Merge branch 'main' into t8989_vyos_vrft8989_vyos_vrf

6 files changed, 1705 insertions, 1460 deletions

diff --git a/plugins/module_utils/vyos.py b/plugins/module_utils/vyos.py
index 82e9727..382394b 100644
--- a/plugins/module_utils/vyos.py
+++ b/plugins/module_utils/vyos.py
@@ -320,7 +320,8 @@ class VyOSModule:
         that's actually already correct.
         """
         result = self._client.retrieve_return_value(path)
-        return result.get("data") or ""
+        data = result.get("data")
+        return "" if data is None else data
 
     def apply_commands(self, commands):
         if not commands:
@@ -372,7 +373,8 @@ class VyOSModule:
         rather than being indistinguishable from a valid empty response.
         """
         result = self._client.show(path)
-        return result.get("data") or ""
+        data = result.get("data")
+        return "" if data is None else data
 
     def save_config(self, file_path=None):
         """Save the running configuration to disk."""
diff --git a/plugins/modules/vyos_l3_interfaces.py b/plugins/modules/vyos_l3_interfaces.py
index 9b33973..c9c6deb 100644
--- a/plugins/modules/vyos_l3_interfaces.py
+++ b/plugins/modules/vyos_l3_interfaces.py
@@ -14,7 +14,13 @@ short_description: Manage L3 interface configuration on VyOS devices via REST AP
 description:
   - Manages IPv4 and IPv6 address configuration on VyOS interfaces using the
     HTTPS REST API.
-  - Mirrors C(vyos.vyos.vyos_l3_interfaces) but uses the HTTP API instead of CLI.
+  - >-
+    L2 attributes (description, mtu, duplex, speed, vrf) and VIF
+    presence/L2 attributes are owned by M(vyos.rest.vyos_interfaces), not
+    this module -- confirmed by design: a VIF's device path is shared
+    between the two modules, and this module's own commands only ever
+    touch the C(address) leaf within it, never the VIF subtree as a whole
+    or any of vyos_interfaces' own fields.
 version_added: "1.0.0"
 author:
   - VyOS Community (@vyos)
@@ -71,9 +77,6 @@ options:
               address:
                 description: IPv6 address in CIDR notation, C(dhcpv6), or C(auto-config).
                 type: str
-  running_config:
-    description: Used only with state C(parsed).
-    type: str
   state:
     description:
       - C(merged) - Add addresses without removing existing ones.
@@ -81,10 +84,8 @@ options:
       - C(overridden) - Replace addresses for all interfaces.
       - C(deleted) - Remove listed or all interface addresses.
       - C(gathered) - Read interface addresses from device without changes.
-      - C(rendered) - Return commands for provided config without connecting.
-      - C(parsed) - Parse running_config into structured data.
     type: str
-    choices: [merged, replaced, overridden, deleted, gathered, rendered, parsed]
+    choices: [merged, replaced, overridden, deleted, gathered]
     default: merged
 seealso:
   - module: vyos.vyos.vyos_l3_interfaces
@@ -142,14 +143,6 @@ gathered:
   description: Current L3 interface configuration as structured data.
   returned: when state is gathered
   type: list
-rendered:
-  description: Commands for the provided config (state=rendered).
-  returned: when state is rendered
-  type: list
-parsed:
-  description: Structured data parsed from running_config (state=parsed).
-  returned: when state is parsed
-  type: list
 saved:
   description: Whether the config was saved after changes.
   returned: when changes are applied
@@ -161,10 +154,16 @@ response:
 """
 
 from ansible.module_utils.basic import AnsibleModule
-from ansible_collections.vyos.rest.plugins.module_utils.vyos import VyOSModule
+from ansible_collections.vyos.rest.plugins.module_utils.vyos import VyOSModule, to_tag_dict
+
 
+_BASE = ["interfaces"]
 
-_IFACE_TYPE = {
+# Aligned with vyos_interfaces' own 11-type table -- confirmed
+# inconsistent in the original (missing ppp/wlan here specifically),
+# corrected for consistency between the two modules that share the
+# same interface namespace.
+_IFACE_TYPE_PREFIX = {
     "eth": "ethernet",
     "bond": "bonding",
     "lo": "loopback",
@@ -173,23 +172,42 @@ _IFACE_TYPE = {
     "vti": "vti",
     "dum": "dummy",
     "vtun": "openvpn",
+    "ppp": "pppoe",
+    "wlan": "wireless",
     "br": "bridge",
 }
 
 
-def _iface_type(name):
-    for prefix, itype in _IFACE_TYPE.items():
+def _guess_iface_type(name):
+    for prefix, itype in _IFACE_TYPE_PREFIX.items():
         if name.startswith(prefix):
             return itype
     return "ethernet"
 
 
-def _iface_base(name):
-    return ["interfaces", _iface_type(name), name]
+def _resolve_iface_type(name, raw_have):
+    """Prefer the real type from the device's own raw response over a
+    name-prefix guess -- only fall back to guessing for a brand-new
+    interface that doesn't exist on the device yet. Same fix as
+    vyos_interfaces' own confirmed bug: the original guessed
+    unconditionally, even for interfaces the device already knows the
+    real type of.
+    """
+    for itype, ifaces in (raw_have or {}).items():
+        if name in to_tag_dict(ifaces):
+            return itype
+    return _guess_iface_type(name)
+
+
+def _iface_base(name, raw_have):
+    return _BASE + [_resolve_iface_type(name, raw_have), name]
 
 
 def _addr_list(raw):
-    """Normalize address field — string or list → sorted list."""
+    """VyOS's address leaf collapses to a bare string for a single
+    value, or a list for multiple -- confirmed device behavior,
+    handled explicitly here since it's a plain multi-value leaf, not
+    a tag-node (to_tag_dict doesn't apply)."""
     if not raw:
         return []
     if isinstance(raw, str):
@@ -200,92 +218,105 @@ def _addr_list(raw):
 
 
 def _split_addresses(addresses):
-    """Split address list into ipv4 and ipv6 lists."""
     ipv4 = []
     ipv6 = []
     for addr in addresses:
-        if addr in ("dhcp", "dhcpv6"):
-            if addr == "dhcp":
-                ipv4.append(addr)
-            else:
-                ipv6.append(addr)
-        elif ":" in addr:
+        if addr == "dhcp":
+            ipv4.append(addr)
+        elif addr in ("dhcpv6", "auto-config") or ":" in addr:
             ipv6.append(addr)
         else:
             ipv4.append(addr)
     return sorted(ipv4), sorted(ipv6)
 
 
-def _parse_iface(name, idata):
-    """Parse raw API interface data into argspec format."""
-    idata = idata or {}
-    entry = {"name": name}
-
-    addrs = _addr_list(idata.get("address"))
-    if addrs:
-        ipv4, ipv6 = _split_addresses(addrs)
-        if ipv4:
-            entry["ipv4"] = [{"address": a} for a in ipv4]
-        if ipv6:
-            entry["ipv6"] = [{"address": a} for a in ipv6]
-
-    vif_data = idata.get("vif") or {}
-    if isinstance(vif_data, dict) and vif_data:
-        vifs = []
-        for vlan_id, vdata in sorted(vif_data.items(), key=lambda x: int(x[0])):
-            vdata = vdata or {}
-            vif = {"vlan_id": int(vlan_id)}
-            vaddrs = _addr_list(vdata.get("address"))
-            if vaddrs:
-                vipv4, vipv6 = _split_addresses(vaddrs)
-                if vipv4:
-                    vif["ipv4"] = [{"address": a} for a in vipv4]
-                if vipv6:
-                    vif["ipv6"] = [{"address": a} for a in vipv6]
-            vifs.append(vif)
-        if vifs:
-            entry["vifs"] = vifs
-
-    return entry
+def _parse_addr_entry(idata):
+    """Returns (ipv4_argspec_list, ipv6_argspec_list) for one address
+    leaf's raw value -- shared by both interface-level and vif-level
+    parsing."""
+    addrs = _addr_list((idata or {}).get("address"))
+    if not addrs:
+        return [], []
+    ipv4, ipv6 = _split_addresses(addrs)
+    return (
+        [{"address": a} for a in ipv4],
+        [{"address": a} for a in ipv6],
+    )
 
 
 def get_running_config(vyos):
-    raw = vyos.get_config(["interfaces"])
-    if not raw or not isinstance(raw, dict):
-        return []
+    """VyOS's REST API collapses a single-child tag node to a plain
+    string (or a list for multiple) -- confirmed as a real failure
+    mode during vyos_ospf_interfaces's build. Normalizing through
+    to_tag_dict unconditionally means callers always receive a
+    genuine dict.
+    """
+    return to_tag_dict(vyos.get_config(_BASE) or {})
+
 
+def _device_to_argspec(raw):
     result = []
-    for itype, ifaces in sorted(raw.items()):
-        if not isinstance(ifaces, dict):
-            continue
-        for iname, idata in sorted(ifaces.items()):
-            entry = _parse_iface(iname, idata)
-            # only include if there's at least one address or vif
+    for itype, ifaces in sorted((raw or {}).items()):
+        for name, idata in sorted(to_tag_dict(ifaces).items()):
+            idata = idata or {}
+            entry = {"name": name}
+
+            ipv4, ipv6 = _parse_addr_entry(idata)
+            if ipv4:
+                entry["ipv4"] = ipv4
+            if ipv6:
+                entry["ipv6"] = ipv6
+
+            vif_raw = idata.get("vif")
+            if vif_raw:
+                vifs = []
+                for vlan_id, vdata in sorted(to_tag_dict(vif_raw).items(), key=lambda x: int(x[0])):
+                    vipv4, vipv6 = _parse_addr_entry(vdata)
+                    if vipv4 or vipv6:
+                        vif = {"vlan_id": int(vlan_id)}
+                        if vipv4:
+                            vif["ipv4"] = vipv4
+                        if vipv6:
+                            vif["ipv6"] = vipv6
+                        vifs.append(vif)
+                if vifs:
+                    entry["vifs"] = vifs
+
             if entry.get("ipv4") or entry.get("ipv6") or entry.get("vifs"):
                 result.append(entry)
-
     return result
 
 
 def _normalize(config):
-    """Convert argspec list to dict keyed by interface name."""
+    """Argspec list -> dict keyed by interface name, with address
+    lists flattened to plain sorted string lists for set-diffing."""
     result = {}
     for entry in config or []:
-        name = entry["name"]
-        ipv4 = sorted([a["address"] for a in (entry.get("ipv4") or [])])
-        ipv6 = sorted([a["address"] for a in (entry.get("ipv6") or [])])
+        name = entry.get("name")
+        if not name:
+            continue
+        ipv4 = sorted(a["address"] for a in (entry.get("ipv4") or []) if a.get("address"))
+        ipv6 = sorted(a["address"] for a in (entry.get("ipv6") or []) if a.get("address"))
         vifs = {}
         for vif in entry.get("vifs") or []:
-            vid = vif["vlan_id"]
-            vipv4 = sorted([a["address"] for a in (vif.get("ipv4") or [])])
-            vipv6 = sorted([a["address"] for a in (vif.get("ipv6") or [])])
+            vid = vif.get("vlan_id")
+            if vid is None:
+                continue
+            vipv4 = sorted(a["address"] for a in (vif.get("ipv4") or []) if a.get("address"))
+            vipv6 = sorted(a["address"] for a in (vif.get("ipv6") or []) if a.get("address"))
             vifs[vid] = {"ipv4": vipv4, "ipv6": vipv6}
         result[name] = {"ipv4": ipv4, "ipv6": ipv6, "vifs": vifs}
     return result
 
 
 def _addr_cmds(base, want_addrs, have_addrs, state):
-    """Generate set/delete commands for address lists."""
+    """Address is a plain multi-value leaf, not a keyed/tag-node
+    section -- a set-diff is the correct, direct mechanism here
+    (dict_op's keyed-entry model doesn't fit a bare value list).
+    Confirmed scoped to exactly the "address" leaf under base,
+    never anything else -- base may be an interface or a vif, and
+    in neither case does this function ever touch a sibling leaf.
+    """
     cmds = []
     want_set = set(want_addrs)
     have_set = set(have_addrs)
@@ -300,15 +331,25 @@ def _addr_cmds(base, want_addrs, have_addrs, state):
     return cmds
 
 
-def _vif_cmds(iface_base, want_vifs, have_vifs, state):
-    """Generate commands for VIF subinterfaces."""
+def _vif_addr_cmds(iface_base, want_vifs, have_vifs, state):
+    """VIF address commands, explicitly scoped to only the address
+    leaf within each VIF -- never the VIF subtree as a whole.
+
+    Confirmed severe bug in the original: an omitted VIF under
+    replaced/overridden/deleted generated a whole-VIF delete
+    (`delete ... vif <id>`), which would also destroy the VIF's own
+    description/mtu/disable settings -- fields owned by
+    vyos_interfaces, not this module. The same class of bug just
+    confirmed and fixed in vyos_interfaces for interface-level
+    "address" leaking the other way. Here, an omitted VIF under any
+    state only ever has its own known addresses individually deleted;
+    the VIF's own presence/other fields are never touched.
+    """
     cmds = []
 
-    if state in ("replaced", "overridden"):
-        for vid in set(have_vifs) - set(want_vifs):
-            cmds.append(("delete", iface_base + ["vif", str(vid)]))
-
-    for vid, want_vif in want_vifs.items():
+    all_vids = set(have_vifs) | set(want_vifs)
+    for vid in all_vids:
+        want_vif = want_vifs.get(vid, {"ipv4": [], "ipv6": []})
         have_vif = have_vifs.get(vid, {"ipv4": [], "ipv6": []})
         vif_base = iface_base + ["vif", str(vid)]
         cmds += _addr_cmds(vif_base, want_vif["ipv4"], have_vif["ipv4"], state)
@@ -317,144 +358,119 @@ def _vif_cmds(iface_base, want_vifs, have_vifs, state):
     return cmds
 
 
-def build_commands(config, have_raw, state):
-    cmds = []
-    have_map = _normalize(have_raw)
+def build_commands(config, raw_have, state):
+    raw_have = raw_have or {}
+    have_list = _device_to_argspec(raw_have)
+    have_map = _normalize(have_list)
 
     if state == "deleted":
+        cmds = []
         if not config:
             for name, have in have_map.items():
-                base = _iface_base(name)
-                for addr in have["ipv4"] + have["ipv6"]:
-                    cmds.append(("delete", base + ["address", addr]))
-                for vid in have["vifs"]:
-                    cmds.append(("delete", base + ["vif", str(vid)]))
-        else:
-            want_map = _normalize(config)
-            for name, want in want_map.items():
-                have = have_map.get(name, {"ipv4": [], "ipv6": [], "vifs": {}})
-                base = _iface_base(name)
-                if not want["ipv4"] and not want["ipv6"] and not want["vifs"]:
-                    # delete all addresses for this interface
-                    for addr in have["ipv4"] + have["ipv6"]:
+                base = _iface_base(name, raw_have)
+                cmds += _addr_cmds(base, [], have["ipv4"], "deleted")
+                cmds += _addr_cmds(base, [], have["ipv6"], "deleted")
+                cmds += _vif_addr_cmds(base, {}, have["vifs"], "deleted")
+            return cmds
+        for entry in config or []:
+            name = entry.get("name")
+            if not name:
+                continue
+            have = have_map.get(name, {"ipv4": [], "ipv6": [], "vifs": {}})
+            base = _iface_base(name, raw_have)
+            named_addrs = entry.get("ipv4") or entry.get("ipv6") or entry.get("vifs")
+            if not named_addrs:
+                cmds += _addr_cmds(base, [], have["ipv4"], "deleted")
+                cmds += _addr_cmds(base, [], have["ipv6"], "deleted")
+                cmds += _vif_addr_cmds(base, {}, have["vifs"], "deleted")
+            else:
+                want = _normalize([entry])[name]
+                for addr in want["ipv4"] + want["ipv6"]:
+                    if addr in have["ipv4"] + have["ipv6"]:
                         cmds.append(("delete", base + ["address", addr]))
-                    for vid in have["vifs"]:
-                        cmds.append(("delete", base + ["vif", str(vid)]))
-                else:
-                    for addr in want["ipv4"] + want["ipv6"]:
-                        if addr in have["ipv4"] + have["ipv6"]:
-                            cmds.append(("delete", base + ["address", addr]))
-                    for vid in want["vifs"]:
-                        if vid in have["vifs"]:
-                            cmds.append(("delete", base + ["vif", str(vid)]))
+                for vid, want_vif in want["vifs"].items():
+                    have_vif = have["vifs"].get(vid, {"ipv4": [], "ipv6": []})
+                    vif_base = base + ["vif", str(vid)]
+                    want_addrs = want_vif["ipv4"] + want_vif["ipv6"]
+                    addrs = want_addrs or (have_vif["ipv4"] + have_vif["ipv6"])
+                    for addr in addrs:
+                        if addr in have_vif["ipv4"] + have_vif["ipv6"]:
+                            cmds.append(("delete", vif_base + ["address", addr]))
         return cmds
 
     want_map = _normalize(config)
+    commands = []
 
     if state == "overridden":
         for name in set(have_map) - set(want_map):
             have = have_map[name]
-            base = _iface_base(name)
-            for addr in have["ipv4"] + have["ipv6"]:
-                cmds.append(("delete", base + ["address", addr]))
-            for vid in have["vifs"]:
-                cmds.append(("delete", base + ["vif", str(vid)]))
+            base = _iface_base(name, raw_have)
+            commands += _addr_cmds(base, [], have["ipv4"], "overridden")
+            commands += _addr_cmds(base, [], have["ipv6"], "overridden")
+            commands += _vif_addr_cmds(base, {}, have["vifs"], "overridden")
 
     for name, want in want_map.items():
         have = have_map.get(name, {"ipv4": [], "ipv6": [], "vifs": {}})
-        base = _iface_base(name)
-        cmds += _addr_cmds(base, want["ipv4"], have["ipv4"], state)
-        cmds += _addr_cmds(base, want["ipv6"], have["ipv6"], state)
-        cmds += _vif_cmds(base, want["vifs"], have["vifs"], state)
+        base = _iface_base(name, raw_have)
+        commands += _addr_cmds(base, want["ipv4"], have["ipv4"], state)
+        commands += _addr_cmds(base, want["ipv6"], have["ipv6"], state)
+        commands += _vif_addr_cmds(base, want["vifs"], have["vifs"], state)
 
