diff --git a/runtime/history/SUPPORT-261005-HOME-GRAM1-NETBIRD-PEER-DNS-POLICY-RCA-99599R1.json b/runtime/history/SUPPORT-261005-HOME-GRAM1-NETBIRD-PEER-DNS-POLICY-RCA-99599R1.json
new file mode 100644
index 00000000..cdacc844
--- /dev/null
+++ b/runtime/history/SUPPORT-261005-HOME-GRAM1-NETBIRD-PEER-DNS-POLICY-RCA-99599R1.json
@@ -0,0 +1,38 @@
+{
+  "schema_version": 1,
+  "channel": "homelab-runtime",
+  "command_id": "SUPPORT-261005-HOME-GRAM1-NETBIRD-PEER-DNS-POLICY-RCA-99599R1",
+  "status": "FAIL",
+  "rc": 52,
+  "host": "pve01",
+  "mode": "read-only",
+  "component": "home-gram1-netbird-peer-dns-policy-rca",
+  "started_at_utc": "2026-10-05T09:49:33Z",
+  "finished_at_utc": "2026-10-05T09:49:34Z",
+  "reference_register_checked": true,
+  "reference_sha256": "5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66",
+  "error_register_checked": true,
+  "error_register_sha256": "3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0",
+  "command_sha256": "a57b891fd2971bb26a4c101ed2507e8c6833907b817e0de6daee5ff3a5d28e63",
+  "duplicate_failed_command_blocked": false,
+  "block_reason": null,
+  "execution_started": true,
+  "change_declared": false,
+  "result_contract_valid": true,
+  "result_contract_status": null,
+  "result_contract_error": null,
+  "command_rc": 52,
+  "changes_made": false,
+  "rollback_started": false,
+  "rollback_restored": null,
+  "mutation_outcome": "NO_MUTATION",
+  "sanitized": true,
+  "secrets_included": false,
+  "private_addresses_included": false,
+  "raw_evidence_retained_locally": true,
+  "raw_evidence_sha256": "3e4f1879b00ba16d89d6709bc923bab558aa7be4cbca2319e9cfcdfef16019ad",
+  "sanitized_output_sha256": "3e4f1879b00ba16d89d6709bc923bab558aa7be4cbca2319e9cfcdfef16019ad",
+  "output_truncated_in_json": false,
+  "full_sanitized_output_url": "https://git.gram1.ru/.well-known/homelab-runtime/latest.txt",
+  "output": "HOME_GRAM1_NETBIRD_PEER_DNS_POLICY_RCA=V1\nNO_LOCAL_WINDOWS_MUTATION=true\nNO_NETBIRD_CLIENT_MUTATION=true\nNO_NETBIRD_SERVER_MUTATION=true\nNO_DNS_POLICY_MUTATION=true\nNO_GROUP_MUTATION=true\nNO_SERVER_RESTART=true\nMODE=read-only\nHOST_PVE01=true\nL_PEER_DIAG_OK=true\nL_NB_PRESENT=true\nL_NB_CONNECTED=true\nL_NB_STATUS_SHA=MISSING\nL_NB_DETAIL_SHA=MISSING\nL_PC_HOSTNAME_SHA=MISSING\nL_NB_ADAPTER_COUNT=1\nL_NB_IP_COUNT=1\nL_NB_IP_1_SHA=MISSING\nL_NB_IP_2_SHA=MISSING\nL_NB_IP_3_SHA=MISSING\nL_NB_IP_4_SHA=MISSING\nL_NB_IP_5_SHA=MISSING\nL_STATUS_HOSTNAME_HINT_SHA=MISSING\nL_STATUS_IP_HINT_SHA=MISSING\nL_HOME_DNS_COUNT=1\nNB_SSH_ALIAS_COUNT=0\nSOURCE_1_LINE=kb/AI_CONTEXT.md:32:Production NetBird is new USA `[IP_REDACTED]`, Debian 12, hostname `nb2`, NetBird `0.73.2`. Exact deployment caveat: `/api/health` = 404 and combined `:9000/health` = 503; these are not generic readiness gates for this deployment. Old USA `[IP_REDACTED]` has Mailcow/NetBird server stopped and observer disabled, but remains in rollback window. Permanent new-USA operator SSH hardening is still P0.\nSOURCE_2_LINE=kb/private/archive/2026-08-19/docs/20_NETBIRD_USA_MIGRATION_2026-08-18.md:20:- temporary hostname `nb2`\nSOURCE_3_LINE=kb/runbooks/04_NETBIRD_USA.md:3:Current production: `[IP_REDACTED]`, NetBird `0.73.2`, hostname `nb2`.\nSOURCE_4_LINE=kb/private/archive/2026-08-19/docs/01_CURRENT_AUTHORITATIVE_STATE.md:183:## 6. New USA NetBird production\nSOURCE_5_LINE=kb/AI_CONTEXT.md:32:Production NetBird is new USA `[IP_REDACTED]`, Debian 12, hostname `nb2`, NetBird `0.73.2`. Exact deployment caveat: `/api/health` = 404 and combined `:9000/health` = 503; these are not generic readiness gates for this deployment. Old USA `[IP_REDACTED]` has Mailcow/NetBird server stopped and observer disabled, but remains in rollback window. Permanent new-USA operator SSH hardening is still P0.\nSOURCE_6_LINE=kb/private/archive/2026-08-19/docs/20_NETBIRD_USA_MIGRATION_2026-08-18.md:20:- temporary hostname `nb2`\nSOURCE_7_LINE=kb/runbooks/04_NETBIRD_USA.md:3:Current production: `[IP_REDACTED]`, NetBird `0.73.2`, hostname `nb2`.\nSOURCE_8_LINE=kb/private/archive/2026-08-19/docs/01_CURRENT_AUTHORITATIVE_STATE.md:183:## 6. New USA NetBird production\nSOURCE_9_LINE=kb/AI_CONTEXT.md:32:Production NetBird is new USA `[IP_REDACTED]`, Debian 12, hostname `nb2`, NetBird `0.73.2`. Exact deployment caveat: `/api/health` = 404 and combined `:9000/health` = 503; these are not generic readiness gates for this deployment. Old USA `[IP_REDACTED]` has Mailcow/NetBird server stopped and observer disabled, but remains in rollback window. Permanent new-USA operator SSH hardening is still P0.