diff --git a/DEPLOY-SUBWORKFLOWS.md b/DEPLOY-SUBWORKFLOWS.md
index 7342cdf..4ab7cbf 100644
--- a/DEPLOY-SUBWORKFLOWS.md
+++ b/DEPLOY-SUBWORKFLOWS.md
@@ -269,3 +269,441 @@ The 2 domain-logic candidates (`Build Cancel Return Submenu` and `Build Immediat
 3. **Complexity is low** -- both nodes are under 75 lines and perform straightforward container name normalization + lookup against Docker API output already fetched.
 
 **Conclusion:** No further Code node extraction is viable. All 58 non-candidate nodes are demonstrably orchestration infrastructure (input preparation, result routing, command parsing, response building, or loop control). The 2 domain-logic candidates would yield a net-negative extraction.
+
+---
+
+## Sub-workflow Input/Output Contracts (Detailed)
+
+Formal contracts for all 7 sub-workflows with field-level documentation. Each contract is verified against the Prepare Input Code nodes that feed the Execute Workflow calls.
+
+### n8n-update.json (Container Update)
+
+**Workflow ID:** `7AvTzLtKXM2hZTio92_mC`
+**Called by:** 3 Execute Workflow nodes
+
+#### Input Contract
+
+| Field | Type | Required | Description |
+|-------|------|----------|-------------|
+| containerId | string | yes* | Docker container ID (empty string if resolving by name) |
+| containerName | string | yes | Container display name |
+| chatId | number | yes | Telegram chat ID |
+| messageId | number | yes | Telegram message ID (0 for text mode) |
+| responseMode | string | yes | `"text"` or `"inline"` |
+
+*containerId can be empty string -- the sub-workflow resolves by name via `Resolve Container ID` node.
+
+#### Output Contract
+
+| Exit Node | Fields | When |
+|-----------|--------|------|
+| Return Success | `success: true, updated: true, message, oldDigest, newDigest` | Image pulled, container recreated |
+| Return No Update | `success: true, updated: false, message` | Image already up to date |
+| Return Error | `success: false, updated: false, message` | Pull or creation failed |
+
+#### Execute Workflow Node Mapping
+
+| Execute Node | Source Node | Fields Produced |
+|-------------|-------------|-----------------|
+| Execute Text Update | Prepare Text Update Input | containerId, containerName, chatId, messageId (0), responseMode ("text") |
+| Execute Callback Update | Find Container For Callback Update | containerId, containerName, chatId, messageId, responseMode ("inline") |
+| Execute Batch Update | Prepare Batch Update Input | containerId, containerName, chatId, messageId, responseMode ("batch") |
+
+**Verification:** All 3 source nodes produce all 5 required fields. Confirmed.
+
+---
+
+### n8n-actions.json (Container Actions)
+
+**Workflow ID:** `fYSZS5PkH0VSEaT5`
+**Called by:** 3 Execute Workflow nodes
+
+#### Input Contract
+
+| Field | Type | Required | Description |
+|-------|------|----------|-------------|
+| containerId | string | yes | Docker container ID |
+| containerName | string | yes | Container display name |
+| action | string | yes | `"start"`, `"stop"`, or `"restart"` |
+| chatId | number | yes | Telegram chat ID |
+| messageId | number | yes | Telegram message ID (0 for text mode) |
+| responseMode | string | yes | `"text"`, `"inline"`, or `"batch"` |
+
+#### Output Contract
+
+All 3 exit nodes return the same structure (per action type):
+
+| Exit Node | Fields |
+|-----------|--------|
+| Format Start Result | `success, message, action, containerName, containerId, chatId, messageId, responseMode` |
+| Format Stop Result | `success, message, action, containerName, containerId, chatId, messageId, responseMode` |
+| Format Restart Result | `success, message, action, containerName, containerId, chatId, messageId, responseMode` |
+
+#### Execute Workflow Node Mapping
+
+| Execute Node | Source Node | Fields Produced |
+|-------------|-------------|-----------------|
+| Execute Container Action | Prepare Text Action Input | containerId, containerName, action, chatId, messageId, responseMode ("text") |
+| Execute Inline Action | Prepare Inline Action Input | containerId, containerName, action, chatId, messageId, responseMode ("inline") |
+| Execute Batch Action Sub-workflow | Prepare Batch Action Input | containerId, containerName, action, chatId, messageId, responseMode ("batch") |
+
+**Verification:** All 3 source nodes produce all 6 required fields. Confirmed.
