diff --git a/docs/CONTRIBUTING-SCRIPTS.md b/docs/CONTRIBUTING-SCRIPTS.md
new file mode 100644
index 000000000..b0d80120b
--- /dev/null
+++ b/docs/CONTRIBUTING-SCRIPTS.md
@@ -0,0 +1,51 @@
+# Contributing to Pulse Installer Scripts
+
+## Workflow Overview
+
+1. **Plan** the change (refactor, new feature, bugfix) and confirm whether the
+   shared libraries already support your needs.
+2. **Implement** in the modular source file (e.g., `scripts/install-foo-v2.sh`).
+3. **Add/Update tests** (smoke + integration where applicable).
+4. **Bundle** (`make bundle-scripts`) and verify outputs.
+5. **Document** any behavioural changes.
+6. **Submit PR** with summary, testing results, and rollout considerations.
+
+## Expectations
+
+- Use shared libraries (`scripts/lib/*.sh`) instead of duplicating helpers.
+- Maintain backward compatibility; introduce feature flags when needed.
+- Keep legacy script versions until rollout completes.
+- Ensure `scripts/tests/run.sh` (smoke) and relevant integration tests pass.
+- Run `make lint-scripts` (shellcheck) before submitting.
+- Update `scripts/bundle.manifest` and regenerate bundles.
+- Provide before/after metrics when refactoring (size reduction, test coverage).
+
+## Testing Checklist
+
+- `scripts/tests/run.sh`
+- Relevant `scripts/tests/integration/*` scripts (add new ones if needed)
+- Manual `--dry-run` invocation of the script when feasible
+- Bundle validation: `bash -n dist/<script>.sh` and `dist/<script>.sh --dry-run`
+
+## Useful Commands
+
+```bash
+# Lint & format
+make lint-scripts
+
+# Run smoke tests
+scripts/tests/run.sh
+
+# Run integration tests
+scripts/tests/integration/test-<name>.sh
+
+# Rebuild bundles
+make bundle-scripts
+```
+
+## Resources
+
+- `docs/script-library-guide.md` — detailed patterns and examples
+- `scripts/lib/README.md` — library function reference
+- `docs/installer-v2-rollout.md` — rollout process for installers
+- GitHub Discussions / internal Slack for questions
diff --git a/docs/installer-v2-quickref.md b/docs/installer-v2-quickref.md
new file mode 100644
index 000000000..04d4be5c1
--- /dev/null
+++ b/docs/installer-v2-quickref.md
@@ -0,0 +1,61 @@
+# Installer v2 Quick Reference
+
+## Opt-In / Opt-Out
+
+```bash
+# Use the new installer
+export PULSE_INSTALLER_V2=1
+curl -fsSL https://download.pulse.example/install-docker-agent.sh | bash -s -- [flags]
+
+# Force the legacy installer
+export PULSE_INSTALLER_V2=0
+curl -fsSL https://download.pulse.example/install-docker-agent.sh | bash -s -- [flags]
+```
+
+## Common Flags
+
+- `--url <https://pulse.example>` — Primary Pulse server URL
+- `--token <api-token>` — API token for enrollment
+- `--target <url|token[|insecure]>` — Additional targets (repeatable)
+- `--interval <duration>` — Poll interval (default `30s`)
+- `--dry-run` — Show actions without applying changes
+- `--uninstall` — Remove agent binary, systemd unit, and startup hooks
+
+## Examples
+
+```bash
+# Preview installation without changes
+export PULSE_INSTALLER_V2=1
+curl -fsSL https://download.pulse.example/install-docker-agent.sh | bash -s -- \
+  --dry-run \
+  --url https://pulse.example \
+  --token <api-token>
+
+# Install with two targets and custom interval
+export PULSE_INSTALLER_V2=1
+curl -fsSL https://download.pulse.example/install-docker-agent.sh | bash -s -- \
+  --url https://pulse-primary \
+  --token <api-token> \
+  --target https://pulse-dr|<dr-token> \
+  --target https://pulse-edge|<edge-token>|true \
+  --interval 15s
+
+# Uninstall
+curl -fsSL https://download.pulse.example/install-docker-agent.sh | bash -s -- --uninstall
+```
+
+## Verification
+
+- Binary path: `/usr/local/bin/pulse-docker-agent`
+- Systemd unit: `/etc/systemd/system/pulse-docker-agent.service`
+- Logs: `journalctl -u pulse-docker-agent -f`
+
+## Rollback
+
+```bash
+# Force legacy installer
+export PULSE_INSTALLER_V2=0
+curl -fsSL https://download.pulse.example/install-docker-agent.sh | bash -s -- ...
+```
+
+Contact support or the Pulse engineering team if issues arise during rollout.
diff --git a/docs/installer-v2-rollout.md b/docs/installer-v2-rollout.md
new file mode 100644
index 000000000..5dce3cd91
--- /dev/null
+++ b/docs/installer-v2-rollout.md
@@ -0,0 +1,142 @@
+# Installer v2 Rollout Plan
+
+## 1. Overview
+
+The Docker agent installer (`install-docker-agent.sh`) has been refactored into a
+modular, testable v2. Key improvements include:
+
+- Shared library usage (`scripts/lib/*.sh`) for logging, HTTP, and systemd
+  helpers, reducing duplication and easing maintenance.
+- Support for `--dry-run`, enabling administrators to preview actions safely.
+- Bundled single-file distribution generated by `scripts/bundle.sh` for curl
+  based installs, while keeping modular sources in the repository.
+- New smoke and integration tests to catch regressions.
+
+Benefits:
+
+- **Users:** Clearer logging, dry-run validation, safer rollbacks, and improved
+  error handling.
+- **Developers:** Consistent helper functions, faster iteration on fixes, and
+  reusable testing infrastructure.
+
+## 2. Rollout Strategy
+
+### Phase 1: Alpha Testing (Internal)
+- Enable v2 via feature flag for internal environments only.
+- Exercise on development clusters, CI agents, and dogfood installations.
+- Validate dry-run, full install, multi-target, and uninstall scenarios.
+- Duration: ~1 week.
+
+### Phase 2: Beta Testing (Early Adopters)
+- Announce availability in release notes and internal channels.
+- Provide explicit opt-in instructions (`PULSE_INSTALLER_V2=1`).
+- Monitor install success metrics, support channels, and gather structured
+  feedback from operators.
+- Duration: ~2 weeks.
+
+### Phase 3: General Availability
+- Flip feature flag default to v2 while retaining v1 as fallback for one full
+  release cycle.
+- Publish deprecation notice for the legacy installer.
+- After the grace period, remove v1 from distribution.
+- Duration: 1 release cadence (approx. 4–6 weeks).
+
+## 3. Feature Flag Mechanism
+
+Users can select installer versions via environment variable:
+
+```bash
+# Enable v2 (early adopter)
+export PULSE_INSTALLER_V2=1
+curl -fsSL https://download.pulse.example/install-docker-agent.sh | bash -s -- ...
+
+# Force legacy v1
+export PULSE_INSTALLER_V2=0
+curl -fsSL https://download.pulse.example/install-docker-agent.sh | bash -s -- ...
+
+# Server-side pseudo-code
+if [[ "${PULSE_INSTALLER_V2:-0}" == "1" ]]; then
+  serve dist/install-docker-agent.sh
+else
+  serve scripts/install-docker-agent-legacy.sh
+fi
+```
+
+The download endpoint should inspect the flag (query parameter, header, or
+environment variable) and serve the appropriate script.
+
+## 4. Testing Checklist
+
+### Before Rollout
+- [ ] Smoke tests (`scripts/tests/run.sh`) passing
+- [ ] Integration tests (`scripts/tests/integration/...`) passing
+- [ ] Ubuntu 20.04 & 22.04 validated
+- [ ] Debian 11 & 12 validated
+- [ ] With and without Docker binary
+- [ ] Multi-target configuration verified
+- [ ] Uninstall path verified
+- [ ] Documentation updated (INSTALL, FAQ, etc.)
+- [ ] Release notes drafted
+
+### During Rollout
+- [ ] Monitor error rates (CI dashboards, telemetry)
+- [ ] Watch support channels/tickets for installer issues
+- [ ] Sample successful installations daily
+- [ ] Collect structured feedback from early adopters
+
+## 5. Success Metrics
+
+- Installation success rate ≥ 99%
+- Median installation duration (baseline ±10%)
+- Top error categories and frequency trending downward
+- Positive/neutral user feedback (no significant negative trend)
+- Rollback requests < 1%
+
+## 6. Rollback Plan
+
+If blocking issues surface:
+
+### Quick Rollback (< 5 minutes)
+1. Replace served script with v1 variant:
+   ```bash
+   cp scripts/install-docker-agent-legacy.sh /var/www/html/install-docker-agent.sh
+   # or update symlink pointing to dist/install-docker-agent.sh
+   ```
+2. Update documentation to reflect temporary rollback.
+3. Broadcast notice in release channels/support chat.
+
+**File references**
+- Legacy: `scripts/install-docker-agent-legacy.sh`
+- Bundled v2: `dist/install-docker-agent.sh`
+- Served location: `/download/install-docker-agent.sh` (symlink/HTTP root)
+
+## 7. Communication Plan
+
+**Announcements**
+- Release notes covering v2 highlights and rollout phases.
+- Update product docs (`INSTALL.md`, quick reference).
+- Post in GitHub Discussions / community forums.
+- Optional blog post for broader awareness.
+
+**User Guidance**
+- Explain how to opt-in/out using `PULSE_INSTALLER_V2`.
+- Highlight new capabilities (`--dry-run`, improved messaging).
+- Provide support contact and bug-reporting instructions.
+- Link to troubleshooting resources.
+
+## 8. Known Limitations
+
+- Limited testing on non-`systemd` init systems (manual startup handled but not
+  optimized).
+- ARM architectures covered via dry-run and download stubs; on-device testing
+  pending.
+- Requires Bash 4.0+ (same as v1) — document for older environments.
+
+## 9. Post-Rollout Tasks
+
+- [ ] Remove feature flag after one successful release cycle.
+- [ ] Retire legacy installer artifacts and adjust CI pipelines.
+- [ ] Update all docs to reference v2 only.
+- [ ] Apply modular pattern to remaining installers (install.sh,
+      install-sensor-proxy.sh, pulse-auto-update.sh).
+- [ ] Expand integration tests to cover additional distributions and scenarios.
diff --git a/docs/script-library-guide.md b/docs/script-library-guide.md
new file mode 100644
index 000000000..d9697da63
--- /dev/null
+++ b/docs/script-library-guide.md
@@ -0,0 +1,192 @@
+# Script Library Guide
+
+## 1. Introduction
+
+The script library system standardises helper functions used across Pulse
+installers. It reduces duplication, improves testability, and makes it easier to
+roll out fixes across the installer fleet. Use the shared libraries when:
+
+- Multiple scripts need the same functionality (logging, HTTP, systemd, etc.).
+- You are refactoring legacy scripts to adopt the v2 pattern.
+- New features require reusable helpers (e.g., additional service management).
+
+## 2. Architecture Overview
+
+```
+scripts/
+├── lib/                     # Shared library modules
+│   ├── common.sh           # Core utilities
+│   ├── systemd.sh          # Service management
+│   ├── http.sh             # HTTP/API operations
+│   └── README.md           # API documentation
+├── tests/                  # Test suites
+│   ├── run.sh              # Test runner
+│   ├── test-*.sh           # Smoke tests
+│   └── integration/        # Integration tests
+├── bundle.sh               # Bundler tool
+├── bundle.manifest         # Bundle configuration
+└── install-*.sh            # Installer scripts
+
+dist/                       # Generated bundled scripts
+└── install-*.sh            # Ready for distribution
+```
+
+## 3. Using the Library in Your Script
+
+```bash
+#!/usr/bin/env bash
+# Example installer using shared libraries
+
+LIB_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}" )" && pwd)/lib"
+if [[ -f "$LIB_DIR/common.sh" ]]; then
+    source "$LIB_DIR/common.sh"
+    source "$LIB_DIR/systemd.sh"
+    source "$LIB_DIR/http.sh"
+fi
+
+common::init "$@"
+
+main() {
+    common::ensure_root --allow-sudo --args "$@"
+    common::log_info "Starting installation..."
+    # ...script logic...
+}
+
+main "$@"
+```
+
+## 4. Common Migration Patterns
+
+**Logging**
+```bash
+# Before
+echo "[INFO] Installing..."
+
+# After
+common::log_info "Installing..."
+```
+
+**Privilege Escalation**
+```bash
+# Before
+if [[ $EUID -ne 0 ]]; then
+  echo "Must run as root"; exit 1
+fi
+
+# After
+common::ensure_root --allow-sudo --args "$@"
+```
+
+**Downloads**
+```bash
+# Before
+curl -o file.tar.gz http://example.com/file.tar.gz
+
+# After
+http::download --url http://example.com/file.tar.gz --output file.tar.gz
+```
+
+**Systemd Unit Creation**
+```bash
+# Before
+cat > /etc/systemd/system/my.service <<'EOF'
+...
+systemctl daemon-reload
+systemctl enable my.service
+systemctl start my.service
+
+# After
+systemd::create_service /etc/systemd/system/my.service <<'EOF'
+...
+EOF
+systemd::enable_and_start "my.service"
+```
+
+## 5. Creating New Library Modules
+
+Create a new module when functionality is reused across scripts or complex
+enough to warrant dedicated helpers. Template:
+
+```bash
+#!/usr/bin/env bash
+# Module: mymodule.sh
+
+mymodule::do_thing() {
+    local arg="$1"
+    # implementation
+}
+```
+
+Add the module to `scripts/lib`, document exported functions in
+`scripts/lib/README.md`, and update `scripts/bundle.manifest` for any bundles
+that need it.