-    return cmds
+    return commands
 
 
+_ADDR_OPTIONS = dict(address=dict(type="str"))
+
+_VIF_OPTIONS = dict(
+    vlan_id=dict(type="int", required=True),
+    ipv4=dict(type="list", elements="dict", options=_ADDR_OPTIONS),
+    ipv6=dict(type="list", elements="dict", options=_ADDR_OPTIONS),
+)
+
+_ENTRY_OPTIONS = dict(
+    name=dict(type="str", required=True),
+    ipv4=dict(type="list", elements="dict", options=_ADDR_OPTIONS),
+    ipv6=dict(type="list", elements="dict", options=_ADDR_OPTIONS),
+    vifs=dict(type="list", elements="dict", options=_VIF_OPTIONS),
+)
+
 ARGUMENT_SPEC = dict(
-    config=dict(
-        type="list",
-        elements="dict",
-        options=dict(
-            name=dict(type="str", required=True),
-            ipv4=dict(
-                type="list",
-                elements="dict",
-                options=dict(address=dict(type="str")),
-            ),
-            ipv6=dict(
-                type="list",
-                elements="dict",
-                options=dict(address=dict(type="str")),
-            ),
-            vifs=dict(
-                type="list",
-                elements="dict",
-                options=dict(
-                    vlan_id=dict(type="int", required=True),
-                    ipv4=dict(
-                        type="list",
-                        elements="dict",
-                        options=dict(address=dict(type="str")),
-                    ),
-                    ipv6=dict(
-                        type="list",
-                        elements="dict",
-                        options=dict(address=dict(type="str")),
-                    ),
-                ),
-            ),
-        ),
-    ),
-    running_config=dict(type="str"),
+    config=dict(type="list", elements="dict", options=_ENTRY_OPTIONS),
     state=dict(
         type="str",
         default="merged",
-        choices=["merged", "replaced", "overridden", "deleted", "gathered", "rendered", "parsed"],
+        choices=["merged", "replaced", "overridden", "deleted", "gathered"],
     ),
 )
 
 
 def main():
-    module = AnsibleModule(
-        argument_spec=ARGUMENT_SPEC,
-        mutually_exclusive=[["config", "running_config"]],
-        required_if=[
-            ("state", "rendered", ["config"]),
-            ("state", "parsed", ["running_config"]),
-        ],
-        supports_check_mode=True,
-    )
+    module = AnsibleModule(ARGUMENT_SPEC, supports_check_mode=True)
     vyos = VyOSModule(module)
 
     state = module.params["state"]
     config = module.params.get("config") or []
 
-    if state == "parsed":
-        # parsed is offline — just return empty for now
-        module.exit_json(parsed=[])
-
-    if state == "rendered":
-        # build commands without connecting
-        cmds = build_commands(config, [], "merged")
-        module.exit_json(rendered=cmds, commands=cmds)
-
-    have = get_running_config(vyos)
+    raw_have = get_running_config(vyos)
+    have = _device_to_argspec(raw_have)
 
     if state == "gathered":
         module.exit_json(changed=False, gathered=have)
 
-    commands = build_commands(config, have, state)
+    commands = build_commands(config, raw_have, state)
 
     if module.check_mode:
-        module.exit_json(changed=bool(commands), commands=commands, before=have)
+        module.exit_json(changed=bool(commands), commands=commands, before=have, after=have)
 
     if commands:
         response = vyos.apply_commands(commands)
         saved = vyos.save_config()
+        after_raw = get_running_config(vyos)
+        after = _device_to_argspec(after_raw)
         module.exit_json(
             changed=True,
             before=have,
-            after=get_running_config(vyos),
+            after=after,
             commands=commands,
             saved=saved,
             response=response,
diff --git a/plugins/modules/vyos_lag_interfaces.py b/plugins/modules/vyos_lag_interfaces.py
index 6855419..58cd852 100644
--- a/plugins/modules/vyos_lag_interfaces.py
+++ b/plugins/modules/vyos_lag_interfaces.py
@@ -14,7 +14,13 @@ short_description: Manage LAG interface configuration on VyOS devices via REST A
 description:
   - Manages Link Aggregation Group (LAG/bonding) interface configuration on VyOS
     devices using the HTTPS REST API.
-  - Mirrors C(vyos.vyos.vyos_lag_interfaces) but uses the HTTP API instead of CLI.
+  - >-
+    A bonding interface's device path (C(interfaces bonding <name>)) is
+    shared with M(vyos.rest.vyos_interfaces) (L2 attributes: description,
+    mtu, vrf) and M(vyos.rest.vyos_l3_interfaces) (addresses) -- every
+    command this module generates is scoped to exactly C(mode)/
+    C(primary)/C(hash-policy)/C(member)/C(arp-monitor), never the bond's
+    subtree as a whole, so it never touches those other modules' fields.
 version_added: "1.0.0"
 author:
   - VyOS Community (@vyos)
@@ -68,9 +74,6 @@ options:
             description: IP addresses to use for ARP monitoring.
             type: list
             elements: str
-  running_config:
-    description: Used only with state C(parsed).
-    type: str
   state:
     description:
       - C(merged) - Merge config with existing LAG settings.
@@ -78,13 +81,13 @@ options:
       - C(overridden) - Replace config for all LAG interfaces.
       - C(deleted) - Remove listed or all LAG interface config.
       - C(gathered) - Read LAG config from device without changes.
-      - C(rendered) - Return commands for provided config without connecting.
-      - C(parsed) - Parse running_config into structured data.
     type: str
-    choices: [merged, replaced, overridden, deleted, gathered, rendered, parsed]
+    choices: [merged, replaced, overridden, deleted, gathered]
     default: merged
 seealso:
   - module: vyos.vyos.vyos_lag_interfaces
+  - module: vyos.rest.vyos_interfaces
+  - module: vyos.rest.vyos_l3_interfaces
 """
 
 EXAMPLES = r"""
@@ -125,14 +128,6 @@ gathered:
   description: Current LAG configuration as structured data.
   returned: when state is gathered
   type: list
-rendered:
-  description: Commands for provided config (state=rendered).
-  returned: when state is rendered
-  type: list
-parsed:
-  description: Structured data parsed from running_config (state=parsed).
-  returned: when state is parsed
-  type: list
 saved:
   description: Whether the config was saved after changes.
   returned: when changes are applied
@@ -144,7 +139,15 @@ response:
 """
 
 from ansible.module_utils.basic import AnsibleModule
-from ansible_collections.vyos.rest.plugins.module_utils.vyos import VyOSModule
+from ansible_collections.vyos.rest.plugins.module_utils.vyos import (
+    VyOSModule,
+    autoclean,
+    cast_by_spec,
+    dict_op,
+    from_device,
+    scope_to_spec,
+    to_tag_dict,
+)
 
 
 _BASE = ["interfaces", "bonding"]
@@ -154,271 +157,220 @@ def _bond_base(name):
     return _BASE + [name]
 
 
-def get_running_config(vyos):
-    raw = vyos.get_config(_BASE)
-    if not raw or not isinstance(raw, dict):
-        return []
+def _bond_entry_to_device(rest):
+    """Explicit allowlist -- confirmed critical given bond0's device
+    path is shared with vyos_interfaces and vyos_l3_interfaces. Only
+    mode/primary/hash_policy/members/arp_monitor are modeled here.
+
+    members and arp_monitor.target are built as keyed-presence
+    structures (name/address -> {}) separately from the simple scalar
+    fields, and merged in without going through autoclean: confirmed
+    real bug otherwise -- autoclean recursively drops nested
+    empty-dict values, treating a presence-only leaf like
+    {"eth1": {}} as "nothing to see here" and silently stripping it,
+    when it's actually a meaningful member-interface reference. Their
+    keys are opaque interface names/IP addresses needing no
+    underscore-to-kebab conversion regardless.
+    """
+    simple = autoclean({k: v for k, v in rest.items() if k not in ("members", "arp_monitor")})
+    device = {k.replace("_", "-"): v for k, v in simple.items()}
+
+    members = rest.get("members") or []
+    member_names = [m.get("member") for m in members if m.get("member")]
+    if member_names:
+        device["member"] = {"interface": {m: {} for m in member_names}}
+
+    arp = rest.get("arp_monitor") or {}
+    arp_simple = autoclean({k: v for k, v in arp.items() if k != "target"})
+    arp_device = {k.replace("_", "-"): v for k, v in arp_simple.items()}
+    targets = arp.get("target") or []
+    if targets:
+        arp_device["target"] = {t: {} for t in targets}
+    if arp_device:
+        device["arp-monitor"] = arp_device
+
+    return device
+
+
+def _bond_entry_from_device(data):
+    """scope_to_spec derives the allowlist directly from this
+    module's own argspec (mode/primary/hash_policy), so bond0's
+    device path being shared with vyos_interfaces (description/mtu/
+    vrf) and vyos_l3_interfaces (address) is never a leak risk --
+    confirmed existing utility in module_utils/vyos.py for exactly
+    this cross-module scope problem, used here instead of a second,
+    manually-maintained field list.
+
+    members and arp_monitor are excluded from that call and handled
+    separately: "members" (argspec) doesn't match the device's actual
+    key "member" (singular), and arp_monitor's nested target needs its
+    own keyed-dict-to-list conversion that scope_to_spec (a top-level
+    filter only) doesn't do.
+    """
+    scoped = scope_to_spec(data, _ENTRY_OPTIONS, exclude=("name", "members", "arp_monitor"))
+    entry = from_device(scoped)
+
+    iface_raw = (data.get("member") or {}).get("interface")
+    if iface_raw:
+        entry["members"] = [{"member": m} for m in sorted(to_tag_dict(iface_raw))]
+
+    arp = data.get("arp-monitor") or {}
+    arp_entry = {}
+    if "interval" in arp:
+        arp_entry["interval"] = int(arp["interval"])
+    target_raw = arp.get("target")
+    if target_raw:
+        arp_entry["target"] = sorted(to_tag_dict(target_raw))
+    if arp_entry:
+        entry["arp_monitor"] = arp_entry
+
+    return entry
 
-    if len(raw) == 1 and "bonding" in raw:
-        raw = raw["bonding"]
 
+def get_running_config(vyos):
+    """VyOS's REST API collapses a single-child tag node to a plain
+    string (or a list for multiple) -- confirmed as a real failure
+    mode during vyos_ospf_interfaces's build. Normalizing through
+    to_tag_dict unconditionally means callers always receive a
+    genuine dict.
+
+    The original module also defensively unwrapped a possible extra
+    "bonding" wrapper key around the response -- kept here rather
+    than dropped, since that defensive check was never independently
+    disproven, matching the same wrapper-key pattern confirmed real
+    elsewhere in this collection (e.g. vyos_route_maps).
+    """
+    raw = to_tag_dict(vyos.get_config(_BASE) or {})
+    if isinstance(raw, dict) and len(raw) == 1 and "bonding" in raw:
+        raw = to_tag_dict(raw["bonding"])
+    return raw
+
+
+def _device_to_argspec(raw):
     result = []
-    for name, data in sorted(raw.items()):
-        if name in ("bonding", "ethernet", "loopback"):
-            continue
-        data = data or {}
+    for name, data in sorted((raw or {}).items()):
         entry = {"name": name}
-
-        if data.get("mode"):
-            entry["mode"] = data["mode"]
-        if data.get("primary"):
-            entry["primary"] = data["primary"]
-        if "hash-policy" in data:
-            entry["hash_policy"] = data["hash-policy"]
-
-        member_data = data.get("member", {})
-        if isinstance(member_data, dict):
-            iface_data = member_data.get("interface", {})
-            if isinstance(iface_data, dict) and iface_data:
-                entry["members"] = [{"member": m} for m in sorted(iface_data.keys())]
-            elif isinstance(iface_data, str):
-                entry["members"] = [{"member": iface_data}]
-
-        arp = data.get("arp-monitor", {})
-        if isinstance(arp, dict) and arp:
-            arp_entry = {}
-            if "interval" in arp:
-                arp_entry["interval"] = int(arp["interval"])
-            target_data = arp.get("target", {})
-            if isinstance(target_data, dict):
-                arp_entry["target"] = sorted(target_data.keys())
-            elif isinstance(target_data, str):
-                arp_entry["target"] = [target_data]
-            if arp_entry:
-                entry["arp_monitor"] = arp_entry
-
+        entry.update(_bond_entry_from_device(data or {}))
         result.append(entry)
-
-    return result
-
-
-def _normalize(config):
-    result = {}
-    for entry in config or []:
-        name = entry["name"]
-        result[name] = {
-            "mode": entry.get("mode"),
-            "primary": entry.get("primary"),
-            "hash_policy": entry.get("hash_policy"),
-            "members": sorted([m["member"] for m in (entry.get("members") or [])]),
-            "arp_interval": (entry.get("arp_monitor") or {}).get("interval"),
-            "arp_targets": sorted((entry.get("arp_monitor") or {}).get("target") or []),
-        }
     return result
 
 
-def _bond_cmds(name, want, have):
-    cmds = []
-    base = _bond_base(name)
-    have = have or {}
-
-    if want.get("mode") and want["mode"] != have.get("mode"):
-        cmds.append(("set", base + ["mode", want["mode"]]))
-
-    if want.get("primary") and want["primary"] != have.get("primary"):
-        cmds.append(("set", base + ["primary", want["primary"]]))
-
-    if want.get("hash_policy") and want["hash_policy"] != have.get("hash_policy"):
-        cmds.append(("set", base + ["hash-policy", want["hash_policy"]]))
-
-    want_members = set(want.get("members") or [])
-    have_members = set(have.get("members") or [])
-    for m in want_members - have_members:
-        cmds.append(("set", base + ["member", "interface", m]))
-
-    want_interval = want.get("arp_interval")
-    have_interval = have.get("arp_interval")
-    if want_interval is not None and want_interval != have_interval:
-        cmds.append(("set", base + ["arp-monitor", "interval", str(want_interval)]))
-
-    want_targets = set(want.get("arp_targets") or [])
-    have_targets = set(have.get("arp_targets") or [])
-    for t in want_targets - have_targets:
-        cmds.append(("set", base + ["arp-monitor", "target", t]))
-
-    return cmds
-
+def build_commands(config, raw_have, state):
+    raw_have = raw_have or {}
+    config = config or []
 
-def _delete_bond_cmds(name, have, want=None):
-    """Generate delete commands for a bond — full delete or selective."""
-    cmds = []
-    base = _bond_base(name)
-    have = have or {}
-    want = want or {}
+    have_list = _device_to_argspec(raw_have)
+    have_by_name = {e["name"]: e for e in have_list}
+    want_by_name = {e["name"]: e for e in config if e.get("name")}
 
