Use when capturing a Linux server baseline, diagnosing service issues from read-only evidence, and producing a patch plan without executing changes.