+
+## 6. Testing Requirements
+
+Every migrated script must include:
+
+1. Smoke test (`scripts/tests/test-<script>.sh`) covering syntax and core flows.
+2. Integration test (when the script modifies system state or talks to services).
+3. Successful execution of `scripts/tests/run.sh` and relevant integration tests.
+
+Example smoke test:
+
+```bash
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT="scripts/my-script.sh"
+bash -n "$SCRIPT"
+output="$($SCRIPT --dry-run 2>&1)"
+[[ -n "$output" ]] || exit 1
+echo "All my-script tests passed"
+```
+
+## 7. Bundling for Distribution
+
+1. Update `scripts/bundle.manifest` with the module order.
+2. Run `make bundle-scripts` or `bash scripts/bundle.sh`.
+3. Validate outputs: `bash -n dist/my-installer.sh` and `dist/my-installer.sh --dry-run`.
+
+## 8. Code Style Guidelines
+
+- Namespace exported functions (`module::function`).
+- Use `common::` helpers whenever applicable.
+- Quote variables, prefer `[[ ]]` over `[ ]`.
+- Keep shellcheck clean (`make lint-scripts`).
+- Internal helpers can use `_module::` or nested `local` functions.
+
+## 9. Migration Checklist
+
+- [ ] Create v2 script alongside legacy version.
+- [ ] Source shared modules and call `common::init`.
+- [ ] Replace manual logging/privilege escalation with library calls.
+- [ ] Extract reusable helpers into modules.
+- [ ] Add `--dry-run` support.
+- [ ] Write/update smoke and integration tests.
+- [ ] Update bundle manifest and regenerate bundles.
+- [ ] Validate bundled artifacts.
+- [ ] Refresh documentation and release notes.
+- [ ] Provide before/after metrics in PR.
+
+## 10. Common Pitfalls
+
+- Modifying shared modules for a single script — create script-specific helpers.
+- Forgetting to update bundle manifest or regenerate bundles.
+- Skipping tests (smoke/integration) before submitting PRs.
+- Hardcoding paths; prefer variables and configurable directories.
+- Breaking backwards compatibility without a rollout plan.
+
+## 11. Examples
+
+- `scripts/install-docker-agent-v2.sh` — complete migration example.
+- `scripts/lib/README.md` — full API reference.
+- `scripts/tests/test-docker-agent-v2.sh` — smoke test pattern.
+- `scripts/tests/integration/test-docker-agent-install.sh` — integration setup.
+
+## 12. Getting Help
+
+- Review existing modules in `scripts/lib` before adding new helpers.
+- Run `scripts/tests/run.sh` (smoke) and relevant integration tests.
+- Use `make lint-scripts` to catch style issues early.
+- Ask in GitHub Discussions or internal Slack with context & logs when blocked.
diff --git a/scripts/bundle.manifest b/scripts/bundle.manifest
new file mode 100644
index 000000000..c1b7b0ab3
--- /dev/null
+++ b/scripts/bundle.manifest
@@ -0,0 +1,17 @@
+# Bundle manifest format:
+#   output: <path/to/output.sh>
+#   <path/to/source1.sh>
+#   <path/to/source2.sh>
+#   ...
+# Lines beginning with # are comments and ignored.
+
+output: dist/common-example.sh
+scripts/lib/common.sh
+scripts/lib/systemd.sh
+scripts/lib/http.sh
+
+output: dist/install-docker-agent.sh
+scripts/lib/common.sh
+scripts/lib/systemd.sh
+scripts/lib/http.sh
+scripts/install-docker-agent-v2.sh
diff --git a/scripts/bundle.sh b/scripts/bundle.sh
new file mode 100755
index 000000000..3f717f7b0
--- /dev/null
+++ b/scripts/bundle.sh
@@ -0,0 +1,112 @@
+#!/usr/bin/env bash
+#
+# Bundle modular installer scripts into distributable single files.
+# Reads scripts/bundle.manifest for bundling instructions.
+
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+MANIFEST_PATH="${ROOT_DIR}/scripts/bundle.manifest"
+HEADER_FMT='# === Begin: %s ==='
+FOOTER_FMT='# === End: %s ==='
+
+main() {
+  [[ -f "${MANIFEST_PATH}" ]] || {
+    echo "Missing manifest: ${MANIFEST_PATH}" >&2
+    exit 1
+  }
+
+  local current_output=""
+  local -a buffer=()
+  local found_output=false
+
+  while IFS= read -r line || [[ -n "${line}" ]]; do
+    # Skip blank lines and comments.
+    [[ -z "${line}" || "${line}" =~ ^[[:space:]]*# ]] && continue
+
+    if [[ "${line}" =~ ^output:[[:space:]]+(.+) ]]; then
+      flush_buffer "${current_output}" buffer
+      buffer=()
+      current_output="$(normalize_path "${BASH_REMATCH[1]}")"
+      mkdir -p "$(dirname "${current_output}")"
+      found_output=true
+      continue
+    fi
+
+    [[ -n "${current_output}" ]] || {
+      echo "Encountered source before output directive: ${line}" >&2
+      exit 1
+    }
+
+    local source_path
+    source_path="$(normalize_path "${line}")"
+
+    if [[ ! -f "${source_path}" ]]; then
+      echo "Source file missing: ${source_path}" >&2
+      exit 1
+    fi
+
+    buffer+=("$(printf "${HEADER_FMT}" "$(relative_path "${source_path}")")")
+    buffer+=("$(<"${source_path}")")
+    buffer+=("$(printf "${FOOTER_FMT}" "$(relative_path "${source_path}")")"$'\n')
+  done < "${MANIFEST_PATH}"
+
+  flush_buffer "${current_output}" buffer
+
+  if [[ "${found_output}" == false ]]; then
+    echo "No output directive found in ${MANIFEST_PATH}" >&2
+    exit 1
+  fi
+
+  echo "Bundling complete."
+}
+
+# flush_buffer <output_path> <buffer_array>
+flush_buffer() {
+  local target="$1"
+  shift
+  [[ $# -gt 0 ]] || return 0
+  local -n buf_ref=$1
+
+  if [[ -z "${target}" ]]; then
+    return 0
+  fi
+
+  {
+    echo "# Generated file. Do not edit."
+    printf '# Bundled on: %s\n' "$(date -u +"%Y-%m-%dT%H:%M:%SZ")"
+    printf '# Manifest: %s\n\n' "$(relative_path "${MANIFEST_PATH}")"
+    printf '%s\n' "${buf_ref[@]}"
+  } > "${target}.tmp"
+
+  mv "${target}.tmp" "${target}"
+  if [[ "${target}" == *.sh ]]; then
+    chmod +x "${target}"
+  fi
+  echo "Wrote $(relative_path "${target}")"
+}
+
+# normalize_path <relative_or_absolute_path>
+normalize_path() {
+  local path="$1"
+  if [[ "${path}" == /* ]]; then
+    printf '%s\n' "${path}"
+  else
+    printf '%s\n' "${ROOT_DIR}/${path}"
+  fi
+}
+
+# relative_path <absolute_path>
+relative_path() {
+  local path="$1"
+  python3 - "$ROOT_DIR" "$path" <<'PY'
+import os
+import sys
+
+root = os.path.abspath(sys.argv[1])
+target = os.path.abspath(sys.argv[2])
+print(os.path.relpath(target, root))
+PY
+}
+
+main "$@"
diff --git a/scripts/install-docker-agent-v2.sh b/scripts/install-docker-agent-v2.sh
new file mode 100755
index 000000000..2397500de
--- /dev/null
+++ b/scripts/install-docker-agent-v2.sh
@@ -0,0 +1,872 @@
+#!/usr/bin/env bash
+#
+# Pulse Docker Agent Installer/Uninstaller (v2)
+# Refactored to leverage shared script libraries.
+
+set -euo pipefail
+
+LIB_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+LIB_DIR="${LIB_ROOT}/lib"
+if [[ -f "${LIB_DIR}/common.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "${LIB_DIR}/common.sh"
+  # shellcheck disable=SC1090
+  source "${LIB_DIR}/systemd.sh"
+  # shellcheck disable=SC1090
+  source "${LIB_DIR}/http.sh"
+fi
+
+common::init "$@"
+
+log_info() {
+    common::log_info "$1"
+}
+
+log_warn() {
+    common::log_warn "$1"
+}
+
+log_error() {
+    common::log_error "$1"
+}
+
+log_success() {
+    common::log_info "[ OK ] $1"
+}
+
+trim() {
+    local value="$1"
+    value="${value#"${value%%[![:space:]]*}"}"
+    value="${value%"${value##*[![:space:]]}"}"
+    printf '%s' "$value"
+}
+
+determine_agent_identifier() {
+    local agent_id=""
+
+    if command -v docker &> /dev/null; then
+        agent_id=$(docker info --format '{{.ID}}' 2>/dev/null | head -n1 | tr -d '[:space:]')
+    fi
+
+    if [[ -z "$agent_id" ]] && [[ -r /etc/machine-id ]]; then
+        agent_id=$(tr -d '[:space:]' < /etc/machine-id)
+    fi
+
+    if [[ -z "$agent_id" ]]; then
+        agent_id=$(hostname 2>/dev/null | tr -d '[:space:]')
+    fi
+
+    printf '%s' "$agent_id"
+}
+
+log_header() {
+    printf '\n== %s ==\n' "$1"
+}
+
+quote_shell_arg() {
+    local value="$1"
+    value=${value//\'/\'\\\'\'}
+    printf "'%s'" "$value"
+}
+
+parse_bool() {
+    local result
+    if result="$(http::parse_bool "${1:-}")"; then
+        PARSED_BOOL="$result"
+        return 0
+    fi
+    return 1
+}
+
+parse_target_spec() {
+    local spec="$1"
+    local raw_url raw_token raw_insecure
+
+    IFS='|' read -r raw_url raw_token raw_insecure <<< "$spec"
+    raw_url=$(trim "$raw_url")
+    raw_token=$(trim "$raw_token")
+    raw_insecure=$(trim "$raw_insecure")
+
+    if [[ -z "$raw_url" || -z "$raw_token" ]]; then
+        echo "Error: invalid target spec \"$spec\". Expected format url|token[|insecure]." >&2
+        return 1
+    fi
+
+    PARSED_TARGET_URL="${raw_url%/}"
+    PARSED_TARGET_TOKEN="$raw_token"
+
+    if [[ -n "$raw_insecure" ]]; then
+        if ! parse_bool "$raw_insecure"; then
+            echo "Error: invalid insecure flag \"$raw_insecure\" in target spec \"$spec\"." >&2
+            return 1
+        fi
+        PARSED_TARGET_INSECURE="$PARSED_BOOL"
+    else
+        PARSED_TARGET_INSECURE="false"
+    fi
+
+    return 0
+}
+
+split_targets_from_env() {
+    local value="$1"
+    if [[ -z "$value" ]]; then
+        return 0
+    fi
+
+    value="${value//$'\n'/;}"
+    IFS=';' read -ra __env_targets <<< "$value"
+    for entry in "${__env_targets[@]}"; do
+        local trimmed
+        trimmed=$(trim "$entry")
+        if [[ -n "$trimmed" ]]; then
+            printf '%s\n' "$trimmed"
+        fi
+    done
+}
+
+extract_targets_from_service() {
+    local file="$1"
+    [[ ! -f "$file" ]] && return
+
+    local line value
+
+    # Prefer explicit multi-target configuration if present
+    line=$(grep -m1 'PULSE_TARGETS=' "$file" 2>/dev/null || true)
+    if [[ -n "$line" ]]; then
+        value=$(printf '%s\n' "$line" | sed -n 's/.*PULSE_TARGETS=\([^"]*\).*/\1/p')
+        if [[ -n "$value" ]]; then
+            IFS=';' read -ra __service_targets <<< "$value"
+            for entry in "${__service_targets[@]}"; do
+                entry=$(trim "$entry")
+                if [[ -n "$entry" ]]; then
+                    printf '%s\n' "$entry"
+                fi
+            done
+        fi
+        return
+    fi
+
+    local url=""
+    local token=""
+    local insecure="false"
+
+    line=$(grep -m1 'PULSE_URL=' "$file" 2>/dev/null || true)
+    if [[ -n "$line" ]]; then
+        value="${line#*PULSE_URL=}"
+        value="${value%\"*}"
+        url=$(trim "$value")
+    fi
+
+    line=$(grep -m1 'PULSE_TOKEN=' "$file" 2>/dev/null || true)
+    if [[ -n "$line" ]]; then
+        value="${line#*PULSE_TOKEN=}"
+        value="${value%\"*}"
+        token=$(trim "$value")
+    fi
+
+    line=$(grep -m1 'PULSE_INSECURE_SKIP_VERIFY=' "$file" 2>/dev/null || true)
+    if [[ -n "$line" ]]; then
+        value="${line#*PULSE_INSECURE_SKIP_VERIFY=}"
+        value="${value%\"*}"