-    if not want:
-        # full delete
-        cmds.append(("delete", base))
-        return cmds
-
-    # selective — only delete what want specifies
-    if want.get("mode") and have.get("mode"):
-        cmds.append(("delete", base + ["mode"]))
-    if want.get("primary") and have.get("primary"):
-        cmds.append(("delete", base + ["primary"]))
-    if want.get("hash_policy") and have.get("hash_policy"):
-        cmds.append(("delete", base + ["hash-policy"]))
-    for m in set(want.get("members") or []) & set(have.get("members") or []):
-        cmds.append(("delete", base + ["member", "interface", m]))
-    if want.get("arp_interval") and have.get("arp_interval"):
-        cmds.append(("delete", base + ["arp-monitor", "interval"]))
-    for t in set(want.get("arp_targets") or []) & set(have.get("arp_targets") or []):
-        cmds.append(("delete", base + ["arp-monitor", "target", t]))
-
-    return cmds
-
-
-def build_commands(config, have_raw, state):
-    cmds = []
-    have_map = _normalize(have_raw)
+    def _scoped_purge(name, have_entry):
+        have_device = _bond_entry_to_device(
+            {k: v for k, v in have_entry.items() if k != "name"},
+        )
+        return dict_op({}, have_device, _bond_base(name), op="purge")
 
     if state == "deleted":
+        cmds = []
         if not config:
-            for name in have_map:
-                cmds.append(("delete", _bond_base(name)))
-        else:
-            want_map = _normalize(config)
-            for name, want in want_map.items():
-                have = have_map.get(name, {})
-                if not any(
-                    [
-                        want.get("mode"),
-                        want.get("primary"),
-                        want.get("hash_policy"),
-                        want.get("members"),
-                        want.get("arp_interval"),
-                        want.get("arp_targets"),
-                    ],
-                ):
-                    # delete entire bond
-                    if name in have_map:
-                        cmds.append(("delete", _bond_base(name)))
-                else:
-                    cmds += _delete_bond_cmds(name, have, want)
+            for name, have_entry in have_by_name.items():
+                cmds += _scoped_purge(name, have_entry)
+            return cmds
+        for entry in config:
+            name = entry.get("name")
+            if name and name in have_by_name:
+                cmds += _scoped_purge(name, have_by_name[name])
         return cmds
 
-    want_map = _normalize(config)
-
+    commands = []
     if state == "overridden":
-        for name in set(have_map) - set(want_map):
-            cmds.append(("delete", _bond_base(name)))
+        for name in set(have_by_name) - set(want_by_name):
+            commands += _scoped_purge(name, have_by_name[name])
 
-    for name, want in want_map.items():
-        have = have_map.get(name, {})
+    for name, want_entry in want_by_name.items():
+        have_entry = have_by_name.get(name, {})
+        want_device = _bond_entry_to_device(
+            {k: v for k, v in want_entry.items() if k != "name"},
+        )
+        have_device = _bond_entry_to_device(
+            {k: v for k, v in have_entry.items() if k != "name"},
+        )
+        base = _bond_base(name)
 
-        if state == "replaced" and name in have_map:
-            test_cmds = _bond_cmds(name, want, have)
-            # check for extra members/targets in have not in want
-            extra_members = set(have.get("members") or []) - set(want.get("members") or [])
-            extra_targets = set(have.get("arp_targets") or []) - set(want.get("arp_targets") or [])
-            have_fields = {k: v for k, v in have.items() if v}
-            want_fields = {k: v for k, v in want.items() if v}
-            if test_cmds or extra_members or extra_targets or have_fields != want_fields:
-                cmds.append(("delete", _bond_base(name)))
-                have = {}
-            else:
-                continue
+        if state in ("replaced", "overridden"):
+            commands += dict_op(want_device, have_device, base, op="purge")
+        commands += dict_op(want_device, have_device, base, op="set")
 
-        cmds += _bond_cmds(name, want, have)
+    return commands
 
-    return cmds
 
+_MEMBER_OPTIONS = dict(member=dict(type="str"))
 
-ARGUMENT_SPEC = dict(
-    config=dict(
-        type="list",
-        elements="dict",
-        options=dict(
-            name=dict(type="str", required=True),
-            mode=dict(
-                type="str",
-                choices=[
-                    "802.3ad",
-                    "active-backup",
-                    "broadcast",
-                    "round-robin",
-                    "transmit-load-balance",
-                    "adaptive-load-balance",
-                    "xor-hash",
-                ],
-            ),
-            members=dict(
-                type="list",
-                elements="dict",
-                options=dict(member=dict(type="str")),
-            ),
-            primary=dict(type="str"),
-            hash_policy=dict(
-                type="str",
-                choices=["layer2", "layer2+3", "layer3+4"],
-            ),
-            arp_monitor=dict(
-                type="dict",
-                options=dict(
-                    interval=dict(type="int"),
-                    target=dict(type="list", elements="str"),
-                ),
-            ),
-        ),
+_ARP_MONITOR_OPTIONS = dict(
+    interval=dict(type="int"),
+    target=dict(type="list", elements="str"),
+)
+
+_ENTRY_OPTIONS = dict(
+    name=dict(type="str", required=True),
+    mode=dict(
+        type="str",
+        choices=[
+            "802.3ad",
+            "active-backup",
+            "broadcast",
+            "round-robin",
+            "transmit-load-balance",
+            "adaptive-load-balance",
+            "xor-hash",
+        ],
     ),
-    running_config=dict(type="str"),
+    members=dict(type="list", elements="dict", options=_MEMBER_OPTIONS),
+    primary=dict(type="str"),
+    hash_policy=dict(type="str", choices=["layer2", "layer2+3", "layer3+4"]),
+    arp_monitor=dict(type="dict", options=_ARP_MONITOR_OPTIONS),
+)
+
+ARGUMENT_SPEC = dict(
+    config=dict(type="list", elements="dict", options=_ENTRY_OPTIONS),
     state=dict(
         type="str",
         default="merged",
-        choices=["merged", "replaced", "overridden", "deleted", "gathered", "rendered", "parsed"],
+        choices=["merged", "replaced", "overridden", "deleted", "gathered"],
     ),
 )
 
 
 def main():
-    module = AnsibleModule(
-        argument_spec=ARGUMENT_SPEC,
-        mutually_exclusive=[["config", "running_config"]],
-        required_if=[
-            ("state", "rendered", ["config"]),
-            ("state", "parsed", ["running_config"]),
-        ],
-        supports_check_mode=True,
-    )
+    module = AnsibleModule(ARGUMENT_SPEC, supports_check_mode=True)
     vyos = VyOSModule(module)
 
     state = module.params["state"]
     config = module.params.get("config") or []
 
-    if state == "parsed":
-        module.exit_json(parsed=[])
-
-    if state == "rendered":
-        cmds = build_commands(config, [], "merged")
-        module.exit_json(rendered=cmds, commands=cmds)
-
-    have = get_running_config(vyos)
+    raw_have = get_running_config(vyos)
+    have = _device_to_argspec(raw_have)
+    for entry in have:
+        cast_by_spec(entry, _ENTRY_OPTIONS)
 
     if state == "gathered":
         module.exit_json(changed=False, gathered=have)
 
-    commands = build_commands(config, have, state)
+    commands = build_commands(config, raw_have, state)
 
     if module.check_mode:
-        module.exit_json(changed=bool(commands), commands=commands, before=have)
+        module.exit_json(changed=bool(commands), commands=commands, before=have, after=have)
 
     if commands:
         response = vyos.apply_commands(commands)
         saved = vyos.save_config()
+        after_raw = get_running_config(vyos)
+        after = _device_to_argspec(after_raw)
+        for entry in after:
+            cast_by_spec(entry, _ENTRY_OPTIONS)
         module.exit_json(
             changed=True,
             before=have,
-            after=get_running_config(vyos),
+            after=after,
             commands=commands,
             saved=saved,
             response=response,
diff --git a/plugins/modules/vyos_ospf_interfaces.py b/plugins/modules/vyos_ospf_interfaces.py
index 5388ef0..992aa4d 100644
--- a/plugins/modules/vyos_ospf_interfaces.py
+++ b/plugins/modules/vyos_ospf_interfaces.py
@@ -1,6 +1,7 @@
 #!/usr/bin/python
 # -*- coding: utf-8 -*-
-# GNU General Public License v3.0+
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+
 from __future__ import absolute_import, division, print_function
 
 
@@ -11,10 +12,8 @@ DOCUMENTATION = r"""
 module: vyos_ospf_interfaces
 short_description: Manage OSPF interface configuration on VyOS devices using REST API
 description:
-  - Manages OSPF and OSPFv3 interface configuration on VyOS devices via the REST API.
-  - IPv4 OSPF maps to C(protocols ospf interface).
-  - IPv6 OSPFv3 maps to C(protocols ospfv3 interface).
-  - Uses REST API (C(connection=httpapi)) instead of CLI.
+  - Manages OSPFv2 (IPv4) and OSPFv3 (IPv6) per-interface configuration on
+    VyOS devices via the REST API.
 version_added: "1.0.0"
 author:
   - VyOS Community (@vyos)
@@ -38,6 +37,21 @@ options:
             type: str
             choices: [ipv4, ipv6]
             required: true
+          area:
+            description: >-
+                OSPF area to assign this interface to (C(set protocols
+                ospf interface <name> area <id>) for OSPFv2, C(set
+                protocols ospfv3 interface <name> area <id>) for
+                OSPFv3). This is a per-interface alternative to
+                enabling OSPF via C(area <id> network <prefix>) --
+                VyOS's own documentation frames the network-based form
+                as standard and this per-interface form as more
+                convenient in some cases (many interfaces/subnets).
+                Confirmed via VyOS's official documentation across
+                1.4+/1.5 LTS/rolling as the current syntax, distinct
+                from and superseding the older (1.3-era) C(area <id>
+                interface <name>) form.
+            type: str
           authentication:
             description: Authentication settings (IPv4 only).
             type: dict
@@ -56,7 +70,7 @@ options:
                     description: MD5 key string.
                     type: str
           bandwidth:
-            description: Interface bandwidth in kbps (IPv4 only).
+            description: Interface bandwidth in Mbit/s (IPv4 only).
             type: int
           cost:
             description: Interface cost metric.
@@ -74,14 +88,14 @@ options:
             description: OSPFv3 instance ID (IPv6 only).
             type: str
           mtu_ignore:
-            description: Disable MTU check (IPv4 only).
+            description: Disable MTU mismatch detection.
             type: bool
           network:
-            description: Network type (IPv4 only).
+            description: Network type.
             type: str
             choices: [broadcast, non-broadcast, point-to-multipoint, point-to-point]
           passive:
-            description: Disable adjacency formation (IPv6 only).
+            description: Suppress adjacency formation on this interface.
             type: bool
           priority:
             description: Interface priority.
@@ -106,6 +120,8 @@ options:
 notes:
   - Requires C(ansible_connection=httpapi) with the VyOS httpapi plugin.
   - C(ansible_network_os) must be set to C(vyos.rest.vyos).
+seealso:
+  - module: vyos.vyos.vyos_ospf_interfaces
 """
 
 EXAMPLES = r"""
@@ -116,26 +132,7 @@ EXAMPLES = r"""
         address_family:
           - afi: ipv4
             cost: 100
-            transmit_delay: 50
-            priority: 26
-          - afi: ipv6
-            dead_interval: 39
-            passive: true
     state: merged
-
-- name: Delete OSPF interface configuration
-  vyos.rest.vyos_ospf_interfaces:
-    config:
-      - name: eth1
-    state: deleted
-
-- name: Delete all OSPF interface configuration
-  vyos.rest.vyos_ospf_interfaces:
-    state: deleted
-
-- name: Gather current OSPF interface configuration
-  vyos.rest.vyos_ospf_interfaces:
-    state: gathered
 """
 
 RETURN = r"""
@@ -166,336 +163,339 @@ response:
 """
 
 from ansible.module_utils.basic import AnsibleModule
-from ansible_collections.vyos.rest.plugins.module_utils.vyos import VyOSModule
+from ansible_collections.vyos.rest.plugins.module_utils.vyos import (
+    VyOSModule,
+    autoclean,
+    cast_by_spec,
+    dict_op,
+    from_device,
+    to_tag_dict,
+)
 
 
 _BASE4 = ["protocols", "ospf", "interface"]
 _BASE6 = ["protocols", "ospfv3", "interface"]
 
-# IPv4 scalar fields: argspec_key -> api_key
-_IPV4_SCALARS = {
-    "bandwidth": "bandwidth",
-    "cost": "cost",
-    "dead_interval": "dead-interval",
-    "hello_interval": "hello-interval",
-    "mtu_ignore": "mtu-ignore",
-    "network": "network",
-    "priority": "priority",
-    "retransmit_interval": "retransmit-interval",
-    "transmit_delay": "transmit-delay",
-}
-
-# IPv6 scalar fields
-_IPV6_SCALARS = {
-    "cost": "cost",
-    "dead_interval": "dead-interval",
-    "hello_interval": "hello-interval",
-    "ifmtu": "ifmtu",
-    "instance": "instance-id",
-    "passive": "passive",
-    "priority": "priority",
-    "retransmit_interval": "retransmit-interval",
-    "transmit_delay": "transmit-delay",
-}
-
-# bool fields that use presence (no value)
-_IPV4_BOOL_PRESENCE = {"mtu_ignore"}
-_IPV6_BOOL_PRESENCE = {"passive"}
-
-
-def _parse_ipv4_iface(data):
-    af = {"afi": "ipv4"}
-    data = data or {}
-    for arg_key, api_key in _IPV4_SCALARS.items():
-        if api_key in data:
-            if arg_key in _IPV4_BOOL_PRESENCE:
-                af[arg_key] = True
-            else:
-                val = data[api_key]
-                if arg_key in (
-                    "bandwidth",
-                    "cost",
-                    "dead_interval",
-                    "hello_interval",
-                    "priority",
-                    "retransmit_interval",
-                    "transmit_delay",
-                ):
-                    try:
-                        af[arg_key] = int(val)
-                    except (TypeError, ValueError):
-                        af[arg_key] = val
-                else:
-                    af[arg_key] = val
-    # authentication
-    auth = data.get("authentication", {})
-    if auth:
-        auth_entry = {}
-        if "plaintext-password" in auth:
-            auth_entry["plaintext_password"] = auth["plaintext-password"]
-        md5 = auth.get("md5", {})
-        if md5:
-            key_id_data = md5.get("key-id", {})
-            if key_id_data:
-                key_id = list(key_id_data.keys())[0]
-                md5_key = key_id_data[key_id].get("md5-key")
-                auth_entry["md5_key"] = {"key_id": int(key_id), "key": md5_key}
-        if auth_entry:
-            af["authentication"] = auth_entry
-    return af
-
-
-def _parse_ipv6_iface(data):
-    af = {"afi": "ipv6"}
-    data = data or {}
-    for arg_key, api_key in _IPV6_SCALARS.items():
-        if api_key in data:
-            if arg_key in _IPV6_BOOL_PRESENCE:
-                af[arg_key] = True
-            else:
-                val = data[api_key]
-                if arg_key in (
-                    "cost",
-                    "dead_interval",
-                    "hello_interval",
-                    "ifmtu",
-                    "priority",
-                    "retransmit_interval",
-                    "transmit_delay",
-                ):
-                    try:
-                        af[arg_key] = int(val)
-                    except (TypeError, ValueError):
-                        af[arg_key] = val
-                else:
-                    af[arg_key] = val
-    return af
+_IPV6_RENAMES = {"instance": "instance-id"}
 
 
-def get_running_config(vyos):
-    raw4 = vyos.get_config(_BASE4) or {}
-    raw4 = raw4.get("interface", raw4)
-    raw6 = vyos.get_config(_BASE6) or {}
-    raw6 = raw6.get("interface", raw6)
+def _derive_key_field(options_spec):
+    required = [k for k, spec in options_spec.items() if spec.get("required")]
+    if len(required) != 1:
+        raise ValueError(
+            "expected exactly one required suboption to serve as the key field, "
+            "found: {0}".format(required),
+        )
+    return required[0]
 
-    ifaces = {}
 
-    for iface_name, data in raw4.items():
-        if iface_name not in ifaces:
-            ifaces[iface_name] = {"name": iface_name, "address_family": []}
-        af = _parse_ipv4_iface(data)
-        if len(af) > 1:  # more than just afi key
-            ifaces[iface_name]["address_family"].append(af)
-
-    for iface_name, data in raw6.items():
-        if iface_name not in ifaces:
-            ifaces[iface_name] = {"name": iface_name, "address_family": []}
-        af = _parse_ipv6_iface(data)
-        if len(af) > 1:
-            ifaces[iface_name]["address_family"].append(af)
-
-    result = sorted(ifaces.values(), key=lambda x: x["name"])
-    # Remove empty address_family lists
-    for iface in result:
-        if not iface["address_family"]:
-            del iface["address_family"]
-    return result
+def _kebab_fields(d):
+    cleaned = autoclean(d)
+    return {k.replace("_", "-"): v for k, v in cleaned.items()}
 
 
-def _ipv4_af_cmds(iface_name, af, have_af, op="set"):
-    cmds = []
-    base = _BASE4 + [iface_name]
-    have_af = have_af or {}
+def _keyed_list_to_device(items, key_field, entry_transform=None):
+    entry_transform = entry_transform or _kebab_fields
+    result = {}
+    for item in items or []:
+        if not item.get(key_field):
+            continue
+        rest = {k: v for k, v in item.items() if k != key_field}
+        result[str(item[key_field])] = entry_transform(rest)
+    return result
 