+
+---
+
+### n8n-logs.json (Container Logs)
+
+**Workflow ID:** `oE7aO2GhbksXDEIw`
+**Called by:** 2 Execute Workflow nodes
+
+#### Input Contract
+
+| Field | Type | Required | Description |
+|-------|------|----------|-------------|
+| containerId | string | no | Docker container ID (optional, resolved by name if absent) |
+| containerName | string | yes* | Container name for lookup |
+| lineCount | number | no | Lines to retrieve (default: 50, max: 1000) |
+| chatId | number | yes | Telegram chat ID |
+| messageId | number | no | Telegram message ID (default: 0) |
+| responseMode | string | no | `"text"` or `"inline"` (default: "text") |
+
+*Either containerId or containerName required. Sub-workflow's `Parse Input` node validates this.
+
+#### Output Contract
+
+| Exit Node | Fields | When |
+|-----------|--------|------|
+| Format Logs | `success: true, message, containerName, lineCount` | Logs retrieved and formatted |
+
+Note: Error cases (container not found, Docker error) throw exceptions which n8n handles as workflow errors.
+
+#### Execute Workflow Node Mapping
+
+| Execute Node | Source Node | Fields Produced |
+|-------------|-------------|-----------------|
+| Execute Text Logs | Prepare Text Logs Input | containerName, lineCount, chatId, messageId, responseMode ("text") |
+| Execute Inline Logs | Prepare Inline Logs Input | containerName, lineCount (30), chatId, messageId, responseMode ("inline") |
+
+**Verification:** Both source nodes produce required fields. `Prepare Text Logs Input` has error-path return (error, chatId, text) but this is handled before reaching Execute Workflow node. Confirmed.
+
+---
+
+### n8n-batch-ui.json (Batch Selection UI)
+
+**Workflow ID:** `ZJhnGzJT26UUmW45`
+**Called by:** 1 Execute Workflow node
+
+#### Input Contract
+
+| Field | Type | Required | Description |
+|-------|------|----------|-------------|
+| chatId | number | yes | Telegram chat ID |
+| messageId | number | yes | Telegram message ID |
+| callbackData | string | yes | Raw callback data string |
+| queryId | string | yes | Telegram callback query ID |
+| action | string | yes | `"mode"`, `"toggle"`, `"nav"`, `"exec"`, `"clear"`, `"cancel"` |
+| batchPage | number | no | Current page number (default: 0) |
+| selectedCsv | string | no | Comma-separated selected container names |
+| toggleName | string | no | Container name being toggled |
+| batchAction | string | no | Action for batch execution (stop/restart/update) |
+
+#### Output Contract
+
+| Exit Node | action Value | Key Fields |
+|-----------|-------------|------------|
+| Build Batch Keyboard | `"keyboard"` | queryId, chatId, messageId, text, keyboard, selectedCsv, selectedCount, answerText |
+| Rebuild Keyboard After Toggle | `"keyboard"` | queryId, chatId, messageId, text, keyboard, selectedCsv, answerText |
+| Rebuild Keyboard For Nav | `"keyboard"` | queryId, chatId, messageId, text, keyboard, selectedCsv, answerText |
+| Rebuild Keyboard After Clear | `"keyboard"` | queryId, chatId, messageId, text, keyboard, selectedCsv (""), answerText |
+| Handle Exec | `"execute"` | queryId, chatId, messageId, batchAction, containerNames, selectedCsv, count, fromKeyboard, answerText |
+| Handle Cancel | `"cancel"` | queryId, chatId, messageId, page, answerText |
+
+All exit nodes include `success: true`.
