule/users/gathered/molecule.yml
diff --git a/extensions/molecule/users/gathered/prepare.yml b/extensions/molecule/users/gathered/prepare.yml
new file mode 100644
index 00000000..92904d59
--- /dev/null
+++ b/extensions/molecule/users/gathered/prepare.yml
@@ -0,0 +1,18 @@
+---
+- name: "Prepare — users (gathered)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed users to be gathered (prerequisite for gathered)
+      ansible.platform.users:
+        config:
+          - "{{ prepare_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/user/gathered/vars.yml b/extensions/molecule/users/gathered/vars.yml
similarity index 100%
rename from extensions/molecule/user/gathered/vars.yml
rename to extensions/molecule/users/gathered/vars.yml
diff --git a/extensions/molecule/users/gathered/verify.yml b/extensions/molecule/users/gathered/verify.yml
new file mode 100644
index 00000000..3e5fd25a
--- /dev/null
+++ b/extensions/molecule/users/gathered/verify.yml
@@ -0,0 +1,26 @@
+---
+- name: "Verify — users (gathered)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather users (assert present after gathered)
+      ansible.platform.users:
+        config:
+          - username: "{{ expected_config.username }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert configuration exists after gathered
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length > 0
+        fail_msg: "Expected resource after gathered. got: {{ gathered.gathered }}"
+
+...
diff --git a/extensions/molecule/user/inventory.yml b/extensions/molecule/users/inventory.yml
similarity index 100%
rename from extensions/molecule/user/inventory.yml
rename to extensions/molecule/users/inventory.yml
diff --git a/extensions/molecule/users/merged/cleanup.yml b/extensions/molecule/users/merged/cleanup.yml
new file mode 100644
index 00000000..a6a183d7
--- /dev/null
+++ b/extensions/molecule/users/merged/cleanup.yml
@@ -0,0 +1,19 @@
+---
+- name: "Cleanup — users (merged)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove int-user-alice (test teardown)
+      ansible.platform.users:
+        config:
+          - username: "int-user-alice"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/users/merged/converge.yml b/extensions/molecule/users/merged/converge.yml
new file mode 100644
index 00000000..999dc194
--- /dev/null
+++ b/extensions/molecule/users/merged/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — users (merged)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.users with state=merged
+      ansible.platform.users:
+        config:
+          - "{{ expected_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/user/merged/molecule.yml b/extensions/molecule/users/merged/molecule.yml
similarity index 100%
rename from extensions/molecule/user/merged/molecule.yml
rename to extensions/molecule/users/merged/molecule.yml
diff --git a/extensions/molecule/user/merged/vars.yml b/extensions/molecule/users/merged/vars.yml
similarity index 100%
rename from extensions/molecule/user/merged/vars.yml
rename to extensions/molecule/users/merged/vars.yml
diff --git a/extensions/molecule/users/merged/verify.yml b/extensions/molecule/users/merged/verify.yml
new file mode 100644
index 00000000..2a436905
--- /dev/null
+++ b/extensions/molecule/users/merged/verify.yml
@@ -0,0 +1,26 @@
+---
+- name: "Verify — users (merged)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather users (assert present after merged)
+      ansible.platform.users:
+        config:
+          - username: "{{ expected_config.username }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert configuration exists after merged
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length > 0
+        fail_msg: "Expected resource after merged. got: {{ gathered.gathered }}"
+
+...
diff --git a/extensions/molecule/users/overridden/cleanup.yml b/extensions/molecule/users/overridden/cleanup.yml
new file mode 100644
index 00000000..412d5500
--- /dev/null
+++ b/extensions/molecule/users/overridden/cleanup.yml
@@ -0,0 +1,19 @@
+---
+- name: "Cleanup — users (overridden)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove int-user-alice (test teardown)
+      ansible.platform.users:
+        config:
+          - username: "int-user-alice"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/users/overridden/converge.yml b/extensions/molecule/users/overridden/converge.yml
new file mode 100644
index 00000000..f65a10a8
--- /dev/null
+++ b/extensions/molecule/users/overridden/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — users (overridden)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.users with state=overridden
+      ansible.platform.users:
+        config:
+          - "{{ expected_config }}"
+        state: overridden
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/user/overridden/molecule.yml b/extensions/molecule/users/overridden/molecule.yml
similarity index 100%
rename from extensions/molecule/user/overridden/molecule.yml
rename to extensions/molecule/users/overridden/molecule.yml
diff --git a/extensions/molecule/users/overridden/prepare.yml b/extensions/molecule/users/overridden/prepare.yml
new file mode 100644
index 00000000..46a9b4e2
--- /dev/null
+++ b/extensions/molecule/users/overridden/prepare.yml
@@ -0,0 +1,17 @@
+---
+- name: "Prepare — users (overridden)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed prerequisite resources via merged (r0 + r1 + extras for overridden)
+      ansible.platform.users:
+        config: "{{ prepare_configs }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/user/overridden/vars.yml b/extensions/molecule/users/overridden/vars.yml
similarity index 100%
rename from extensions/molecule/user/overridden/vars.yml
rename to extensions/molecule/users/overridden/vars.yml
diff --git a/extensions/molecule/users/overridden/verify.yml b/extensions/molecule/users/overridden/verify.yml
new file mode 100644
index 00000000..e834f9c6
--- /dev/null
+++ b/extensions/molecule/users/overridden/verify.yml
@@ -0,0 +1,31 @@
+---
+- name: "Verify — users (overridden)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather all users resources (verify overridden final state)
+      ansible.platform.users:
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered_all
+
+    - name: Assert int-user-alice still exists after overridden
+      ansible.builtin.assert:
+        that:
+          - gathered_all.gathered is defined
+          - gathered_all.gathered | selectattr("username", "equalto", "int-user-alice") | list | length == 1
+        fail_msg: "Expected int-user-alice to exist after overridden. got: {{ gathered_all.gathered }}"
+
+    - name: Assert int-user-bob was deleted by overridden (not in desired config)
+      ansible.builtin.assert:
+        that:
+          - gathered_all.gathered is defined
+          - gathered_all.gathered | selectattr("username", "equalto", "int-user-bob") | list | length == 0
+        fail_msg: "overridden should have deleted int-user-bob. got: {{ gathered_all.gathered }}"
+
+...
diff --git a/extensions/molecule/users/replaced/cleanup.yml b/extensions/molecule/users/replaced/cleanup.yml
new file mode 100644
index 00000000..ded38f8b
--- /dev/null
+++ b/extensions/molecule/users/replaced/cleanup.yml
@@ -0,0 +1,19 @@
+---
+- name: "Cleanup — users (replaced)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Remove int-user-alice (test teardown)
+      ansible.platform.users:
+        config:
+          - username: "int-user-alice"
+        state: deleted
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      failed_when: false
+
+...
diff --git a/extensions/molecule/users/replaced/converge.yml b/extensions/molecule/users/replaced/converge.yml
new file mode 100644
index 00000000..eff53ca5
--- /dev/null
+++ b/extensions/molecule/users/replaced/converge.yml
@@ -0,0 +1,19 @@
+---
+- name: "Converge — users (replaced)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Run ansible.platform.users with state=replaced
+      ansible.platform.users:
+        config:
+          - "{{ expected_config }}"
+        state: replaced
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: result
+
+...
diff --git a/extensions/molecule/user/replaced/molecule.yml b/extensions/molecule/users/replaced/molecule.yml
similarity index 100%
rename from extensions/molecule/user/replaced/molecule.yml
rename to extensions/molecule/users/replaced/molecule.yml
diff --git a/extensions/molecule/users/replaced/prepare.yml b/extensions/molecule/users/replaced/prepare.yml
new file mode 100644
index 00000000..1cbe0218
--- /dev/null
+++ b/extensions/molecule/users/replaced/prepare.yml
@@ -0,0 +1,18 @@
+---
+- name: "Prepare — users (replaced)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Seed users to be replaced (prerequisite for replaced)
+      ansible.platform.users:
+        config:
+          - "{{ prepare_config }}"
+        state: merged
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+
+...
diff --git a/extensions/molecule/user/replaced/vars.yml b/extensions/molecule/users/replaced/vars.yml
similarity index 100%
rename from extensions/molecule/user/replaced/vars.yml
rename to extensions/molecule/users/replaced/vars.yml
diff --git a/extensions/molecule/users/replaced/verify.yml b/extensions/molecule/users/replaced/verify.yml
new file mode 100644
index 00000000..51917bdb
--- /dev/null
+++ b/extensions/molecule/users/replaced/verify.yml
@@ -0,0 +1,32 @@
+---
+- name: "Verify — users (replaced)"
+  hosts: localhost
+  gather_facts: false
+  vars_files:
+    - vars.yml
+  tasks:
+    - name: Gather users (assert present after replaced)
+      ansible.platform.users:
+        config:
+          - username: "{{ expected_config.username }}"
+        state: gathered
+        gateway_hostname: "{{ gateway_hostname }}"
+        gateway_username: "{{ gateway_username }}"
+        gateway_password: "{{ gateway_password }}"
+        gateway_validate_certs: "{{ gateway_validate_certs }}"
+      register: gathered
+
+    - name: Assert configuration exists after replaced
+      ansible.builtin.assert:
+        that:
+          - gathered.gathered is defined
+          - gathered.gathered | length > 0
+        fail_msg: "Expected resource after replaced. got: {{ gathered.gathered }}"
+
+    - name: Assert last_name was updated by replaced
+      ansible.builtin.assert:
+        that:
+          - (gathered.gathered | first).last_name == expected_config.last_name
+        fail_msg: "replaced should have set last_name='Johnson'. got: {{ (gathered.gathered | first).last_name }}"
+
+...
diff --git a/plugins/action/application.py b/plugins/action/application.py
deleted file mode 100644
index 9b8e19de..00000000
--- a/plugins/action/application.py
+++ /dev/null
@@ -1,23 +0,0 @@
-#!/usr/bin/env python
-# -*- coding: utf-8 -*-
-# (c) 2025, Ansible Platform Collection Contributors
-# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
-"""
-Action plugin for ansible.platform.application resource module.
-
-Auto-generated by tools/generate_resource.py — review before committing.
-"""
-
-from __future__ import absolute_import, division, print_function
-
-__metaclass__ = type
-
-from ansible_collections.ansible.platform.plugins.action.base_action import (
-    BaseResourceActionPlugin,
-)
-
-
-class ActionModule(BaseResourceActionPlugin):
-    """Resource module action plugin for application."""
-
-    USER_MODEL = "plugins.plugin_utils.ansible_models.application.AnsibleApplication"
diff --git a/plugins/action/applications.py b/plugins/action/applications.py
new file mode 100644
index 00000000..d094ba70
--- /dev/null
+++ b/plugins/action/applications.py
@@ -0,0 +1,23 @@
+#!/usr/bin/env python
+# -*- coding: utf-8 -*-
+# (c) 2025, Ansible Platform Collection Contributors
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+"""
+Action plugin for ansible.platform.applications resource module.
+
+Auto-generated by tools/generate_resource.py — review before committing.
+"""
+
+from __future__ import absolute_import, division, print_function
+
+__metaclass__ = type
+
+from ansible_collections.ansible.platform.plugins.action.base_action import (
+    BaseResourceActionPlugin,
+)
+
+
+class ActionModule(BaseResourceActionPlugin):
+    """Resource module action plugin for applications."""
+
+    USER_MODEL = "plugins.plugin_utils.ansible_models.applications.AnsibleApplications"
diff --git a/plugins/action/authenticator.py b/plugins/action/authenticator.py
deleted file mode 100644
index 14acdd00..00000000
--- a/plugins/action/authenticator.py
+++ /dev/null
@@ -1,23 +0,0 @@
-#!/usr/bin/env python
-# -*- coding: utf-8 -*-
-# (c) 2025, Ansible Platform Collection Contributors
-# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
-"""
-Action plugin for ansible.platform.authenticator resource module.
-
-Auto-generated by tools/generate_resource.py — review before committing.
-"""
-
-from __future__ import absolute_import, division, print_function
-
-__metaclass__ = type
-
-from ansible_collections.ansible.platform.plugins.action.base_action import (
-    BaseResourceActionPlugin,
-)
-
-
-class ActionModule(BaseResourceActionPlugin):
-    """Resource module action plugin for authenticator."""
-
-    USER_MODEL = "plugins.plugin_utils.ansible_models.authenticator.AnsibleAuthenticator"
diff --git a/plugins/action/authenticator_map.py b/plugins/action/authenticator_map.py
deleted file mode 100644
index 3ffd7d09..00000000
--- a/plugins/action/authenticator_map.py
+++ /dev/null
@@ -1,23 +0,0 @@
-#!/usr/bin/env python
-# -*- coding: utf-8 -*-
-# (c) 2025, Ansible Platform Collection Contributors
-# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
-"""
-Action plugin for ansible.platform.authenticator_map resource module.
-
-Auto-generated by tools/generate_resource.py — review before committing.
-"""
-
-from __future__ import absolute_import, division, print_function
-
-__metaclass__ = type
-
-from ansible_collections.ansible.platform.plugins.action.base_action import (
-    BaseResourceActionPlugin,
-)
-
-
-class ActionModule(BaseResourceActionPlugin):
-    """Resource module action plugin for authenticator_map."""
-
-    USER_MODEL = "plugins.plugin_utils.ansible_models.authenticator_map.AnsibleAuthenticatorMap"
diff --git a/plugins/action/authenticator_maps.py b/plugins/action/authenticator_maps.py
new file mode 100644
index 00000000..b5112ec8
--- /dev/null
+++ b/plugins/action/authenticator_maps.py
@@ -0,0 +1,23 @@
+#!/usr/bin/env python
+# -*- coding: utf-8 -*-
+# (c) 2025, Ansible Platform Collection Contributors
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+"""
+Action plugin for ansible.platform.authenticator_maps resource module.
+
+Auto-generated by tools/generate_resource.py — review before committing.
+"""
+
+from __future__ import absolute_import, division, print_function
+
+__metaclass__ = type
+
+from ansible_collections.ansible.platform.plugins.action.base_action import (
+    BaseResourceActionPlugin,
+)
+
+
+class ActionModule(BaseResourceActionPlugin):
+    """Resource module action plugin for authenticator_maps."""
+
+    USER_MODEL = "plugins.plugin_utils.ansible_models.authenticator_maps.AnsibleAuthenticatorMaps"
diff --git a/plugins/action/authenticator_user.py b/plugins/action/authenticator_user.py
deleted file mode 100644
index 496f6510..00000000
--- a/plugins/action/authenticator_user.py
+++ /dev/null
@@ -1,23 +0,0 @@
-#!/usr/bin/env python
-# -*- coding: utf-8 -*-
-# (c) 2025, Ansible Platform Collection Contributors
-# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
-"""
-Action plugin for ansible.platform.authenticator_user resource module.
-
-Auto-generated by tools/generate_resource.py — review before committing.
-"""
-
-from __future__ import absolute_import, division, print_function
-
-__metaclass__ = type
-
-from ansible_collections.ansible.platform.plugins.action.base_action import (
-    BaseResourceActionPlugin,
-)
-
-
-class ActionModule(BaseResourceActionPlugin):
-    """Resource module action plugin for authenticator_user."""
-
-    USER_MODEL = "plugins.plugin_utils.ansible_models.authenticator_user.AnsibleAuthenticatorUser"
diff --git a/plugins/action/authenticator_users.py b/plugins/action/authenticator_users.py
new file mode 100644
index 00000000..6bf9e8a1
--- /dev/null
+++ b/plugins/action/authenticator_users.py
@@ -0,0 +1,23 @@
+#!/usr/bin/env python
+# -*- coding: utf-8 -*-
+# (c) 2025, Ansible Platform Collection Contributors
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+"""
+Action plugin for ansible.platform.authenticator_users resource module.
+
+Auto-generated by tools/generate_resource.py — review before committing.
+"""
+
+from __future__ import absolute_import, division, print_function
+
+__metaclass__ = type
+
+from ansible_collections.ansible.platform.plugins.action.base_action import (
+    BaseResourceActionPlugin,
+)
+
+
+class ActionModule(BaseResourceActionPlugin):
+    """Resource module action plugin for authenticator_users."""
+
+    USER_MODEL = "plugins.plugin_utils.ansible_models.authenticator_users.AnsibleAuthenticatorUsers"
diff --git a/plugins/action/authenticators.py b/plugins/action/authenticators.py
new file mode 100644
index 00000000..064fe140
--- /dev/null
+++ b/plugins/action/authenticators.py
@@ -0,0 +1,23 @@
+#!/usr/bin/env python
+# -*- coding: utf-8 -*-
+# (c) 2025, Ansible Platform Collection Contributors
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+"""
+Action plugin for ansible.platform.authenticators resource module.
+
+Auto-generated by tools/generate_resource.py — review before committing.
+"""
+
+from __future__ import absolute_import, division, print_function
+
+__metaclass__ = type
+
+from ansible_collections.ansible.platform.plugins.action.base_action import (
+    BaseResourceActionPlugin,
+)
+
+
+class ActionModule(BaseResourceActionPlugin):
+    """Resource module action plugin for authenticators."""
+
+    USER_MODEL = "plugins.plugin_utils.ansible_models.authenticators.AnsibleAuthenticators"
diff --git a/plugins/action/base_action.py b/plugins/action/base_action.py
index e6cf915a..3b5ea6e9 100644
--- a/plugins/action/base_action.py
+++ b/plugins/action/base_action.py
@@ -30,7 +30,7 @@
 
 Subclass contract (minimal):
     class ActionModule(BaseResourceActionPlugin):
-        USER_MODEL = 'plugins.plugin_utils.ansible_models.user.AnsibleUser'
+        USER_MODEL = 'plugins.plugin_utils.ansible_models.users.AnsibleUsers'
 
 Identity categories (see docs/05-design-principles.md):
     Category A: CANONICAL_KEY set, SYSTEM_KEY=None  — user key IS the API key
@@ -44,6 +44,7 @@ class ActionModule(BaseResourceActionPlugin):
 
 import base64
 import importlib
+import importlib.util
 import json
 import subprocess
 import time
@@ -244,7 +245,7 @@ class BaseResourceActionPlugin(ActionBase):
     Subclasses declare the Ansible Model import path:
 
         class ActionModule(BaseResourceActionPlugin):
-            USER_MODEL = 'plugins.plugin_utils.ansible_models.user.AnsibleUser'
+            USER_MODEL = 'plugins.plugin_utils.ansible_models.users.AnsibleUsers'
 
     All resource metadata (MODULE_NAME, SCOPE_PARAM, CANONICAL_KEY, etc.)
     is read from the Ansible Model class at runtime.
@@ -949,13 +950,19 @@ def _get_documentation(self) -> str:
         if not self.MODULE_NAME:
             return ""
 
+        # Module files use plural names (e.g. users.py) while MODULE_NAME is
+        # the singular API endpoint name (e.g. "user"). Derive the file name.
+        module_file_name = (
+            self.MODULE_NAME
+            if self.MODULE_NAME.endswith("s")
+            else self.MODULE_NAME + "s"
+        )
+
         # Primary: file-based discovery relative to this action plugin
-        module_file = Path(__file__).parent.parent / "modules" / f"{self.MODULE_NAME}.py"
+        module_file = Path(__file__).parent.parent / "modules" / f"{module_file_name}.py"
         if module_file.exists():
             try:
-                import importlib.util
-
-                spec = importlib.util.spec_from_file_location(f"module_{self.MODULE_NAME}", module_file)
+                spec = importlib.util.spec_from_file_location(f"module_{module_file_name}", module_file)
                 if spec and spec.loader:
                     mod = importlib.util.module_from_spec(spec)
                     spec.loader.exec_module(mod)
@@ -968,8 +975,8 @@ def _get_documentation(self) -> str:
         # Fallback: standard import
         parent_pkg = type(self).__module__.rsplit(".", 2)[0]  # ...plugins
         for candidate in (
-            f"{parent_pkg}.modules.{self.MODULE_NAME}",
-            f"ansible_collections.ansible.platform.plugins.modules.{self.MODULE_NAME}",
+            f"{parent_pkg}.modules.{module_file_name}",
+            f"ansible_collections.ansible.platform.plugins.modules.{module_file_name}",
         ):
             try:
                 mod = importlib.import_module(candidate)
@@ -1025,8 +1032,6 @@ def _load_documentation_fragment(self, fragment_name: str) -> dict:
             fragment_path = Path(__file__).parent.parent / "doc_fragments" / f"{fragment}.py"
 
             if fragment_path.exists():
-                import importlib.util
-
                 spec = importlib.util.spec_from_file_location(f"doc_fragment_{fragment}", fragment_path)
                 if spec and spec.loader:
                     module = importlib.util.module_from_spec(spec)
diff --git a/plugins/action/ca_certificate.py b/plugins/action/ca_certificate.py
deleted file mode 100644
index 89096b29..00000000
--- a/plugins/action/ca_certificate.py
+++ /dev/null
@@ -1,23 +0,0 @@
-#!/usr/bin/env python
-# -*- coding: utf-8 -*-
-# (c) 2025, Ansible Platform Collection Contributors
-# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
-"""
-Action plugin for ansible.platform.ca_certificate resource module.
-
-Auto-generated by tools/generate_resource.py — review before committing.
-"""
-
-from __future__ import absolute_import, division, print_function
-
-__metaclass__ = type
-
-from ansible_collections.ansible.platform.plugins.action.base_action import (
-    BaseResourceActionPlugin,
-)
-
-
-class ActionModule(BaseResourceActionPlugin):
-    """Resource module action plugin for ca_certificate."""
-
-    USER_MODEL = "plugins.plugin_utils.ansible_models.ca_certificate.AnsibleCaCertificate"
diff --git a/plugins/action/ca_certificates.py b/plugins/action/ca_certificates.py
new file mode 100644
index 00000000..8eb1fa0f
--- /dev/null
+++ b/plugins/action/ca_certificates.py
@@ -0,0 +1,23 @@
+#!/usr/bin/env python
+# -*- coding: utf-8 -*-
+# (c) 2025, Ansible Platform Collection Contributors
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+"""
+Action plugin for ansible.platform.ca_certificates resource module.
+
+Auto-generated by tools/generate_resource.py — review before committing.
+"""
+
+from __future__ import absolute_import, division, print_function
+
+__metaclass__ = type
+
+from ansible_collections.ansible.platform.plugins.action.base_action import (
+    BaseResourceActionPlugin,
+)
+
+
+class ActionModule(BaseResourceActionPlugin):
+    """Resource module action plugin for ca_certificates."""
+
+    USER_MODEL = "plugins.plugin_utils.ansible_models.ca_certificates.AnsibleCaCertificates"
diff --git a/plugins/action/feature_flag.py b/plugins/action/feature_flag.py
deleted file mode 100644
index 559ae838..00000000
--- a/plugins/action/feature_flag.py
+++ /dev/null
@@ -1,23 +0,0 @@
-#!/usr/bin/env python
-# -*- coding: utf-8 -*-
-# (c) 2025, Ansible Platform Collection Contributors
-# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
-"""
-Action plugin for ansible.platform.feature_flag resource module.
-
-Auto-generated by tools/generate_resource.py — review before committing.
-"""
-
-from __future__ import absolute_import, division, print_function
-
-__metaclass__ = type
-
-from ansible_collections.ansible.platform.plugins.action.base_action import (
-    BaseResourceActionPlugin,
-)
-
-
-class ActionModule(BaseResourceActionPlugin):
-    """Resource module action plugin for feature_flag."""
-
-    USER_MODEL = "plugins.plugin_utils.ansible_models.feature_flag.AnsibleFeatureFlag"
diff --git a/plugins/action/feature_flags.py b/plugins/action/feature_flags.py
new file mode 100644
index 00000000..4375c74d
--- /dev/null
+++ b/plugins/action/feature_flags.py
@@ -0,0 +1,23 @@
+#!/usr/bin/env python
+# -*- coding: utf-8 -*-
+# (c) 2025, Ansible Platform Collection Contributors
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+"""
+Action plugin for ansible.platform.feature_flags resource module.
+
+Auto-generated by tools/generate_resource.py — review before committing.
+"""
+
+from __future__ import absolute_import, division, print_function
+
+__metaclass__ = type
+
+from ansible_collections.ansible.platform.plugins.action.base_action import (
+    BaseResourceActionPlugin,
+)
+
+
+class ActionModule(BaseResourceActionPlugin):
+    """Resource module action plugin for feature_flags."""
+
+    USER_MODEL = "plugins.plugin_utils.ansible_models.feature_flags.AnsibleFeatureFlags"
diff --git a/plugins/action/http_port.py b/plugins/action/http_port.py
deleted file mode 100644
index c0d99603..00000000
--- a/plugins/action/http_port.py
+++ /dev/null
@@ -1,23 +0,0 @@
-#!/usr/bin/env python
-# -*- coding: utf-8 -*-
-# (c) 2025, Ansible Platform Collection Contributors
-# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
-"""
-Action plugin for ansible.platform.http_port resource module.
-
-Auto-generated by tools/generate_resource.py — review before committing.
-"""
-
-from __future__ import absolute_import, division, print_function
-
-__metaclass__ = type
-
-from ansible_collections.ansible.platform.plugins.action.base_action import (
-    BaseResourceActionPlugin,
-)
-
-
-class ActionModule(BaseResourceActionPlugin):
-    """Resource module action plugin for http_port."""
-
-    USER_MODEL = "plugins.plugin_utils.ansible_models.http_port.AnsibleHttpPort"
diff --git a/plugins/action/http_ports.py b/plugins/action/http_ports.py
new file mode 100644
index 00000000..27b16773
--- /dev/null
+++ b/plugins/action/http_ports.py
@@ -0,0 +1,23 @@
+#!/usr/bin/env python
+# -*- coding: utf-8 -*-
+# (c) 2025, Ansible Platform Collection Contributors
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+"""
+Action plugin for ansible.platform.http_ports resource module.
+
+Auto-generated by tools/generate_resource.py — review before committing.
+"""
+
+from __future__ import absolute_import, division, print_function
+
+__metaclass__ = type
+
+from ansible_collections.ansible.platform.plugins.action.base_action import (
+    BaseResourceActionPlugin,
+)
+
+
+class ActionModule(BaseResourceActionPlugin):
+    """Resource module action plugin for http_ports."""
+
+    USER_MODEL = "plugins.plugin_utils.ansible_models.http_ports.AnsibleHttpPorts"
diff --git a/plugins/action/organization.py b/plugins/action/organization.py
deleted file mode 100644
index 47bd5cb1..00000000
--- a/plugins/action/organization.py
+++ /dev/null
@@ -1,23 +0,0 @@
-#!/usr/bin/env python
-# -*- coding: utf-8 -*-
-# (c) 2025, Ansible Platform Collection Contributors
-# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
-"""
-Action plugin for ansible.platform.organization resource module.
-
-Auto-generated by tools/generate_resource.py — review before committing.
-"""
-
-from __future__ import absolute_import, division, print_function
-
-__metaclass__ = type
-
-from ansible_collections.ansible.platform.plugins.action.base_action import (
-    BaseResourceActionPlugin,
-)
-
-
-class ActionModule(BaseResourceActionPlugin):
-    """Resource module action plugin for organization."""
-
-    USER_MODEL = "plugins.plugin_utils.ansible_models.organization.AnsibleOrganization"
diff --git a/plugins/action/organizations.py b/plugins/action/organizations.py
new file mode 100644
index 00000000..5241b5a0
--- /dev/null
+++ b/plugins/action/organizations.py
@@ -0,0 +1,23 @@
+#!/usr/bin/env python
+# -*- coding: utf-8 -*-
+# (c) 2025, Ansible Platform Collection Contributors
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+"""
+Action plugin for ansible.platform.organizations resource module.
+
+Auto-generated by tools/generate_resource.py — review before committing.
+"""
+
+from __future__ import absolute_import, division, print_function
+
+__metaclass__ = type
+
+from ansible_collections.ansible.platform.plugins.action.base_action import (
+    BaseResourceActionPlugin,
+)
+
+
+class ActionModule(BaseResourceActionPlugin):
+    """Resource module action plugin for organizations."""
+
+    USER_MODEL = "plugins.plugin_utils.ansible_models.organizations.AnsibleOrganizations"
diff --git a/plugins/action/role_definition.py b/plugins/action/role_definition.py
deleted file mode 100644
index 8618c4b5..00000000
--- a/plugins/action/role_definition.py
+++ /dev/null
@@ -1,23 +0,0 @@
-#!/usr/bin/env python
-# -*- coding: utf-8 -*-
-# (c) 2025, Ansible Platform Collection Contributors
-# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
-"""
-Action plugin for ansible.platform.role_definition resource module.
-
-Auto-generated by tools/generate_resource.py — review before committing.
-"""
-
-from __future__ import absolute_import, division, print_function
-
-__metaclass__ = type
-
-from ansible_collections.ansible.platform.plugins.action.base_action import (
-    BaseResourceActionPlugin,
-)
-
-
-class ActionModule(BaseResourceActionPlugin):
-    """Resource module action plugin for role_definition."""
-
-    USER_MODEL = "plugins.plugin_utils.ansible_models.role_definition.AnsibleRoleDefinition"
diff --git a/plugins/action/role_definitions.py b/plugins/action/role_definitions.py
new file mode 100644
index 00000000..9ddbb572
--- /dev/null
+++ b/plugins/action/role_definitions.py
@@ -0,0 +1,23 @@
+#!/usr/bin/env python
+# -*- coding: utf-8 -*-
+# (c) 2025, Ansible Platform Collection Contributors
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+"""
+Action plugin for ansible.platform.role_definitions resource module.
+
+Auto-generated by tools/generate_resource.py — review before committing.
+"""
+
+from __future__ import absolute_import, division, print_function
+
+__metaclass__ = type
+
+from ansible_collections.ansible.platform.plugins.action.base_action import (
+    BaseResourceActionPlugin,
+)
+
+
+class ActionModule(BaseResourceActionPlugin):
+    """Resource module action plugin for role_definitions."""
+
+    USER_MODEL = "plugins.plugin_utils.ansible_models.role_definitions.AnsibleRoleDefinitions"
diff --git a/plugins/action/role_team_assignment.py b/plugins/action/role_team_assignment.py
deleted file mode 100644
index 7c182114..00000000
--- a/plugins/action/role_team_assignment.py
+++ /dev/null
@@ -1,23 +0,0 @@
-#!/usr/bin/env python
-# -*- coding: utf-8 -*-
-# (c) 2025, Ansible Platform Collection Contributors
-# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
-"""
-Action plugin for ansible.platform.role_team_assignment resource module.
-
-Auto-generated by tools/generate_resource.py — review before committing.
-"""
-
-from __future__ import absolute_import, division, print_function
-
-__metaclass__ = type
-
-from ansible_collections.ansible.platform.plugins.action.base_action import (
-    BaseResourceActionPlugin,
-)
-
-
-class ActionModule(BaseResourceActionPlugin):
-    """Resource module action plugin for role_team_assignment."""
-
-    USER_MODEL = "plugins.plugin_utils.ansible_models.role_team_assignment.AnsibleRoleTeamAssignment"
diff --git a/plugins/action/role_team_assignments.py b/plugins/action/role_team_assignments.py
new file mode 100644
index 00000000..89dd84bb
--- /dev/null
+++ b/plugins/action/role_team_assignments.py
@@ -0,0 +1,23 @@
+#!/usr/bin/env python
+# -*- coding: utf-8 -*-
+# (c) 2025, Ansible Platform Collection Contributors
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+"""
+Action plugin for ansible.platform.role_team_assignments resource module.
+
+Auto-generated by tools/generate_resource.py — review before committing.
+"""
+
+from __future__ import absolute_import, division, print_function
+
+__metaclass__ = type
+
+from ansible_collections.ansible.platform.plugins.action.base_action import (
+    BaseResourceActionPlugin,
+)
+
+
+class ActionModule(BaseResourceActionPlugin):
+    """Resource module action plugin for role_team_assignments."""
+
+    USER_MODEL = "plugins.plugin_utils.ansible_models.role_team_assignments.AnsibleRoleTeamAssignments"
diff --git a/plugins/action/role_user_assignment.py b/plugins/action/role_user_assignment.py
deleted file mode 100644
index 04d001fb..00000000
--- a/plugins/action/role_user_assignment.py
+++ /dev/null
@@ -1,23 +0,0 @@
-#!/usr/bin/env python
-# -*- coding: utf-8 -*-
-# (c) 2025, Ansible Platform Collection Contributors
-# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
-"""
-Action plugin for ansible.platform.role_user_assignment resource module.
-
-Auto-generated by tools/generate_resource.py — review before committing.
-"""
-
-from __future__ import absolute_import, division, print_function
-
-__metaclass__ = type
-
-from ansible_collections.ansible.platform.plugins.action.base_action import (
-    BaseResourceActionPlugin,
-)
-
-
-class ActionModule(BaseResourceActionPlugin):
-    """Resource module action plugin for role_user_assignment."""
-
-    USER_MODEL = "plugins.plugin_utils.ansible_models.role_user_assignment.AnsibleRoleUserAssignment"
diff --git a/plugins/action/role_user_assignments.py b/plugins/action/role_user_assignments.py
new file mode 100644
index 00000000..5c00d2e4
--- /dev/null
+++ b/plugins/action/role_user_assignments.py
@@ -0,0 +1,23 @@
+#!/usr/bin/env python
+# -*- coding: utf-8 -*-
+# (c) 2025, Ansible Platform Collection Contributors
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+"""
+Action plugin for ansible.platform.role_user_assignments resource module.
+
+Auto-generated by tools/generate_resource.py — review before committing.
+"""
+
+from __future__ import absolute_import, division, print_function
+
+__metaclass__ = type
+
+from ansible_collections.ansible.platform.plugins.action.base_action import (
+    BaseResourceActionPlugin,
+)
+
+
+class ActionModule(BaseResourceActionPlugin):
+    """Resource module action plugin for role_user_assignments."""
+
+    USER_MODEL = "plugins.plugin_utils.ansible_models.role_user_assignments.AnsibleRoleUserAssignments"
diff --git a/plugins/action/route.py b/plugins/action/route.py
deleted file mode 100644
index 75f13ce2..00000000
--- a/plugins/action/route.py
+++ /dev/null
@@ -1,23 +0,0 @@
-#!/usr/bin/env python
-# -*- coding: utf-8 -*-
-# (c) 2025, Ansible Platform Collection Contributors
-# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
-"""
-Action plugin for ansible.platform.route resource module.
-
-Auto-generated by tools/generate_resource.py — review before committing.
-"""
-
-from __future__ import absolute_import, division, print_function
-
-__metaclass__ = type
-
-from ansible_collections.ansible.platform.plugins.action.base_action import (
-    BaseResourceActionPlugin,
-)
-
-
-class ActionModule(BaseResourceActionPlugin):
-    """Resource module action plugin for route."""
-
-    USER_MODEL = "plugins.plugin_utils.ansible_models.route.AnsibleRoute"
diff --git a/plugins/action/routes.py b/plugins/action/routes.py
new file mode 100644
index 00000000..6e42ce14
--- /dev/null
+++ b/plugins/action/routes.py
@@ -0,0 +1,23 @@
+#!/usr/bin/env python
+# -*- coding: utf-8 -*-
+# (c) 2025, Ansible Platform Collection Contributors
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+"""
+Action plugin for ansible.platform.routes resource module.
+
+Auto-generated by tools/generate_resource.py — review before committing.
+"""
+
+from __future__ import absolute_import, division, print_function
+
+__metaclass__ = type
+
+from ansible_collections.ansible.platform.plugins.action.base_action import (
+    BaseResourceActionPlugin,
+)
+
+
+class ActionModule(BaseResourceActionPlugin):
+    """Resource module action plugin for routes."""
+
+    USER_MODEL = "plugins.plugin_utils.ansible_models.routes.AnsibleRoutes"
diff --git a/plugins/action/service.py b/plugins/action/service.py
deleted file mode 100644
index 78fa7482..00000000
--- a/plugins/action/service.py
+++ /dev/null
@@ -1,23 +0,0 @@
-#!/usr/bin/env python
-# -*- coding: utf-8 -*-
-# (c) 2025, Ansible Platform Collection Contributors
-# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
-"""
-Action plugin for ansible.platform.service resource module.
-
-Auto-generated by tools/generate_resource.py — review before committing.
-"""
-
-from __future__ import absolute_import, division, print_function
-
-__metaclass__ = type
-
-from ansible_collections.ansible.platform.plugins.action.base_action import (
-    BaseResourceActionPlugin,
-)
-
-
-class ActionModule(BaseResourceActionPlugin):
-    """Resource module action plugin for service."""
-
-    USER_MODEL = "plugins.plugin_utils.ansible_models.service.AnsibleService"
diff --git a/plugins/action/service_cluster.py b/plugins/action/service_cluster.py
deleted file mode 100644
index dba7f922..00000000
--- a/plugins/action/service_cluster.py
+++ /dev/null
@@ -1,23 +0,0 @@
-#!/usr/bin/env python
-# -*- coding: utf-8 -*-
-# (c) 2025, Ansible Platform Collection Contributors
-# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
-"""
-Action plugin for ansible.platform.service_cluster resource module.
-
-Auto-generated by tools/generate_resource.py — review before committing.
-"""
-
-from __future__ import absolute_import, division, print_function
-
-__metaclass__ = type
-
-from ansible_collections.ansible.platform.plugins.action.base_action import (
-    BaseResourceActionPlugin,
-)
-
-
-class ActionModule(BaseResourceActionPlugin):
-    """Resource module action plugin for service_cluster."""
-
-    USER_MODEL = "plugins.plugin_utils.ansible_models.service_cluster.AnsibleServiceCluster"
diff --git a/plugins/action/service_clusters.py b/plugins/action/service_clusters.py
new file mode 100644
index 00000000..e794bb5f
--- /dev/null
+++ b/plugins/action/service_clusters.py
@@ -0,0 +1,23 @@
+#!/usr/bin/env python
+# -*- coding: utf-8 -*-
+# (c) 2025, Ansible Platform Collection Contributors
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+"""
+Action plugin for ansible.platform.service_clusters resource module.
+
+Auto-generated by tools/generate_resource.py — review before committing.
+"""
+
+from __future__ import absolute_import, division, print_function
+
+__metaclass__ = type
+
+from ansible_collections.ansible.platform.plugins.action.base_action import (
+    BaseResourceActionPlugin,
+)
+
+
+class ActionModule(BaseResourceActionPlugin):
+    """Resource module action plugin for service_clusters."""
+
+    USER_MODEL = "plugins.plugin_utils.ansible_models.service_clusters.AnsibleServiceClusters"
diff --git a/plugins/action/service_key.py b/plugins/action/service_key.py
deleted file mode 100644
index acc30006..00000000
--- a/plugins/action/service_key.py
+++ /dev/null
@@ -1,23 +0,0 @@
-#!/usr/bin/env python
-# -*- coding: utf-8 -*-
-# (c) 2025, Ansible Platform Collection Contributors
-# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
-"""
-Action plugin for ansible.platform.service_key resource module.
-
-Auto-generated by tools/generate_resource.py — review before committing.
-"""
-
-from __future__ import absolute_import, division, print_function
-
-__metaclass__ = type
-
-from ansible_collections.ansible.platform.plugins.action.base_action import (
-    BaseResourceActionPlugin,
-)
-
-
-class ActionModule(BaseResourceActionPlugin):
-    """Resource module action plugin for service_key."""
-
-    USER_MODEL = "plugins.plugin_utils.ansible_models.service_key.AnsibleServiceKey"
diff --git a/plugins/action/service_keys.py b/plugins/action/service_keys.py
new file mode 100644
index 00000000..918c8350
--- /dev/null
+++ b/plugins/action/service_keys.py
@@ -0,0 +1,23 @@
+#!/usr/bin/env python
+# -*- coding: utf-8 -*-
+# (c) 2025, Ansible Platform Collection Contributors
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+"""
+Action plugin for ansible.platform.service_keys resource module.
+
+Auto-generated by tools/generate_resource.py — review before committing.
+"""
+
+from __future__ import absolute_import, division, print_function
+
+__metaclass__ = type
+
+from ansible_collections.ansible.platform.plugins.action.base_action import (
+    BaseResourceActionPlugin,
+)
+
+
+class ActionModule(BaseResourceActionPlugin):
+    """Resource module action plugin for service_keys."""
+
+    USER_MODEL = "plugins.plugin_utils.ansible_models.service_keys.AnsibleServiceKeys"
diff --git a/plugins/action/service_node.py b/plugins/action/service_node.py
deleted file mode 100644
index ec0db897..00000000
--- a/plugins/action/service_node.py
+++ /dev/null
@@ -1,23 +0,0 @@
-#!/usr/bin/env python
-# -*- coding: utf-8 -*-
-# (c) 2025, Ansible Platform Collection Contributors
-# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
-"""
-Action plugin for ansible.platform.service_node resource module.
-
-Auto-generated by tools/generate_resource.py — review before committing.
-"""
-
-from __future__ import absolute_import, division, print_function
-
-__metaclass__ = type
-
-from ansible_collections.ansible.platform.plugins.action.base_action import (
-    BaseResourceActionPlugin,
-)
-
-
-class ActionModule(BaseResourceActionPlugin):
-    """Resource module action plugin for service_node."""
-
-    USER_MODEL = "plugins.plugin_utils.ansible_models.service_node.AnsibleServiceNode"
diff --git a/plugins/action/service_nodes.py b/plugins/action/service_nodes.py
new file mode 100644
index 00000000..8229e267
--- /dev/null
+++ b/plugins/action/service_nodes.py
@@ -0,0 +1,23 @@
+#!/usr/bin/env python
+# -*- coding: utf-8 -*-
+# (c) 2025, Ansible Platform Collection Contributors
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+"""
+Action plugin for ansible.platform.service_nodes resource module.
+
+Auto-generated by tools/generate_resource.py — review before committing.
+"""
+
+from __future__ import absolute_import, division, print_function
+
+__metaclass__ = type
+
+from ansible_collections.ansible.platform.plugins.action.base_action import (
+    BaseResourceActionPlugin,
+)
+
+
+class ActionModule(BaseResourceActionPlugin):
+    """Resource module action plugin for service_nodes."""
+
+    USER_MODEL = "plugins.plugin_utils.ansible_models.service_nodes.AnsibleServiceNodes"
diff --git a/plugins/action/service_type.py b/plugins/action/service_type.py
deleted file mode 100644
index 7331044e..00000000
--- a/plugins/action/service_type.py
+++ /dev/null
@@ -1,23 +0,0 @@
-#!/usr/bin/env python
-# -*- coding: utf-8 -*-
-# (c) 2025, Ansible Platform Collection Contributors
-# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
-"""
-Action plugin for ansible.platform.service_type resource module.
-
-Auto-generated by tools/generate_resource.py — review before committing.
-"""
-
-from __future__ import absolute_import, division, print_function
-
-__metaclass__ = type
-
-from ansible_collections.ansible.platform.plugins.action.base_action import (
-    BaseResourceActionPlugin,
-)
-
-
-class ActionModule(BaseResourceActionPlugin):
-    """Resource module action plugin for service_type."""
-
-    USER_MODEL = "plugins.plugin_utils.ansible_models.service_type.AnsibleServiceType"
diff --git a/plugins/action/service_types.py b/plugins/action/service_types.py
new file mode 100644
index 00000000..56175a99
--- /dev/null
+++ b/plugins/action/service_types.py
@@ -0,0 +1,23 @@
+#!/usr/bin/env python
+# -*- coding: utf-8 -*-
+# (c) 2025, Ansible Platform Collection Contributors
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+"""
+Action plugin for ansible.platform.service_types resource module.
+
+Auto-generated by tools/generate_resource.py — review before committing.
+"""
+
+from __future__ import absolute_import, division, print_function
+
+__metaclass__ = type
+
+from ansible_collections.ansible.platform.plugins.action.base_action import (
+    BaseResourceActionPlugin,
+)
+
+
+class ActionModule(BaseResourceActionPlugin):
+    """Resource module action plugin for service_types."""
+
+    USER_MODEL = "plugins.plugin_utils.ansible_models.service_types.AnsibleServiceTypes"
diff --git a/plugins/action/services.py b/plugins/action/services.py
new file mode 100644
index 00000000..34047305
--- /dev/null
+++ b/plugins/action/services.py
@@ -0,0 +1,23 @@
+#!/usr/bin/env python
+# -*- coding: utf-8 -*-
+# (c) 2025, Ansible Platform Collection Contributors
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+"""
+Action plugin for ansible.platform.services resource module.
+
+Auto-generated by tools/generate_resource.py — review before committing.
+"""
+
+from __future__ import absolute_import, division, print_function
+
+__metaclass__ = type
+
+from ansible_collections.ansible.platform.plugins.action.base_action import (
+    BaseResourceActionPlugin,
+)
+
+
+class ActionModule(BaseResourceActionPlugin):
+    """Resource module action plugin for services."""
+
+    USER_MODEL = "plugins.plugin_utils.ansible_models.services.AnsibleServices"
diff --git a/plugins/action/settings.py b/plugins/action/settings.py
index f12dbcbe..8b4a12d0 100644
--- a/plugins/action/settings.py
+++ b/plugins/action/settings.py
@@ -20,4 +20,4 @@
 class ActionModule(BaseResourceActionPlugin):
     """Resource module action plugin for setting."""
 