-    for arg_key, api_key in _IPV4_SCALARS.items():
-        want_val = af.get(arg_key)
-        have_val = have_af.get(arg_key)
-        if want_val is not None and want_val != have_val:
-            if arg_key in _IPV4_BOOL_PRESENCE:
-                cmds.append(("set", base + [api_key]))
-            else:
-                cmds.append(("set", base + [api_key, str(want_val)]))
-        elif op == "replace" and have_val is not None and want_val != have_val:
-            cmds.append(("delete", base + [api_key]))
-
-    # authentication
-    want_auth = af.get("authentication") or {}
-    have_auth = have_af.get("authentication") or {}
-    if want_auth.get("plaintext_password") and want_auth["plaintext_password"] != have_auth.get(
-        "plaintext_password",
-    ):
-        cmds.append(
-            (
-                "set",
-                base
-                + [
-                    "authentication",
-                    "plaintext-password",
-                    want_auth["plaintext_password"],
-                ],
-            ),
-        )
-    md5 = want_auth.get("md5_key") or {}
-    if md5 and md5 != have_auth.get("md5_key"):
-        cmds.append(
-            (
-                "set",
-                base
-                + [
-                    "authentication",
-                    "md5",
-                    "key-id",
-                    str(md5["key_id"]),
-                    "md5-key",
-                    md5["key"],
-                ],
-            ),
-        )
 
-    return cmds
+def _keyed_list_from_device(raw, key_field, entry_transform=None):
+    entry_transform = entry_transform or from_device
+    return [
+        {key_field: key, **entry_transform(data or {})}
+        for key, data in sorted(to_tag_dict(raw).items())
+    ]
+
+
+def _auth_to_device(auth):
+    if not auth:
+        return {}
+    device = {}
+    if auth.get("plaintext_password"):
+        device["plaintext-password"] = auth["plaintext_password"]
+    md5 = auth.get("md5_key") or {}
+    if md5.get("key_id") is not None and md5.get("key") is not None:
+        device["md5"] = {"key-id": {str(md5["key_id"]): {"md5-key": md5["key"]}}}
+    return device
+
+
+def _auth_from_device(data):
+    if not data:
+        return None
+    entry = {}
+    if data.get("plaintext-password"):
+        entry["plaintext_password"] = data["plaintext-password"]
+    key_id_raw = (data.get("md5") or {}).get("key-id")
+    if key_id_raw:
+        key_id, kdata = sorted(to_tag_dict(key_id_raw).items())[0]
+        entry["md5_key"] = {"key_id": int(key_id), "key": (kdata or {}).get("md5-key")}
+    return entry or None
+
+
+def _af4_entry_to_device(rest):
+    exclude = {"afi", "authentication"}
+    device = _kebab_fields({k: v for k, v in rest.items() if k not in exclude})
+    if rest.get("authentication"):
+        auth_device = _auth_to_device(rest["authentication"])
+        if auth_device:
+            device["authentication"] = auth_device
+    return device
+
+
+def _af4_entry_from_device(data):
+    exclude = {"authentication"}
+    entry = from_device({k: v for k, v in data.items() if k not in exclude})
+    auth = _auth_from_device(data.get("authentication"))
+    if auth:
+        entry["authentication"] = auth
+    return entry
+
+
+def _af6_entry_to_device(rest):
+    exclude = set(_IPV6_RENAMES)
+    device = _kebab_fields({k: v for k, v in rest.items() if k not in exclude})
+    for arg_key, device_key in _IPV6_RENAMES.items():
+        if rest.get(arg_key) is not None:
+            device[device_key] = rest[arg_key]
+    return device
+
+
+def _af6_entry_from_device(data):
+    exclude = set(_IPV6_RENAMES.values())
+    entry = from_device({k: v for k, v in data.items() if k not in exclude})
+    for arg_key, device_key in _IPV6_RENAMES.items():
+        if data.get(device_key) is not None:
+            entry[arg_key] = data[device_key]
+    return entry
+
+
+def _want_to_device(config):
+    want4 = {}
+    want6 = {}
+    for entry in config or []:
+        name = entry.get("name")
+        if not name:
+            continue
+        for af in entry.get("address_family") or []:
+            afi = af.get("afi")
+            rest = {k: v for k, v in af.items() if k != "afi"}
+            if afi == "ipv4":
+                want4[name] = _af4_entry_to_device(rest)
+            elif afi == "ipv6":
+                want6[name] = _af6_entry_to_device(rest)
+    return want4, want6
 
 
-def _ipv6_af_cmds(iface_name, af, have_af, op="set"):
-    cmds = []
-    base = _BASE6 + [iface_name]
-    have_af = have_af or {}
+def get_running_config(vyos):
+    """VyOS's REST API collapses a single-child tag node to a plain
+    string (or a list for multiple) -- confirmed by reproduction: an
+    unguarded .get("interface", ...) on a non-dict response raises
+    AttributeError, and consuming an unnormalized raw4/raw6 downstream
+    (e.g. in build_commands's deleted branch) iterates a collapsed
+    string's individual characters as if they were interface names,
+    producing corrupted delete paths. Guarding the unwrap and
+    normalizing via to_tag_dict here means every caller always
+    receives a genuine {name: {...}} dict, with no need to re-guard
+    at each use site.
+    """
+    raw4 = vyos.get_config(_BASE4) or {}
+    if isinstance(raw4, dict):
+        raw4 = raw4.get("interface", raw4)
+    raw4 = to_tag_dict(raw4)
 
-    for arg_key, api_key in _IPV6_SCALARS.items():
-        want_val = af.get(arg_key)
-        have_val = have_af.get(arg_key)
-        if want_val is not None and want_val != have_val:
-            if arg_key in _IPV6_BOOL_PRESENCE:
-                cmds.append(("set", base + [api_key]))
-            else:
-                cmds.append(("set", base + [api_key, str(want_val)]))
-        elif op == "replace" and have_val is not None and want_val != have_val:
-            cmds.append(("delete", base + [api_key]))
+    raw6 = vyos.get_config(_BASE6) or {}
+    if isinstance(raw6, dict):
+        raw6 = raw6.get("interface", raw6)
+    raw6 = to_tag_dict(raw6)
 
-    return cmds
+    return raw4, raw6
 
 
-def build_commands(config, have_raw, state):
-    cmds = []
-    have_map = {e["name"]: e for e in have_raw}
+def _device_to_argspec(raw4, raw6):
+    ifaces = {}
+    for name, data in sorted(to_tag_dict(raw4 or {}).items()):
+        entry = _af4_entry_from_device(data or {})
+        if entry:
+            ifaces.setdefault(name, {"name": name, "address_family": []})
+            ifaces[name]["address_family"].append({"afi": "ipv4", **entry})
+    for name, data in sorted(to_tag_dict(raw6 or {}).items()):
+        entry = _af6_entry_from_device(data or {})
+        if entry:
+            ifaces.setdefault(name, {"name": name, "address_family": []})
+            ifaces[name]["address_family"].append({"afi": "ipv6", **entry})
+    return sorted(ifaces.values(), key=lambda i: i["name"])
+
+
+def _validate_config(config):
+    """Confirmed real bugs, both by reproduction:
+
+    1. md5_key.key/key_id were checked by truthiness, not presence --
+       key_id set without key reached _auth_to_device and produced
+       {"md5-key": None} in the generated command (a broken device
+       write, not a validation failure); an empty-string key without
+       key_id silently passed validation and then got dropped
+       entirely by _auth_to_device's own key_id is not None check
+       (the original confirmed bug, just reachable via a second
+       value). is not None checks catch both directions and don't
+       treat a legitimately-empty (but explicitly set) value as
+       "unset".
+
+    2. authentication is documented and confirmed (via vyos-1x
+       schema) as IPv4-only -- OSPFv3's interface config has no
+       authentication node at all -- but the shared argspec doesn't
+       enforce this, and _af6_entry_to_device would silently forward
+       it into the ipv6 device path, where the real device would
+       reject it at apply time instead of failing cleanly upfront.
+    """
+    for entry in config or []:
+        name = entry.get("name")
+        for af in entry.get("address_family") or []:
+            afi = af.get("afi")
+            auth = af.get("authentication") or {}
+
+            if afi == "ipv6" and auth:
+                return (
+                    "address_family.authentication was set for interface "
+                    "'{0}' with afi: ipv6 -- authentication is IPv4-only "
+                    "and has no corresponding OSPFv3 device path.".format(name)
+                )
+
+            md5 = auth.get("md5_key") or {}
+            has_key = md5.get("key") is not None
+            has_key_id = md5.get("key_id") is not None
+            if has_key != has_key_id:
+                return (
+                    "address_family.authentication.md5_key.key and .key_id "
+                    "were not both set for interface '{0}' -- both are "
+                    "required together.".format(name)
+                )
+    return None
+
+
+def build_commands(config, raw_have, state):
+    raw4, raw6 = raw_have
+    config = config or []
 
     if state == "deleted":
+        cmds = []
         if not config:
-            # delete all
-            if have_raw:
-                for iface in have_raw:
-                    name = iface["name"]
-                    afs = {af["afi"] for af in iface.get("address_family", [])}
-                    if "ipv4" in afs:
-                        cmds.append(("delete", _BASE4 + [name]))
-                    if "ipv6" in afs:
-                        cmds.append(("delete", _BASE6 + [name]))
-        else:
-            for entry in config:
-                name = entry["name"]
-                if name in have_map:
-                    have_afs = {af["afi"] for af in have_map[name].get("address_family", [])}
-                    want_afis = {af["afi"] for af in (entry.get("address_family") or [])}
-                    if not want_afis:
-                        # delete all AFIs for this interface
-                        if "ipv4" in have_afs:
-                            cmds.append(("delete", _BASE4 + [name]))
-                        if "ipv6" in have_afs:
-                            cmds.append(("delete", _BASE6 + [name]))
-                    else:
-                        if "ipv4" in want_afis and "ipv4" in have_afs:
-                            cmds.append(("delete", _BASE4 + [name]))
-                        if "ipv6" in want_afis and "ipv6" in have_afs:
-                            cmds.append(("delete", _BASE6 + [name]))
-        return cmds
-
-    if state == "overridden":
-        want_names = {e["name"] for e in config}
-        for name, have_iface in have_map.items():
-            if name not in want_names:
-                have_afs = {af["afi"] for af in have_iface.get("address_family", [])}
-                if "ipv4" in have_afs:
+            for name in raw4 or {}:
+                cmds.append(("delete", _BASE4 + [name]))
+            for name in raw6 or {}:
+                cmds.append(("delete", _BASE6 + [name]))
+            return cmds
+        for entry in config:
+            name = entry.get("name")
+            if not name:
+                continue
+            want_afis = {af.get("afi") for af in (entry.get("address_family") or [])}
+            if not want_afis:
+                if name in (raw4 or {}):
                     cmds.append(("delete", _BASE4 + [name]))
-                if "ipv6" in have_afs:
+                if name in (raw6 or {}):
                     cmds.append(("delete", _BASE6 + [name]))
-
-    for entry in config:
-        name = entry["name"]
-        have_iface = have_map.get(name, {})
-        have_af_map = {af["afi"]: af for af in have_iface.get("address_family", [])}
-
-        for af in entry.get("address_family", []):
-            afi = af["afi"]
-            have_af = have_af_map.get(afi, {})
-
-            if state == "replaced":
-                af_clean = {k: v for k, v in af.items() if v is not None}
-                if have_af and have_af != af_clean:
-                    if afi == "ipv4":
-                        cmds.append(("delete", _BASE4 + [name]))
-                        have_af = {}
-                    else:
-                        cmds.append(("delete", _BASE6 + [name]))
-                        have_af = {}
-                elif have_af == af_clean:
-                    continue  # already matches — idempotent
-
-            if afi == "ipv4":
-                cmds += _ipv4_af_cmds(name, af, have_af)
             else:
-                cmds += _ipv6_af_cmds(name, af, have_af)
-
-    return cmds
+                if "ipv4" in want_afis and name in (raw4 or {}):
+                    cmds.append(("delete", _BASE4 + [name]))
+                if "ipv6" in want_afis and name in (raw6 or {}):
+                    cmds.append(("delete", _BASE6 + [name]))
+        return cmds
 
+    want4, want6 = _want_to_device(config)
+    have_argspec = _device_to_argspec(raw4, raw6)
+    norm4, norm6 = _want_to_device(have_argspec)
 
-ARGUMENT_SPEC = dict(
-    config=dict(
-        type="list",
-        elements="dict",
+    commands = []
+    if state == "overridden":
+        commands += dict_op(want4, norm4, _BASE4, op="purge")
+        commands += dict_op(want6, norm6, _BASE6, op="purge")
+        # Confirmed bug: an interface present on the raw device with
+        # an entirely empty per-AFI entry (bare presence, nothing
+        # configured under it) produces {} from _af*_entry_from_device,
+        # which _device_to_argspec silently omits -- invisible to both
+        # want and norm_have, so dict_op's purge above (which only
+        # ever iterates have's own keys) can never generate a delete
+        # for it. These names are, by construction, guaranteed absent
+        # from norm4/norm6, so there's no risk of duplicating a delete
+        # dict_op already issued.
+        for name in raw4 or {}:
+            if name not in norm4 and name not in want4:
+                commands.append(("delete", _BASE4 + [name]))
+        for name in raw6 or {}:
+            if name not in norm6 and name not in want6:
+                commands.append(("delete", _BASE6 + [name]))
+    elif state == "replaced":
+        for entry in config:
+            name = entry.get("name")
+            if not name:
+                continue
+            for af in entry.get("address_family") or []:
+                afi = af.get("afi")
+                if afi == "ipv4":
+                    commands += dict_op(
+                        want4.get(name, {}),
+                        norm4.get(name, {}),
+                        _BASE4 + [name],
+                        op="purge",
+                    )
+                elif afi == "ipv6":
+                    commands += dict_op(
+                        want6.get(name, {}),
+                        norm6.get(name, {}),
+                        _BASE6 + [name],
+                        op="purge",
+                    )
+    commands += dict_op(want4, norm4, _BASE4, op="set")
+    commands += dict_op(want6, norm6, _BASE6, op="set")
+    return commands
+
+
+_AUTH_OPTIONS = dict(
+    plaintext_password=dict(type="str", no_log=True),
+    md5_key=dict(
+        type="dict",
+        no_log=True,
         options=dict(
-            name=dict(type="str", required=True),
-            address_family=dict(
-                type="list",
-                elements="dict",
-                options=dict(
-                    afi=dict(type="str", choices=["ipv4", "ipv6"], required=True),
-                    authentication=dict(
-                        type="dict",
-                        options=dict(
-                            plaintext_password=dict(type="str", no_log=True),
-                            md5_key=dict(
-                                type="dict",
-                                no_log=True,
-                                options=dict(
-                                    key_id=dict(type="int"),
-                                    key=dict(type="str", no_log=True),
-                                ),
-                            ),
-                        ),
-                    ),
-                    bandwidth=dict(type="int"),
-                    cost=dict(type="int"),
-                    dead_interval=dict(type="int"),
-                    hello_interval=dict(type="int"),
-                    ifmtu=dict(type="int"),
-                    instance=dict(type="str"),
-                    mtu_ignore=dict(type="bool"),
-                    network=dict(
-                        type="str",
-                        choices=[
-                            "broadcast",
-                            "non-broadcast",
-                            "point-to-multipoint",
-                            "point-to-point",
-                        ],
-                    ),
-                    passive=dict(type="bool"),
-                    priority=dict(type="int"),
-                    retransmit_interval=dict(type="int"),
-                    transmit_delay=dict(type="int"),
-                ),
-            ),
+            key_id=dict(type="int"),
+            key=dict(type="str", no_log=True),
         ),
     ),
+)
+
+_AF_OPTIONS = dict(
+    afi=dict(type="str", choices=["ipv4", "ipv6"], required=True),
+    area=dict(type="str"),
+    authentication=dict(type="dict", options=_AUTH_OPTIONS),
+    bandwidth=dict(type="int"),
+    cost=dict(type="int"),
+    dead_interval=dict(type="int"),
+    hello_interval=dict(type="int"),
+    ifmtu=dict(type="int"),
+    instance=dict(type="str"),
+    mtu_ignore=dict(type="bool"),
+    network=dict(
+        type="str",
+        choices=["broadcast", "non-broadcast", "point-to-multipoint", "point-to-point"],
+    ),
+    passive=dict(type="bool"),
+    priority=dict(type="int"),
+    retransmit_interval=dict(type="int"),
+    transmit_delay=dict(type="int"),
+)
+
+_ENTRY_OPTIONS = dict(
+    name=dict(type="str", required=True),
+    address_family=dict(type="list", elements="dict", options=_AF_OPTIONS),
+)
+
+ARGUMENT_SPEC = dict(
+    config=dict(type="list", elements="dict", options=_ENTRY_OPTIONS),
     state=dict(
         default="merged",
         choices=["merged", "replaced", "overridden", "deleted", "gathered"],
@@ -510,23 +510,36 @@ def main():
     state = module.params["state"]
     config = module.params.get("config") or []
 
-    have = get_running_config(vyos)
+    validation_error = _validate_config(config)
+    if validation_error:
+        module.fail_json(msg=validation_error)
+
+    raw_have = get_running_config(vyos)
+    have = _device_to_argspec(*raw_have)
+    for iface in have:
+        for af in iface.get("address_family") or []:
+            cast_by_spec(af, _AF_OPTIONS)
 
     if state == "gathered":
         module.exit_json(changed=False, gathered=have)
 