+        if parse_bool "$value"; then
+            insecure="$PARSED_BOOL"
+        fi
+    fi
+
+    local exec_line
+    exec_line=$(grep -m1 '^ExecStart=' "$file" 2>/dev/null || true)
+    if [[ -n "$exec_line" ]]; then
+        if [[ -z "$url" ]]; then
+            if [[ "$exec_line" =~ --url[[:space:]]+\"([^\"]+)\" ]]; then
+                url="${BASH_REMATCH[1]}"
+            elif [[ "$exec_line" =~ --url[[:space:]]+([^[:space:]]+) ]]; then
+                url="${BASH_REMATCH[1]}"
+            fi
+        fi
+        if [[ -z "$token" ]]; then
+            if [[ "$exec_line" =~ --token[[:space:]]+\"([^\"]+)\" ]]; then
+                token="${BASH_REMATCH[1]}"
+            elif [[ "$exec_line" =~ --token[[:space:]]+([^[:space:]]+) ]]; then
+                token="${BASH_REMATCH[1]}"
+            fi
+        fi
+        if [[ "$insecure" != "true" && "$exec_line" == *"--insecure"* ]]; then
+            insecure="true"
+        fi
+    fi
+
+    url=$(trim "$url")
+    token=$(trim "$token")
+
+    if [[ -n "$url" && -n "$token" ]]; then
+        printf '%s|%s|%s\n' "$url" "$token" "$insecure"
+    fi
+}
+
+detect_agent_path_from_service() {
+    if [[ -n "$SERVICE_PATH" && -f "$SERVICE_PATH" ]]; then
+        local exec_line
+        exec_line=$(grep -m1 '^ExecStart=' "$SERVICE_PATH" 2>/dev/null || true)
+        if [[ -n "$exec_line" ]]; then
+            local value="${exec_line#ExecStart=}"
+            value=$(trim "$value")
+            if [[ -n "$value" ]]; then
+                printf '%s' "${value%%[[:space:]]*}"
+                return
+            fi
+        fi
+    fi
+}
+
+detect_agent_path_from_unraid() {
+    if [[ -n "$UNRAID_STARTUP" && -f "$UNRAID_STARTUP" ]]; then
+        local match
+        match=$(grep -m1 -o '/[^[:space:]]*pulse-docker-agent' "$UNRAID_STARTUP" 2>/dev/null || true)
+        if [[ -n "$match" ]]; then
+            printf '%s' "$match"
+            return
+        fi
+    fi
+}
+
+detect_existing_agent_path() {
+    local path
+
+    path=$(detect_agent_path_from_service)
+    if [[ -n "$path" ]]; then
+        printf '%s' "$path"
+        return
+    fi
+
+    path=$(detect_agent_path_from_unraid)
+    if [[ -n "$path" ]]; then
+        printf '%s' "$path"
+        return
+    fi
+
+    if command -v pulse-docker-agent >/dev/null 2>&1; then
+        path=$(command -v pulse-docker-agent)
+        if [[ -n "$path" ]]; then
+            printf '%s' "$path"
+            return
+        fi
+    fi
+}
+
+ensure_agent_path_writable() {
+    local file_path="$1"
+    local dir="${file_path%/*}"
+
+    if [[ -z "$dir" || "$file_path" != /* ]]; then
+        return 1
+    fi
+
+    if [[ ! -d "$dir" ]]; then
+        if ! mkdir -p "$dir" 2>/dev/null; then
+            return 1
+        fi
+    fi
+
+    local test_file="$dir/.pulse-agent-write-test-$$"
+    if ! touch "$test_file" 2>/dev/null; then
+        return 1
+    fi
+    rm -f "$test_file" 2>/dev/null || true
+    return 0
+}
+
+select_agent_path_for_install() {
+    local candidates=()
+    declare -A seen=()
+    local selected=""
+    local default_attempted="false"
+    local default_failed="false"
+
+    if [[ -n "$AGENT_PATH_OVERRIDE" ]]; then
+        candidates+=("$AGENT_PATH_OVERRIDE")
+    fi
+
+    if [[ -n "$EXISTING_AGENT_PATH" ]]; then
+        candidates+=("$EXISTING_AGENT_PATH")
+    fi
+
+    candidates+=("$DEFAULT_AGENT_PATH")
+    for fallback in "${AGENT_FALLBACK_PATHS[@]}"; do
+        candidates+=("$fallback")
+    done
+
+    for candidate in "${candidates[@]}"; do
+        candidate=$(trim "$candidate")
+        if [[ -z "$candidate" || "$candidate" != /* ]]; then
+            continue
+        fi
+        if [[ -n "${seen[$candidate]:-}" ]]; then
+            continue
+        fi
+        seen["$candidate"]=1
+
+        if [[ "$candidate" == "$DEFAULT_AGENT_PATH" ]]; then
+            default_attempted="true"
+        fi
+
+        if ensure_agent_path_writable "$candidate"; then
+            selected="$candidate"
+            if [[ "$candidate" == "$DEFAULT_AGENT_PATH" ]]; then
+                DEFAULT_AGENT_PATH_WRITABLE="true"
+            else
+                if [[ "$default_attempted" == "true" && "$default_failed" == "true" && "$OVERRIDE_SPECIFIED" == "false" ]]; then
+                    AGENT_PATH_NOTE="Note: Detected that $DEFAULT_AGENT_PATH is not writable. Using fallback path: $candidate"
+                fi
+            fi
+            break
+        else
+            if [[ "$candidate" == "$DEFAULT_AGENT_PATH" ]]; then
+                default_failed="true"
+                DEFAULT_AGENT_PATH_WRITABLE="false"
+            fi
+        fi
+    done
+
+    if [[ -z "$selected" ]]; then
+        echo "Error: Could not find a writable location for the agent binary." >&2
+        if [[ "$OVERRIDE_SPECIFIED" == "true" ]]; then
+            echo "Provided agent path: $AGENT_PATH_OVERRIDE" >&2
+        fi
+        exit 1
+    fi
+
+    printf '%s' "$selected"
+}
+
+resolve_agent_path_for_uninstall() {
+    if [[ -n "$AGENT_PATH_OVERRIDE" ]]; then
+        printf '%s' "$AGENT_PATH_OVERRIDE"
+        return
+    fi
+
+    local existing_path
+    existing_path=$(detect_existing_agent_path)
+    if [[ -n "$existing_path" ]]; then
+        printf '%s' "$existing_path"
+        return
+    fi
+
+    printf '%s' "$DEFAULT_AGENT_PATH"
+}
+
+# Pulse Docker Agent Installer/Uninstaller
+# Install (single target):
+#   curl -fsSL http://pulse.example.com/install-docker-agent.sh | bash -s -- --url http://pulse.example.com --token <api-token>
+# Install (multi-target fan-out):
+#   curl -fsSL http://pulse.example.com/install-docker-agent.sh | bash -s -- \
+#     --target https://pulse.example.com|<api-token> \
+#     --target https://pulse-dr.example.com|<api-token>
+# Uninstall:
+#   curl -fsSL http://pulse.example.com/install-docker-agent.sh | bash -s -- --uninstall
+
+PULSE_URL=""
+DEFAULT_AGENT_PATH="/usr/local/bin/pulse-docker-agent"
+AGENT_FALLBACK_PATHS=(
+    "/opt/pulse/bin/pulse-docker-agent"
+    "/opt/bin/pulse-docker-agent"
+    "/var/lib/pulse/bin/pulse-docker-agent"
+)
+AGENT_PATH_OVERRIDE="${PULSE_AGENT_PATH:-}"
+OVERRIDE_SPECIFIED="false"
+if [[ -n "$AGENT_PATH_OVERRIDE" ]]; then
+    OVERRIDE_SPECIFIED="true"
+fi
+AGENT_PATH_NOTE=""
+DEFAULT_AGENT_PATH_WRITABLE="unknown"
+EXISTING_AGENT_PATH=""
+AGENT_PATH=""
+SERVICE_PATH="/etc/systemd/system/pulse-docker-agent.service"
+UNRAID_STARTUP="/boot/config/go.d/pulse-docker-agent.sh"
+LOG_PATH="/var/log/pulse-docker-agent.log"
+INTERVAL="30s"
+UNINSTALL=false
+TOKEN="${PULSE_TOKEN:-}"
+DOWNLOAD_ARCH=""
+TARGET_SPECS=()
+PULSE_TARGETS_ENV="${PULSE_TARGETS:-}"
+DEFAULT_INSECURE="$(trim "${PULSE_INSECURE_SKIP_VERIFY:-}")"
+PRIMARY_URL=""
+PRIMARY_TOKEN=""
+PRIMARY_INSECURE="false"
+JOINED_TARGETS=""
+ORIGINAL_ARGS=("$@")
+
+# Parse arguments
+while [[ $# -gt 0 ]]; do
+  case $1 in
+    --url)
+      PULSE_URL="$2"
+      shift 2
+      ;;
+    --interval)
+      INTERVAL="$2"
+      shift 2
+      ;;
+    --uninstall)
+      UNINSTALL=true
+      shift
+      ;;
+    --token)
+      TOKEN="$2"
+      shift 2
+      ;;
+    --target)
+      TARGET_SPECS+=("$2")
+      shift 2
+      ;;
+    --agent-path)
+      AGENT_PATH_OVERRIDE="$2"
+      OVERRIDE_SPECIFIED="true"
+      shift 2
+      ;;
+    --dry-run)
+      common::set_dry_run true
+      shift
+      ;;
+    *)
+      echo "Unknown option: $1"
+      echo "Usage: $0 --url <Pulse URL> --token <API token> [--interval 30s]"
+      echo "       $0 --agent-path /custom/path/pulse-docker-agent"
+      echo "       $0 --uninstall"
+      exit 1
+      ;;
+  esac
+done
+
+# Normalize PULSE_URL - strip trailing slashes to prevent double-slash issues
+PULSE_URL="${PULSE_URL%/}"
+
+if ! common::is_dry_run; then
+    common::ensure_root --allow-sudo --args "${ORIGINAL_ARGS[@]}"
+else
+    common::log_debug "Skipping privilege escalation due to dry-run mode"
+fi
+
+AGENT_PATH_OVERRIDE=$(trim "$AGENT_PATH_OVERRIDE")
+if [[ -z "$AGENT_PATH_OVERRIDE" ]]; then
+    OVERRIDE_SPECIFIED="false"
+fi
+
+if [[ -n "$AGENT_PATH_OVERRIDE" && "$AGENT_PATH_OVERRIDE" != /* ]]; then
+    echo "Error: --agent-path must be an absolute path." >&2
+    exit 1
+fi
+
+EXISTING_AGENT_PATH=$(detect_existing_agent_path)
+
+if [[ "$UNINSTALL" = true ]]; then
+    AGENT_PATH=$(resolve_agent_path_for_uninstall)
+else
+    AGENT_PATH=$(select_agent_path_for_install)
+fi
+
+# Handle uninstall
+if [ "$UNINSTALL" = true ]; then
+    echo "==================================="
+    echo "Pulse Docker Agent Uninstaller"
+    echo "==================================="
+    echo ""
+
+    # Stop and disable systemd service
+    if command -v systemctl &> /dev/null && [ -f "$SERVICE_PATH" ]; then
+        echo "Stopping systemd service..."
+        systemctl stop pulse-docker-agent 2>/dev/null || true
+        systemctl disable pulse-docker-agent 2>/dev/null || true
+        rm -f "$SERVICE_PATH"
+        systemctl daemon-reload
+        echo "✓ Systemd service removed"
+    fi
+
+    # Stop running agent process
+    if pgrep -f pulse-docker-agent > /dev/null; then
+        echo "Stopping agent process..."
+        pkill -f pulse-docker-agent || true
+        sleep 1
+        echo "✓ Agent process stopped"
+    fi
+
+    # Remove binary
+    if [ -f "$AGENT_PATH" ]; then
+        rm -f "$AGENT_PATH"
+        echo "✓ Agent binary removed"
+    fi
+
+    # Remove Unraid startup script
+    if [ -f "$UNRAID_STARTUP" ]; then
+        rm -f "$UNRAID_STARTUP"
+        echo "✓ Unraid startup script removed"
+    fi
+
+    # Remove log file
+    if [ -f "$LOG_PATH" ]; then
+        rm -f "$LOG_PATH"
+        echo "✓ Log file removed"
+    fi
+
+    echo ""
+    echo "==================================="
+    echo "✓ Uninstall complete!"
+    echo "==================================="
+    echo ""
+    echo "The Pulse Docker agent has been removed from this system."
+    echo ""
+    exit 0
+fi
+
+# Validate target configuration for install
+if [[ "$UNINSTALL" != true ]]; then
+  declare -a RAW_TARGETS=()
+
+  if [[ ${#TARGET_SPECS[@]} -gt 0 ]]; then
+    RAW_TARGETS+=("${TARGET_SPECS[@]}")
+  fi
+
+  if [[ -n "$PULSE_TARGETS_ENV" ]]; then
+    mapfile -t ENV_TARGETS < <(split_targets_from_env "$PULSE_TARGETS_ENV")
+    if [[ ${#ENV_TARGETS[@]} -gt 0 ]]; then
+      RAW_TARGETS+=("${ENV_TARGETS[@]}")
+    fi
+  fi
+
+  TOKEN=$(trim "$TOKEN")
+  PULSE_URL=$(trim "$PULSE_URL")
+
+  if [[ ${#RAW_TARGETS[@]} -eq 0 ]]; then
+    if [[ -z "$PULSE_URL" || -z "$TOKEN" ]]; then
+      echo "Error: Provide --target / PULSE_TARGETS or legacy --url and --token values."