\nSOURCE_10_LINE=kb/private/archive/2026-08-19/docs/20_NETBIRD_USA_MIGRATION_2026-08-18.md:20:- temporary hostname `nb2`\nSOURCE_11_LINE=kb/runbooks/04_NETBIRD_USA.md:3:Current production: `[IP_REDACTED]`, NetBird `0.73.2`, hostname `nb2`.\nSOURCE_12_LINE=kb/private/archive/2026-08-19/docs/01_CURRENT_AUTHORITATIVE_STATE.md:183:## 6. New USA NetBird production\nSOURCE_13_LINE=kb/AI_CONTEXT.md:32:Production NetBird is new USA `[IP_REDACTED]`, Debian 12, hostname `nb2`, NetBird `0.73.2`. Exact deployment caveat: `/api/health` = 404 and combined `:9000/health` = 503; these are not generic readiness gates for this deployment. Old USA `[IP_REDACTED]` has Mailcow/NetBird server stopped and observer disabled, but remains in rollback window. Permanent new-USA operator SSH hardening is still P0.\nSOURCE_14_LINE=kb/private/archive/2026-08-19/docs/20_NETBIRD_USA_MIGRATION_2026-08-18.md:20:- temporary hostname `nb2`\nSOURCE_15_LINE=kb/runbooks/04_NETBIRD_USA.md:3:Current production: `[IP_REDACTED]`, NetBird `0.73.2`, hostname `nb2`.\nSOURCE_16_LINE=kb/private/archive/2026-08-19/docs/01_CURRENT_AUTHORITATIVE_STATE.md:183:## 6. New USA NetBird production\nSOURCE_17_LINE=kb/AI_CONTEXT.md:32:Production NetBird is new USA `[IP_REDACTED]`, Debian 12, hostname `nb2`, NetBird `0.73.2`. Exact deployment caveat: `/api/health` = 404 and combined `:9000/health` = 503; these are not generic readiness gates for this deployment. Old USA `[IP_REDACTED]` has Mailcow/NetBird server stopped and observer disabled, but remains in rollback window. Permanent new-USA operator SSH hardening is still P0.\nSOURCE_18_LINE=kb/private/archive/2026-08-19/docs/20_NETBIRD_USA_MIGRATION_2026-08-18.md:20:- temporary hostname `nb2`\nSOURCE_19_LINE=kb/runbooks/04_NETBIRD_USA.md:3:Current production: `[IP_REDACTED]`, NetBird `0.73.2`, hostname `nb2`.\nSOURCE_20_LINE=kb/private/archive/2026-08-19/docs/01_CURRENT_AUTHORITATIVE_STATE.md:183:## 6. New USA NetBird production\nSOURCE_21_LINE=kb/AI_CONTEXT.md:32:Production NetBird is new USA `[IP_REDACTED]`, Debian 12, hostname `nb2`, NetBird `0.73.2`. Exact deployment caveat: `/api/health` = 404 and combined `:9000/health` = 503; these are not generic readiness gates for this deployment. Old USA `[IP_REDACTED]` has Mailcow/NetBird server stopped and observer disabled, but remains in rollback window. Permanent new-USA operator SSH hardening is still P0.\nSOURCE_22_LINE=kb/private/archive/2026-08-19/docs/20_NETBIRD_USA_MIGRATION_2026-08-18.md:20:- temporary hostname `nb2`\nSOURCE_23_LINE=kb/runbooks/04_NETBIRD_USA.md:3:Current production: `[IP_REDACTED]`, NetBird `0.73.2`, hostname `nb2`.\nSOURCE_24_LINE=kb/private/archive/2026-08-19/docs/01_CURRENT_AUTHORITATIVE_STATE.md:183:## 6. New USA NetBird production\nSOURCE_25_LINE=kb/AI_CONTEXT.md:32:Production NetBird is new USA `[IP_REDACTED]`, Debian 12, hostname `nb2`, NetBird `0.73.2`. Exact deployment caveat: `/api/health` = 404 and combined `:9000/health` = 503; these are not generic readiness gates for this deployment. Old USA `[IP_REDACTED]` has Mailcow/NetBird server stopped and observer disabled, but remains in rollback window. Permanent new-USA operator SSH hardening is still P0.\nSOURCE_26_LINE=kb/private/archive/2026-08-19/docs/20_NETBIRD_USA_MIGRATION_2026-08-18.md:20:- temporary hostname `nb2`\nSOURCE_27_LINE=kb/runbooks/04_NETBIRD_USA.md:3:Current production: `[IP_REDACTED]`, NetBird `0.73.2`, hostname `nb2`.\nSOURCE_28_LINE=kb/private/archive/2026-08-19/docs/01_CURRENT_AUTHORITATIVE_STATE.md:183:## 6. New USA NetBird production\nSOURCE_29_LINE=kb/AI_CONTEXT.md:32:Production NetBird is new USA `[IP_REDACTED]`, Debian 12, hostname `nb2`, NetBird `0.73.2`. Exact deployment caveat: `/api/health` = 404 and combined `:9000/health` = 503; these are not generic readiness gates for this deployment. Old USA `[IP_REDACTED]` has Mailcow/NetBird server stopped and observer disabled, but remains in rollback window. Permanent new-USA operator SSH hardening is still P0.\nSOURCE_30_LINE=kb/private/archive/2026-08-19/docs/20_NETBIRD_USA_MIGRATION_2026-08-18.md:20:- temporary hostname `nb2`\nSOURCE_31_LINE=kb/runbooks/04_NETBIRD_USA.md:3:Current production: `[IP_REDACTED]`, NetBird `0.73.2`, hostname `nb2`.