-    commands = build_commands(config, have, state)
+    commands = build_commands(config, raw_have, state)
 
     if module.check_mode:
-        module.exit_json(changed=bool(commands), commands=commands, before=have)
+        module.exit_json(changed=bool(commands), commands=commands, before=have, after=have)
 
     if commands:
         response = vyos.apply_commands(commands)
         saved = vyos.save_config()
+        after_raw = get_running_config(vyos)
+        after = _device_to_argspec(*after_raw)
+        for iface in after:
+            for af in iface.get("address_family") or []:
+                cast_by_spec(af, _AF_OPTIONS)
         module.exit_json(
             changed=True,
             before=have,
-            after=get_running_config(vyos),
+            after=after,
             commands=commands,
             saved=saved,
             response=response,
diff --git a/plugins/modules/vyos_ospfv2.py b/plugins/modules/vyos_ospfv2.py
index 5ac333d..efdd2a5 100644
--- a/plugins/modules/vyos_ospfv2.py
+++ b/plugins/modules/vyos_ospfv2.py
@@ -1,6 +1,7 @@
 #!/usr/bin/python
 # -*- coding: utf-8 -*-
-# GNU General Public License v3.0+
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+
 from __future__ import absolute_import, division, print_function
 
 
@@ -13,7 +14,25 @@ short_description: Manage OSPFv2 configuration on VyOS devices using REST API
 description:
   - Manages OSPFv2 configuration on VyOS devices via the REST API.
   - Uses REST API (C(connection=httpapi)) instead of CLI.
-  - 'In VyOS 1.5+, passive interfaces use per-interface config rather than passive-interface.'
+  - >-
+    Scope matches the current vyos.vyos.vyos_ospfv2 (CLI collection) module:
+    areas (including virtual_link), auto_cost, default_information,
+    default_metric, distance, log_adjacency_changes, max_metric, mpls_te,
+    neighbor, parameters, passive_interface, passive_interface_exclude,
+    redistribute, timers. VyOS's OSPF schema is considerably larger than
+    even this -- access-list, aggregation, capability, graceful-restart,
+    ldp-sync, maximum-paths, per-interface
+    tuning (bandwidth/hello-multiplier/network-type/authentication/intervals beyond passive),
+    segment-routing, and summary-address are not modeled here, matching
+    real gaps in the CLI module's own scope, not oversights.
+  - >-
+    A standalone top-level C(route_map) field exists in the CLI module's
+    argspec but does not correspond to any real device path -- confirmed
+    against a live VyOS 1.5.0 device's C(set protocols ospf) completions,
+    which list no C(route-map) entry at that level (only nested under
+    C(default-information originate) and per-protocol under
+    C(redistribute), both of which are modeled here). Deliberately
+    omitted rather than built against a confirmed non-functional field.
 version_added: "1.0.0"
 author:
   - VyOS Community (@vyos)
@@ -103,6 +122,45 @@ options:
             description: Shortcut mode.
             type: str
             choices: [default, disable, enable]
+          virtual_link:
+            description: Virtual link.
+            type: list
+            elements: dict
+            suboptions:
+              address:
+                description: Virtual link address (router ID of the remote ABR).
+                type: str
+                required: true
+              authentication:
+                description: Virtual link authentication.
+                type: dict
+                suboptions:
+                  md5:
+                    description: MD5 key id based authentication.
+                    type: list
+                    elements: dict
+                    suboptions:
+                      key_id:
+                        description: MD5 key id (1-255).
+                        type: int
+                      md5_key:
+                        description: MD5 key (16 characters or less).
+                        type: str
+                  plaintext_password:
+                    description: Plain text password (8 characters or less).
+                    type: str
+              dead_interval:
+                description: Interval after which a neighbor is declared dead.
+                type: int
+              hello_interval:
+                description: Interval between hello packets.
+                type: int
+              retransmit_interval:
+                description: Interval between retransmitting lost link state advertisements.
+                type: int
+              transmit_delay:
+                description: Link state transmit delay.
+                type: int
       auto_cost:
         description: Auto-cost reference bandwidth.
         type: dict
@@ -157,6 +215,33 @@ options:
         description: Log adjacency changes.
         type: str
         choices: [detail]
+      max_metric:
+        description: OSPFv2 maximum/infinite-distance metric.
+        type: dict
+        suboptions:
+          router_lsa:
+            description: Advertise own Router-LSA with infinite distance (stub router).
+            type: dict
+            suboptions:
+              administrative:
+                description: Administratively apply, for an indefinite period.
+                type: bool
+              on_shutdown:
+                description: Time (seconds) to advertise self as stub-router before shutdown.
+                type: int
+              on_startup:
+                description: Time (seconds) to advertise self as stub-router on startup.
+                type: int
+      mpls_te:
+        description: MPLS Traffic Engineering parameters.
+        type: dict
+        suboptions:
+          enabled:
+            description: Enable MPLS-TE functionality.
+            type: bool
+          router_address:
+            description: Stable IP address of the advertising router.
+            type: str
       neighbor:
         description: OSPF neighbors.
         type: list
@@ -190,9 +275,16 @@ options:
             description: Router ID.
             type: str
       passive_interface:
-        description: >
-          Passive interfaces (VyOS 1.5+: configured via
-          C(protocols ospf interface <name> passive)).
+        description: >-
+          Interfaces to suppress routing updates on, via per-interface
+          configuration (C(protocols ospf interface <name> passive)).
+        type: list
+        elements: str
+      passive_interface_exclude:
+        description: >-
+          Interfaces to explicitly exclude from passive mode (via
+          C(protocols ospf interface <name> passive disable)) -- e.g.
+          when passive is otherwise applied broadly.
         type: list
         elements: str
       redistribute:
@@ -213,6 +305,34 @@ options:
           route_map:
             description: Route map.
             type: str
+      timers:
+        description: Routing timers.
+        type: dict
+        suboptions:
+          refresh:
+            description: Refresh parameters.
+            type: dict
+            suboptions:
+              timers:
+                description: Refresh timer (seconds).
+                type: int
+          throttle:
+            description: Throttling adaptive timers.
+            type: dict
+            suboptions:
+              spf:
+                description: SPF timers.
+                type: dict
+                suboptions:
+                  delay:
+                    description: Delay (ms) from first change received to SPF calculation.
+                    type: int
+                  initial_holdtime:
+                    description: Initial hold time (ms) between consecutive SPF calculations.
+                    type: int
+                  max_holdtime:
+                    description: Maximum hold time (ms).
+                    type: int
   state:
     description:
       - Desired state.
@@ -226,8 +346,8 @@ options:
 notes:
   - Requires C(ansible_connection=httpapi) with the VyOS httpapi plugin.
   - C(ansible_network_os) must be set to C(vyos.rest.vyos).
-  - VyOS 1.5+ uses per-interface passive configuration rather than
-    the global C(passive-interface) command used in VyOS 1.4.
+seealso:
+  - module: vyos.vyos.vyos_ospfv2
 """
 
 EXAMPLES = r"""
@@ -245,10 +365,6 @@ EXAMPLES = r"""
             normal: true
           network:
             - address: 192.0.2.0/24
-        - area_id: "3"
-          area_type:
-            nssa:
-              set: true
         - area_id: "4"
           area_type:
             stub:
@@ -261,6 +377,16 @@ EXAMPLES = r"""
           metric: 10
       passive_interface:
         - eth1
+      max_metric:
+        router_lsa:
+          administrative: true
+      mpls_te:
+        enabled: true
+        router_address: 192.0.11.11
+      timers:
+        throttle:
+          spf:
+            delay: 200
     state: merged
 
 - name: Delete all OSPFv2 configuration
@@ -300,618 +426,706 @@ response:
 """
 
 from ansible.module_utils.basic import AnsibleModule
-from ansible_collections.vyos.rest.plugins.module_utils.vyos import VyOSModule
+from ansible_collections.vyos.rest.plugins.module_utils.vyos import (
+    VyOSModule,
+    autoclean,
+    cast_by_spec,
+    dict_op,
+    from_device,
+    to_tag_dict,
+)
 
 
 _BASE = ["protocols", "ospf"]
 
 
-def _parse_areas(raw_areas):
-    if not raw_areas or not isinstance(raw_areas, dict):
-        return []
-    areas = []
-    for area_id, data in sorted(raw_areas.items()):
-        area = {"area_id": area_id}
-        data = data or {}
+def _derive_key_field(options_spec):
+    """The field identifying each entry in a named-list section is
+    never inferable from a generic walk alone -- but it doesn't need
+    to be hand-declared either: every named-list section in this
+    argspec already marks exactly one suboption required=True.
+    """
+    required = [k for k, spec in options_spec.items() if spec.get("required")]
+    if len(required) != 1:
+        raise ValueError(
+            "expected exactly one required suboption to serve as the key field, "
+            "found: {0}".format(required),
+        )
+    return required[0]
 
-        # area-type
-        at = data.get("area-type", {})
-        if at:
-            area_type = {}
-            if "normal" in at:
-                area_type["normal"] = True
-            if "nssa" in at:
-                nssa_data = at["nssa"] or {}
-                nssa = {"set": True}
-                if "default-cost" in nssa_data:
-                    nssa["default_cost"] = int(nssa_data["default-cost"])
-                if "no-summary" in nssa_data:
-                    nssa["no_summary"] = True
-                if "translate" in nssa_data:
-                    nssa["translate"] = nssa_data["translate"]
-                area_type["nssa"] = nssa
-            if "stub" in at:
-                stub_data = at["stub"] or {}
-                stub = {"set": True}
-                if "default-cost" in stub_data:
-                    stub["default_cost"] = int(stub_data["default-cost"])
-                if "no-summary" in stub_data:
-                    stub["no_summary"] = True
-                area_type["stub"] = stub
-            if area_type:
-                area["area_type"] = area_type
-
-        if "authentication" in data:
-            area["authentication"] = data["authentication"]
-
-        if "shortcut" in data:
-            area["shortcut"] = data["shortcut"]
-
-        # network
-        net = data.get("network")
-        if net:
-            if isinstance(net, str):
-                area["network"] = [{"address": net}]
-            elif isinstance(net, dict):
-                area["network"] = [{"address": a} for a in sorted(net.keys())]
-            elif isinstance(net, list):
-                area["network"] = [{"address": a} for a in sorted(net)]
-
-        # range
-        rng = data.get("range", {})
-        if rng and isinstance(rng, dict):
-            ranges = []
-            for addr, rdata in sorted(rng.items()):
-                r = {"address": addr}
-                rdata = rdata or {}
-                if "cost" in rdata:
-                    r["cost"] = int(rdata["cost"])
-                if "not-advertise" in rdata:
-                    r["not_advertise"] = True
-                if "substitute" in rdata:
-                    r["substitute"] = rdata["substitute"]
-                ranges.append(r)
-            if ranges:
-                area["range"] = ranges
-
-        areas.append(area)
-    return areas
-
-
-def _parse_redistribute(raw):
-    if not raw or not isinstance(raw, dict):
-        return []
-    result = []
-    for rt, data in sorted(raw.items()):
-        entry = {"route_type": rt}
-        data = data or {}
-        if "metric" in data:
-            entry["metric"] = int(data["metric"])
-        if "metric-type" in data:
-            entry["metric_type"] = int(data["metric-type"])
-        if "route-map" in data:
-            entry["route_map"] = data["route-map"]
-        result.append(entry)
+
+def _keyed_list_to_device(items, key_field, entry_transform=None):
+    entry_transform = entry_transform or _kebab_fields
+    result = {}
+    for item in items or []:
+        if not item.get(key_field):
+            continue
+        rest = {k: v for k, v in item.items() if k != key_field}
+        result[str(item[key_field])] = entry_transform(rest)
     return result
 
 
-def _parse_neighbor(raw):
-    if not raw or not isinstance(raw, dict):
-        return []
-    result = []
-    for nb_id, data in sorted(raw.items()):
-        entry = {"neighbor_id": nb_id}
-        data = data or {}
-        if "poll-interval" in data:
-            entry["poll_interval"] = int(data["poll-interval"])
-        if "priority" in data:
-            entry["priority"] = int(data["priority"])
-        result.append(entry)
-    return result
+def _keyed_list_from_device(raw, key_field, entry_transform=None, key_cast=None):
+    entry_transform = entry_transform or from_device
+    key_cast = key_cast or (lambda k: k)
+    return [
+        {key_field: key_cast(key), **entry_transform(data or {})}
+        for key, data in sorted(to_tag_dict(raw).items())
+    ]
 
 
-def _parse_parameters(raw):
-    if not raw or not isinstance(raw, dict):
-        return {}
-    result = {}
-    if "router-id" in raw:
-        result["router_id"] = raw["router-id"]
-    if "abr-type" in raw:
-        result["abr_type"] = raw["abr-type"]
-    if "opaque-lsa" in raw:
-        result["opaque_lsa"] = True
-    if "rfc1583-compatibility" in raw:
-        result["rfc1583_compatibility"] = True
-    return result
+# ---------------------------------------------------------------------------
+# area_type -- confirmed against vyos-1x: normal (presence), nssa (a node
+# with default-cost/no-summary/translate -- presence of the node itself
+# is the "set" flag, matching the argspec's own "set" boolean rather
+# than a separate device leaf), stub (default-cost/no-summary,
+# same presence pattern). Genuine structural exception: the argspec's
+# nssa/stub "set" key doesn't exist as a device leaf at all -- the
+# *node's presence* IS the set flag, so "set" must be stripped out
+# before the walk and re-derived on the way back.
+# ---------------------------------------------------------------------------
 
 
-def _parse_default_information(raw):
-    if not raw or not isinstance(raw, dict):
+def _area_type_to_device(area_type):
+    if not area_type:
         return {}
-    orig = raw.get("originate", {}) or {}
-    result = {}
-    if "always" in orig:
-        result["always"] = True
-    if "metric" in orig:
-        result["metric"] = int(orig["metric"])
-    if "metric-type" in orig:
-        result["metric_type"] = int(orig["metric-type"])
-    if "route-map" in orig:
-        result["route_map"] = orig["route-map"]
-    if result:
-        return {"originate": result}
-    return {}
+    device = {}
+    if area_type.get("normal"):
+        device["normal"] = {}
+    nssa = area_type.get("nssa")
+    if nssa:
+        nssa_device = _kebab_fields({k: v for k, v in nssa.items() if k != "set"})
+        device["nssa"] = nssa_device
+    stub = area_type.get("stub")
+    if stub:
+        stub_device = _kebab_fields({k: v for k, v in stub.items() if k != "set"})
+        device["stub"] = stub_device
+    return device
+
+
+def _area_type_from_device(data):
+    if not data:
+        return None
+    entry = {}
+    if "normal" in data:
+        entry["normal"] = True
+    if "nssa" in data:
+        nssa = from_device(data["nssa"] or {})
+        nssa["set"] = True
+        entry["nssa"] = nssa
+    if "stub" in data:
+        stub = from_device(data["stub"] or {})
+        stub["set"] = True
+        entry["stub"] = stub
+    return entry or None
+
+
+# ---------------------------------------------------------------------------
+# virtual_link -- confirmed against vyos-1x: keyed by address, with an
+# "authentication" node (md5 tag-node keyed by key-id, or a bare
+# plaintext-password leaf), plus dead-interval/hello-interval/
+# retransmit-interval/transmit-delay as plain leaves.
+# ---------------------------------------------------------------------------
+
+
+def _vlink_auth_to_device(auth):
+    if not auth:
+        return {}
+    device = {}
+    md5_list = auth.get("md5") or []
+    if md5_list:
+        md5_device = {
+            str(entry["key_id"]): {"md5-key": entry["md5_key"]}
+            for entry in md5_list
+            if entry.get("key_id") is not None and entry.get("md5_key") is not None
+        }
+        if md5_device:
+            device["md5"] = md5_device
+    if auth.get("plaintext_password"):
+        device["plaintext-password"] = auth["plaintext_password"]
+    return device
+
+
+def _vlink_auth_from_device(data):
+    if not data:
+        return None
+    entry = {}
+    md5_raw = data.get("md5")
+    if md5_raw:
+        entry["md5"] = [
+            {"key_id": int(key_id), "md5_key": (kdata or {}).get("md5-key")}
+            for key_id, kdata in sorted(to_tag_dict(md5_raw).items())
+        ]
+    if data.get("plaintext-password"):
+        entry["plaintext_password"] = data["plaintext-password"]
+    return entry or None
+
+
+def _vlink_entry_to_device(rest):
+    exclude = {"authentication"}
+    device = _kebab_fields({k: v for k, v in rest.items() if k not in exclude})
+    if rest.get("authentication"):
+        auth_device = _vlink_auth_to_device(rest["authentication"])
+        if auth_device:
+            device["authentication"] = auth_device
+    return device
+
+
+def _vlink_entry_from_device(data):
+    exclude = {"authentication"}
+    entry = from_device({k: v for k, v in data.items() if k not in exclude})
+    auth = _vlink_auth_from_device(data.get("authentication"))
+    if auth:
+        entry["authentication"] = auth
+    return entry
+
+
+# ---------------------------------------------------------------------------
+# area -- orchestrates area_type, network, range, virtual_link, and the
+# plain leaves (authentication, shortcut).
+# ---------------------------------------------------------------------------
+
+_NETWORK_KEY = "address"
+_RANGE_KEY = "address"
+_VLINK_KEY = "address"
+
+
+def _area_entry_to_device(rest):
+    exclude = {"area_type", "network", "range", "virtual_link"}
+    device = autoclean({k: v for k, v in rest.items() if k not in exclude})
+
+    at = _area_type_to_device(rest.get("area_type"))
+    if at:
+        device["area-type"] = at
+
+    networks = rest.get("network") or []
+    if networks:
+        device["network"] = {n["address"]: {} for n in networks if n.get("address")}
+
+    ranges = rest.get("range") or []
+    if ranges:
+        device["range"] = _keyed_list_to_device(ranges, _RANGE_KEY)
+
+    vlinks = rest.get("virtual_link") or []
+    if vlinks:
+        device["virtual-link"] = _keyed_list_to_device(vlinks, _VLINK_KEY, _vlink_entry_to_device)
+
+    return device
+
+
+def _area_entry_from_device(data):
+    exclude = {"area-type", "network", "range", "virtual-link"}
+    entry = from_device({k: v for k, v in data.items() if k not in exclude})
+
+    at = _area_type_from_device(data.get("area-type"))
+    if at:
+        entry["area_type"] = at
+
+    net_raw = data.get("network")
+    if net_raw:
+        entry["network"] = [{"address": addr} for addr in sorted(to_tag_dict(net_raw))]
+
+    range_raw = data.get("range")
+    if range_raw:
+        entry["range"] = _keyed_list_from_device(range_raw, _RANGE_KEY)
+
+    vlink_raw = data.get("virtual-link")
+    if vlink_raw:
+        entry["virtual_link"] = _keyed_list_from_device(
+            vlink_raw,
+            _VLINK_KEY,
+            _vlink_entry_from_device,
+        )
+
+    return entry
+
 