-    USER_MODEL = "plugins.plugin_utils.ansible_models.settings.AnsibleSetting"
+    USER_MODEL = "plugins.plugin_utils.ansible_models.settings.AnsibleSettings"
diff --git a/plugins/action/team.py b/plugins/action/team.py
deleted file mode 100644
index cc3b7221..00000000
--- a/plugins/action/team.py
+++ /dev/null
@@ -1,23 +0,0 @@
-#!/usr/bin/env python
-# -*- coding: utf-8 -*-
-# (c) 2025, Ansible Platform Collection Contributors
-# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
-"""
-Action plugin for ansible.platform.team resource module.
-
-Auto-generated by tools/generate_resource.py — review before committing.
-"""
-
-from __future__ import absolute_import, division, print_function
-
-__metaclass__ = type
-
-from ansible_collections.ansible.platform.plugins.action.base_action import (
-    BaseResourceActionPlugin,
-)
-
-
-class ActionModule(BaseResourceActionPlugin):
-    """Resource module action plugin for team."""
-
-    USER_MODEL = "plugins.plugin_utils.ansible_models.team.AnsibleTeam"
diff --git a/plugins/action/teams.py b/plugins/action/teams.py
new file mode 100644
index 00000000..a85f951f
--- /dev/null
+++ b/plugins/action/teams.py
@@ -0,0 +1,23 @@
+#!/usr/bin/env python
+# -*- coding: utf-8 -*-
+# (c) 2025, Ansible Platform Collection Contributors
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+"""
+Action plugin for ansible.platform.teams resource module.
+
+Auto-generated by tools/generate_resource.py — review before committing.
+"""
+
+from __future__ import absolute_import, division, print_function
+
+__metaclass__ = type
+
+from ansible_collections.ansible.platform.plugins.action.base_action import (
+    BaseResourceActionPlugin,
+)
+
+
+class ActionModule(BaseResourceActionPlugin):
+    """Resource module action plugin for teams."""
+
+    USER_MODEL = "plugins.plugin_utils.ansible_models.teams.AnsibleTeams"
diff --git a/plugins/action/token.py b/plugins/action/token.py
deleted file mode 100644
index e705605e..00000000
--- a/plugins/action/token.py
+++ /dev/null
@@ -1,23 +0,0 @@
-#!/usr/bin/env python
-# -*- coding: utf-8 -*-
-# (c) 2025, Ansible Platform Collection Contributors
-# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
-"""
-Action plugin for ansible.platform.token resource module.
-
-Auto-generated by tools/generate_resource.py — review before committing.
-"""
-
-from __future__ import absolute_import, division, print_function
-
-__metaclass__ = type
-
-from ansible_collections.ansible.platform.plugins.action.base_action import (
-    BaseResourceActionPlugin,
-)
-
-
-class ActionModule(BaseResourceActionPlugin):
-    """Resource module action plugin for token."""
-
-    USER_MODEL = "plugins.plugin_utils.ansible_models.token.AnsibleToken"
diff --git a/plugins/action/tokens.py b/plugins/action/tokens.py
new file mode 100644
index 00000000..680fc6ae
--- /dev/null
+++ b/plugins/action/tokens.py
@@ -0,0 +1,23 @@
+#!/usr/bin/env python
+# -*- coding: utf-8 -*-
+# (c) 2025, Ansible Platform Collection Contributors
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+"""
+Action plugin for ansible.platform.tokens resource module.
+
+Auto-generated by tools/generate_resource.py — review before committing.
+"""
+
+from __future__ import absolute_import, division, print_function
+
+__metaclass__ = type
+
+from ansible_collections.ansible.platform.plugins.action.base_action import (
+    BaseResourceActionPlugin,
+)
+
+
+class ActionModule(BaseResourceActionPlugin):
+    """Resource module action plugin for tokens."""
+
+    USER_MODEL = "plugins.plugin_utils.ansible_models.tokens.AnsibleTokens"
diff --git a/plugins/action/ui_plugin_route.py b/plugins/action/ui_plugin_route.py
deleted file mode 100644
index 23fe8a46..00000000
--- a/plugins/action/ui_plugin_route.py
+++ /dev/null
@@ -1,23 +0,0 @@
-#!/usr/bin/env python
-# -*- coding: utf-8 -*-
-# (c) 2025, Ansible Platform Collection Contributors
-# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
-"""
-Action plugin for ansible.platform.ui_plugin_route resource module.
-
-Auto-generated by tools/generate_resource.py — review before committing.
-"""
-
-from __future__ import absolute_import, division, print_function
-
-__metaclass__ = type
-
-from ansible_collections.ansible.platform.plugins.action.base_action import (
-    BaseResourceActionPlugin,
-)
-
-
-class ActionModule(BaseResourceActionPlugin):
-    """Resource module action plugin for ui_plugin_route."""
-
-    USER_MODEL = "plugins.plugin_utils.ansible_models.ui_plugin_route.AnsibleUiPluginRoute"
diff --git a/plugins/action/ui_plugin_routes.py b/plugins/action/ui_plugin_routes.py
new file mode 100644
index 00000000..9623fe1a
--- /dev/null
+++ b/plugins/action/ui_plugin_routes.py
@@ -0,0 +1,23 @@
+#!/usr/bin/env python
+# -*- coding: utf-8 -*-
+# (c) 2025, Ansible Platform Collection Contributors
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+"""
+Action plugin for ansible.platform.ui_plugin_routes resource module.
+
+Auto-generated by tools/generate_resource.py — review before committing.
+"""
+
+from __future__ import absolute_import, division, print_function
+
+__metaclass__ = type
+
+from ansible_collections.ansible.platform.plugins.action.base_action import (
+    BaseResourceActionPlugin,
+)
+
+
+class ActionModule(BaseResourceActionPlugin):
+    """Resource module action plugin for ui_plugin_routes."""
+
+    USER_MODEL = "plugins.plugin_utils.ansible_models.ui_plugin_routes.AnsibleUiPluginRoutes"
diff --git a/plugins/action/user.py b/plugins/action/user.py
deleted file mode 100644
index 10f70e41..00000000
--- a/plugins/action/user.py
+++ /dev/null
@@ -1,23 +0,0 @@
-#!/usr/bin/env python
-# -*- coding: utf-8 -*-
-# (c) 2025, Ansible Platform Collection Contributors
-# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
-"""
-Action plugin for ansible.platform.user resource module.
-
-Auto-generated by tools/generate_resource.py — review before committing.
-"""
-
-from __future__ import absolute_import, division, print_function
-
-__metaclass__ = type
-
-from ansible_collections.ansible.platform.plugins.action.base_action import (
-    BaseResourceActionPlugin,
-)
-
-
-class ActionModule(BaseResourceActionPlugin):
-    """Resource module action plugin for user."""
-
-    USER_MODEL = "plugins.plugin_utils.ansible_models.user.AnsibleUser"
diff --git a/plugins/action/users.py b/plugins/action/users.py
new file mode 100644
index 00000000..d92c4c0b
--- /dev/null
+++ b/plugins/action/users.py
@@ -0,0 +1,23 @@
+#!/usr/bin/env python
+# -*- coding: utf-8 -*-
+# (c) 2025, Ansible Platform Collection Contributors
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+"""
+Action plugin for ansible.platform.users resource module.
+
+Auto-generated by tools/generate_resource.py — review before committing.
+"""
+
+from __future__ import absolute_import, division, print_function
+
+__metaclass__ = type
+
+from ansible_collections.ansible.platform.plugins.action.base_action import (
+    BaseResourceActionPlugin,
+)
+
+
+class ActionModule(BaseResourceActionPlugin):
+    """Resource module action plugin for users."""
+
+    USER_MODEL = "plugins.plugin_utils.ansible_models.users.AnsibleUsers"
diff --git a/plugins/modules/application.py b/plugins/modules/application.py
deleted file mode 100644
index f5d9cc2c..00000000
--- a/plugins/modules/application.py
+++ /dev/null
@@ -1,131 +0,0 @@
-#!/usr/bin/python
-# coding: utf-8 -*-
-# (c) 2025, Ansible Platform Collection Contributors
-# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
-"""
-Auto-generated by tools/generate_resource.py — review before committing.
-"""
-
-from __future__ import absolute_import, division, print_function
-
-__metaclass__ = type
-
-DOCUMENTATION = """
----
-module: application
-short_description: Manage gateway application resources.
-author: Red Hat (@RedHatOfficial)
-description:
-    - Create, update, delete, or gather automation platform gateway application resources.
-    - Follows the Ansible resource module pattern with before/after state tracking.
-options:
-    config:
-      description:
-        - A list of application resource configurations.
-        - Each entry represents a desired application state.
-      type: list
-      elements: dict
-      suboptions:
-        name:
-          required: true
-          type: str
-          description: The name of this resource.
-        organization:
-          required: true
-          type: int
-          description: Organization containing this application.
-        client_type:
-          required: true
-          type: str
-          description:
-            - Set to Public or Confidential depending on how secure the client device is.
-            - "confidential - Confidential"
-            - "public - Public"
-        authorization_grant_type:
-          required: true
-          type: str
-          description:
-            - The Grant type the user must use for acquire tokens for this application.
-            - "authorization-code - Authorization code"
-            - "password - Resource owner password-based"
-        redirect_uris:
-          type: str
-          description: Allowed URIs list, space separated
-        post_logout_redirect_uris:
-          type: str
-          description: Allowed Post Logout URIs list, space separated
-        algorithm:
-          type: str
-          description:
-            - "empty string - No OIDC support"
-            - "RS256 - RSA with SHA-2 256"
-            - "HS256 - HMAC with SHA-2 256"
-        user:
-          type: int
-          description: The user who created the application.
-        description:
-          type: str
-          description: A description of this application.
-        app_url:
-          type: str
-          description: The URL of this application.
-        skip_authorization:
-          type: bool
-          description: Set True to skip authorization step for completely trusted applications.
-        id:
-          type: str
-          description: The unique identifier of the resource. Used for update/delete operations.
-
-extends_documentation_fragment:
-  - ansible.platform.auth
-  - ansible.platform.state
-"""
-
-EXAMPLES = """
-- name: Create application resources (merged)
-  ansible.platform.application:
-    config:
-      - name: "my-application"
-    state: merged
-
-- name: Gather current application state
-  ansible.platform.application:
-    state: gathered
-  register: result
-
-- name: Delete specific application resources
-  ansible.platform.application:
-    config:
-      - name: "my-application"
-    state: deleted
-
-- name: Override — ensure only these application resources exist
-  ansible.platform.application:
-    config:
-      - name: "keep-this-application"
-    state: overridden
-...
-"""
-
-RETURN = """
-before:
-  description: The state of the application resources before this run.
-  returned: when state is not gathered
-  type: list
-  elements: dict
-after:
-  description: The state of the application resources after this run.
-  returned: when state is not gathered
-  type: list
-  elements: dict
-gathered:
-  description: The gathered application resource state (read-only).
-  returned: when state is gathered
-  type: list
-  elements: dict
-config:
-  description: The resulting configuration (alias for after or gathered).
-  returned: always
-  type: list
-  elements: dict
-"""
diff --git a/plugins/modules/applications.py b/plugins/modules/applications.py
new file mode 100644
index 00000000..7e8f8773
--- /dev/null
+++ b/plugins/modules/applications.py
@@ -0,0 +1,131 @@
+#!/usr/bin/python
+# coding: utf-8 -*-
+# (c) 2025, Ansible Platform Collection Contributors
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+"""
+Auto-generated by tools/generate_resource.py — review before committing.
+"""
+
+from __future__ import absolute_import, division, print_function
+
+__metaclass__ = type
+
+DOCUMENTATION = """
+---
+module: applications
+short_description: Manage gateway application resources.
+author: Red Hat (@RedHatOfficial)
+description:
+    - Create, update, delete, or gather automation platform gateway application resources.
+    - Follows the Ansible resource module pattern with before/after state tracking.
+options:
+    config:
+      description:
+        - A list of application resource configurations.
+        - Each entry represents a desired application state.
+      type: list
+      elements: dict
+      suboptions:
+        name:
+          required: true
+          type: str
+          description: The name of this resource.
+        organization:
+          required: true
+          type: int
+          description: Organization containing this application.
+        client_type:
+          required: true
+          type: str
+          description:
+            - Set to Public or Confidential depending on how secure the client device is.
+            - "confidential - Confidential"
+            - "public - Public"
+        authorization_grant_type:
+          required: true
+          type: str
+          description:
+            - The Grant type the user must use for acquire tokens for this application.
+            - "authorization-code - Authorization code"
+            - "password - Resource owner password-based"
+        redirect_uris:
+          type: str
+          description: Allowed URIs list, space separated
+        post_logout_redirect_uris:
+          type: str
+          description: Allowed Post Logout URIs list, space separated
+        algorithm:
+          type: str
+          description:
+            - "empty string - No OIDC support"
+            - "RS256 - RSA with SHA-2 256"
+            - "HS256 - HMAC with SHA-2 256"
+        user:
+          type: int
+          description: The user who created the application.
+        description:
+          type: str
+          description: A description of this application.
+        app_url:
+          type: str
+          description: The URL of this application.
+        skip_authorization:
+          type: bool
+          description: Set True to skip authorization step for completely trusted applications.
+        id:
+          type: str
+          description: The unique identifier of the resource. Used for update/delete operations.
+
+extends_documentation_fragment:
+  - ansible.platform.auth
+  - ansible.platform.state
+"""
+
+EXAMPLES = """
+- name: Create application resources (merged)
+  ansible.platform.applications:
+    config:
+      - name: "my-application"
+    state: merged
+
+- name: Gather current application state
+  ansible.platform.applications:
+    state: gathered
+  register: result
+
+- name: Delete specific application resources
+  ansible.platform.applications:
+    config:
+      - name: "my-application"
+    state: deleted
+
+- name: Override — ensure only these application resources exist
+  ansible.platform.applications:
+    config:
+      - name: "keep-this-application"
+    state: overridden
+...
+"""
+
+RETURN = """
+before:
+  description: The state of the application resources before this run.
+  returned: when state is not gathered
+  type: list
+  elements: dict
+after:
+  description: The state of the application resources after this run.
+  returned: when state is not gathered
+  type: list
+  elements: dict
+gathered:
+  description: The gathered application resource state (read-only).
+  returned: when state is gathered
+  type: list
+  elements: dict
+config:
+  description: The resulting configuration (alias for after or gathered).
+  returned: always
+  type: list
+  elements: dict
+"""
diff --git a/plugins/modules/authenticator.py b/plugins/modules/authenticator.py
deleted file mode 100644
index 5d377aaf..00000000
--- a/plugins/modules/authenticator.py
+++ /dev/null
@@ -1,140 +0,0 @@
-#!/usr/bin/python
-# coding: utf-8 -*-
-# (c) 2025, Ansible Platform Collection Contributors
-# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
-"""
-Auto-generated by tools/generate_resource.py — review before committing.
-"""
-
-from __future__ import absolute_import, division, print_function
-
-__metaclass__ = type
-
-DOCUMENTATION = """
----
-module: authenticator
-short_description: Manage gateway authenticator resources.
-author: Red Hat (@RedHatOfficial)
-description:
-    - Create, update, delete, or gather automation platform gateway authenticator resources.
-    - Follows the Ansible resource module pattern with before/after state tracking.
-options:
-    config:
-      description:
-        - A list of authenticator resource configurations.
-        - Each entry represents a desired authenticator state.
-      type: list
-      elements: dict
-      suboptions:
-        name:
-          required: true
-          type: str
-          description: The name of this resource.
-        configuration:
-          required: true
-          type: str
-          description: The required configuration for this source.
-        type:
-          required: true
-          type: str
-          description:
-            - "ansible_base.authentication.authenticator_plugins.github_org"
-            - >-
-              `ansible_base.authentication.authenticator_plugins.github_enterprise_org`
-              - ansible_base.authentication.authenticator_plugins.github_enterprise_org
-            - '`ansible_base.authentication.authenticator_plugins.saml` - ansible_base.authentication.authenticator_plugins.saml'
-            - '`ansible_base.authentication.authenticator_plugins.local` - ansible_base.authentication.authenticator_plugins.local'
-            - '`ansible_base.authentication.authenticator_plugins.ldap` - ansible_base.authentication.authenticator_plugins.ldap'
-            - '`ansible_base.authentication.authenticator_plugins.google_oauth2` - ansible_base.authentication.authenticator_plugins.google_oauth2'
-            - '`ansible_base.authentication.authenticator_plugins.radius` - ansible_base.authentication.authenticator_plugins.radius'
-            - '`ansible_base.authentication.authenticator_plugins.github` - ansible_base.authentication.authenticator_plugins.github'
-            - '`ansible_base.authentication.authenticator_plugins.oidc` - ansible_base.authentication.authenticator_plugins.oidc'
-            - >-
-              `ansible_base.authentication.authenticator_plugins.github_enterprise_team`
-              - ansible_base.authentication.authenticator_plugins.github_enterprise_team
-            - '`ansible_base.authentication.authenticator_plugins.github_enterprise` - ansible_base.authentication.authenticator_plugins.github_enterprise'
-            - '`ansible_base.authentication.authenticator_plugins.keycloak` - ansible_base.authentication.authenticator_plugins.keycloak'
-            - '`ansible_base.authentication.authenticator_plugins.azuread` - ansible_base.authentication.authenticator_plugins.azuread'
-            - '`ansible_base.authentication.authenticator_plugins.github_team` - ansible_base.authentication.authenticator_plugins.github_team'
-            - '`ansible_base.authentication.authenticator_plugins.tacacs` - ansible_base.authentication.authenticator_plugins.tacacs'
-        enabled:
-          type: bool
-          description: Should this authenticator be enabled.
-        create_objects:
-          type: bool
-          description: Allow authenticator to create objects (users, teams, organizations).
-        remove_users:
-          type: bool
-          description: When a user authenticates from this source should they be removed from any other groups they were previously added to.
-        order:
-          type: int
-          description: The order in which an authenticator will be tried. This only pertains to username/password authenticators.
-        slug:
-          type: str
-          description: An immutable identifier for the authenticator; used to generate the sso uri for sso authenticator types
-        auto_migrate_users_to:
-          type: int
-          description: >-
-            Automatically move users from this authenticator to the target authenticator
-            when a matching user logs in via the target authenticator. For this to work,
-            the field used for the user ID on both authenticators needs to have the same
-            value. This should only be used when migrating users between two authentication
-            mechanisms that share the same user database (such as when both IDPs share
-            the same LDAP user directory).
-        id:
-          type: str
-          description: The unique identifier of the resource. Used for update/delete operations.
-
-extends_documentation_fragment:
-  - ansible.platform.auth
-  - ansible.platform.state
-"""
-
-EXAMPLES = """
-- name: Create authenticator resources (merged)
-  ansible.platform.authenticator:
-    config:
-      - name: "my-authenticator"
-    state: merged
-
-- name: Gather current authenticator state
-  ansible.platform.authenticator:
-    state: gathered
-  register: result
-
-- name: Delete specific authenticator resources
-  ansible.platform.authenticator:
-    config:
-      - name: "my-authenticator"
-    state: deleted
-
-- name: Override — ensure only these authenticator resources exist
-  ansible.platform.authenticator:
-    config:
-      - name: "keep-this-authenticator"
-    state: overridden
-...
-"""
-
-RETURN = """
-before:
-  description: The state of the authenticator resources before this run.
-  returned: when state is not gathered
-  type: list
-  elements: dict
-after:
-  description: The state of the authenticator resources after this run.
-  returned: when state is not gathered
-  type: list
-  elements: dict
-gathered:
-  description: The gathered authenticator resource state (read-only).
-  returned: when state is gathered
-  type: list
-  elements: dict
-config:
-  description: The resulting configuration (alias for after or gathered).
-  returned: always
-  type: list
-  elements: dict
-"""
diff --git a/plugins/modules/authenticator_map.py b/plugins/modules/authenticator_map.py
deleted file mode 100644
index b661ea3a..00000000
--- a/plugins/modules/authenticator_map.py
+++ /dev/null
@@ -1,126 +0,0 @@
-#!/usr/bin/python
-# coding: utf-8 -*-
-# (c) 2025, Ansible Platform Collection Contributors
-# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
-"""
-Auto-generated by tools/generate_resource.py — review before committing.
-"""
-
-from __future__ import absolute_import, division, print_function
-
-__metaclass__ = type
-
-DOCUMENTATION = """
----
-module: authenticator_map
-short_description: Manage gateway authenticator_map resources.
-author: Red Hat (@RedHatOfficial)
-description:
-    - Create, update, delete, or gather automation platform gateway authenticator_map resources.
-    - Follows the Ansible resource module pattern with before/after state tracking.
-options:
-    config:
-      description:
-        - A list of authenticator_map resource configurations.
-        - Each entry represents a desired authenticator_map state.
-      type: list
-      elements: dict
-      suboptions:
-        name:
-          required: true
-          type: str
-          description: The name of this resource.
-        authenticator:
-          required: true
-          type: int
-          description: The authenticator this mapping belongs to.
-        triggers:
-          required: true
-          type: str
-          description: >-
-            Required. Trigger conditions dictionary that determines when this map applies.
-            See /trigger_definition/ for structure details. Only one top-level key per request.
-        map_type:
-          type: str
-          description:
-            - What will the map grant the user? System access (allow) a team or organization membership, the superuser flag or a role in the system.
-            - '`allow` - allow'
-            - '`is_superuser` - is_superuser'
-            - '`role` - role'
-            - '`organization` - organization'
-            - '`team` - team'
-
-        role:
-          type: str
-          description: The role this map will grant the authenticating user to the targeted object. Will expand {% for_attr_value(user_orgs) %} syntax
-        organization:
-          type: str
-          description: An organization name this rule works on. Will expand {% for_attr_value(user_orgs) %} syntax
-        team:
-          type: str
-          description: A team name this rule works on. Will expand {% for_attr_value(user_orgs) %} syntax.
-        revoke:
-          type: bool
-          description: Revoke the permission if a user does not meet this rule.
-        order:
-          type: int
-          description: >-
-            The order in which this rule should be processed, smaller numbers are of higher precedence.
-            Items with the same order will be executed in random order.
-        id:
-          type: str
-          description: The unique identifier of the resource. Used for update/delete operations.
-
-extends_documentation_fragment:
-  - ansible.platform.auth
-  - ansible.platform.state
-"""
-
-EXAMPLES = """
-- name: Create authenticator_map resources (merged)
-  ansible.platform.authenticator_map:
-    config:
-      - name: "my-authenticator_map"
-    state: merged
-
-- name: Gather current authenticator_map state
-  ansible.platform.authenticator_map:
-    state: gathered
-  register: result
-
-- name: Delete specific authenticator_map resources
-  ansible.platform.authenticator_map:
-    config:
-      - name: "my-authenticator_map"
-    state: deleted
-
-- name: Override — ensure only these authenticator_map resources exist
-  ansible.platform.authenticator_map:
-    config:
-      - name: "keep-this-authenticator_map"
-    state: overridden
-...
-"""
-
-RETURN = """
-before:
-  description: The state of the authenticator_map resources before this run.
-  returned: when state is not gathered
-  type: list
-  elements: dict
-after:
-  description: The state of the authenticator_map resources after this run.
-  returned: when state is not gathered
-  type: list
-  elements: dict
-gathered:
-  description: The gathered authenticator_map resource state (read-only).
-  returned: when state is gathered
-  type: list
-  elements: dict
-config:
-  description: The resulting configuration (alias for after or gathered).
-  returned: always
-  type: list
-  elements: dict
-"""
diff --git a/plugins/modules/authenticator_maps.py b/plugins/modules/authenticator_maps.py
new file mode 100644
index 00000000..35dde17d
--- /dev/null
+++ b/plugins/modules/authenticator_maps.py
@@ -0,0 +1,126 @@
+#!/usr/bin/python
+# coding: utf-8 -*-
+# (c) 2025, Ansible Platform Collection Contributors
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+"""
+Auto-generated by tools/generate_resource.py — review before committing.
+"""
+
+from __future__ import absolute_import, division, print_function
+
+__metaclass__ = type
+
+DOCUMENTATION = """
+---
+module: authenticator_maps
+short_description: Manage gateway authenticator_map resources.
+author: Red Hat (@RedHatOfficial)
+description:
+    - Create, update, delete, or gather automation platform gateway authenticator_map resources.
+    - Follows the Ansible resource module pattern with before/after state tracking.
+options:
+    config:
+      description:
+        - A list of authenticator_map resource configurations.
+        - Each entry represents a desired authenticator_map state.
+      type: list
+      elements: dict
+      suboptions:
+        name:
+          required: true
+          type: str
+          description: The name of this resource.
+        authenticator:
+          required: true
+          type: int
+          description: The authenticator this mapping belongs to.
+        triggers:
+          required: true
+          type: str
+          description: >-
+            Required. Trigger conditions dictionary that determines when this map applies.
+            See /trigger_definition/ for structure details. Only one top-level key per request.
+        map_type:
+          type: str
+          description:
+            - What will the map grant the user? System access (allow) a team or organization membership, the superuser flag or a role in the system.
+            - '`allow` - allow'
+            - '`is_superuser` - is_superuser'
+            - '`role` - role'
+            - '`organization` - organization'
+            - '`team` - team'
+
+        role:
+          type: str
+          description: The role this map will grant the authenticating user to the targeted object. Will expand {% for_attr_value(user_orgs) %} syntax
+        organization:
+          type: str
+          description: An organization name this rule works on. Will expand {% for_attr_value(user_orgs) %} syntax
+        team:
+          type: str
+          description: A team name this rule works on. Will expand {% for_attr_value(user_orgs) %} syntax.
+        revoke:
+          type: bool
+          description: Revoke the permission if a user does not meet this rule.
+        order:
+          type: int
+          description: >-
+            The order in which this rule should be processed, smaller numbers are of higher precedence.
+            Items with the same order will be executed in random order.
+        id:
+          type: str
+          description: The unique identifier of the resource. Used for update/delete operations.
+
+extends_documentation_fragment:
+  - ansible.platform.auth
+  - ansible.platform.state
+"""
+
+EXAMPLES = """
+- name: Create authenticator_map resources (merged)
+  ansible.platform.authenticator_maps:
+    config:
+      - name: "my-authenticator_map"
+    state: merged
+
+- name: Gather current authenticator_map state
+  ansible.platform.authenticator_maps:
+    state: gathered
+  register: result
+
+- name: Delete specific authenticator_map resources
+  ansible.platform.authenticator_maps:
+    config:
+      - name: "my-authenticator_map"
+    state: deleted
+
+- name: Override — ensure only these authenticator_map resources exist
+  ansible.platform.authenticator_maps:
+    config:
+      - name: "keep-this-authenticator_map"
+    state: overridden
+...
+"""
+
+RETURN = """
+before:
+  description: The state of the authenticator_map resources before this run.
+  returned: when state is not gathered
+  type: list
+  elements: dict
+after:
+  description: The state of the authenticator_map resources after this run.
+  returned: when state is not gathered
+  type: list
+  elements: dict
+gathered:
+  description: The gathered authenticator_map resource state (read-only).
+  returned: when state is gathered
+  type: list
+  elements: dict
+config:
+  description: The resulting configuration (alias for after or gathered).
+  returned: always
+  type: list
+  elements: dict
+"""
diff --git a/plugins/modules/authenticator_user.py b/plugins/modules/authenticator_user.py
deleted file mode 100644
index 460239a6..00000000
--- a/plugins/modules/authenticator_user.py
+++ /dev/null
@@ -1,85 +0,0 @@
-#!/usr/bin/python
-# coding: utf-8 -*-
-# (c) 2025, Ansible Platform Collection Contributors
-# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
-"""
-Auto-generated by tools/generate_resource.py — review before committing.
-"""
-
-from __future__ import absolute_import, division, print_function
-
-__metaclass__ = type
-
-DOCUMENTATION = """
----
-module: authenticator_user
-short_description: Manage gateway authenticator_user resources.
-author: Red Hat (@RedHatOfficial)
-description:
-    - Create, update, delete, or gather automation platform gateway authenticator_user resources.
-    - Follows the Ansible resource module pattern with before/after state tracking.
-options:
-    config:
-      description:
-        - A list of authenticator_user resource configurations.
-        - Each entry represents a desired authenticator_user state.
-      type: list
-      elements: dict
-      suboptions:
-        id:
-          type: str
-          description: The unique identifier of the resource. Used for update/delete operations.
-
-extends_documentation_fragment:
-  - ansible.platform.auth
-  - ansible.platform.state
-"""
-
-EXAMPLES = """
-- name: Create authenticator_user resources (merged)
-  ansible.platform.authenticator_user:
-    config:
-      - name: "my-authenticator_user"
-    state: merged
-
-- name: Gather current authenticator_user state
-  ansible.platform.authenticator_user:
-    state: gathered
-  register: result
-
-- name: Delete specific authenticator_user resources
-  ansible.platform.authenticator_user:
-    config:
-      - name: "my-authenticator_user"
-    state: deleted
-
-- name: Override — ensure only these authenticator_user resources exist
-  ansible.platform.authenticator_user:
-    config:
-      - name: "keep-this-authenticator_user"
-    state: overridden
-...
-"""
-
-RETURN = """
-before:
-  description: The state of the authenticator_user resources before this run.
-  returned: when state is not gathered
-  type: list
-  elements: dict
-after:
-  description: The state of the authenticator_user resources after this run.
-  returned: when state is not gathered
-  type: list
-  elements: dict
-gathered:
-  description: The gathered authenticator_user resource state (read-only).
-  returned: when state is gathered
-  type: list
-  elements: dict
-config:
-  description: The resulting configuration (alias for after or gathered).
-  returned: always
-  type: list
-  elements: dict
-"""
diff --git a/plugins/modules/authenticator_users.py b/plugins/modules/authenticator_users.py
new file mode 100644
index 00000000..604183e9
--- /dev/null
+++ b/plugins/modules/authenticator_users.py
@@ -0,0 +1,85 @@
+#!/usr/bin/python
+# coding: utf-8 -*-
+# (c) 2025, Ansible Platform Collection Contributors
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+"""
+Auto-generated by tools/generate_resource.py — review before committing.
+"""
+
+from __future__ import absolute_import, division, print_function
+
+__metaclass__ = type
+
+DOCUMENTATION = """
+---
+module: authenticator_users
+short_description: Manage gateway authenticator_user resources.
+author: Red Hat (@RedHatOfficial)
+description:
+    - Create, update, delete, or gather automation platform gateway authenticator_user resources.
+    - Follows the Ansible resource module pattern with before/after state tracking.
+options:
+    config:
+      description:
+        - A list of authenticator_user resource configurations.
+        - Each entry represents a desired authenticator_user state.
+      type: list
+      elements: dict
+      suboptions:
+        id:
+          type: str
+          description: The unique identifier of the resource. Used for update/delete operations.
+
+extends_documentation_fragment:
+  - ansible.platform.auth
+  - ansible.platform.state
+"""
+
+EXAMPLES = """
+- name: Create authenticator_user resources (merged)
+  ansible.platform.authenticator_users:
+    config:
+      - name: "my-authenticator_user"
+    state: merged
+
+- name: Gather current authenticator_user state
+  ansible.platform.authenticator_users:
+    state: gathered
+  register: result
+
+- name: Delete specific authenticator_user resources
+  ansible.platform.authenticator_users:
+    config:
+      - name: "my-authenticator_user"
+    state: deleted
+
+- name: Override — ensure only these authenticator_user resources exist
+  ansible.platform.authenticator_users:
+    config:
+      - name: "keep-this-authenticator_user"
+    state: overridden
+...
+"""
+
+RETURN = """
+before:
+  description: The state of the authenticator_user resources before this run.
+  returned: when state is not gathered
+  type: list
+  elements: dict
+after:
+  description: The state of the authenticator_user resources after this run.
+  returned: when state is not gathered
+  type: list
+  elements: dict
+gathered:
+  description: The gathered authenticator_user resource state (read-only).
+  returned: when state is gathered
+  type: list
+  elements: dict
+config:
+  description: The resulting configuration (alias for after or gathered).
+  returned: always
+  type: list
+  elements: dict
+"""
diff --git a/plugins/modules/authenticators.py b/plugins/modules/authenticators.py
new file mode 100644
index 00000000..2efd1f9f
--- /dev/null
+++ b/plugins/modules/authenticators.py
@@ -0,0 +1,140 @@
+#!/usr/bin/python
+# coding: utf-8 -*-
+# (c) 2025, Ansible Platform Collection Contributors
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+"""
+Auto-generated by tools/generate_resource.py — review before committing.
+"""
+
+from __future__ import absolute_import, division, print_function
+
+__metaclass__ = type
+
+DOCUMENTATION = """
+---
+module: authenticators
+short_description: Manage gateway authenticator resources.
+author: Red Hat (@RedHatOfficial)
+description:
+    - Create, update, delete, or gather automation platform gateway authenticator resources.
+    - Follows the Ansible resource module pattern with before/after state tracking.
+options:
+    config:
+      description:
+        - A list of authenticator resource configurations.
+        - Each entry represents a desired authenticator state.
+      type: list
+      elements: dict
+      suboptions:
+        name:
+          required: true
+          type: str
+          description: The name of this resource.
+        configuration:
+          required: true
+          type: str
+          description: The required configuration for this source.
+        type:
+          required: true
+          type: str
+          description:
+            - "ansible_base.authentication.authenticator_plugins.github_org"
+            - >-
+              `ansible_base.authentication.authenticator_plugins.github_enterprise_org`
+              - ansible_base.authentication.authenticator_plugins.github_enterprise_org
+            - '`ansible_base.authentication.authenticator_plugins.saml` - ansible_base.authentication.authenticator_plugins.saml'
+            - '`ansible_base.authentication.authenticator_plugins.local` - ansible_base.authentication.authenticator_plugins.local'
+            - '`ansible_base.authentication.authenticator_plugins.ldap` - ansible_base.authentication.authenticator_plugins.ldap'
+            - '`ansible_base.authentication.authenticator_plugins.google_oauth2` - ansible_base.authentication.authenticator_plugins.google_oauth2'
+            - '`ansible_base.authentication.authenticator_plugins.radius` - ansible_base.authentication.authenticator_plugins.radius'
+            - '`ansible_base.authentication.authenticator_plugins.github` - ansible_base.authentication.authenticator_plugins.github'
+            - '`ansible_base.authentication.authenticator_plugins.oidc` - ansible_base.authentication.authenticator_plugins.oidc'
+            - >-
+              `ansible_base.authentication.authenticator_plugins.github_enterprise_team`
+              - ansible_base.authentication.authenticator_plugins.github_enterprise_team
+            - '`ansible_base.authentication.authenticator_plugins.github_enterprise` - ansible_base.authentication.authenticator_plugins.github_enterprise'
+            - '`ansible_base.authentication.authenticator_plugins.keycloak` - ansible_base.authentication.authenticator_plugins.keycloak'
+            - '`ansible_base.authentication.authenticator_plugins.azuread` - ansible_base.authentication.authenticator_plugins.azuread'
+            - '`ansible_base.authentication.authenticator_plugins.github_team` - ansible_base.authentication.authenticator_plugins.github_team'
+            - '`ansible_base.authentication.authenticator_plugins.tacacs` - ansible_base.authentication.authenticator_plugins.tacacs'
+        enabled:
+          type: bool
+          description: Should this authenticator be enabled.
+        create_objects:
+          type: bool
+          description: Allow authenticator to create objects (users, teams, organizations).
+        remove_users:
+          type: bool
+          description: When a user authenticates from this source should they be removed from any other groups they were previously added to.
+        order:
+          type: int
+          description: The order in which an authenticator will be tried. This only pertains to username/password authenticators.
+        slug:
+          type: str
+          description: An immutable identifier for the authenticator; used to generate the sso uri for sso authenticator types
+        auto_migrate_users_to:
+          type: int
+          description: >-
+            Automatically move users from this authenticator to the target authenticator
+            when a matching user logs in via the target authenticator. For this to work,
+            the field used for the user ID on both authenticators needs to have the same
+            value. This should only be used when migrating users between two authentication
+            mechanisms that share the same user database (such as when both IDPs share
+            the same LDAP user directory).
+        id:
+          type: str
+          description: The unique identifier of the resource. Used for update/delete operations.
+
+extends_documentation_fragment:
+  - ansible.platform.auth
+  - ansible.platform.state
+"""
+
+EXAMPLES = """
+- name: Create authenticator resources (merged)
+  ansible.platform.authenticators:
+    config:
+      - name: "my-authenticator"
+    state: merged
+
+- name: Gather current authenticator state
+  ansible.platform.authenticators:
+    state: gathered
+  register: result
+
+- name: Delete specific authenticator resources
+  ansible.platform.authenticators:
+    config:
+      - name: "my-authenticator"
+    state: deleted
+
+- name: Override — ensure only these authenticator resources exist
+  ansible.platform.authenticators:
+    config:
+      - name: "keep-this-authenticator"
+    state: overridden
+...
+"""
+
+RETURN = """
+before:
+  description: The state of the authenticator resources before this run.
+  returned: when state is not gathered
+  type: list
+  elements: dict
+after:
+  description: The state of the authenticator resources after this run.
+  returned: when state is not gathered
+  type: list
+  elements: dict
+gathered:
+  description: The gathered authenticator resource state (read-only).
+  returned: when state is gathered
+  type: list
+  elements: dict
+config:
+  description: The resulting configuration (alias for after or gathered).
+  returned: always
+  type: list
+  elements: dict
+"""
diff --git a/plugins/modules/ca_certificate.py b/plugins/modules/ca_certificate.py
deleted file mode 100644
index 521c4641..00000000
--- a/plugins/modules/ca_certificate.py
+++ /dev/null
@@ -1,100 +0,0 @@
-#!/usr/bin/python
-# coding: utf-8 -*-
-# (c) 2025, Ansible Platform Collection Contributors
-# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
-"""
-Auto-generated by tools/generate_resource.py — review before committing.
-"""
-
-from __future__ import absolute_import, division, print_function
-
-__metaclass__ = type
-
-DOCUMENTATION = """
----
-module: ca_certificate
-short_description: Manage gateway ca_certificate resources.
-author: Red Hat (@RedHatOfficial)
-description:
-    - Create, update, delete, or gather automation platform gateway ca_certificate resources.
-    - Follows the Ansible resource module pattern with before/after state tracking.
-options:
-    config:
-      description:
-        - A list of ca_certificate resource configurations.
-        - Each entry represents a desired ca_certificate state.
-      type: list
-      elements: dict
-      suboptions:
-        name:
-          required: true
-          type: str
-          description: The name of this resource.
-        pem_data:
-          required: true
-          type: str
-          description: The pem_data of the CaCertificate.
-        sha256:
-          required: true
-          type: str
-          description: The sha256 of the CaCertificate.
-        related_id_reference:
-          type: str
-          description: Reference to an object that is related to this CA.
-        id:
-          type: str
-          description: The unique identifier of the resource. Used for update/delete operations.
-
-extends_documentation_fragment:
-  - ansible.platform.auth
-  - ansible.platform.state
-"""
-
-EXAMPLES = """
-- name: Create ca_certificate resources (merged)
-  ansible.platform.ca_certificate:
-    config:
-      - name: "my-ca_certificate"
-    state: merged
-
-- name: Gather current ca_certificate state
-  ansible.platform.ca_certificate:
-    state: gathered
-  register: result
-
-- name: Delete specific ca_certificate resources
-  ansible.platform.ca_certificate:
-    config:
-      - name: "my-ca_certificate"
-    state: deleted
-
-- name: Override — ensure only these ca_certificate resources exist
-  ansible.platform.ca_certificate:
-    config:
-      - name: "keep-this-ca_certificate"
-    state: overridden
-...
-"""
-
-RETURN = """
-before:
-  description: The state of the ca_certificate resources before this run.
-  returned: when state is not gathered
-  type: list
-  elements: dict
-after:
-  description: The state of the ca_certificate resources after this run.
-  returned: when state is not gathered
-  type: list
-  elements: dict
-gathered:
-  description: The gathered ca_certificate resource state (read-only).
-  returned: when state is gathered
-  type: list
-  elements: dict
-config:
-  description: The resulting configuration (alias for after or gathered).
-  returned: always
-  type: list
-  elements: dict
-"""
diff --git a/plugins/modules/ca_certificates.py b/plugins/modules/ca_certificates.py
new file mode 100644
index 00000000..9378e242
--- /dev/null
+++ b/plugins/modules/ca_certificates.py
@@ -0,0 +1,100 @@
+#!/usr/bin/python
+# coding: utf-8 -*-
+# (c) 2025, Ansible Platform Collection Contributors
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+"""
+Auto-generated by tools/generate_resource.py — review before committing.
+"""
+
+from __future__ import absolute_import, division, print_function
+
+__metaclass__ = type
+
+DOCUMENTATION = """
+---
+module: ca_certificates
+short_description: Manage gateway ca_certificate resources.
+author: Red Hat (@RedHatOfficial)
+description:
+    - Create, update, delete, or gather automation platform gateway ca_certificate resources.
+    - Follows the Ansible resource module pattern with before/after state tracking.
+options:
+    config:
+      description:
+        - A list of ca_certificate resource configurations.
+        - Each entry represents a desired ca_certificate state.
+      type: list
+      elements: dict
+      suboptions:
+        name:
+          required: true
+          type: str
+          description: The name of this resource.
+        pem_data:
+          required: true
+          type: str
+          description: The pem_data of the CaCertificate.
+        sha256:
+          required: true
+          type: str
+          description: The sha256 of the CaCertificate.
+        related_id_reference:
+          type: str
+          description: Reference to an object that is related to this CA.
+        id:
+          type: str
+          description: The unique identifier of the resource. Used for update/delete operations.
+
+extends_documentation_fragment:
+  - ansible.platform.auth
+  - ansible.platform.state
+"""
+
+EXAMPLES = """
+- name: Create ca_certificate resources (merged)
+  ansible.platform.ca_certificates:
+    config:
+      - name: "my-ca_certificate"
+    state: merged
+
+- name: Gather current ca_certificate state
+  ansible.platform.ca_certificates:
+    state: gathered
+  register: result
+
+- name: Delete specific ca_certificate resources
+  ansible.platform.ca_certificates:
+    config:
+      - name: "my-ca_certificate"
+    state: deleted
+
+- name: Override — ensure only these ca_certificate resources exist
+  ansible.platform.ca_certificates:
+    config:
+      - name: "keep-this-ca_certificate"
+    state: overridden
+...
+"""
+
+RETURN = """
+before:
+  description: The state of the ca_certificate resources before this run.
+  returned: when state is not gathered
+  type: list
+  elements: dict
+after:
+  description: The state of the ca_certificate resources after this run.
+  returned: when state is not gathered
+  type: list
+  elements: dict
+gathered:
+  description: The gathered ca_certificate resource state (read-only).
+  returned: when state is gathered
+  type: list
+  elements: dict
+config:
+  description: The resulting configuration (alias for after or gathered).
+  returned: always
+  type: list
+  elements: dict
+"""
diff --git a/plugins/modules/feature_flag.py b/plugins/modules/feature_flag.py
deleted file mode 100644
index 876005f3..00000000
--- a/plugins/modules/feature_flag.py
+++ /dev/null
@@ -1,91 +0,0 @@
-#!/usr/bin/python
-# coding: utf-8 -*-
-# (c) 2025, Ansible Platform Collection Contributors
-# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
-"""
-Auto-generated by tools/generate_resource.py — review before committing.
-"""
-
-from __future__ import absolute_import, division, print_function
-
-__metaclass__ = type
-
-DOCUMENTATION = """
----
-module: feature_flag
-short_description: Manage gateway feature_flag resources.
-author: Red Hat (@RedHatOfficial)
-description:
-    - Create, update, delete, or gather automation platform gateway feature_flag resources.
-    - Follows the Ansible resource module pattern with before/after state tracking.
-options:
-    config:
-      description:
-        - A list of feature_flag resource configurations.
-        - Each entry represents a desired feature_flag state.
-      type: list
-      elements: dict
-      suboptions:
-        name:
-          type: str
-          description: The name (identifier) of the feature flag.
-        value:
-          type: str
-          description: The value used to evaluate the conditional specified.
-        id:
-          type: str
-          description: The unique identifier of the resource. Used for update/delete operations.
-
-extends_documentation_fragment:
-  - ansible.platform.auth
-  - ansible.platform.state
-"""
-
-EXAMPLES = """
-- name: Create feature_flag resources (merged)
-  ansible.platform.feature_flag:
-    config:
-      - name: "my-feature_flag"
-    state: merged
-
-- name: Gather current feature_flag state
-  ansible.platform.feature_flag:
-    state: gathered
-  register: result
-
-- name: Delete specific feature_flag resources
-  ansible.platform.feature_flag:
-    config:
-      - name: "my-feature_flag"
-    state: deleted
-
-- name: Override — ensure only these feature_flag resources exist
-  ansible.platform.feature_flag:
-    config:
-      - name: "keep-this-feature_flag"
-    state: overridden
-...
-"""
-
-RETURN = """
-before:
-  description: The state of the feature_flag resources before this run.
-  returned: when state is not gathered
-  type: list
-  elements: dict
-after:
-  description: The state of the feature_flag resources after this run.
-  returned: when state is not gathered
-  type: list
-  elements: dict
-gathered:
-  description: The gathered feature_flag resource state (read-only).
-  returned: when state is gathered
-  type: list
-  elements: dict
-config:
-  description: The resulting configuration (alias for after or gathered).
-  returned: always
-  type: list
-  elements: dict
-"""
diff --git a/plugins/modules/feature_flags.py b/plugins/modules/feature_flags.py
new file mode 100644
index 00000000..5dbc0ee1
--- /dev/null
+++ b/plugins/modules/feature_flags.py
@@ -0,0 +1,91 @@
+#!/usr/bin/python
+# coding: utf-8 -*-
+# (c) 2025, Ansible Platform Collection Contributors
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+"""
+Auto-generated by tools/generate_resource.py — review before committing.
+"""
+
+from __future__ import absolute_import, division, print_function
+
+__metaclass__ = type
+
+DOCUMENTATION = """
+---
+module: feature_flags
+short_description: Manage gateway feature_flag resources.
+author: Red Hat (@RedHatOfficial)
+description:
+    - Create, update, delete, or gather automation platform gateway feature_flag resources.
+    - Follows the Ansible resource module pattern with before/after state tracking.
+options:
+    config:
+      description:
+        - A list of feature_flag resource configurations.
+        - Each entry represents a desired feature_flag state.
+      type: list
+      elements: dict
+      suboptions:
+        name:
+          type: str
+          description: The name (identifier) of the feature flag.
+        value:
+          type: str
+          description: The value used to evaluate the conditional specified.
+        id:
+          type: str
+          description: The unique identifier of the resource. Used for update/delete operations.
+
+extends_documentation_fragment:
+  - ansible.platform.auth
+  - ansible.platform.state
+"""
+
+EXAMPLES = """
+- name: Create feature_flag resources (merged)
+  ansible.platform.feature_flags:
+    config:
+      - name: "my-feature_flag"
+    state: merged
+
+- name: Gather current feature_flag state
+  ansible.platform.feature_flags:
+    state: gathered
+  register: result
+
+- name: Delete specific feature_flag resources
+  ansible.platform.feature_flags:
+    config:
+      - name: "my-feature_flag"
+    state: deleted
+
+- name: Override — ensure only these feature_flag resources exist
+  ansible.platform.feature_flags:
+    config:
+      - name: "keep-this-feature_flag"
+    state: overridden
+...
+"""
+
+RETURN = """
+before:
+  description: The state of the feature_flag resources before this run.
+  returned: when state is not gathered
+  type: list
+  elements: dict
+after:
+  description: The state of the feature_flag resources after this run.
+  returned: when state is not gathered
+  type: list
+  elements: dict
+gathered:
+  description: The gathered feature_flag resource state (read-only).
+  returned: when state is gathered
+  type: list
+  elements: dict
+config:
+  description: The resulting configuration (alias for after or gathered).
+  returned: always
+  type: list
+  elements: dict
+"""
diff --git a/plugins/modules/http_port.py b/plugins/modules/http_port.py
deleted file mode 100644
index 0a23e597..00000000
--- a/plugins/modules/http_port.py
+++ /dev/null
@@ -1,99 +0,0 @@
-#!/usr/bin/python
-# coding: utf-8 -*-
-# (c) 2025, Ansible Platform Collection Contributors
-# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
-"""
-Auto-generated by tools/generate_resource.py — review before committing.
-"""
-
-from __future__ import absolute_import, division, print_function
-
-__metaclass__ = type
-
-DOCUMENTATION = """
----
-module: http_port
-short_description: Manage gateway http_port resources.
-author: Red Hat (@RedHatOfficial)
-description:
-    - Create, update, delete, or gather automation platform gateway http_port resources.
-    - Follows the Ansible resource module pattern with before/after state tracking.
-options:
-    config:
-      description:
-        - A list of http_port resource configurations.
-        - Each entry represents a desired http_port state.
-      type: list
-      elements: dict
-      suboptions:
-        name:
-          required: true
-          type: str
-          description: The name of this resource.
-        number:
-          required: true
-          type: int
-          description: The port number to listen on.
-        use_https:
-          type: bool
-          description: Secure this port with HTTPS.
-        is_api_port:
-          type: bool
-          description: If true, this port will be used to serve the AAP service APIs. Only one port can be the API port.
-        id:
-          type: str
-          description: The unique identifier of the resource. Used for update/delete operations.
-
-extends_documentation_fragment:
-  - ansible.platform.auth
-  - ansible.platform.state
-"""
-
-EXAMPLES = """
-- name: Create http_port resources (merged)
-  ansible.platform.http_port:
-    config:
-      - name: "my-http_port"
-    state: merged
-
-- name: Gather current http_port state
-  ansible.platform.http_port:
-    state: gathered
-  register: result
-
-- name: Delete specific http_port resources
-  ansible.platform.http_port:
-    config:
-      - name: "my-http_port"
-    state: deleted
-
-- name: Override — ensure only these http_port resources exist
-  ansible.platform.http_port:
-    config:
-      - name: "keep-this-http_port"
-    state: overridden
-...
-"""
-
-RETURN = """
-before:
-  description: The state of the http_port resources before this run.
-  returned: when state is not gathered
-  type: list
-  elements: dict
-after:
-  description: The state of the http_port resources after this run.
-  returned: when state is not gathered
-  type: list
-  elements: dict
-gathered:
-  description: The gathered http_port resource state (read-only).
-  returned: when state is gathered
-  type: list
-  elements: dict
-config:
-  description: The resulting configuration (alias for after or gathered).
-  returned: always
-  type: list
-  elements: dict
-"""
diff --git a/plugins/modules/http_ports.py b/plugins/modules/http_ports.py
new file mode 100644
index 00000000..5e94f785
--- /dev/null
+++ b/plugins/modules/http_ports.py
@@ -0,0 +1,99 @@
+#!/usr/bin/python
+# coding: utf-8 -*-
+# (c) 2025, Ansible Platform Collection Contributors
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+"""
+Auto-generated by tools/generate_resource.py — review before committing.
+"""
+
+from __future__ import absolute_import, division, print_function
+
+__metaclass__ = type
+
+DOCUMENTATION = """
+---
+module: http_ports
+short_description: Manage gateway http_port resources.
+author: Red Hat (@RedHatOfficial)
+description:
+    - Create, update, delete, or gather automation platform gateway http_port resources.
+    - Follows the Ansible resource module pattern with before/after state tracking.
+options:
+    config:
+      description:
+        - A list of http_port resource configurations.
+        - Each entry represents a desired http_port state.
+      type: list
+      elements: dict
+      suboptions:
+        name:
+          required: true
+          type: str
+          description: The name of this resource.
+        number:
+          required: true
+          type: int
+          description: The port number to listen on.
+        use_https:
+          type: bool
+          description: Secure this port with HTTPS.
+        is_api_port:
+          type: bool
+          description: If true, this port will be used to serve the AAP service APIs. Only one port can be the API port.
+        id:
+          type: str
+          description: The unique identifier of the resource. Used for update/delete operations.
+
+extends_documentation_fragment:
+  - ansible.platform.auth
+  - ansible.platform.state
+"""
+
+EXAMPLES = """
+- name: Create http_port resources (merged)
+  ansible.platform.http_ports:
+    config:
+      - name: "my-http_port"
+    state: merged
+
+- name: Gather current http_port state
+  ansible.platform.http_ports:
+    state: gathered
+  register: result
+
+- name: Delete specific http_port resources
+  ansible.platform.http_ports:
+    config:
+      - name: "my-http_port"
+    state: deleted
+
+- name: Override — ensure only these http_port resources exist
+  ansible.platform.http_ports:
+    config:
+      - name: "keep-this-http_port"
+    state: overridden
+...
+"""
+
+RETURN = """
+before:
+  description: The state of the http_port resources before this run.
+  returned: when state is not gathered
+  type: list
+  elements: dict
+after:
+  description: The state of the http_port resources after this run.
+  returned: when state is not gathered
+  type: list
+  elements: dict
+gathered:
+  description: The gathered http_port resource state (read-only).
+  returned: when state is gathered
+  type: list
+  elements: dict
+config:
+  description: The resulting configuration (alias for after or gathered).
+  returned: always
+  type: list
+  elements: dict
+"""
diff --git a/plugins/modules/organization.py b/plugins/modules/organization.py
deleted file mode 100644
index 6b25fa18..00000000
--- a/plugins/modules/organization.py
+++ /dev/null
@@ -1,92 +0,0 @@
-#!/usr/bin/python
-# coding: utf-8 -*-
-# (c) 2025, Ansible Platform Collection Contributors
-# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
-"""
-Auto-generated by tools/generate_resource.py — review before committing.
-"""
-
-from __future__ import absolute_import, division, print_function
-
-__metaclass__ = type
-
-DOCUMENTATION = """
----
-module: organization
-short_description: Manage gateway organization resources.
-author: Red Hat (@RedHatOfficial)
-description:
-    - Create, update, delete, or gather automation platform gateway organization resources.
-    - Follows the Ansible resource module pattern with before/after state tracking.
-options:
-    config:
-      description:
-        - A list of organization resource configurations.
-        - Each entry represents a desired organization state.
-      type: list
-      elements: dict
-      suboptions:
-        name:
-          required: true
-          type: str
-          description: The name of this resource.
-        description:
-          type: str
-          description: The organization description.
-        id:
-          type: str
-          description: The unique identifier of the resource. Used for update/delete operations.
-
-extends_documentation_fragment:
-  - ansible.platform.auth
-  - ansible.platform.state
-"""
-
-EXAMPLES = """
-- name: Create organization resources (merged)
-  ansible.platform.organization:
-    config:
-      - name: "my-organization"
-    state: merged
-
-- name: Gather current organization state
-  ansible.platform.organization:
-    state: gathered
-  register: result
-
-- name: Delete specific organization resources
-  ansible.platform.organization:
-    config:
-      - name: "my-organization"
-    state: deleted
-
-- name: Override — ensure only these organization resources exist
-  ansible.platform.organization:
-    config:
-      - name: "keep-this-organization"
-    state: overridden
-...
-"""
-
-RETURN = """
-before:
-  description: The state of the organization resources before this run.
-  returned: when state is not gathered
-  type: list
-  elements: dict
-after:
-  description: The state of the organization resources after this run.
-  returned: when state is not gathered
-  type: list
-  elements: dict
-gathered:
-  description: The gathered organization resource state (read-only).
-  returned: when state is gathered
-  type: list
-  elements: dict
-config:
-  description: The resulting configuration (alias for after or gathered).
-  returned: always
-  type: list
-  elements: dict
-"""
diff --git a/plugins/modules/organizations.py b/plugins/modules/organizations.py
new file mode 100644
index 00000000..291ee4f6
--- /dev/null
+++ b/plugins/modules/organizations.py
@@ -0,0 +1,92 @@
+#!/usr/bin/python
+# coding: utf-8 -*-
+# (c) 2025, Ansible Platform Collection Contributors
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+"""
+Auto-generated by tools/generate_resource.py — review before committing.
+"""
+
+from __future__ import absolute_import, division, print_function
+
+__metaclass__ = type
+
+DOCUMENTATION = """
+---
+module: organizations
+short_description: Manage gateway organization resources.
+author: Red Hat (@RedHatOfficial)
+description:
+    - Create, update, delete, or gather automation platform gateway organization resources.
+    - Follows the Ansible resource module pattern with before/after state tracking.
+options:
+    config:
+      description:
+        - A list of organization resource configurations.
+        - Each entry represents a desired organization state.
+      type: list
+      elements: dict
+      suboptions:
+        name:
+          required: true
+          type: str
+          description: The name of this resource.
+        description:
+          type: str
+          description: The organization description.
+        id:
+          type: str
+          description: The unique identifier of the resource. Used for update/delete operations.
+
+extends_documentation_fragment:
+  - ansible.platform.auth
+  - ansible.platform.state
+"""
+
+EXAMPLES = """
+- name: Create organization resources (merged)
+  ansible.platform.organizations:
+    config:
+      - name: "my-organization"
+    state: merged
+
+- name: Gather current organization state
+  ansible.platform.organizations:
+    state: gathered
+  register: result
+
+- name: Delete specific organization resources
+  ansible.platform.organizations:
+    config:
+      - name: "my-organization"
+    state: deleted
+
+- name: Override — ensure only these organization resources exist
+  ansible.platform.organizations:
+    config:
+      - name: "keep-this-organization"
+    state: overridden
+...
+"""
+
+RETURN = """
+before:
+  description: The state of the organization resources before this run.
+  returned: when state is not gathered
+  type: list
+  elements: dict
+after:
+  description: The state of the organization resources after this run.
+  returned: when state is not gathered
+  type: list
+  elements: dict
+gathered:
+  description: The gathered organization resource state (read-only).
+  returned: when state is gathered
+  type: list
+  elements: dict
+config:
+  description: The resulting configuration (alias for after or gathered).
+  returned: always
+  type: list
+  elements: dict
+"""
diff --git a/plugins/modules/role_definition.py b/plugins/modules/role_definition.py
deleted file mode 100644
index 444b7141..00000000
--- a/plugins/modules/role_definition.py
+++ /dev/null
@@ -1,99 +0,0 @@
-#!/usr/bin/python
-# coding: utf-8 -*-
-# (c) 2025, Ansible Platform Collection Contributors
-# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
-"""
-Auto-generated by tools/generate_resource.py — review before committing.
-"""
-
-from __future__ import absolute_import, division, print_function
-
-__metaclass__ = type
-
-DOCUMENTATION = """
----
-module: role_definition
-short_description: Manage gateway role_definition resources.
-author: Red Hat (@RedHatOfficial)
-description:
-    - Create, update, delete, or gather automation platform gateway role_definition resources.
-    - Follows the Ansible resource module pattern with before/after state tracking.
-options:
-    config:
-      description:
-        - A list of role_definition resource configurations.
-        - Each entry represents a desired role_definition state.
-      type: list
-      elements: dict
-      suboptions:
-        permissions:
-          required: true
-          type: str
-          description: The permissions of the RoleDefinition.
-        name:
-          required: true
-          type: str
-          description: The name of this role.
-        content_type:
-          type: str
-          description: String to use for references to this type from other models in the API.
-        description:
-          type: str
-          description: A description of this role.
-        id:
-          type: str
-          description: The unique identifier of the resource. Used for update/delete operations.
-
-extends_documentation_fragment:
-  - ansible.platform.auth
-  - ansible.platform.state
-"""
-
-EXAMPLES = """
-- name: Create role_definition resources (merged)
-  ansible.platform.role_definition:
-    config:
-      - name: "my-role_definition"
-    state: merged
-
-- name: Gather current role_definition state
-  ansible.platform.role_definition:
-    state: gathered
-  register: result
-
-- name: Delete specific role_definition resources
-  ansible.platform.role_definition:
-    config:
-      - name: "my-role_definition"
-    state: deleted
-
-- name: Override — ensure only these role_definition resources exist
-  ansible.platform.role_definition:
-    config:
-      - name: "keep-this-role_definition"
-    state: overridden
-...
-"""
-
-RETURN = """
-before:
-  description: The state of the role_definition resources before this run.
-  returned: when state is not gathered
-  type: list
-  elements: dict
-after:
-  description: The state of the role_definition resources after this run.
-  returned: when state is not gathered
-  type: list
-  elements: dict
-gathered:
-  description: The gathered role_definition resource state (read-only).
-  returned: when state is gathered
-  type: list
-  elements: dict
-config:
-  description: The resulting configuration (alias for after or gathered).
-  returned: always
-  type: list
-  elements: dict
-"""
diff --git a/plugins/modules/role_definitions.py b/plugins/modules/role_definitions.py
new file mode 100644
index 00000000..9a718d9c
--- /dev/null
+++ b/plugins/modules/role_definitions.py
@@ -0,0 +1,99 @@
+#!/usr/bin/python
+# coding: utf-8 -*-
+# (c) 2025, Ansible Platform Collection Contributors
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+"""
+Auto-generated by tools/generate_resource.py — review before committing.
+"""
+
+from __future__ import absolute_import, division, print_function
+
+__metaclass__ = type
+
+DOCUMENTATION = """
+---
+module: role_definitions
+short_description: Manage gateway role_definition resources.
+author: Red Hat (@RedHatOfficial)
+description:
+    - Create, update, delete, or gather automation platform gateway role_definition resources.
+    - Follows the Ansible resource module pattern with before/after state tracking.
+options:
+    config:
+      description:
+        - A list of role_definition resource configurations.
+        - Each entry represents a desired role_definition state.
+      type: list
+      elements: dict
+      suboptions:
+        permissions:
+          required: true
+          type: str
+          description: The permissions of the RoleDefinition.
+        name:
+          required: true
+          type: str
+          description: The name of this role.
+        content_type:
+          type: str
+          description: String to use for references to this type from other models in the API.
+        description:
+          type: str
+          description: A description of this role.
+        id:
+          type: str
+          description: The unique identifier of the resource. Used for update/delete operations.
+
+extends_documentation_fragment:
+  - ansible.platform.auth
+  - ansible.platform.state
+"""
+
+EXAMPLES = """
+- name: Create role_definition resources (merged)
+  ansible.platform.role_definitions:
+    config:
+      - name: "my-role_definition"
+    state: merged
+
+- name: Gather current role_definition state
+  ansible.platform.role_definitions:
+    state: gathered
+  register: result
+
+- name: Delete specific role_definition resources
+  ansible.platform.role_definitions:
+    config:
+      - name: "my-role_definition"
+    state: deleted
+
+- name: Override — ensure only these role_definition resources exist
+  ansible.platform.role_definitions:
+    config:
+      - name: "keep-this-role_definition"
+    state: overridden
+...
+"""
+
+RETURN = """
+before:
+  description: The state of the role_definition resources before this run.
+  returned: when state is not gathered
+  type: list
+  elements: dict
+after:
+  description: The state of the role_definition resources after this run.
+  returned: when state is not gathered
+  type: list
+  elements: dict
+gathered:
+  description: The gathered role_definition resource state (read-only).
+  returned: when state is gathered
+  type: list
+  elements: dict
+config:
+  description: The resulting configuration (alias for after or gathered).
+  returned: always
+  type: list
+  elements: dict
+"""
diff --git a/plugins/modules/role_team_assignment.py b/plugins/modules/role_team_assignment.py
deleted file mode 100644
index 3f6fd556..00000000
--- a/plugins/modules/role_team_assignment.py
+++ /dev/null
@@ -1,101 +0,0 @@
-#!/usr/bin/python
-# coding: utf-8 -*-
-# (c) 2025, Ansible Platform Collection Contributors
-# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
-"""
-Auto-generated by tools/generate_resource.py — review before committing.
-"""
-
-from __future__ import absolute_import, division, print_function
-
-__metaclass__ = type
-
-DOCUMENTATION = """
----
-module: role_team_assignment
-short_description: Manage gateway role_team_assignment resources.
-author: Red Hat (@RedHatOfficial)
-description:
-    - Create, update, delete, or gather automation platform gateway role_team_assignment resources.
-    - Follows the Ansible resource module pattern with before/after state tracking.
-options:
-    config:
-      description:
-        - A list of role_team_assignment resource configurations.
-        - Each entry represents a desired role_team_assignment state.
-      type: list
-      elements: dict
-      suboptions:
-        role_definition:
-          required: true
-          type: int
-          description: The role definition which defines permissions conveyed by this assignment.
-        object_id:
-          type: str
-          description: The primary key of the object this assignment applies to; null value indicates system-wide assignment.
-        object_ansible_id:
-          type: str
-          description: The resource id of the object this role applies to. An alternative to the object_id field.
-        team:
-          type: int
-          description: The team of the RoleTeamAssignment.
-        team_ansible_id:
-          type: str
-          description: The resource ID of the team who will receive permissions from this assignment. An alternative to team field.
-        id:
-          type: str
-          description: The unique identifier of the resource. Used for update/delete operations.
-
-extends_documentation_fragment:
-  - ansible.platform.auth
-  - ansible.platform.state
-"""
-
-EXAMPLES = """
-- name: Create role_team_assignment resources (merged)
-  ansible.platform.role_team_assignment:
-    config:
-      - name: "my-role_team_assignment"
-    state: merged
-
-- name: Gather current role_team_assignment state
-  ansible.platform.role_team_assignment:
-    state: gathered
-  register: result
-
-- name: Delete specific role_team_assignment resources
-  ansible.platform.role_team_assignment:
-    config:
-      - name: "my-role_team_assignment"
-    state: deleted
-
-- name: Override — ensure only these role_team_assignment resources exist
-  ansible.platform.role_team_assignment:
-    config:
-      - name: "keep-this-role_team_assignment"
-    state: overridden
-...
-"""
-
-RETURN = """
-before:
-  description: The state of the role_team_assignment resources before this run.
-  returned: when state is not gathered
-  type: list
-  elements: dict
-after:
-  description: The state of the role_team_assignment resources after this run.
-  returned: when state is not gathered
-  type: list
-  elements: dict
-gathered:
-  description: The gathered role_team_assignment resource state (read-only).
-  returned: when state is gathered
-  type: list
-  elements: dict
-config:
-  description: The resulting configuration (alias for after or gathered).
-  returned: always
-  type: list
-  elements: dict
-"""
diff --git a/plugins/modules/role_team_assignments.py b/plugins/modules/role_team_assignments.py
new file mode 100644
index 00000000..d25be7c0
--- /dev/null
+++ b/plugins/modules/role_team_assignments.py
@@ -0,0 +1,101 @@
+#!/usr/bin/python
+# coding: utf-8 -*-
+# (c) 2025, Ansible Platform Collection Contributors
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+"""
+Auto-generated by tools/generate_resource.py — review before committing.
+"""
+
+from __future__ import absolute_import, division, print_function
+
+__metaclass__ = type
+
+DOCUMENTATION = """
+---
+module: role_team_assignments
+short_description: Manage gateway role_team_assignment resources.
+author: Red Hat (@RedHatOfficial)
+description:
+    - Create, update, delete, or gather automation platform gateway role_team_assignment resources.
+    - Follows the Ansible resource module pattern with before/after state tracking.
+options:
+    config:
+      description:
+        - A list of role_team_assignment resource configurations.
+        - Each entry represents a desired role_team_assignment state.
+      type: list
+      elements: dict
+      suboptions:
+        role_definition:
+          required: true
+          type: int
+          description: The role definition which defines permissions conveyed by this assignment.
+        object_id:
+          type: str
+          description: The primary key of the object this assignment applies to; null value indicates system-wide assignment.
+        object_ansible_id:
+          type: str
+          description: The resource id of the object this role applies to. An alternative to the object_id field.
+        team:
+          type: int
+          description: The team of the RoleTeamAssignment.
+        team_ansible_id:
+          type: str
+          description: The resource ID of the team who will receive permissions from this assignment. An alternative to team field.
+        id:
+          type: str
+          description: The unique identifier of the resource. Used for update/delete operations.
+
+extends_documentation_fragment:
+  - ansible.platform.auth
+  - ansible.platform.state
+"""
+
+EXAMPLES = """
+- name: Create role_team_assignment resources (merged)
+  ansible.platform.role_team_assignments:
+    config:
+      - name: "my-role_team_assignment"
+    state: merged
+
+- name: Gather current role_team_assignment state
+  ansible.platform.role_team_assignments:
+    state: gathered
+  register: result
+
+- name: Delete specific role_team_assignment resources
+  ansible.platform.role_team_assignments:
+    config:
+      - name: "my-role_team_assignment"
+    state: deleted
+
+- name: Override — ensure only these role_team_assignment resources exist
+  ansible.platform.role_team_assignments:
+    config:
+      - name: "keep-this-role_team_assignment"
+    state: overridden
+...
+"""
+
+RETURN = """
+before:
+  description: The state of the role_team_assignment resources before this run.
+  returned: when state is not gathered
+  type: list
+  elements: dict
+after:
+  description: The state of the role_team_assignment resources after this run.
+  returned: when state is not gathered
+  type: list
+  elements: dict
+gathered:
+  description: The gathered role_team_assignment resource state (read-only).
+  returned: when state is gathered
+  type: list
+  elements: dict
+config:
+  description: The resulting configuration (alias for after or gathered).
+  returned: always
+  type: list
+  elements: dict
+"""
diff --git a/plugins/modules/role_user_assignment.py b/plugins/modules/role_user_assignment.py
deleted file mode 100644
index de266771..00000000
--- a/plugins/modules/role_user_assignment.py
+++ /dev/null
@@ -1,101 +0,0 @@
-#!/usr/bin/python
-# coding: utf-8 -*-
-# (c) 2025, Ansible Platform Collection Contributors
-# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
-"""
-Auto-generated by tools/generate_resource.py — review before committing.
-"""
-
-from __future__ import absolute_import, division, print_function
-
-__metaclass__ = type
-
-DOCUMENTATION = """
----
-module: role_user_assignment
-short_description: Manage gateway role_user_assignment resources.
-author: Red Hat (@RedHatOfficial)
-description:
-    - Create, update, delete, or gather automation platform gateway role_user_assignment resources.
-    - Follows the Ansible resource module pattern with before/after state tracking.
-options:
-    config:
-      description:
-        - A list of role_user_assignment resource configurations.
-        - Each entry represents a desired role_user_assignment state.
-      type: list
-      elements: dict
-      suboptions:
-        role_definition:
-          required: true
-          type: int
-          description: The role definition which defines permissions conveyed by this assignment.
-        object_id:
-          type: str
-          description: The primary key of the object this assignment applies to; null value indicates system-wide assignment.
-        object_ansible_id:
-          type: str
-          description: The resource id of the object this role applies to. An alternative to the object_id field.
-        user:
-          type: int
-          description: The user of the RoleUserAssignment.
-        user_ansible_id:
-          type: str
-          description: The resource ID of the user who will receive permissions from this assignment. An alternative to user field.
-        id:
-          type: str
-          description: The unique identifier of the resource. Used for update/delete operations.
-
-extends_documentation_fragment:
-  - ansible.platform.auth
-  - ansible.platform.state
-"""
-
-EXAMPLES = """
-- name: Create role_user_assignment resources (merged)
-  ansible.platform.role_user_assignment:
-    config:
-      - name: "my-role_user_assignment"
-    state: merged
-
-- name: Gather current role_user_assignment state
-  ansible.platform.role_user_assignment:
-    state: gathered
-  register: result
-
-- name: Delete specific role_user_assignment resources
-  ansible.platform.role_user_assignment:
-    config:
-      - name: "my-role_user_assignment"
-    state: deleted
-
-- name: Override — ensure only these role_user_assignment resources exist
-  ansible.platform.role_user_assignment:
-    config:
-      - name: "keep-this-role_user_assignment"
-    state: overridden
-...
-"""
-
-RETURN = """
-before:
-  description: The state of the role_user_assignment resources before this run.
-  returned: when state is not gathered
-  type: list
-  elements: dict
-after:
-  description: The state of the role_user_assignment resources after this run.
-  returned: when state is not gathered
-  type: list
-  elements: dict
-gathered:
-  description: The gathered role_user_assignment resource state (read-only).
-  returned: when state is gathered
-  type: list
-  elements: dict
-config:
-  description: The resulting configuration (alias for after or gathered).
-  returned: always
-  type: list
-  elements: dict
-"""
diff --git a/plugins/modules/role_user_assignments.py b/plugins/modules/role_user_assignments.py
new file mode 100644
index 00000000..6683bc89
--- /dev/null
+++ b/plugins/modules/role_user_assignments.py
@@ -0,0 +1,101 @@
+#!/usr/bin/python
+# coding: utf-8 -*-
+# (c) 2025, Ansible Platform Collection Contributors
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+"""
+Auto-generated by tools/generate_resource.py — review before committing.
+"""
+
+from __future__ import absolute_import, division, print_function
+
+__metaclass__ = type
+
+DOCUMENTATION = """
+---
+module: role_user_assignments
+short_description: Manage gateway role_user_assignment resources.
+author: Red Hat (@RedHatOfficial)
+description:
+    - Create, update, delete, or gather automation platform gateway role_user_assignment resources.
+    - Follows the Ansible resource module pattern with before/after state tracking.
+options:
+    config:
+      description:
+        - A list of role_user_assignment resource configurations.
+        - Each entry represents a desired role_user_assignment state.
+      type: list
+      elements: dict
+      suboptions:
+        role_definition:
+          required: true
+          type: int
+          description: The role definition which defines permissions conveyed by this assignment.
+        object_id:
+          type: str
+          description: The primary key of the object this assignment applies to; null value indicates system-wide assignment.
+        object_ansible_id:
+          type: str
+          description: The resource id of the object this role applies to. An alternative to the object_id field.
+        user:
+          type: int
+          description: The user of the RoleUserAssignment.
+        user_ansible_id:
+          type: str
+          description: The resource ID of the user who will receive permissions from this assignment. An alternative to user field.
+        id:
+          type: str
+          description: The unique identifier of the resource. Used for update/delete operations.
+
+extends_documentation_fragment:
+  - ansible.platform.auth
+  - ansible.platform.state
+"""
+
+EXAMPLES = """
+- name: Create role_user_assignment resources (merged)
+  ansible.platform.role_user_assignments:
+    config:
+      - name: "my-role_user_assignment"
+    state: merged
+
+- name: Gather current role_user_assignment state
+  ansible.platform.role_user_assignments:
+    state: gathered
+  register: result
+
+- name: Delete specific role_user_assignment resources
+  ansible.platform.role_user_assignments:
+    config:
+      - name: "my-role_user_assignment"
+    state: deleted
+
+- name: Override — ensure only these role_user_assignment resources exist
+  ansible.platform.role_user_assignments:
+    config:
+      - name: "keep-this-role_user_assignment"
+    state: overridden
+...
+"""
+
+RETURN = """
+before:
+  description: The state of the role_user_assignment resources before this run.
+  returned: when state is not gathered
+  type: list
+  elements: dict
+after:
+  description: The state of the role_user_assignment resources after this run.
+  returned: when state is not gathered
+  type: list
+  elements: dict
+gathered:
+  description: The gathered role_user_assignment resource state (read-only).
+  returned: when state is gathered
+  type: list
+  elements: dict
+config:
+  description: The resulting configuration (alias for after or gathered).
+  returned: always
+  type: list
+  elements: dict
+"""
diff --git a/plugins/modules/route.py b/plugins/modules/route.py
deleted file mode 100644
index 41079f0f..00000000
--- a/plugins/modules/route.py
+++ /dev/null
@@ -1,128 +0,0 @@
-#!/usr/bin/python
-# coding: utf-8 -*-
-# (c) 2025, Ansible Platform Collection Contributors
-# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
-"""
-Auto-generated by tools/generate_resource.py — review before committing.
-"""
-
-from __future__ import absolute_import, division, print_function
-
-__metaclass__ = type
-
-DOCUMENTATION = """
----
-module: route
-short_description: Manage gateway route resources.
-author: Red Hat (@RedHatOfficial)
-description:
-    - Create, update, delete, or gather automation platform gateway route resources.
-    - Follows the Ansible resource module pattern with before/after state tracking.
-options:
-    config:
-      description:
-        - A list of route resource configurations.
-        - Each entry represents a desired route state.
-      type: list
-      elements: dict
-      suboptions:
-        name:
-          required: true
-          type: str
-          description: The name of this resource.
-        http_port:
-          required: true
-          type: int
-          description: The port on the AAP gateway to listen to traffic on.
-        service_cluster:
-          required: true
-          type: int
-          description: The AAP Service to route traffic to.
-        service_port:
-          required: true
-          type: int
-          description: The port on the service cluster to route traffic to.
-        is_service_https:
-          required: true
-          type: bool
-          description: Set this to true if the service cluster requires HTTPS.
-        service_path:
-          required: true
-          type: str
-          description: The URL path on the AAP Service cluster to route traffic to.
-        gateway_path:
-          required: true
-          type: str
-          description: The path on the AAP gateway to listen to traffic on.
-        is_internal_route:
-          type: bool
-          description: If true, the AAP gateway will only allow other AAP services to access this route. Requires gateway auth to be enabled.
-        description:
-          type: str
-          description: A description of this route.
-        enable_gateway_auth:
-          type: bool
-          description: If false, the AAP gateway will not insert a gateway token into the proxied request.
-        node_tags:
-          type: str
-          description: A comma-separated list of nodes in the service cluster to receive traffic from this route.  Leave blank to select all nodes.
-        enable_mtls:
-          type: bool
-          description: If true, the route requires mutual TLS. Connecting clients have to provide one or more certificates.
-        id:
-          type: str
-          description: The unique identifier of the resource. Used for update/delete operations.
-
-extends_documentation_fragment:
-  - ansible.platform.auth
-  - ansible.platform.state
-"""
-
-EXAMPLES = """
-- name: Create route resources (merged)
-  ansible.platform.route:
-    config:
-      - name: "my-route"
-    state: merged
-
-- name: Gather current route state
-  ansible.platform.route:
-    state: gathered
-  register: result
-
-- name: Delete specific route resources
-  ansible.platform.route:
-    config:
-      - name: "my-route"
-    state: deleted
-
-- name: Override — ensure only these route resources exist
-  ansible.platform.route:
-    config:
-      - name: "keep-this-route"
-    state: overridden
-...
-"""
-
-RETURN = """
-before:
-  description: The state of the route resources before this run.
-  returned: when state is not gathered
-  type: list
-  elements: dict
-after:
-  description: The state of the route resources after this run.
-  returned: when state is not gathered
-  type: list
-  elements: dict
-gathered:
-  description: The gathered route resource state (read-only).
-  returned: when state is gathered
-  type: list
-  elements: dict
-config:
-  description: The resulting configuration (alias for after or gathered).
-  returned: always
-  type: list
-  elements: dict
-"""
diff --git a/plugins/modules/routes.py b/plugins/modules/routes.py
new file mode 100644
index 00000000..1fa4a747
--- /dev/null
+++ b/plugins/modules/routes.py
@@ -0,0 +1,128 @@
+#!/usr/bin/python
+# coding: utf-8 -*-
+# (c) 2025, Ansible Platform Collection Contributors
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+"""
+Auto-generated by tools/generate_resource.py — review before committing.
+"""
+
+from __future__ import absolute_import, division, print_function
+
+__metaclass__ = type
+
+DOCUMENTATION = """
+---
+module: routes
+short_description: Manage gateway route resources.
+author: Red Hat (@RedHatOfficial)
+description:
+    - Create, update, delete, or gather automation platform gateway route resources.
+    - Follows the Ansible resource module pattern with before/after state tracking.
+options:
+    config:
+      description:
+        - A list of route resource configurations.
+        - Each entry represents a desired route state.
+      type: list
+      elements: dict
+      suboptions:
+        name:
+          required: true
+          type: str
+          description: The name of this resource.
+        http_port:
+          required: true
+          type: int
+          description: The port on the AAP gateway to listen to traffic on.
+        service_cluster:
+          required: true
+          type: int
+          description: The AAP Service to route traffic to.
+        service_port:
+          required: true
+          type: int
+          description: The port on the service cluster to route traffic to.
+        is_service_https:
+          required: true
+          type: bool
+          description: Set this to true if the service cluster requires HTTPS.
+        service_path:
+          required: true
+          type: str
+          description: The URL path on the AAP Service cluster to route traffic to.
+        gateway_path:
+          required: true
+          type: str
+          description: The path on the AAP gateway to listen to traffic on.
+        is_internal_route:
+          type: bool
+          description: If true, the AAP gateway will only allow other AAP services to access this route. Requires gateway auth to be enabled.
+        description:
+          type: str
+          description: A description of this route.
+        enable_gateway_auth:
+          type: bool
+          description: If false, the AAP gateway will not insert a gateway token into the proxied request.
+        node_tags:
+          type: str
+          description: A comma-separated list of nodes in the service cluster to receive traffic from this route.  Leave blank to select all nodes.
+        enable_mtls:
+          type: bool
+          description: If true, the route requires mutual TLS. Connecting clients have to provide one or more certificates.
+        id:
+          type: str
+          description: The unique identifier of the resource. Used for update/delete operations.
+
+extends_documentation_fragment:
+  - ansible.platform.auth
+  - ansible.platform.state
+"""
+
+EXAMPLES = """
+- name: Create route resources (merged)
+  ansible.platform.routes:
+    config:
+      - name: "my-route"
+    state: merged
+
+- name: Gather current route state
+  ansible.platform.routes:
+    state: gathered
+  register: result
+
+- name: Delete specific route resources
+  ansible.platform.routes:
+    config:
+      - name: "my-route"
+    state: deleted
+
+- name: Override — ensure only these route resources exist
+  ansible.platform.routes:
+    config:
+      - name: "keep-this-route"
+    state: overridden
+...
+"""
+
+RETURN = """
+before:
+  description: The state of the route resources before this run.
+  returned: when state is not gathered
+  type: list
+  elements: dict
+after:
+  description: The state of the route resources after this run.
+  returned: when state is not gathered
+  type: list
+  elements: dict
+gathered:
+  description: The gathered route resource state (read-only).
+  returned: when state is gathered
+  type: list
+  elements: dict
+config:
+  description: The resulting configuration (alias for after or gathered).
+  returned: always
+  type: list
+  elements: dict
+"""
diff --git a/plugins/modules/service.py b/plugins/modules/service.py
deleted file mode 100644
index 3f4ccb69..00000000
--- a/plugins/modules/service.py
+++ /dev/null
@@ -1,131 +0,0 @@
-#!/usr/bin/python
-# coding: utf-8 -*-
-# (c) 2025, Ansible Platform Collection Contributors
-# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
-"""
-Auto-generated by tools/generate_resource.py — review before committing.
-"""
-
-from __future__ import absolute_import, division, print_function
-
-__metaclass__ = type
-
-DOCUMENTATION = """
----
-module: service
-short_description: Manage gateway service resources.
-author: Red Hat (@RedHatOfficial)
-description:
-    - Create, update, delete, or gather automation platform gateway service resources.
-    - Follows the Ansible resource module pattern with before/after state tracking.
-options:
-    config:
-      description:
-        - A list of service resource configurations.
-        - Each entry represents a desired service state.
-      type: list
-      elements: dict
-      suboptions:
-        name:
-          required: true
-          type: str
-          description: The name of this resource.
-        http_port:
-          required: true
-          type: int
-          description: The port on the AAP gateway to listen to traffic on.
-        service_cluster:
-          required: true
-          type: int
-          description: The AAP Service to route traffic to.
-        service_port:
-          required: true
-          type: int
-          description: The port on the service cluster to route traffic to.
-        is_service_https:
-          required: true
-          type: bool
-          description: Set this to true if the service cluster requires HTTPS.
-        service_path:
-          required: true
-          type: str
-          description: The URL path on the AAP Service cluster to route traffic to.
-        api_slug:
-          required: true
-          type: str
-          description: An internally generated API slug for this Service API Route.
-        is_internal_route:
-          type: bool
-          description: If true, the AAP gateway will only allow other AAP services to access this route. Requires gateway auth to be enabled.
-        description:
-          type: str
-          description: A description of this route.
-        enable_gateway_auth:
-          type: bool
-          description: If false, the AAP gateway will not insert a gateway token into the proxied request.
-        order:
-          type: int
-          description: The order to apply the routes in; lower numbers are first. Items with the same value have no guaranteed order
-        node_tags:
-          type: str
-          description: A comma-separated list of nodes in the service cluster to receive traffic from this route.  Leave blank to select all nodes.
-        enable_mtls:
-          type: bool
-          description: If true, the route requires mutual TLS. Connecting clients have to provide one or more certificates.
-        id:
-          type: str
-          description: The unique identifier of the resource. Used for update/delete operations.
-
-extends_documentation_fragment:
-  - ansible.platform.auth
-  - ansible.platform.state
-"""
-
-EXAMPLES = """
-- name: Create service resources (merged)
-  ansible.platform.service:
-    config:
-      - name: "my-service"
-    state: merged
-
-- name: Gather current service state
-  ansible.platform.service:
-    state: gathered
-  register: result
-
-- name: Delete specific service resources
-  ansible.platform.service:
-    config:
-      - name: "my-service"
-    state: deleted
-
-- name: Override — ensure only these service resources exist
-  ansible.platform.service:
-    config:
-      - name: "keep-this-service"
-    state: overridden
-...
-"""
-
-RETURN = """
-before:
-  description: The state of the service resources before this run.
-  returned: when state is not gathered
-  type: list
-  elements: dict
-after:
-  description: The state of the service resources after this run.
-  returned: when state is not gathered
-  type: list
-  elements: dict
-gathered:
-  description: The gathered service resource state (read-only).
-  returned: when state is gathered
-  type: list
-  elements: dict
-config:
-  description: The resulting configuration (alias for after or gathered).
-  returned: always
-  type: list
-  elements: dict
-"""
diff --git a/plugins/modules/service_cluster.py b/plugins/modules/service_cluster.py
deleted file mode 100644
index 523065e8..00000000
--- a/plugins/modules/service_cluster.py
+++ /dev/null
@@ -1,154 +0,0 @@
-#!/usr/bin/python
-# coding: utf-8 -*-
-# (c) 2025, Ansible Platform Collection Contributors
-# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
-"""
-Auto-generated by tools/generate_resource.py — review before committing.
-"""
-
-from __future__ import absolute_import, division, print_function
-
-__metaclass__ = type
-
-DOCUMENTATION = """
----
-module: service_cluster
-short_description: Manage gateway service_cluster resources.
-author: Red Hat (@RedHatOfficial)
-description:
-    - Create, update, delete, or gather automation platform gateway service_cluster resources.
-    - Follows the Ansible resource module pattern with before/after state tracking.
-options:
-    config:
-      description:
-        - A list of service_cluster resource configurations.
-        - Each entry represents a desired service_cluster state.
-      type: list
-      elements: dict
-      suboptions:
-        name:
-          required: true
-          type: str
-          description: The name of this resource.
-        service_type:
-          required: true
-          type: int
-          description: The AAP service type of this service cluster.
-        auth_type:
-          type: str
-          description:
-            - The authorization type for this service.
-            - '`JWT` - JWT'
-            - '`BASIC` - Basic auth'
-            - '`TOKEN` - Bearer token'
-
-        upstream_hostname:
-          type: str
-          description: Set this value to enable server name identification on associated routes.
-        dns_discovery_type:
-          type: str
-          description:
-            - The DNS service discovery type for this service.
-            - '`LOGICAL_DNS` - Logical DNS'
-            - '`STRICT_DNS` - Strict DNS'
-
-        dns_lookup_family:
-          type: str
-          description:
-            - DNS lookup type for this service.
-            - '`V4_ONLY` - IPv4 only'
-            - '`V6_ONLY` - IPv6 only'
-            - '`AUTO` - Auto (IPv6 preferred)'
-            - '`ALL` - All IPv4 and IPv6 addresses'
-            - '`V4_PREFERRED` - IPv4 preferred'
-
-        outlier_detection_enabled:
-          type: bool
-          description: If true, outlier detection will be used to determine if a node is unhealthy and should be ejected from the cluster.
-        outlier_detection_consecutive_5xx:
-          type: int
-          description: The number of consecutive 5xx responses to consider a node unhealthy.
-        outlier_detection_interval_seconds:
-          type: int
-          description: The time interval between ejection analysis sweeps.
-        outlier_detection_base_ejection_time_seconds:
-          type: int
-          description: The base time a node will be ejected for.
-        outlier_detection_max_ejection_percent:
-          type: int
-          description: The maximum percent of nodes that can be ejected from the cluster.
-        health_checks_enabled:
-          type: bool
-          description: If true, health checks will be used to determine if a node is healthy.
-        health_check_timeout_seconds:
-          type: int
-          description: The time to wait for a health check to complete.
-        health_check_interval_seconds:
-          type: int
-          description: The time between health check requests.
-        health_check_unhealthy_threshold:
-          type: int
-          description: The number of consecutive failed health checks before a node is considered unhealthy.
-        health_check_healthy_threshold:
-          type: int
-          description: The number of consecutive successful health checks before a node is considered healthy.
-        healthy_panic_threshold:
-          type: int
-          description: The percentage of failed hosts when the proxy will panic and start routing traffic to all nodes. Set to 0 to disable this.
-        id:
-          type: str
-          description: The unique identifier of the resource. Used for update/delete operations.
-
-extends_documentation_fragment:
-  - ansible.platform.auth
-  - ansible.platform.state
-"""
-
-EXAMPLES = """
-- name: Create service_cluster resources (merged)
-  ansible.platform.service_cluster:
-    config:
-      - name: "my-service_cluster"
-    state: merged
-
-- name: Gather current service_cluster state
-  ansible.platform.service_cluster:
-    state: gathered
-  register: result
-
-- name: Delete specific service_cluster resources
-  ansible.platform.service_cluster:
-    config:
-      - name: "my-service_cluster"
-    state: deleted
-
-- name: Override — ensure only these service_cluster resources exist
-  ansible.platform.service_cluster:
-    config:
-      - name: "keep-this-service_cluster"
-    state: overridden
-...
-"""
-
-RETURN = """
-before:
-  description: The state of the service_cluster resources before this run.
-  returned: when state is not gathered
-  type: list
-  elements: dict
-after:
-  description: The state of the service_cluster resources after this run.
-  returned: when state is not gathered
-  type: list
-  elements: dict
-gathered:
-  description: The gathered service_cluster resource state (read-only).
-  returned: when state is gathered
-  type: list
-  elements: dict
-config:
-  description: The resulting configuration (alias for after or gathered).
-  returned: always
-  type: list
-  elements: dict
-"""
diff --git a/plugins/modules/service_clusters.py b/plugins/modules/service_clusters.py
new file mode 100644
index 00000000..281fea29
--- /dev/null
+++ b/plugins/modules/service_clusters.py
@@ -0,0 +1,154 @@
+#!/usr/bin/python
+# coding: utf-8 -*-
+# (c) 2025, Ansible Platform Collection Contributors
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+"""
+Auto-generated by tools/generate_resource.py — review before committing.
+"""
+
+from __future__ import absolute_import, division, print_function
+
+__metaclass__ = type
+
+DOCUMENTATION = """
+---
+module: service_clusters
+short_description: Manage gateway service_cluster resources.
+author: Red Hat (@RedHatOfficial)
+description:
+    - Create, update, delete, or gather automation platform gateway service_cluster resources.
+    - Follows the Ansible resource module pattern with before/after state tracking.
+options:
+    config:
+      description:
+        - A list of service_cluster resource configurations.
+        - Each entry represents a desired service_cluster state.
+      type: list
+      elements: dict
+      suboptions:
+        name:
+          required: true
+          type: str
+          description: The name of this resource.
+        service_type:
+          required: true
+          type: int
+          description: The AAP service type of this service cluster.
+        auth_type:
+          type: str
+          description:
+            - The authorization type for this service.
+            - '`JWT` - JWT'
+            - '`BASIC` - Basic auth'
+            - '`TOKEN` - Bearer token'
+
+        upstream_hostname:
+          type: str
+          description: Set this value to enable server name identification on associated routes.
+        dns_discovery_type:
+          type: str
+          description:
+            - The DNS service discovery type for this service.
+            - '`LOGICAL_DNS` - Logical DNS'
+            - '`STRICT_DNS` - Strict DNS'
+
+        dns_lookup_family:
+          type: str
+          description:
+            - DNS lookup type for this service.
+            - '`V4_ONLY` - IPv4 only'
+            - '`V6_ONLY` - IPv6 only'
+            - '`AUTO` - Auto (IPv6 preferred)'
+            - '`ALL` - All IPv4 and IPv6 addresses'
+            - '`V4_PREFERRED` - IPv4 preferred'
+
+        outlier_detection_enabled:
+          type: bool
+          description: If true, outlier detection will be used to determine if a node is unhealthy and should be ejected from the cluster.
+        outlier_detection_consecutive_5xx:
+          type: int
+          description: The number of consecutive 5xx responses to consider a node unhealthy.
+        outlier_detection_interval_seconds:
+          type: int
+          description: The time interval between ejection analysis sweeps.
+        outlier_detection_base_ejection_time_seconds:
+          type: int
+          description: The base time a node will be ejected for.
+        outlier_detection_max_ejection_percent:
+          type: int
+          description: The maximum percent of nodes that can be ejected from the cluster.