\nSOURCE_32_LINE=kb/private/archive/2026-08-19/docs/01_CURRENT_AUTHORITATIVE_STATE.md:183:## 6. New USA NetBird production\nSOURCE_33_LINE=kb/AI_CONTEXT.md:32:Production NetBird is new USA `[IP_REDACTED]`, Debian 12, hostname `nb2`, NetBird `0.73.2`. Exact deployment caveat: `/api/health` = 404 and combined `:9000/health` = 503; these are not generic readiness gates for this deployment. Old USA `[IP_REDACTED]` has Mailcow/NetBird server stopped and observer disabled, but remains in rollback window. Permanent new-USA operator SSH hardening is still P0.\nSOURCE_34_LINE=kb/private/archive/2026-08-19/docs/20_NETBIRD_USA_MIGRATION_2026-08-18.md:20:- temporary hostname `nb2`\nSOURCE_35_LINE=kb/runbooks/04_NETBIRD_USA.md:3:Current production: `[IP_REDACTED]`, NetBird `0.73.2`, hostname `nb2`.\nSOURCE_36_LINE=kb/private/archive/2026-08-19/docs/01_CURRENT_AUTHORITATIVE_STATE.md:183:## 6. New USA NetBird production\nSOURCE_37_LINE=kb/AI_CONTEXT.md:32:Production NetBird is new USA `[IP_REDACTED]`, Debian 12, hostname `nb2`, NetBird `0.73.2`. Exact deployment caveat: `/api/health` = 404 and combined `:9000/health` = 503; these are not generic readiness gates for this deployment. Old USA `[IP_REDACTED]` has Mailcow/NetBird server stopped and observer disabled, but remains in rollback window. Permanent new-USA operator SSH hardening is still P0.\nSOURCE_38_LINE=kb/private/archive/2026-08-19/docs/20_NETBIRD_USA_MIGRATION_2026-08-18.md:20:- temporary hostname `nb2`\nSOURCE_39_LINE=kb/runbooks/04_NETBIRD_USA.md:3:Current production: `[IP_REDACTED]`, NetBird `0.73.2`, hostname `nb2`.\nSOURCE_40_LINE=kb/private/archive/2026-08-19/docs/01_CURRENT_AUTHORITATIVE_STATE.md:183:## 6. New USA NetBird production\nSOURCE_41_LINE=kb/AI_CONTEXT.md:32:Production NetBird is new USA `[IP_REDACTED]`, Debian 12, hostname `nb2`, NetBird `0.73.2`. Exact deployment caveat: `/api/health` = 404 and combined `:9000/health` = 503; these are not generic readiness gates for this deployment. Old USA `[IP_REDACTED]` has Mailcow/NetBird server stopped and observer disabled, but remains in rollback window. Permanent new-USA operator SSH hardening is still P0.\nSOURCE_42_LINE=kb/private/archive/2026-08-19/docs/20_NETBIRD_USA_MIGRATION_2026-08-18.md:20:- temporary hostname `nb2`\nSOURCE_43_LINE=kb/runbooks/04_NETBIRD_USA.md:3:Current production: `[IP_REDACTED]`, NetBird `0.73.2`, hostname `nb2`.\nSOURCE_44_LINE=kb/private/archive/2026-08-19/docs/01_CURRENT_AUTHORITATIVE_STATE.md:183:## 6. New USA NetBird production\nSOURCE_45_LINE=kb/AI_CONTEXT.md:32:Production NetBird is new USA `[IP_REDACTED]`, Debian 12, hostname `nb2`, NetBird `0.73.2`. Exact deployment caveat: `/api/health` = 404 and combined `:9000/health` = 503; these are not generic readiness gates for this deployment. Old USA `[IP_REDACTED]` has Mailcow/NetBird server stopped and observer disabled, but remains in rollback window. Permanent new-USA operator SSH hardening is still P0.\nSOURCE_46_LINE=kb/private/archive/2026-08-19/docs/20_NETBIRD_USA_MIGRATION_2026-08-18.md:20:- temporary hostname `nb2`\nSOURCE_47_LINE=kb/runbooks/04_NETBIRD_USA.md:3:Current production: `[IP_REDACTED]`, NetBird `0.73.2`, hostname `nb2`.\nSOURCE_48_LINE=kb/private/archive/2026-08-19/docs/01_CURRENT_AUTHORITATIVE_STATE.md:183:## 6. New USA NetBird production\nSOURCE_49_LINE=kb/AI_CONTEXT.md:32:Production NetBird is new USA `[IP_REDACTED]`, Debian 12, hostname `nb2`, NetBird `0.73.2`. Exact deployment caveat: `/api/health` = 404 and combined `:9000/health` = 503; these are not generic readiness gates for this deployment. Old USA `[IP_REDACTED]` has Mailcow/NetBird server stopped and observer disabled, but remains in rollback window. Permanent new-USA operator SSH hardening is still P0.\nSOURCE_50_LINE=kb/private/archive/2026-08-19/docs/20_NETBIRD_USA_MIGRATION_2026-08-18.md:20:- temporary hostname `nb2`\nSOURCE_51_LINE=kb/runbooks/04_NETBIRD_USA.md:3:Current production: `[IP_REDACTED]`, NetBird `0.73.2`, hostname `nb2`.\nSOURCE_52_LINE=kb/private/archive/2026-08-19/docs/01_CURRENT_AUTHORITATIVE_STATE.md:183:## 6. New USA NetBird production\nSOURCE_53_LINE=kb/AI_CONTEXT.md:32:Production NetBird is new USA `[IP_REDACTED]`, Debian 12, hostname `nb2`, NetBird `0.73.2`. Exact deployment caveat: `/api/health` = 404 and combined `:9000/health` = 503; these are not generic readiness gates for this deployment. Old USA `[IP_REDACTED]` has Mailcow/NetBird server stopped and observer disabled, but remains in rollback window. Permanent new-USA operator SSH hardening is still P0.