+# ---------------------------------------------------------------------------
+# distance -- confirmed genuine structural exception: argspec's "global"
+# is a reserved-adjacent-but-legal dict key (fine as a string key, no
+# Python keyword issue since it's inside dict(**{...}), unlike "as"
+# elsewhere in this collection), device path is distance.global (a
+# leaf) and distance.ospf.{external,inter-area,intra-area}.
+# ---------------------------------------------------------------------------
 
-def _parse_distance(raw):
-    if not raw or not isinstance(raw, dict):
+
+def _distance_to_device(dist):
+    if not dist:
         return {}
-    result = {}
-    if "global" in raw:
-        result["global"] = int(raw["global"])
-    ospf = raw.get("ospf", {}) or {}
+    device = {}
+    if dist.get("global") is not None:
+        device["global"] = dist["global"]
+    ospf = dist.get("ospf")
     if ospf:
-        od = {}
-        if "external" in ospf:
-            od["external"] = int(ospf["external"])
-        if "inter-area" in ospf:
-            od["inter_area"] = int(ospf["inter-area"])
-        if "intra-area" in ospf:
-            od["intra_area"] = int(ospf["intra-area"])
-        if od:
-            result["ospf"] = od
-    return result
+        ospf_device = _kebab_fields(ospf)
+        if ospf_device:
+            device["ospf"] = ospf_device
+    return device
+
+
+def _distance_from_device(data):
+    if not data:
+        return None
+    entry = {}
+    if "global" in data:
+        entry["global"] = int(data["global"])
+    if data.get("ospf"):
+        entry["ospf"] = from_device(data["ospf"])
+    return entry or None
+
+
+# ---------------------------------------------------------------------------
+# timers -- confirmed genuine structural exception: argspec groups
+# "refresh" and "throttle" both under one "timers" parent, but the
+# device has them as two SEPARATE top-level nodes ("refresh" and
+# "timers.throttle") -- not a nested nesting-insertion like most
+# exceptions in this collection, but a nesting *removal*/regrouping.
+# Handled at the top level in build_commands/get_running_config rather
+# than as a single self-contained entry-transform, since it spans two
+# different top-level device keys.
+# ---------------------------------------------------------------------------
+
+
+def _timers_to_device_refresh(timers):
+    """Returns the device's top-level "refresh" node contents."""
+    refresh = (timers or {}).get("refresh") or {}
+    if refresh.get("timers") is not None:
+        return {"timers": refresh["timers"]}
+    return {}
 
 
-def get_running_config(vyos):
-    raw = vyos.get_config(_BASE)
-    if not raw or not isinstance(raw, dict):
-        return {}
-    result = {}
+def _timers_to_device_throttle(timers):
+    """Returns the device's top-level "timers" node contents (just the
+    throttle.spf subtree, matching confirmed scope)."""
+    throttle = (timers or {}).get("throttle") or {}
+    spf = throttle.get("spf") or {}
+    spf_device = _kebab_fields(spf)
+    if spf_device:
+        return {"throttle": {"spf": spf_device}}
+    return {}
 
-    areas = _parse_areas(raw.get("area"))
-    if areas:
-        result["areas"] = areas
 
-    ac = raw.get("auto-cost", {})
-    if ac and "reference-bandwidth" in ac:
-        result["auto_cost"] = {"reference_bandwidth": int(ac["reference-bandwidth"])}
+def _timers_from_device(refresh_raw, timers_raw):
+    entry = {}
+    if refresh_raw and refresh_raw.get("timers") is not None:
+        entry["refresh"] = {"timers": int(refresh_raw["timers"])}
+    throttle_raw = (timers_raw or {}).get("throttle") or {}
+    spf_raw = throttle_raw.get("spf")
+    if spf_raw:
+        entry["throttle"] = {"spf": from_device(spf_raw)}
+    return entry or None
+
+
+# ---------------------------------------------------------------------------
+# passive_interface / passive_interface_exclude -- confirmed against
+# vyos-1x: both map onto the SAME per-interface "interface <name>
+# passive" node -- presence alone means passive-enabled,
+# "passive.disable" (a generic-disable-node) means explicitly
+# excluded. These share one device subtree, so both are handled
+# together rather than as two independent list diffs.
+# ---------------------------------------------------------------------------
+
+
+def _passive_to_device(passive_list, exclude_list):
+    device = {}
+    for iface in passive_list or []:
+        device[iface] = {"passive": {}}
+    for iface in exclude_list or []:
+        device[iface] = {"passive": {"disable": {}}}
+    return device
+
+
+def _passive_from_device(iface_raw):
+    passive = []
+    excluded = []
+    for name, data in sorted((iface_raw or {}).items()):
+        data = data or {}
+        passive_node = data.get("passive")
+        if passive_node is None:
+            continue
+        if isinstance(passive_node, dict) and "disable" in passive_node:
+            excluded.append(name)
+        else:
+            passive.append(name)
+    return passive, excluded
 
-    di = _parse_default_information(raw.get("default-information", {}))
-    if di:
-        result["default_information"] = di
 
-    if "default-metric" in raw:
-        result["default_metric"] = int(raw["default-metric"])
+# ---------------------------------------------------------------------------
+# redistribute -- fully generic once keyed by route_type; metric/
+# metric-type/route-map are all plain leaves.
+# ---------------------------------------------------------------------------
 
-    dist = _parse_distance(raw.get("distance", {}))
-    if dist:
-        result["distance"] = dist
+_REDISTRIBUTE_KEY = "route_type"
+_NEIGHBOR_KEY = "neighbor_id"
 
-    lac = raw.get("log-adjacency-changes", {})
-    if lac:
-        if isinstance(lac, dict) and "detail" in lac:
-            result["log_adjacency_changes"] = "detail"
-        elif lac == "detail":
-            result["log_adjacency_changes"] = "detail"
 
-    neighbors = _parse_neighbor(raw.get("neighbor"))
+def _want_to_device(config):
+    config = config or {}
+    device = {}
+
+    areas = config.get("areas") or []
+    if areas:
+        device["area"] = _keyed_list_to_device(areas, "area_id", _area_entry_to_device)
+
+    ac = config.get("auto_cost") or {}
+    if ac.get("reference_bandwidth") is not None:
+        device["auto-cost"] = {"reference-bandwidth": ac["reference_bandwidth"]}
+
+    di = (config.get("default_information") or {}).get("originate") or {}
+    di_device = _kebab_fields(di)
+    if di_device:
+        device["default-information"] = {"originate": di_device}
+
+    if config.get("default_metric") is not None:
+        device["default-metric"] = config["default_metric"]
+
+    dist_device = _distance_to_device(config.get("distance"))
+    if dist_device:
+        device["distance"] = dist_device
+
+    if config.get("log_adjacency_changes"):
+        device["log-adjacency-changes"] = {config["log_adjacency_changes"]: {}}
+
+    mm = (config.get("max_metric") or {}).get("router_lsa") or {}
+    mm_device = _kebab_fields(mm)
+    if mm_device:
+        device["max-metric"] = {"router-lsa": mm_device}
+
+    mpls = config.get("mpls_te") or {}
+    mpls_device = {}
+    if mpls.get("enabled"):
+        mpls_device["enable"] = {}
+    if mpls.get("router_address"):
+        mpls_device["router-address"] = mpls["router_address"]
+    if mpls_device:
+        device["mpls-te"] = mpls_device
+
+    neighbors = config.get("neighbor") or []
     if neighbors:
-        result["neighbor"] = neighbors
+        device["neighbor"] = _keyed_list_to_device(neighbors, _NEIGHBOR_KEY)
 
-    params = _parse_parameters(raw.get("parameters"))
-    if params:
-        result["parameters"] = params
+    params_device = _kebab_fields(config.get("parameters") or {})
+    if params_device:
+        device["parameters"] = params_device
 
-    # passive interfaces — VyOS 1.5 uses interface <name> passive
-    iface_raw = raw.get("interface", {}) or {}
-    passive = sorted(
-        [name for name, data in iface_raw.items() if isinstance(data, dict) and "passive" in data],
+    iface_device = _passive_to_device(
+        config.get("passive_interface"),
+        config.get("passive_interface_exclude"),
     )
-    if passive:
-        result["passive_interface"] = passive
+    if iface_device:
+        device["interface"] = iface_device
 
-    redist = _parse_redistribute(raw.get("redistribute"))
+    redist = config.get("redistribute") or []
     if redist:
-        result["redistribute"] = redist
+        device["redistribute"] = _keyed_list_to_device(redist, _REDISTRIBUTE_KEY)
 
-    return result
+    refresh_device = _timers_to_device_refresh(config.get("timers"))
+    if refresh_device:
+        device["refresh"] = refresh_device
+    throttle_device = _timers_to_device_throttle(config.get("timers"))
+    if throttle_device:
+        device.setdefault("timers", {}).update(throttle_device)
 
+    return device
 
-def _area_type_cmds(abase, area_type, have_at):
-    cmds = []
-    have_at = have_at or {}
-    if area_type.get("normal") and not have_at.get("normal"):
-        cmds.append(("set", abase + ["area-type", "normal"]))
-    nssa = area_type.get("nssa") or {}
-    if nssa:
-        have_nssa = have_at.get("nssa") or {}
-        if not have_nssa:
-            cmds.append(("set", abase + ["area-type", "nssa"]))
-        if nssa.get("default_cost") and nssa["default_cost"] != have_nssa.get("default_cost"):
-            cmds.append(
-                (
-                    "set",
-                    abase
-                    + [
-                        "area-type",
-                        "nssa",
-                        "default-cost",
-                        str(nssa["default_cost"]),
-                    ],
-                ),
-            )
-        if nssa.get("no_summary") and not have_nssa.get("no_summary"):
-            cmds.append(("set", abase + ["area-type", "nssa", "no-summary"]))
-        if nssa.get("translate") and nssa["translate"] != have_nssa.get("translate"):
-            cmds.append(("set", abase + ["area-type", "nssa", "translate", nssa["translate"]]))
-    stub = area_type.get("stub") or {}
-    if stub:
-        have_stub = have_at.get("stub") or {}
-        if not have_stub:
-            if stub.get("default_cost"):
-                cmds.append(
-                    (
-                        "set",
-                        abase
-                        + [
-                            "area-type",
-                            "stub",
-                            "default-cost",
-                            str(stub["default_cost"]),
-                        ],
-                    ),
-                )
-            else:
-                cmds.append(("set", abase + ["area-type", "stub"]))
-        elif stub.get("default_cost") and stub["default_cost"] != have_stub.get("default_cost"):
-            cmds.append(
-                (
-                    "set",
-                    abase
-                    + [
-                        "area-type",
-                        "stub",
-                        "default-cost",
-                        str(stub["default_cost"]),
-                    ],
-                ),
-            )
-    return cmds
-
-
-def _area_cmds(area, have_area):
-    cmds = []
-    area_id = area["area_id"]
-    abase = _BASE + ["area", area_id]
-    have_area = have_area or {}
-
-    if area.get("area_type"):
-        cmds += _area_type_cmds(abase, area["area_type"], have_area.get("area_type"))
-
-    if area.get("authentication") and area["authentication"] != have_area.get("authentication"):
-        cmds.append(("set", abase + ["authentication", area["authentication"]]))
-
-    if area.get("shortcut") and area["shortcut"] != have_area.get("shortcut"):
-        cmds.append(("set", abase + ["shortcut", area["shortcut"]]))
-
-    want_nets = {n["address"] for n in (area.get("network") or [])}
-    have_nets = {n["address"] for n in (have_area.get("network") or [])}
-    for addr in want_nets - have_nets:
-        cmds.append(("set", abase + ["network", addr]))
-
-    want_ranges = {r["address"]: r for r in (area.get("range") or [])}
-    have_ranges = {r["address"]: r for r in (have_area.get("range") or [])}
-    for addr, rng in want_ranges.items():
-        have_rng = have_ranges.get(addr, {})
-        if addr not in have_ranges:
-            cmds.append(("set", abase + ["range", addr]))
-        if rng.get("cost") and rng["cost"] != have_rng.get("cost"):
-            cmds.append(("set", abase + ["range", addr, "cost", str(rng["cost"])]))
-        if rng.get("not_advertise") and not have_rng.get("not_advertise"):
-            cmds.append(("set", abase + ["range", addr, "not-advertise"]))
-        if rng.get("substitute") and rng["substitute"] != have_rng.get("substitute"):
-            cmds.append(("set", abase + ["range", addr, "substitute", rng["substitute"]]))
-
-    return cmds
-
-
-def _parameters_cmds(params, have_params):
-    cmds = []
-    have_params = have_params or {}
-    pbase = _BASE + ["parameters"]
-    if params.get("router_id") and params["router_id"] != have_params.get("router_id"):
-        cmds.append(("set", pbase + ["router-id", params["router_id"]]))
-    if params.get("abr_type") and params["abr_type"] != have_params.get("abr_type"):
-        cmds.append(("set", pbase + ["abr-type", params["abr_type"]]))
-    if params.get("opaque_lsa") and not have_params.get("opaque_lsa"):
-        cmds.append(("set", pbase + ["opaque-lsa"]))
-    if params.get("rfc1583_compatibility") and not have_params.get("rfc1583_compatibility"):
-        cmds.append(("set", pbase + ["rfc1583-compatibility"]))
-    return cmds
-
-
-def _redistribute_cmds(redist_list, have_redist_list):
-    cmds = []
-    want = {r["route_type"]: r for r in (redist_list or [])}
-    have = {r["route_type"]: r for r in (have_redist_list or [])}
-    for rt, entry in want.items():
-        have_entry = have.get(rt, {})
-        rbase = _BASE + ["redistribute", rt]
-        if rt not in have:
-            cmds.append(("set", rbase))
-        if entry.get("metric") and entry["metric"] != have_entry.get("metric"):
-            cmds.append(("set", rbase + ["metric", str(entry["metric"])]))
-        if entry.get("metric_type") and entry["metric_type"] != have_entry.get("metric_type"):
-            cmds.append(("set", rbase + ["metric-type", str(entry["metric_type"])]))
-        if entry.get("route_map") and entry["route_map"] != have_entry.get("route_map"):
-            cmds.append(("set", rbase + ["route-map", entry["route_map"]]))
-    return cmds
-
-
-def _neighbor_cmds(neighbors, have_neighbors):
-    cmds = []
-    want = {n["neighbor_id"]: n for n in (neighbors or [])}
-    have = {n["neighbor_id"]: n for n in (have_neighbors or [])}
-    for nb_id, entry in want.items():
-        have_entry = have.get(nb_id, {})
-        nbase = _BASE + ["neighbor", nb_id]
-        if nb_id not in have:
-            cmds.append(("set", nbase))
-        if entry.get("priority") and entry["priority"] != have_entry.get("priority"):
-            cmds.append(("set", nbase + ["priority", str(entry["priority"])]))
-        if entry.get("poll_interval") and entry["poll_interval"] != have_entry.get("poll_interval"):
-            cmds.append(("set", nbase + ["poll-interval", str(entry["poll_interval"])]))
-    return cmds
-
-
-def _default_info_cmds(di, have_di):
-    cmds = []
-    have_di = have_di or {}
-    orig = (di or {}).get("originate") or {}
-    have_orig = have_di.get("originate") or {}
-    if not orig:
-        return cmds
-    dbase = _BASE + ["default-information", "originate"]
-    if orig.get("always") and not have_orig.get("always"):
-        cmds.append(("set", dbase + ["always"]))
-    if orig.get("metric") and orig["metric"] != have_orig.get("metric"):
-        cmds.append(("set", dbase + ["metric", str(orig["metric"])]))
-    if orig.get("metric_type") and orig["metric_type"] != have_orig.get("metric_type"):
-        cmds.append(("set", dbase + ["metric-type", str(orig["metric_type"])]))
-    if orig.get("route_map") and orig["route_map"] != have_orig.get("route_map"):
-        cmds.append(("set", dbase + ["route-map", orig["route_map"]]))
-    return cmds
-
-
-def build_commands(config, have, state):
-    cmds = []
 