+        health_checks_enabled:
+          type: bool
+          description: If true, health checks will be used to determine if a node is healthy.
+        health_check_timeout_seconds:
+          type: int
+          description: The time to wait for a health check to complete.
+        health_check_interval_seconds:
+          type: int
+          description: The time between health check requests.
+        health_check_unhealthy_threshold:
+          type: int
+          description: The number of consecutive failed health checks before a node is considered unhealthy.
+        health_check_healthy_threshold:
+          type: int
+          description: The number of consecutive successful health checks before a node is considered healthy.
+        healthy_panic_threshold:
+          type: int
+          description: The percentage of failed hosts when the proxy will panic and start routing traffic to all nodes. Set to 0 to disable this.
+        id:
+          type: str
+          description: The unique identifier of the resource. Used for update/delete operations.
+
+extends_documentation_fragment:
+  - ansible.platform.auth
+  - ansible.platform.state
+"""
+
+EXAMPLES = """
+- name: Create service_cluster resources (merged)
+  ansible.platform.service_clusters:
+    config:
+      - name: "my-service_cluster"
+    state: merged
+
+- name: Gather current service_cluster state
+  ansible.platform.service_clusters:
+    state: gathered
+  register: result
+
+- name: Delete specific service_cluster resources
+  ansible.platform.service_clusters:
+    config:
+      - name: "my-service_cluster"
+    state: deleted
+
+- name: Override — ensure only these service_cluster resources exist
+  ansible.platform.service_clusters:
+    config:
+      - name: "keep-this-service_cluster"
+    state: overridden
+...
+"""
+
+RETURN = """
+before:
+  description: The state of the service_cluster resources before this run.
+  returned: when state is not gathered
+  type: list
+  elements: dict
+after:
+  description: The state of the service_cluster resources after this run.
+  returned: when state is not gathered
+  type: list
+  elements: dict
+gathered:
+  description: The gathered service_cluster resource state (read-only).
+  returned: when state is gathered
+  type: list
+  elements: dict
+config:
+  description: The resulting configuration (alias for after or gathered).
+  returned: always
+  type: list
+  elements: dict
+"""
diff --git a/plugins/modules/service_key.py b/plugins/modules/service_key.py
deleted file mode 100644
index 3a3a39c7..00000000
--- a/plugins/modules/service_key.py
+++ /dev/null
@@ -1,108 +0,0 @@
-#!/usr/bin/python
-# coding: utf-8 -*-
-# (c) 2025, Ansible Platform Collection Contributors
-# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
-"""
-Auto-generated by tools/generate_resource.py — review before committing.
-"""
-
-from __future__ import absolute_import, division, print_function
-
-__metaclass__ = type
-
-DOCUMENTATION = """
----
-module: service_key
-short_description: Manage gateway service_key resources.
-author: Red Hat (@RedHatOfficial)
-description:
-    - Create, update, delete, or gather automation platform gateway service_key resources.
-    - Follows the Ansible resource module pattern with before/after state tracking.
-options:
-    config:
-      description:
-        - A list of service_key resource configurations.
-        - Each entry represents a desired service_key state.
-      type: list
-      elements: dict
-      suboptions:
-        service_cluster:
-          required: true
-          type: int
-          description: The service cluster this key is for
-        mark_previous_inactive:
-          required: true
-          type: bool
-          description: The mark_previous_inactive of the ServiceKey.
-        name:
-          type: str
-          description: The name of this resource.
-        is_active:
-          type: bool
-          description: Is this service key active.
-        algorithm:
-          type: str
-          description:
-            - "HS256 - HMAC with SHA256"
-            - "HS384 - HMAC with SHA384"
-            - "HS512 - HMAC with SHA512"
-        secret_length:
-          type: int
-          description: The secret_length of the ServiceKey.
-        id:
-          type: str
-          description: The unique identifier of the resource. Used for update/delete operations.
-
-extends_documentation_fragment:
-  - ansible.platform.auth
-  - ansible.platform.state
-"""
-
-EXAMPLES = """
-- name: Create service_key resources (merged)
-  ansible.platform.service_key:
-    config:
-      - name: "my-service_key"
-    state: merged
-
-- name: Gather current service_key state
-  ansible.platform.service_key:
-    state: gathered
-  register: result
-
-- name: Delete specific service_key resources
-  ansible.platform.service_key:
-    config:
-      - name: "my-service_key"
-    state: deleted
-
-- name: Override — ensure only these service_key resources exist
-  ansible.platform.service_key:
-    config:
-      - name: "keep-this-service_key"
-    state: overridden
-...
-"""
-
-RETURN = """
-before:
-  description: The state of the service_key resources before this run.
-  returned: when state is not gathered
-  type: list
-  elements: dict
-after:
-  description: The state of the service_key resources after this run.
-  returned: when state is not gathered
-  type: list
-  elements: dict
-gathered:
-  description: The gathered service_key resource state (read-only).
-  returned: when state is gathered
-  type: list
-  elements: dict
-config:
-  description: The resulting configuration (alias for after or gathered).
-  returned: always
-  type: list
-  elements: dict
-"""
diff --git a/plugins/modules/service_keys.py b/plugins/modules/service_keys.py
new file mode 100644
index 00000000..d41f947c
--- /dev/null
+++ b/plugins/modules/service_keys.py
@@ -0,0 +1,108 @@
+#!/usr/bin/python
+# coding: utf-8 -*-
+# (c) 2025, Ansible Platform Collection Contributors
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+"""
+Auto-generated by tools/generate_resource.py — review before committing.
+"""
+
+from __future__ import absolute_import, division, print_function
+
+__metaclass__ = type
+
+DOCUMENTATION = """
+---
+module: service_keys
+short_description: Manage gateway service_key resources.
+author: Red Hat (@RedHatOfficial)
+description:
+    - Create, update, delete, or gather automation platform gateway service_key resources.
+    - Follows the Ansible resource module pattern with before/after state tracking.
+options:
+    config:
+      description:
+        - A list of service_key resource configurations.
+        - Each entry represents a desired service_key state.
+      type: list
+      elements: dict
+      suboptions:
+        service_cluster:
+          required: true
+          type: int
+          description: The service cluster this key is for
+        mark_previous_inactive:
+          required: true
+          type: bool
+          description: The mark_previous_inactive of the ServiceKey.
+        name:
+          type: str
+          description: The name of this resource.
+        is_active:
+          type: bool
+          description: Is this service key active.
+        algorithm:
+          type: str
+          description:
+            - "HS256 - HMAC with SHA256"
+            - "HS384 - HMAC with SHA384"
+            - "HS512 - HMAC with SHA512"
+        secret_length:
+          type: int
+          description: The secret_length of the ServiceKey.
+        id:
+          type: str
+          description: The unique identifier of the resource. Used for update/delete operations.
+
+extends_documentation_fragment:
+  - ansible.platform.auth
+  - ansible.platform.state
+"""
+
+EXAMPLES = """
+- name: Create service_key resources (merged)
+  ansible.platform.service_keys:
+    config:
+      - name: "my-service_key"
+    state: merged
+
+- name: Gather current service_key state
+  ansible.platform.service_keys:
+    state: gathered
+  register: result
+
+- name: Delete specific service_key resources
+  ansible.platform.service_keys:
+    config:
+      - name: "my-service_key"
+    state: deleted
+
+- name: Override — ensure only these service_key resources exist
+  ansible.platform.service_keys:
+    config:
+      - name: "keep-this-service_key"
+    state: overridden
+...
+"""
+
+RETURN = """
+before:
+  description: The state of the service_key resources before this run.
+  returned: when state is not gathered
+  type: list
+  elements: dict
+after:
+  description: The state of the service_key resources after this run.
+  returned: when state is not gathered
+  type: list
+  elements: dict
+gathered:
+  description: The gathered service_key resource state (read-only).
+  returned: when state is gathered
+  type: list
+  elements: dict
+config:
+  description: The resulting configuration (alias for after or gathered).
+  returned: always
+  type: list
+  elements: dict
+"""
diff --git a/plugins/modules/service_node.py b/plugins/modules/service_node.py
deleted file mode 100644
index a0197c51..00000000
--- a/plugins/modules/service_node.py
+++ /dev/null
@@ -1,100 +0,0 @@
-#!/usr/bin/python
-# coding: utf-8 -*-
-# (c) 2025, Ansible Platform Collection Contributors
-# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
-"""
-Auto-generated by tools/generate_resource.py — review before committing.
-"""
-
-from __future__ import absolute_import, division, print_function
-
-__metaclass__ = type
-
-DOCUMENTATION = """
----
-module: service_node
-short_description: Manage gateway service_node resources.
-author: Red Hat (@RedHatOfficial)
-description:
-    - Create, update, delete, or gather automation platform gateway service_node resources.
-    - Follows the Ansible resource module pattern with before/after state tracking.
-options:
-    config:
-      description:
-        - A list of service_node resource configurations.
-        - Each entry represents a desired service_node state.
-      type: list
-      elements: dict
-      suboptions:
-        name:
-          required: true
-          type: str
-          description: The name of this resource.
-        address:
-          required: true
-          type: str
-          description: The network address to route traffic for this service to.
-        service_cluster:
-          required: true
-          type: int
-          description: The AAP Service cluster that this node belongs to.
-        tags:
-          type: str
-          description: A comma-separated list of roles to assign to a node; to be selective about which routes point to it.
-        id:
-          type: str
-          description: The unique identifier of the resource. Used for update/delete operations.
-
-extends_documentation_fragment:
-  - ansible.platform.auth
-  - ansible.platform.state
-"""
-
-EXAMPLES = """
-- name: Create service_node resources (merged)
-  ansible.platform.service_node:
-    config:
-      - name: "my-service_node"
-    state: merged
-
-- name: Gather current service_node state
-  ansible.platform.service_node:
-    state: gathered
-  register: result
-
-- name: Delete specific service_node resources
-  ansible.platform.service_node:
-    config:
-      - name: "my-service_node"
-    state: deleted
-
-- name: Override — ensure only these service_node resources exist
-  ansible.platform.service_node:
-    config:
-      - name: "keep-this-service_node"
-    state: overridden
-...
-"""
-
-RETURN = """
-before:
-  description: The state of the service_node resources before this run.
-  returned: when state is not gathered
-  type: list
-  elements: dict
-after:
-  description: The state of the service_node resources after this run.
-  returned: when state is not gathered
-  type: list
-  elements: dict
-gathered:
-  description: The gathered service_node resource state (read-only).
-  returned: when state is gathered
-  type: list
-  elements: dict
-config:
-  description: The resulting configuration (alias for after or gathered).
-  returned: always
-  type: list
-  elements: dict
-"""
diff --git a/plugins/modules/service_nodes.py b/plugins/modules/service_nodes.py
new file mode 100644
index 00000000..c454a5ef
--- /dev/null
+++ b/plugins/modules/service_nodes.py
@@ -0,0 +1,100 @@
+#!/usr/bin/python
+# coding: utf-8 -*-
+# (c) 2025, Ansible Platform Collection Contributors
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+"""
+Auto-generated by tools/generate_resource.py — review before committing.
+"""
+
+from __future__ import absolute_import, division, print_function
+
+__metaclass__ = type
+
+DOCUMENTATION = """
+---
+module: service_nodes
+short_description: Manage gateway service_node resources.
+author: Red Hat (@RedHatOfficial)
+description:
+    - Create, update, delete, or gather automation platform gateway service_node resources.
+    - Follows the Ansible resource module pattern with before/after state tracking.
+options:
+    config:
+      description:
+        - A list of service_node resource configurations.
+        - Each entry represents a desired service_node state.
+      type: list
+      elements: dict
+      suboptions:
+        name:
+          required: true
+          type: str
+          description: The name of this resource.
+        address:
+          required: true
+          type: str
+          description: The network address to route traffic for this service to.
+        service_cluster:
+          required: true
+          type: int
+          description: The AAP Service cluster that this node belongs to.
+        tags:
+          type: str
+          description: A comma-separated list of roles to assign to a node; to be selective about which routes point to it.
+        id:
+          type: str
+          description: The unique identifier of the resource. Used for update/delete operations.
+
+extends_documentation_fragment:
+  - ansible.platform.auth
+  - ansible.platform.state
+"""
+
+EXAMPLES = """
+- name: Create service_node resources (merged)
+  ansible.platform.service_nodes:
+    config:
+      - name: "my-service_node"
+    state: merged
+
+- name: Gather current service_node state
+  ansible.platform.service_nodes:
+    state: gathered
+  register: result
+
+- name: Delete specific service_node resources
+  ansible.platform.service_nodes:
+    config:
+      - name: "my-service_node"
+    state: deleted
+
+- name: Override — ensure only these service_node resources exist
+  ansible.platform.service_nodes:
+    config:
+      - name: "keep-this-service_node"
+    state: overridden
+...
+"""
+
+RETURN = """
+before:
+  description: The state of the service_node resources before this run.
+  returned: when state is not gathered
+  type: list
+  elements: dict
+after:
+  description: The state of the service_node resources after this run.
+  returned: when state is not gathered
+  type: list
+  elements: dict
+gathered:
+  description: The gathered service_node resource state (read-only).
+  returned: when state is gathered
+  type: list
+  elements: dict
+config:
+  description: The resulting configuration (alias for after or gathered).
+  returned: always
+  type: list
+  elements: dict
+"""
diff --git a/plugins/modules/service_type.py b/plugins/modules/service_type.py
deleted file mode 100644
index 9285fed4..00000000
--- a/plugins/modules/service_type.py
+++ /dev/null
@@ -1,101 +0,0 @@
-#!/usr/bin/python
-# coding: utf-8 -*-
-# (c) 2025, Ansible Platform Collection Contributors
-# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
-"""
-Auto-generated by tools/generate_resource.py — review before committing.
-"""
-
-from __future__ import absolute_import, division, print_function
-
-__metaclass__ = type
-
-DOCUMENTATION = """
----
-module: service_type
-short_description: Manage gateway service_type resources.
-author: Red Hat (@RedHatOfficial)
-description:
-    - Create, update, delete, or gather automation platform gateway service_type resources.
-    - Follows the Ansible resource module pattern with before/after state tracking.
-options:
-    config:
-      description:
-        - A list of service_type resource configurations.
-        - Each entry represents a desired service_type state.
-      type: list
-      elements: dict
-      suboptions:
-        name:
-          required: true
-          type: str
-          description: The name of this resource.
-        login_path:
-          type: str
-          description: API path to login for service, ex. /v1/auth/session/login/
-        logout_path:
-          type: str
-          description: API path to logout for service, ex. /logout/
-        ping_url:
-          type: str
-          description: URL to the ping/status page of the service, ex. /pulp/api/v3/status/
-        service_index_path:
-          type: str
-          description: API path to resource service index endpoint, ex. /v2/service-index/
-        id:
-          type: str
-          description: The unique identifier of the resource. Used for update/delete operations.
-
-extends_documentation_fragment:
-  - ansible.platform.auth
-  - ansible.platform.state
-"""
-
-EXAMPLES = """
-- name: Create service_type resources (merged)
-  ansible.platform.service_type:
-    config:
-      - name: "my-service_type"
-    state: merged
-
-- name: Gather current service_type state
-  ansible.platform.service_type:
-    state: gathered
-  register: result
-
-- name: Delete specific service_type resources
-  ansible.platform.service_type:
-    config:
-      - name: "my-service_type"
-    state: deleted
-
-- name: Override — ensure only these service_type resources exist
-  ansible.platform.service_type:
-    config:
-      - name: "keep-this-service_type"
-    state: overridden
-...
-"""
-
-RETURN = """
-before:
-  description: The state of the service_type resources before this run.
-  returned: when state is not gathered
-  type: list
-  elements: dict
-after:
-  description: The state of the service_type resources after this run.
-  returned: when state is not gathered
-  type: list
-  elements: dict
-gathered:
-  description: The gathered service_type resource state (read-only).
-  returned: when state is gathered
-  type: list
-  elements: dict
-config:
-  description: The resulting configuration (alias for after or gathered).
-  returned: always
-  type: list
-  elements: dict
-"""
diff --git a/plugins/modules/service_types.py b/plugins/modules/service_types.py
new file mode 100644
index 00000000..4572f427
--- /dev/null
+++ b/plugins/modules/service_types.py
@@ -0,0 +1,101 @@
+#!/usr/bin/python
+# coding: utf-8 -*-
+# (c) 2025, Ansible Platform Collection Contributors
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+"""
+Auto-generated by tools/generate_resource.py — review before committing.
+"""
+
+from __future__ import absolute_import, division, print_function
+
+__metaclass__ = type
+
+DOCUMENTATION = """
+---
+module: service_types
+short_description: Manage gateway service_type resources.
+author: Red Hat (@RedHatOfficial)
+description:
+    - Create, update, delete, or gather automation platform gateway service_type resources.
+    - Follows the Ansible resource module pattern with before/after state tracking.
+options:
+    config:
+      description:
+        - A list of service_type resource configurations.
+        - Each entry represents a desired service_type state.
+      type: list
+      elements: dict
+      suboptions:
+        name:
+          required: true
+          type: str
+          description: The name of this resource.
+        login_path:
+          type: str
+          description: API path to login for service, ex. /v1/auth/session/login/
+        logout_path:
+          type: str
+          description: API path to logout for service, ex. /logout/
+        ping_url:
+          type: str
+          description: URL to the ping/status page of the service, ex. /pulp/api/v3/status/
+        service_index_path:
+          type: str
+          description: API path to resource service index endpoint, ex. /v2/service-index/
+        id:
+          type: str
+          description: The unique identifier of the resource. Used for update/delete operations.
+
+extends_documentation_fragment:
+  - ansible.platform.auth
+  - ansible.platform.state
+"""
+
+EXAMPLES = """
+- name: Create service_type resources (merged)
+  ansible.platform.service_types:
+    config:
+      - name: "my-service_type"
+    state: merged
+
+- name: Gather current service_type state
+  ansible.platform.service_types:
+    state: gathered
+  register: result
+
+- name: Delete specific service_type resources
+  ansible.platform.service_types:
+    config:
+      - name: "my-service_type"
+    state: deleted
+
+- name: Override — ensure only these service_type resources exist
+  ansible.platform.service_types:
+    config:
+      - name: "keep-this-service_type"
+    state: overridden
+...
+"""
+
+RETURN = """
+before:
+  description: The state of the service_type resources before this run.
+  returned: when state is not gathered
+  type: list
+  elements: dict
+after:
+  description: The state of the service_type resources after this run.
+  returned: when state is not gathered
+  type: list
+  elements: dict
+gathered:
+  description: The gathered service_type resource state (read-only).
+  returned: when state is gathered
+  type: list
+  elements: dict
+config:
+  description: The resulting configuration (alias for after or gathered).
+  returned: always
+  type: list
+  elements: dict
+"""
diff --git a/plugins/modules/services.py b/plugins/modules/services.py
new file mode 100644
index 00000000..e8827de8
--- /dev/null
+++ b/plugins/modules/services.py
@@ -0,0 +1,131 @@
+#!/usr/bin/python
+# coding: utf-8 -*-
+# (c) 2025, Ansible Platform Collection Contributors
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+"""
+Auto-generated by tools/generate_resource.py — review before committing.
+"""
+
+from __future__ import absolute_import, division, print_function
+
+__metaclass__ = type
+
+DOCUMENTATION = """
+---
+module: services
+short_description: Manage gateway service resources.
+author: Red Hat (@RedHatOfficial)
+description:
+    - Create, update, delete, or gather automation platform gateway service resources.
+    - Follows the Ansible resource module pattern with before/after state tracking.
+options:
+    config:
+      description:
+        - A list of service resource configurations.
+        - Each entry represents a desired service state.
+      type: list
+      elements: dict
+      suboptions:
+        name:
+          required: true
+          type: str
+          description: The name of this resource.
+        http_port:
+          required: true
+          type: int
+          description: The port on the AAP gateway to listen to traffic on.
+        service_cluster:
+          required: true
+          type: int
+          description: The AAP Service to route traffic to.
+        service_port:
+          required: true
+          type: int
+          description: The port on the service cluster to route traffic to.
+        is_service_https:
+          required: true
+          type: bool
+          description: Set this to true if the service cluster requires HTTPS.
+        service_path:
+          required: true
+          type: str
+          description: The URL path on the AAP Service cluster to route traffic to.
+        api_slug:
+          required: true
+          type: str
+          description: An internally generated API slug for this Service API Route.
+        is_internal_route:
+          type: bool
+          description: If true, the AAP gateway will only allow other AAP services to access this route. Requires gateway auth to be enabled.
+        description:
+          type: str
+          description: A description of this route.
+        enable_gateway_auth:
+          type: bool
+          description: If false, the AAP gateway will not insert a gateway token into the proxied request.
+        order:
+          type: int
+          description: The order to apply the routes in; lower numbers are first. Items with the same value have no guaranteed order
+        node_tags:
+          type: str
+          description: A comma-separated list of nodes in the service cluster to receive traffic from this route.  Leave blank to select all nodes.
+        enable_mtls:
+          type: bool
+          description: If true, the route requires mutual TLS. Connecting clients have to provide one or more certificates.
+        id:
+          type: str
+          description: The unique identifier of the resource. Used for update/delete operations.
+
+extends_documentation_fragment:
+  - ansible.platform.auth
+  - ansible.platform.state
+"""
+
+EXAMPLES = """
+- name: Create service resources (merged)
+  ansible.platform.services:
+    config:
+      - name: "my-service"
+    state: merged
+
+- name: Gather current service state
+  ansible.platform.services:
+    state: gathered
+  register: result
+
+- name: Delete specific service resources
+  ansible.platform.services:
+    config:
+      - name: "my-service"
+    state: deleted
+
+- name: Override — ensure only these service resources exist
+  ansible.platform.services:
+    config:
+      - name: "keep-this-service"
+    state: overridden
+...
+"""
+
+RETURN = """
+before:
+  description: The state of the service resources before this run.
+  returned: when state is not gathered
+  type: list
+  elements: dict
+after:
+  description: The state of the service resources after this run.
+  returned: when state is not gathered
+  type: list
+  elements: dict
+gathered:
+  description: The gathered service resource state (read-only).
+  returned: when state is gathered
+  type: list
+  elements: dict
+config:
+  description: The resulting configuration (alias for after or gathered).
+  returned: always
+  type: list
+  elements: dict
+"""
diff --git a/plugins/modules/team.py b/plugins/modules/team.py
deleted file mode 100644
index aa65d8c5..00000000
--- a/plugins/modules/team.py
+++ /dev/null
@@ -1,96 +0,0 @@
-#!/usr/bin/python
-# coding: utf-8 -*-
-# (c) 2025, Ansible Platform Collection Contributors
-# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
-"""
-Auto-generated by tools/generate_resource.py — review before committing.
-"""
-
-from __future__ import absolute_import, division, print_function
-
-__metaclass__ = type
-
-DOCUMENTATION = """
----
-module: team
-short_description: Manage gateway team resources.
-author: Red Hat (@RedHatOfficial)
-description:
-    - Create, update, delete, or gather automation platform gateway team resources.
-    - Follows the Ansible resource module pattern with before/after state tracking.
-options:
-    config:
-      description:
-        - A list of team resource configurations.
-        - Each entry represents a desired team state.
-      type: list
-      elements: dict
-      suboptions:
-        name:
-          required: true
-          type: str
-          description: The name of this resource.
-        organization:
-          required: true
-          type: int
-          description: The organization of this team.
-        description:
-          type: str
-          description: The team description.
-        id:
-          type: str
-          description: The unique identifier of the resource. Used for update/delete operations.
-
-extends_documentation_fragment:
-  - ansible.platform.auth
-  - ansible.platform.state
-"""
-
-EXAMPLES = """
-- name: Create team resources (merged)
-  ansible.platform.team:
-    config:
-      - name: "my-team"
-    state: merged
-
-- name: Gather current team state
-  ansible.platform.team:
-    state: gathered
-  register: result
-
-- name: Delete specific team resources
-  ansible.platform.team:
-    config:
-      - name: "my-team"
-    state: deleted
-
-- name: Override — ensure only these team resources exist
-  ansible.platform.team:
-    config:
-      - name: "keep-this-team"
-    state: overridden
-...
-"""
-
-RETURN = """
-before:
-  description: The state of the team resources before this run.
-  returned: when state is not gathered
-  type: list
-  elements: dict
-after:
-  description: The state of the team resources after this run.
-  returned: when state is not gathered
-  type: list
-  elements: dict
-gathered:
-  description: The gathered team resource state (read-only).
-  returned: when state is gathered
-  type: list
-  elements: dict
-config:
-  description: The resulting configuration (alias for after or gathered).
-  returned: always
-  type: list
-  elements: dict
-"""
diff --git a/plugins/modules/teams.py b/plugins/modules/teams.py
new file mode 100644
index 00000000..2a77bfad
--- /dev/null
+++ b/plugins/modules/teams.py
@@ -0,0 +1,96 @@
+#!/usr/bin/python
+# coding: utf-8 -*-
+# (c) 2025, Ansible Platform Collection Contributors
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+"""
+Auto-generated by tools/generate_resource.py — review before committing.
+"""
+
+from __future__ import absolute_import, division, print_function
+
+__metaclass__ = type
+
+DOCUMENTATION = """
+---
+module: teams
+short_description: Manage gateway team resources.
+author: Red Hat (@RedHatOfficial)
+description:
+    - Create, update, delete, or gather automation platform gateway team resources.
+    - Follows the Ansible resource module pattern with before/after state tracking.
+options:
+    config:
+      description:
+        - A list of team resource configurations.
+        - Each entry represents a desired team state.
+      type: list
+      elements: dict
+      suboptions:
+        name:
+          required: true
+          type: str
+          description: The name of this resource.
+        organization:
+          required: true
+          type: int
+          description: The organization of this team.
+        description:
+          type: str
+          description: The team description.
+        id:
+          type: str
+          description: The unique identifier of the resource. Used for update/delete operations.
+
+extends_documentation_fragment:
+  - ansible.platform.auth
+  - ansible.platform.state
+"""
+
+EXAMPLES = """
+- name: Create team resources (merged)
+  ansible.platform.teams:
+    config:
+      - name: "my-team"
+    state: merged
+
+- name: Gather current team state
+  ansible.platform.teams:
+    state: gathered
+  register: result
+
+- name: Delete specific team resources
+  ansible.platform.teams:
+    config:
+      - name: "my-team"
+    state: deleted
+
+- name: Override — ensure only these team resources exist
+  ansible.platform.teams:
+    config:
+      - name: "keep-this-team"
+    state: overridden
+...
+"""
+
+RETURN = """
+before:
+  description: The state of the team resources before this run.
+  returned: when state is not gathered
+  type: list
+  elements: dict
+after:
+  description: The state of the team resources after this run.
+  returned: when state is not gathered
+  type: list
+  elements: dict
+gathered:
+  description: The gathered team resource state (read-only).
+  returned: when state is gathered
+  type: list
+  elements: dict
+config:
+  description: The resulting configuration (alias for after or gathered).
+  returned: always
+  type: list
+  elements: dict
+"""
diff --git a/plugins/modules/token.py b/plugins/modules/token.py
deleted file mode 100644
index 6217b1f8..00000000
--- a/plugins/modules/token.py
+++ /dev/null
@@ -1,94 +0,0 @@
-#!/usr/bin/python
-# coding: utf-8 -*-
-# (c) 2025, Ansible Platform Collection Contributors
-# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
-"""
-Auto-generated by tools/generate_resource.py — review before committing.
-"""
-
-from __future__ import absolute_import, division, print_function
-
-__metaclass__ = type
-
-DOCUMENTATION = """
----
-module: token
-short_description: Manage gateway token resources.
-author: Red Hat (@RedHatOfficial)
-description:
-    - Create, update, delete, or gather automation platform gateway token resources.
-    - Follows the Ansible resource module pattern with before/after state tracking.
-options:
-    config:
-      description:
-        - A list of token resource configurations.
-        - Each entry represents a desired token state.
-      type: list
-      elements: dict
-      suboptions:
-        application:
-          type: int
-          description: The related application. If None, this is a user token instead of an application token.
-        description:
-          type: str
-          description: A description for this token.
-        scope:
-          type: str
-          description: Allowed scopes, further restricts user permissions. Must be a simple space-separated string with allowed scopes ['read', 'write'].
-        id:
-          type: str
-          description: The unique identifier of the resource. Used for update/delete operations.
-
-extends_documentation_fragment:
-  - ansible.platform.auth
-  - ansible.platform.state
-"""
-
-EXAMPLES = """
-- name: Create token resources (merged)
-  ansible.platform.token:
-    config:
-      - name: "my-token"
-    state: merged
-
-- name: Gather current token state
-  ansible.platform.token:
-    state: gathered
-  register: result
-
-- name: Delete specific token resources
-  ansible.platform.token:
-    config:
-      - name: "my-token"
-    state: deleted
-
-- name: Override — ensure only these token resources exist
-  ansible.platform.token:
-    config:
-      - name: "keep-this-token"
-    state: overridden
-...
-"""
-
-RETURN = """
-before:
-  description: The state of the token resources before this run.
-  returned: when state is not gathered
-  type: list
-  elements: dict
-after:
-  description: The state of the token resources after this run.
-  returned: when state is not gathered
-  type: list
-  elements: dict
-gathered:
-  description: The gathered token resource state (read-only).
-  returned: when state is gathered
-  type: list
-  elements: dict
-config:
-  description: The resulting configuration (alias for after or gathered).
-  returned: always
-  type: list
-  elements: dict
-"""
diff --git a/plugins/modules/tokens.py b/plugins/modules/tokens.py
new file mode 100644
index 00000000..e4480433
--- /dev/null
+++ b/plugins/modules/tokens.py
@@ -0,0 +1,94 @@
+#!/usr/bin/python
+# coding: utf-8 -*-
+# (c) 2025, Ansible Platform Collection Contributors
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+"""
+Auto-generated by tools/generate_resource.py — review before committing.
+"""
+
+from __future__ import absolute_import, division, print_function
+
+__metaclass__ = type
+
+DOCUMENTATION = """
+---
+module: tokens
+short_description: Manage gateway token resources.
+author: Red Hat (@RedHatOfficial)
+description:
+    - Create, update, delete, or gather automation platform gateway token resources.
+    - Follows the Ansible resource module pattern with before/after state tracking.
+options:
+    config:
+      description:
+        - A list of token resource configurations.
+        - Each entry represents a desired token state.
+      type: list
+      elements: dict
+      suboptions:
+        application:
+          type: int
+          description: The related application. If None, this is a user token instead of an application token.
+        description:
+          type: str
+          description: A description for this token.
+        scope:
+          type: str
+          description: Allowed scopes, further restricts user permissions. Must be a simple space-separated string with allowed scopes ['read', 'write'].
+        id:
+          type: str
+          description: The unique identifier of the resource. Used for update/delete operations.
+
+extends_documentation_fragment:
+  - ansible.platform.auth
+  - ansible.platform.state
+"""
+
+EXAMPLES = """
+- name: Create token resources (merged)
+  ansible.platform.tokens:
+    config:
+      - name: "my-token"
+    state: merged
+
+- name: Gather current token state
+  ansible.platform.tokens:
+    state: gathered
+  register: result
+
+- name: Delete specific token resources
+  ansible.platform.tokens:
+    config:
+      - name: "my-token"
+    state: deleted
+
+- name: Override — ensure only these token resources exist
+  ansible.platform.tokens:
+    config:
+      - name: "keep-this-token"
+    state: overridden
+...
+"""
+
+RETURN = """
+before:
+  description: The state of the token resources before this run.
+  returned: when state is not gathered
+  type: list
+  elements: dict
+after:
+  description: The state of the token resources after this run.
+  returned: when state is not gathered
+  type: list
+  elements: dict
+gathered:
+  description: The gathered token resource state (read-only).
+  returned: when state is gathered
+  type: list
+  elements: dict
+config:
+  description: The resulting configuration (alias for after or gathered).
+  returned: always
+  type: list
+  elements: dict
+"""
diff --git a/plugins/modules/ui_plugin_route.py b/plugins/modules/ui_plugin_route.py
deleted file mode 100644
index a15e2102..00000000
--- a/plugins/modules/ui_plugin_route.py
+++ /dev/null
@@ -1,118 +0,0 @@
-#!/usr/bin/python
-# coding: utf-8 -*-
-# (c) 2025, Ansible Platform Collection Contributors
-# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
-"""
-Auto-generated by tools/generate_resource.py — review before committing.
-"""
-
-from __future__ import absolute_import, division, print_function
-
-__metaclass__ = type
-
-DOCUMENTATION = """
----
-module: ui_plugin_route
-short_description: Manage gateway ui_plugin_route resources.
-author: Red Hat (@RedHatOfficial)
-description:
-    - Create, update, delete, or gather automation platform gateway ui_plugin_route resources.
-    - Follows the Ansible resource module pattern with before/after state tracking.
-options:
-    config:
-      description:
-        - A list of ui_plugin_route resource configurations.
-        - Each entry represents a desired ui_plugin_route state.
-      type: list
-      elements: dict
-      suboptions:
-        name:
-          required: true
-          type: str
-          description: The name of this resource.
-        http_port:
-          required: true
-          type: int
-          description: The port on the AAP gateway to listen to traffic on.
-        service_cluster:
-          required: true
-          type: int
-          description: The service_cluster of the UiPluginRoute.
-        service_port:
-          required: true
-          type: int
-          description: The port on the service cluster to route traffic to.
-        is_service_https:
-          required: true
-          type: bool
-          description: Set this to true if the service cluster requires HTTPS.
-        ui_plugin_path:
-          required: true
-          type: str
-          description: The relative path to the UI plugin on the service cluster.
-        description:
-          type: str
-          description: A description of this route.
-        order:
-          type: int
-          description: The order to apply the routes in; lower numbers are first. Items with the same value have no guaranteed order
-        node_tags:
-          type: str
-          description: A comma-separated list of nodes in the service cluster to receive traffic from this route.  Leave blank to select all nodes.
-        id:
-          type: str
-          description: The unique identifier of the resource. Used for update/delete operations.
-
-extends_documentation_fragment:
-  - ansible.platform.auth
-  - ansible.platform.state
-"""
-
-EXAMPLES = """
-- name: Create ui_plugin_route resources (merged)
-  ansible.platform.ui_plugin_route:
-    config:
-      - name: "my-ui_plugin_route"
-    state: merged
-
-- name: Gather current ui_plugin_route state
-  ansible.platform.ui_plugin_route:
-    state: gathered
-  register: result
-
-- name: Delete specific ui_plugin_route resources
-  ansible.platform.ui_plugin_route:
-    config:
-      - name: "my-ui_plugin_route"
-    state: deleted
-
-- name: Override — ensure only these ui_plugin_route resources exist
-  ansible.platform.ui_plugin_route:
-    config:
-      - name: "keep-this-ui_plugin_route"
-    state: overridden
-...
-"""
-
-RETURN = """
-before:
-  description: The state of the ui_plugin_route resources before this run.
-  returned: when state is not gathered
-  type: list
-  elements: dict
-after:
-  description: The state of the ui_plugin_route resources after this run.
-  returned: when state is not gathered
-  type: list
-  elements: dict
-gathered:
-  description: The gathered ui_plugin_route resource state (read-only).
-  returned: when state is gathered
-  type: list
-  elements: dict
-config:
-  description: The resulting configuration (alias for after or gathered).
-  returned: always
-  type: list
-  elements: dict
-"""
diff --git a/plugins/modules/ui_plugin_routes.py b/plugins/modules/ui_plugin_routes.py
new file mode 100644
index 00000000..3ed9e376
--- /dev/null
+++ b/plugins/modules/ui_plugin_routes.py
@@ -0,0 +1,118 @@
+#!/usr/bin/python
+# coding: utf-8 -*-
+# (c) 2025, Ansible Platform Collection Contributors
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+"""
+Auto-generated by tools/generate_resource.py — review before committing.
+"""
+
+from __future__ import absolute_import, division, print_function
+
+__metaclass__ = type
+
+DOCUMENTATION = """
+---
+module: ui_plugin_routes
+short_description: Manage gateway ui_plugin_route resources.
+author: Red Hat (@RedHatOfficial)
+description:
+    - Create, update, delete, or gather automation platform gateway ui_plugin_route resources.
+    - Follows the Ansible resource module pattern with before/after state tracking.
+options:
+    config:
+      description:
+        - A list of ui_plugin_route resource configurations.
+        - Each entry represents a desired ui_plugin_route state.
+      type: list
+      elements: dict
+      suboptions:
+        name:
+          required: true
+          type: str
+          description: The name of this resource.
+        http_port:
+          required: true
+          type: int
+          description: The port on the AAP gateway to listen to traffic on.
+        service_cluster:
+          required: true
+          type: int
+          description: The service_cluster of the UiPluginRoute.
+        service_port:
+          required: true
+          type: int
+          description: The port on the service cluster to route traffic to.
+        is_service_https:
+          required: true
+          type: bool
+          description: Set this to true if the service cluster requires HTTPS.
+        ui_plugin_path:
+          required: true
+          type: str
+          description: The relative path to the UI plugin on the service cluster.
+        description:
+          type: str
+          description: A description of this route.
+        order:
+          type: int
+          description: The order to apply the routes in; lower numbers are first. Items with the same value have no guaranteed order
+        node_tags:
+          type: str
+          description: A comma-separated list of nodes in the service cluster to receive traffic from this route.  Leave blank to select all nodes.
+        id:
+          type: str
+          description: The unique identifier of the resource. Used for update/delete operations.
+
+extends_documentation_fragment:
+  - ansible.platform.auth
+  - ansible.platform.state
+"""
+
+EXAMPLES = """
+- name: Create ui_plugin_route resources (merged)
+  ansible.platform.ui_plugin_routes:
+    config:
+      - name: "my-ui_plugin_route"
+    state: merged
+
+- name: Gather current ui_plugin_route state
+  ansible.platform.ui_plugin_routes:
+    state: gathered
+  register: result
+
+- name: Delete specific ui_plugin_route resources
+  ansible.platform.ui_plugin_routes:
+    config:
+      - name: "my-ui_plugin_route"
+    state: deleted
+
+- name: Override — ensure only these ui_plugin_route resources exist
+  ansible.platform.ui_plugin_routes:
+    config:
+      - name: "keep-this-ui_plugin_route"
+    state: overridden
+...
+"""
+
+RETURN = """
+before:
+  description: The state of the ui_plugin_route resources before this run.
+  returned: when state is not gathered
+  type: list
+  elements: dict
+after:
+  description: The state of the ui_plugin_route resources after this run.
+  returned: when state is not gathered
+  type: list
+  elements: dict
+gathered:
+  description: The gathered ui_plugin_route resource state (read-only).
+  returned: when state is gathered
+  type: list
+  elements: dict
+config:
+  description: The resulting configuration (alias for after or gathered).
+  returned: always
+  type: list
+  elements: dict
+"""
diff --git a/plugins/modules/user.py b/plugins/modules/user.py
deleted file mode 100644
index 2d701120..00000000
--- a/plugins/modules/user.py
+++ /dev/null
@@ -1,113 +0,0 @@
-#!/usr/bin/python
-# coding: utf-8 -*-
-# (c) 2025, Ansible Platform Collection Contributors
-# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
-"""
-Auto-generated by tools/generate_resource.py — review before committing.
-"""
-
-from __future__ import absolute_import, division, print_function
-
-__metaclass__ = type
-
-DOCUMENTATION = """
----
-module: user
-short_description: Manage gateway user resources.
-author: Red Hat (@RedHatOfficial)
-description:
-    - Create, update, delete, or gather automation platform gateway user resources.
-    - Follows the Ansible resource module pattern with before/after state tracking.
-options:
-    config:
-      description:
-        - A list of user resource configurations.
-        - Each entry represents a desired user state.
-      type: list
-      elements: dict
-      suboptions:
-        username:
-          required: true
-          type: str
-          description: Required. 150 characters or fewer. Letters, digits and @/./+/-/_ only.
-        email:
-          type: str
-          description: The email of the User.
-        first_name:
-          type: str
-          description: The first_name of the User.
-        last_name:
-          type: str
-          description: The last_name of the User.
-        password:
-          type: str
-          description: The password of the User.
-        is_superuser:
-          type: bool
-          description: Designates that this user has all permissions without explicitly assigning them.
-        authenticators:
-          type: str
-          description: "DEPRECATED: This field is deprecated and will be removed in a future version. Please use 'associated_authenticators' instead."
-        authenticator_uid:
-          type: str
-          description: "DEPRECATED: This field is deprecated and will be removed in a future version. Please use 'associated_authenticators' instead."
-        associated_authenticators:
-          type: str
-          description: The associated_authenticators of the User.
-        id:
-          type: str
-          description: The unique identifier of the resource. Used for update/delete operations.
-
-extends_documentation_fragment:
-  - ansible.platform.auth
-  - ansible.platform.state
-"""
-
-EXAMPLES = """
-- name: Create user resources (merged)
-  ansible.platform.user:
-    config:
-      - username: "my-user"
-    state: merged
-
-- name: Gather current user state
-  ansible.platform.user:
-    state: gathered
-  register: result
-
-- name: Delete specific user resources
-  ansible.platform.user:
-    config:
-      - username: "my-user"
-    state: deleted
-
-- name: Override — ensure only these user resources exist
-  ansible.platform.user:
-    config:
-      - username: "keep-this-user"
-    state: overridden
-...
-"""
-
-RETURN = """
-before:
-  description: The state of the user resources before this run.
-  returned: when state is not gathered
-  type: list
-  elements: dict
-after:
-  description: The state of the user resources after this run.
-  returned: when state is not gathered
-  type: list
-  elements: dict
-gathered:
-  description: The gathered user resource state (read-only).
-  returned: when state is gathered
-  type: list
-  elements: dict
-config:
-  description: The resulting configuration (alias for after or gathered).
-  returned: always
-  type: list
-  elements: dict
-"""
diff --git a/plugins/modules/users.py b/plugins/modules/users.py
new file mode 100644
index 00000000..8631dc08
--- /dev/null
+++ b/plugins/modules/users.py
@@ -0,0 +1,113 @@
+#!/usr/bin/python
+# coding: utf-8 -*-
+# (c) 2025, Ansible Platform Collection Contributors
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+"""
+Auto-generated by tools/generate_resource.py — review before committing.
+"""
+
+from __future__ import absolute_import, division, print_function
+
+__metaclass__ = type
+
+DOCUMENTATION = """
+---
+module: users
+short_description: Manage gateway user resources.
+author: Red Hat (@RedHatOfficial)
+description:
+    - Create, update, delete, or gather automation platform gateway user resources.
+    - Follows the Ansible resource module pattern with before/after state tracking.
+options:
+    config:
+      description:
+        - A list of user resource configurations.
+        - Each entry represents a desired user state.
+      type: list
+      elements: dict
+      suboptions:
+        username:
+          required: true
+          type: str
+          description: Required. 150 characters or fewer. Letters, digits and @/./+/-/_ only.
+        email:
+          type: str
+          description: The email of the User.
+        first_name:
+          type: str
+          description: The first_name of the User.
+        last_name:
+          type: str
+          description: The last_name of the User.
+        password:
+          type: str
+          description: The password of the User.
+        is_superuser:
+          type: bool
+          description: Designates that this user has all permissions without explicitly assigning them.
+        authenticators:
+          type: str
+          description: "DEPRECATED: This field is deprecated and will be removed in a future version. Please use 'associated_authenticators' instead."
+        authenticator_uid:
+          type: str
+          description: "DEPRECATED: This field is deprecated and will be removed in a future version. Please use 'associated_authenticators' instead."
+        associated_authenticators:
+          type: str
+          description: The associated_authenticators of the User.
+        id:
+          type: str
+          description: The unique identifier of the resource. Used for update/delete operations.
+
+extends_documentation_fragment:
+  - ansible.platform.auth
+  - ansible.platform.state
+"""
+
+EXAMPLES = """
+- name: Create user resources (merged)
+  ansible.platform.users:
+    config:
+      - username: "my-user"
+    state: merged
+
+- name: Gather current user state
+  ansible.platform.users:
+    state: gathered
+  register: result
+
+- name: Delete specific user resources
+  ansible.platform.users:
+    config:
+      - username: "my-user"
+    state: deleted
+
+- name: Override — ensure only these user resources exist
+  ansible.platform.users:
+    config:
+      - username: "keep-this-user"
+    state: overridden
+...
+"""
+
+RETURN = """
+before:
+  description: The state of the user resources before this run.
+  returned: when state is not gathered
+  type: list
+  elements: dict
+after:
+  description: The state of the user resources after this run.
+  returned: when state is not gathered
+  type: list
+  elements: dict
+gathered:
+  description: The gathered user resource state (read-only).
+  returned: when state is gathered
+  type: list
+  elements: dict
+config:
+  description: The resulting configuration (alias for after or gathered).
+  returned: always
+  type: list
+  elements: dict
+"""
diff --git a/plugins/plugin_utils/ansible_models/application.py b/plugins/plugin_utils/ansible_models/application.py
deleted file mode 100644
index 78751a90..00000000
--- a/plugins/plugin_utils/ansible_models/application.py
+++ /dev/null
@@ -1,46 +0,0 @@
-"""
-Ansible Application dataclass — user-facing stable interface.
-
-Auto-generated by tools/generate_resource.py from the Gateway OpenAPI spec.
-"""
-
-from dataclasses import dataclass
-from typing import Any, Dict, Optional
-
-from ..platform.base_transform import BaseTransformMixin
-
-
-@dataclass
-class AnsibleApplication(BaseTransformMixin):
-    """Ansible representation of a gateway application (resource module pattern)."""
-
-    # Resource metadata for the base action plugin
-    MODULE_NAME = "application"
-    CANONICAL_KEY = "name"
-    SYSTEM_KEY = "id"
-    SUPPORTS_DELETE = True
-    VALID_STATES = frozenset({"merged", "replaced", "overridden", "deleted", "gathered"})
-
-    name: Optional[str] = None
-    organization: Optional[int] = None
-    client_type: Optional[str] = None
-    authorization_grant_type: Optional[str] = None
-    redirect_uris: Optional[str] = None
-    post_logout_redirect_uris: Optional[str] = None
-    algorithm: Optional[str] = None
-    user: Optional[int] = None
-    description: Optional[str] = None
-    app_url: Optional[str] = None
-    skip_authorization: Optional[bool] = None
-
-    # Read-only fields (populated from API)
-    id: Optional[int] = None
-    url: Optional[str] = None
-    related: Optional[Dict[str, Any]] = None
-    summary_fields: Optional[Dict[str, Any]] = None
