diff --git a/runtime/history/SUPPORT-261005-SNIKKET-FRESH-BACKUP-RESTORE-PROOF-99594R1.json b/runtime/history/SUPPORT-261005-SNIKKET-FRESH-BACKUP-RESTORE-PROOF-99594R1.json
new file mode 100644
index 00000000..63f35eae
--- /dev/null
+++ b/runtime/history/SUPPORT-261005-SNIKKET-FRESH-BACKUP-RESTORE-PROOF-99594R1.json
@@ -0,0 +1,38 @@
+{
+  "schema_version": 1,
+  "channel": "homelab-runtime",
+  "command_id": "SUPPORT-261005-SNIKKET-FRESH-BACKUP-RESTORE-PROOF-99594R1",
+  "status": "OK",
+  "rc": 0,
+  "host": "pve01",
+  "mode": "change",
+  "component": "snikket-fresh-backup-restore-proof",
+  "started_at_utc": "2026-10-05T09:11:09Z",
+  "finished_at_utc": "2026-10-05T09:11:13Z",
+  "reference_register_checked": true,
+  "reference_sha256": "5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66",
+  "error_register_checked": true,
+  "error_register_sha256": "3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0",
+  "command_sha256": "aa168f4e2aaf7ed228f1b7ef7073bec91a595c91e272bdbe71396362a9f74e49",
+  "duplicate_failed_command_blocked": false,
+  "block_reason": null,
+  "execution_started": true,
+  "change_declared": true,
+  "result_contract_valid": true,
+  "result_contract_status": "OK",
+  "result_contract_error": null,
+  "command_rc": 0,
+  "changes_made": false,
+  "rollback_started": false,
+  "rollback_restored": null,
+  "mutation_outcome": "NO_MUTATION",
+  "sanitized": true,
+  "secrets_included": false,
+  "private_addresses_included": false,
+  "raw_evidence_retained_locally": true,
+  "raw_evidence_sha256": "db13236deb4e488789bfa79f9da14522d2a458330c8a70229e6879ff981a1bb5",
+  "sanitized_output_sha256": "db13236deb4e488789bfa79f9da14522d2a458330c8a70229e6879ff981a1bb5",
+  "output_truncated_in_json": false,
+  "full_sanitized_output_url": "https://git.gram1.ru/.well-known/homelab-runtime/latest.txt",
+  "output": "SNIKKET_FRESH_BACKUP_RESTORE_PROOF_WRAPPER=V1\nHOST_PVE01=true\nINGRESS_HOSTKEY_SELF_BOUND=true\nMODE=change\nMUTATION_BOUNDARY=FRESH_VM150_BACKUP_PLUS_TEMP_ISOLATED_RESTORE_ONLY\nNO_PRODUCTION_VM150_CONFIG_MUTATION=true\nNO_DNS_MUTATION=true\nNO_MONITOR_MUTATION=true\nNO_SOURCE_MUTATION=true\nNO_GLOBAL_DR_POLICY_MUTATION=true\nPROOF_PYTHON_RC=0\nPROD_VM150_RUNNING_PRE=true\nPROD_VM150_QGA_PRE=true\nPROD_VM150_CONFIG_SHA_PRE=2e4c1ea46b27034a2efe7bfc00cd9f32c0641a43d8365aa21992f72493a43b0e\nVM150_RUNTIME_EXACT_MATCH_COUNT=60\nFRESH_BACKUP_RESTORE_ERROR_CLASS=RuntimeError\nFRESH_BACKUP_RESTORE_ERROR_SHA256=30e31c3eb92140cf12764306833d83831395839ce95eba60ead3e5c88f3553f7\nPUBLIC_DNS_OK_COUNT=3\nPUBLIC_HTTPS_OK_COUNT=3\nFRESH_BACKUP_AND_ISOLATED_RESTORE_PASS=false\nDECISION=HOLD_SNIKKET_FRESH_BACKUP_RESTORE_PROOF\nNEXT_GATE=SNIKKET_FRESH_BACKUP_RESTORE_RECONCILE\nTASK_RESULT=HOLD_SNIKKET_FRESH_BACKUP_RESTORE_PROOF\nCHANGES_MADE=false\nROLLBACK_STARTED=false\nROLLBACK_RESTORED=null\nMUTATION_OUTCOME=NO_MUTATION\nPROOF_PYTHON_STDERR_BYTES=0\nPUBLIC_STUN_3479_PASS=true\nFINAL_FRESH_BACKUP_RESTORE_ACCEPT=false\nHOMELAB_RESULT_CONTRACT={\"version\":1,\"command_id\":\"SUPPORT-261005-SNIKKET-FRESH-BACKUP-RESTORE-PROOF-99594R1\",\"status\":\"OK\",\"changes_made\":false,\"rollback_started\":false,\"rollback_restored\":null}\n"
+}
diff --git a/runtime/history/SUPPORT-261005-SNIKKET-FRESH-BACKUP-RESTORE-PROOF-99594R1.txt b/runtime/history/SUPPORT-261005-SNIKKET-FRESH-BACKUP-RESTORE-PROOF-99594R1.txt
new file mode 100644
index 00000000..4b17a6eb
--- /dev/null
+++ b/runtime/history/SUPPORT-261005-SNIKKET-FRESH-BACKUP-RESTORE-PROOF-99594R1.txt
@@ -0,0 +1,63 @@
+CHAT_OUTPUT_BEGIN
+COMMAND_ID=SUPPORT-261005-SNIKKET-FRESH-BACKUP-RESTORE-PROOF-99594R1
+STATUS=OK
+RC=0
+HOST=pve01
+MODE=change
+COMPONENT=snikket-fresh-backup-restore-proof
+REFERENCE_REGISTER_CHECK=OK
+REFERENCE_SHA256=5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66
+ERROR_REGISTER_CHECK=OK
+ERROR_REGISTER_SHA256=3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0
+COMMAND_SHA256=aa168f4e2aaf7ed228f1b7ef7073bec91a595c91e272bdbe71396362a9f74e49
+DUPLICATE_FAILED_COMMAND_BLOCKED=false
+EXECUTION_STARTED=true
+CHANGE_DECLARED=true
+RESULT_CONTRACT_VALID=true
+RESULT_CONTRACT_STATUS=OK
+RESULT_CONTRACT_ERROR=NONE
+COMMAND_RC=0
+CHANGES_MADE=false
+ROLLBACK_STARTED=false
+ROLLBACK_RESTORED=null
+MUTATION_OUTCOME=NO_MUTATION
+SANITIZED=yes
+SECRETS_INCLUDED=no
+PRIVATE_ADDRESSES_INCLUDED=no
+RAW_EVIDENCE_SHA256=db13236deb4e488789bfa79f9da14522d2a458330c8a70229e6879ff981a1bb5
+SANITIZED_OUTPUT_SHA256=db13236deb4e488789bfa79f9da14522d2a458330c8a70229e6879ff981a1bb5
+OUTPUT_BEGIN
+SNIKKET_FRESH_BACKUP_RESTORE_PROOF_WRAPPER=V1
+HOST_PVE01=true
+INGRESS_HOSTKEY_SELF_BOUND=true
+MODE=change
+MUTATION_BOUNDARY=FRESH_VM150_BACKUP_PLUS_TEMP_ISOLATED_RESTORE_ONLY
+NO_PRODUCTION_VM150_CONFIG_MUTATION=true
+NO_DNS_MUTATION=true
+NO_MONITOR_MUTATION=true
+NO_SOURCE_MUTATION=true
+NO_GLOBAL_DR_POLICY_MUTATION=true
+PROOF_PYTHON_RC=0
+PROD_VM150_RUNNING_PRE=true
+PROD_VM150_QGA_PRE=true
+PROD_VM150_CONFIG_SHA_PRE=2e4c1ea46b27034a2efe7bfc00cd9f32c0641a43d8365aa21992f72493a43b0e
+VM150_RUNTIME_EXACT_MATCH_COUNT=60
+FRESH_BACKUP_RESTORE_ERROR_CLASS=RuntimeError
+FRESH_BACKUP_RESTORE_ERROR_SHA256=30e31c3eb92140cf12764306833d83831395839ce95eba60ead3e5c88f3553f7
+PUBLIC_DNS_OK_COUNT=3
+PUBLIC_HTTPS_OK_COUNT=3
+FRESH_BACKUP_AND_ISOLATED_RESTORE_PASS=false
+DECISION=HOLD_SNIKKET_FRESH_BACKUP_RESTORE_PROOF
+NEXT_GATE=SNIKKET_FRESH_BACKUP_RESTORE_RECONCILE
+TASK_RESULT=HOLD_SNIKKET_FRESH_BACKUP_RESTORE_PROOF
+CHANGES_MADE=false
+ROLLBACK_STARTED=false
+ROLLBACK_RESTORED=null
+MUTATION_OUTCOME=NO_MUTATION
+PROOF_PYTHON_STDERR_BYTES=0
+PUBLIC_STUN_3479_PASS=true
+FINAL_FRESH_BACKUP_RESTORE_ACCEPT=false
+HOMELAB_RESULT_CONTRACT={"version":1,"command_id":"SUPPORT-261005-SNIKKET-FRESH-BACKUP-RESTORE-PROOF-99594R1","status":"OK","changes_made":false,"rollback_started":false,"rollback_restored":null}
+
+OUTPUT_END
+CHAT_OUTPUT_END
diff --git a/runtime/latest.json b/runtime/latest.json
index e1d52665..63f35eae 100644
--- a/runtime/latest.json
+++ b/runtime/latest.json
@@ -1,25 +1,25 @@
 {
   "schema_version": 1,
   "channel": "homelab-runtime",
-  "command_id": "SUPPORT-261005-HOME-GRAM1-HTTP403-TOPOLOGY-RCA-99593R1",
+  "command_id": "SUPPORT-261005-SNIKKET-FRESH-BACKUP-RESTORE-PROOF-99594R1",
   "status": "OK",
   "rc": 0,
   "host": "pve01",
-  "mode": "read-only",
-  "component": "home-gram1-http403-topology-rca",
-  "started_at_utc": "2026-10-05T09:07:50Z",
-  "finished_at_utc": "2026-10-05T09:07:56Z",
+  "mode": "change",
+  "component": "snikket-fresh-backup-restore-proof",
+  "started_at_utc": "2026-10-05T09:11:09Z",
+  "finished_at_utc": "2026-10-05T09:11:13Z",
   "reference_register_checked": true,
   "reference_sha256": "5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66",
   "error_register_checked": true,
   "error_register_sha256": "3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0",
-  "command_sha256": "aaaeca49d0fbf9246a46cb3d73283a4569d6422b267b1751abb7ff84108e2a5d",
+  "command_sha256": "aa168f4e2aaf7ed228f1b7ef7073bec91a595c91e272bdbe71396362a9f74e49",
   "duplicate_failed_command_blocked": false,
   "block_reason": null,
   "execution_started": true,
-  "change_declared": false,
+  "change_declared": true,
   "result_contract_valid": true,
-  "result_contract_status": null,
+  "result_contract_status": "OK",
   "result_contract_error": null,
   "command_rc": 0,
   "changes_made": false,
@@ -30,9 +30,9 @@
   "secrets_included": false,
   "private_addresses_included": false,
   "raw_evidence_retained_locally": true,
-  "raw_evidence_sha256": "17eb3c30f0b452dca55cba4d33e06205714ba648378996a1ae318bf0662aeb42",
-  "sanitized_output_sha256": "17eb3c30f0b452dca55cba4d33e06205714ba648378996a1ae318bf0662aeb42",
+  "raw_evidence_sha256": "db13236deb4e488789bfa79f9da14522d2a458330c8a70229e6879ff981a1bb5",
+  "sanitized_output_sha256": "db13236deb4e488789bfa79f9da14522d2a458330c8a70229e6879ff981a1bb5",
   "output_truncated_in_json": false,
   "full_sanitized_output_url": "https://git.gram1.ru/.well-known/homelab-runtime/latest.txt",