\nSOURCE_54_LINE=kb/private/archive/2026-08-19/docs/20_NETBIRD_USA_MIGRATION_2026-08-18.md:20:- temporary hostname `nb2`\nSOURCE_55_LINE=kb/runbooks/04_NETBIRD_USA.md:3:Current production: `[IP_REDACTED]`, NetBird `0.73.2`, hostname `nb2`.\nSOURCE_56_LINE=kb/private/archive/2026-08-19/docs/01_CURRENT_AUTHORITATIVE_STATE.md:183:## 6. New USA NetBird production\nSOURCE_57_LINE=kb/AI_CONTEXT.md:32:Production NetBird is new USA `[IP_REDACTED]`, Debian 12, hostname `nb2`, NetBird `0.73.2`. Exact deployment caveat: `/api/health` = 404 and combined `:9000/health` = 503; these are not generic readiness gates for this deployment. Old USA `[IP_REDACTED]` has Mailcow/NetBird server stopped and observer disabled, but remains in rollback window. Permanent new-USA operator SSH hardening is still P0.\nSOURCE_58_LINE=kb/private/archive/2026-08-19/docs/20_NETBIRD_USA_MIGRATION_2026-08-18.md:20:- temporary hostname `nb2`\nSOURCE_59_LINE=kb/runbooks/04_NETBIRD_USA.md:3:Current production: `[IP_REDACTED]`, NetBird `0.73.2`, hostname `nb2`.\nSOURCE_60_LINE=kb/private/archive/2026-08-19/docs/01_CURRENT_AUTHORITATIVE_STATE.md:183:## 6. New USA NetBird production\nSOURCE_61_LINE=kb/AI_CONTEXT.md:32:Production NetBird is new USA `[IP_REDACTED]`, Debian 12, hostname `nb2`, NetBird `0.73.2`. Exact deployment caveat: `/api/health` = 404 and combined `:9000/health` = 503; these are not generic readiness gates for this deployment. Old USA `[IP_REDACTED]` has Mailcow/NetBird server stopped and observer disabled, but remains in rollback window. Permanent new-USA operator SSH hardening is still P0.\nSOURCE_62_LINE=kb/private/archive/2026-08-19/docs/20_NETBIRD_USA_MIGRATION_2026-08-18.md:20:- temporary hostname `nb2`\nSOURCE_63_LINE=kb/runbooks/04_NETBIRD_USA.md:3:Current production: `[IP_REDACTED]`, NetBird `0.73.2`, hostname `nb2`.\nSOURCE_64_LINE=kb/private/archive/2026-08-19/docs/01_CURRENT_AUTHORITATIVE_STATE.md:183:## 6. New USA NetBird production\nSOURCE_65_LINE=kb/AI_CONTEXT.md:32:Production NetBird is new USA `[IP_REDACTED]`, Debian 12, hostname `nb2`, NetBird `0.73.2`. Exact deployment caveat: `/api/health` = 404 and combined `:9000/health` = 503; these are not generic readiness gates for this deployment. Old USA `[IP_REDACTED]` has Mailcow/NetBird server stopped and observer disabled, but remains in rollback window. Permanent new-USA operator SSH hardening is still P0.\nSOURCE_66_LINE=kb/private/archive/2026-08-19/docs/20_NETBIRD_USA_MIGRATION_2026-08-18.md:20:- temporary hostname `nb2`\nSOURCE_67_LINE=kb/runbooks/04_NETBIRD_USA.md:3:Current production: `[IP_REDACTED]`, NetBird `0.73.2`, hostname `nb2`.\nSOURCE_68_LINE=kb/private/archive/2026-08-19/docs/01_CURRENT_AUTHORITATIVE_STATE.md:183:## 6. New USA NetBird production\nSOURCE_69_LINE=kb/AI_CONTEXT.md:32:Production NetBird is new USA `[IP_REDACTED]`, Debian 12, hostname `nb2`, NetBird `0.73.2`. Exact deployment caveat: `/api/health` = 404 and combined `:9000/health` = 503; these are not generic readiness gates for this deployment. Old USA `[IP_REDACTED]` has Mailcow/NetBird server stopped and observer disabled, but remains in rollback window. Permanent new-USA operator SSH hardening is still P0.\nSOURCE_70_LINE=kb/private/archive/2026-08-19/docs/20_NETBIRD_USA_MIGRATION_2026-08-18.md:20:- temporary hostname `nb2`\nSOURCE_71_LINE=kb/runbooks/04_NETBIRD_USA.md:3:Current production: `[IP_REDACTED]`, NetBird `0.73.2`, hostname `nb2`.\nSOURCE_72_LINE=kb/private/archive/2026-08-19/docs/01_CURRENT_AUTHORITATIVE_STATE.md:183:## 6. New USA NetBird production\nSOURCE_73_LINE=kb/AI_CONTEXT.md:32:Production NetBird is new USA `[IP_REDACTED]`, Debian 12, hostname `nb2`, NetBird `0.73.2`. Exact deployment caveat: `/api/health` = 404 and combined `:9000/health` = 503; these are not generic readiness gates for this deployment. Old USA `[IP_REDACTED]` has Mailcow/NetBird server stopped and observer disabled, but remains in rollback window. Permanent new-USA operator SSH hardening is still P0.\nSOURCE_74_LINE=kb/private/archive/2026-08-19/docs/20_NETBIRD_USA_MIGRATION_2026-08-18.md:20:- temporary hostname `nb2`\nSOURCE_75_LINE=kb/runbooks/04_NETBIRD_USA.md:3:Current production: `[IP_REDACTED]`, NetBird `0.73.2`, hostname `nb2`.\nSOURCE_76_LINE=kb/private/archive/2026-08-19/docs/01_CURRENT_AUTHORITATIVE_STATE.md:183:## 6. New USA NetBird production\nSOURCE_77_LINE=kb/AI_CONTEXT.md:32:Production NetBird is new USA `[IP_REDACTED]`, Debian 12, hostname `nb2`, NetBird `0.73.2`. Exact deployment caveat: `/api/health` = 404 and combined `:9000/health` = 503; these are not generic readiness gates for this deployment. Old USA `[IP_REDACTED]` has Mailcow/NetBird server stopped and observer disabled, but remains in rollback window. Permanent new-USA operator SSH hardening is still P0.