+      echo ""
+      echo "Usage:"
+      echo "  Install:   $0 --target https://pulse.example.com|<api-token> [--target ...] [--interval 30s]"
+      echo "  Legacy:    $0 --url http://pulse.example.com --token <api-token> [--interval 30s]"
+      echo "  Uninstall: $0 --uninstall"
+      exit 1
+    fi
+
+    if [[ -n "$DEFAULT_INSECURE" ]]; then
+      if ! parse_bool "$DEFAULT_INSECURE"; then
+        echo "Error: invalid PULSE_INSECURE_SKIP_VERIFY value \"$DEFAULT_INSECURE\"." >&2
+        exit 1
+      fi
+      PRIMARY_INSECURE="$PARSED_BOOL"
+    else
+      PRIMARY_INSECURE="false"
+    fi
+
+    RAW_TARGETS+=("${PULSE_URL%/}|$TOKEN|$PRIMARY_INSECURE")
+  fi
+
+  if [[ -f "$SERVICE_PATH" && ${#RAW_TARGETS[@]} -eq 0 ]]; then
+    mapfile -t EXISTING_TARGETS < <(extract_targets_from_service "$SERVICE_PATH")
+    if [[ ${#EXISTING_TARGETS[@]} -gt 0 ]]; then
+      RAW_TARGETS+=("${EXISTING_TARGETS[@]}")
+    fi
+  fi
+
+  declare -A SEEN_TARGETS=()
+  TARGETS=()
+
+  for spec in "${RAW_TARGETS[@]}"; do
+    if ! parse_target_spec "$spec"; then
+      exit 1
+    fi
+
+    local_normalized="${PARSED_TARGET_URL}|${PARSED_TARGET_TOKEN}|${PARSED_TARGET_INSECURE}"
+
+    if [[ -z "$PRIMARY_URL" ]]; then
+      PRIMARY_URL="$PARSED_TARGET_URL"
+      PRIMARY_TOKEN="$PARSED_TARGET_TOKEN"
+      PRIMARY_INSECURE="$PARSED_TARGET_INSECURE"
+    fi
+
+    if [[ -n "${SEEN_TARGETS[$local_normalized]:-}" ]]; then
+      continue
+    fi
+
+    SEEN_TARGETS[$local_normalized]=1
+    TARGETS+=("$local_normalized")
+  done
+
+  if [[ ${#TARGETS[@]} -eq 0 ]]; then
+    echo "Error: no valid Pulse targets provided." >&2
+    exit 1
+  fi
+
+  JOINED_TARGETS=$(printf "%s;" "${TARGETS[@]}")
+  JOINED_TARGETS="${JOINED_TARGETS%;}"
+
+  # Backwards compatibility for older agent versions
+  PULSE_URL="$PRIMARY_URL"
+  TOKEN="$PRIMARY_TOKEN"
+fi
+
+log_header "Pulse Docker Agent Installer"
+if [[ "$UNINSTALL" != true ]]; then
+  AGENT_IDENTIFIER=$(determine_agent_identifier)
+else
+  AGENT_IDENTIFIER=""
+fi
+if [[ -n "$AGENT_PATH_NOTE" ]]; then
+  log_warn "$AGENT_PATH_NOTE"
+fi
+log_info "Primary Pulse URL : $PRIMARY_URL"
+if [[ ${#TARGETS[@]} -gt 1 ]]; then
+  log_info "Additional targets : $(( ${#TARGETS[@]} - 1 ))"
+fi
+log_info "Install path      : $AGENT_PATH"
+log_info "Log directory     : /var/log/pulse-docker-agent"
+log_info "Reporting interval: $INTERVAL"
+if [[ "$UNINSTALL" != true ]]; then
+  log_info "API token         : provided"
+  if [[ -n "$AGENT_IDENTIFIER" ]]; then
+    log_info "Docker host ID    : $AGENT_IDENTIFIER"
+  fi
+  log_info "Targets:" 
+  for spec in "${TARGETS[@]}"; do
+    IFS='|' read -r target_url _ target_insecure <<< "$spec"
+    if [[ "$target_insecure" == "true" ]]; then
+      log_info "  • $target_url (skip TLS verify)"
+    else
+      log_info "  • $target_url"
+    fi
+  done
+fi
+printf '\n'
+
+# Detect architecture for download
+if [[ "$UNINSTALL" != true ]]; then
+  ARCH=$(uname -m)
+  case "$ARCH" in
+    x86_64|amd64)
+      DOWNLOAD_ARCH="linux-amd64"
+      ;;
+    aarch64|arm64)
+      DOWNLOAD_ARCH="linux-arm64"
+      ;;
+    armv7l|armhf|armv7)
+      DOWNLOAD_ARCH="linux-armv7"
+      ;;
+    *)
+      DOWNLOAD_ARCH=""
+      log_warn "Unknown architecture '$ARCH'. Falling back to default agent binary."
+      ;;
+  esac
+fi
+
+# Check if Docker is installed
+if ! command -v docker &> /dev/null; then
+    log_warn 'Docker not found. The agent requires Docker to be installed.'
+    if common::is_dry_run; then
+        log_warn 'Dry-run mode: skipping Docker enforcement.'
+    else
+        read -p "Continue anyway? (y/N) " -n 1 -r
+        echo
+        if [[ ! $REPLY =~ ^[Yy]$ ]]; then
+            exit 1
+        fi
+    fi
+fi
+
+if [[ "$UNINSTALL" != true ]] && command -v systemctl >/dev/null 2>&1; then
+    if systemd::service_exists "pulse-docker-agent"; then
+        if systemd::is_active "pulse-docker-agent"; then
+            systemd::safe_systemctl stop "pulse-docker-agent"
+        fi
+    fi
+fi
+
+# Download agent binary
+log_info "Downloading agent binary"
+DOWNLOAD_URL_BASE="$PRIMARY_URL/download/pulse-docker-agent"
+DOWNLOAD_URL="$DOWNLOAD_URL_BASE"
+if [[ -n "$DOWNLOAD_ARCH" ]]; then
+    DOWNLOAD_URL="$DOWNLOAD_URL?arch=$DOWNLOAD_ARCH"
+fi
+
+download_agent_binary() {
+    local primary_url="$1"
+    local fallback_url="$2"
+    local -a download_args=(--url "${primary_url}" --output "${AGENT_PATH}" --retries 3 --backoff "1 3 5")
+    if [[ "$PRIMARY_INSECURE" == "true" ]]; then
+        download_args+=(--insecure)
+    fi
+
+    if http::download "${download_args[@]}"; then
+        return 0
+    fi
+
+    if ! common::is_dry_run; then
+        rm -f "$AGENT_PATH" 2>/dev/null || true
+    fi
+
+    if [[ "${fallback_url}" != "${primary_url}" && -n "${fallback_url}" ]]; then
+        log_info 'Falling back to server default agent binary'
+        download_args=(--url "${fallback_url}" --output "${AGENT_PATH}" --retries 3 --backoff "1 3 5")
+        if [[ "$PRIMARY_INSECURE" == "true" ]]; then
+            download_args+=(--insecure)
+        fi
+        if http::download "${download_args[@]}"; then
+            return 0
+        fi
+
+        if ! common::is_dry_run; then
+            rm -f "$AGENT_PATH" 2>/dev/null || true
+        fi
+    fi
+
+    return 1
+}
+
+if download_agent_binary "$DOWNLOAD_URL" "$DOWNLOAD_URL_BASE"; then
+    :
+else
+    log_warn 'Failed to download agent binary'
+    log_warn "Ensure the Pulse server is reachable at $PRIMARY_URL"
+    exit 1
+fi
+
+if ! common::is_dry_run; then
+    chmod +x "$AGENT_PATH"
+fi
+log_success "Agent binary installed"
+
+allow_reenroll_if_needed() {
+    local host_id="$1"
+    if [[ -z "$host_id" || -z "$PRIMARY_TOKEN" || -z "$PRIMARY_URL" ]]; then
+        return 0
+    fi
+
+    local endpoint="$PRIMARY_URL/api/agents/docker/hosts/${host_id}/allow-reenroll"
+    local -a api_args=(--url "${endpoint}" --method POST --token "${PRIMARY_TOKEN}")
+    if [[ "$PRIMARY_INSECURE" == "true" ]]; then
+        api_args+=(--insecure)
+    fi
+
+    if http::api_call "${api_args[@]}" >/dev/null 2>&1; then
+        log_success "Cleared any previous stop block for host"
+    else
+        log_warn "Unable to confirm removal block clearance (continuing)"
+    fi
+
+    return 0
+}
+
+allow_reenroll_if_needed "$AGENT_IDENTIFIER"
+
+# Check if systemd is available
+if ! command -v systemctl &> /dev/null || [ ! -d /etc/systemd/system ]; then
+    printf '\n%s\n' '-- Systemd not detected; configuring alternative startup --'
+
+    # Check if this is Unraid (has /boot/config directory)
+    if [ -d /boot/config ]; then
+        log_info 'Detected Unraid environment'
+
+        mkdir -p /boot/config/go.d
+        STARTUP_SCRIPT="/boot/config/go.d/pulse-docker-agent.sh"
+cat > "$STARTUP_SCRIPT" <<EOF
+#!/bin/bash
+# Pulse Docker Agent - Auto-start script
+sleep 10  # Wait for Docker to be ready
+PULSE_URL="$PRIMARY_URL" PULSE_TOKEN="$PRIMARY_TOKEN" PULSE_TARGETS="$JOINED_TARGETS" PULSE_INSECURE_SKIP_VERIFY="$PRIMARY_INSECURE" $AGENT_PATH --url "$PRIMARY_URL" --interval "$INTERVAL"$NO_AUTO_UPDATE_FLAG > /var/log/pulse-docker-agent.log 2>&1 &
+EOF
+
+        chmod +x "$STARTUP_SCRIPT"
+        log_success "Created startup script: $STARTUP_SCRIPT"
+
+        log_info 'Starting agent'
+        PULSE_URL="$PRIMARY_URL" PULSE_TOKEN="$PRIMARY_TOKEN" PULSE_TARGETS="$JOINED_TARGETS" PULSE_INSECURE_SKIP_VERIFY="$PRIMARY_INSECURE" $AGENT_PATH --url "$PRIMARY_URL" --interval "$INTERVAL"$NO_AUTO_UPDATE_FLAG > /var/log/pulse-docker-agent.log 2>&1 &
+
+        log_header 'Installation complete'
+        log_info 'Agent started via Unraid go.d hook'
+        log_info 'Log file             : /var/log/pulse-docker-agent.log'
+        log_info 'Host visible in Pulse: ~30 seconds'
+        exit 0
+    fi
+
+    log_info 'Manual startup environment detected'
+    log_info "Binary location      : $AGENT_PATH"
+    log_info 'Start manually with  :'
+    printf '  PULSE_URL=%s PULSE_TOKEN=<api-token> \\n' "$PRIMARY_URL"
+    printf '  PULSE_TARGETS="%s" \\n' "https://pulse.example.com|<token>[;https://pulse-alt.example.com|<token2>]"
+    printf '  %s --interval %s &
+' "$AGENT_PATH" "$INTERVAL"
+    log_info 'Add the same command to your init system to start automatically.'
+    exit 0
+
+fi
+
+
+# Check if server is in development mode
+NO_AUTO_UPDATE_FLAG=""
+if http::detect_download_tool >/dev/null 2>&1; then
+    SERVER_INFO_URL="$PRIMARY_URL/api/server/info"
+    IS_DEV="false"
+
+    SERVER_INFO=""
+    declare -a __server_info_args=(--url "$SERVER_INFO_URL")
+    if [[ "$PRIMARY_INSECURE" == "true" ]]; then
+        __server_info_args+=(--insecure)
+    fi
+    SERVER_INFO="$(http::api_call "${__server_info_args[@]}" 2>/dev/null || true)"
+    unset __server_info_args
+
+if [[ -n "$SERVER_INFO" ]] && echo "$SERVER_INFO" | grep -q '"isDevelopment"[[:space:]]*:[[:space:]]*true'; then
+    IS_DEV="true"
+    NO_AUTO_UPDATE_FLAG=" --no-auto-update"
+    log_info 'Development server detected – auto-update disabled'
+fi
+
+if [[ -n "$NO_AUTO_UPDATE_FLAG" ]]; then
+    if ! "$AGENT_PATH" --help 2>&1 | grep -q -- '--no-auto-update'; then
+        log_warn 'Agent binary lacks --no-auto-update flag; keeping auto-update enabled'
+        NO_AUTO_UPDATE_FLAG=""
+    fi
+fi
+fi
+
+# Create systemd service
+log_header 'Configuring systemd service'
+SYSTEMD_ENV_TARGETS_LINE=""
+if [[ -n "$JOINED_TARGETS" ]]; then
+SYSTEMD_ENV_TARGETS_LINE="Environment=\"PULSE_TARGETS=$JOINED_TARGETS\""
+fi
+SYSTEMD_ENV_URL_LINE="Environment=\"PULSE_URL=$PRIMARY_URL\""
+SYSTEMD_ENV_TOKEN_LINE="Environment=\"PULSE_TOKEN=$PRIMARY_TOKEN\""
+SYSTEMD_ENV_INSECURE_LINE="Environment=\"PULSE_INSECURE_SKIP_VERIFY=$PRIMARY_INSECURE\""
+systemd::create_service "$SERVICE_PATH" <<EOF
+[Unit]
+Description=Pulse Docker Agent
+After=network-online.target docker.service
+Wants=network-online.target
+
+[Service]
+Type=simple
+$SYSTEMD_ENV_URL_LINE
+$SYSTEMD_ENV_TOKEN_LINE
+$SYSTEMD_ENV_TARGETS_LINE
+$SYSTEMD_ENV_INSECURE_LINE
+ExecStart=$AGENT_PATH --url "$PRIMARY_URL" --interval "$INTERVAL"$NO_AUTO_UPDATE_FLAG
+Restart=on-failure
+RestartSec=5s
+User=root
+
+[Install]
+WantedBy=multi-user.target
+EOF
+
+log_success "Wrote unit file: $SERVICE_PATH"
+
+# Reload systemd and start service
+log_info 'Starting service'
+systemd::enable_and_start "pulse-docker-agent"
+
+log_header 'Installation complete'
+log_info 'Agent service enabled and started'
+log_info 'Check status          : systemctl status pulse-docker-agent'
+log_info 'Follow logs           : journalctl -u pulse-docker-agent -f'
+log_info 'Host visible in Pulse : ~30 seconds'
diff --git a/scripts/lib/README.md b/scripts/lib/README.md
new file mode 100644
index 000000000..81b00e1d5
--- /dev/null
+++ b/scripts/lib/README.md
@@ -0,0 +1,84 @@
+# Pulse Script Library
+
+The `scripts/lib` directory houses shared Bash modules used by Pulse installation and maintenance scripts. The goal is to keep production installers modular and testable while still supporting bundled single-file artifacts for curl-based distribution.