-  "output": "HOME_GRAM1_HTTP403_TOPOLOGY_RCA=V1\nNO_MAIL_SEND=true\nNO_SERVICE_RESTART=true\nNO_TIMER_MUTATION=true\nNO_NETWORK_MUTATION=true\nNO_SOURCE_MUTATION=true\nNO_DNS_MUTATION=true\nNO_PROXY_MUTATION=true\nNO_CONTAINER_MUTATION=true\nMODE=read-only\nHOST_PVE01=true\nHTTPS_CURL_RC=0\nHTTPS_HTTP_STATUS=200\nHTTPS_CONTENT_TYPE=text/html; charset=utf-8\nHTTPS_CONTENT_LENGTH=71651\nHTTPS_BODY_BYTES=71651\nHTTPS_BODY_SHA=dfac996d8d5743682137e74e417866dd905f6c3ee3a6511c1342ccf2b5fe060b\nHTTPS_BODY_HAS_FORBIDDEN=false\nHTTPS_BODY_HAS_CLOUDFLARE=true\nHTTPS_BODY_HAS_HOMEPAGE=true\nHTTPS_BODY_HAS_HOMARR=false\nHTTPS_BODY_HAS_NGINX=true\nHTTPS_BODY_HAS_CADDY=true\nHTTPS_BODY_HAS_TRAEFIK=true\nHTTPS_BODY_HAS_HOST_VALIDATION=false\nHTTPS_BODY_HAS_ALLOWED_HOSTS=false\nHTTPS_BODY_HAS_INVALID_HOST=false\nHTTPS_TITLE=Homelab\nHTTP_CURL_RC=0\nHTTP_HTTP_STATUS=301\nHTTP_CONTENT_TYPE=text/html\nHTTP_CONTENT_LENGTH=140\nHTTP_LOCATION=https://home.gram1.ru/\nHTTP_BODY_BYTES=133\nHTTP_BODY_SHA=33405a226a7a7c73d67c73cf635296a9b11b95b6f9fb0dc83e43f9ad47ef09e7\nHTTP_BODY_HAS_FORBIDDEN=false\nHTTP_BODY_HAS_CLOUDFLARE=false\nHTTP_BODY_HAS_HOMEPAGE=false\nHTTP_BODY_HAS_HOMARR=false\nHTTP_BODY_HAS_NGINX=false\nHTTP_BODY_HAS_CADDY=false\nHTTP_BODY_HAS_TRAEFIK=false\nHTTP_BODY_HAS_HOST_VALIDATION=false\nHTTP_BODY_HAS_ALLOWED_HOSTS=false\nHTTP_BODY_HAS_INVALID_HOST=false\nHTTP_TITLE=301 Moved Permanently\nDNS_ADDRESS_COUNT=1\nDNS_1_CLASS=private\nDNS_1_SHA=bc517b4af3298846906234d3d697d3820b0b652ade1880c937c9d71cd802c834\nTLS_RC=0\nTLS_SUBJECT=CN=home.gram1.ru\nTLS_ISSUER=C=US, O=Let's Encrypt, CN=YE2\nTLS_NOTBEFORE=Aug 14 16:08:49 2026 GMT\nTLS_NOTAFTER=Nov 12 16:08:48 2026 GMT\nTLS_SAN_HAS_DOMAIN=true\nGIT_REPO_COUNT=44\nREPO_MATCH_1_REPO_SHA=58c56c4f28c229efb3ca4d09891e4070e176e047f78342121c8b9ce639a4291a\nREPO_MATCH_1_PATH=kb/private/archive/2026-08-19/docs/03_SERVICE_CATALOG.md\nREPO_MATCH_1_PATTERN=homepage\nREPO_MATCH_1_LINE=kb/private/archive/2026-08-19/docs/03_SERVICE_CATALOG.md:154:- `homepage` — `ghcr.io/gethomepage/homepage:latest` — Up 2 weeks (healthy) — `[PRIVATE_IP]:3000->3000/tcp`\nREPO_MATCH_2_REPO_SHA=58c56c4f28c229efb3ca4d09891e4070e176e047f78342121c8b9ce639a4291a\nREPO_MATCH_2_PATH=kb/private/archive/2026-08-19/machine/cluster_inventory.json\nREPO_MATCH_2_PATTERN=homepage\nREPO_MATCH_2_LINE=kb/private/archive/2026-08-19/machine/cluster_inventory.json:1396:          \"name\": \"homepage\",\nREPO_MATCH_3_REPO_SHA=58c56c4f28c229efb3ca4d09891e4070e176e047f78342121c8b9ce639a4291a\nREPO_MATCH_3_PATH=kb/private/archive/2026-08-19/machine/cluster_inventory.json\nREPO_MATCH_3_PATTERN=homepage\nREPO_MATCH_3_LINE=kb/private/archive/2026-08-19/machine/cluster_inventory.json:1397:          \"image\": \"ghcr.io/gethomepage/homepage:latest\",\nREPO_MATCH_4_REPO_SHA=2a829b2765d95641aac83ee239582027e35fb801358950022c180f08f6b3d9bb\nREPO_MATCH_4_PATH=kb/private/archive/2026-08-19/docs/03_SERVICE_CATALOG.md\nREPO_MATCH_4_PATTERN=homepage\nREPO_MATCH_4_LINE=kb/private/archive/2026-08-19/docs/03_SERVICE_CATALOG.md:154:- `homepage` — `ghcr.io/gethomepage/homepage:latest` — Up 2 weeks (healthy) — `[PRIVATE_IP]:3000->3000/tcp`\nREPO_MATCH_5_REPO_SHA=2a829b2765d95641aac83ee239582027e35fb801358950022c180f08f6b3d9bb\nREPO_MATCH_5_PATH=kb/private/archive/2026-08-19/machine/cluster_inventory.json\nREPO_MATCH_5_PATTERN=homepage\nREPO_MATCH_5_LINE=kb/private/archive/2026-08-19/machine/cluster_inventory.json:1396:          \"name\": \"homepage\",\nREPO_MATCH_6_REPO_SHA=2a829b2765d95641aac83ee239582027e35fb801358950022c180f08f6b3d9bb\nREPO_MATCH_6_PATH=kb/private/archive/2026-08-19/machine/cluster_inventory.json\nREPO_MATCH_6_PATTERN=homepage\nREPO_MATCH_6_LINE=kb/private/archive/2026-08-19/machine/cluster_inventory.json:1397:          \"image\": \"ghcr.io/gethomepage/homepage:latest\",\nREPO_MATCH_7_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e\nREPO_MATCH_7_PATH=README.md\nREPO_MATCH_7_PATTERN=home.gram1.ru\nREPO_MATCH_7_LINE=README.md:9:- Homepage: https://home.gram1.ru\nREPO_MATCH_8_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e\nREPO_MATCH_8_PATH=README.md\nREPO_MATCH_8_PATTERN=home.gram1.ru\nREPO_MATCH_8_LINE=README.md:53:- https://home.gram1.ru\nREPO_MATCH_9_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e\nREPO_MATCH_9_PATH=configs/sanitized/edge-vm/homepage-compose.yaml\nREPO_MATCH_9_PATTERN=home.gram1.ru\nREPO_MATCH_9_LINE=configs/sanitized/edge-vm/homepage-compose.yaml:9:      HOMEPAGE_ALLOWED_HOSTS: home.gram1.ru,homepage.vpn.gram1.ru\nREPO_MATCH_10_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e\nREPO_MATCH_10_PATH=configs/sanitized/edge-vm/homepage-services.yaml\nREPO_MATCH_10_PATTERN=home.gram1.ru\nREPO_MATCH_10_LINE=configs/sanitized/edge-vm/homepage-services.yaml:3:      href: https://home.gram1.ru\nREPO_MATCH_11_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e\nREPO_MATCH_11_PATH=docs/05-service-catalog.md\nREPO_MATCH_11_PATTERN=home.gram1.ru\nREPO_MATCH_11_LINE=docs/05-service-catalog.md:67:- Domain: https://home.gram1.ru\nREPO_MATCH_12_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e\nREPO_MATCH_12_PATH=docs/06-certificates-troubleshooting.md\nREPO_MATCH_12_PATTERN=home.gram1.ru\nREPO_MATCH_12_LINE=docs/06-certificates-troubleshooting.md:62:Observed with home.gram1.ru and git.gram1.ru before certificate completion.\nREPO_MATCH_13_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e\nREPO_MATCH_13_PATH=docs/06-certificates-troubleshooting.md\nREPO_MATCH_13_PATTERN=home.gram1.ru\nREPO_MATCH_13_LINE=docs/06-certificates-troubleshooting.md:96:- home.gram1.ru: Lets Encrypt via Cloudflare DNS challenge.\nREPO_MATCH_14_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e\nREPO_MATCH_14_PATH=docs/99-current-state-summary.md\nREPO_MATCH_14_PATTERN=home.gram1.ru\nREPO_MATCH_14_LINE=docs/99-current-state-summary.md:113:- URL: https://home.gram1.ru\nREPO_MATCH_15_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e\nREPO_MATCH_15_PATH=docs/99-current-state-summary.md\nREPO_MATCH_15_PATTERN=home.gram1.ru\nREPO_MATCH_15_LINE=docs/99-current-state-summary.md:147:- https://home.gram1.ru\nREPO_MATCH_16_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e\nREPO_MATCH_16_PATH=docs/operations/p0-healthchecks-restore-proof-preflight-20260624T190801Z.md\nREPO_MATCH_16_PATTERN=home.gram1.ru\nREPO_MATCH_16_LINE=docs/operations/p0-healthchecks-restore-proof-preflight-20260624T190801Z.md:65:id=16 active=1 interval=300 type=http name=Homepage HTTPS target=https://home.gram1.ru\nREPO_MATCH_17_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e\nREPO_MATCH_17_PATH=docs/operations/p0-restore-drill-matrix-edge-index-20260624T183747Z.md\nREPO_MATCH_17_PATTERN=home.gram1.ru\nREPO_MATCH_17_LINE=docs/operations/p0-restore-drill-matrix-edge-index-20260624T183747Z.md:112:id=16 active=1 interval=300 type=http name=Homepage HTTPS target=https://home.gram1.ru\nREPO_MATCH_18_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e\nREPO_MATCH_18_PATH=docs/operations/p0-restore-drill-matrix-quality-offhost-20260624T183931Z.md\nREPO_MATCH_18_PATTERN=home.gram1.ru\nREPO_MATCH_18_LINE=docs/operations/p0-restore-drill-matrix-quality-offhost-20260624T183931Z.md:126:id=16 active=1 interval=300 type=http name=Homepage HTTPS target=https://home.gram1.ru\nREPO_MATCH_19_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e\nREPO_MATCH_19_PATH=docs/operations/p0-vikunja-restore-proof-preflight-20260624T191408Z.md\nREPO_MATCH_19_PATTERN=home.gram1.ru\nREPO_MATCH_19_LINE=docs/operations/p0-vikunja-restore-proof-preflight-20260624T191408Z.md:63:id=16 active=1 interval=300 type=http name=Homepage HTTPS target=https://home.gram1.ru\nREPO_MATCH_20_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e\nREPO_MATCH_20_PATH=docs/operations/p1-exposure-matrix-npmplus-route-inventory-20260625T212426Z.json\nREPO_MATCH_20_PATTERN=home.gram1.ru\nREPO_MATCH_20_LINE=docs/operations/p1-exposure-matrix-npmplus-route-inventory-20260625T212426Z.json:123:        \"home.gram1.ru\"\nREPO_MATCH_21_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e\nREPO_MATCH_21_PATH=docs/operations/p1-exposure-matrix-npmplus-route-inventory-20260625T212426Z.md\nREPO_MATCH_21_PATTERN=home.gram1.ru\nREPO_MATCH_21_LINE=docs/operations/p1-exposure-matrix-npmplus-route-inventory-20260625T212426Z.md:34:| 8 | public_or_unknown | home.gram1.ru | yes | http | [PRIVATE_IP]:3000 | present | 8 |\nREPO_MATCH_22_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e\nREPO_MATCH_22_PATH=docs/operations/p1-exposure-ownership-matrix-20260625T212704Z.json\nREPO_MATCH_22_PATTERN=home.gram1.ru\nREPO_MATCH_22_LINE=docs/operations/p1-exposure-ownership-matrix-20260625T212704Z.json:103:      \"domain\": \"home.gram1.ru\",\nREPO_MATCH_23_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e\nREPO_MATCH_23_PATH=docs/operations/p1-exposure-ownership-matrix-20260625T212704Z.json\nREPO_MATCH_23_PATTERN=home.gram1.ru\nREPO_MATCH_23_LINE=docs/operations/p1-exposure-ownership-matrix-20260625T212704Z.json:105:        \"home.gram1.ru\"\nREPO_MATCH_24_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e\nREPO_MATCH_24_PATH=docs/operations/p1-exposure-ownership-matrix-20260625T212704Z.md\nREPO_MATCH_24_PATTERN=home.gram1.ru\nREPO_MATCH_24_LINE=docs/operations/p1-exposure-ownership-matrix-20260625T212704Z.md:39:| 8 | home.gram1.ru | public-domain | homepage | edge-local | http://[PRIVATE_IP]:3000 | yes | present | OK_PUBLIC_INTENTIONAL | keep_monitoring |\nREPO_MATCH_25_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e\nREPO_MATCH_25_PATH=docs/operations/p2-dependency-risk-classification-20260625T221747Z.json\nREPO_MATCH_25_PATTERN=home.gram1.ru\nREPO_MATCH_25_LINE=docs/operations/p2-dependency-risk-classification-20260625T221747Z.json:905:      \"domain\": \"home.gram1.ru\",\nREPO_MATCH_26_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e\nREPO_MATCH_26_PATH=docs/operations/p2-dependency-risk-classification-20260625T221747Z.md\nREPO_MATCH_26_PATTERN=home.gram1.ru\nREPO_MATCH_26_LINE=docs/operations/p2-dependency-risk-classification-20260625T221747Z.md:68:| 8 | home.gram1.ru | http://[PRIVATE_IP]:3000 | homepage | PUBLIC_OR_UNKNOWN_ROUTE, ACCESS_HINT_REVIEW |\nREPO_MATCH_27_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e\nREPO_MATCH_27_PATH=docs/operations/p2-service-dependency-graph-20260625T221552Z.json\nREPO_MATCH_27_PATTERN=home.gram1.ru\nREPO_MATCH_27_LINE=docs/operations/p2-service-dependency-graph-20260625T221552Z.json:1278:      \"domain\": \"home.gram1.ru\",\nREPO_MATCH_28_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e\nREPO_MATCH_28_PATH=docs/operations/p2-service-dependency-graph-20260625T221552Z.json\nREPO_MATCH_28_PATTERN=home.gram1.ru\nREPO_MATCH_28_LINE=docs/operations/p2-service-dependency-graph-20260625T221552Z.json:1870:        \"home.gram1.ru\",\nREPO_MATCH_29_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e\nREPO_MATCH_29_PATH=docs/operations/p2-service-dependency-graph-20260625T221552Z.md\nREPO_MATCH_29_PATTERN=home.gram1.ru\nREPO_MATCH_29_LINE=docs/operations/p2-service-dependency-graph-20260625T221552Z.md:112:| homepage | homepage | home.gram1.ru, homepage.vpn.gram1.ru |\nREPO_MATCH_30_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e\nREPO_MATCH_30_PATH=docs/operations/postp1-fix-inputs-npm-sops-inspect-20260624T182227Z.md\nREPO_MATCH_30_PATTERN=home.gram1.ru\nREPO_MATCH_30_LINE=docs/operations/postp1-fix-inputs-npm-sops-inspect-20260624T182227Z.md:200:8\t1\t27\t1\t[\"home.gram1.ru\"]\t[PRIVATE_IP]\t3000\nREPO_MATCH_31_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e\nREPO_MATCH_31_PATH=docs/service-url-catalog.md\nREPO_MATCH_31_PATTERN=home.gram1.ru\nREPO_MATCH_31_LINE=docs/service-url-catalog.md:16:| home.gram1.ru | http://[PRIVATE_IP]:3000 | yes | LAN only | home.gram1.ru | enabled |\nREPO_MATCH_32_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e\nREPO_MATCH_32_PATH=docs/service-url-catalog.md\nREPO_MATCH_32_PATTERN=home.gram1.ru\nREPO_MATCH_32_LINE=docs/service-url-catalog.md:48:| home.gram1.ru | letsencrypt | 2026-09-13 16:43:44 |\nREPO_MATCH_33_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e\nREPO_MATCH_33_PATH=docs/service-url-catalog.md\nREPO_MATCH_33_PATTERN=home.gram1.ru\nREPO_MATCH_33_LINE=docs/service-url-catalog.md:75:| `home.gram1.ru` | `http://[PRIVATE_IP]:3000` | cert id 27 | yes | Homepage |\nREPO_MATCH_34_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e\nREPO_MATCH_34_PATH=evidence/p0-restore-drill-20260624T122122Z/edge-health-redacted.txt\nREPO_MATCH_34_PATTERN=home.gram1.ru\nREPO_MATCH_34_LINE=evidence/p0-restore-drill-20260624T122122Z/edge-health-redacted.txt:34:id=16 active=1 interval=300 type=http name=Homepage HTTPS target=https://home.gram1.ru\nREPO_MATCH_35_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e\nREPO_MATCH_35_PATH=inventory/domains.csv\nREPO_MATCH_35_PATTERN=home.gram1.ru\nREPO_MATCH_35_LINE=inventory/domains.csv:5:home.gram1.ru,[PRIVATE_IP],[PRIVATE_IP],http://[PRIVATE_IP]:3000,LAN-only,cloudflare-dns-challenge\nREPO_MATCH_36_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e\nREPO_MATCH_36_PATH=inventory/ports.md\nREPO_MATCH_36_PATTERN=home.gram1.ru\nREPO_MATCH_36_LINE=inventory/ports.md:42:| Homepage | [PRIVATE_IP]:3000 | https://home.gram1.ru |\nREPO_MATCH_37_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e\nREPO_MATCH_37_PATH=configs/sanitized/edge-vm/homepage-compose.yaml\nREPO_MATCH_37_PATTERN=HOMEPAGE_ALLOWED_HOSTS\nREPO_MATCH_37_LINE=configs/sanitized/edge-vm/homepage-compose.yaml:9:      HOMEPAGE_ALLOWED_HOSTS: home.gram1.ru,homepage.vpn.gram1.ru\nREPO_MATCH_38_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e\nREPO_MATCH_38_PATH=baselines/README.md\nREPO_MATCH_38_PATTERN=homepage\nREPO_MATCH_38_LINE=baselines/README.md:14:- `/root/homepage-post-install-baseline-20260615T145851Z.tar.gz`\nREPO_MATCH_39_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e\nREPO_MATCH_39_PATH=configs/sanitized/edge-vm/homepage-compose.yaml\nREPO_MATCH_39_PATTERN=homepage\nREPO_MATCH_39_LINE=configs/sanitized/edge-vm/homepage-compose.yaml:2:  homepage:\nREPO_MATCH_40_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e\nREPO_MATCH_40_PATH=configs/sanitized/edge-vm/homepage-compose.yaml\nREPO_MATCH_40_PATTERN=homepage\nREPO_MATCH_40_LINE=configs/sanitized/edge-vm/homepage-compose.yaml:3:    image: ghcr.io/gethomepage/homepage:latest\nREPO_MATCH_41_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e\nREPO_MATCH_41_PATH=configs/sanitized/edge-vm/homepage-compose.yaml\nREPO_MATCH_41_PATTERN=homepage\nREPO_MATCH_41_LINE=configs/sanitized/edge-vm/homepage-compose.yaml:4:    container_name: homepage\nREPO_MATCH_42_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e\nREPO_MATCH_42_PATH=configs/sanitized/edge-vm/homepage-compose.yaml\nREPO_MATCH_42_PATTERN=homepage\nREPO_MATCH_42_LINE=configs/sanitized/edge-vm/homepage-compose.yaml:9:      HOMEPAGE_ALLOWED_HOSTS: home.gram1.ru,homepage.vpn.gram1.ru\nREPO_MATCH_43_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e\nREPO_MATCH_43_PATH=configs/sanitized/edge-vm/homepage-services.yaml\nREPO_MATCH_43_PATTERN=homepage\nREPO_MATCH_43_LINE=configs/sanitized/edge-vm/homepage-services.yaml:5:      icon: homepage.png\nREPO_MATCH_44_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e\nREPO_MATCH_44_PATH=configs/sanitized/edge-vm/homepage-services.yaml\nREPO_MATCH_44_PATTERN=homepage\nREPO_MATCH_44_LINE=configs/sanitized/edge-vm/homepage-services.yaml:7:      href: https://homepage.vpn.gram1.ru\nREPO_MATCH_45_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e\nREPO_MATCH_45_PATH=configs/sanitized/edge-vm/homepage-services.yaml\nREPO_MATCH_45_PATTERN=homepage\nREPO_MATCH_45_LINE=configs/sanitized/edge-vm/homepage-services.yaml:9:      icon: homepage.png\nREPO_MATCH_46_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e\nREPO_MATCH_46_PATH=docs/03-proxmox-layout.md\nREPO_MATCH_46_PATTERN=homepage\nREPO_MATCH_46_LINE=docs/03-proxmox-layout.md:53:- homepage\nREPO_MATCH_47_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e\nREPO_MATCH_47_PATH=docs/05-service-catalog.md\nREPO_MATCH_47_PATTERN=homepage\nREPO_MATCH_47_LINE=docs/05-service-catalog.md:64:- Compose path: /opt/stacks/homepage/compose.yaml\nREPO_MATCH_48_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e\nREPO_MATCH_48_PATH=docs/05-service-catalog.md\nREPO_MATCH_48_PATTERN=homepage\nREPO_MATCH_48_LINE=docs/05-service-catalog.md:65:- Config path: /opt/stacks/homepage/config\nREPO_MATCH_49_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e\nREPO_MATCH_49_PATH=docs/99-current-state-summary.md\nREPO_MATCH_49_PATTERN=homepage\nREPO_MATCH_49_LINE=docs/99-current-state-summary.md:114:- Config path: /opt/stacks/homepage/config\nREPO_MATCH_50_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e\nREPO_MATCH_50_PATH=docs/99-current-state-summary.md\nREPO_MATCH_50_PATTERN=homepage\nREPO_MATCH_50_LINE=docs/99-current-state-summary.md:441:- `filebrowser, gitea, homebox, homepage, karakeep-chrome, karakeep-meilisearch, minio, node-exporter, prometheus`\nREPO_MATCH_51_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e\nREPO_MATCH_51_PATH=docs/99-current-state-summary.md\nREPO_MATCH_51_PATTERN=homepage\nREPO_MATCH_51_LINE=docs/99-current-state-summary.md:2333:- `homepage.vpn.gram1.ru`: HTTP `200`\nREPO_MATCH_52_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e\nREPO_MATCH_52_PATH=docs/ERRORS-LESSONS-20260618.md\nREPO_MATCH_52_PATTERN=homepage\nREPO_MATCH_52_LINE=docs/ERRORS-LESSONS-20260618.md:61:Correct value: only https://homepage.vpn.gram1.ru.\nREPO_MATCH_53_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e\nREPO_MATCH_53_PATH=docs/ERRORS-LESSONS-20260618.md\nREPO_MATCH_53_PATTERN=homepage\nREPO_MATCH_53_LINE=docs/ERRORS-LESSONS-20260618.md:90:Cause: command authentik_homepage_application_cli_created returned SSH_RC=0 but produced no expected stdout, so local verification could not confirm provider/application state.\nREPO_MATCH_54_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e\nREPO_MATCH_54_PATH=docs/ERRORS-LESSONS-20260618.md\nREPO_MATCH_54_PATTERN=homepage\nREPO_MATCH_54_LINE=docs/ERRORS-LESSONS-20260618.md:108:Correction: use local direct Authentik outpost checks with homepage.vpn.gram1.ru forwarded headers before enabling NPMplus auth. Do not require the public auth.vpn outpost auth endpoint to match the Homepage provider.\nREPO_MATCH_55_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e\nREPO_MATCH_55_PATH=docs/HANDOFF-20260618-authentik-npmplus.md\nREPO_MATCH_55_PATTERN=homepage\nREPO_MATCH_55_LINE=docs/HANDOFF-20260618-authentik-npmplus.md:11:homepage.vpn.gram1.ru    proxy id 17 cert id 32 access 1 ssl forced\nREPO_MATCH_56_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e\nREPO_MATCH_56_PATH=docs/HANDOFF-20260618-authentik-npmplus.md\nREPO_MATCH_56_PATTERN=homepage\nREPO_MATCH_56_LINE=docs/HANDOFF-20260618-authentik-npmplus.md:31:Slug or Identifier: homepage-vpn\nREPO_MATCH_57_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e\nREPO_MATCH_57_PATH=docs/HANDOFF-20260618-authentik-npmplus.md\nREPO_MATCH_57_PATTERN=homepage\nREPO_MATCH_57_LINE=docs/HANDOFF-20260618-authentik-npmplus.md:33:Launch URL: https://homepage.vpn.gram1.ru\nREPO_MATCH_58_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e\nREPO_MATCH_58_PATH=docs/HANDOFF-20260618-authentik-npmplus.md\nREPO_MATCH_58_PATTERN=homepage\nREPO_MATCH_58_LINE=docs/HANDOFF-20260618-authentik-npmplus.md:34:Provider: homepage-vpn-forward-auth\nREPO_MATCH_59_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e\nREPO_MATCH_59_PATH=docs/HANDOFF-20260618-authentik-npmplus.md\nREPO_MATCH_59_PATTERN=homepage\nREPO_MATCH_59_LINE=docs/HANDOFF-20260618-authentik-npmplus.md:42:Only after provider and outpost verification, enable npmplus_auth_request authentik for homepage.vpn.gram1.ru. Keep rollback ready by setting it back to none.