\nSOURCE_78_LINE=kb/private/archive/2026-08-19/docs/20_NETBIRD_USA_MIGRATION_2026-08-18.md:20:- temporary hostname `nb2`\nSOURCE_79_LINE=kb/runbooks/04_NETBIRD_USA.md:3:Current production: `[IP_REDACTED]`, NetBird `0.73.2`, hostname `nb2`.\nSOURCE_80_LINE=kb/private/archive/2026-08-19/docs/01_CURRENT_AUTHORITATIVE_STATE.md:183:## 6. New USA NetBird production\nSOURCE_MATCH_COUNT=80\nNB_SSH_TRY_e16ce208_RC=255\nNB_SERVER_REACHABLE=false\nRCA_CLASS=NETBIRD_SERVER_NOT_REACHABLE_FROM_PVE01\nDECISION=HOLD_NETBIRD_PEER_DNS_POLICY_RCA\nNEXT_GATE=NETBIRD_SERVER_ACCESS_RECONCILE\nTASK_RESULT=HOME_GRAM1_NETBIRD_PEER_DNS_POLICY_RCA\nCHANGES_MADE=false\nROLLBACK_STARTED=false\nROLLBACK_RESTORED=null\nMUTATION_OUTCOME=NO_MUTATION\n"
+}
diff --git a/runtime/history/SUPPORT-261005-HOME-GRAM1-NETBIRD-PEER-DNS-POLICY-RCA-99599R1.txt b/runtime/history/SUPPORT-261005-HOME-GRAM1-NETBIRD-PEER-DNS-POLICY-RCA-99599R1.txt
new file mode 100644
index 00000000..b7f70494
--- /dev/null
+++ b/runtime/history/SUPPORT-261005-HOME-GRAM1-NETBIRD-PEER-DNS-POLICY-RCA-99599R1.txt
@@ -0,0 +1,149 @@
+CHAT_OUTPUT_BEGIN
+COMMAND_ID=SUPPORT-261005-HOME-GRAM1-NETBIRD-PEER-DNS-POLICY-RCA-99599R1
+STATUS=FAIL
+RC=52
+HOST=pve01
+MODE=read-only
+COMPONENT=home-gram1-netbird-peer-dns-policy-rca
+REFERENCE_REGISTER_CHECK=OK
+REFERENCE_SHA256=5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66
+ERROR_REGISTER_CHECK=OK
+ERROR_REGISTER_SHA256=3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0
+COMMAND_SHA256=a57b891fd2971bb26a4c101ed2507e8c6833907b817e0de6daee5ff3a5d28e63
+DUPLICATE_FAILED_COMMAND_BLOCKED=false
+EXECUTION_STARTED=true
+CHANGE_DECLARED=false
+RESULT_CONTRACT_VALID=true
+RESULT_CONTRACT_STATUS=NOT_APPLICABLE
+RESULT_CONTRACT_ERROR=NONE
+COMMAND_RC=52
+CHANGES_MADE=false
+ROLLBACK_STARTED=false
+ROLLBACK_RESTORED=null
+MUTATION_OUTCOME=NO_MUTATION
+SANITIZED=yes
+SECRETS_INCLUDED=no
+PRIVATE_ADDRESSES_INCLUDED=no
+RAW_EVIDENCE_SHA256=3e4f1879b00ba16d89d6709bc923bab558aa7be4cbca2319e9cfcdfef16019ad
+SANITIZED_OUTPUT_SHA256=3e4f1879b00ba16d89d6709bc923bab558aa7be4cbca2319e9cfcdfef16019ad
+OUTPUT_BEGIN
+HOME_GRAM1_NETBIRD_PEER_DNS_POLICY_RCA=V1
+NO_LOCAL_WINDOWS_MUTATION=true
+NO_NETBIRD_CLIENT_MUTATION=true
+NO_NETBIRD_SERVER_MUTATION=true
+NO_DNS_POLICY_MUTATION=true
+NO_GROUP_MUTATION=true
+NO_SERVER_RESTART=true
+MODE=read-only
+HOST_PVE01=true
+L_PEER_DIAG_OK=true
+L_NB_PRESENT=true
+L_NB_CONNECTED=true
+L_NB_STATUS_SHA=MISSING
+L_NB_DETAIL_SHA=MISSING
+L_PC_HOSTNAME_SHA=MISSING
+L_NB_ADAPTER_COUNT=1
+L_NB_IP_COUNT=1
+L_NB_IP_1_SHA=MISSING
+L_NB_IP_2_SHA=MISSING
+L_NB_IP_3_SHA=MISSING
+L_NB_IP_4_SHA=MISSING
+L_NB_IP_5_SHA=MISSING
+L_STATUS_HOSTNAME_HINT_SHA=MISSING
+L_STATUS_IP_HINT_SHA=MISSING
+L_HOME_DNS_COUNT=1
+NB_SSH_ALIAS_COUNT=0
+SOURCE_1_LINE=kb/AI_CONTEXT.md:32:Production NetBird is new USA `[IP_REDACTED]`, Debian 12, hostname `nb2`, NetBird `0.73.2`. Exact deployment caveat: `/api/health` = 404 and combined `:9000/health` = 503; these are not generic readiness gates for this deployment. Old USA `[IP_REDACTED]` has Mailcow/NetBird server stopped and observer disabled, but remains in rollback window. Permanent new-USA operator SSH hardening is still P0.
+SOURCE_2_LINE=kb/private/archive/2026-08-19/docs/20_NETBIRD_USA_MIGRATION_2026-08-18.md:20:- temporary hostname `nb2`
+SOURCE_3_LINE=kb/runbooks/04_NETBIRD_USA.md:3:Current production: `[IP_REDACTED]`, NetBird `0.73.2`, hostname `nb2`.
+SOURCE_4_LINE=kb/private/archive/2026-08-19/docs/01_CURRENT_AUTHORITATIVE_STATE.md:183:## 6. New USA NetBird production
+SOURCE_5_LINE=kb/AI_CONTEXT.md:32:Production NetBird is new USA `[IP_REDACTED]`, Debian 12, hostname `nb2`, NetBird `0.73.2`. Exact deployment caveat: `/api/health` = 404 and combined `:9000/health` = 503; these are not generic readiness gates for this deployment. Old USA `[IP_REDACTED]` has Mailcow/NetBird server stopped and observer disabled, but remains in rollback window. Permanent new-USA operator SSH hardening is still P0.
+SOURCE_6_LINE=kb/private/archive/2026-08-19/docs/20_NETBIRD_USA_MIGRATION_2026-08-18.md:20:- temporary hostname `nb2`
+SOURCE_7_LINE=kb/runbooks/04_NETBIRD_USA.md:3:Current production: `[IP_REDACTED]`, NetBird `0.73.2`, hostname `nb2`.