+
+## Modules & Namespaces
+
+- Each module lives in `scripts/lib/<module>.sh`.
+- Public functions use the `module::function` namespace (`common::log_info`, `proxmox::get_nodes`, etc.).
+- Internal helpers can be marked `local` or use a `module::__helper` prefix.
+- Scripts should only rely on documented `module::` APIs.
+
+## Using the Library
+
+### Development Mode
+
+```bash
+LIB_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/lib" && pwd)"
+if [[ -f "${LIB_DIR}/common.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "${LIB_DIR}/common.sh"
+fi
+
+common::init "$@"
+common::log_info "Starting installer..."
+
+# Acquire a temp directory (automatically cleaned on exit)
+common::temp_dir TMP_DIR --prefix pulse-install-
+common::log_info "Working in ${TMP_DIR}"
+```
+
+### Bundled Mode
+
+Bundled scripts have the library concatenated into the file during the release process. The `source` guard remains but is a no-op because all functions are already defined.
+
+## Environment Variables
+
+| Variable             | Description                                                                  |
+|----------------------|------------------------------------------------------------------------------|
+| `PULSE_DEBUG`        | When set to `1`, forces debug logging and enables additional diagnostics.    |
+| `PULSE_LOG_LEVEL`    | Sets log level (`debug`, `info`, `warn`, `error`). Defaults to `info`.       |
+| `PULSE_NO_COLOR`     | When `1`, disables ANSI colors (used for non-TTY or forced monochrome).      |
+| `PULSE_SUDO_CMD`     | Overrides the sudo command (e.g., `/usr/bin/doas`).                          |
+| `PULSE_FORCE_INTERACTIVE` | Forces interactive behavior (treats script as running in a TTY).       |
+
+## `common.sh` API Reference
+
+- `common::init "$@"` — Initializes logging, traps, and script metadata. Call once at script start.
+- `common::log_info "msg"` — Logs informational messages to stdout.
+- `common::log_warn "msg"` — Logs warnings to stderr.
+- `common::log_error "msg"` — Logs errors to stderr.
+- `common::log_debug "msg"` — Logs debug output (requires log level `debug`).
+- `common::fail "msg" [--code N]` — Logs error and exits with optional status code.
+- `common::require_command cmd...` — Verifies required commands exist; exits on missing dependencies.
+- `common::is_interactive` — Returns success when stdin/stdout are TTYs or forced interactive.
+- `common::ensure_root [--allow-sudo] [--args "${COMMON__ORIGINAL_ARGS[@]}"]` — Ensures root privileges, optionally re-executing via sudo.
+- `common::sudo_exec command...` — Executes command with sudo, printing guidance if sudo is unavailable.
+- `common::run [--label desc] [--retries N] [--backoff "1 2"] -- cmd...` — Executes a command with optional retries and dry-run support.
+- `common::run_capture [--label desc] -- cmd...` — Runs a command and prints captured stdout; honors dry-run.
+- `common::temp_dir VAR [--prefix name]` — Creates a temporary directory, assigns it to `VAR`, and registers cleanup (avoid command substitution so handlers persist).
+- `common::cleanup_push "description" "command"` — Registers cleanup/rollback handler (LIFO order).
+- `common::cleanup_run` — Executes registered cleanup handlers; automatically called on exit.
+- `common::set_dry_run true|false` — Enables or disables dry-run mode for command wrappers.
+- `common::is_dry_run` — Returns success when dry-run mode is active.
+
+## Bundling Workflow
+
+1. Define modules under `scripts/lib/`.
+2. Reference them from scripts using the development source guard.
+3. Update `scripts/bundle.manifest` to list output artifacts and module order.
+4. Run `scripts/bundle.sh` to generate bundled files under `dist/`.
+5. Distribute bundled files (e.g., replace production installer).
+
+Headers inserted during bundling (`# === Begin: ... ===`) mark module boundaries and aid debugging. The generated file includes provenance metadata with timestamp and manifest path.
+- `systemd.sh` — safe wrappers around `systemctl`, unit creation helpers, and service lifecycle utilities.
+- `http.sh` — download helpers, API call wrappers with retries, and GitHub release discovery.
+
+- `systemd::safe_systemctl args...` — Run `systemctl` with timeout protection (container-friendly).
+- `systemd::service_exists name` / `systemd::detect_service_name …` — Inspect available unit files.
+- `systemd::create_service path [mode]` — Write a unit file from stdin (respects dry-run).
+- `systemd::enable_and_start name` / `systemd::restart name` — Common service workflows.
+- `http::download --url URL --output FILE [...]` — Robust curl/wget download helper with retries.
+- `http::api_call --url URL [...]` — Token-authenticated API invocation; prints response body.
+- `http::get_github_latest_release owner/repo` — Fetch latest GitHub release tag.
+- `http::parse_bool value` — Normalize truthy/falsy strings.
diff --git a/scripts/lib/common.sh b/scripts/lib/common.sh
new file mode 100644
index 000000000..78e52fb04
--- /dev/null
+++ b/scripts/lib/common.sh
@@ -0,0 +1,477 @@
+#!/usr/bin/env bash
+#
+# Shared common utilities for Pulse shell scripts.
+# Provides logging, privilege escalation, command execution helpers, and cleanup management.
+
+set -o errexit
+set -o nounset
+set -o pipefail
+
+shopt -s extglob
+
+declare -gA COMMON__LOG_LEVELS=(
+  [debug]=10
+  [info]=20
+  [warn]=30
+  [error]=40
+)
+
+declare -g COMMON__SCRIPT_PATH=""
+declare -g COMMON__SCRIPT_DIR=""
+declare -g COMMON__ORIGINAL_ARGS=()
+
+declare -g COMMON__LOG_LEVEL="info"
+declare -g COMMON__LOG_LEVEL_NUM=20
+declare -g COMMON__DEBUG=false
+declare -g COMMON__COLOR_ENABLED=true
+
+declare -g COMMON__DRY_RUN=false
+
+declare -ag COMMON__CLEANUP_DESCRIPTIONS=()
+declare -ag COMMON__CLEANUP_COMMANDS=()
+declare -g COMMON__CLEANUP_REGISTERED=false
+
+# shellcheck disable=SC2034
+declare -g COMMON__ANSI_RESET=""
+# shellcheck disable=SC2034
+declare -g COMMON__ANSI_INFO=""
+# shellcheck disable=SC2034
+declare -g COMMON__ANSI_WARN=""
+# shellcheck disable=SC2034
+declare -g COMMON__ANSI_ERROR=""
+# shellcheck disable=SC2034
+declare -g COMMON__ANSI_DEBUG=""
+
+# common::init
+# Initializes the common library. Call at the top of every script.
+# Sets script metadata, log level, color handling, traps, and stores original args.
+common::init() {
+  COMMON__SCRIPT_PATH="$(common::__resolve_script_path)"
+  COMMON__SCRIPT_DIR="$(dirname "${COMMON__SCRIPT_PATH}")"
+  COMMON__ORIGINAL_ARGS=("$@")
+
+  common::__configure_color
+  common::__configure_log_level
+
+  if [[ "${COMMON__DEBUG}" == true ]]; then
+    common::log_debug "Debug mode enabled"
+  fi
+
+  if [[ "${COMMON__CLEANUP_REGISTERED}" == false ]]; then
+    trap common::cleanup_run EXIT
+    COMMON__CLEANUP_REGISTERED=true
+  fi
+}
+
+# common::log_info "message"
+# Logs informational messages. Printed to stdout.
+common::log_info() {
+  common::__log "info" "$@"
+}
+
+# common::log_warn "message"
+# Logs warning messages. Printed to stderr.
+common::log_warn() {
+  common::__log "warn" "$@"
+}
+
+# common::log_error "message"
+# Logs error messages. Printed to stderr.
+common::log_error() {
+  common::__log "error" "$@"
+}
+
+# common::log_debug "message"
+# Logs debug messages when log level is debug. Printed to stderr.
+common::log_debug() {
+  common::__log "debug" "$@"
+}
+
+# common::fail "message" [--code N]
+# Logs an error message and exits with provided code (default 1).
+common::fail() {
+  local exit_code=1
+  local message_parts=()
+  while (($#)); do
+    case "$1" in
+      --code)
+        shift
+        exit_code="${1:-1}"
+        ;;
+      *)
+        message_parts+=("$1")
+        ;;
+    esac
+    shift || break
+  done
+  local message="${message_parts[*]}"
+  common::log_error "${message}"
+  exit "${exit_code}"
+}
+
+# common::require_command cmd1 [cmd2 ...]
+# Verifies that required commands exist. Fails if any are missing.
+common::require_command() {
+  local missing=()
+  local cmd
+  for cmd in "$@"; do
+    if ! command -v "${cmd}" >/dev/null 2>&1; then
+      missing+=("${cmd}")
+    fi
+  done
+
+  if ((${#missing[@]} > 0)); then
+    common::fail "Missing required command(s): ${missing[*]}"
+  fi
+}
+
+# common::is_interactive
+# Returns success when running in an interactive TTY or PULSE_FORCE_INTERACTIVE=1.
+common::is_interactive() {
+  if [[ "${PULSE_FORCE_INTERACTIVE:-0}" == "1" ]]; then
+    return 0
+  fi
+  [[ -t 0 && -t 1 ]]
+}
+
+# common::ensure_root [--allow-sudo] [--args "${COMMON__ORIGINAL_ARGS[@]}"]
+# Ensures the script is running with root privileges. Optionally re-execs with sudo.
+common::ensure_root() {
+  local allow_sudo=false
+  local reexec_args=()
+
+  while (($#)); do
+    case "$1" in
+      --allow-sudo)
+        allow_sudo=true
+        ;;
+      --args)
+        shift
+        reexec_args=("$@")
+        break
+        ;;
+      *)
+        common::log_warn "Unknown argument to common::ensure_root: $1"
+        ;;
+    esac
+    shift || break
+  done
+
+  if [[ "${EUID}" -eq 0 ]]; then
+    return 0
+  fi
+
+  if [[ "${allow_sudo}" == true ]]; then
+    if common::is_interactive; then
+      common::log_info "Escalating privileges with sudo..."
+      common::sudo_exec "${COMMON__SCRIPT_PATH}" "${reexec_args[@]}"
+      exit 0
+    fi
+    common::fail "Root privileges required; rerun with sudo or as root."
+  fi
+
+  common::fail "Root privileges required."
+}
+
+# common::sudo_exec command [args...]
+# Executes a command via sudo, providing user guidance on failure.
+common::sudo_exec() {
+  local sudo_cmd="${PULSE_SUDO_CMD:-sudo}"
+  if command -v "${sudo_cmd}" >/dev/null 2>&1; then
+    exec "${sudo_cmd}" -- "$@"
+  fi
+
+  cat <<'EOF' >&2
+Unable to escalate privileges automatically because sudo is unavailable.
+Please install sudo or rerun this script as root.
+EOF
+  exit 1
+}
+
+# common::run [--label desc] [--retries N] [--backoff "1 2 4"] command [args...]
+# Executes a command, respecting dry-run mode and retry policies.
+common::run() {
+  local label=""
+  local retries=1
+  local backoff=()
+  local -a cmd=()
+
+  while (($#)); do
+    case "$1" in
+      --label)
+        label="$2"
+        shift 2
+        continue
+        ;;
+      --retries)
+        retries="$2"
+        shift 2
+        continue
+        ;;
+      --backoff)
+        read -r -a backoff <<<"$2"
+        shift 2
+        continue
+        ;;
+      --)
+        shift
+        break
+        ;;
+      -*)
+        common::log_warn "Unknown flag for common::run: $1"
+        shift
+        continue
+        ;;
+      *)
+        break
+        ;;
+    esac
+  done
+
+  cmd=("$@")
+  [[ -z "${label}" ]] && label="${cmd[*]}"
+
+  if [[ "${COMMON__DRY_RUN}" == true ]]; then
+    common::log_info "[dry-run] ${label}"
+    return 0
+  fi
+
+  local attempt=1
+  local exit_code=0
+
+  while (( attempt <= retries )); do
+    if "${cmd[@]}"; then
+      return 0
+    fi
+
+    exit_code=$?
+    if (( attempt == retries )); then
+      common::log_error "Command failed (${exit_code}): ${label}"
+      return "${exit_code}"
+    fi
+
+    local sleep_time="${backoff[$((attempt - 1))]:-1}"
+    common::log_warn "Command failed (${exit_code}): ${label} — retrying in ${sleep_time}s (attempt ${attempt}/${retries})"
+    sleep "${sleep_time}"
+    ((attempt++))
+  done
+
+  return "${exit_code}"
+}
+
+# common::run_capture [--label desc] command [args...]
+# Executes a command and captures stdout. Respects dry-run mode.
+common::run_capture() {
+  local label=""
+
+  while (($#)); do
+    case "$1" in
+      --label)
+        label="$2"
+        shift 2
+        continue
+        ;;
+      --)
+        shift
+        break
+        ;;
+      -*)
+        common::log_warn "Unknown flag for common::run_capture: $1"
+        shift
+        continue
+        ;;
+      *)
+        break
+        ;;
+    esac
+  done
+
+  local -a cmd=("$@")
+  [[ -z "${label}" ]] && label="${cmd[*]}"
+
+  if [[ "${COMMON__DRY_RUN}" == true ]]; then
+    common::log_info "[dry-run] ${label}"
+    echo ""
+    return 0
+  fi
+
+  "${cmd[@]}"
+}
+
+# common::temp_dir <var> [--prefix name]
+# Creates a temporary directory tracked for cleanup and assigns it to <var>.