-    created: Optional[str] = None
-    created_by: Optional[int] = None
-    modified: Optional[str] = None
-    modified_by: Optional[int] = None
-    client_id: Optional[str] = None
-    client_secret: Optional[str] = None
diff --git a/plugins/plugin_utils/ansible_models/applications.py b/plugins/plugin_utils/ansible_models/applications.py
new file mode 100644
index 00000000..1b1fc795
--- /dev/null
+++ b/plugins/plugin_utils/ansible_models/applications.py
@@ -0,0 +1,46 @@
+"""
+Ansible Application dataclass — user-facing stable interface.
+
+Auto-generated by tools/generate_resource.py from the Gateway OpenAPI spec.
+"""
+
+from dataclasses import dataclass
+from typing import Any, Dict, Optional
+
+from ..platform.base_transform import BaseTransformMixin
+
+
+@dataclass
+class AnsibleApplications(BaseTransformMixin):
+    """Ansible representation of a gateway application (resource module pattern)."""
+
+    # Resource metadata for the base action plugin
+    MODULE_NAME = "application"
+    CANONICAL_KEY = "name"
+    SYSTEM_KEY = "id"
+    SUPPORTS_DELETE = True
+    VALID_STATES = frozenset({"merged", "replaced", "overridden", "deleted", "gathered"})
+
+    name: Optional[str] = None
+    organization: Optional[int] = None
+    client_type: Optional[str] = None
+    authorization_grant_type: Optional[str] = None
+    redirect_uris: Optional[str] = None
+    post_logout_redirect_uris: Optional[str] = None
+    algorithm: Optional[str] = None
+    user: Optional[int] = None
+    description: Optional[str] = None
+    app_url: Optional[str] = None
+    skip_authorization: Optional[bool] = None
+
+    # Read-only fields (populated from API)
+    id: Optional[int] = None
+    url: Optional[str] = None
+    related: Optional[Dict[str, Any]] = None
+    summary_fields: Optional[Dict[str, Any]] = None
+    created: Optional[str] = None
+    created_by: Optional[int] = None
+    modified: Optional[str] = None
+    modified_by: Optional[int] = None
+    client_id: Optional[str] = None
+    client_secret: Optional[str] = None
diff --git a/plugins/plugin_utils/ansible_models/authenticator.py b/plugins/plugin_utils/ansible_models/authenticator.py
deleted file mode 100644
index 6f0d2eac..00000000
--- a/plugins/plugin_utils/ansible_models/authenticator.py
+++ /dev/null
@@ -1,42 +0,0 @@
-"""
-Ansible Authenticator dataclass — user-facing stable interface.
-
-Auto-generated by tools/generate_resource.py from the Gateway OpenAPI spec.
-"""
-
-from dataclasses import dataclass
-from typing import Any, Dict, Optional
-
-from ..platform.base_transform import BaseTransformMixin
-
-
-@dataclass
-class AnsibleAuthenticator(BaseTransformMixin):
-    """Ansible representation of a gateway authenticator (resource module pattern)."""
-
-    # Resource metadata for the base action plugin
-    MODULE_NAME = "authenticator"
-    CANONICAL_KEY = "name"
-    SYSTEM_KEY = "id"
-    SUPPORTS_DELETE = True
-    VALID_STATES = frozenset({"merged", "replaced", "overridden", "deleted", "gathered"})
-
-    name: Optional[str] = None
-    configuration: Optional[Any] = None
-    type: Optional[str] = None
-    enabled: Optional[bool] = None
-    create_objects: Optional[bool] = None
-    remove_users: Optional[bool] = None
-    order: Optional[int] = None
-    slug: Optional[str] = None
-    auto_migrate_users_to: Optional[int] = None
-
-    # Read-only fields (populated from API)
-    id: Optional[int] = None
-    url: Optional[str] = None
-    related: Optional[Dict[str, Any]] = None
-    summary_fields: Optional[Dict[str, Any]] = None
-    created: Optional[str] = None
-    created_by: Optional[int] = None
-    modified: Optional[str] = None
-    modified_by: Optional[int] = None
diff --git a/plugins/plugin_utils/ansible_models/authenticator_map.py b/plugins/plugin_utils/ansible_models/authenticator_map.py
deleted file mode 100644
index 29a7cf0a..00000000
--- a/plugins/plugin_utils/ansible_models/authenticator_map.py
+++ /dev/null
@@ -1,42 +0,0 @@
-"""
-Ansible AuthenticatorMap dataclass — user-facing stable interface.
-
-Auto-generated by tools/generate_resource.py from the Gateway OpenAPI spec.
-"""
-
-from dataclasses import dataclass
-from typing import Any, Dict, Optional
-
-from ..platform.base_transform import BaseTransformMixin
-
-
-@dataclass
-class AnsibleAuthenticatorMap(BaseTransformMixin):
-    """Ansible representation of a gateway authenticator_map (resource module pattern)."""
-
-    # Resource metadata for the base action plugin
-    MODULE_NAME = "authenticator_map"
-    CANONICAL_KEY = "name"
-    SYSTEM_KEY = "id"
-    SUPPORTS_DELETE = True
-    VALID_STATES = frozenset({"merged", "replaced", "overridden", "deleted", "gathered"})
-
-    name: Optional[str] = None
-    authenticator: Optional[int] = None
-    triggers: Optional[Any] = None
-    map_type: Optional[str] = None
-    role: Optional[str] = None
-    organization: Optional[str] = None
-    team: Optional[str] = None
-    revoke: Optional[bool] = None
-    order: Optional[int] = None
-
-    # Read-only fields (populated from API)
-    id: Optional[int] = None
-    url: Optional[str] = None
-    related: Optional[Dict[str, Any]] = None
-    summary_fields: Optional[Dict[str, Any]] = None
-    created: Optional[str] = None
-    created_by: Optional[int] = None
-    modified: Optional[str] = None
-    modified_by: Optional[int] = None
diff --git a/plugins/plugin_utils/ansible_models/authenticator_maps.py b/plugins/plugin_utils/ansible_models/authenticator_maps.py
new file mode 100644
index 00000000..3c4159b8
--- /dev/null
+++ b/plugins/plugin_utils/ansible_models/authenticator_maps.py
@@ -0,0 +1,42 @@
+"""
+Ansible AuthenticatorMap dataclass — user-facing stable interface.
+
+Auto-generated by tools/generate_resource.py from the Gateway OpenAPI spec.
+"""
+
+from dataclasses import dataclass
+from typing import Any, Dict, Optional
+
+from ..platform.base_transform import BaseTransformMixin
+
+
+@dataclass
+class AnsibleAuthenticatorMaps(BaseTransformMixin):
+    """Ansible representation of a gateway authenticator_map (resource module pattern)."""
+
+    # Resource metadata for the base action plugin
+    MODULE_NAME = "authenticator_map"
+    CANONICAL_KEY = "name"
+    SYSTEM_KEY = "id"
+    SUPPORTS_DELETE = True
+    VALID_STATES = frozenset({"merged", "replaced", "overridden", "deleted", "gathered"})
+
+    name: Optional[str] = None
+    authenticator: Optional[int] = None
+    triggers: Optional[Any] = None
+    map_type: Optional[str] = None
+    role: Optional[str] = None
+    organization: Optional[str] = None
+    team: Optional[str] = None
+    revoke: Optional[bool] = None
+    order: Optional[int] = None
+
+    # Read-only fields (populated from API)
+    id: Optional[int] = None
+    url: Optional[str] = None
+    related: Optional[Dict[str, Any]] = None
+    summary_fields: Optional[Dict[str, Any]] = None
+    created: Optional[str] = None
+    created_by: Optional[int] = None
+    modified: Optional[str] = None
+    modified_by: Optional[int] = None
diff --git a/plugins/plugin_utils/ansible_models/authenticator_user.py b/plugins/plugin_utils/ansible_models/authenticator_user.py
deleted file mode 100644
index e592a5b7..00000000
--- a/plugins/plugin_utils/ansible_models/authenticator_user.py
+++ /dev/null
@@ -1,23 +0,0 @@
-"""
-Ansible AuthenticatorUser dataclass — user-facing stable interface.
-
-Auto-generated by tools/generate_resource.py from the Gateway OpenAPI spec.
-"""
-
-from dataclasses import dataclass
-
-from ..platform.base_transform import BaseTransformMixin
-
-
-@dataclass
-class AnsibleAuthenticatorUser(BaseTransformMixin):
-    """Ansible representation of a gateway authenticator_user (resource module pattern)."""
-
-    # Resource metadata for the base action plugin
-    MODULE_NAME = "authenticator_user"
-    CANONICAL_KEY = "name"
-    SYSTEM_KEY = "id"
-    SUPPORTS_DELETE = False
-    VALID_STATES = frozenset({"merged", "replaced", "overridden", "deleted", "gathered"})
-
-    # Read-only fields (populated from API)
diff --git a/plugins/plugin_utils/ansible_models/authenticator_users.py b/plugins/plugin_utils/ansible_models/authenticator_users.py
new file mode 100644
index 00000000..e32f9a86
--- /dev/null
+++ b/plugins/plugin_utils/ansible_models/authenticator_users.py
@@ -0,0 +1,23 @@
+"""
+Ansible AuthenticatorUser dataclass — user-facing stable interface.
+
+Auto-generated by tools/generate_resource.py from the Gateway OpenAPI spec.
+"""
+
+from dataclasses import dataclass
+
+from ..platform.base_transform import BaseTransformMixin
+
+
+@dataclass
+class AnsibleAuthenticatorUsers(BaseTransformMixin):
+    """Ansible representation of a gateway authenticator_user (resource module pattern)."""
+
+    # Resource metadata for the base action plugin
+    MODULE_NAME = "authenticator_user"
+    CANONICAL_KEY = "name"
+    SYSTEM_KEY = "id"
+    SUPPORTS_DELETE = False
+    VALID_STATES = frozenset({"merged", "replaced", "overridden", "deleted", "gathered"})
+
+    # Read-only fields (populated from API)
diff --git a/plugins/plugin_utils/ansible_models/authenticators.py b/plugins/plugin_utils/ansible_models/authenticators.py
new file mode 100644
index 00000000..7c862cb1
--- /dev/null
+++ b/plugins/plugin_utils/ansible_models/authenticators.py
@@ -0,0 +1,42 @@
+"""
+Ansible Authenticator dataclass — user-facing stable interface.
+
+Auto-generated by tools/generate_resource.py from the Gateway OpenAPI spec.
+"""
+
+from dataclasses import dataclass
+from typing import Any, Dict, Optional
+
+from ..platform.base_transform import BaseTransformMixin
+
+
+@dataclass
+class AnsibleAuthenticators(BaseTransformMixin):
+    """Ansible representation of a gateway authenticator (resource module pattern)."""
+
+    # Resource metadata for the base action plugin
+    MODULE_NAME = "authenticator"
+    CANONICAL_KEY = "name"
+    SYSTEM_KEY = "id"
+    SUPPORTS_DELETE = True
+    VALID_STATES = frozenset({"merged", "replaced", "overridden", "deleted", "gathered"})
+
+    name: Optional[str] = None
+    configuration: Optional[Any] = None
+    type: Optional[str] = None
+    enabled: Optional[bool] = None
+    create_objects: Optional[bool] = None
+    remove_users: Optional[bool] = None
+    order: Optional[int] = None
+    slug: Optional[str] = None
+    auto_migrate_users_to: Optional[int] = None
+
+    # Read-only fields (populated from API)
+    id: Optional[int] = None
+    url: Optional[str] = None
+    related: Optional[Dict[str, Any]] = None
+    summary_fields: Optional[Dict[str, Any]] = None
+    created: Optional[str] = None
+    created_by: Optional[int] = None
+    modified: Optional[str] = None
+    modified_by: Optional[int] = None
diff --git a/plugins/plugin_utils/ansible_models/ca_certificate.py b/plugins/plugin_utils/ansible_models/ca_certificate.py
deleted file mode 100644
index 404bea83..00000000
--- a/plugins/plugin_utils/ansible_models/ca_certificate.py
+++ /dev/null
@@ -1,37 +0,0 @@
-"""
-Ansible CaCertificate dataclass — user-facing stable interface.
-
-Auto-generated by tools/generate_resource.py from the Gateway OpenAPI spec.
-"""
-
-from dataclasses import dataclass
-from typing import Any, Dict, Optional
-
-from ..platform.base_transform import BaseTransformMixin
-
-
-@dataclass
-class AnsibleCaCertificate(BaseTransformMixin):
-    """Ansible representation of a gateway ca_certificate (resource module pattern)."""
-
-    # Resource metadata for the base action plugin
-    MODULE_NAME = "ca_certificate"
-    CANONICAL_KEY = "name"
-    SYSTEM_KEY = "id"
-    SUPPORTS_DELETE = True
-    VALID_STATES = frozenset({"merged", "replaced", "overridden", "deleted", "gathered"})
-
-    name: Optional[str] = None
-    pem_data: Optional[str] = None
-    sha256: Optional[str] = None
-    related_id_reference: Optional[str] = None
-
-    # Read-only fields (populated from API)
-    id: Optional[int] = None
-    url: Optional[str] = None
-    related: Optional[Dict[str, Any]] = None
-    summary_fields: Optional[Dict[str, Any]] = None
-    created: Optional[str] = None
-    created_by: Optional[int] = None
-    modified: Optional[str] = None
-    modified_by: Optional[int] = None
diff --git a/plugins/plugin_utils/ansible_models/ca_certificates.py b/plugins/plugin_utils/ansible_models/ca_certificates.py
new file mode 100644
index 00000000..e593d545
--- /dev/null
+++ b/plugins/plugin_utils/ansible_models/ca_certificates.py
@@ -0,0 +1,37 @@
+"""
+Ansible CaCertificate dataclass — user-facing stable interface.
+
+Auto-generated by tools/generate_resource.py from the Gateway OpenAPI spec.
+"""
+
+from dataclasses import dataclass
+from typing import Any, Dict, Optional
+
+from ..platform.base_transform import BaseTransformMixin
+
+
+@dataclass
+class AnsibleCaCertificates(BaseTransformMixin):
+    """Ansible representation of a gateway ca_certificate (resource module pattern)."""
+
+    # Resource metadata for the base action plugin
+    MODULE_NAME = "ca_certificate"
+    CANONICAL_KEY = "name"
+    SYSTEM_KEY = "id"
+    SUPPORTS_DELETE = True
+    VALID_STATES = frozenset({"merged", "replaced", "overridden", "deleted", "gathered"})
+
+    name: Optional[str] = None
+    pem_data: Optional[str] = None
+    sha256: Optional[str] = None
+    related_id_reference: Optional[str] = None
+
+    # Read-only fields (populated from API)
+    id: Optional[int] = None
+    url: Optional[str] = None
+    related: Optional[Dict[str, Any]] = None
+    summary_fields: Optional[Dict[str, Any]] = None
+    created: Optional[str] = None
+    created_by: Optional[int] = None
+    modified: Optional[str] = None
+    modified_by: Optional[int] = None
diff --git a/plugins/plugin_utils/ansible_models/feature_flag.py b/plugins/plugin_utils/ansible_models/feature_flag.py
deleted file mode 100644
index e2fb6738..00000000
--- a/plugins/plugin_utils/ansible_models/feature_flag.py
+++ /dev/null
@@ -1,35 +0,0 @@
-"""
-Ansible FeatureFlag dataclass — user-facing stable interface.
-
-Auto-generated by tools/generate_resource.py from the Gateway OpenAPI spec.
-"""
-
-from dataclasses import dataclass
-from typing import Any, List, Optional
-
-from ..platform.base_transform import BaseTransformMixin
-
-
-@dataclass
-class AnsibleFeatureFlag(BaseTransformMixin):
-    """Ansible representation of a gateway feature_flag (resource module pattern)."""
-
-    # Resource metadata for the base action plugin
-    MODULE_NAME = "feature_flag"
-    CANONICAL_KEY = "name"
-    SYSTEM_KEY = "id"
-    SUPPORTS_DELETE = False
-    VALID_STATES = frozenset({"merged", "replaced", "overridden", "deleted", "gathered"})
-
-    name: Optional[str] = None
-    value: Optional[str] = None
-
-    # Read-only fields (populated from API)
-    id: Optional[int] = None
-    toggle_type: Optional[str] = None
-    condition: Optional[str] = None
-    description: Optional[str] = None
-    required: Optional[bool] = None
-    support_level: Optional[str] = None
-    visibility: Optional[bool] = None
-    labels: Optional[List[Any]] = None
diff --git a/plugins/plugin_utils/ansible_models/feature_flags.py b/plugins/plugin_utils/ansible_models/feature_flags.py
new file mode 100644
index 00000000..b92c6ad1
--- /dev/null
+++ b/plugins/plugin_utils/ansible_models/feature_flags.py
@@ -0,0 +1,35 @@
+"""
+Ansible FeatureFlag dataclass — user-facing stable interface.
+
+Auto-generated by tools/generate_resource.py from the Gateway OpenAPI spec.
+"""
+
+from dataclasses import dataclass
+from typing import Any, List, Optional
+
+from ..platform.base_transform import BaseTransformMixin
+
+
+@dataclass
+class AnsibleFeatureFlags(BaseTransformMixin):
+    """Ansible representation of a gateway feature_flag (resource module pattern)."""
+
+    # Resource metadata for the base action plugin
+    MODULE_NAME = "feature_flag"
+    CANONICAL_KEY = "name"
+    SYSTEM_KEY = "id"
+    SUPPORTS_DELETE = False
+    VALID_STATES = frozenset({"merged", "replaced", "overridden", "deleted", "gathered"})
+
+    name: Optional[str] = None
+    value: Optional[str] = None
+
+    # Read-only fields (populated from API)
+    id: Optional[int] = None
+    toggle_type: Optional[str] = None
+    condition: Optional[str] = None
+    description: Optional[str] = None
+    required: Optional[bool] = None
+    support_level: Optional[str] = None
+    visibility: Optional[bool] = None
+    labels: Optional[List[Any]] = None
diff --git a/plugins/plugin_utils/ansible_models/http_port.py b/plugins/plugin_utils/ansible_models/http_port.py
deleted file mode 100644
index d6f6f596..00000000
--- a/plugins/plugin_utils/ansible_models/http_port.py
+++ /dev/null
@@ -1,37 +0,0 @@
-"""
-Ansible HttpPort dataclass — user-facing stable interface.
-
-Auto-generated by tools/generate_resource.py from the Gateway OpenAPI spec.
-"""
-
-from dataclasses import dataclass
-from typing import Any, Dict, Optional
-
-from ..platform.base_transform import BaseTransformMixin
-
-
-@dataclass
-class AnsibleHttpPort(BaseTransformMixin):
-    """Ansible representation of a gateway http_port (resource module pattern)."""
-
-    # Resource metadata for the base action plugin
-    MODULE_NAME = "http_port"
-    CANONICAL_KEY = "name"
-    SYSTEM_KEY = "id"
-    SUPPORTS_DELETE = True
-    VALID_STATES = frozenset({"merged", "replaced", "overridden", "deleted", "gathered"})
-
-    name: Optional[str] = None
-    number: Optional[int] = None
-    use_https: Optional[bool] = None
-    is_api_port: Optional[bool] = None
-
-    # Read-only fields (populated from API)
-    id: Optional[int] = None
-    url: Optional[str] = None
-    related: Optional[Dict[str, Any]] = None
-    summary_fields: Optional[Dict[str, Any]] = None
-    created: Optional[str] = None
-    created_by: Optional[int] = None
-    modified: Optional[str] = None
-    modified_by: Optional[int] = None
diff --git a/plugins/plugin_utils/ansible_models/http_ports.py b/plugins/plugin_utils/ansible_models/http_ports.py
new file mode 100644
index 00000000..a21775f0
--- /dev/null
+++ b/plugins/plugin_utils/ansible_models/http_ports.py
@@ -0,0 +1,37 @@
+"""
+Ansible HttpPort dataclass — user-facing stable interface.
+
+Auto-generated by tools/generate_resource.py from the Gateway OpenAPI spec.
+"""
+
+from dataclasses import dataclass
+from typing import Any, Dict, Optional
+
+from ..platform.base_transform import BaseTransformMixin
+
+
+@dataclass
+class AnsibleHttpPorts(BaseTransformMixin):
+    """Ansible representation of a gateway http_port (resource module pattern)."""
+
+    # Resource metadata for the base action plugin
+    MODULE_NAME = "http_port"
+    CANONICAL_KEY = "name"
+    SYSTEM_KEY = "id"
+    SUPPORTS_DELETE = True
+    VALID_STATES = frozenset({"merged", "replaced", "overridden", "deleted", "gathered"})
+
+    name: Optional[str] = None
+    number: Optional[int] = None
+    use_https: Optional[bool] = None
+    is_api_port: Optional[bool] = None
+
+    # Read-only fields (populated from API)
+    id: Optional[int] = None
+    url: Optional[str] = None
+    related: Optional[Dict[str, Any]] = None
+    summary_fields: Optional[Dict[str, Any]] = None
+    created: Optional[str] = None
+    created_by: Optional[int] = None
+    modified: Optional[str] = None
+    modified_by: Optional[int] = None
diff --git a/plugins/plugin_utils/ansible_models/organization.py b/plugins/plugin_utils/ansible_models/organization.py
deleted file mode 100644
index c9504915..00000000
--- a/plugins/plugin_utils/ansible_models/organization.py
+++ /dev/null
@@ -1,36 +0,0 @@
-"""
-Ansible Organization dataclass — user-facing stable interface.
-
-Auto-generated by tools/generate_resource.py from the Gateway OpenAPI spec.
-"""
-
-from dataclasses import dataclass
-from typing import Any, Dict, Optional
-
-from ..platform.base_transform import BaseTransformMixin
-
-
-@dataclass
-class AnsibleOrganization(BaseTransformMixin):
-    """Ansible representation of a gateway organization (resource module pattern)."""
-
-    # Resource metadata for the base action plugin
-    MODULE_NAME = "organization"
-    CANONICAL_KEY = "name"
-    SYSTEM_KEY = "id"
-    SUPPORTS_DELETE = True
-    VALID_STATES = frozenset({"merged", "replaced", "overridden", "deleted", "gathered"})
-
-    name: Optional[str] = None
-    description: Optional[str] = None
-
-    # Read-only fields (populated from API)
-    id: Optional[int] = None
-    url: Optional[str] = None
-    related: Optional[Dict[str, Any]] = None
-    summary_fields: Optional[Dict[str, Any]] = None
-    created: Optional[str] = None
-    created_by: Optional[int] = None
-    modified: Optional[str] = None
-    modified_by: Optional[int] = None
-    managed: Optional[bool] = None
diff --git a/plugins/plugin_utils/ansible_models/organizations.py b/plugins/plugin_utils/ansible_models/organizations.py
new file mode 100644
index 00000000..f27509e6
--- /dev/null
+++ b/plugins/plugin_utils/ansible_models/organizations.py
@@ -0,0 +1,36 @@
+"""
+Ansible Organization dataclass — user-facing stable interface.
+
+Auto-generated by tools/generate_resource.py from the Gateway OpenAPI spec.
+"""
+
+from dataclasses import dataclass
+from typing import Any, Dict, Optional
+
+from ..platform.base_transform import BaseTransformMixin
+
+
+@dataclass
+class AnsibleOrganizations(BaseTransformMixin):
+    """Ansible representation of a gateway organization (resource module pattern)."""
+
+    # Resource metadata for the base action plugin
+    MODULE_NAME = "organization"
+    CANONICAL_KEY = "name"
+    SYSTEM_KEY = "id"
+    SUPPORTS_DELETE = True
+    VALID_STATES = frozenset({"merged", "replaced", "overridden", "deleted", "gathered"})
+
+    name: Optional[str] = None
+    description: Optional[str] = None
+
+    # Read-only fields (populated from API)
+    id: Optional[int] = None
+    url: Optional[str] = None
+    related: Optional[Dict[str, Any]] = None
+    summary_fields: Optional[Dict[str, Any]] = None
+    created: Optional[str] = None
+    created_by: Optional[int] = None
+    modified: Optional[str] = None
+    modified_by: Optional[int] = None
+    managed: Optional[bool] = None
diff --git a/plugins/plugin_utils/ansible_models/role_definition.py b/plugins/plugin_utils/ansible_models/role_definition.py
deleted file mode 100644
index 2b6d67d6..00000000
--- a/plugins/plugin_utils/ansible_models/role_definition.py
+++ /dev/null
@@ -1,38 +0,0 @@
-"""
-Ansible RoleDefinition dataclass — user-facing stable interface.
-
-Auto-generated by tools/generate_resource.py from the Gateway OpenAPI spec.
-"""
-
-from dataclasses import dataclass
-from typing import Any, Dict, List, Optional
-
-from ..platform.base_transform import BaseTransformMixin
-
-
-@dataclass
-class AnsibleRoleDefinition(BaseTransformMixin):
-    """Ansible representation of a gateway role_definition (resource module pattern)."""
-
-    # Resource metadata for the base action plugin
-    MODULE_NAME = "role_definition"
-    CANONICAL_KEY = "name"
-    SYSTEM_KEY = "id"
-    SUPPORTS_DELETE = True
-    VALID_STATES = frozenset({"merged", "replaced", "overridden", "deleted", "gathered"})
-
-    permissions: Optional[List[Any]] = None
-    name: Optional[str] = None
-    content_type: Optional[str] = None
-    description: Optional[str] = None
-
-    # Read-only fields (populated from API)
-    id: Optional[int] = None
-    url: Optional[str] = None
-    related: Optional[Dict[str, Any]] = None
-    summary_fields: Optional[Dict[str, Any]] = None
-    modified: Optional[str] = None
-    created: Optional[str] = None
-    managed: Optional[bool] = None
-    modified_by: Optional[int] = None
-    created_by: Optional[int] = None
diff --git a/plugins/plugin_utils/ansible_models/role_definitions.py b/plugins/plugin_utils/ansible_models/role_definitions.py
new file mode 100644
index 00000000..ae3da000
--- /dev/null
+++ b/plugins/plugin_utils/ansible_models/role_definitions.py
@@ -0,0 +1,38 @@
+"""
+Ansible RoleDefinition dataclass — user-facing stable interface.
+
+Auto-generated by tools/generate_resource.py from the Gateway OpenAPI spec.
+"""
+
+from dataclasses import dataclass
+from typing import Any, Dict, List, Optional
+
+from ..platform.base_transform import BaseTransformMixin
+
+
+@dataclass
+class AnsibleRoleDefinitions(BaseTransformMixin):
+    """Ansible representation of a gateway role_definition (resource module pattern)."""
+
+    # Resource metadata for the base action plugin
+    MODULE_NAME = "role_definition"
+    CANONICAL_KEY = "name"
+    SYSTEM_KEY = "id"
+    SUPPORTS_DELETE = True
+    VALID_STATES = frozenset({"merged", "replaced", "overridden", "deleted", "gathered"})
+
+    permissions: Optional[List[Any]] = None
+    name: Optional[str] = None
+    content_type: Optional[str] = None
+    description: Optional[str] = None
+
+    # Read-only fields (populated from API)
+    id: Optional[int] = None
+    url: Optional[str] = None
+    related: Optional[Dict[str, Any]] = None
+    summary_fields: Optional[Dict[str, Any]] = None
+    modified: Optional[str] = None
+    created: Optional[str] = None
+    managed: Optional[bool] = None
+    modified_by: Optional[int] = None
+    created_by: Optional[int] = None
diff --git a/plugins/plugin_utils/ansible_models/role_team_assignment.py b/plugins/plugin_utils/ansible_models/role_team_assignment.py
deleted file mode 100644
index 02b13c4f..00000000
--- a/plugins/plugin_utils/ansible_models/role_team_assignment.py
+++ /dev/null
@@ -1,39 +0,0 @@
-"""
-Ansible RoleTeamAssignment dataclass — user-facing stable interface.
-
-Auto-generated by tools/generate_resource.py from the Gateway OpenAPI spec.
-"""
-
-from dataclasses import dataclass
-from typing import Any, Dict, List, Optional
-
-from ..platform.base_transform import BaseTransformMixin
-
-
-@dataclass
-class AnsibleRoleTeamAssignment(BaseTransformMixin):
-    """Ansible representation of a gateway role_team_assignment (resource module pattern)."""
-
-    # Resource metadata for the base action plugin
-    MODULE_NAME = "role_team_assignment"
-    CANONICAL_KEY = None  # Category C: no canonical key, match by content
-    SYSTEM_KEY = "id"
-    SUPPORTS_DELETE = True
-    VALID_STATES = frozenset({"merged", "replaced", "overridden", "deleted", "gathered"})
-    INPUT_ONLY_FIELDS = frozenset({"assignment_objects"})  # transformed to object_id, never returned by API
-
-    role_definition: Optional[Any] = None  # int ID or str name (resolved in transform)
-    object_id: Optional[str] = None
-    object_ansible_id: Optional[str] = None
-    team: Optional[Any] = None  # int ID or str name (resolved in transform)
-    team_ansible_id: Optional[str] = None
-    assignment_objects: Optional[List[Any]] = None  # input-only: [{name, type}] → object_id
-
-    # Read-only fields (populated from API)
-    id: Optional[int] = None
-    url: Optional[str] = None
-    related: Optional[Dict[str, Any]] = None
-    summary_fields: Optional[Dict[str, Any]] = None
-    created: Optional[str] = None
-    created_by: Optional[int] = None
-    content_type: Optional[str] = None
diff --git a/plugins/plugin_utils/ansible_models/role_team_assignments.py b/plugins/plugin_utils/ansible_models/role_team_assignments.py
new file mode 100644
index 00000000..a91a4056
--- /dev/null
+++ b/plugins/plugin_utils/ansible_models/role_team_assignments.py
@@ -0,0 +1,39 @@
+"""
+Ansible RoleTeamAssignment dataclass — user-facing stable interface.
+
+Auto-generated by tools/generate_resource.py from the Gateway OpenAPI spec.
+"""
+
+from dataclasses import dataclass
+from typing import Any, Dict, List, Optional
+
+from ..platform.base_transform import BaseTransformMixin
+
+
+@dataclass
+class AnsibleRoleTeamAssignments(BaseTransformMixin):
+    """Ansible representation of a gateway role_team_assignment (resource module pattern)."""
+
+    # Resource metadata for the base action plugin
+    MODULE_NAME = "role_team_assignment"
+    CANONICAL_KEY = None  # Category C: no canonical key, match by content
+    SYSTEM_KEY = "id"
+    SUPPORTS_DELETE = True
+    VALID_STATES = frozenset({"merged", "replaced", "overridden", "deleted", "gathered"})
+    INPUT_ONLY_FIELDS = frozenset({"assignment_objects"})  # transformed to object_id, never returned by API
+
+    role_definition: Optional[Any] = None  # int ID or str name (resolved in transform)
+    object_id: Optional[str] = None
+    object_ansible_id: Optional[str] = None
+    team: Optional[Any] = None  # int ID or str name (resolved in transform)
+    team_ansible_id: Optional[str] = None
+    assignment_objects: Optional[List[Any]] = None  # input-only: [{name, type}] → object_id
+
+    # Read-only fields (populated from API)
+    id: Optional[int] = None
+    url: Optional[str] = None
+    related: Optional[Dict[str, Any]] = None
+    summary_fields: Optional[Dict[str, Any]] = None
+    created: Optional[str] = None
+    created_by: Optional[int] = None
+    content_type: Optional[str] = None
diff --git a/plugins/plugin_utils/ansible_models/role_user_assignment.py b/plugins/plugin_utils/ansible_models/role_user_assignment.py
deleted file mode 100644
index 15457d3a..00000000
--- a/plugins/plugin_utils/ansible_models/role_user_assignment.py
+++ /dev/null
@@ -1,39 +0,0 @@
-"""
-Ansible RoleUserAssignment dataclass — user-facing stable interface.
-
-Auto-generated by tools/generate_resource.py from the Gateway OpenAPI spec.
-"""
-
-from dataclasses import dataclass
-from typing import Any, Dict, List, Optional
-
-from ..platform.base_transform import BaseTransformMixin
-
-
-@dataclass
-class AnsibleRoleUserAssignment(BaseTransformMixin):
-    """Ansible representation of a gateway role_user_assignment (resource module pattern)."""
-
-    # Resource metadata for the base action plugin
-    MODULE_NAME = "role_user_assignment"
-    CANONICAL_KEY = None  # Category C: no canonical key, match by content
-    SYSTEM_KEY = "id"
-    SUPPORTS_DELETE = True
-    VALID_STATES = frozenset({"merged", "replaced", "overridden", "deleted", "gathered"})
-    INPUT_ONLY_FIELDS = frozenset({"object_ids"})  # transformed to object_id, never returned by API
-
-    role_definition: Optional[Any] = None  # int ID or str name (resolved in transform)
-    object_id: Optional[str] = None
-    object_ansible_id: Optional[str] = None
-    user: Optional[Any] = None  # int ID or str name (resolved in transform)
-    user_ansible_id: Optional[str] = None
-    object_ids: Optional[List[Any]] = None  # input-only: [name_or_id, ...] → object_id
-
-    # Read-only fields (populated from API)
-    id: Optional[int] = None
-    url: Optional[str] = None
-    related: Optional[Dict[str, Any]] = None
-    summary_fields: Optional[Dict[str, Any]] = None
-    created: Optional[str] = None
-    created_by: Optional[int] = None
-    content_type: Optional[str] = None
diff --git a/plugins/plugin_utils/ansible_models/role_user_assignments.py b/plugins/plugin_utils/ansible_models/role_user_assignments.py
new file mode 100644
index 00000000..d56db232
--- /dev/null
+++ b/plugins/plugin_utils/ansible_models/role_user_assignments.py
@@ -0,0 +1,39 @@
+"""
+Ansible RoleUserAssignment dataclass — user-facing stable interface.
+
+Auto-generated by tools/generate_resource.py from the Gateway OpenAPI spec.
+"""
+
+from dataclasses import dataclass
+from typing import Any, Dict, List, Optional
+
+from ..platform.base_transform import BaseTransformMixin
+
+
+@dataclass
+class AnsibleRoleUserAssignments(BaseTransformMixin):
+    """Ansible representation of a gateway role_user_assignment (resource module pattern)."""
+
+    # Resource metadata for the base action plugin
+    MODULE_NAME = "role_user_assignment"
+    CANONICAL_KEY = None  # Category C: no canonical key, match by content
+    SYSTEM_KEY = "id"
+    SUPPORTS_DELETE = True
+    VALID_STATES = frozenset({"merged", "replaced", "overridden", "deleted", "gathered"})
+    INPUT_ONLY_FIELDS = frozenset({"object_ids"})  # transformed to object_id, never returned by API
+
+    role_definition: Optional[Any] = None  # int ID or str name (resolved in transform)
+    object_id: Optional[str] = None
+    object_ansible_id: Optional[str] = None
+    user: Optional[Any] = None  # int ID or str name (resolved in transform)
+    user_ansible_id: Optional[str] = None
+    object_ids: Optional[List[Any]] = None  # input-only: [name_or_id, ...] → object_id
+
+    # Read-only fields (populated from API)
+    id: Optional[int] = None
+    url: Optional[str] = None
+    related: Optional[Dict[str, Any]] = None
+    summary_fields: Optional[Dict[str, Any]] = None
+    created: Optional[str] = None
+    created_by: Optional[int] = None
+    content_type: Optional[str] = None
diff --git a/plugins/plugin_utils/ansible_models/route.py b/plugins/plugin_utils/ansible_models/route.py
deleted file mode 100644
index a950153d..00000000
--- a/plugins/plugin_utils/ansible_models/route.py
+++ /dev/null
@@ -1,45 +0,0 @@
-"""
-Ansible Route dataclass — user-facing stable interface.
-
-Auto-generated by tools/generate_resource.py from the Gateway OpenAPI spec.
-"""
-
-from dataclasses import dataclass
-from typing import Any, Dict, Optional
-
-from ..platform.base_transform import BaseTransformMixin
-
-
-@dataclass
-class AnsibleRoute(BaseTransformMixin):
-    """Ansible representation of a gateway route (resource module pattern)."""
-
-    # Resource metadata for the base action plugin
-    MODULE_NAME = "route"
-    CANONICAL_KEY = "name"
-    SYSTEM_KEY = "id"
-    SUPPORTS_DELETE = True
-    VALID_STATES = frozenset({"merged", "replaced", "overridden", "deleted", "gathered"})
-
-    name: Optional[str] = None
-    http_port: Optional[int] = None
-    service_cluster: Optional[int] = None
-    service_port: Optional[int] = None
-    is_service_https: Optional[bool] = None
-    service_path: Optional[str] = None
-    gateway_path: Optional[str] = None
-    is_internal_route: Optional[bool] = None
-    description: Optional[str] = None
-    enable_gateway_auth: Optional[bool] = None
-    node_tags: Optional[str] = None
-    enable_mtls: Optional[bool] = None
-
-    # Read-only fields (populated from API)
-    id: Optional[int] = None
-    url: Optional[str] = None
-    related: Optional[Dict[str, Any]] = None
-    summary_fields: Optional[Dict[str, Any]] = None
-    created: Optional[str] = None
-    created_by: Optional[int] = None
-    modified: Optional[str] = None
-    modified_by: Optional[int] = None
diff --git a/plugins/plugin_utils/ansible_models/routes.py b/plugins/plugin_utils/ansible_models/routes.py
new file mode 100644
index 00000000..ed95d939
--- /dev/null
+++ b/plugins/plugin_utils/ansible_models/routes.py
@@ -0,0 +1,45 @@
+"""
+Ansible Route dataclass — user-facing stable interface.
+
+Auto-generated by tools/generate_resource.py from the Gateway OpenAPI spec.
+"""
+
+from dataclasses import dataclass
+from typing import Any, Dict, Optional
+
+from ..platform.base_transform import BaseTransformMixin
+
+
+@dataclass
+class AnsibleRoutes(BaseTransformMixin):
+    """Ansible representation of a gateway route (resource module pattern)."""
+
+    # Resource metadata for the base action plugin
+    MODULE_NAME = "route"
+    CANONICAL_KEY = "name"
+    SYSTEM_KEY = "id"
+    SUPPORTS_DELETE = True
+    VALID_STATES = frozenset({"merged", "replaced", "overridden", "deleted", "gathered"})
+
+    name: Optional[str] = None
+    http_port: Optional[int] = None
+    service_cluster: Optional[int] = None
+    service_port: Optional[int] = None
+    is_service_https: Optional[bool] = None
+    service_path: Optional[str] = None
+    gateway_path: Optional[str] = None
+    is_internal_route: Optional[bool] = None
+    description: Optional[str] = None
+    enable_gateway_auth: Optional[bool] = None
+    node_tags: Optional[str] = None
+    enable_mtls: Optional[bool] = None
+
+    # Read-only fields (populated from API)
+    id: Optional[int] = None
+    url: Optional[str] = None
+    related: Optional[Dict[str, Any]] = None
+    summary_fields: Optional[Dict[str, Any]] = None
+    created: Optional[str] = None
+    created_by: Optional[int] = None
+    modified: Optional[str] = None
+    modified_by: Optional[int] = None
diff --git a/plugins/plugin_utils/ansible_models/service.py b/plugins/plugin_utils/ansible_models/service.py
deleted file mode 100644
index 4a9dc1db..00000000
--- a/plugins/plugin_utils/ansible_models/service.py
+++ /dev/null
@@ -1,47 +0,0 @@
-"""
-Ansible Service dataclass — user-facing stable interface.
-
-Auto-generated by tools/generate_resource.py from the Gateway OpenAPI spec.
-"""
-
-from dataclasses import dataclass
-from typing import Any, Dict, Optional
-
-from ..platform.base_transform import BaseTransformMixin
-
-
-@dataclass
-class AnsibleService(BaseTransformMixin):
-    """Ansible representation of a gateway service (resource module pattern)."""
-
-    # Resource metadata for the base action plugin
-    MODULE_NAME = "service"
-    CANONICAL_KEY = "name"
-    SYSTEM_KEY = "id"
-    SUPPORTS_DELETE = True
-    VALID_STATES = frozenset({"merged", "replaced", "overridden", "deleted", "gathered"})
-
-    name: Optional[str] = None
-    http_port: Optional[int] = None
-    service_cluster: Optional[int] = None
-    service_port: Optional[int] = None
-    is_service_https: Optional[bool] = None
-    service_path: Optional[str] = None
-    api_slug: Optional[str] = None
-    is_internal_route: Optional[bool] = None
-    description: Optional[str] = None
-    enable_gateway_auth: Optional[bool] = None
-    order: Optional[int] = None
-    node_tags: Optional[str] = None
-    enable_mtls: Optional[bool] = None
-
-    # Read-only fields (populated from API)
-    id: Optional[int] = None
-    url: Optional[str] = None
-    related: Optional[Dict[str, Any]] = None
-    summary_fields: Optional[Dict[str, Any]] = None
-    created: Optional[str] = None
-    created_by: Optional[int] = None
-    modified: Optional[str] = None
-    modified_by: Optional[int] = None
-    gateway_path: Optional[str] = None
diff --git a/plugins/plugin_utils/ansible_models/service_cluster.py b/plugins/plugin_utils/ansible_models/service_cluster.py
deleted file mode 100644
index 9eb5be1c..00000000
--- a/plugins/plugin_utils/ansible_models/service_cluster.py
+++ /dev/null
@@ -1,51 +0,0 @@
-"""
-Ansible ServiceCluster dataclass — user-facing stable interface.
-
-Auto-generated by tools/generate_resource.py from the Gateway OpenAPI spec.
-"""
-
-from dataclasses import dataclass
-from typing import Any, Dict, Optional
-
-from ..platform.base_transform import BaseTransformMixin
-
-
-@dataclass
-class AnsibleServiceCluster(BaseTransformMixin):
-    """Ansible representation of a gateway service_cluster (resource module pattern)."""
-
-    # Resource metadata for the base action plugin
-    MODULE_NAME = "service_cluster"
-    CANONICAL_KEY = "name"
-    SYSTEM_KEY = "id"
-    SUPPORTS_DELETE = True
-    VALID_STATES = frozenset({"merged", "replaced", "overridden", "deleted", "gathered"})
-
-    name: Optional[str] = None
-    service_type: Optional[int] = None
-    auth_type: Optional[str] = None
-    upstream_hostname: Optional[str] = None
-    dns_discovery_type: Optional[str] = None
-    dns_lookup_family: Optional[str] = None
-    outlier_detection_enabled: Optional[bool] = None
-    outlier_detection_consecutive_5xx: Optional[int] = None
-    outlier_detection_interval_seconds: Optional[int] = None
-    outlier_detection_base_ejection_time_seconds: Optional[int] = None
-    outlier_detection_max_ejection_percent: Optional[int] = None
-    health_checks_enabled: Optional[bool] = None
-    health_check_timeout_seconds: Optional[int] = None
-    health_check_interval_seconds: Optional[int] = None
-    health_check_unhealthy_threshold: Optional[int] = None
-    health_check_healthy_threshold: Optional[int] = None
-    healthy_panic_threshold: Optional[int] = None
-
-    # Read-only fields (populated from API)
-    id: Optional[int] = None
-    url: Optional[str] = None
-    related: Optional[Dict[str, Any]] = None
-    summary_fields: Optional[Dict[str, Any]] = None
-    created: Optional[str] = None
-    created_by: Optional[int] = None
-    modified: Optional[str] = None
-    modified_by: Optional[int] = None
-    service_id: Optional[str] = None
diff --git a/plugins/plugin_utils/ansible_models/service_clusters.py b/plugins/plugin_utils/ansible_models/service_clusters.py
new file mode 100644
index 00000000..62d05ca6
--- /dev/null
+++ b/plugins/plugin_utils/ansible_models/service_clusters.py
@@ -0,0 +1,51 @@
+"""
+Ansible ServiceCluster dataclass — user-facing stable interface.
+
+Auto-generated by tools/generate_resource.py from the Gateway OpenAPI spec.
+"""
+
+from dataclasses import dataclass
+from typing import Any, Dict, Optional
+
+from ..platform.base_transform import BaseTransformMixin
+
+
+@dataclass
+class AnsibleServiceClusters(BaseTransformMixin):
+    """Ansible representation of a gateway service_cluster (resource module pattern)."""
+
+    # Resource metadata for the base action plugin
+    MODULE_NAME = "service_cluster"
+    CANONICAL_KEY = "name"
+    SYSTEM_KEY = "id"
+    SUPPORTS_DELETE = True
+    VALID_STATES = frozenset({"merged", "replaced", "overridden", "deleted", "gathered"})
+
+    name: Optional[str] = None
+    service_type: Optional[int] = None
+    auth_type: Optional[str] = None
+    upstream_hostname: Optional[str] = None
+    dns_discovery_type: Optional[str] = None
+    dns_lookup_family: Optional[str] = None
+    outlier_detection_enabled: Optional[bool] = None
+    outlier_detection_consecutive_5xx: Optional[int] = None
+    outlier_detection_interval_seconds: Optional[int] = None
+    outlier_detection_base_ejection_time_seconds: Optional[int] = None
+    outlier_detection_max_ejection_percent: Optional[int] = None
+    health_checks_enabled: Optional[bool] = None
+    health_check_timeout_seconds: Optional[int] = None
+    health_check_interval_seconds: Optional[int] = None
+    health_check_unhealthy_threshold: Optional[int] = None
+    health_check_healthy_threshold: Optional[int] = None
+    healthy_panic_threshold: Optional[int] = None
+
+    # Read-only fields (populated from API)
+    id: Optional[int] = None
+    url: Optional[str] = None
+    related: Optional[Dict[str, Any]] = None
+    summary_fields: Optional[Dict[str, Any]] = None
+    created: Optional[str] = None
+    created_by: Optional[int] = None
+    modified: Optional[str] = None
+    modified_by: Optional[int] = None
+    service_id: Optional[str] = None
diff --git a/plugins/plugin_utils/ansible_models/service_key.py b/plugins/plugin_utils/ansible_models/service_key.py
deleted file mode 100644
index ac7e1c48..00000000
--- a/plugins/plugin_utils/ansible_models/service_key.py
+++ /dev/null
@@ -1,40 +0,0 @@
-"""
-Ansible ServiceKey dataclass — user-facing stable interface.
-
-Auto-generated by tools/generate_resource.py from the Gateway OpenAPI spec.
-"""
-
-from dataclasses import dataclass
-from typing import Any, Dict, Optional
-
-from ..platform.base_transform import BaseTransformMixin
-
-
-@dataclass
-class AnsibleServiceKey(BaseTransformMixin):
-    """Ansible representation of a gateway service_key (resource module pattern)."""
-
-    # Resource metadata for the base action plugin
-    MODULE_NAME = "service_key"
-    CANONICAL_KEY = "name"
-    SYSTEM_KEY = "id"
-    SUPPORTS_DELETE = True
-    VALID_STATES = frozenset({"merged", "replaced", "overridden", "deleted", "gathered"})
-
-    service_cluster: Optional[int] = None
-    mark_previous_inactive: Optional[bool] = None
-    name: Optional[str] = None
-    is_active: Optional[bool] = None
-    algorithm: Optional[str] = None
-    secret_length: Optional[int] = None
-
-    # Read-only fields (populated from API)
-    id: Optional[int] = None
-    url: Optional[str] = None
-    related: Optional[Dict[str, Any]] = None
-    summary_fields: Optional[Dict[str, Any]] = None
-    created: Optional[str] = None
-    created_by: Optional[int] = None
-    modified: Optional[str] = None
-    modified_by: Optional[int] = None
-    secret: Optional[str] = None
diff --git a/plugins/plugin_utils/ansible_models/service_keys.py b/plugins/plugin_utils/ansible_models/service_keys.py
new file mode 100644
index 00000000..b448ef8e
--- /dev/null
+++ b/plugins/plugin_utils/ansible_models/service_keys.py
@@ -0,0 +1,40 @@
+"""
+Ansible ServiceKey dataclass — user-facing stable interface.
+
+Auto-generated by tools/generate_resource.py from the Gateway OpenAPI spec.
+"""
+
+from dataclasses import dataclass
+from typing import Any, Dict, Optional
+
+from ..platform.base_transform import BaseTransformMixin
+
+
+@dataclass
+class AnsibleServiceKeys(BaseTransformMixin):
+    """Ansible representation of a gateway service_key (resource module pattern)."""
+
+    # Resource metadata for the base action plugin
+    MODULE_NAME = "service_key"
+    CANONICAL_KEY = "name"
+    SYSTEM_KEY = "id"
+    SUPPORTS_DELETE = True
+    VALID_STATES = frozenset({"merged", "replaced", "overridden", "deleted", "gathered"})
+
+    service_cluster: Optional[int] = None
+    mark_previous_inactive: Optional[bool] = None
+    name: Optional[str] = None
+    is_active: Optional[bool] = None
+    algorithm: Optional[str] = None
+    secret_length: Optional[int] = None
+
+    # Read-only fields (populated from API)
+    id: Optional[int] = None
+    url: Optional[str] = None
+    related: Optional[Dict[str, Any]] = None
+    summary_fields: Optional[Dict[str, Any]] = None
+    created: Optional[str] = None
+    created_by: Optional[int] = None
+    modified: Optional[str] = None
+    modified_by: Optional[int] = None
+    secret: Optional[str] = None
diff --git a/plugins/plugin_utils/ansible_models/service_node.py b/plugins/plugin_utils/ansible_models/service_node.py
deleted file mode 100644
index fedd0afa..00000000
--- a/plugins/plugin_utils/ansible_models/service_node.py
+++ /dev/null
@@ -1,37 +0,0 @@
-"""
-Ansible ServiceNode dataclass — user-facing stable interface.
-
-Auto-generated by tools/generate_resource.py from the Gateway OpenAPI spec.
-"""
-
-from dataclasses import dataclass
-from typing import Any, Dict, Optional
-
-from ..platform.base_transform import BaseTransformMixin
-
-
-@dataclass
-class AnsibleServiceNode(BaseTransformMixin):
-    """Ansible representation of a gateway service_node (resource module pattern)."""
-
-    # Resource metadata for the base action plugin
-    MODULE_NAME = "service_node"
-    CANONICAL_KEY = "name"
-    SYSTEM_KEY = "id"
-    SUPPORTS_DELETE = True
-    VALID_STATES = frozenset({"merged", "replaced", "overridden", "deleted", "gathered"})
-
-    name: Optional[str] = None
-    address: Optional[str] = None
-    service_cluster: Optional[int] = None
-    tags: Optional[str] = None
-
-    # Read-only fields (populated from API)
-    id: Optional[int] = None
-    url: Optional[str] = None
-    related: Optional[Dict[str, Any]] = None
-    summary_fields: Optional[Dict[str, Any]] = None
-    created: Optional[str] = None
-    created_by: Optional[int] = None
-    modified: Optional[str] = None
-    modified_by: Optional[int] = None
diff --git a/plugins/plugin_utils/ansible_models/service_nodes.py b/plugins/plugin_utils/ansible_models/service_nodes.py
new file mode 100644
index 00000000..57a935c3
--- /dev/null
+++ b/plugins/plugin_utils/ansible_models/service_nodes.py
@@ -0,0 +1,37 @@
+"""
+Ansible ServiceNode dataclass — user-facing stable interface.
+
+Auto-generated by tools/generate_resource.py from the Gateway OpenAPI spec.
+"""
+
+from dataclasses import dataclass
+from typing import Any, Dict, Optional
+
+from ..platform.base_transform import BaseTransformMixin
+
+
+@dataclass
+class AnsibleServiceNodes(BaseTransformMixin):
+    """Ansible representation of a gateway service_node (resource module pattern)."""
+
+    # Resource metadata for the base action plugin
+    MODULE_NAME = "service_node"
+    CANONICAL_KEY = "name"
+    SYSTEM_KEY = "id"
+    SUPPORTS_DELETE = True
+    VALID_STATES = frozenset({"merged", "replaced", "overridden", "deleted", "gathered"})
+
+    name: Optional[str] = None
+    address: Optional[str] = None
+    service_cluster: Optional[int] = None
+    tags: Optional[str] = None
+
+    # Read-only fields (populated from API)
+    id: Optional[int] = None
+    url: Optional[str] = None
+    related: Optional[Dict[str, Any]] = None
+    summary_fields: Optional[Dict[str, Any]] = None
+    created: Optional[str] = None
+    created_by: Optional[int] = None
+    modified: Optional[str] = None
+    modified_by: Optional[int] = None
diff --git a/plugins/plugin_utils/ansible_models/service_type.py b/plugins/plugin_utils/ansible_models/service_type.py
deleted file mode 100644
index 4d44dd57..00000000
--- a/plugins/plugin_utils/ansible_models/service_type.py
+++ /dev/null
@@ -1,38 +0,0 @@
-"""
-Ansible ServiceType dataclass — user-facing stable interface.
-
-Auto-generated by tools/generate_resource.py from the Gateway OpenAPI spec.
-"""
-
-from dataclasses import dataclass
-from typing import Any, Dict, Optional
-
-from ..platform.base_transform import BaseTransformMixin
-
-
-@dataclass
-class AnsibleServiceType(BaseTransformMixin):
-    """Ansible representation of a gateway service_type (resource module pattern)."""
-
-    # Resource metadata for the base action plugin
-    MODULE_NAME = "service_type"
-    CANONICAL_KEY = "name"
-    SYSTEM_KEY = "id"
-    SUPPORTS_DELETE = True
-    VALID_STATES = frozenset({"merged", "replaced", "overridden", "deleted", "gathered"})
-
-    name: Optional[str] = None
-    login_path: Optional[str] = None
-    logout_path: Optional[str] = None
-    ping_url: Optional[str] = None
-    service_index_path: Optional[str] = None
-
-    # Read-only fields (populated from API)
-    id: Optional[int] = None
-    url: Optional[str] = None
-    related: Optional[Dict[str, Any]] = None
-    summary_fields: Optional[Dict[str, Any]] = None
-    created: Optional[str] = None
-    created_by: Optional[int] = None
-    modified: Optional[str] = None
-    modified_by: Optional[int] = None
diff --git a/plugins/plugin_utils/ansible_models/service_types.py b/plugins/plugin_utils/ansible_models/service_types.py
new file mode 100644
index 00000000..6d98caca
--- /dev/null
+++ b/plugins/plugin_utils/ansible_models/service_types.py
@@ -0,0 +1,38 @@
+"""
+Ansible ServiceType dataclass — user-facing stable interface.
+
+Auto-generated by tools/generate_resource.py from the Gateway OpenAPI spec.
+"""
+
+from dataclasses import dataclass
+from typing import Any, Dict, Optional
+
+from ..platform.base_transform import BaseTransformMixin
+
+
+@dataclass
+class AnsibleServiceTypes(BaseTransformMixin):
+    """Ansible representation of a gateway service_type (resource module pattern)."""
+
+    # Resource metadata for the base action plugin
+    MODULE_NAME = "service_type"
+    CANONICAL_KEY = "name"
+    SYSTEM_KEY = "id"
+    SUPPORTS_DELETE = True
+    VALID_STATES = frozenset({"merged", "replaced", "overridden", "deleted", "gathered"})
+
+    name: Optional[str] = None
+    login_path: Optional[str] = None
+    logout_path: Optional[str] = None
+    ping_url: Optional[str] = None
+    service_index_path: Optional[str] = None
+
+    # Read-only fields (populated from API)
+    id: Optional[int] = None
+    url: Optional[str] = None
+    related: Optional[Dict[str, Any]] = None
+    summary_fields: Optional[Dict[str, Any]] = None
+    created: Optional[str] = None
+    created_by: Optional[int] = None
+    modified: Optional[str] = None
+    modified_by: Optional[int] = None
diff --git a/plugins/plugin_utils/ansible_models/services.py b/plugins/plugin_utils/ansible_models/services.py
new file mode 100644
index 00000000..33b286a4
--- /dev/null
+++ b/plugins/plugin_utils/ansible_models/services.py
@@ -0,0 +1,47 @@
+"""
+Ansible Service dataclass — user-facing stable interface.
+
+Auto-generated by tools/generate_resource.py from the Gateway OpenAPI spec.
+"""
+
+from dataclasses import dataclass
+from typing import Any, Dict, Optional
+
+from ..platform.base_transform import BaseTransformMixin
+
+
+@dataclass
+class AnsibleServices(BaseTransformMixin):
+    """Ansible representation of a gateway service (resource module pattern)."""
+
+    # Resource metadata for the base action plugin
+    MODULE_NAME = "service"
+    CANONICAL_KEY = "name"
+    SYSTEM_KEY = "id"
+    SUPPORTS_DELETE = True
+    VALID_STATES = frozenset({"merged", "replaced", "overridden", "deleted", "gathered"})
+
+    name: Optional[str] = None
+    http_port: Optional[int] = None
+    service_cluster: Optional[int] = None
+    service_port: Optional[int] = None
+    is_service_https: Optional[bool] = None
+    service_path: Optional[str] = None
+    api_slug: Optional[str] = None
+    is_internal_route: Optional[bool] = None
+    description: Optional[str] = None
+    enable_gateway_auth: Optional[bool] = None
+    order: Optional[int] = None
+    node_tags: Optional[str] = None
+    enable_mtls: Optional[bool] = None
+
+    # Read-only fields (populated from API)
+    id: Optional[int] = None
+    url: Optional[str] = None
+    related: Optional[Dict[str, Any]] = None
+    summary_fields: Optional[Dict[str, Any]] = None
+    created: Optional[str] = None
+    created_by: Optional[int] = None
+    modified: Optional[str] = None
+    modified_by: Optional[int] = None
+    gateway_path: Optional[str] = None
diff --git a/plugins/plugin_utils/ansible_models/settings.py b/plugins/plugin_utils/ansible_models/settings.py
index 78f14648..ecfe9fe7 100644
--- a/plugins/plugin_utils/ansible_models/settings.py
+++ b/plugins/plugin_utils/ansible_models/settings.py
@@ -11,7 +11,7 @@
 