-    if state == "deleted":
-        if have:
-            cmds.append(("delete", _BASE))
-        return cmds
+def get_running_config(vyos):
+    return vyos.get_config(_BASE) or {}
 
-    if state == "replaced":
-        would_set = build_commands(config, {}, "merged")
-        have_set = build_commands(have, {}, "merged")
-        if would_set == have_set:
-            return []
-        if have:
-            cmds.append(("delete", _BASE))
-        have = {}
 
-    config = config or {}
+def _device_to_argspec(raw):
+    if not raw:
+        return {}
+    entry = {}
 
-    # parameters
-    if config.get("parameters"):
-        cmds += _parameters_cmds(config["parameters"], have.get("parameters"))
+    area_raw = raw.get("area")
+    if area_raw:
+        entry["areas"] = _keyed_list_from_device(area_raw, "area_id", _area_entry_from_device)
 
-    # auto_cost
-    ac = config.get("auto_cost") or {}
-    have_ac = have.get("auto_cost") or {}
-    if ac.get("reference_bandwidth") and ac["reference_bandwidth"] != have_ac.get(
-        "reference_bandwidth",
-    ):
-        cmds.append(
-            (
-                "set",
-                _BASE
-                + [
-                    "auto-cost",
-                    "reference-bandwidth",
-                    str(ac["reference_bandwidth"]),
-                ],
-            ),
-        )
+    ac = raw.get("auto-cost") or {}
+    if ac.get("reference-bandwidth") is not None:
+        entry["auto_cost"] = {"reference_bandwidth": int(ac["reference-bandwidth"])}
 
-    # default_information
-    if config.get("default_information"):
-        cmds += _default_info_cmds(
-            config["default_information"],
-            have.get("default_information"),
-        )
+    di_raw = (raw.get("default-information") or {}).get("originate")
+    if di_raw:
+        entry["default_information"] = {"originate": from_device(di_raw)}
 
-    # default_metric
-    if config.get("default_metric") and config["default_metric"] != have.get("default_metric"):
-        cmds.append(("set", _BASE + ["default-metric", str(config["default_metric"])]))
-
-    # distance
-    dist = config.get("distance") or {}
-    have_dist = have.get("distance") or {}
-    if dist.get("global") and dist["global"] != have_dist.get("global"):
-        cmds.append(("set", _BASE + ["distance", "global", str(dist["global"])]))
-    ospf_dist = dist.get("ospf") or {}
-    have_ospf_dist = have_dist.get("ospf") or {}
-    for key, api_key in [
-        ("external", "external"),
-        ("inter_area", "inter-area"),
-        ("intra_area", "intra-area"),
-    ]:
-        if ospf_dist.get(key) and ospf_dist[key] != have_ospf_dist.get(key):
-            cmds.append(("set", _BASE + ["distance", "ospf", api_key, str(ospf_dist[key])]))
-
-    # log_adjacency_changes
-    if config.get("log_adjacency_changes") and config["log_adjacency_changes"] != have.get(
-        "log_adjacency_changes",
-    ):
-        cmds.append(("set", _BASE + ["log-adjacency-changes", config["log_adjacency_changes"]]))
-
-    # neighbor
-    if config.get("neighbor"):
-        cmds += _neighbor_cmds(config["neighbor"], have.get("neighbor"))
-
-    # redistribute
-    if config.get("redistribute"):
-        cmds += _redistribute_cmds(config["redistribute"], have.get("redistribute"))
-
-    # passive_interface — VyOS 1.5 per-interface style
-    want_passive = set(config.get("passive_interface") or [])
-    have_passive = set(have.get("passive_interface") or [])
-    for iface in want_passive - have_passive:
-        cmds.append(("set", _BASE + ["interface", iface, "passive"]))
-
-    # areas
-    have_areas = {a["area_id"]: a for a in (have.get("areas") or [])}
-    for area in config.get("areas") or []:
-        have_area = have_areas.get(area["area_id"], {})
-        cmds += _area_cmds(area, have_area)
-
-    return cmds
+    if "default-metric" in raw:
+        entry["default_metric"] = int(raw["default-metric"])
 
+    dist = _distance_from_device(raw.get("distance"))
+    if dist:
+        entry["distance"] = dist
 
-ARGUMENT_SPEC = dict(
-    config=dict(
+    lac = raw.get("log-adjacency-changes")
+    if lac:
+        lac_dict = to_tag_dict(lac)
+        if "detail" in lac_dict:
+            entry["log_adjacency_changes"] = "detail"
+
+    mm_raw = (raw.get("max-metric") or {}).get("router-lsa")
+    if mm_raw:
+        entry["max_metric"] = {"router_lsa": from_device(mm_raw)}
+
+    mpls_raw = raw.get("mpls-te") or {}
+    mpls_entry = {}
+    if "enable" in mpls_raw:
+        mpls_entry["enabled"] = True
+    if mpls_raw.get("router-address"):
+        mpls_entry["router_address"] = mpls_raw["router-address"]
+    if mpls_entry:
+        entry["mpls_te"] = mpls_entry
+
+    neighbor_raw = raw.get("neighbor")
+    if neighbor_raw:
+        entry["neighbor"] = _keyed_list_from_device(neighbor_raw, _NEIGHBOR_KEY)
+
+    params_raw = raw.get("parameters")
+    if params_raw:
+        entry["parameters"] = from_device(params_raw)
+
+    passive, excluded = _passive_from_device(raw.get("interface"))
+    if passive:
+        entry["passive_interface"] = passive
+    if excluded:
+        entry["passive_interface_exclude"] = excluded
+
+    redist_raw = raw.get("redistribute")
+    if redist_raw:
+        entry["redistribute"] = _keyed_list_from_device(redist_raw, _REDISTRIBUTE_KEY)
+
+    timers = _timers_from_device(raw.get("refresh"), raw.get("timers"))
+    if timers:
+        entry["timers"] = timers
+
+    return entry
+
+
+def _kebab_fields(d):
+    """autoclean, then kebab-convert the resulting keys.
+
+    Safe specifically because every call site below is a leaf-level
+    dict of schema field names (nssa/stub attributes, distance.ospf,
+    default_information.originate, max_metric.router_lsa, parameters,
+    timers.throttle.spf, virtual_link's plain fields, and range/
+    neighbor/redistribute entry fields) with no further nested
+    tag-node-keyed structure underneath -- never an opaque value like
+    an area ID or interface name used as a dict key, which must stay
+    verbatim (confirmed real corruption risk: a blanket recursive
+    conversion turns "my_area" into "my-area").
+
+    Needed because dict_op requires have's keys to already be genuine
+    device kebab-case -- it only normalizes underscores to dashes for
+    its own lookup index, but uses have's key verbatim for the output
+    path. autoclean deliberately leaves keys exactly as given (dict_op
+    is meant to convert during its own want-vs-have comparison), which
+    only works when have comes straight from the device. Here, have is
+    instead reconstructed by round-tripping through this module's own
+    entry-transforms (needed for confirmed structural exceptions like
+    area-type's "set" flag or the shared interface/passive subtree),
+    so any field passed through unconverted stays snake_case and
+    dict_op has no way to recover the real device key. Confirmed as a
+    real bug: "default_cost" appeared in a generated delete command
+    instead of "default-cost".
+    """
+    cleaned = autoclean(d)
+    return {k.replace("_", "-"): v for k, v in cleaned.items()}
+
+
+def build_commands(config, raw_have, state):
+    raw_have = raw_have or {}
+
+    if state == "deleted":
+        return [("delete", _BASE)] if raw_have else []
+
+    want = _want_to_device(config)
+    norm_have = _want_to_device(_device_to_argspec(raw_have))
+
+    commands = []
+    if state == "replaced":
+        commands += dict_op(want, norm_have, _BASE, op="purge")
+    commands += dict_op(want, norm_have, _BASE, op="set")
+    return commands
+
+
+_VLINK_AUTH_OPTIONS = dict(
+    md5=dict(
+        type="list",
+        elements="dict",
+        options=dict(
+            key_id=dict(type="int"),
+            md5_key=dict(type="str", no_log=True),
+        ),
+    ),
+    plaintext_password=dict(type="str", no_log=True),
+)
+
+_VLINK_OPTIONS = dict(
+    address=dict(type="str", required=True),
+    authentication=dict(type="dict", options=_VLINK_AUTH_OPTIONS),
+    dead_interval=dict(type="int"),
+    hello_interval=dict(type="int"),
+    retransmit_interval=dict(type="int"),
+    transmit_delay=dict(type="int"),
+)
+
+_AREA_OPTIONS = dict(
+    area_id=dict(type="str", required=True),
+    area_type=dict(
         type="dict",
         options=dict(
-            areas=dict(
-                type="list",
-                elements="dict",
+            normal=dict(type="bool"),
+            nssa=dict(
+                type="dict",
                 options=dict(
-                    area_id=dict(type="str", required=True),
-                    area_type=dict(
-                        type="dict",
-                        options=dict(
-                            normal=dict(type="bool"),
-                            nssa=dict(
-                                type="dict",
-                                options=dict(
-                                    set=dict(type="bool"),
-                                    default_cost=dict(type="int"),
-                                    no_summary=dict(type="bool"),
-                                    translate=dict(
-                                        type="str",
-                                        choices=["always", "candidate", "never"],
-                                    ),
-                                ),
-                            ),
-                            stub=dict(
-                                type="dict",
-                                options=dict(
-                                    set=dict(type="bool"),
-                                    default_cost=dict(type="int"),
-                                    no_summary=dict(type="bool"),
-                                ),
-                            ),
-                        ),
-                    ),
-                    authentication=dict(
-                        type="str",
-                        choices=["plaintext-password", "md5"],
-                    ),
-                    network=dict(
-                        type="list",
-                        elements="dict",
-                        options=dict(
-                            address=dict(type="str", required=True),
-                        ),
-                    ),
-                    range=dict(
-                        type="list",
-                        elements="dict",
-                        options=dict(
-                            address=dict(type="str", required=True),
-                            cost=dict(type="int"),
-                            not_advertise=dict(type="bool"),
-                            substitute=dict(type="str"),
-                        ),
-                    ),
-                    shortcut=dict(type="str", choices=["default", "disable", "enable"]),
+                    set=dict(type="bool"),
+                    default_cost=dict(type="int"),
+                    no_summary=dict(type="bool"),
+                    translate=dict(type="str", choices=["always", "candidate", "never"]),
                 ),
             ),
-            auto_cost=dict(
+            stub=dict(
                 type="dict",
                 options=dict(
-                    reference_bandwidth=dict(type="int"),
+                    set=dict(type="bool"),
+                    default_cost=dict(type="int"),
+                    no_summary=dict(type="bool"),
                 ),
             ),
-            default_information=dict(
+        ),
+    ),
+    authentication=dict(type="str", choices=["plaintext-password", "md5"]),
+    network=dict(
+        type="list",
+        elements="dict",
+        options=dict(address=dict(type="str", required=True)),
+    ),
+    range=dict(
+        type="list",
+        elements="dict",
+        options=dict(
+            address=dict(type="str", required=True),
+            cost=dict(type="int"),
+            not_advertise=dict(type="bool"),
+            substitute=dict(type="str"),
+        ),
+    ),
+    shortcut=dict(type="str", choices=["default", "disable", "enable"]),
+    virtual_link=dict(type="list", elements="dict", options=_VLINK_OPTIONS),
+)
+
+_CONFIG_OPTIONS = dict(
+    areas=dict(type="list", elements="dict", options=_AREA_OPTIONS),
+    auto_cost=dict(
+        type="dict",
+        options=dict(reference_bandwidth=dict(type="int")),
+    ),
+    default_information=dict(
+        type="dict",
+        options=dict(
+            originate=dict(
                 type="dict",
                 options=dict(
-                    originate=dict(
-                        type="dict",
-                        options=dict(
-                            always=dict(type="bool"),
-                            metric=dict(type="int"),
-                            metric_type=dict(type="int"),
-                            route_map=dict(type="str"),
-                        ),
-                    ),
+                    always=dict(type="bool"),
+                    metric=dict(type="int"),
+                    metric_type=dict(type="int"),
+                    route_map=dict(type="str"),
                 ),
             ),
-            default_metric=dict(type="int"),
-            distance=dict(
+        ),
+    ),
+    default_metric=dict(type="int"),
+    distance=dict(
+        type="dict",
+        options=dict(
+            **{"global": dict(type="int")},
+            ospf=dict(
                 type="dict",
                 options=dict(
-                    **{"global": dict(type="int")},
-                    ospf=dict(
-                        type="dict",
-                        options=dict(
-                            external=dict(type="int"),
-                            inter_area=dict(type="int"),
-                            intra_area=dict(type="int"),
-                        ),
-                    ),
+                    external=dict(type="int"),
+                    inter_area=dict(type="int"),
+                    intra_area=dict(type="int"),
                 ),
             ),
-            log_adjacency_changes=dict(type="str", choices=["detail"]),
-            neighbor=dict(
-                type="list",
-                elements="dict",
+        ),
+    ),
+    log_adjacency_changes=dict(type="str", choices=["detail"]),
+    max_metric=dict(
+        type="dict",
+        options=dict(
+            router_lsa=dict(
+                type="dict",
                 options=dict(
-                    neighbor_id=dict(type="str", required=True),
-                    poll_interval=dict(type="int"),
-                    priority=dict(type="int"),
+                    administrative=dict(type="bool"),
+                    on_shutdown=dict(type="int"),
+                    on_startup=dict(type="int"),
                 ),
             ),
-            parameters=dict(
+        ),
+    ),
+    mpls_te=dict(
+        type="dict",
+        options=dict(
+            enabled=dict(type="bool"),
+            router_address=dict(type="str"),
+        ),
+    ),
+    neighbor=dict(
+        type="list",
+        elements="dict",
+        options=dict(
+            neighbor_id=dict(type="str", required=True),
+            poll_interval=dict(type="int"),
+            priority=dict(type="int"),
+        ),
+    ),
+    parameters=dict(
+        type="dict",
+        options=dict(
+            abr_type=dict(type="str", choices=["cisco", "ibm", "shortcut", "standard"]),
+            opaque_lsa=dict(type="bool"),
+            rfc1583_compatibility=dict(type="bool"),
+            router_id=dict(type="str"),
+        ),
+    ),
+    passive_interface=dict(type="list", elements="str"),
+    passive_interface_exclude=dict(type="list", elements="str"),
+    redistribute=dict(
+        type="list",
+        elements="dict",
+        options=dict(
+            route_type=dict(type="str", choices=["bgp", "connected", "kernel", "rip", "static"]),
+            metric=dict(type="int"),
+            metric_type=dict(type="int"),
+            route_map=dict(type="str"),
+        ),
+    ),
+    timers=dict(
+        type="dict",
+        options=dict(
+            refresh=dict(
                 type="dict",
-                options=dict(
-                    abr_type=dict(
-                        type="str",
-                        choices=["cisco", "ibm", "shortcut", "standard"],
-                    ),
-                    opaque_lsa=dict(type="bool"),
-                    rfc1583_compatibility=dict(type="bool"),
-                    router_id=dict(type="str"),
-                ),
+                options=dict(timers=dict(type="int")),
             ),
-            passive_interface=dict(type="list", elements="str"),
-            redistribute=dict(
-                type="list",
-                elements="dict",
+            throttle=dict(
+                type="dict",
                 options=dict(
-                    route_type=dict(
-                        type="str",
-                        choices=["bgp", "connected", "kernel", "rip", "static"],
+                    spf=dict(
+                        type="dict",
+                        options=dict(
+                            delay=dict(type="int"),
+                            initial_holdtime=dict(type="int"),
+                            max_holdtime=dict(type="int"),
+                        ),
                     ),
-                    metric=dict(type="int"),
-                    metric_type=dict(type="int"),
-                    route_map=dict(type="str"),
                 ),
             ),
         ),
     ),
+)
+
+ARGUMENT_SPEC = dict(
+    config=dict(type="dict", options=_CONFIG_OPTIONS),
     state=dict(
         default="merged",
         choices=["merged", "replaced", "deleted", "gathered"],
@@ -926,23 +1140,28 @@ def main():
     state = module.params["state"]
     config = module.params.get("config") or {}
 