+common::temp_dir() {
+  local var_name=""
+  local prefix="pulse-"
+
+  if (($#)) && [[ $1 != --* ]]; then
+    var_name="$1"
+    shift
+  fi
+
+  while (($#)); do
+    case "$1" in
+      --prefix)
+        prefix="$2"
+        shift 2
+        continue
+        ;;
+      *)
+        common::log_warn "Unknown argument to common::temp_dir: $1"
+        shift
+        continue
+        ;;
+    esac
+  done
+
+  local dir
+  dir="$(mktemp -d -t "${prefix}XXXXXX")"
+  if (( "${BASH_SUBSHELL:-0}" > 0 )); then
+    common::log_warn "common::temp_dir invoked in subshell; cleanup handlers will not be registered automatically for ${dir}"
+  else
+    common::cleanup_push "Remove temp dir ${dir}" "rm -rf ${dir@Q}"
+  fi
+
+  if [[ -n "${var_name}" ]]; then
+    printf -v "${var_name}" '%s' "${dir}"
+  else
+    printf '%s\n' "${dir}"
+  fi
+}
+
+# common::cleanup_push "description" "command"
+# Adds a cleanup handler executed in LIFO order on exit.
+common::cleanup_push() {
+  local description="${1:-}"
+  local command="${2:-}"
+
+  if [[ -z "${command}" ]]; then
+    common::log_warn "Ignoring cleanup handler without command"
+    return
+  fi
+
+  COMMON__CLEANUP_DESCRIPTIONS+=("${description}")
+  COMMON__CLEANUP_COMMANDS+=("${command}")
+}
+
+# common::cleanup_run
+# Executes registered cleanup handlers. Called automatically via EXIT trap.
+common::cleanup_run() {
+  local idx=$(( ${#COMMON__CLEANUP_COMMANDS[@]} - 1 ))
+  while (( idx >= 0 )); do
+    local command="${COMMON__CLEANUP_COMMANDS[$idx]}"
+    local description="${COMMON__CLEANUP_DESCRIPTIONS[$idx]}"
+    if [[ -n "${description}" ]]; then
+      common::log_debug "Running cleanup: ${description}"
+    fi
+    eval "${command}"
+    ((idx--))
+  done
+
+  COMMON__CLEANUP_COMMANDS=()
+  COMMON__CLEANUP_DESCRIPTIONS=()
+}
+
+# common::set_dry_run true|false
+# Enables or disables global dry-run mode.
+common::set_dry_run() {
+  local flag="${1:-false}"
+  case "${flag}" in
+    true|1|yes)
+      COMMON__DRY_RUN=true
+      ;;
+    false|0|no)
+      COMMON__DRY_RUN=false
+      ;;
+    *)
+      common::log_warn "Unknown dry-run flag: ${flag}"
+      COMMON__DRY_RUN=true
+      ;;
+  esac
+}
+
+# common::is_dry_run
+# Returns success when dry-run mode is active.
+common::is_dry_run() {
+  [[ "${COMMON__DRY_RUN}" == true ]]
+}
+
+# Internal helper: configure color output.
+common::__configure_color() {
+  if [[ "${PULSE_NO_COLOR:-0}" == "1" || ! -t 1 ]]; then
+    COMMON__COLOR_ENABLED=false
+  fi
+
+  if [[ "${COMMON__COLOR_ENABLED}" == true ]]; then
+    COMMON__ANSI_RESET=$'\033[0m'
+    COMMON__ANSI_INFO=$'\033[1;34m'
+    COMMON__ANSI_WARN=$'\033[1;33m'
+    COMMON__ANSI_ERROR=$'\033[1;31m'
+    COMMON__ANSI_DEBUG=$'\033[1;35m'
+  else
+    COMMON__ANSI_RESET=""
+    COMMON__ANSI_INFO=""
+    COMMON__ANSI_WARN=""
+    COMMON__ANSI_ERROR=""
+    COMMON__ANSI_DEBUG=""
+  fi
+}
+
+# Internal helper: set log level and debug flag.
+common::__configure_log_level() {
+  if [[ "${PULSE_DEBUG:-0}" == "1" ]]; then
+    COMMON__DEBUG=true
+    COMMON__LOG_LEVEL="debug"
+  else
+    COMMON__LOG_LEVEL="${PULSE_LOG_LEVEL:-info}"
+  fi
+
+  COMMON__LOG_LEVEL="${COMMON__LOG_LEVEL,,}"
+  COMMON__LOG_LEVEL_NUM="${COMMON__LOG_LEVELS[${COMMON__LOG_LEVEL}]:-20}"
+}
+
+# Internal helper: generic logger.
+common::__log() {
+  local level="$1"
+  shift
+  local message="$*"
+
+  local level_num="${COMMON__LOG_LEVELS[${level}]:-20}"
+  if (( level_num < COMMON__LOG_LEVEL_NUM )); then
+    return 0
+  fi
+
+  local timestamp
+  timestamp="$(date -u +"%Y-%m-%dT%H:%M:%SZ")"
+  local color=""
+
+  case "${level}" in
+    info) color="${COMMON__ANSI_INFO}" ;;
+    warn) color="${COMMON__ANSI_WARN}" ;;
+    error) color="${COMMON__ANSI_ERROR}" ;;
+    debug) color="${COMMON__ANSI_DEBUG}" ;;
+  esac
+
+  local formatted="[$timestamp] [${level^^}] ${message}"
+  if [[ "${level}" == "info" ]]; then
+    printf '%s%s%s\n' "${color}" "${formatted}" "${COMMON__ANSI_RESET}"
+  else
+    printf '%s%s%s\n' "${color}" "${formatted}" "${COMMON__ANSI_RESET}" >&2
+  fi
+}
+
+# Internal helper: determine absolute script path.
+common::__resolve_script_path() {
+  local source="${BASH_SOURCE[1]:-${BASH_SOURCE[0]}}"
+  if [[ -z "${source}" ]]; then
+    pwd
+    return
+  fi
+
+  if [[ "${source}" == /* ]]; then
+    printf '%s\n' "${source}"
+    return
+  fi
+
+  printf '%s\n' "$(cd "$(dirname "${source}")" && pwd)/$(basename "${source}")"
+}
diff --git a/scripts/lib/http.sh b/scripts/lib/http.sh
new file mode 100644
index 000000000..4a967ae31
--- /dev/null
+++ b/scripts/lib/http.sh
@@ -0,0 +1,284 @@
+#!/usr/bin/env bash
+#
+# HTTP helpers for Pulse shell scripts (downloads, API calls, GitHub queries).
+
+set -euo pipefail
+
+# Ensure common library is loaded when sourced directly.
+if ! declare -F common::log_info >/dev/null 2>&1; then
+  # shellcheck disable=SC1091
+  source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/common.sh"
+fi
+
+declare -g HTTP_DEFAULT_RETRIES="${HTTP_DEFAULT_RETRIES:-3}"
+declare -g HTTP_DEFAULT_BACKOFF="${HTTP_DEFAULT_BACKOFF:-1 3 5}"
+
+# http::detect_download_tool
+# Emits the preferred download tool (curl/wget) or fails if neither exist.
+http::detect_download_tool() {
+  if command -v curl >/dev/null 2>&1; then
+    printf 'curl\n'
+    return 0
+  fi
+  if command -v wget >/dev/null 2>&1; then
+    printf 'wget\n'
+    return 0
+  fi
+  return 1
+}
+
+# http::download --url URL --output PATH [--insecure] [--quiet] [--header "Name: value"]
+#               [--retries N] [--backoff "1 3 5"]
+# Downloads the specified URL to PATH using curl or wget.
+http::download() {
+  local url=""
+  local output=""
+  local insecure=false
+  local quiet=false
+  local retries="${HTTP_DEFAULT_RETRIES}"
+  local backoff="${HTTP_DEFAULT_BACKOFF}"
+  local -a headers=()
+
+  while (($#)); do
+    case "$1" in
+      --url)
+        url="$2"
+        shift 2
+        ;;
+      --output)
+        output="$2"
+        shift 2
+        ;;
+      --insecure)
+        insecure=true
+        shift
+        ;;
+      --quiet)
+        quiet=true
+        shift
+        ;;
+      --header)
+        headers+=("$2")
+        shift 2
+        ;;
+      --retries)
+        retries="$2"
+        shift 2
+        ;;
+      --backoff)
+        backoff="$2"
+        shift 2
+        ;;
+      *)
+        common::log_warn "Unknown flag for http::download: $1"
+        shift
+        ;;
+    esac
+  done
+
+  if [[ -z "${url}" || -z "${output}" ]]; then
+    common::fail "http::download requires --url and --output"
+  fi
+
+  if common::is_dry_run; then
+    common::log_info "[dry-run] Download ${url} -> ${output}"
+    return 0
+  fi
+
+  local tool
+  if ! tool="$(http::detect_download_tool)"; then
+    common::fail "No download tool available (install curl or wget)"
+  fi
+
+  mkdir -p "$(dirname "${output}")"
+
+  local -a cmd
+  if [[ "${tool}" == "curl" ]]; then
+    cmd=(curl -fL --connect-timeout 15)
+    if [[ "${quiet}" == true ]]; then
+      cmd+=(-sS)
+    else
+      cmd+=(--progress-bar)
+    fi
+    if [[ "${insecure}" == true ]]; then
+      cmd+=(-k)
+    fi
+    local header
+    for header in "${headers[@]}"; do
+      cmd+=(-H "${header}")
+    done
+    cmd+=(-o "${output}" "${url}")
+  else
+    cmd=(wget --tries=3)
+    if [[ "${quiet}" == true ]]; then
+      cmd+=(-q)
+    else
+      cmd+=(--progress=bar:force)
+    fi
+    if [[ "${insecure}" == true ]]; then
+      cmd+=(--no-check-certificate)
+    fi
+    local header
+    for header in "${headers[@]}"; do
+      cmd+=(--header="${header}")
+    done
+    cmd+=(-O "${output}" "${url}")
+  fi
+
+  local -a run_args=(--label "download ${url}")
+  [[ -n "${retries}" ]] && run_args+=(--retries "${retries}")
+  [[ -n "${backoff}" ]] && run_args+=(--backoff "${backoff}")
+
+  common::run "${run_args[@]}" -- "${cmd[@]}"
+}
+
+# http::api_call --url URL [--method METHOD] [--token TOKEN] [--bearer TOKEN]
+#                [--body DATA] [--header "Name: value"] [--insecure]
+# Performs an API request and prints the response body.
+http::api_call() {
+  local url=""
+  local method="GET"
+  local token=""
+  local bearer=""
+  local body=""
+  local insecure=false
+  local -a headers=()
+
+  while (($#)); do
+    case "$1" in
+      --url)
+        url="$2"
+        shift 2
+        ;;
+      --method)
+        method="$2"
+        shift 2
+        ;;
+      --token)
+        token="$2"
+        shift 2
+        ;;
+      --bearer)
+        bearer="$2"
+        shift 2
+        ;;
+      --body)
+        body="$2"
+        shift 2
+        ;;
+      --header)
+        headers+=("$2")
+        shift 2
+        ;;
+      --insecure)
+        insecure=true
+        shift
+        ;;
+      *)
+        common::log_warn "Unknown flag for http::api_call: $1"
+        shift
+        ;;
+    esac
+  done
+
+  if [[ -z "${url}" ]]; then
+    common::fail "http::api_call requires --url"
+  fi
+
+  if common::is_dry_run; then
+    common::log_info "[dry-run] API ${method} ${url}"
+    return 0
+  fi
+
+  local tool
+  if ! tool="$(http::detect_download_tool)"; then
+    common::fail "No HTTP client available (install curl or wget)"
+  fi
+
+  local -a cmd
+  if [[ "${tool}" == "curl" ]]; then
+    cmd=(curl -fsSL)
+    [[ "${insecure}" == true ]] && cmd+=(-k)
+    [[ -n "${method}" ]] && cmd+=(-X "${method}")
+    if [[ -n "${body}" ]]; then
+      cmd+=(-d "${body}")
+    fi
+    if [[ -n "${token}" ]]; then
+      headers+=("X-API-Token: ${token}")
+    fi
+    if [[ -n "${bearer}" ]]; then
+      headers+=("Authorization: Bearer ${bearer}")
+    fi
+    local header
+    for header in "${headers[@]}"; do
+      cmd+=(-H "${header}")
+    done
+    cmd+=("${url}")
+  else
+    cmd=(wget -qO-)
+    [[ "${insecure}" == true ]] && cmd+=(--no-check-certificate)
+    [[ -n "${method}" ]] && cmd+=(--method="${method}")
+    if [[ -n "${body}" ]]; then
+      cmd+=(--body-data="${body}")
+    fi
+    if [[ -n "${token}" ]]; then
+      cmd+=(--header="X-API-Token: ${token}")
+    fi
+    if [[ -n "${bearer}" ]]; then
+      cmd+=(--header="Authorization: Bearer ${bearer}")
+    fi
+    local header
+    for header in "${headers[@]}"; do
+      cmd+=(--header="${header}")
+    done
+    cmd+=("${url}")
+  fi
+
+  common::run_capture --label "api ${method} ${url}" -- "${cmd[@]}"
+}
+
+# http::get_github_latest_release owner/repo
+# Echoes the latest release tag for a GitHub repository.
+http::get_github_latest_release() {
+  local repo="${1:-}"
+  if [[ -z "${repo}" ]]; then
+    common::fail "http::get_github_latest_release requires owner/repo argument"
+  fi
+
+  local response
+  response="$(http::api_call --url "https://api.github.com/repos/${repo}/releases/latest" --header "Accept: application/vnd.github+json" 2>/dev/null || true)"
+  if [[ -z "${response}" ]]; then
+    return 1
+  fi
+
+  if [[ "${response}" =~ \"tag_name\"[[:space:]]*:[[:space:]]*\"([^\"]+)\" ]]; then
+    printf '%s\n' "${BASH_REMATCH[1]}"
+    return 0
+  fi
+
+  if [[ "${response}" =~ \"name\"[[:space:]]*:[[:space:]]*\"([^\"]+)\" ]]; then
+    printf '%s\n' "${BASH_REMATCH[1]}"
+    return 0
+  fi
+
+  common::log_warn "Unable to parse GitHub release tag for ${repo}"
+  return 1
+}
+
+# http::parse_bool value
+# Parses truthy/falsy strings and prints canonical true/false.