+SOURCE_8_LINE=kb/private/archive/2026-08-19/docs/01_CURRENT_AUTHORITATIVE_STATE.md:183:## 6. New USA NetBird production
+SOURCE_9_LINE=kb/AI_CONTEXT.md:32:Production NetBird is new USA `[IP_REDACTED]`, Debian 12, hostname `nb2`, NetBird `0.73.2`. Exact deployment caveat: `/api/health` = 404 and combined `:9000/health` = 503; these are not generic readiness gates for this deployment. Old USA `[IP_REDACTED]` has Mailcow/NetBird server stopped and observer disabled, but remains in rollback window. Permanent new-USA operator SSH hardening is still P0.
+SOURCE_10_LINE=kb/private/archive/2026-08-19/docs/20_NETBIRD_USA_MIGRATION_2026-08-18.md:20:- temporary hostname `nb2`
+SOURCE_11_LINE=kb/runbooks/04_NETBIRD_USA.md:3:Current production: `[IP_REDACTED]`, NetBird `0.73.2`, hostname `nb2`.
+SOURCE_12_LINE=kb/private/archive/2026-08-19/docs/01_CURRENT_AUTHORITATIVE_STATE.md:183:## 6. New USA NetBird production
+SOURCE_13_LINE=kb/AI_CONTEXT.md:32:Production NetBird is new USA `[IP_REDACTED]`, Debian 12, hostname `nb2`, NetBird `0.73.2`. Exact deployment caveat: `/api/health` = 404 and combined `:9000/health` = 503; these are not generic readiness gates for this deployment. Old USA `[IP_REDACTED]` has Mailcow/NetBird server stopped and observer disabled, but remains in rollback window. Permanent new-USA operator SSH hardening is still P0.
+SOURCE_14_LINE=kb/private/archive/2026-08-19/docs/20_NETBIRD_USA_MIGRATION_2026-08-18.md:20:- temporary hostname `nb2`
+SOURCE_15_LINE=kb/runbooks/04_NETBIRD_USA.md:3:Current production: `[IP_REDACTED]`, NetBird `0.73.2`, hostname `nb2`.
+SOURCE_16_LINE=kb/private/archive/2026-08-19/docs/01_CURRENT_AUTHORITATIVE_STATE.md:183:## 6. New USA NetBird production
+SOURCE_17_LINE=kb/AI_CONTEXT.md:32:Production NetBird is new USA `[IP_REDACTED]`, Debian 12, hostname `nb2`, NetBird `0.73.2`. Exact deployment caveat: `/api/health` = 404 and combined `:9000/health` = 503; these are not generic readiness gates for this deployment. Old USA `[IP_REDACTED]` has Mailcow/NetBird server stopped and observer disabled, but remains in rollback window. Permanent new-USA operator SSH hardening is still P0.
+SOURCE_18_LINE=kb/private/archive/2026-08-19/docs/20_NETBIRD_USA_MIGRATION_2026-08-18.md:20:- temporary hostname `nb2`
+SOURCE_19_LINE=kb/runbooks/04_NETBIRD_USA.md:3:Current production: `[IP_REDACTED]`, NetBird `0.73.2`, hostname `nb2`.
+SOURCE_20_LINE=kb/private/archive/2026-08-19/docs/01_CURRENT_AUTHORITATIVE_STATE.md:183:## 6. New USA NetBird production
+SOURCE_21_LINE=kb/AI_CONTEXT.md:32:Production NetBird is new USA `[IP_REDACTED]`, Debian 12, hostname `nb2`, NetBird `0.73.2`. Exact deployment caveat: `/api/health` = 404 and combined `:9000/health` = 503; these are not generic readiness gates for this deployment. Old USA `[IP_REDACTED]` has Mailcow/NetBird server stopped and observer disabled, but remains in rollback window. Permanent new-USA operator SSH hardening is still P0.
+SOURCE_22_LINE=kb/private/archive/2026-08-19/docs/20_NETBIRD_USA_MIGRATION_2026-08-18.md:20:- temporary hostname `nb2`
+SOURCE_23_LINE=kb/runbooks/04_NETBIRD_USA.md:3:Current production: `[IP_REDACTED]`, NetBird `0.73.2`, hostname `nb2`.
+SOURCE_24_LINE=kb/private/archive/2026-08-19/docs/01_CURRENT_AUTHORITATIVE_STATE.md:183:## 6. New USA NetBird production
+SOURCE_25_LINE=kb/AI_CONTEXT.md:32:Production NetBird is new USA `[IP_REDACTED]`, Debian 12, hostname `nb2`, NetBird `0.73.2`. Exact deployment caveat: `/api/health` = 404 and combined `:9000/health` = 503; these are not generic readiness gates for this deployment. Old USA `[IP_REDACTED]` has Mailcow/NetBird server stopped and observer disabled, but remains in rollback window. Permanent new-USA operator SSH hardening is still P0.
+SOURCE_26_LINE=kb/private/archive/2026-08-19/docs/20_NETBIRD_USA_MIGRATION_2026-08-18.md:20:- temporary hostname `nb2`
+SOURCE_27_LINE=kb/runbooks/04_NETBIRD_USA.md:3:Current production: `[IP_REDACTED]`, NetBird `0.73.2`, hostname `nb2`.
+SOURCE_28_LINE=kb/private/archive/2026-08-19/docs/01_CURRENT_AUTHORITATIVE_STATE.md:183:## 6. New USA NetBird production
+SOURCE_29_LINE=kb/AI_CONTEXT.md:32:Production NetBird is new USA `[IP_REDACTED]`, Debian 12, hostname `nb2`, NetBird `0.73.2`. Exact deployment caveat: `/api/health` = 404 and combined `:9000/health` = 503; these are not generic readiness gates for this deployment. Old USA `[IP_REDACTED]` has Mailcow/NetBird server stopped and observer disabled, but remains in rollback window. Permanent new-USA operator SSH hardening is still P0.