\nREPO_MATCH_60_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e\nREPO_MATCH_60_PATH=docs/HANDOFF-20260618-authentik-npmplus.md\nREPO_MATCH_60_PATTERN=homepage\nREPO_MATCH_60_LINE=docs/HANDOFF-20260618-authentik-npmplus.md:54:The public check through auth.vpn.gram1.ru returned 404 for /outpost.goauthentik.io/auth/nginx, while the local direct outpost check for homepage.vpn.gram1.ru returned a valid auth response. Treat the public auth.vpn auth endpoint as a wrong validation path for Homepage. Next safe step: enable npmplus_auth_request=authentik only for homepage proxy id 17 with rollback ready.\nREPO_MATCH_61_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e\nREPO_MATCH_61_PATH=docs/HANDOFF-20260618-authentik-npmplus.md\nREPO_MATCH_61_PATTERN=homepage\nREPO_MATCH_61_LINE=docs/HANDOFF-20260618-authentik-npmplus.md:73:host: homepage.vpn.gram1.ru\nREPO_MATCH_62_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e\nREPO_MATCH_62_PATH=docs/RUNBOOK-PRIVATE-VPN-HOSTS-20260618.md\nREPO_MATCH_62_PATTERN=homepage\nREPO_MATCH_62_LINE=docs/RUNBOOK-PRIVATE-VPN-HOSTS-20260618.md:22:homepage.vpn.gram1.ru    -> [PRIVATE_IP] -> NPMplus -> [PRIVATE_IP]:3000\nREPO_MATCH_63_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e\nREPO_MATCH_63_PATH=docs/RUNBOOK-PRIVATE-VPN-HOSTS-20260618.md\nREPO_MATCH_63_PATTERN=homepage\nREPO_MATCH_63_LINE=docs/RUNBOOK-PRIVATE-VPN-HOSTS-20260618.md:55:EDGE_HOST=edge-vm;DOCKER_IMAGES=actual-budget=actualbudget/actual-server:latest;authentik-postgresql-1=postgres:16-alpine;authentik-server-1=ghcr.io/goauthentik/server:2026.5.3;authentik-worker-1=ghcr.io/goauthentik/server:2026.5.3;beszel=henrygd/beszel:latest;crowdsec=crowdsecurity/crowdsec:latest;dockge=louislam/dockge:1;dozzle=amir20/dozzle:latest;filebrowser=filebrowser/filebrowser:latest;gitea=docker.gitea.com/gitea:1.26.2;gotify=gotify/server:latest;grafana=grafana/grafana:latest;homeassistant=ghcr.io/home-assistant/home-assistant:stable;homebox=ghcr.io/sysadminsmedia/homebox:latest-rootless;homepage=ghcr.io/gethomepage/homepage:latest;immi\nREPO_MATCH_64_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e\nREPO_MATCH_64_PATH=docs/SERVICES-BOOTSTRAP-20260617.md\nREPO_MATCH_64_PATTERN=homepage\nREPO_MATCH_64_LINE=docs/SERVICES-BOOTSTRAP-20260617.md:15:STACKS=/opt/stacks/ntfy;/opt/stacks/filebrowser;/opt/stacks/searxng;/opt/stacks/mealie;/opt/stacks/homeassistant;/opt/stacks/homebox;/opt/stacks/it-tools;/opt/stacks/minio;/opt/stacks/crowdsec;/opt/stacks/linkding;/opt/stacks/observability-lite;/opt/stacks/gitea;/opt/stacks/memos;/opt/stacks/node-red;/opt/stacks/paperless;/opt/stacks/karakeep;/opt/stacks/beszel;/opt/stacks/actual-budget;/opt/stacks/dozzle;/opt/stacks/homepage;/opt/stacks/syncthing;/opt/stacks/n8n;\nREPO_MATCH_65_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e\nREPO_MATCH_65_PATH=docs/SERVICES-BOOTSTRAP-20260617.md\nREPO_MATCH_65_PATTERN=homepage\nREPO_MATCH_65_LINE=docs/SERVICES-BOOTSTRAP-20260617.md:16:CONTAINERS=actual-budget|actualbudget/actual-server:latest|Up 11 hours|[PRIVATE_IP]:5006->5006/tcp;[redacted] 36 hours (healthy)|5432/tcp;[redacted] 36 hours (healthy)|[PRIVATE_IP]:9000->9000/tcp, [PRIVATE_IP]:9443->9443/tcp;[redacted] 36 hours (healthy)|;beszel|henrygd/beszel:latest|Up 12 hours|[PRIVATE_IP]:8090->8090/tcp;crowdsec|crowdsecurity/crowdsec:latest|Up 11 hours|;dockge|louislam/dockge:1|Up 36 hours (healthy)|[PRIVATE_IP]:5001->5001/tcp;dozzle|amir20/dozzle:latest|Up 36 hours|[PRIVATE_IP]:9999->8080/tcp;filebrowser|filebrowser/filebrowser:latest|Up 10 hours (healthy)|[PRIVATE_IP]:8085->80/tcp;gitea|docker.gitea.com/gitea:1.26.2|Up 36 hours|22\nREPO_MATCH_66_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e\nREPO_MATCH_66_PATH=docs/SERVICES-BOOTSTRAP-20260617.md\nREPO_MATCH_66_PATTERN=homepage\nREPO_MATCH_66_LINE=docs/SERVICES-BOOTSTRAP-20260617.md:208:homepage.vpn.gram1.ru    -> [PRIVATE_IP] -> [PRIVATE_IP]:3000\nREPO_MATCH_67_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e\nREPO_MATCH_67_PATH=docs/SERVICES-BOOTSTRAP-20260617.md\nREPO_MATCH_67_PATTERN=homepage\nREPO_MATCH_67_LINE=docs/SERVICES-BOOTSTRAP-20260617.md:216:BINDING=      - NPM_IPV4_BINDING=[PRIVATE_IP];      - IPV4_BINDING=[PRIVATE_IP];;ACCESS=5|access_list_id=1|address=[PRIVATE_IP]/24|directive=allow;6|access_list_id=1|address=[PRIVATE_IP]/24|directive=allow;7|access_list_id=1|address=[PRIVATE_IP]/16|directive=allow;8|access_list_id=1|address=[PRIVATE_IP]/16|directive=allow;;PROXIES=16|[\"kuma.vpn.gram1.ru\"]|forward=http://[PRIVATE_IP]:3001|cert=32|access=1|enabled=1|ssl_forced=1|hsts=0;17|[\"homepage.vpn.gram1.ru\"]|forward=http://[PRIVATE_IP]:3000|cert=32|access=1|enabled=1|ssl_forced=1|hsts=0;18|[\"gitea.vpn.gram1.ru\"]|forward=http://[PRIVATE_IP]:3002|cert=32|access=1|enabled=1|ssl_forced=1|hsts=0;19|[\"fi\nREPO_MATCH_68_REPO_SHA=b3bd020ee5e776df415b94aee9451ce762c9c91c320a7e6502cf0c1435363c7f\nREPO_MATCH_68_PATH=kb/private/archive/2026-08-19/docs/03_SERVICE_CATALOG.md\nREPO_MATCH_68_PATTERN=homepage\nREPO_MATCH_68_LINE=kb/private/archive/2026-08-19/docs/03_SERVICE_CATALOG.md:154:- `homepage` — `ghcr.io/gethomepage/homepage:latest` — Up 2 weeks (healthy) — `[PRIVATE_IP]:3000->3000/tcp`\nREPO_MATCH_69_REPO_SHA=b3bd020ee5e776df415b94aee9451ce762c9c91c320a7e6502cf0c1435363c7f\nREPO_MATCH_69_PATH=kb/private/archive/2026-08-19/machine/cluster_inventory.json\nREPO_MATCH_69_PATTERN=homepage\nREPO_MATCH_69_LINE=kb/private/archive/2026-08-19/machine/cluster_inventory.json:1396:          \"name\": \"homepage\",\nREPO_MATCH_70_REPO_SHA=b3bd020ee5e776df415b94aee9451ce762c9c91c320a7e6502cf0c1435363c7f\nREPO_MATCH_70_PATH=kb/private/archive/2026-08-19/machine/cluster_inventory.json\nREPO_MATCH_70_PATTERN=homepage\nREPO_MATCH_70_LINE=kb/private/archive/2026-08-19/machine/cluster_inventory.json:1397:          \"image\": \"ghcr.io/gethomepage/homepage:latest\",\nREPO_MATCH_71_REPO_SHA=43edb8c759a325850dc949c70678f7d00db21eee7cd62c8909cea8281531314d\nREPO_MATCH_71_PATH=kb/private/archive/2026-08-19/docs/03_SERVICE_CATALOG.md\nREPO_MATCH_71_PATTERN=homepage\nREPO_MATCH_71_LINE=kb/private/archive/2026-08-19/docs/03_SERVICE_CATALOG.md:154:- `homepage` — `ghcr.io/gethomepage/homepage:latest` — Up 2 weeks (healthy) — `[PRIVATE_IP]:3000->3000/tcp`\nREPO_MATCH_72_REPO_SHA=43edb8c759a325850dc949c70678f7d00db21eee7cd62c8909cea8281531314d\nREPO_MATCH_72_PATH=kb/private/archive/2026-08-19/machine/cluster_inventory.json\nREPO_MATCH_72_PATTERN=homepage\nREPO_MATCH_72_LINE=kb/private/archive/2026-08-19/machine/cluster_inventory.json:1396:          \"name\": \"homepage\",\nREPO_MATCH_73_REPO_SHA=43edb8c759a325850dc949c70678f7d00db21eee7cd62c8909cea8281531314d\nREPO_MATCH_73_PATH=kb/private/archive/2026-08-19/machine/cluster_inventory.json\nREPO_MATCH_73_PATTERN=homepage\nREPO_MATCH_73_LINE=kb/private/archive/2026-08-19/machine/cluster_inventory.json:1397:          \"image\": \"ghcr.io/gethomepage/homepage:latest\",\nREPO_MATCH_74_REPO_SHA=23273fcc8384fcaaa64503e3daf9d2ad455c5be24d496dbd4d82bb7bf67f489d\nREPO_MATCH_74_PATH=kb/private/archive/2026-08-19/docs/03_SERVICE_CATALOG.md\nREPO_MATCH_74_PATTERN=homepage\nREPO_MATCH_74_LINE=kb/private/archive/2026-08-19/docs/03_SERVICE_CATALOG.md:154:- `homepage` — `ghcr.io/gethomepage/homepage:latest` — Up 2 weeks (healthy) — `[PRIVATE_IP]:3000->3000/tcp`\nREPO_MATCH_75_REPO_SHA=23273fcc8384fcaaa64503e3daf9d2ad455c5be24d496dbd4d82bb7bf67f489d\nREPO_MATCH_75_PATH=kb/private/archive/2026-08-19/machine/cluster_inventory.json\nREPO_MATCH_75_PATTERN=homepage\nREPO_MATCH_75_LINE=kb/private/archive/2026-08-19/machine/cluster_inventory.json:1396:          \"name\": \"homepage\",\nREPO_MATCH_76_REPO_SHA=23273fcc8384fcaaa64503e3daf9d2ad455c5be24d496dbd4d82bb7bf67f489d\nREPO_MATCH_76_PATH=kb/private/archive/2026-08-19/machine/cluster_inventory.json\nREPO_MATCH_76_PATTERN=homepage\nREPO_MATCH_76_LINE=kb/private/archive/2026-08-19/machine/cluster_inventory.json:1397:          \"image\": \"ghcr.io/gethomepage/homepage:latest\",\nREPO_MATCH_77_REPO_SHA=01acf10171d1463b5d9692c69ca3ae04684a26fe7afd5716891c325e80e771bc\nREPO_MATCH_77_PATH=kb/private/archive/2026-08-19/docs/03_SERVICE_CATALOG.md\nREPO_MATCH_77_PATTERN=homepage\nREPO_MATCH_77_LINE=kb/private/archive/2026-08-19/docs/03_SERVICE_CATALOG.md:154:- `homepage` — `ghcr.io/gethomepage/homepage:latest` — Up 2 weeks (healthy) — `[PRIVATE_IP]:3000->3000/tcp`\nREPO_MATCH_78_REPO_SHA=01acf10171d1463b5d9692c69ca3ae04684a26fe7afd5716891c325e80e771bc\nREPO_MATCH_78_PATH=kb/private/archive/2026-08-19/machine/cluster_inventory.json\nREPO_MATCH_78_PATTERN=homepage\nREPO_MATCH_78_LINE=kb/private/archive/2026-08-19/machine/cluster_inventory.json:1396:          \"name\": \"homepage\",\nREPO_MATCH_79_REPO_SHA=01acf10171d1463b5d9692c69ca3ae04684a26fe7afd5716891c325e80e771bc\nREPO_MATCH_79_PATH=kb/private/archive/2026-08-19/machine/cluster_inventory.json\nREPO_MATCH_79_PATTERN=homepage\nREPO_MATCH_79_LINE=kb/private/archive/2026-08-19/machine/cluster_inventory.json:1397:          \"image\": \"ghcr.io/gethomepage/homepage:latest\",\nREPO_MATCH_80_REPO_SHA=6a5d39387f04765b96e1ce0ad8b812560f60db0fdb2f8202d25647714ce7ef81\nREPO_MATCH_80_PATH=kb/private/archive/2026-08-19/docs/03_SERVICE_CATALOG.md\nREPO_MATCH_80_PATTERN=homepage\nREPO_MATCH_80_LINE=kb/private/archive/2026-08-19/docs/03_SERVICE_CATALOG.md:154:- `homepage` — `ghcr.io/gethomepage/homepage:latest` — Up 2 weeks (healthy) — `[PRIVATE_IP]:3000->3000/tcp`\nREPO_MATCH_COUNT=80\nHOMEPAGE_ALLOWED_HOSTS_SOURCE_EVIDENCE=true\nCLUSTER_RESOURCES_RC=0\nCLUSTER_RESOURCES_JSON=true\nCLUSTER_CANDIDATE_COUNT=1\nCAND_1_VMID=190\nCAND_1_TYPE=qemu\nCAND_1_NODE=pve03\nCAND_1_STATUS=running\nCAND_1_NAME=homelab-ops-worker\nONLINE_NODE_COUNT=3\nNODE_PVE02_SEARCH_RC=0\nNODE_PVE03_SEARCH_RC=0\nNODE_PVE01_SEARCH_RC=0\nHOSTCFG_1_NODE=pve01\nHOSTCFG_1_PATH=/srv/homelab-ops-worktrees/cr-2026-0017-inventory-foundation/observed/services/index.json\nHOSTCFG_2_NODE=pve01\nHOSTCFG_2_PATH=/srv/homelab-ops-worktrees/cr-2026-0017-inventory-foundation/inventory/services.json\nHOSTCFG_3_NODE=pve01\nHOSTCFG_3_PATH=/srv/homelab-desired-state/health/service-readiness-homepage.txt\nHOSTCFG_MATCH_COUNT=3\nGUEST_190_EXEC_RC=255\nGUEST_OBSERVATION_COUNT=0\nEXTERNAL_403_REPRODUCED=false\nDECISION=ANALYZE_HOME_GRAM1_403_TOPOLOGY\nNEXT_GATE=HOME_GRAM1_TARGETED_REPAIR\nTASK_RESULT=HOME_GRAM1_HTTP403_TOPOLOGY_RCA\nCHANGES_MADE=false\nROLLBACK_STARTED=false\nROLLBACK_RESTORED=null\nMUTATION_OUTCOME=NO_MUTATION\n"