+http::parse_bool() {
+  local input="${1:-}"
+  local lowered="${input,,}"
+  case "${lowered}" in
+    1|true|yes|y|on)
+      printf 'true\n'
+      return 0
+      ;;
+    0|false|no|n|off|"")
+      printf 'false\n'
+      return 0
+      ;;
+  esac
+  return 1
+}
diff --git a/scripts/lib/systemd.sh b/scripts/lib/systemd.sh
new file mode 100644
index 000000000..e72af242f
--- /dev/null
+++ b/scripts/lib/systemd.sh
@@ -0,0 +1,188 @@
+#!/usr/bin/env bash
+#
+# Systemd management helpers for Pulse shell scripts.
+
+set -euo pipefail
+
+# Ensure the common library is available when sourced directly.
+if ! declare -F common::log_info >/dev/null 2>&1; then
+  # shellcheck disable=SC1091
+  source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/common.sh"
+fi
+
+declare -g SYSTEMD_TIMEOUT_SEC="${SYSTEMD_TIMEOUT_SEC:-20}"
+
+# systemd::safe_systemctl args...
+# Executes systemctl with sensible defaults and optional timeout guards.
+systemd::safe_systemctl() {
+  if ! command -v systemctl >/dev/null 2>&1; then
+    common::fail "systemctl not available on this host"
+  fi
+
+  local -a cmd
+  systemd::__build_cmd cmd "$@"
+  systemd::__wrap_timeout cmd
+
+  local label="systemctl $*"
+  common::run --label "${label}" -- "${cmd[@]}"
+}
+
+# systemd::detect_service_name [service...]
+# Returns the first existing service name from the provided list.
+systemd::detect_service_name() {
+  local -a candidates=("$@")
+  if ((${#candidates[@]} == 0)); then
+    candidates=(pulse.service pulse-backend.service pulse-docker-agent.service pulse-hot-dev.service)
+  fi
+
+  local name
+  for name in "${candidates[@]}"; do
+    if systemd::service_exists "${name}"; then
+      printf '%s\n' "$(systemd::__normalize_unit "${name}")"
+      return 0
+    fi
+  done
+  return 1
+}
+
+# systemd::service_exists service
+# Returns success if the given service unit exists.
+systemd::service_exists() {
+  local unit
+  unit="$(systemd::__normalize_unit "${1:-}")" || return 1
+
+  if command -v systemctl >/dev/null 2>&1 && ! common::is_dry_run; then
+    local -a cmd
+    systemd::__build_cmd cmd "list-unit-files" "${unit}"
+    systemd::__wrap_timeout cmd
+    local output=""
+    if output="$("${cmd[@]}" 2>/dev/null)"; then
+      [[ "${output}" =~ ^${unit}[[:space:]] ]] && return 0
+    fi
+  fi
+
+  local paths=(
+    "/etc/systemd/system/${unit}"
+    "/lib/systemd/system/${unit}"
+    "/usr/lib/systemd/system/${unit}"
+  )
+  local path
+  for path in "${paths[@]}"; do
+    if [[ -f "${path}" ]]; then
+      return 0
+    fi
+  done
+  return 1
+}
+
+# systemd::is_active service
+# Checks whether the given service is active.
+systemd::is_active() {
+  local unit
+  unit="$(systemd::__normalize_unit "${1:-}")" || return 1
+
+  if common::is_dry_run; then
+    return 1
+  fi
+
+  if ! command -v systemctl >/dev/null 2>&1; then
+    return 1
+  fi
+
+  local -a cmd
+  systemd::__build_cmd cmd "is-active" "--quiet" "${unit}"
+  systemd::__wrap_timeout cmd
+  if "${cmd[@]}" >/dev/null 2>&1; then
+    return 0
+  fi
+  return 1
+}
+
+# systemd::create_service /path/to/unit.service
+# Reads unit file content from stdin and writes it to the supplied path.
+systemd::create_service() {
+  local target="${1:-}"
+  local mode="${2:-0644}"
+  if [[ -z "${target}" ]]; then
+    common::fail "systemd::create_service requires a target path"
+  fi
+
+  local content
+  content="$(cat)"
+
+  if common::is_dry_run; then
+    common::log_info "[dry-run] Would write systemd unit ${target}"
+    common::log_debug "${content}"
+    return 0
+  fi
+
+  mkdir -p "$(dirname "${target}")"
+  printf '%s' "${content}" > "${target}"
+  chmod "${mode}" "${target}"
+  common::log_info "Wrote unit file: ${target}"
+}
+
+# systemd::enable_and_start service
+# Reloads systemd, enables, and starts the given service.
+systemd::enable_and_start() {
+  local unit
+  unit="$(systemd::__normalize_unit "${1:-}")" || common::fail "Invalid systemd unit name"
+
+  systemd::safe_systemctl daemon-reload
+  systemd::safe_systemctl enable "${unit}"
+  systemd::safe_systemctl start "${unit}"
+}
+
+# systemd::restart service
+# Safely restarts the given service.
+systemd::restart() {
+  local unit
+  unit="$(systemd::__normalize_unit "${1:-}")" || common::fail "Invalid systemd unit name"
+  systemd::safe_systemctl restart "${unit}"
+}
+
+# Internal: build systemctl command array.
+systemd::__build_cmd() {
+  local -n ref=$1
+  shift
+  ref=("systemctl" "--no-ask-password" "--no-pager")
+  ref+=("$@")
+}
+
+# Internal: wrap command with timeout if necessary.
+systemd::__wrap_timeout() {
+  local -n ref=$1
+  if ! command -v timeout >/dev/null 2>&1; then
+    return
+  fi
+  if systemd::__should_timeout; then
+    local -a wrapped=("timeout" "${SYSTEMD_TIMEOUT_SEC}s")
+    wrapped+=("${ref[@]}")
+    ref=("${wrapped[@]}")
+  fi
+}
+
+# Internal: determine if we are in a container environment.
+systemd::__should_timeout() {
+  if [[ -f /run/systemd/container ]]; then
+    return 0
+  fi
+  if command -v systemd-detect-virt >/dev/null 2>&1; then
+    if systemd-detect-virt --quiet --container; then
+      return 0
+    fi
+  fi
+  return 1
+}
+
+# Internal: normalize service names to include .service suffix.
+systemd::__normalize_unit() {
+  local unit="${1:-}"
+  if [[ -z "${unit}" ]]; then
+    return 1
+  fi
+  if [[ "${unit}" != *.service ]]; then
+    unit="${unit}.service"
+  fi
+  printf '%s\n' "${unit}"
+}
diff --git a/scripts/tests/integration/README.md b/scripts/tests/integration/README.md
new file mode 100644
index 000000000..3866d62bd
--- /dev/null
+++ b/scripts/tests/integration/README.md
@@ -0,0 +1,45 @@
+# Integration Tests
+
+The scripts in this directory exercise the Pulse installer scripts inside isolated
+environments (typically Linux containers). They are intended to catch regressions
+that unit-style smoke tests cannot detect (e.g., filesystem layout, systemd unit
+generation, binary placement).
+
+## Prerequisites
+
+- Docker or another container runtime supported by the test script. When Docker
+  is unavailable the test will skip gracefully.
+- Internet access is **not** required; HTTP interactions are stubbed.
+
+## Running the Docker Agent Installer Test
+
+```bash
+scripts/tests/integration/test-docker-agent-install.sh
+```
+
+The script will:
+
+1. Launch an Ubuntu 22.04 container (when Docker is available).
+2. Inject lightweight stubs for `systemctl`, `docker`, `curl`, and `wget`.
+3. Execute the refactored installer through several scenarios (dry run,
+   full install, missing Docker handling, multi-target configuration, uninstall).
+
+The container is discarded automatically, and no files are written to the host
+outside of the repository.
+
+## Adding New Integration Tests
+
+1. Place new test scripts in this directory. They should follow the pattern of
+   detecting required tooling, skipping when prerequisites are missing, and
+   producing clear PASS/FAIL output.
+2. Prefer running inside an ephemeral container to avoid modifying the host
+   system.
+3. Use repository-relative paths (`/workspace` inside the container) and avoid
+   relying on network resources.
+4. Clean up all temporary files even when the test fails (use traps).
+
+## Reporting
+
+Each integration script is self-contained and prints a concise summary at the
+end. CI jobs or developers can invoke them individually without modifying
+the top-level smoke test harness.
diff --git a/scripts/tests/integration/test-docker-agent-install.sh b/scripts/tests/integration/test-docker-agent-install.sh
new file mode 100755
index 000000000..7811bad39
--- /dev/null
+++ b/scripts/tests/integration/test-docker-agent-install.sh
@@ -0,0 +1,277 @@
+#!/usr/bin/env bash
+# Integration test for install-docker-agent-v2.sh
+
+set -euo pipefail
+
+PROJECT_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../../.." && pwd)"
+CONTAINER_IMAGE="${INTEGRATION_DOCKER_IMAGE:-ubuntu:22.04}"
+log() {
+  printf '[integration] %s\n' "$*"
+}
+
+if ! command -v docker >/dev/null 2>&1; then
+  log "Docker not available. Skipping docker-agent integration tests."
+  exit 0
+fi
+
+log "Running docker-agent installer integration tests in ${CONTAINER_IMAGE}"
+
+container_script="$(mktemp -t pulse-docker-agent-integ-XXXXXX.sh)"
+trap 'rm -f "${container_script}"' EXIT
+
+cat <<'EOS' >"${container_script}"
+#!/usr/bin/env bash
+set -euo pipefail
+
+INSTALLER_SCRIPT="/workspace/scripts/install-docker-agent-v2.sh"
+STUB_DIR=/tmp/installer-stubs
+mkdir -p "${STUB_DIR}"
+
+create_systemctl_stub() {
+  cat <<'EOF' >"${STUB_DIR}/systemctl"
+#!/usr/bin/env bash
+set -eo pipefail
+
+cmd=""
+for arg in "$@"; do
+  case "$arg" in
+    list-unit-files|is-active|daemon-reload|enable|start|stop|disable|restart)
+      cmd="$arg"
+      shift
+      break
+      ;;
+  esac
+  shift || true
+done
+
+case "$cmd" in
+  list-unit-files)
+    exit 1
+    ;;
+  is-active)
+    unit=""
+    for arg in "$@"; do
+      case "$arg" in
+        --*) ;;
+        *) unit="$arg"; break ;;
+      esac
+    done
+    if [[ -n "$unit" && -f "/etc/systemd/system/$unit" ]]; then
+      exit 0
+    fi
+    exit 3
+    ;;
+  *)
+    exit 0
+    ;;
+esac
+EOF
+  chmod +x "${STUB_DIR}/systemctl"
+}
+
+create_curl_stub() {
+  cat <<'EOF' >"${STUB_DIR}/curl"
+#!/usr/bin/env bash
+set -eo pipefail
+
+outfile=""
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    -o|--output)
+      outfile="$2"; shift 2;;
+    -H|-d|-X|--header|--data|--request|--url)
+      shift 2;;
+    -f|-s|-S|-L|-k|--progress-bar|--connect-timeout|--retry|--retry-delay|--silent)
+      shift;;
+    *)
+      shift;;
+  esac
+done
+
+if [[ -n "${outfile:-}" ]]; then
+  cat <<'SCRIPT' >"$outfile"
+#!/usr/bin/env bash
+if [[ "$1" == "--help" ]]; then
+  echo "--no-auto-update"
+fi
+exit 0
+SCRIPT
+  chmod +x "$outfile"
+else
+  printf '{"ok":true}\n'
+fi
+EOF
+  chmod +x "${STUB_DIR}/curl"
+}
+
+create_wget_stub() {
+  cat <<'EOF' >"${STUB_DIR}/wget"
+#!/usr/bin/env bash
+set -eo pipefail
+
+outfile=""
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    -O|--output-document)
+      outfile="$2"; shift 2;;
+    --header|--method|--body-data)
+      shift 2;;
+    -q|--quiet|--show-progress|--no-check-certificate)
+      shift;;
+    *)
+      shift;;
+  esac
+done
+
+if [[ -n "${outfile:-}" ]]; then
+  cat <<'SCRIPT' >"$outfile"
+#!/usr/bin/env bash
+if [[ "$1" == "--help" ]]; then
+  echo "--no-auto-update"
+fi
+exit 0
+SCRIPT
+  chmod +x "$outfile"
+else
+  printf '{"ok":true}\n'
+fi
+EOF
+  chmod +x "${STUB_DIR}/wget"
+}
+
+create_docker_stub() {
+  cat <<'EOF' >"${STUB_DIR}/docker"
+#!/usr/bin/env bash
+set -eo pipefail
+
+if [[ "${1:-}" == "info" ]]; then
+  if [[ "${2:-}" == "--format" ]]; then
+    printf 'stub-host-id\n'
+  else
+    printf '{}\n'
+  fi
+  exit 0
+fi
+exit 0
+EOF
+  chmod +x "${STUB_DIR}/docker"
+}
+
+create_stubs() {
+  create_systemctl_stub
+  create_curl_stub
+  create_wget_stub
+  create_docker_stub
+  export PATH="${STUB_DIR}:$PATH"
+}
+
+assert_file_contains() {
+  local file=$1
+  local expected=$2
+  if ! grep -Fq "$expected" "$file"; then
+    echo "Expected to find \"$expected\" in $file" >&2
+    exit 1
+  fi
+}
+
+test_dry_run() {
+  echo "== Dry-run scenario =="
+  set +e
+  output="$(PULSE_FORCE_INTERACTIVE=1 PATH="${STUB_DIR}:$PATH" bash "${INSTALLER_SCRIPT}" --dry-run --url http://primary.local --token token123 2>&1)"
+  status=$?