 
 @dataclass
-class AnsibleSetting(BaseTransformMixin):
+class AnsibleSettings(BaseTransformMixin):
     """Ansible representation of a gateway setting (resource module pattern)."""
 
     # Resource metadata for the base action plugin
diff --git a/plugins/plugin_utils/ansible_models/team.py b/plugins/plugin_utils/ansible_models/team.py
deleted file mode 100644
index 435ee3dc..00000000
--- a/plugins/plugin_utils/ansible_models/team.py
+++ /dev/null
@@ -1,36 +0,0 @@
-"""
-Ansible Team dataclass — user-facing stable interface.
-
-Auto-generated by tools/generate_resource.py from the Gateway OpenAPI spec.
-"""
-
-from dataclasses import dataclass
-from typing import Any, Dict, Optional
-
-from ..platform.base_transform import BaseTransformMixin
-
-
-@dataclass
-class AnsibleTeam(BaseTransformMixin):
-    """Ansible representation of a gateway team (resource module pattern)."""
-
-    # Resource metadata for the base action plugin
-    MODULE_NAME = "team"
-    CANONICAL_KEY = "name"
-    SYSTEM_KEY = "id"
-    SUPPORTS_DELETE = True
-    VALID_STATES = frozenset({"merged", "replaced", "overridden", "deleted", "gathered"})
-
-    name: Optional[str] = None
-    organization: Optional[int] = None
-    description: Optional[str] = None
-
-    # Read-only fields (populated from API)
-    id: Optional[int] = None
-    url: Optional[str] = None
-    related: Optional[Dict[str, Any]] = None
-    summary_fields: Optional[Dict[str, Any]] = None
-    created: Optional[str] = None
-    created_by: Optional[int] = None
-    modified: Optional[str] = None
-    modified_by: Optional[int] = None
diff --git a/plugins/plugin_utils/ansible_models/teams.py b/plugins/plugin_utils/ansible_models/teams.py
new file mode 100644
index 00000000..008127c5
--- /dev/null
+++ b/plugins/plugin_utils/ansible_models/teams.py
@@ -0,0 +1,36 @@
+"""
+Ansible Team dataclass — user-facing stable interface.
+
+Auto-generated by tools/generate_resource.py from the Gateway OpenAPI spec.
+"""
+
+from dataclasses import dataclass
+from typing import Any, Dict, Optional
+
+from ..platform.base_transform import BaseTransformMixin
+
+
+@dataclass
+class AnsibleTeams(BaseTransformMixin):
+    """Ansible representation of a gateway team (resource module pattern)."""
+
+    # Resource metadata for the base action plugin
+    MODULE_NAME = "team"
+    CANONICAL_KEY = "name"
+    SYSTEM_KEY = "id"
+    SUPPORTS_DELETE = True
+    VALID_STATES = frozenset({"merged", "replaced", "overridden", "deleted", "gathered"})
+
+    name: Optional[str] = None
+    organization: Optional[int] = None
+    description: Optional[str] = None
+
+    # Read-only fields (populated from API)
+    id: Optional[int] = None
+    url: Optional[str] = None
+    related: Optional[Dict[str, Any]] = None
+    summary_fields: Optional[Dict[str, Any]] = None
+    created: Optional[str] = None
+    created_by: Optional[int] = None
+    modified: Optional[str] = None
+    modified_by: Optional[int] = None
diff --git a/plugins/plugin_utils/ansible_models/token.py b/plugins/plugin_utils/ansible_models/token.py
deleted file mode 100644
index d379f85b..00000000
--- a/plugins/plugin_utils/ansible_models/token.py
+++ /dev/null
@@ -1,41 +0,0 @@
-"""
-Ansible Token dataclass — user-facing stable interface.
-
-Auto-generated by tools/generate_resource.py from the Gateway OpenAPI spec.
-"""
-
-from dataclasses import dataclass
-from typing import Any, Dict, Optional
-
-from ..platform.base_transform import BaseTransformMixin
-
-
-@dataclass
-class AnsibleToken(BaseTransformMixin):
-    """Ansible representation of a gateway token (resource module pattern)."""
-
-    # Resource metadata for the base action plugin
-    MODULE_NAME = "token"
-    CANONICAL_KEY = "description"
-    SYSTEM_KEY = "id"
-    SUPPORTS_DELETE = True
-    VALID_STATES = frozenset({"merged", "replaced", "overridden", "deleted", "gathered"})
-
-    application: Optional[int] = None
-    description: Optional[str] = None
-    scope: Optional[str] = None
-
-    # Read-only fields (populated from API)
-    id: Optional[int] = None
-    url: Optional[str] = None
-    related: Optional[Dict[str, Any]] = None
-    summary_fields: Optional[Dict[str, Any]] = None
-    created: Optional[str] = None
-    created_by: Optional[int] = None
-    modified: Optional[str] = None
-    modified_by: Optional[int] = None
-    expires: Optional[str] = None
-    user: Optional[int] = None
-    last_used: Optional[str] = None
-    token: Optional[str] = None
-    refresh_token: Optional[str] = None
diff --git a/plugins/plugin_utils/ansible_models/tokens.py b/plugins/plugin_utils/ansible_models/tokens.py
new file mode 100644
index 00000000..97ad9057
--- /dev/null
+++ b/plugins/plugin_utils/ansible_models/tokens.py
@@ -0,0 +1,41 @@
+"""
+Ansible Token dataclass — user-facing stable interface.
+
+Auto-generated by tools/generate_resource.py from the Gateway OpenAPI spec.
+"""
+
+from dataclasses import dataclass
+from typing import Any, Dict, Optional
+
+from ..platform.base_transform import BaseTransformMixin
+
+
+@dataclass
+class AnsibleTokens(BaseTransformMixin):
+    """Ansible representation of a gateway token (resource module pattern)."""
+
+    # Resource metadata for the base action plugin
+    MODULE_NAME = "token"
+    CANONICAL_KEY = "description"
+    SYSTEM_KEY = "id"
+    SUPPORTS_DELETE = True
+    VALID_STATES = frozenset({"merged", "replaced", "overridden", "deleted", "gathered"})
+
+    application: Optional[int] = None
+    description: Optional[str] = None
+    scope: Optional[str] = None
+
+    # Read-only fields (populated from API)
+    id: Optional[int] = None
+    url: Optional[str] = None
+    related: Optional[Dict[str, Any]] = None
+    summary_fields: Optional[Dict[str, Any]] = None
+    created: Optional[str] = None
+    created_by: Optional[int] = None
+    modified: Optional[str] = None
+    modified_by: Optional[int] = None
+    expires: Optional[str] = None
+    user: Optional[int] = None
+    last_used: Optional[str] = None
+    token: Optional[str] = None
+    refresh_token: Optional[str] = None
diff --git a/plugins/plugin_utils/ansible_models/ui_plugin_route.py b/plugins/plugin_utils/ansible_models/ui_plugin_route.py
deleted file mode 100644
index 397e32aa..00000000
--- a/plugins/plugin_utils/ansible_models/ui_plugin_route.py
+++ /dev/null
@@ -1,43 +0,0 @@
-"""
-Ansible UiPluginRoute dataclass — user-facing stable interface.
-
-Auto-generated by tools/generate_resource.py from the Gateway OpenAPI spec.
-"""
-
-from dataclasses import dataclass
-from typing import Any, Dict, Optional
-
-from ..platform.base_transform import BaseTransformMixin
-
-
-@dataclass
-class AnsibleUiPluginRoute(BaseTransformMixin):
-    """Ansible representation of a gateway ui_plugin_route (resource module pattern)."""
-
-    # Resource metadata for the base action plugin
-    MODULE_NAME = "ui_plugin_route"
-    CANONICAL_KEY = "name"
-    SYSTEM_KEY = "id"
-    SUPPORTS_DELETE = True
-    VALID_STATES = frozenset({"merged", "replaced", "overridden", "deleted", "gathered"})
-
-    name: Optional[str] = None
-    http_port: Optional[int] = None
-    service_cluster: Optional[int] = None
-    service_port: Optional[int] = None
-    is_service_https: Optional[bool] = None
-    ui_plugin_path: Optional[str] = None
-    description: Optional[str] = None
-    order: Optional[int] = None
-    node_tags: Optional[str] = None
-
-    # Read-only fields (populated from API)
-    id: Optional[int] = None
-    url: Optional[str] = None
-    related: Optional[Dict[str, Any]] = None
-    summary_fields: Optional[Dict[str, Any]] = None
-    created: Optional[str] = None
-    created_by: Optional[int] = None
-    modified: Optional[str] = None
-    modified_by: Optional[int] = None
-    gateway_path: Optional[str] = None
diff --git a/plugins/plugin_utils/ansible_models/ui_plugin_routes.py b/plugins/plugin_utils/ansible_models/ui_plugin_routes.py
new file mode 100644
index 00000000..0f43f3b7
--- /dev/null
+++ b/plugins/plugin_utils/ansible_models/ui_plugin_routes.py
@@ -0,0 +1,43 @@
+"""
+Ansible UiPluginRoute dataclass — user-facing stable interface.
+
+Auto-generated by tools/generate_resource.py from the Gateway OpenAPI spec.
+"""
+
+from dataclasses import dataclass
+from typing import Any, Dict, Optional
+
+from ..platform.base_transform import BaseTransformMixin
+
+
+@dataclass
+class AnsibleUiPluginRoutes(BaseTransformMixin):
+    """Ansible representation of a gateway ui_plugin_route (resource module pattern)."""
+
+    # Resource metadata for the base action plugin
+    MODULE_NAME = "ui_plugin_route"
+    CANONICAL_KEY = "name"
+    SYSTEM_KEY = "id"
+    SUPPORTS_DELETE = True
+    VALID_STATES = frozenset({"merged", "replaced", "overridden", "deleted", "gathered"})
+
+    name: Optional[str] = None
+    http_port: Optional[int] = None
+    service_cluster: Optional[int] = None
+    service_port: Optional[int] = None
+    is_service_https: Optional[bool] = None
+    ui_plugin_path: Optional[str] = None
+    description: Optional[str] = None
+    order: Optional[int] = None
+    node_tags: Optional[str] = None
+
+    # Read-only fields (populated from API)
+    id: Optional[int] = None
+    url: Optional[str] = None
+    related: Optional[Dict[str, Any]] = None
+    summary_fields: Optional[Dict[str, Any]] = None
+    created: Optional[str] = None
+    created_by: Optional[int] = None
+    modified: Optional[str] = None
+    modified_by: Optional[int] = None
+    gateway_path: Optional[str] = None
diff --git a/plugins/plugin_utils/ansible_models/user.py b/plugins/plugin_utils/ansible_models/user.py
deleted file mode 100644
index 36f2e70c..00000000
--- a/plugins/plugin_utils/ansible_models/user.py
+++ /dev/null
@@ -1,46 +0,0 @@
-"""
-Ansible User dataclass — user-facing stable interface.
-
-Auto-generated by tools/generate_resource.py from the Gateway OpenAPI spec.
-"""
-
-from dataclasses import dataclass
-from typing import Any, Dict, List, Optional
-
-from ..platform.base_transform import BaseTransformMixin
-
-
-@dataclass
-class AnsibleUser(BaseTransformMixin):
-    """Ansible representation of a gateway user (resource module pattern)."""
-
-    # Resource metadata for the base action plugin
-    MODULE_NAME = "user"
-    CANONICAL_KEY = "username"
-    SYSTEM_KEY = "id"
-    SUPPORTS_DELETE = True
-    VALID_STATES = frozenset({"merged", "replaced", "overridden", "deleted", "gathered"})
-
-    username: Optional[str] = None
-    email: Optional[str] = None
-    first_name: Optional[str] = None
-    last_name: Optional[str] = None
-    password: Optional[str] = None
-    is_superuser: Optional[bool] = None
-    authenticators: Optional[List[Any]] = None
-    authenticator_uid: Optional[str] = None
-    associated_authenticators: Optional[Any] = None
-
-    # Read-only fields (populated from API)
-    id: Optional[int] = None
-    url: Optional[str] = None
-    related: Optional[Dict[str, Any]] = None
-    summary_fields: Optional[Dict[str, Any]] = None
-    created: Optional[str] = None
-    created_by: Optional[int] = None
-    modified: Optional[str] = None
-    modified_by: Optional[int] = None
-    last_login: Optional[str] = None
-    last_login_from: Optional[str] = None
-    is_platform_auditor: Optional[bool] = None
-    managed: Optional[bool] = None
diff --git a/plugins/plugin_utils/ansible_models/users.py b/plugins/plugin_utils/ansible_models/users.py
new file mode 100644
index 00000000..510e09a6
--- /dev/null
+++ b/plugins/plugin_utils/ansible_models/users.py
@@ -0,0 +1,46 @@
+"""
+Ansible User dataclass — user-facing stable interface.
+
+Auto-generated by tools/generate_resource.py from the Gateway OpenAPI spec.
+"""
+
+from dataclasses import dataclass
+from typing import Any, Dict, List, Optional
+
+from ..platform.base_transform import BaseTransformMixin
+
+
+@dataclass
+class AnsibleUsers(BaseTransformMixin):
+    """Ansible representation of a gateway user (resource module pattern)."""
+
+    # Resource metadata for the base action plugin
+    MODULE_NAME = "user"
+    CANONICAL_KEY = "username"
+    SYSTEM_KEY = "id"
+    SUPPORTS_DELETE = True
+    VALID_STATES = frozenset({"merged", "replaced", "overridden", "deleted", "gathered"})
+
+    username: Optional[str] = None
+    email: Optional[str] = None
+    first_name: Optional[str] = None
+    last_name: Optional[str] = None
+    password: Optional[str] = None
+    is_superuser: Optional[bool] = None
+    authenticators: Optional[List[Any]] = None
+    authenticator_uid: Optional[str] = None
+    associated_authenticators: Optional[Any] = None
+
+    # Read-only fields (populated from API)
+    id: Optional[int] = None
+    url: Optional[str] = None
+    related: Optional[Dict[str, Any]] = None
+    summary_fields: Optional[Dict[str, Any]] = None
+    created: Optional[str] = None
+    created_by: Optional[int] = None
+    modified: Optional[str] = None
+    modified_by: Optional[int] = None
+    last_login: Optional[str] = None
+    last_login_from: Optional[str] = None
+    is_platform_auditor: Optional[bool] = None
+    managed: Optional[bool] = None
diff --git a/plugins/plugin_utils/api/v1/application.py b/plugins/plugin_utils/api/v1/application.py
index 675e9e2f..a2b030fe 100644
--- a/plugins/plugin_utils/api/v1/application.py
+++ b/plugins/plugin_utils/api/v1/application.py
@@ -153,9 +153,9 @@ def from_api(
         api_data: Dict[str, Any],
         context: Union[TransformContext, Dict[str, Any]],
     ):
-        from ...ansible_models.application import AnsibleApplication
+        from ...ansible_models.applications import AnsibleApplications
 