+  "output": "SNIKKET_FRESH_BACKUP_RESTORE_PROOF_WRAPPER=V1\nHOST_PVE01=true\nINGRESS_HOSTKEY_SELF_BOUND=true\nMODE=change\nMUTATION_BOUNDARY=FRESH_VM150_BACKUP_PLUS_TEMP_ISOLATED_RESTORE_ONLY\nNO_PRODUCTION_VM150_CONFIG_MUTATION=true\nNO_DNS_MUTATION=true\nNO_MONITOR_MUTATION=true\nNO_SOURCE_MUTATION=true\nNO_GLOBAL_DR_POLICY_MUTATION=true\nPROOF_PYTHON_RC=0\nPROD_VM150_RUNNING_PRE=true\nPROD_VM150_QGA_PRE=true\nPROD_VM150_CONFIG_SHA_PRE=2e4c1ea46b27034a2efe7bfc00cd9f32c0641a43d8365aa21992f72493a43b0e\nVM150_RUNTIME_EXACT_MATCH_COUNT=60\nFRESH_BACKUP_RESTORE_ERROR_CLASS=RuntimeError\nFRESH_BACKUP_RESTORE_ERROR_SHA256=30e31c3eb92140cf12764306833d83831395839ce95eba60ead3e5c88f3553f7\nPUBLIC_DNS_OK_COUNT=3\nPUBLIC_HTTPS_OK_COUNT=3\nFRESH_BACKUP_AND_ISOLATED_RESTORE_PASS=false\nDECISION=HOLD_SNIKKET_FRESH_BACKUP_RESTORE_PROOF\nNEXT_GATE=SNIKKET_FRESH_BACKUP_RESTORE_RECONCILE\nTASK_RESULT=HOLD_SNIKKET_FRESH_BACKUP_RESTORE_PROOF\nCHANGES_MADE=false\nROLLBACK_STARTED=false\nROLLBACK_RESTORED=null\nMUTATION_OUTCOME=NO_MUTATION\nPROOF_PYTHON_STDERR_BYTES=0\nPUBLIC_STUN_3479_PASS=true\nFINAL_FRESH_BACKUP_RESTORE_ACCEPT=false\nHOMELAB_RESULT_CONTRACT={\"version\":1,\"command_id\":\"SUPPORT-261005-SNIKKET-FRESH-BACKUP-RESTORE-PROOF-99594R1\",\"status\":\"OK\",\"changes_made\":false,\"rollback_started\":false,\"rollback_restored\":null}\n"
 }
diff --git a/runtime/latest.txt b/runtime/latest.txt
index 9100d8df..4b17a6eb 100644
--- a/runtime/latest.txt
+++ b/runtime/latest.txt
@@ -1,20 +1,20 @@
 CHAT_OUTPUT_BEGIN
-COMMAND_ID=SUPPORT-261005-HOME-GRAM1-HTTP403-TOPOLOGY-RCA-99593R1
+COMMAND_ID=SUPPORT-261005-SNIKKET-FRESH-BACKUP-RESTORE-PROOF-99594R1
 STATUS=OK
 RC=0
 HOST=pve01
-MODE=read-only
-COMPONENT=home-gram1-http403-topology-rca
+MODE=change
+COMPONENT=snikket-fresh-backup-restore-proof
 REFERENCE_REGISTER_CHECK=OK
 REFERENCE_SHA256=5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66
 ERROR_REGISTER_CHECK=OK
 ERROR_REGISTER_SHA256=3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0
-COMMAND_SHA256=aaaeca49d0fbf9246a46cb3d73283a4569d6422b267b1751abb7ff84108e2a5d
+COMMAND_SHA256=aa168f4e2aaf7ed228f1b7ef7073bec91a595c91e272bdbe71396362a9f74e49
 DUPLICATE_FAILED_COMMAND_BLOCKED=false
 EXECUTION_STARTED=true
-CHANGE_DECLARED=false
+CHANGE_DECLARED=true
 RESULT_CONTRACT_VALID=true
-RESULT_CONTRACT_STATUS=NOT_APPLICABLE
+RESULT_CONTRACT_STATUS=OK
 RESULT_CONTRACT_ERROR=NONE
 COMMAND_RC=0
 CHANGES_MADE=false
@@ -24,416 +24,40 @@ MUTATION_OUTCOME=NO_MUTATION
 SANITIZED=yes
 SECRETS_INCLUDED=no
 PRIVATE_ADDRESSES_INCLUDED=no
-RAW_EVIDENCE_SHA256=17eb3c30f0b452dca55cba4d33e06205714ba648378996a1ae318bf0662aeb42
-SANITIZED_OUTPUT_SHA256=17eb3c30f0b452dca55cba4d33e06205714ba648378996a1ae318bf0662aeb42
+RAW_EVIDENCE_SHA256=db13236deb4e488789bfa79f9da14522d2a458330c8a70229e6879ff981a1bb5
+SANITIZED_OUTPUT_SHA256=db13236deb4e488789bfa79f9da14522d2a458330c8a70229e6879ff981a1bb5
 OUTPUT_BEGIN
-HOME_GRAM1_HTTP403_TOPOLOGY_RCA=V1
-NO_MAIL_SEND=true
-NO_SERVICE_RESTART=true
-NO_TIMER_MUTATION=true
-NO_NETWORK_MUTATION=true
-NO_SOURCE_MUTATION=true
-NO_DNS_MUTATION=true
-NO_PROXY_MUTATION=true
-NO_CONTAINER_MUTATION=true
-MODE=read-only
+SNIKKET_FRESH_BACKUP_RESTORE_PROOF_WRAPPER=V1
 HOST_PVE01=true
-HTTPS_CURL_RC=0
-HTTPS_HTTP_STATUS=200
-HTTPS_CONTENT_TYPE=text/html; charset=utf-8
-HTTPS_CONTENT_LENGTH=71651
-HTTPS_BODY_BYTES=71651
-HTTPS_BODY_SHA=dfac996d8d5743682137e74e417866dd905f6c3ee3a6511c1342ccf2b5fe060b
-HTTPS_BODY_HAS_FORBIDDEN=false
-HTTPS_BODY_HAS_CLOUDFLARE=true
-HTTPS_BODY_HAS_HOMEPAGE=true
-HTTPS_BODY_HAS_HOMARR=false
-HTTPS_BODY_HAS_NGINX=true
-HTTPS_BODY_HAS_CADDY=true
-HTTPS_BODY_HAS_TRAEFIK=true
-HTTPS_BODY_HAS_HOST_VALIDATION=false
-HTTPS_BODY_HAS_ALLOWED_HOSTS=false
-HTTPS_BODY_HAS_INVALID_HOST=false
-HTTPS_TITLE=Homelab
-HTTP_CURL_RC=0
-HTTP_HTTP_STATUS=301
-HTTP_CONTENT_TYPE=text/html
-HTTP_CONTENT_LENGTH=140
-HTTP_LOCATION=https://home.gram1.ru/
-HTTP_BODY_BYTES=133
-HTTP_BODY_SHA=33405a226a7a7c73d67c73cf635296a9b11b95b6f9fb0dc83e43f9ad47ef09e7
-HTTP_BODY_HAS_FORBIDDEN=false
-HTTP_BODY_HAS_CLOUDFLARE=false
-HTTP_BODY_HAS_HOMEPAGE=false
-HTTP_BODY_HAS_HOMARR=false
-HTTP_BODY_HAS_NGINX=false
-HTTP_BODY_HAS_CADDY=false
-HTTP_BODY_HAS_TRAEFIK=false
-HTTP_BODY_HAS_HOST_VALIDATION=false
-HTTP_BODY_HAS_ALLOWED_HOSTS=false
-HTTP_BODY_HAS_INVALID_HOST=false
-HTTP_TITLE=301 Moved Permanently
-DNS_ADDRESS_COUNT=1
-DNS_1_CLASS=private
-DNS_1_SHA=bc517b4af3298846906234d3d697d3820b0b652ade1880c937c9d71cd802c834
-TLS_RC=0
-TLS_SUBJECT=CN=home.gram1.ru
-TLS_ISSUER=C=US, O=Let's Encrypt, CN=YE2
-TLS_NOTBEFORE=Aug 14 16:08:49 2026 GMT
-TLS_NOTAFTER=Nov 12 16:08:48 2026 GMT
-TLS_SAN_HAS_DOMAIN=true
-GIT_REPO_COUNT=44
-REPO_MATCH_1_REPO_SHA=58c56c4f28c229efb3ca4d09891e4070e176e047f78342121c8b9ce639a4291a
-REPO_MATCH_1_PATH=kb/private/archive/2026-08-19/docs/03_SERVICE_CATALOG.md
-REPO_MATCH_1_PATTERN=homepage
-REPO_MATCH_1_LINE=kb/private/archive/2026-08-19/docs/03_SERVICE_CATALOG.md:154:- `homepage` — `ghcr.io/gethomepage/homepage:latest` — Up 2 weeks (healthy) — `[PRIVATE_IP]:3000->3000/tcp`
-REPO_MATCH_2_REPO_SHA=58c56c4f28c229efb3ca4d09891e4070e176e047f78342121c8b9ce639a4291a
-REPO_MATCH_2_PATH=kb/private/archive/2026-08-19/machine/cluster_inventory.json
-REPO_MATCH_2_PATTERN=homepage
-REPO_MATCH_2_LINE=kb/private/archive/2026-08-19/machine/cluster_inventory.json:1396:          "name": "homepage",
-REPO_MATCH_3_REPO_SHA=58c56c4f28c229efb3ca4d09891e4070e176e047f78342121c8b9ce639a4291a
-REPO_MATCH_3_PATH=kb/private/archive/2026-08-19/machine/cluster_inventory.json
-REPO_MATCH_3_PATTERN=homepage
-REPO_MATCH_3_LINE=kb/private/archive/2026-08-19/machine/cluster_inventory.json:1397:          "image": "ghcr.io/gethomepage/homepage:latest",
-REPO_MATCH_4_REPO_SHA=2a829b2765d95641aac83ee239582027e35fb801358950022c180f08f6b3d9bb
-REPO_MATCH_4_PATH=kb/private/archive/2026-08-19/docs/03_SERVICE_CATALOG.md
-REPO_MATCH_4_PATTERN=homepage
-REPO_MATCH_4_LINE=kb/private/archive/2026-08-19/docs/03_SERVICE_CATALOG.md:154:- `homepage` — `ghcr.io/gethomepage/homepage:latest` — Up 2 weeks (healthy) — `[PRIVATE_IP]:3000->3000/tcp`
-REPO_MATCH_5_REPO_SHA=2a829b2765d95641aac83ee239582027e35fb801358950022c180f08f6b3d9bb
-REPO_MATCH_5_PATH=kb/private/archive/2026-08-19/machine/cluster_inventory.json
-REPO_MATCH_5_PATTERN=homepage
-REPO_MATCH_5_LINE=kb/private/archive/2026-08-19/machine/cluster_inventory.json:1396:          "name": "homepage",
-REPO_MATCH_6_REPO_SHA=2a829b2765d95641aac83ee239582027e35fb801358950022c180f08f6b3d9bb
-REPO_MATCH_6_PATH=kb/private/archive/2026-08-19/machine/cluster_inventory.json
-REPO_MATCH_6_PATTERN=homepage
-REPO_MATCH_6_LINE=kb/private/archive/2026-08-19/machine/cluster_inventory.json:1397:          "image": "ghcr.io/gethomepage/homepage:latest",
-REPO_MATCH_7_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
-REPO_MATCH_7_PATH=README.md
-REPO_MATCH_7_PATTERN=home.gram1.ru
-REPO_MATCH_7_LINE=README.md:9:- Homepage: https://home.gram1.ru
-REPO_MATCH_8_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
-REPO_MATCH_8_PATH=README.md
-REPO_MATCH_8_PATTERN=home.gram1.ru
-REPO_MATCH_8_LINE=README.md:53:- https://home.gram1.ru
-REPO_MATCH_9_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
-REPO_MATCH_9_PATH=configs/sanitized/edge-vm/homepage-compose.yaml
-REPO_MATCH_9_PATTERN=home.gram1.ru
-REPO_MATCH_9_LINE=configs/sanitized/edge-vm/homepage-compose.yaml:9:      HOMEPAGE_ALLOWED_HOSTS: home.gram1.ru,homepage.vpn.gram1.ru
-REPO_MATCH_10_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
-REPO_MATCH_10_PATH=configs/sanitized/edge-vm/homepage-services.yaml
-REPO_MATCH_10_PATTERN=home.gram1.ru
-REPO_MATCH_10_LINE=configs/sanitized/edge-vm/homepage-services.yaml:3:      href: https://home.gram1.ru
-REPO_MATCH_11_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
-REPO_MATCH_11_PATH=docs/05-service-catalog.md
-REPO_MATCH_11_PATTERN=home.gram1.ru
-REPO_MATCH_11_LINE=docs/05-service-catalog.md:67:- Domain: https://home.gram1.ru
-REPO_MATCH_12_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
-REPO_MATCH_12_PATH=docs/06-certificates-troubleshooting.md
-REPO_MATCH_12_PATTERN=home.gram1.ru
-REPO_MATCH_12_LINE=docs/06-certificates-troubleshooting.md:62:Observed with home.gram1.ru and git.gram1.ru before certificate completion.