+
+#### Execute Workflow Node Mapping
+
+| Execute Node | Source Node | Fields Produced |
+|-------------|-------------|-----------------|
+| Execute Batch UI | Prepare Batch UI Input | chatId, messageId, queryId, callbackData, action, batchAction, batchPage, selectedCsv, toggleName |
+
+**Verification:** Source node produces all 9 input fields. Confirmed.
+
+---
+
+### n8n-status.json (Container Status/List)
+
+**Workflow ID:** `lqpg2CqesnKE2RJQ`
+**Called by:** 4 Execute Workflow nodes
+
+#### Input Contract
+
+| Field | Type | Required | Description |
+|-------|------|----------|-------------|
+| chatId | number | yes | Telegram chat ID |
+| messageId | number | yes | Telegram message ID |
+| action | string | yes | `"list"`, `"status"`, `"paginate"` |
+| containerId | string | no | Docker container ID (for status lookup) |
+| containerName | string | no | Container name (for status lookup) |
+| page | number | no | Page number for pagination (default: 0) |
+| queryId | string | no | Telegram callback query ID |
+| searchTerm | string | no | Container name search term |
+
+#### Output Contract
+
+| Exit Node | action Value | Key Fields |
+|-----------|-------------|------------|
+| Build Container List | `"list"` | chatId, messageId, text, reply_markup, totalContainers, currentPage, totalPages |
+| Build Container Submenu | `"status"` | chatId, messageId, text, reply_markup, container (id, name, state, status, image) |
+| Build Paginated List | `"paginate"` | chatId, messageId, text, reply_markup, totalContainers, currentPage, totalPages |
+
+All exit nodes include `success: true`.
+
+Note: The main workflow also routes `status_direct` results (when messageId > 0 goes to edit, messageId == 0 goes to text send via `Strip Status Keyboard`).
+
+#### Execute Workflow Node Mapping
+
+| Execute Node | Source Node | Fields Produced |
+|-------------|-------------|-----------------|
+| Execute Container Status | Prepare Status Input | chatId, messageId, action ("list"/"status"), containerId, containerName, page, queryId, searchTerm |
+| Execute Select Status | Prepare Select Status Input | chatId, messageId, action ("status"), containerId, containerName, page, queryId, searchTerm |
+| Execute Paginate Status | Prepare Paginate Input | chatId, messageId, action ("paginate"), containerId, containerName, page, queryId, searchTerm |
+| Execute Batch Cancel Status | Prepare Batch Cancel Return Input | chatId, messageId, action ("paginate"), containerId, containerName, page, queryId, searchTerm |
+
+**Verification:** All 4 source nodes produce all 8 fields. Confirmed.
+
+---
+
+### n8n-confirmation.json (Confirmation Dialogs)
+
+**Workflow ID:** `fZ1hu8eiovkCk08G`
+**Called by:** 1 Execute Workflow node (from 3 source nodes)
+
+#### Input Contract
+
+| Field | Type | Required | Description |
+|-------|------|----------|-------------|
+| chatId | number | yes | Telegram chat ID |
+| messageId | number | yes | Telegram message ID |
+| action | string | yes | `"show_stop"`, `"show_update"`, `"confirm"`, `"cancel"`, `"expired"` |
+| containerId | string | no | Docker container ID |
+| containerName | string | yes | Container display name |
+| confirmAction | string | no | `"stop"` or `"update"` (for confirm action) |
+| confirmationToken | string | no | Timestamp token for expiry check |
+| expired | boolean | no | Whether confirmation has expired |
+| responseMode | string | no | `"inline"` (default) |
+
+Note: This sub-workflow internally calls n8n-actions.json (ID: `fYSZS5PkH0VSEaT5`) for confirmed stop actions.