-    have = get_running_config(vyos)
+    raw_have = get_running_config(vyos)
+    have = _device_to_argspec(raw_have)
+    cast_by_spec(have, _CONFIG_OPTIONS)
 
     if state == "gathered":
         module.exit_json(changed=False, gathered=have)
 
-    commands = build_commands(config, have, state)
+    commands = build_commands(config, raw_have, state)
 
     if module.check_mode:
-        module.exit_json(changed=bool(commands), commands=commands, before=have)
+        module.exit_json(changed=bool(commands), commands=commands, before=have, after=have)
 
     if commands:
         response = vyos.apply_commands(commands)
         saved = vyos.save_config()
+        after_raw = get_running_config(vyos)
+        after = _device_to_argspec(after_raw)
+        cast_by_spec(after, _CONFIG_OPTIONS)
         module.exit_json(
             changed=True,
             before=have,
-            after=get_running_config(vyos),
+            after=after,
             commands=commands,
             saved=saved,
             response=response,
diff --git a/plugins/modules/vyos_ospfv3.py b/plugins/modules/vyos_ospfv3.py
index fcf404e..5923a61 100644
--- a/plugins/modules/vyos_ospfv3.py
+++ b/plugins/modules/vyos_ospfv3.py
@@ -1,6 +1,7 @@
 #!/usr/bin/python
 # -*- coding: utf-8 -*-
-# GNU General Public License v3.0+
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+
 from __future__ import absolute_import, division, print_function
 
 
@@ -13,6 +14,22 @@ short_description: Manage OSPFv3 configuration on VyOS devices using REST API
 description:
   - Manages OSPFv3 configuration on VyOS devices via the REST API.
   - Uses REST API (C(connection=httpapi)) instead of CLI.
+  - >-
+    Scope matches the current vyos.vyos.vyos_ospfv3 (CLI collection) module,
+    confirmed against VyOS's official documentation (1.4+/1.5 LTS/rolling).
+  - >-
+    C(areas.interface) (an area-to-interface assignment list) exists in the
+    CLI module's argspec but was deliberately NOT carried over here --
+    confirmed via VyOS's official docs across multiple versions that
+    C(set protocols ospfv3 area <id> interface <name>) is the superseded,
+    1.3-era syntax. The current mechanism, C(set protocols ospfv3 interface
+    <name> area <id>), is a per-interface setting and is modeled in
+    M(vyos.rest.vyos_ospf_interfaces)'s C(area) field instead (and is not
+    affected by this module's C(state=replaced)).
+  - >-
+    C(distance) and C(graceful-restart) are real, confirmed OSPFv3 features
+    not modeled here, matching a genuine gap in the CLI module's own scope
+    rather than an oversight.
 version_added: "1.0.0"
 author:
   - VyOS Community (@vyos)
@@ -37,7 +54,7 @@ options:
             description: Name of import-list.
             type: str
           range:
-            description: Summarize routes matching prefix.
+            description: Summarize routes matching prefix (border routers only).
             type: list
             elements: dict
             suboptions:
@@ -65,6 +82,7 @@ options:
         suboptions:
           route_type:
             description: Protocol to redistribute.
+            required: true
             type: str
             choices: [bgp, connected, kernel, ripng, static]
           route_map:
@@ -83,6 +101,9 @@ options:
 notes:
   - Requires C(ansible_connection=httpapi) with the VyOS httpapi plugin.
   - C(ansible_network_os) must be set to C(vyos.rest.vyos).
+seealso:
+  - module: vyos.vyos.vyos_ospfv3
+  - module: vyos.rest.vyos_ospf_interfaces
 """
 
 EXAMPLES = r"""
@@ -139,184 +160,201 @@ response:
 """
 
 from ansible.module_utils.basic import AnsibleModule
-from ansible_collections.vyos.rest.plugins.module_utils.vyos import VyOSModule
+from ansible_collections.vyos.rest.plugins.module_utils.vyos import (
+    VyOSModule,
+    autoclean,
+    cast_by_spec,
+    dict_op,
+    from_device,
+    to_tag_dict,
+)
 
 
 _BASE = ["protocols", "ospfv3"]
 
 
+def _kebab_fields(d):
+    """autoclean, then kebab-convert the resulting keys.
+
+    Needed because dict_op requires have's keys to already be genuine
+    device kebab-case -- it only normalizes underscores to dashes for
+    its own lookup index, but uses have's key verbatim for the output
+    path. autoclean deliberately leaves keys exactly as given (dict_op
+    is meant to convert during its own want-vs-have comparison), which
+    only works when have comes straight from the device. Here, have is
+    reconstructed by round-tripping through this module's own entry-
+    transforms, so any field passed through unconverted would stay
+    snake_case and dict_op would have no way to recover the real
+    device key -- confirmed as a real bug during vyos_ospfv2's build.
+    Safe here since every call site is a leaf-level dict of schema
+    field names, never an opaque tag-node value like an area ID used
+    as a dict key.
+    """
+    cleaned = autoclean(d)
+    return {k.replace("_", "-"): v for k, v in cleaned.items()}
+
+
+def _derive_key_field(options_spec):
+    required = [k for k, spec in options_spec.items() if spec.get("required")]
+    if len(required) != 1:
+        raise ValueError(
+            "expected exactly one required suboption to serve as the key field, "
+            "found: {0}".format(required),
+        )
+    return required[0]
+
+
+def _keyed_list_to_device(items, key_field, entry_transform=None):
+    entry_transform = entry_transform or _kebab_fields
+    result = {}
+    for item in items or []:
+        if not item.get(key_field):
+            continue
+        rest = {k: v for k, v in item.items() if k != key_field}
+        result[str(item[key_field])] = entry_transform(rest)
+    return result
+
+
+def _keyed_list_from_device(raw, key_field, entry_transform=None):
+    entry_transform = entry_transform or from_device
+    return [
+        {key_field: key, **entry_transform(data or {})}
+        for key, data in sorted(to_tag_dict(raw).items())
+    ]
+
+
+# ---------------------------------------------------------------------------
+# range -- confirmed against CLI: advertise/not_advertise are presence-
+# only opposite flags (not both meaningful at once, though the argspec
+# doesn't enforce mutual exclusivity -- matching the CLI's own scope).
+# Fully generic once keyed by address.
+# ---------------------------------------------------------------------------
+
+_RANGE_KEY = "address"
+
+
+def _area_entry_to_device(rest):
+    exclude = {"range"}
+    device = _kebab_fields({k: v for k, v in rest.items() if k not in exclude})
+    ranges = rest.get("range") or []
+    if ranges:
+        device["range"] = _keyed_list_to_device(ranges, _RANGE_KEY)
+    return device
+
+
+def _area_entry_from_device(data):
+    exclude = {"range"}
+    entry = from_device({k: v for k, v in data.items() if k not in exclude})
+    range_raw = data.get("range")
+    if range_raw:
+        entry["range"] = _keyed_list_from_device(range_raw, _RANGE_KEY)
+    return entry
+
+
+def _want_to_device(config):
+    config = config or {}
+    device = {}
+
+    areas = config.get("areas") or []
+    if areas:
+        device["area"] = _keyed_list_to_device(areas, _AREA_KEY, _area_entry_to_device)
+
+    params_device = _kebab_fields(config.get("parameters") or {})
+    if params_device:
+        device["parameters"] = params_device
+
+    redist = config.get("redistribute") or []
+    if redist:
+        device["redistribute"] = _keyed_list_to_device(redist, _REDISTRIBUTE_KEY)
+
+    return device
+
+
 def get_running_config(vyos):
-    raw = vyos.get_config(_BASE)
+    """VyOS's REST API collapses a single-child tag node to a plain
+    string (or a list for multiple) -- confirmed as a real failure
+    mode during vyos_ospf_interfaces's build (an unguarded response
+    iterated character-by-character). Normalizing through to_tag_dict
+    unconditionally means callers always receive a genuine dict.
+    """
+    return to_tag_dict(vyos.get_config(_BASE) or {})
+
+
+def _device_to_argspec(raw):
     if not raw or not isinstance(raw, dict):
         return {}
-    return _parse_ospfv3(raw)
+    entry = {}
 
+    area_raw = raw.get("area")
+    if area_raw:
+        areas = _keyed_list_from_device(area_raw, _AREA_KEY, _area_entry_from_device)
+        if areas:
+            entry["areas"] = areas
 
-def _parse_ospfv3(raw):
-    result = {}
+    params_raw = raw.get("parameters")
+    if params_raw:
+        entry["parameters"] = from_device(params_raw)
 
-    # parameters
-    params = raw.get("parameters", {})
-    if params:
-        result["parameters"] = {}
-        if "router-id" in params:
-            result["parameters"]["router_id"] = params["router-id"]
-
-    # redistribute
-    redist_raw = raw.get("redistribute", {})
-    if redist_raw and isinstance(redist_raw, dict):
-        redist = []
-        for route_type, data in sorted(redist_raw.items()):
-            entry = {"route_type": route_type}
-            if isinstance(data, dict) and data.get("route-map"):
-                entry["route_map"] = data["route-map"]
-            redist.append(entry)
-        if redist:
-            result["redistribute"] = redist
-
-    # areas
-    area_raw = raw.get("area", {})
-    if area_raw and isinstance(area_raw, dict):
-        areas = []
-        for area_id, area_data in sorted(area_raw.items()):
-            area = {"area_id": area_id}
-            area_data = area_data or {}
-            if area_data.get("export-list"):
-                area["export_list"] = area_data["export-list"]
-            if area_data.get("import-list"):
-                area["import_list"] = area_data["import-list"]
-            range_raw = area_data.get("range", {})
-            if range_raw and isinstance(range_raw, dict):
-                ranges = []
-                for prefix, rdata in sorted(range_raw.items()):
-                    r = {"address": prefix}
-                    rdata = rdata or {}
-                    if "advertise" in rdata:
-                        r["advertise"] = True
-                    if "not-advertise" in rdata:
-                        r["not_advertise"] = True
-                    ranges.append(r)
-                if ranges:
-                    area["range"] = ranges
-            areas.append(area)
-        if areas:
-            result["areas"] = areas
+    redist_raw = raw.get("redistribute")
+    if redist_raw:
+        entry["redistribute"] = _keyed_list_from_device(redist_raw, _REDISTRIBUTE_KEY)
 
-    return result
+    return entry
 
 
-def build_commands(config, have, state):
-    cmds = []
+def build_commands(config, raw_have, state):
+    raw_have = raw_have or {}
 
     if state == "deleted":
-        if have:
-            cmds.append(("delete", _BASE))
-        return cmds
+        return [("delete", _BASE)] if raw_have else []
+
+    want = _want_to_device(config)
+    norm_have = _want_to_device(_device_to_argspec(raw_have))
 
+    commands = []
     if state == "replaced":
-        # Build what we would set from scratch and compare to have
-        would_set = build_commands(config, {}, "merged")
-        have_set = build_commands(have, {}, "merged")
-        if would_set == have_set:
-            return []
-        if have:
-            cmds.append(("delete", _BASE))
-        have = {}
-
-    # parameters
-    want_params = (config or {}).get("parameters") or {}
-    have_params = have.get("parameters") or {}
-    if want_params.get("router_id") and want_params["router_id"] != have_params.get("router_id"):
-        cmds.append(("set", _BASE + ["parameters", "router-id", want_params["router_id"]]))
-
-    # redistribute
-    want_redist = {r["route_type"]: r for r in ((config or {}).get("redistribute") or [])}
-    have_redist = {r["route_type"]: r for r in (have.get("redistribute") or [])}
-
-    for rt in set(have_redist) - set(want_redist):
-        if state == "merged":
-            pass  # merged doesn't remove
-    for rt, entry in want_redist.items():
-        if rt not in have_redist:
-            cmds.append(("set", _BASE + ["redistribute", rt]))
-        if entry.get("route_map"):
-            have_rm = have_redist.get(rt, {}).get("route_map")
-            if entry["route_map"] != have_rm:
-                cmds.append(("set", _BASE + ["redistribute", rt, "route-map", entry["route_map"]]))
-
-    # areas
-    want_areas = {a["area_id"]: a for a in ((config or {}).get("areas") or [])}
-    have_areas = {a["area_id"]: a for a in (have.get("areas") or [])}
-
-    for area_id, want_area in want_areas.items():
-        have_area = have_areas.get(area_id, {})
-        abase = _BASE + ["area", area_id]
-
-        if want_area.get("export_list") and want_area["export_list"] != have_area.get(
-            "export_list",
-        ):
-            cmds.append(("set", abase + ["export-list", want_area["export_list"]]))
-        if want_area.get("import_list") and want_area["import_list"] != have_area.get(
-            "import_list",
-        ):
-            cmds.append(("set", abase + ["import-list", want_area["import_list"]]))
-
-        want_ranges = {r["address"]: r for r in (want_area.get("range") or [])}
-        have_ranges = {r["address"]: r for r in (have_area.get("range") or [])}
-
-        for addr in want_ranges:
-            if addr not in have_ranges:
-                cmds.append(("set", abase + ["range", addr]))
-                r = want_ranges[addr]
-                if r.get("not_advertise"):
-                    cmds.append(("set", abase + ["range", addr, "not-advertise"]))
-                elif r.get("advertise"):
-                    cmds.append(("set", abase + ["range", addr, "advertise"]))
-
-    return cmds
+        commands += dict_op(want, norm_have, _BASE, op="purge")
+    commands += dict_op(want, norm_have, _BASE, op="set")
+    return commands
 
 
-ARGUMENT_SPEC = dict(
-    config=dict(
-        type="dict",
-        options=dict(
-            areas=dict(
-                type="list",
-                elements="dict",
-                options=dict(
-                    area_id=dict(type="str", required=True),
-                    export_list=dict(type="str"),
-                    import_list=dict(type="str"),
-                    range=dict(
-                        type="list",
-                        elements="dict",
-                        options=dict(
-                            address=dict(type="str", required=True),
-                            advertise=dict(type="bool"),
-                            not_advertise=dict(type="bool"),
-                        ),
-                    ),
-                ),
-            ),
-            parameters=dict(
-                type="dict",
-                options=dict(
-                    router_id=dict(type="str"),
-                ),
-            ),
-            redistribute=dict(
-                type="list",
-                elements="dict",
-                options=dict(
-                    route_type=dict(
-                        type="str",
-                        choices=["bgp", "connected", "kernel", "ripng", "static"],
-                    ),
-                    route_map=dict(type="str"),
-                ),
-            ),
-        ),
+_RANGE_OPTIONS = dict(
+    address=dict(type="str", required=True),
+    advertise=dict(type="bool"),
+    not_advertise=dict(type="bool"),
+)
+
+_AREA_OPTIONS = dict(
+    area_id=dict(type="str", required=True),
+    export_list=dict(type="str"),
+    import_list=dict(type="str"),
+    range=dict(type="list", elements="dict", options=_RANGE_OPTIONS),
+)
+
+_PARAMETERS_OPTIONS = dict(
+    router_id=dict(type="str"),
+)
+
+_REDISTRIBUTE_OPTIONS = dict(
+    route_type=dict(
+        type="str",
+        required=True,
+        choices=["bgp", "connected", "kernel", "ripng", "static"],
     ),
+    route_map=dict(type="str"),
+)
+
+_AREA_KEY = _derive_key_field(_AREA_OPTIONS)
+_REDISTRIBUTE_KEY = _derive_key_field(_REDISTRIBUTE_OPTIONS)
+
+_CONFIG_OPTIONS = dict(
+    areas=dict(type="list", elements="dict", options=_AREA_OPTIONS),
+    parameters=dict(type="dict", options=_PARAMETERS_OPTIONS),
+    redistribute=dict(type="list", elements="dict", options=_REDISTRIBUTE_OPTIONS),
+)
+
+ARGUMENT_SPEC = dict(
+    config=dict(type="dict", options=_CONFIG_OPTIONS),
     state=dict(
         default="merged",
         choices=["merged", "replaced", "deleted", "gathered"],
@@ -331,12 +369,14 @@ def main():
     state = module.params["state"]
     config = module.params.get("config") or {}
 
-    have = get_running_config(vyos)
+    raw_have = get_running_config(vyos)
+    have = _device_to_argspec(raw_have)
+    cast_by_spec(have, _CONFIG_OPTIONS)
 
     if state == "gathered":
         module.exit_json(changed=False, gathered=have)
 
-    commands = build_commands(config, have, state)
+    commands = build_commands(config, raw_have, state)
 
     if module.check_mode:
         module.exit_json(changed=bool(commands), commands=commands, before=have)
@@ -344,10 +384,13 @@ def main():
     if commands:
         response = vyos.apply_commands(commands)
         saved = vyos.save_config()
+        after_raw = get_running_config(vyos)
+        after = _device_to_argspec(after_raw)
+        cast_by_spec(after, _CONFIG_OPTIONS)
         module.exit_json(
             changed=True,
             before=have,
-            after=get_running_config(vyos),
+            after=after,
             commands=commands,
             saved=saved,
             response=response,