+  set -e
+  if [[ $status -ne 0 ]]; then
+    echo "$output"
+    echo "dry-run failed"
+    exit 1
+  fi
+  if [[ "$output" != *"[dry-run]"* ]]; then
+    echo "$output"
+    echo "dry-run output missing markers"
+    exit 1
+  fi
+}
+
+test_install_basic() {
+  echo "== Basic installation =="
+  rm -f /usr/local/bin/pulse-docker-agent /etc/systemd/system/pulse-docker-agent.service
+  PULSE_FORCE_INTERACTIVE=1 PATH="${STUB_DIR}:$PATH" bash "${INSTALLER_SCRIPT}" --url http://primary.local --token token123 --interval 15s >/tmp/install.log 2>&1
+  test -f /usr/local/bin/pulse-docker-agent
+  test -f /etc/systemd/system/pulse-docker-agent.service
+  assert_file_contains /etc/systemd/system/pulse-docker-agent.service "Environment=\"PULSE_URL=http://primary.local\""
+  assert_file_contains /etc/systemd/system/pulse-docker-agent.service "ExecStart=/usr/local/bin/pulse-docker-agent --url \"http://primary.local\" --interval \"15s\""
+}
+
+test_install_without_docker() {
+  echo "== Installation without docker binary =="
+  mv "${STUB_DIR}/docker" "${STUB_DIR}/docker.disabled"
+  set +e
+  output="$(printf 'y\n' | PULSE_FORCE_INTERACTIVE=1 PATH="${STUB_DIR}:$PATH" bash "${INSTALLER_SCRIPT}" --dry-run --url http://nodocker.local --token token456 2>&1)"
+  status=${PIPESTATUS[1]:-0}
+  set -e
+  mv "${STUB_DIR}/docker.disabled" "${STUB_DIR}/docker"
+  if [[ $status -ne 0 ]]; then
+    echo "$output"
+    echo "dry-run without docker failed"
+    exit 1
+  fi
+  if [[ "$output" != *"Docker not found"* ]]; then
+    echo "$output"
+    echo "expected docker warning"
+    exit 1
+  fi
+}
+
+test_multi_target() {
+  echo "== Multi-target installation =="
+  rm -f /usr/local/bin/pulse-docker-agent /etc/systemd/system/pulse-docker-agent.service
+  PULSE_FORCE_INTERACTIVE=1 PATH="${STUB_DIR}:$PATH" bash "${INSTALLER_SCRIPT}" \
+    --url http://primary.local \
+    --token token789 \
+    --target 'https://target.one|tok1' \
+    --target 'https://target.two|tok2' \
+    >/tmp/install-multi.log 2>&1
+  if [[ ! -f /etc/systemd/system/pulse-docker-agent.service ]]; then
+    echo "ERROR: Service file doesn't exist!" >&2
+    exit 1
+  fi
+
+  echo "Service file contents:"
+  cat /etc/systemd/system/pulse-docker-agent.service
+
+  assert_file_contains /etc/systemd/system/pulse-docker-agent.service 'PULSE_TARGETS='
+}
+
+test_uninstall() {
+  echo "== Uninstall =="
+  PATH="${STUB_DIR}:$PATH" bash "${INSTALLER_SCRIPT}" --uninstall >/tmp/uninstall.log 2>&1
+  if [[ -f /etc/systemd/system/pulse-docker-agent.service ]]; then
+    echo "service file still present after uninstall" >&2
+    exit 1
+  fi
+  if [[ -f /usr/local/bin/pulse-docker-agent ]]; then
+    echo "agent binary still present after uninstall" >&2
+    exit 1
+  fi
+}
+
+create_stubs
+test_dry_run
+test_install_basic
+test_install_without_docker
+test_multi_target
+test_uninstall
+
+echo "All docker-agent installer integration scenarios passed."
+EOS
+
+chmod +x "${container_script}"
+
+docker run --rm \
+  -v "${PROJECT_ROOT}:/workspace:ro" \
+  -v "${container_script}:/tmp/integration-test.sh:ro" \
+  -w /workspace \
+  "${CONTAINER_IMAGE}" \
+  bash /tmp/integration-test.sh
+
+log "Integration testing complete."
diff --git a/scripts/tests/run.sh b/scripts/tests/run.sh
new file mode 100755
index 000000000..7c8dd9189
--- /dev/null
+++ b/scripts/tests/run.sh
@@ -0,0 +1,101 @@
+#!/usr/bin/env bash
+#
+# Simple harness to execute shell-based smoke tests under scripts/tests/.
+
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+TEST_DIR="${ROOT_DIR}/scripts/tests"
+
+usage() {
+  cat <<'EOF'
+Usage: scripts/tests/run.sh [test-script ...]
+
+Run all scripts/tests/test-*.sh tests or a subset when specified.
+EOF
+}
+
+discover_tests() {
+  local -n ref=$1
+  mapfile -t ref < <(find "${TEST_DIR}" -maxdepth 1 -type f -name 'test-*.sh' | sort)
+}
+
+resolve_test_path() {
+  local input="$1"
+  if [[ "${input}" == /* ]]; then
+    printf '%s\n' "${input}"
+    return 0
+  fi
+
+  if [[ -f "${TEST_DIR}/${input}" ]]; then
+    printf '%s\n' "${TEST_DIR}/${input}"
+    return 0
+  fi
+
+  if [[ -f "${input}" ]]; then
+    printf '%s\n' "${input}"
+    return 0
+  fi
+
+  return 1
+}
+
+run_tests() {
+  local -a tests=("$@")
+  local total=0
+  local passed=0
+  local failed=0
+
+  for test in "${tests[@]}"; do
+    ((total += 1))
+    local display="${test#${ROOT_DIR}/}"
+    printf '==> %s\n' "${display}"
+    if (cd "${ROOT_DIR}" && "${test}"); then
+      echo "PASS"
+      ((passed += 1))
+    else
+      echo "FAIL"
+      ((failed += 1))
+    fi
+    echo
+  done
+
+  echo "Summary: ${passed}/${total} passed"
+  if (( failed > 0 )); then
+    echo "Failures: ${failed}"
+    return 1
+  fi
+  return 0
+}
+
+main() {
+  if [[ $# -gt 0 ]]; then
+    if [[ "$1" == "-h" || "$1" == "--help" ]]; then
+      usage
+      exit 0
+    fi
+  fi
+
+  local -a tests=()
+  if [[ $# -gt 0 ]]; then
+    local arg resolved
+    for arg in "$@"; do
+      if ! resolved="$(resolve_test_path "${arg}")"; then
+        echo "Unknown test: ${arg}" >&2
+        exit 1
+      fi
+      tests+=("${resolved}")
+    done
+  else
+    discover_tests tests
+  fi
+
+  if [[ ${#tests[@]} -eq 0 ]]; then
+    echo "No tests found under ${TEST_DIR}" >&2
+    exit 1
+  fi
+
+  run_tests "${tests[@]}"
+}
+
+main "$@"
diff --git a/scripts/tests/test-common-lib.sh b/scripts/tests/test-common-lib.sh
new file mode 100755
index 000000000..a51a89d6c
--- /dev/null
+++ b/scripts/tests/test-common-lib.sh
@@ -0,0 +1,118 @@
+#!/usr/bin/env bash
+#
+# Smoke test for scripts/lib/common.sh functionality.
+
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+COMMON_LIB="${ROOT_DIR}/scripts/lib/common.sh"
+
+if [[ ! -f "${COMMON_LIB}" ]]; then
+  echo "common.sh not found at ${COMMON_LIB}" >&2
+  exit 1
+fi
+
+# shellcheck disable=SC1090
+source "${COMMON_LIB}"
+
+export PULSE_NO_COLOR=1
+common::init "$0"
+
+failures=0
+
+assert_success() {
+  local desc="$1"
+  shift
+  if "$@"; then
+    echo "[PASS] ${desc}"
+    return 0
+  else
+    echo "[FAIL] ${desc}" >&2
+    ((failures++))
+    return 1
+  fi
+}
+
+test_functions_exist() {
+  local missing=0
+  local fn
+  for fn in \
+    common::init \
+    common::log_info \
+    common::log_warn \
+    common::log_error \
+    common::log_debug \
+    common::fail \
+    common::require_command \
+    common::is_interactive \
+    common::ensure_root \
+    common::sudo_exec \
+    common::run \
+    common::run_capture \
+    common::temp_dir \
+    common::cleanup_push \
+    common::cleanup_run \
+    common::set_dry_run \
+    common::is_dry_run; do
+    if ! declare -F -- "${fn}" >/dev/null 2>&1; then
+      echo "Missing function definition: ${fn}" >&2
+      missing=1
+    fi
+  done
+  [[ "${missing}" -eq 0 ]]
+}
+
+test_logging() {
+  local info_output debug_output warn_output
+  info_output="$(common::log_info "common-log-info-test")"
+  [[ "${info_output}" == *"common-log-info-test"* ]] || return 1
+
+  debug_output="$(common::log_debug "common-log-debug-test" 2>&1)"
+  [[ -z "${debug_output}" ]] || return 1
+
+  warn_output="$(common::log_warn "common-log-warn-test" 2>&1)"
+  [[ "${warn_output}" == *"common-log-warn-test"* ]] || return 1
+}
+
+test_dry_run() {
+  local tmpfile
+  tmpfile="$(mktemp)"
+  rm -f "${tmpfile}"
+  common::set_dry_run true
+  common::run --label "dry-run-touch" touch "${tmpfile}"
+  common::set_dry_run false
+  [[ ! -e "${tmpfile}" ]]
+}
+
+test_interactive_detection() {
+  # Ensure the function returns success when forced.
+  if PULSE_FORCE_INTERACTIVE=1 common::is_interactive; then
+    return 0
+  fi
+  return 1
+}
+
+test_temp_dir_cleanup() {
+  local tmp_dir=""
+  common::temp_dir tmp_dir --prefix pulse-test-common-
+  [[ -d "${tmp_dir}" ]] || return 1
+  common::cleanup_run
+  [[ ! -d "${tmp_dir}" ]]
+}
+
+main() {
+  assert_success "functions exist" test_functions_exist
+  assert_success "logging output" test_logging
+  assert_success "dry-run support" test_dry_run
+  assert_success "interactive detection" test_interactive_detection
+  assert_success "temp dir cleanup" test_temp_dir_cleanup
+
+  if (( failures > 0 )); then
+    echo "Total failures: ${failures}" >&2
+    return 1
+  fi
+
+  echo "All common.sh smoke tests passed."
+}
+
+main "$@"
diff --git a/scripts/tests/test-docker-agent-v2.sh b/scripts/tests/test-docker-agent-v2.sh
new file mode 100755
index 000000000..f0133598c
--- /dev/null
+++ b/scripts/tests/test-docker-agent-v2.sh
@@ -0,0 +1,85 @@
+#!/usr/bin/env bash
+# Smoke tests for install-docker-agent-v2.sh
+
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+SCRIPT_PATH="${ROOT_DIR}/scripts/install-docker-agent-v2.sh"
+TEST_NAME="install-docker-agent-v2"
+
+if [[ ! -f "${SCRIPT_PATH}" ]]; then
+  echo "Missing script at ${SCRIPT_PATH}" >&2
+  exit 1
+fi
+
+TMP_DIR="$(mktemp -d "${TMPDIR:-/tmp}/pulse-test-XXXXXX")"
+trap 'rm -rf "${TMP_DIR}"' EXIT
+
+pass_count=0
+fail_count=0
+
+log_pass() {
+  echo "[PASS] $1"
+  ((pass_count++))
+  return 0
+}
+
+log_fail() {
+  echo "[FAIL] $1" >&2
+  ((fail_count++))
+  return 1
+}
+
+run_test() {
+  local desc="$1"
+  shift
+  if "$@"; then
+    log_pass "$desc"
+  else
+    local status=$?
+    log_fail "$desc (exit ${status})"
+  fi
+}
+
+set +e
+run_test "syntax check" bash -n "${SCRIPT_PATH}"
+set -e
+
+# Test dry-run output captures action hints
+set +e
+DRY_RUN_OUTPUT="$("${SCRIPT_PATH}" --dry-run --url http://test.local --token testtoken 2>&1)"
+DRY_STATUS=$?
+set -e
+if (( DRY_STATUS == 0 )) && [[ "${DRY_RUN_OUTPUT}" == *"[dry-run]"* ]]; then
+  log_pass "dry-run outputs actions"
+else
+  log_fail "dry-run outputs actions"
+  echo "${DRY_RUN_OUTPUT}"
+fi
+
+if (( DRY_STATUS == 0 )); then
+  log_pass "dry-run exits successfully"
+else
+  log_fail "dry-run exits successfully (exit ${DRY_STATUS})"
+  echo "${DRY_RUN_OUTPUT}"
+fi
+
+# Test argument validation (missing token)
+MISSING_TOKEN_LOG="${TMP_DIR}/missing-token.log"
+set +e
+"${SCRIPT_PATH}" --dry-run --url http://test.local >"${MISSING_TOKEN_LOG}" 2>&1
+ARG_STATUS=$?
+set -e
+if (( ARG_STATUS == 0 )); then
+  log_fail "missing token rejected"
+  cat "${MISSING_TOKEN_LOG}"
+else
+  log_pass "missing token rejected"
+fi
+
+if (( fail_count > 0 )); then
+  echo "${TEST_NAME}: ${fail_count} failures" >&2
+  exit 1
+fi
+
+echo "All ${TEST_NAME} tests passed (${pass_count})"