+
+#### Output Contract
+
+| Exit Node | action Value | Key Fields |
+|-----------|-------------|------------|
+| Build Stop Confirmation | `"show_stop"` | chatId, messageId, text, reply_markup |
+| Build Update Confirmation | `"show_update"` | chatId, messageId, text, reply_markup |
+| Format Stop Result | `"confirm_stop_result"` | success, chatId, messageId, text, reply_markup |
+| Return Update Action | `"confirm_update"` | containerId, containerName, chatId, messageId, responseMode |
+| Handle Cancel | `"cancel"` | containerName, chatId, messageId |
+| Handle Expired | `"expired"` | chatId, messageId, text, reply_markup |
+| Stop Expired Response | `"expired"` | chatId, messageId, text, reply_markup |
+| Update Expired Response | `"expired"` | chatId, messageId, text, reply_markup |
+
+#### Execute Workflow Node Mapping
+
+| Execute Node | Source Node | Fields Produced |
+|-------------|-------------|-----------------|
+| Execute Confirmation | Prepare Confirm Input | chatId, messageId, action ("confirm"/"cancel"/"expired"), containerId, containerName, confirmAction, confirmationToken, expired, responseMode |
+| Execute Confirmation | Prepare Show Stop Input | chatId, messageId, action ("show_stop"), containerId, containerName, responseMode |
+| Execute Confirmation | Prepare Show Update Input | chatId, messageId, action ("show_update"), containerId, containerName, responseMode |
+
+**Verification:** All 3 source nodes produce required fields for their respective action paths. Confirmed.
+
+---
+
+### n8n-matching.json (Container Matching/Disambiguation)
+
+**Workflow ID:** `kL4BoI8ITSP9Oxek`
+**Called by:** 3 Execute Workflow nodes
+
+#### Input Contract
+
+| Field | Type | Required | Description |
+|-------|------|----------|-------------|
+| action | string | yes | `"match_action"`, `"match_update"`, or `"match_batch"` |
+| containerList | string | yes | Raw Docker API JSON output (container list) |
+| searchTerm | string | yes | Container name query to match |
+| selectedContainers | string | no | Comma-separated container names for batch matching |
+| chatId | number | yes | Telegram chat ID |
+| messageId | number | yes | Telegram message ID |
+
+#### Output Contract
+
+**Action match path** (action: "match_action"):
+
+| Exit Node | action Value | Key Fields |
+|-----------|-------------|------------|
+| Format Single Match Return | `"matched"` | containerId, containerName, matches, matchCount, actionType, containerQuery, chatId, allContainers |
+| Format Multiple Match Return | `"multiple"` | matches, matchCount, actionType, containerQuery, chatId, allContainers |
+| Format No Match Return | `"no_match"` | query, chatId |
+| Format Error Return | `"error"` | errorMessage, chatId |
+| Build Suggestion Keyboard | `"suggestion"` | chat_id, text, parse_mode, reply_markup |
+
+**Update match path** (action: "match_update"):
+
+| Exit Node | action Value | Key Fields |
+|-----------|-------------|------------|
+| Format Update Single Match Return | `"matched_update"` | containerId, containerName, matches, matchCount, containerQuery, chatId |
+| Format Update Multiple Match Return | `"multiple_update"` | matches, matchCount, containerQuery, chatId |
+| Format Update No Match Return | `"no_match_update"` | containerQuery, chatId |
+| Format Update Error Return | `"error"` | errorMessage, chatId |
+
+**Batch match path** (action: "match_batch"):
+
+| Exit Node | action Value | Key Fields |
+|-----------|-------------|------------|
+| Format Batch Matched Return | `"batch_matched"` | matchedContainers, chatId, messageId, originalContainerNames |
+| Build Disambiguation Message | `"disambiguation"` | chat_id, text, parse_mode, reply_markup |
+| Build Not Found Message | `"not_found"` | chat_id, text, parse_mode, hasMatched (+ optional matchedContainers) |
+
+#### Execute Workflow Node Mapping
+
+| Execute Node | Source Node | Fields Produced |
+|-------------|-------------|-----------------|
+| Execute Action Match | Prepare Action Match Input | action ("match_action"), containerList, searchTerm, selectedContainers (""), chatId, messageId |
+| Execute Update Match | Prepare Update Match Input | action ("match_update"), containerList, searchTerm, selectedContainers (""), chatId, messageId |
+| Execute Batch Match | Prepare Batch Match Input | action ("match_batch"), containerList, searchTerm (""), selectedContainers, chatId, messageId |
+
+**Verification:** All 3 source nodes produce all 6 input fields. Confirmed.