-        return AnsibleApplication(
+        return AnsibleApplications(
             name=api_data.get("name"),
             redirect_uris=api_data.get("redirect_uris"),
             post_logout_redirect_uris=api_data.get("post_logout_redirect_uris"),
diff --git a/plugins/plugin_utils/api/v1/authenticator.py b/plugins/plugin_utils/api/v1/authenticator.py
index 635d7512..fd99f53d 100644
--- a/plugins/plugin_utils/api/v1/authenticator.py
+++ b/plugins/plugin_utils/api/v1/authenticator.py
@@ -123,9 +123,9 @@ def from_api(
         api_data: Dict[str, Any],
         context: Union[TransformContext, Dict[str, Any]],
     ):
-        from ...ansible_models.authenticator import AnsibleAuthenticator
+        from ...ansible_models.authenticators import AnsibleAuthenticators
 
-        return AnsibleAuthenticator(
+        return AnsibleAuthenticators(
             name=api_data.get("name"),
             enabled=api_data.get("enabled"),
             create_objects=api_data.get("create_objects"),
diff --git a/plugins/plugin_utils/api/v1/authenticator_map.py b/plugins/plugin_utils/api/v1/authenticator_map.py
index 6a957646..dfbba7d5 100644
--- a/plugins/plugin_utils/api/v1/authenticator_map.py
+++ b/plugins/plugin_utils/api/v1/authenticator_map.py
@@ -123,9 +123,9 @@ def from_api(
         api_data: Dict[str, Any],
         context: Union[TransformContext, Dict[str, Any]],
     ):
-        from ...ansible_models.authenticator_map import AnsibleAuthenticatorMap
+        from ...ansible_models.authenticator_maps import AnsibleAuthenticatorMaps
 