-REPO_MATCH_13_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
-REPO_MATCH_13_PATH=docs/06-certificates-troubleshooting.md
-REPO_MATCH_13_PATTERN=home.gram1.ru
-REPO_MATCH_13_LINE=docs/06-certificates-troubleshooting.md:96:- home.gram1.ru: Lets Encrypt via Cloudflare DNS challenge.
-REPO_MATCH_14_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
-REPO_MATCH_14_PATH=docs/99-current-state-summary.md
-REPO_MATCH_14_PATTERN=home.gram1.ru
-REPO_MATCH_14_LINE=docs/99-current-state-summary.md:113:- URL: https://home.gram1.ru
-REPO_MATCH_15_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
-REPO_MATCH_15_PATH=docs/99-current-state-summary.md
-REPO_MATCH_15_PATTERN=home.gram1.ru
-REPO_MATCH_15_LINE=docs/99-current-state-summary.md:147:- https://home.gram1.ru
-REPO_MATCH_16_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
-REPO_MATCH_16_PATH=docs/operations/p0-healthchecks-restore-proof-preflight-20260624T190801Z.md
-REPO_MATCH_16_PATTERN=home.gram1.ru
-REPO_MATCH_16_LINE=docs/operations/p0-healthchecks-restore-proof-preflight-20260624T190801Z.md:65:id=16 active=1 interval=300 type=http name=Homepage HTTPS target=https://home.gram1.ru
-REPO_MATCH_17_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
-REPO_MATCH_17_PATH=docs/operations/p0-restore-drill-matrix-edge-index-20260624T183747Z.md
-REPO_MATCH_17_PATTERN=home.gram1.ru
-REPO_MATCH_17_LINE=docs/operations/p0-restore-drill-matrix-edge-index-20260624T183747Z.md:112:id=16 active=1 interval=300 type=http name=Homepage HTTPS target=https://home.gram1.ru
-REPO_MATCH_18_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
-REPO_MATCH_18_PATH=docs/operations/p0-restore-drill-matrix-quality-offhost-20260624T183931Z.md
-REPO_MATCH_18_PATTERN=home.gram1.ru
-REPO_MATCH_18_LINE=docs/operations/p0-restore-drill-matrix-quality-offhost-20260624T183931Z.md:126:id=16 active=1 interval=300 type=http name=Homepage HTTPS target=https://home.gram1.ru
-REPO_MATCH_19_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
-REPO_MATCH_19_PATH=docs/operations/p0-vikunja-restore-proof-preflight-20260624T191408Z.md
-REPO_MATCH_19_PATTERN=home.gram1.ru
-REPO_MATCH_19_LINE=docs/operations/p0-vikunja-restore-proof-preflight-20260624T191408Z.md:63:id=16 active=1 interval=300 type=http name=Homepage HTTPS target=https://home.gram1.ru
-REPO_MATCH_20_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
-REPO_MATCH_20_PATH=docs/operations/p1-exposure-matrix-npmplus-route-inventory-20260625T212426Z.json
-REPO_MATCH_20_PATTERN=home.gram1.ru
-REPO_MATCH_20_LINE=docs/operations/p1-exposure-matrix-npmplus-route-inventory-20260625T212426Z.json:123:        "home.gram1.ru"
-REPO_MATCH_21_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
-REPO_MATCH_21_PATH=docs/operations/p1-exposure-matrix-npmplus-route-inventory-20260625T212426Z.md
-REPO_MATCH_21_PATTERN=home.gram1.ru
-REPO_MATCH_21_LINE=docs/operations/p1-exposure-matrix-npmplus-route-inventory-20260625T212426Z.md:34:| 8 | public_or_unknown | home.gram1.ru | yes | http | [PRIVATE_IP]:3000 | present | 8 |
-REPO_MATCH_22_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
-REPO_MATCH_22_PATH=docs/operations/p1-exposure-ownership-matrix-20260625T212704Z.json
-REPO_MATCH_22_PATTERN=home.gram1.ru
-REPO_MATCH_22_LINE=docs/operations/p1-exposure-ownership-matrix-20260625T212704Z.json:103:      "domain": "home.gram1.ru",
-REPO_MATCH_23_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
-REPO_MATCH_23_PATH=docs/operations/p1-exposure-ownership-matrix-20260625T212704Z.json
-REPO_MATCH_23_PATTERN=home.gram1.ru
-REPO_MATCH_23_LINE=docs/operations/p1-exposure-ownership-matrix-20260625T212704Z.json:105:        "home.gram1.ru"
-REPO_MATCH_24_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
-REPO_MATCH_24_PATH=docs/operations/p1-exposure-ownership-matrix-20260625T212704Z.md
-REPO_MATCH_24_PATTERN=home.gram1.ru
-REPO_MATCH_24_LINE=docs/operations/p1-exposure-ownership-matrix-20260625T212704Z.md:39:| 8 | home.gram1.ru | public-domain | homepage | edge-local | http://[PRIVATE_IP]:3000 | yes | present | OK_PUBLIC_INTENTIONAL | keep_monitoring |
-REPO_MATCH_25_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
-REPO_MATCH_25_PATH=docs/operations/p2-dependency-risk-classification-20260625T221747Z.json
-REPO_MATCH_25_PATTERN=home.gram1.ru
-REPO_MATCH_25_LINE=docs/operations/p2-dependency-risk-classification-20260625T221747Z.json:905:      "domain": "home.gram1.ru",
-REPO_MATCH_26_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
-REPO_MATCH_26_PATH=docs/operations/p2-dependency-risk-classification-20260625T221747Z.md
-REPO_MATCH_26_PATTERN=home.gram1.ru
-REPO_MATCH_26_LINE=docs/operations/p2-dependency-risk-classification-20260625T221747Z.md:68:| 8 | home.gram1.ru | http://[PRIVATE_IP]:3000 | homepage | PUBLIC_OR_UNKNOWN_ROUTE, ACCESS_HINT_REVIEW |
-REPO_MATCH_27_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
-REPO_MATCH_27_PATH=docs/operations/p2-service-dependency-graph-20260625T221552Z.json
-REPO_MATCH_27_PATTERN=home.gram1.ru
-REPO_MATCH_27_LINE=docs/operations/p2-service-dependency-graph-20260625T221552Z.json:1278:      "domain": "home.gram1.ru",
-REPO_MATCH_28_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
-REPO_MATCH_28_PATH=docs/operations/p2-service-dependency-graph-20260625T221552Z.json
-REPO_MATCH_28_PATTERN=home.gram1.ru
-REPO_MATCH_28_LINE=docs/operations/p2-service-dependency-graph-20260625T221552Z.json:1870:        "home.gram1.ru",
-REPO_MATCH_29_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
-REPO_MATCH_29_PATH=docs/operations/p2-service-dependency-graph-20260625T221552Z.md
-REPO_MATCH_29_PATTERN=home.gram1.ru
-REPO_MATCH_29_LINE=docs/operations/p2-service-dependency-graph-20260625T221552Z.md:112:| homepage | homepage | home.gram1.ru, homepage.vpn.gram1.ru |
-REPO_MATCH_30_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
-REPO_MATCH_30_PATH=docs/operations/postp1-fix-inputs-npm-sops-inspect-20260624T182227Z.md
-REPO_MATCH_30_PATTERN=home.gram1.ru
-REPO_MATCH_30_LINE=docs/operations/postp1-fix-inputs-npm-sops-inspect-20260624T182227Z.md:200:8	1	27	1	["home.gram1.ru"]	[PRIVATE_IP]	3000
-REPO_MATCH_31_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
-REPO_MATCH_31_PATH=docs/service-url-catalog.md
-REPO_MATCH_31_PATTERN=home.gram1.ru
-REPO_MATCH_31_LINE=docs/service-url-catalog.md:16:| home.gram1.ru | http://[PRIVATE_IP]:3000 | yes | LAN only | home.gram1.ru | enabled |
-REPO_MATCH_32_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
-REPO_MATCH_32_PATH=docs/service-url-catalog.md
-REPO_MATCH_32_PATTERN=home.gram1.ru
-REPO_MATCH_32_LINE=docs/service-url-catalog.md:48:| home.gram1.ru | letsencrypt | 2026-09-13 16:43:44 |
-REPO_MATCH_33_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
-REPO_MATCH_33_PATH=docs/service-url-catalog.md
-REPO_MATCH_33_PATTERN=home.gram1.ru
-REPO_MATCH_33_LINE=docs/service-url-catalog.md:75:| `home.gram1.ru` | `http://[PRIVATE_IP]:3000` | cert id 27 | yes | Homepage |
-REPO_MATCH_34_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
-REPO_MATCH_34_PATH=evidence/p0-restore-drill-20260624T122122Z/edge-health-redacted.txt
-REPO_MATCH_34_PATTERN=home.gram1.ru
-REPO_MATCH_34_LINE=evidence/p0-restore-drill-20260624T122122Z/edge-health-redacted.txt:34:id=16 active=1 interval=300 type=http name=Homepage HTTPS target=https://home.gram1.ru
-REPO_MATCH_35_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
-REPO_MATCH_35_PATH=inventory/domains.csv
-REPO_MATCH_35_PATTERN=home.gram1.ru
-REPO_MATCH_35_LINE=inventory/domains.csv:5:home.gram1.ru,[PRIVATE_IP],[PRIVATE_IP],http://[PRIVATE_IP]:3000,LAN-only,cloudflare-dns-challenge
-REPO_MATCH_36_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
-REPO_MATCH_36_PATH=inventory/ports.md
-REPO_MATCH_36_PATTERN=home.gram1.ru
-REPO_MATCH_36_LINE=inventory/ports.md:42:| Homepage | [PRIVATE_IP]:3000 | https://home.gram1.ru |
-REPO_MATCH_37_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
-REPO_MATCH_37_PATH=configs/sanitized/edge-vm/homepage-compose.yaml
-REPO_MATCH_37_PATTERN=HOMEPAGE_ALLOWED_HOSTS
-REPO_MATCH_37_LINE=configs/sanitized/edge-vm/homepage-compose.yaml:9:      HOMEPAGE_ALLOWED_HOSTS: home.gram1.ru,homepage.vpn.gram1.ru
-REPO_MATCH_38_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
-REPO_MATCH_38_PATH=baselines/README.md
-REPO_MATCH_38_PATTERN=homepage
-REPO_MATCH_38_LINE=baselines/README.md:14:- `/root/homepage-post-install-baseline-20260615T145851Z.tar.gz`
-REPO_MATCH_39_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
-REPO_MATCH_39_PATH=configs/sanitized/edge-vm/homepage-compose.yaml
-REPO_MATCH_39_PATTERN=homepage
-REPO_MATCH_39_LINE=configs/sanitized/edge-vm/homepage-compose.yaml:2:  homepage:
-REPO_MATCH_40_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
-REPO_MATCH_40_PATH=configs/sanitized/edge-vm/homepage-compose.yaml
-REPO_MATCH_40_PATTERN=homepage
-REPO_MATCH_40_LINE=configs/sanitized/edge-vm/homepage-compose.yaml:3:    image: ghcr.io/gethomepage/homepage:latest
-REPO_MATCH_41_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
-REPO_MATCH_41_PATH=configs/sanitized/edge-vm/homepage-compose.yaml
-REPO_MATCH_41_PATTERN=homepage
-REPO_MATCH_41_LINE=configs/sanitized/edge-vm/homepage-compose.yaml:4:    container_name: homepage
-REPO_MATCH_42_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
-REPO_MATCH_42_PATH=configs/sanitized/edge-vm/homepage-compose.yaml
-REPO_MATCH_42_PATTERN=homepage
-REPO_MATCH_42_LINE=configs/sanitized/edge-vm/homepage-compose.yaml:9:      HOMEPAGE_ALLOWED_HOSTS: home.gram1.ru,homepage.vpn.gram1.ru
-REPO_MATCH_43_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
-REPO_MATCH_43_PATH=configs/sanitized/edge-vm/homepage-services.yaml
-REPO_MATCH_43_PATTERN=homepage
-REPO_MATCH_43_LINE=configs/sanitized/edge-vm/homepage-services.yaml:5:      icon: homepage.png
-REPO_MATCH_44_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
-REPO_MATCH_44_PATH=configs/sanitized/edge-vm/homepage-services.yaml
-REPO_MATCH_44_PATTERN=homepage
-REPO_MATCH_44_LINE=configs/sanitized/edge-vm/homepage-services.yaml:7:      href: https://homepage.vpn.gram1.ru
-REPO_MATCH_45_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
-REPO_MATCH_45_PATH=configs/sanitized/edge-vm/homepage-services.yaml
-REPO_MATCH_45_PATTERN=homepage
-REPO_MATCH_45_LINE=configs/sanitized/edge-vm/homepage-services.yaml:9:      icon: homepage.png
-REPO_MATCH_46_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
-REPO_MATCH_46_PATH=docs/03-proxmox-layout.md
-REPO_MATCH_46_PATTERN=homepage
-REPO_MATCH_46_LINE=docs/03-proxmox-layout.md:53:- homepage
-REPO_MATCH_47_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
-REPO_MATCH_47_PATH=docs/05-service-catalog.md
-REPO_MATCH_47_PATTERN=homepage
-REPO_MATCH_47_LINE=docs/05-service-catalog.md:64:- Compose path: /opt/stacks/homepage/compose.yaml
-REPO_MATCH_48_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
-REPO_MATCH_48_PATH=docs/05-service-catalog.md
-REPO_MATCH_48_PATTERN=homepage
-REPO_MATCH_48_LINE=docs/05-service-catalog.md:65:- Config path: /opt/stacks/homepage/config
-REPO_MATCH_49_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
-REPO_MATCH_49_PATH=docs/99-current-state-summary.md
-REPO_MATCH_49_PATTERN=homepage
-REPO_MATCH_49_LINE=docs/99-current-state-summary.md:114:- Config path: /opt/stacks/homepage/config
-REPO_MATCH_50_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
-REPO_MATCH_50_PATH=docs/99-current-state-summary.md
-REPO_MATCH_50_PATTERN=homepage
-REPO_MATCH_50_LINE=docs/99-current-state-summary.md:441:- `filebrowser, gitea, homebox, homepage, karakeep-chrome, karakeep-meilisearch, minio, node-exporter, prometheus`
-REPO_MATCH_51_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
-REPO_MATCH_51_PATH=docs/99-current-state-summary.md
-REPO_MATCH_51_PATTERN=homepage
-REPO_MATCH_51_LINE=docs/99-current-state-summary.md:2333:- `homepage.vpn.gram1.ru`: HTTP `200`
-REPO_MATCH_52_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
-REPO_MATCH_52_PATH=docs/ERRORS-LESSONS-20260618.md
-REPO_MATCH_52_PATTERN=homepage
-REPO_MATCH_52_LINE=docs/ERRORS-LESSONS-20260618.md:61:Correct value: only https://homepage.vpn.gram1.ru.
-REPO_MATCH_53_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
-REPO_MATCH_53_PATH=docs/ERRORS-LESSONS-20260618.md
-REPO_MATCH_53_PATTERN=homepage
-REPO_MATCH_53_LINE=docs/ERRORS-LESSONS-20260618.md:90:Cause: command authentik_homepage_application_cli_created returned SSH_RC=0 but produced no expected stdout, so local verification could not confirm provider/application state.
-REPO_MATCH_54_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
-REPO_MATCH_54_PATH=docs/ERRORS-LESSONS-20260618.md
-REPO_MATCH_54_PATTERN=homepage
-REPO_MATCH_54_LINE=docs/ERRORS-LESSONS-20260618.md:108:Correction: use local direct Authentik outpost checks with homepage.vpn.gram1.ru forwarded headers before enabling NPMplus auth. Do not require the public auth.vpn outpost auth endpoint to match the Homepage provider.
-REPO_MATCH_55_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
-REPO_MATCH_55_PATH=docs/HANDOFF-20260618-authentik-npmplus.md
-REPO_MATCH_55_PATTERN=homepage
-REPO_MATCH_55_LINE=docs/HANDOFF-20260618-authentik-npmplus.md:11:homepage.vpn.gram1.ru    proxy id 17 cert id 32 access 1 ssl forced
-REPO_MATCH_56_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
-REPO_MATCH_56_PATH=docs/HANDOFF-20260618-authentik-npmplus.md
-REPO_MATCH_56_PATTERN=homepage
-REPO_MATCH_56_LINE=docs/HANDOFF-20260618-authentik-npmplus.md:31:Slug or Identifier: homepage-vpn
-REPO_MATCH_57_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
-REPO_MATCH_57_PATH=docs/HANDOFF-20260618-authentik-npmplus.md
-REPO_MATCH_57_PATTERN=homepage
-REPO_MATCH_57_LINE=docs/HANDOFF-20260618-authentik-npmplus.md:33:Launch URL: https://homepage.vpn.gram1.ru
-REPO_MATCH_58_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
-REPO_MATCH_58_PATH=docs/HANDOFF-20260618-authentik-npmplus.md
-REPO_MATCH_58_PATTERN=homepage
-REPO_MATCH_58_LINE=docs/HANDOFF-20260618-authentik-npmplus.md:34:Provider: homepage-vpn-forward-auth
-REPO_MATCH_59_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
-REPO_MATCH_59_PATH=docs/HANDOFF-20260618-authentik-npmplus.md
-REPO_MATCH_59_PATTERN=homepage
-REPO_MATCH_59_LINE=docs/HANDOFF-20260618-authentik-npmplus.md:42:Only after provider and outpost verification, enable npmplus_auth_request authentik for homepage.vpn.gram1.ru. Keep rollback ready by setting it back to none.
-REPO_MATCH_60_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
-REPO_MATCH_60_PATH=docs/HANDOFF-20260618-authentik-npmplus.md
-REPO_MATCH_60_PATTERN=homepage
-REPO_MATCH_60_LINE=docs/HANDOFF-20260618-authentik-npmplus.md:54:The public check through auth.vpn.gram1.ru returned 404 for /outpost.goauthentik.io/auth/nginx, while the local direct outpost check for homepage.vpn.gram1.ru returned a valid auth response. Treat the public auth.vpn auth endpoint as a wrong validation path for Homepage. Next safe step: enable npmplus_auth_request=authentik only for homepage proxy id 17 with rollback ready.
-REPO_MATCH_61_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
-REPO_MATCH_61_PATH=docs/HANDOFF-20260618-authentik-npmplus.md
-REPO_MATCH_61_PATTERN=homepage
-REPO_MATCH_61_LINE=docs/HANDOFF-20260618-authentik-npmplus.md:73:host: homepage.vpn.gram1.ru
-REPO_MATCH_62_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
-REPO_MATCH_62_PATH=docs/RUNBOOK-PRIVATE-VPN-HOSTS-20260618.md
-REPO_MATCH_62_PATTERN=homepage
-REPO_MATCH_62_LINE=docs/RUNBOOK-PRIVATE-VPN-HOSTS-20260618.md:22:homepage.vpn.gram1.ru    -> [PRIVATE_IP] -> NPMplus -> [PRIVATE_IP]:3000
-REPO_MATCH_63_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
-REPO_MATCH_63_PATH=docs/RUNBOOK-PRIVATE-VPN-HOSTS-20260618.md
-REPO_MATCH_63_PATTERN=homepage
-REPO_MATCH_63_LINE=docs/RUNBOOK-PRIVATE-VPN-HOSTS-20260618.md:55:EDGE_HOST=edge-vm;DOCKER_IMAGES=actual-budget=actualbudget/actual-server:latest;authentik-postgresql-1=postgres:16-alpine;authentik-server-1=ghcr.io/goauthentik/server:2026.5.3;authentik-worker-1=ghcr.io/goauthentik/server:2026.5.3;beszel=henrygd/beszel:latest;crowdsec=crowdsecurity/crowdsec:latest;dockge=louislam/dockge:1;dozzle=amir20/dozzle:latest;filebrowser=filebrowser/filebrowser:latest;gitea=docker.gitea.com/gitea:1.26.2;gotify=gotify/server:latest;grafana=grafana/grafana:latest;homeassistant=ghcr.io/home-assistant/home-assistant:stable;homebox=ghcr.io/sysadminsmedia/homebox:latest-rootless;homepage=ghcr.io/gethomepage/homepage:latest;immi
-REPO_MATCH_64_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
-REPO_MATCH_64_PATH=docs/SERVICES-BOOTSTRAP-20260617.md
-REPO_MATCH_64_PATTERN=homepage
-REPO_MATCH_64_LINE=docs/SERVICES-BOOTSTRAP-20260617.md:15:STACKS=/opt/stacks/ntfy;/opt/stacks/filebrowser;/opt/stacks/searxng;/opt/stacks/mealie;/opt/stacks/homeassistant;/opt/stacks/homebox;/opt/stacks/it-tools;/opt/stacks/minio;/opt/stacks/crowdsec;/opt/stacks/linkding;/opt/stacks/observability-lite;/opt/stacks/gitea;/opt/stacks/memos;/opt/stacks/node-red;/opt/stacks/paperless;/opt/stacks/karakeep;/opt/stacks/beszel;/opt/stacks/actual-budget;/opt/stacks/dozzle;/opt/stacks/homepage;/opt/stacks/syncthing;/opt/stacks/n8n;
-REPO_MATCH_65_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
-REPO_MATCH_65_PATH=docs/SERVICES-BOOTSTRAP-20260617.md
-REPO_MATCH_65_PATTERN=homepage