+
+---
+
+### Execute Workflow Node Summary
+
+**Total Execute Workflow nodes:** 17
+
+| Target Sub-workflow | Count | Execute Nodes |
+|--------------------|-------|---------------|
+| n8n-update.json | 3 | Execute Text Update, Execute Callback Update, Execute Batch Update |
+| n8n-actions.json | 3 | Execute Container Action, Execute Inline Action, Execute Batch Action Sub-workflow |
+| n8n-logs.json | 2 | Execute Text Logs, Execute Inline Logs |
+| n8n-batch-ui.json | 1 | Execute Batch UI |
+| n8n-status.json | 4 | Execute Container Status, Execute Select Status, Execute Paginate Status, Execute Batch Cancel Status |
+| n8n-confirmation.json | 1 | Execute Confirmation (3 source nodes) |
+| n8n-matching.json | 3 | Execute Action Match, Execute Update Match, Execute Batch Match |
+
+**Contract verification result:** All 17 Execute Workflow nodes receive correctly structured input from their source Prepare Input nodes. No mismatches found.
+
+---
+
+## Node Count Analysis
+
+### Current State
+
+- **Main workflow:** 168 nodes (after all Phase 10.1 extractions)
+- **7 sub-workflows:** 120 nodes total
+  - n8n-update.json: 34 nodes
+  - n8n-matching.json: 23 nodes
+  - n8n-batch-ui.json: 16 nodes
+  - n8n-confirmation.json: 16 nodes
+  - n8n-actions.json: 11 nodes
+  - n8n-status.json: 11 nodes
+  - n8n-logs.json: 9 nodes
+
+### Main Workflow Node Breakdown (168 total)
+
+| Category | Count | Description |
+|----------|-------|-------------|
+| Code nodes | 60 | Orchestration logic (see Classification above) |
+| HTTP Request nodes | 40 | Docker API + Telegram API calls |
+| Telegram nodes | 23 | User-facing response nodes (locked to main per design) |
+| Execute Workflow nodes | 17 | Sub-workflow dispatch |
+| Switch nodes | 13 | Routing logic (Keyword Router, Route Callback, etc.) |
+| If nodes | 8 | Conditional routing (auth checks, batch completion, etc.) |
+| Execute Command nodes | 6 | Docker CLI calls (list, execute) |
+| Telegram Trigger | 1 | Entry point |
+
+### Why 115-125 Target Is Not Achievable
+
+Based on the Code node classification above, here is the structural breakdown of what must remain in the main workflow:
+
+```
+Locked infrastructure (cannot be extracted):
+  1  Telegram Trigger
+  8  If nodes (auth, batch complete, expired checks, status routing)
+  13 Switch nodes (keyword router, callback router, result routers)
+  ── Total: 22 nodes
+
+Telegram response nodes (locked per design decision):
+  23 Telegram nodes (user-facing messages — must stay in main)
+  ── Total: 23 nodes
+
+HTTP Request nodes (Telegram API + Docker API):
+  40 HTTP Request nodes (edit message, answer callback, send message, Docker queries)
+  ── Total: 40 nodes
+
+Execute Workflow dispatch:
+  17 Execute Workflow nodes (sub-workflow calls)
+  ── Total: 17 nodes
+
+Execute Command (Docker CLI):
+  6  Execute Command nodes (docker list/exec operations)
+  ── Total: 6 nodes
+
+Code nodes — orchestration infrastructure (must stay):
+  27 prepare-input (sub-workflow glue)
+  12 route-result (sub-workflow result routing)
+  5  parse-command (keyword routing)