+SOURCE_30_LINE=kb/private/archive/2026-08-19/docs/20_NETBIRD_USA_MIGRATION_2026-08-18.md:20:- temporary hostname `nb2`
+SOURCE_31_LINE=kb/runbooks/04_NETBIRD_USA.md:3:Current production: `[IP_REDACTED]`, NetBird `0.73.2`, hostname `nb2`.
+SOURCE_32_LINE=kb/private/archive/2026-08-19/docs/01_CURRENT_AUTHORITATIVE_STATE.md:183:## 6. New USA NetBird production
+SOURCE_33_LINE=kb/AI_CONTEXT.md:32:Production NetBird is new USA `[IP_REDACTED]`, Debian 12, hostname `nb2`, NetBird `0.73.2`. Exact deployment caveat: `/api/health` = 404 and combined `:9000/health` = 503; these are not generic readiness gates for this deployment. Old USA `[IP_REDACTED]` has Mailcow/NetBird server stopped and observer disabled, but remains in rollback window. Permanent new-USA operator SSH hardening is still P0.
+SOURCE_34_LINE=kb/private/archive/2026-08-19/docs/20_NETBIRD_USA_MIGRATION_2026-08-18.md:20:- temporary hostname `nb2`
+SOURCE_35_LINE=kb/runbooks/04_NETBIRD_USA.md:3:Current production: `[IP_REDACTED]`, NetBird `0.73.2`, hostname `nb2`.
+SOURCE_36_LINE=kb/private/archive/2026-08-19/docs/01_CURRENT_AUTHORITATIVE_STATE.md:183:## 6. New USA NetBird production
+SOURCE_37_LINE=kb/AI_CONTEXT.md:32:Production NetBird is new USA `[IP_REDACTED]`, Debian 12, hostname `nb2`, NetBird `0.73.2`. Exact deployment caveat: `/api/health` = 404 and combined `:9000/health` = 503; these are not generic readiness gates for this deployment. Old USA `[IP_REDACTED]` has Mailcow/NetBird server stopped and observer disabled, but remains in rollback window. Permanent new-USA operator SSH hardening is still P0.
+SOURCE_38_LINE=kb/private/archive/2026-08-19/docs/20_NETBIRD_USA_MIGRATION_2026-08-18.md:20:- temporary hostname `nb2`
+SOURCE_39_LINE=kb/runbooks/04_NETBIRD_USA.md:3:Current production: `[IP_REDACTED]`, NetBird `0.73.2`, hostname `nb2`.
+SOURCE_40_LINE=kb/private/archive/2026-08-19/docs/01_CURRENT_AUTHORITATIVE_STATE.md:183:## 6. New USA NetBird production
+SOURCE_41_LINE=kb/AI_CONTEXT.md:32:Production NetBird is new USA `[IP_REDACTED]`, Debian 12, hostname `nb2`, NetBird `0.73.2`. Exact deployment caveat: `/api/health` = 404 and combined `:9000/health` = 503; these are not generic readiness gates for this deployment. Old USA `[IP_REDACTED]` has Mailcow/NetBird server stopped and observer disabled, but remains in rollback window. Permanent new-USA operator SSH hardening is still P0.
+SOURCE_42_LINE=kb/private/archive/2026-08-19/docs/20_NETBIRD_USA_MIGRATION_2026-08-18.md:20:- temporary hostname `nb2`
+SOURCE_43_LINE=kb/runbooks/04_NETBIRD_USA.md:3:Current production: `[IP_REDACTED]`, NetBird `0.73.2`, hostname `nb2`.
+SOURCE_44_LINE=kb/private/archive/2026-08-19/docs/01_CURRENT_AUTHORITATIVE_STATE.md:183:## 6. New USA NetBird production
+SOURCE_45_LINE=kb/AI_CONTEXT.md:32:Production NetBird is new USA `[IP_REDACTED]`, Debian 12, hostname `nb2`, NetBird `0.73.2`. Exact deployment caveat: `/api/health` = 404 and combined `:9000/health` = 503; these are not generic readiness gates for this deployment. Old USA `[IP_REDACTED]` has Mailcow/NetBird server stopped and observer disabled, but remains in rollback window. Permanent new-USA operator SSH hardening is still P0.
+SOURCE_46_LINE=kb/private/archive/2026-08-19/docs/20_NETBIRD_USA_MIGRATION_2026-08-18.md:20:- temporary hostname `nb2`
+SOURCE_47_LINE=kb/runbooks/04_NETBIRD_USA.md:3:Current production: `[IP_REDACTED]`, NetBird `0.73.2`, hostname `nb2`.
+SOURCE_48_LINE=kb/private/archive/2026-08-19/docs/01_CURRENT_AUTHORITATIVE_STATE.md:183:## 6. New USA NetBird production
+SOURCE_49_LINE=kb/AI_CONTEXT.md:32:Production NetBird is new USA `[IP_REDACTED]`, Debian 12, hostname `nb2`, NetBird `0.73.2`. Exact deployment caveat: `/api/health` = 404 and combined `:9000/health` = 503; these are not generic readiness gates for this deployment. Old USA `[IP_REDACTED]` has Mailcow/NetBird server stopped and observer disabled, but remains in rollback window. Permanent new-USA operator SSH hardening is still P0.
+SOURCE_50_LINE=kb/private/archive/2026-08-19/docs/20_NETBIRD_USA_MIGRATION_2026-08-18.md:20:- temporary hostname `nb2`
+SOURCE_51_LINE=kb/runbooks/04_NETBIRD_USA.md:3:Current production: `[IP_REDACTED]`, NetBird `0.73.2`, hostname `nb2`.
+SOURCE_52_LINE=kb/private/archive/2026-08-19/docs/01_CURRENT_AUTHORITATIVE_STATE.md:183:## 6. New USA NetBird production
+SOURCE_53_LINE=kb/AI_CONTEXT.md:32:Production NetBird is new USA `[IP_REDACTED]`, Debian 12, hostname `nb2`, NetBird `0.73.2`. Exact deployment caveat: `/api/health` = 404 and combined `:9000/health` = 503; these are not generic readiness gates for this deployment. Old USA `[IP_REDACTED]` has Mailcow/NetBird server stopped and observer disabled, but remains in rollback window. Permanent new-USA operator SSH hardening is still P0.