-        return AnsibleAuthenticatorMap(
+        return AnsibleAuthenticatorMaps(
             name=api_data.get("name"),
             authenticator=api_data.get("authenticator"),
             map_type=api_data.get("map_type"),
diff --git a/plugins/plugin_utils/api/v1/authenticator_user.py b/plugins/plugin_utils/api/v1/authenticator_user.py
index 630cf47d..a7a186f6 100644
--- a/plugins/plugin_utils/api/v1/authenticator_user.py
+++ b/plugins/plugin_utils/api/v1/authenticator_user.py
@@ -74,6 +74,6 @@ def from_api(
         api_data: Dict[str, Any],
         context: Union[TransformContext, Dict[str, Any]],
     ):
-        from ...ansible_models.authenticator_user import AnsibleAuthenticatorUser
+        from ...ansible_models.authenticator_users import AnsibleAuthenticatorUsers
 
-        return AnsibleAuthenticatorUser()
+        return AnsibleAuthenticatorUsers()
diff --git a/plugins/plugin_utils/api/v1/ca_certificate.py b/plugins/plugin_utils/api/v1/ca_certificate.py
index 00a15fb0..b8ed03ae 100644
--- a/plugins/plugin_utils/api/v1/ca_certificate.py
+++ b/plugins/plugin_utils/api/v1/ca_certificate.py
@@ -113,9 +113,9 @@ def from_api(
         api_data: Dict[str, Any],
         context: Union[TransformContext, Dict[str, Any]],
     ):
-        from ...ansible_models.ca_certificate import AnsibleCaCertificate
+        from ...ansible_models.ca_certificates import AnsibleCaCertificates
 
-        return AnsibleCaCertificate(
+        return AnsibleCaCertificates(
             name=api_data.get("name"),
             pem_data=api_data.get("pem_data"),
             sha256=api_data.get("sha256"),
diff --git a/plugins/plugin_utils/api/v1/feature_flag.py b/plugins/plugin_utils/api/v1/feature_flag.py
index a40e0750..c6bf7de5 100644
--- a/plugins/plugin_utils/api/v1/feature_flag.py
+++ b/plugins/plugin_utils/api/v1/feature_flag.py
@@ -91,9 +91,9 @@ def from_api(
         api_data: Dict[str, Any],
         context: Union[TransformContext, Dict[str, Any]],
     ):
-        from ...ansible_models.feature_flag import AnsibleFeatureFlag
+        from ...ansible_models.feature_flags import AnsibleFeatureFlags
 
-        return AnsibleFeatureFlag(
+        return AnsibleFeatureFlags(
             name=api_data.get("name"),
             value=api_data.get("value"),
             id=api_data.get("id"),
diff --git a/plugins/plugin_utils/api/v1/http_port.py b/plugins/plugin_utils/api/v1/http_port.py
index 9f1b6e2d..fbc5c799 100644
--- a/plugins/plugin_utils/api/v1/http_port.py
+++ b/plugins/plugin_utils/api/v1/http_port.py
@@ -113,9 +113,9 @@ def from_api(
         api_data: Dict[str, Any],
         context: Union[TransformContext, Dict[str, Any]],
     ):
-        from ...ansible_models.http_port import AnsibleHttpPort
+        from ...ansible_models.http_ports import AnsibleHttpPorts
 
-        return AnsibleHttpPort(
+        return AnsibleHttpPorts(
             name=api_data.get("name"),
             number=api_data.get("number"),
             use_https=api_data.get("use_https"),
diff --git a/plugins/plugin_utils/api/v1/organization.py b/plugins/plugin_utils/api/v1/organization.py
index 0cb989ba..76885e67 100644
--- a/plugins/plugin_utils/api/v1/organization.py
+++ b/plugins/plugin_utils/api/v1/organization.py
@@ -110,9 +110,9 @@ def from_api(
         api_data: Dict[str, Any],
         context: Union[TransformContext, Dict[str, Any]],
     ):
-        from ...ansible_models.organization import AnsibleOrganization
+        from ...ansible_models.organizations import AnsibleOrganizations
 
-        return AnsibleOrganization(
+        return AnsibleOrganizations(
             name=api_data.get("name"),
             description=api_data.get("description"),
             id=api_data.get("id"),
diff --git a/plugins/plugin_utils/api/v1/role_definition.py b/plugins/plugin_utils/api/v1/role_definition.py
index a24c2811..0152086c 100644
--- a/plugins/plugin_utils/api/v1/role_definition.py
+++ b/plugins/plugin_utils/api/v1/role_definition.py
@@ -114,9 +114,9 @@ def from_api(
         api_data: Dict[str, Any],
         context: Union[TransformContext, Dict[str, Any]],
     ):
-        from ...ansible_models.role_definition import AnsibleRoleDefinition
+        from ...ansible_models.role_definitions import AnsibleRoleDefinitions
 
-        return AnsibleRoleDefinition(
+        return AnsibleRoleDefinitions(
             permissions=api_data.get("permissions"),
             content_type=api_data.get("content_type"),
             name=api_data.get("name"),
diff --git a/plugins/plugin_utils/api/v1/role_team_assignment.py b/plugins/plugin_utils/api/v1/role_team_assignment.py
index 9206a728..89cc2ccf 100644
--- a/plugins/plugin_utils/api/v1/role_team_assignment.py
+++ b/plugins/plugin_utils/api/v1/role_team_assignment.py
@@ -118,9 +118,9 @@ def from_api(
         api_data: Dict[str, Any],
         context: Union[TransformContext, Dict[str, Any]],
     ):
-        from ...ansible_models.role_team_assignment import AnsibleRoleTeamAssignment
+        from ...ansible_models.role_team_assignments import AnsibleRoleTeamAssignments
 
-        return AnsibleRoleTeamAssignment(
+        return AnsibleRoleTeamAssignments(
             object_id=api_data.get("object_id"),
             object_ansible_id=api_data.get("object_ansible_id"),
             role_definition=api_data.get("role_definition"),
diff --git a/plugins/plugin_utils/api/v1/role_user_assignment.py b/plugins/plugin_utils/api/v1/role_user_assignment.py
index 049b8294..8e5963d3 100644
--- a/plugins/plugin_utils/api/v1/role_user_assignment.py
+++ b/plugins/plugin_utils/api/v1/role_user_assignment.py
@@ -114,9 +114,9 @@ def from_api(
         api_data: Dict[str, Any],
         context: Union[TransformContext, Dict[str, Any]],
     ):
-        from ...ansible_models.role_user_assignment import AnsibleRoleUserAssignment
+        from ...ansible_models.role_user_assignments import AnsibleRoleUserAssignments
 
-        return AnsibleRoleUserAssignment(
+        return AnsibleRoleUserAssignments(
             object_id=api_data.get("object_id"),
             object_ansible_id=api_data.get("object_ansible_id"),
             role_definition=api_data.get("role_definition"),
diff --git a/plugins/plugin_utils/api/v1/route.py b/plugins/plugin_utils/api/v1/route.py
index d60c2d2b..88e05e45 100644
--- a/plugins/plugin_utils/api/v1/route.py
+++ b/plugins/plugin_utils/api/v1/route.py
@@ -155,9 +155,9 @@ def from_api(
         api_data: Dict[str, Any],
         context: Union[TransformContext, Dict[str, Any]],
     ):
-        from ...ansible_models.route import AnsibleRoute
+        from ...ansible_models.routes import AnsibleRoutes
 
-        return AnsibleRoute(
+        return AnsibleRoutes(
             name=api_data.get("name"),
             http_port=api_data.get("http_port"),
             service_cluster=api_data.get("service_cluster"),
diff --git a/plugins/plugin_utils/api/v1/service.py b/plugins/plugin_utils/api/v1/service.py
index 073844d9..48d4aa33 100644
--- a/plugins/plugin_utils/api/v1/service.py
+++ b/plugins/plugin_utils/api/v1/service.py
@@ -160,9 +160,9 @@ def from_api(
         api_data: Dict[str, Any],
         context: Union[TransformContext, Dict[str, Any]],
     ):
-        from ...ansible_models.service import AnsibleService
+        from ...ansible_models.services import AnsibleServices
 
-        return AnsibleService(
+        return AnsibleServices(
             name=api_data.get("name"),
             http_port=api_data.get("http_port"),
             service_cluster=api_data.get("service_cluster"),
diff --git a/plugins/plugin_utils/api/v1/service_cluster.py b/plugins/plugin_utils/api/v1/service_cluster.py
index 88174918..f1ce0db0 100644
--- a/plugins/plugin_utils/api/v1/service_cluster.py
+++ b/plugins/plugin_utils/api/v1/service_cluster.py
@@ -176,9 +176,9 @@ def from_api(
         api_data: Dict[str, Any],
         context: Union[TransformContext, Dict[str, Any]],
     ):
-        from ...ansible_models.service_cluster import AnsibleServiceCluster
+        from ...ansible_models.service_clusters import AnsibleServiceClusters
 
-        return AnsibleServiceCluster(
+        return AnsibleServiceClusters(
             name=api_data.get("name"),
             service_type=api_data.get("service_type"),
             auth_type=api_data.get("auth_type"),
diff --git a/plugins/plugin_utils/api/v1/service_key.py b/plugins/plugin_utils/api/v1/service_key.py
index 98952ede..ee8b1664 100644
--- a/plugins/plugin_utils/api/v1/service_key.py
+++ b/plugins/plugin_utils/api/v1/service_key.py
@@ -118,9 +118,9 @@ def from_api(
         api_data: Dict[str, Any],
         context: Union[TransformContext, Dict[str, Any]],
     ):
-        from ...ansible_models.service_key import AnsibleServiceKey
+        from ...ansible_models.service_keys import AnsibleServiceKeys
 
-        return AnsibleServiceKey(
+        return AnsibleServiceKeys(
             name=api_data.get("name"),
             service_cluster=api_data.get("service_cluster"),
             is_active=api_data.get("is_active"),
diff --git a/plugins/plugin_utils/api/v1/service_node.py b/plugins/plugin_utils/api/v1/service_node.py
index 50eb9cf5..2cebfa8f 100644
--- a/plugins/plugin_utils/api/v1/service_node.py
+++ b/plugins/plugin_utils/api/v1/service_node.py
@@ -113,9 +113,9 @@ def from_api(
         api_data: Dict[str, Any],
         context: Union[TransformContext, Dict[str, Any]],
     ):
-        from ...ansible_models.service_node import AnsibleServiceNode
+        from ...ansible_models.service_nodes import AnsibleServiceNodes
 
-        return AnsibleServiceNode(
+        return AnsibleServiceNodes(
             name=api_data.get("name"),
             address=api_data.get("address"),
             service_cluster=api_data.get("service_cluster"),
diff --git a/plugins/plugin_utils/api/v1/service_type.py b/plugins/plugin_utils/api/v1/service_type.py
index 0adcc9c8..61e0735d 100644
--- a/plugins/plugin_utils/api/v1/service_type.py
+++ b/plugins/plugin_utils/api/v1/service_type.py
@@ -115,9 +115,9 @@ def from_api(
         api_data: Dict[str, Any],
         context: Union[TransformContext, Dict[str, Any]],
     ):
-        from ...ansible_models.service_type import AnsibleServiceType
+        from ...ansible_models.service_types import AnsibleServiceTypes
 
-        return AnsibleServiceType(
+        return AnsibleServiceTypes(
             name=api_data.get("name"),
             login_path=api_data.get("login_path"),
             logout_path=api_data.get("logout_path"),
diff --git a/plugins/plugin_utils/api/v1/settings.py b/plugins/plugin_utils/api/v1/settings.py
index 174739c6..11453590 100644
--- a/plugins/plugin_utils/api/v1/settings.py
+++ b/plugins/plugin_utils/api/v1/settings.py
@@ -78,16 +78,16 @@ def from_api(
         api_data: Dict[str, Any],
         context: Union[TransformContext, Dict[str, Any]],
     ):
-        from ...ansible_models.settings import AnsibleSetting
+        from ...ansible_models.settings import AnsibleSettings
 
         # api_data may be a flat settings dict {KEY: value, ...}
         # or a list item {key: KEY, value: val} — handle both
         if isinstance(api_data, dict) and not any(k in api_data for k in ("key", "value", "id", "url")):
             # Flat dict from /settings/all/ endpoint
-            return AnsibleSetting(settings=dict(api_data))
+            return AnsibleSettings(settings=dict(api_data))
 
         # Fall back: return empty
-        return AnsibleSetting()
+        return AnsibleSettings()
 
 
 # Alias: the loader looks for SettingsTransformMixin_v1 (plural)
diff --git a/plugins/plugin_utils/api/v1/team.py b/plugins/plugin_utils/api/v1/team.py
index 4f59cadd..7403a3ee 100644
--- a/plugins/plugin_utils/api/v1/team.py
+++ b/plugins/plugin_utils/api/v1/team.py
@@ -127,9 +127,9 @@ def from_api(
         api_data: Dict[str, Any],
         context: Union[TransformContext, Dict[str, Any]],
     ):
-        from ...ansible_models.team import AnsibleTeam
+        from ...ansible_models.teams import AnsibleTeams
 
-        return AnsibleTeam(
+        return AnsibleTeams(
             name=api_data.get("name"),
             organization=api_data.get("organization"),
             description=api_data.get("description"),
diff --git a/plugins/plugin_utils/api/v1/token.py b/plugins/plugin_utils/api/v1/token.py
index e25371c8..a8baf249 100644
--- a/plugins/plugin_utils/api/v1/token.py
+++ b/plugins/plugin_utils/api/v1/token.py
@@ -130,9 +130,9 @@ def from_api(
         api_data: Dict[str, Any],
         context: Union[TransformContext, Dict[str, Any]],
     ):
-        from ...ansible_models.token import AnsibleToken
+        from ...ansible_models.tokens import AnsibleTokens
 
-        return AnsibleToken(
+        return AnsibleTokens(
             application=api_data.get("application"),
             description=api_data.get("description"),
             scope=api_data.get("scope"),
diff --git a/plugins/plugin_utils/api/v1/ui_plugin_route.py b/plugins/plugin_utils/api/v1/ui_plugin_route.py
index 5098dcd7..1ca49da0 100644
--- a/plugins/plugin_utils/api/v1/ui_plugin_route.py
+++ b/plugins/plugin_utils/api/v1/ui_plugin_route.py
@@ -124,9 +124,9 @@ def from_api(
         api_data: Dict[str, Any],
         context: Union[TransformContext, Dict[str, Any]],
     ):
-        from ...ansible_models.ui_plugin_route import AnsibleUiPluginRoute
+        from ...ansible_models.ui_plugin_routes import AnsibleUiPluginRoutes
 
-        return AnsibleUiPluginRoute(
+        return AnsibleUiPluginRoutes(
             name=api_data.get("name"),
             http_port=api_data.get("http_port"),
             service_cluster=api_data.get("service_cluster"),
diff --git a/plugins/plugin_utils/api/v1/user.py b/plugins/plugin_utils/api/v1/user.py
index 35de75a5..31f5f50b 100644
--- a/plugins/plugin_utils/api/v1/user.py
+++ b/plugins/plugin_utils/api/v1/user.py
@@ -160,9 +160,9 @@ def from_api(
         api_data: Dict[str, Any],
         context: Union[TransformContext, Dict[str, Any]],
     ):
-        from ...ansible_models.user import AnsibleUser
+        from ...ansible_models.users import AnsibleUsers
 
-        return AnsibleUser(
+        return AnsibleUsers(
             username=api_data.get("username"),
             email=api_data.get("email"),
             first_name=api_data.get("first_name"),
diff --git a/plugins/plugin_utils/platform/loader.py b/plugins/plugin_utils/platform/loader.py
index 9ebc01b7..449f4418 100644
--- a/plugins/plugin_utils/platform/loader.py
+++ b/plugins/plugin_utils/platform/loader.py
@@ -93,8 +93,11 @@ def _load_ansible_class(self, module_name: str) -> Type:
             ImportError: If module cannot be imported
             ValueError: If class cannot be found
         """
-        # Import from ansible_models/<module_name>.py
-        module_path = f"ansible_collections.ansible.platform.plugins.plugin_utils.ansible_models.{module_name}"
+        # Model files are plural (e.g., MODULE_NAME="application" -> "applications.py")
+        module_file_name = module_name if module_name.endswith("s") else module_name + "s"
+
+        # Import from ansible_models/<module_file_name>.py
+        module_path = f"ansible_collections.ansible.platform.plugins.plugin_utils.ansible_models.{module_file_name}"
 
         try:
             module = importlib.import_module(module_path)
@@ -102,8 +105,8 @@ def _load_ansible_class(self, module_name: str) -> Type:
             logger.error("Failed to import Ansible module %s: %s", module_path, e)
             raise ImportError(f"Failed to import Ansible module {module_path}: {e}") from e
 
-        # Find Ansible dataclass (e.g., AnsibleUser, AnsibleCACertificate)
-        class_name = f"Ansible{_to_pascal_case(module_name)}"
+        # Find Ansible dataclass (e.g., AnsibleUsers, AnsibleApplications)
+        class_name = f"Ansible{_to_pascal_case(module_file_name)}"
         target_lower = class_name.lower()
 
         if hasattr(module, class_name):
diff --git a/tools/generate_integration_tests.py b/tools/generate_integration_tests.py
index 052cbd25..003cdd94 100644
--- a/tools/generate_integration_tests.py
+++ b/tools/generate_integration_tests.py
@@ -87,7 +87,7 @@ class ModuleFixture:
 
 
 FIXTURES: Dict[str, ModuleFixture] = {
-    "organization": ModuleFixture(
+    "organizations": ModuleFixture(
         canonical_field="name",
         prefix="int-org-",
         resources=[
@@ -101,7 +101,7 @@ class ModuleFixture:
             {"name": "int-org-delta", "description": "Delta seed"},
         ],
     ),
-    "user": ModuleFixture(
+    "users": ModuleFixture(
         canonical_field="username",
         prefix="int-user-",
         resources=[
@@ -153,7 +153,7 @@ class ModuleFixture:
             },
         ],
     ),
-    "team": ModuleFixture(
+    "teams": ModuleFixture(
         canonical_field="name",
         prefix="int-team-",
         # organization: 1 = "Default" org, always seeded by mock_gateway_server.seed_defaults()
@@ -168,7 +168,7 @@ class ModuleFixture:
             {"name": "int-team-delta", "description": "Delta seed", "organization": 1},
         ],
     ),
-    "role_definition": ModuleFixture(
+    "role_definitions": ModuleFixture(
         canonical_field="name",
         prefix="int-roledef-",
         resources=[
@@ -201,7 +201,7 @@ class ModuleFixture:
             },
         ],
     ),
-    "token": ModuleFixture(
+    "tokens": ModuleFixture(
         canonical_field="description",
         prefix="int-token-",
         resources=[
@@ -214,7 +214,7 @@ class ModuleFixture:
             {"description": "Gamma seed", "scope": "read"},
         ],
     ),
-    "application": ModuleFixture(
+    "applications": ModuleFixture(
         canonical_field="name",
         prefix="int-app-",
         # organization: 1 = "Default" org, always seeded by mock_gateway_server.seed_defaults()
@@ -228,7 +228,7 @@ class ModuleFixture:
             {"name": "int-app-gamma", "description": "Gamma seed", "organization": 1},
         ],
     ),
-    "service_cluster": ModuleFixture(
+    "service_clusters": ModuleFixture(
         canonical_field="name",
         prefix="int-cluster-",
         resources=[
@@ -239,7 +239,7 @@ class ModuleFixture:
         replaced_config={"name": "int-cluster-alpha", "outlier_detection_enabled": False},
         extra_seeds=[{"name": "int-cluster-gamma", "outlier_detection_enabled": False}],
     ),
-    "service_type": ModuleFixture(
+    "service_types": ModuleFixture(
         canonical_field="name",
         prefix="int-stype-",
         resources=[
@@ -250,7 +250,7 @@ class ModuleFixture:
         replaced_config={"name": "int-stype-alpha", "login_path": "/login"},
         extra_seeds=[{"name": "int-stype-gamma", "login_path": "/login"}],
     ),
-    "http_port": ModuleFixture(
+    "http_ports": ModuleFixture(
         canonical_field="name",
         prefix="int-port-",
         resources=[
@@ -261,7 +261,7 @@ class ModuleFixture:
         replaced_config={"name": "int-port-alpha", "use_https": False},
         extra_seeds=[{"name": "int-port-gamma", "use_https": False}],
     ),
-    "route": ModuleFixture(
+    "routes": ModuleFixture(
         canonical_field="name",
         prefix="int-route-",
         resources=[
@@ -272,7 +272,7 @@ class ModuleFixture:
         replaced_config={"name": "int-route-alpha", "description": "Alpha route"},
         extra_seeds=[{"name": "int-route-gamma", "description": "Gamma seed"}],
     ),
-    "ui_plugin_route": ModuleFixture(
+    "ui_plugin_routes": ModuleFixture(
         canonical_field="name",
         prefix="int-uipr-",
         resources=[
@@ -283,7 +283,7 @@ class ModuleFixture:
         replaced_config={"name": "int-uipr-alpha", "description": "Alpha ui plugin route"},
         extra_seeds=[{"name": "int-uipr-gamma", "description": "Gamma seed"}],
     ),
-    "ca_certificate": ModuleFixture(
+    "ca_certificates": ModuleFixture(
         canonical_field="name",
         prefix="int-cert-",
         resources=[
@@ -294,7 +294,7 @@ class ModuleFixture:
         replaced_config={"name": "int-cert-alpha", "pem_data": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0t"},
         extra_seeds=[{"name": "int-cert-gamma", "pem_data": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0t"}],
     ),
-    "authenticator": ModuleFixture(
+    "authenticators": ModuleFixture(
         canonical_field="name",
         prefix="int-auth-",
         resources=[
@@ -308,7 +308,7 @@ class ModuleFixture:
             {"name": "int-auth-gamma", "type": "ansible_base.authentication.authenticator_plugins.local", "enabled": True},
         ],
     ),
-    "authenticator_map": ModuleFixture(
+    "authenticator_maps": ModuleFixture(
         canonical_field="name",
         prefix="int-authmap-",
         # authenticator: 3100 = first ID in mock server's authenticator range (start_id=3100).
@@ -324,7 +324,7 @@ class ModuleFixture:
         prepare_all_states=True,
         prereq_yaml="""\
     - name: Seed prerequisite authenticator (required by all authenticator_map tests)
-      ansible.platform.authenticator:
+      ansible.platform.authenticators:
         config:
           - name: "int-prereq-authn"
             type: "ansible_base.authentication.authenticator_plugins.local"
@@ -336,7 +336,7 @@ class ModuleFixture:
 """,
         cleanup_prereq_yaml="""\
     - name: Remove prerequisite authenticator (test teardown)
-      ansible.platform.authenticator:
+      ansible.platform.authenticators:
         config:
           - name: "int-prereq-authn"
         state: deleted
@@ -347,7 +347,7 @@ class ModuleFixture:
       failed_when: false
 """,
     ),
-    "service": ModuleFixture(
+    "services": ModuleFixture(
         canonical_field="name",
         prefix="int-svc-",
         resources=[
@@ -358,7 +358,7 @@ class ModuleFixture:
         replaced_config={"name": "int-svc-alpha", "description": "Alpha service"},
         extra_seeds=[{"name": "int-svc-gamma", "description": "Gamma seed"}],
     ),
-    "service_key": ModuleFixture(
+    "service_keys": ModuleFixture(
         canonical_field="name",
         prefix="int-skey-",
         resources=[
@@ -369,7 +369,7 @@ class ModuleFixture:
         replaced_config={"name": "int-skey-alpha", "is_active": True},
         extra_seeds=[{"name": "int-skey-gamma", "is_active": True}],
     ),
-    "service_node": ModuleFixture(
+    "service_nodes": ModuleFixture(
         canonical_field="name",
         prefix="int-snode-",
         resources=[
@@ -400,8 +400,8 @@ def load_model_class(module_name: str):
 
 
 def get_all_module_names() -> List[str]:
-    models_dir = COLLECTION_ROOT / "plugins" / "plugin_utils" / "ansible_models"
-    return sorted(p.stem for p in models_dir.glob("*.py") if not p.stem.startswith("_") and p.stem != "base_transform")
+    """Return module names from the FIXTURES registry (plural, public names)."""
+    return sorted(FIXTURES.keys())
 
 
 # ---------------------------------------------------------------------------