+  8  build-response (Telegram message building)
+  6  orchestration (batch loop control)
+  ── Total: 58 nodes
+
+Code nodes — domain logic candidates:
+  2  domain-logic (Build Cancel Return Submenu, Build Immediate Action Command)
+  ── Total: 2 nodes
+```
+
+### Revised Realistic Baseline
+
+**Minimum viable main workflow:** 166 nodes (all categories that must stay)
+- 22 infrastructure + 23 Telegram + 40 HTTP + 17 Execute Workflow + 6 Execute Command + 58 Code = 166
+
+**Current:** 168 nodes
+**Gap:** 2 nodes of domain logic where extraction overhead (~3 nodes per extraction: Prepare Input + Execute Workflow + Route Result) makes extraction net-negative
+
+### Extraction History
+
+| Phase | Extraction | Nodes Removed | Nodes Added | Net Change |
+|-------|-----------|--------------|-------------|------------|
+| 10-02 | Container Update | -13 (inline logic) | +6 (integration) | -7 |
+| 10-03 | Container Actions | -6 (inline logic) | +5 (integration) | -1 |
+| 10-05 | Batch Loops + Logs | -5 (inline logic) | +4 (integration) | -1 |
+| 10.1-02 | Batch UI | -16 (inline logic) | +3 (integration) | -13 |
+| 10.1-03 | Container Status | -11 (inline logic) | +10 (integration) | -1 |
+| 10.1-04 | Confirmation Dialogs | -16 (inline logic) | +6 (integration) | -10 |
+| 10.1-06 | Matching/Disambiguation | -12 (inline logic) | +12 (integration + fixes) | 0 |
+| **Total** | **7 sub-workflows** | **-79** | **+46** | **-33** |
+
+Starting from 192 nodes (post-Phase 10), reduced to 168 nodes in Phase 10.1 (-24 nodes, -12.5%).
+Including Phase 10 reductions: 209 -> 168 nodes total (-41 nodes, -19.6%).
+
+### Diminishing Returns Evidence
+
+Each extraction adds integration overhead (Prepare Input, Execute Workflow, Route Result nodes). The extraction benefit decreases as remaining logic is more tightly coupled to the orchestration:
+
+- **Batch UI extraction:** 16 nodes extracted, 3 overhead = 81% efficient
+- **Confirmation extraction:** 16 nodes extracted, 6 overhead = 63% efficient
+- **Status extraction:** 11 nodes extracted, 10 overhead = 9% efficient
+- **Matching extraction:** 12 nodes extracted, 12 overhead = 0% efficient
+
+Further extraction of the 2 remaining domain-logic nodes (115 total lines) would require 3 overhead nodes, yielding a **-50% efficiency** (net increase of 1 node).
+
+### Conclusion
+
+The 168-node main workflow is **2 nodes above the structural minimum** of 166. The 115-125 target was based on incomplete analysis of extraction overhead costs. With full evidence:
+
+1. **58 Code nodes** are verified orchestration infrastructure (cannot be extracted)
+2. **2 Code nodes** are domain logic but extraction is net-negative
+3. **108 non-Code nodes** are locked infrastructure (Telegram, HTTP, Switch, If, Execute, Trigger)
+4. **All 17 Execute Workflow nodes** pass correct input data to sub-workflows
+5. **All 7 sub-workflow contracts** are formally documented and verified
+
+The modularization objective is achieved: domain complexity is in sub-workflows, the main workflow is a routing/orchestration shell.