-REPO_MATCH_65_LINE=docs/SERVICES-BOOTSTRAP-20260617.md:16:CONTAINERS=actual-budget|actualbudget/actual-server:latest|Up 11 hours|[PRIVATE_IP]:5006->5006/tcp;[redacted] 36 hours (healthy)|5432/tcp;[redacted] 36 hours (healthy)|[PRIVATE_IP]:9000->9000/tcp, [PRIVATE_IP]:9443->9443/tcp;[redacted] 36 hours (healthy)|;beszel|henrygd/beszel:latest|Up 12 hours|[PRIVATE_IP]:8090->8090/tcp;crowdsec|crowdsecurity/crowdsec:latest|Up 11 hours|;dockge|louislam/dockge:1|Up 36 hours (healthy)|[PRIVATE_IP]:5001->5001/tcp;dozzle|amir20/dozzle:latest|Up 36 hours|[PRIVATE_IP]:9999->8080/tcp;filebrowser|filebrowser/filebrowser:latest|Up 10 hours (healthy)|[PRIVATE_IP]:8085->80/tcp;gitea|docker.gitea.com/gitea:1.26.2|Up 36 hours|22
-REPO_MATCH_66_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
-REPO_MATCH_66_PATH=docs/SERVICES-BOOTSTRAP-20260617.md
-REPO_MATCH_66_PATTERN=homepage
-REPO_MATCH_66_LINE=docs/SERVICES-BOOTSTRAP-20260617.md:208:homepage.vpn.gram1.ru    -> [PRIVATE_IP] -> [PRIVATE_IP]:3000
-REPO_MATCH_67_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
-REPO_MATCH_67_PATH=docs/SERVICES-BOOTSTRAP-20260617.md
-REPO_MATCH_67_PATTERN=homepage
-REPO_MATCH_67_LINE=docs/SERVICES-BOOTSTRAP-20260617.md:216:BINDING=      - NPM_IPV4_BINDING=[PRIVATE_IP];      - IPV4_BINDING=[PRIVATE_IP];;ACCESS=5|access_list_id=1|address=[PRIVATE_IP]/24|directive=allow;6|access_list_id=1|address=[PRIVATE_IP]/24|directive=allow;7|access_list_id=1|address=[PRIVATE_IP]/16|directive=allow;8|access_list_id=1|address=[PRIVATE_IP]/16|directive=allow;;PROXIES=16|["kuma.vpn.gram1.ru"]|forward=http://[PRIVATE_IP]:3001|cert=32|access=1|enabled=1|ssl_forced=1|hsts=0;17|["homepage.vpn.gram1.ru"]|forward=http://[PRIVATE_IP]:3000|cert=32|access=1|enabled=1|ssl_forced=1|hsts=0;18|["gitea.vpn.gram1.ru"]|forward=http://[PRIVATE_IP]:3002|cert=32|access=1|enabled=1|ssl_forced=1|hsts=0;19|["fi
-REPO_MATCH_68_REPO_SHA=b3bd020ee5e776df415b94aee9451ce762c9c91c320a7e6502cf0c1435363c7f
-REPO_MATCH_68_PATH=kb/private/archive/2026-08-19/docs/03_SERVICE_CATALOG.md
-REPO_MATCH_68_PATTERN=homepage
-REPO_MATCH_68_LINE=kb/private/archive/2026-08-19/docs/03_SERVICE_CATALOG.md:154:- `homepage` — `ghcr.io/gethomepage/homepage:latest` — Up 2 weeks (healthy) — `[PRIVATE_IP]:3000->3000/tcp`
-REPO_MATCH_69_REPO_SHA=b3bd020ee5e776df415b94aee9451ce762c9c91c320a7e6502cf0c1435363c7f
-REPO_MATCH_69_PATH=kb/private/archive/2026-08-19/machine/cluster_inventory.json
-REPO_MATCH_69_PATTERN=homepage
-REPO_MATCH_69_LINE=kb/private/archive/2026-08-19/machine/cluster_inventory.json:1396:          "name": "homepage",
-REPO_MATCH_70_REPO_SHA=b3bd020ee5e776df415b94aee9451ce762c9c91c320a7e6502cf0c1435363c7f
-REPO_MATCH_70_PATH=kb/private/archive/2026-08-19/machine/cluster_inventory.json
-REPO_MATCH_70_PATTERN=homepage
-REPO_MATCH_70_LINE=kb/private/archive/2026-08-19/machine/cluster_inventory.json:1397:          "image": "ghcr.io/gethomepage/homepage:latest",
-REPO_MATCH_71_REPO_SHA=43edb8c759a325850dc949c70678f7d00db21eee7cd62c8909cea8281531314d
-REPO_MATCH_71_PATH=kb/private/archive/2026-08-19/docs/03_SERVICE_CATALOG.md
-REPO_MATCH_71_PATTERN=homepage
-REPO_MATCH_71_LINE=kb/private/archive/2026-08-19/docs/03_SERVICE_CATALOG.md:154:- `homepage` — `ghcr.io/gethomepage/homepage:latest` — Up 2 weeks (healthy) — `[PRIVATE_IP]:3000->3000/tcp`
-REPO_MATCH_72_REPO_SHA=43edb8c759a325850dc949c70678f7d00db21eee7cd62c8909cea8281531314d
-REPO_MATCH_72_PATH=kb/private/archive/2026-08-19/machine/cluster_inventory.json
-REPO_MATCH_72_PATTERN=homepage
-REPO_MATCH_72_LINE=kb/private/archive/2026-08-19/machine/cluster_inventory.json:1396:          "name": "homepage",
-REPO_MATCH_73_REPO_SHA=43edb8c759a325850dc949c70678f7d00db21eee7cd62c8909cea8281531314d
-REPO_MATCH_73_PATH=kb/private/archive/2026-08-19/machine/cluster_inventory.json
-REPO_MATCH_73_PATTERN=homepage
-REPO_MATCH_73_LINE=kb/private/archive/2026-08-19/machine/cluster_inventory.json:1397:          "image": "ghcr.io/gethomepage/homepage:latest",
-REPO_MATCH_74_REPO_SHA=23273fcc8384fcaaa64503e3daf9d2ad455c5be24d496dbd4d82bb7bf67f489d
-REPO_MATCH_74_PATH=kb/private/archive/2026-08-19/docs/03_SERVICE_CATALOG.md
-REPO_MATCH_74_PATTERN=homepage
-REPO_MATCH_74_LINE=kb/private/archive/2026-08-19/docs/03_SERVICE_CATALOG.md:154:- `homepage` — `ghcr.io/gethomepage/homepage:latest` — Up 2 weeks (healthy) — `[PRIVATE_IP]:3000->3000/tcp`
-REPO_MATCH_75_REPO_SHA=23273fcc8384fcaaa64503e3daf9d2ad455c5be24d496dbd4d82bb7bf67f489d
-REPO_MATCH_75_PATH=kb/private/archive/2026-08-19/machine/cluster_inventory.json
-REPO_MATCH_75_PATTERN=homepage
-REPO_MATCH_75_LINE=kb/private/archive/2026-08-19/machine/cluster_inventory.json:1396:          "name": "homepage",
-REPO_MATCH_76_REPO_SHA=23273fcc8384fcaaa64503e3daf9d2ad455c5be24d496dbd4d82bb7bf67f489d
-REPO_MATCH_76_PATH=kb/private/archive/2026-08-19/machine/cluster_inventory.json
-REPO_MATCH_76_PATTERN=homepage
-REPO_MATCH_76_LINE=kb/private/archive/2026-08-19/machine/cluster_inventory.json:1397:          "image": "ghcr.io/gethomepage/homepage:latest",
-REPO_MATCH_77_REPO_SHA=01acf10171d1463b5d9692c69ca3ae04684a26fe7afd5716891c325e80e771bc
-REPO_MATCH_77_PATH=kb/private/archive/2026-08-19/docs/03_SERVICE_CATALOG.md
-REPO_MATCH_77_PATTERN=homepage
-REPO_MATCH_77_LINE=kb/private/archive/2026-08-19/docs/03_SERVICE_CATALOG.md:154:- `homepage` — `ghcr.io/gethomepage/homepage:latest` — Up 2 weeks (healthy) — `[PRIVATE_IP]:3000->3000/tcp`
-REPO_MATCH_78_REPO_SHA=01acf10171d1463b5d9692c69ca3ae04684a26fe7afd5716891c325e80e771bc
-REPO_MATCH_78_PATH=kb/private/archive/2026-08-19/machine/cluster_inventory.json
-REPO_MATCH_78_PATTERN=homepage
-REPO_MATCH_78_LINE=kb/private/archive/2026-08-19/machine/cluster_inventory.json:1396:          "name": "homepage",
-REPO_MATCH_79_REPO_SHA=01acf10171d1463b5d9692c69ca3ae04684a26fe7afd5716891c325e80e771bc
-REPO_MATCH_79_PATH=kb/private/archive/2026-08-19/machine/cluster_inventory.json
-REPO_MATCH_79_PATTERN=homepage
-REPO_MATCH_79_LINE=kb/private/archive/2026-08-19/machine/cluster_inventory.json:1397:          "image": "ghcr.io/gethomepage/homepage:latest",
-REPO_MATCH_80_REPO_SHA=6a5d39387f04765b96e1ce0ad8b812560f60db0fdb2f8202d25647714ce7ef81
-REPO_MATCH_80_PATH=kb/private/archive/2026-08-19/docs/03_SERVICE_CATALOG.md
-REPO_MATCH_80_PATTERN=homepage
-REPO_MATCH_80_LINE=kb/private/archive/2026-08-19/docs/03_SERVICE_CATALOG.md:154:- `homepage` — `ghcr.io/gethomepage/homepage:latest` — Up 2 weeks (healthy) — `[PRIVATE_IP]:3000->3000/tcp`
-REPO_MATCH_COUNT=80
-HOMEPAGE_ALLOWED_HOSTS_SOURCE_EVIDENCE=true
-CLUSTER_RESOURCES_RC=0
-CLUSTER_RESOURCES_JSON=true
-CLUSTER_CANDIDATE_COUNT=1
-CAND_1_VMID=190
-CAND_1_TYPE=qemu
-CAND_1_NODE=pve03
-CAND_1_STATUS=running
-CAND_1_NAME=homelab-ops-worker
-ONLINE_NODE_COUNT=3
-NODE_PVE02_SEARCH_RC=0
-NODE_PVE03_SEARCH_RC=0
-NODE_PVE01_SEARCH_RC=0
-HOSTCFG_1_NODE=pve01
-HOSTCFG_1_PATH=/srv/homelab-ops-worktrees/cr-2026-0017-inventory-foundation/observed/services/index.json
-HOSTCFG_2_NODE=pve01
-HOSTCFG_2_PATH=/srv/homelab-ops-worktrees/cr-2026-0017-inventory-foundation/inventory/services.json
-HOSTCFG_3_NODE=pve01
-HOSTCFG_3_PATH=/srv/homelab-desired-state/health/service-readiness-homepage.txt
-HOSTCFG_MATCH_COUNT=3
-GUEST_190_EXEC_RC=255
-GUEST_OBSERVATION_COUNT=0
-EXTERNAL_403_REPRODUCED=false
-DECISION=ANALYZE_HOME_GRAM1_403_TOPOLOGY
-NEXT_GATE=HOME_GRAM1_TARGETED_REPAIR
-TASK_RESULT=HOME_GRAM1_HTTP403_TOPOLOGY_RCA
+INGRESS_HOSTKEY_SELF_BOUND=true
+MODE=change
+MUTATION_BOUNDARY=FRESH_VM150_BACKUP_PLUS_TEMP_ISOLATED_RESTORE_ONLY
+NO_PRODUCTION_VM150_CONFIG_MUTATION=true
+NO_DNS_MUTATION=true
+NO_MONITOR_MUTATION=true
+NO_SOURCE_MUTATION=true
+NO_GLOBAL_DR_POLICY_MUTATION=true
+PROOF_PYTHON_RC=0
+PROD_VM150_RUNNING_PRE=true
+PROD_VM150_QGA_PRE=true
+PROD_VM150_CONFIG_SHA_PRE=2e4c1ea46b27034a2efe7bfc00cd9f32c0641a43d8365aa21992f72493a43b0e
+VM150_RUNTIME_EXACT_MATCH_COUNT=60
+FRESH_BACKUP_RESTORE_ERROR_CLASS=RuntimeError
+FRESH_BACKUP_RESTORE_ERROR_SHA256=30e31c3eb92140cf12764306833d83831395839ce95eba60ead3e5c88f3553f7
+PUBLIC_DNS_OK_COUNT=3
+PUBLIC_HTTPS_OK_COUNT=3
+FRESH_BACKUP_AND_ISOLATED_RESTORE_PASS=false
+DECISION=HOLD_SNIKKET_FRESH_BACKUP_RESTORE_PROOF
+NEXT_GATE=SNIKKET_FRESH_BACKUP_RESTORE_RECONCILE
+TASK_RESULT=HOLD_SNIKKET_FRESH_BACKUP_RESTORE_PROOF
 CHANGES_MADE=false
 ROLLBACK_STARTED=false
 ROLLBACK_RESTORED=null
 MUTATION_OUTCOME=NO_MUTATION
+PROOF_PYTHON_STDERR_BYTES=0
+PUBLIC_STUN_3479_PASS=true
+FINAL_FRESH_BACKUP_RESTORE_ACCEPT=false
+HOMELAB_RESULT_CONTRACT={"version":1,"command_id":"SUPPORT-261005-SNIKKET-FRESH-BACKUP-RESTORE-PROOF-99594R1","status":"OK","changes_made":false,"rollback_started":false,"rollback_restored":null}
 
 OUTPUT_END
 CHAT_OUTPUT_END