+SOURCE_54_LINE=kb/private/archive/2026-08-19/docs/20_NETBIRD_USA_MIGRATION_2026-08-18.md:20:- temporary hostname `nb2`
+SOURCE_55_LINE=kb/runbooks/04_NETBIRD_USA.md:3:Current production: `[IP_REDACTED]`, NetBird `0.73.2`, hostname `nb2`.
+SOURCE_56_LINE=kb/private/archive/2026-08-19/docs/01_CURRENT_AUTHORITATIVE_STATE.md:183:## 6. New USA NetBird production
+SOURCE_57_LINE=kb/AI_CONTEXT.md:32:Production NetBird is new USA `[IP_REDACTED]`, Debian 12, hostname `nb2`, NetBird `0.73.2`. Exact deployment caveat: `/api/health` = 404 and combined `:9000/health` = 503; these are not generic readiness gates for this deployment. Old USA `[IP_REDACTED]` has Mailcow/NetBird server stopped and observer disabled, but remains in rollback window. Permanent new-USA operator SSH hardening is still P0.
+SOURCE_58_LINE=kb/private/archive/2026-08-19/docs/20_NETBIRD_USA_MIGRATION_2026-08-18.md:20:- temporary hostname `nb2`
+SOURCE_59_LINE=kb/runbooks/04_NETBIRD_USA.md:3:Current production: `[IP_REDACTED]`, NetBird `0.73.2`, hostname `nb2`.
+SOURCE_60_LINE=kb/private/archive/2026-08-19/docs/01_CURRENT_AUTHORITATIVE_STATE.md:183:## 6. New USA NetBird production
+SOURCE_61_LINE=kb/AI_CONTEXT.md:32:Production NetBird is new USA `[IP_REDACTED]`, Debian 12, hostname `nb2`, NetBird `0.73.2`. Exact deployment caveat: `/api/health` = 404 and combined `:9000/health` = 503; these are not generic readiness gates for this deployment. Old USA `[IP_REDACTED]` has Mailcow/NetBird server stopped and observer disabled, but remains in rollback window. Permanent new-USA operator SSH hardening is still P0.
+SOURCE_62_LINE=kb/private/archive/2026-08-19/docs/20_NETBIRD_USA_MIGRATION_2026-08-18.md:20:- temporary hostname `nb2`
+SOURCE_63_LINE=kb/runbooks/04_NETBIRD_USA.md:3:Current production: `[IP_REDACTED]`, NetBird `0.73.2`, hostname `nb2`.
+SOURCE_64_LINE=kb/private/archive/2026-08-19/docs/01_CURRENT_AUTHORITATIVE_STATE.md:183:## 6. New USA NetBird production
+SOURCE_65_LINE=kb/AI_CONTEXT.md:32:Production NetBird is new USA `[IP_REDACTED]`, Debian 12, hostname `nb2`, NetBird `0.73.2`. Exact deployment caveat: `/api/health` = 404 and combined `:9000/health` = 503; these are not generic readiness gates for this deployment. Old USA `[IP_REDACTED]` has Mailcow/NetBird server stopped and observer disabled, but remains in rollback window. Permanent new-USA operator SSH hardening is still P0.
+SOURCE_66_LINE=kb/private/archive/2026-08-19/docs/20_NETBIRD_USA_MIGRATION_2026-08-18.md:20:- temporary hostname `nb2`
+SOURCE_67_LINE=kb/runbooks/04_NETBIRD_USA.md:3:Current production: `[IP_REDACTED]`, NetBird `0.73.2`, hostname `nb2`.
+SOURCE_68_LINE=kb/private/archive/2026-08-19/docs/01_CURRENT_AUTHORITATIVE_STATE.md:183:## 6. New USA NetBird production
+SOURCE_69_LINE=kb/AI_CONTEXT.md:32:Production NetBird is new USA `[IP_REDACTED]`, Debian 12, hostname `nb2`, NetBird `0.73.2`. Exact deployment caveat: `/api/health` = 404 and combined `:9000/health` = 503; these are not generic readiness gates for this deployment. Old USA `[IP_REDACTED]` has Mailcow/NetBird server stopped and observer disabled, but remains in rollback window. Permanent new-USA operator SSH hardening is still P0.
+SOURCE_70_LINE=kb/private/archive/2026-08-19/docs/20_NETBIRD_USA_MIGRATION_2026-08-18.md:20:- temporary hostname `nb2`
+SOURCE_71_LINE=kb/runbooks/04_NETBIRD_USA.md:3:Current production: `[IP_REDACTED]`, NetBird `0.73.2`, hostname `nb2`.
+SOURCE_72_LINE=kb/private/archive/2026-08-19/docs/01_CURRENT_AUTHORITATIVE_STATE.md:183:## 6. New USA NetBird production
+SOURCE_73_LINE=kb/AI_CONTEXT.md:32:Production NetBird is new USA `[IP_REDACTED]`, Debian 12, hostname `nb2`, NetBird `0.73.2`. Exact deployment caveat: `/api/health` = 404 and combined `:9000/health` = 503; these are not generic readiness gates for this deployment. Old USA `[IP_REDACTED]` has Mailcow/NetBird server stopped and observer disabled, but remains in rollback window. Permanent new-USA operator SSH hardening is still P0.
+SOURCE_74_LINE=kb/private/archive/2026-08-19/docs/20_NETBIRD_USA_MIGRATION_2026-08-18.md:20:- temporary hostname `nb2`
+SOURCE_75_LINE=kb/runbooks/04_NETBIRD_USA.md:3:Current production: `[IP_REDACTED]`, NetBird `0.73.2`, hostname `nb2`.
+SOURCE_76_LINE=kb/private/archive/2026-08-19/docs/01_CURRENT_AUTHORITATIVE_STATE.md:183:## 6. New USA NetBird production
+SOURCE_77_LINE=kb/AI_CONTEXT.md:32:Production NetBird is new USA `[IP_REDACTED]`, Debian 12, hostname `nb2`, NetBird `0.73.2`. Exact deployment caveat: `/api/health` = 404 and combined `:9000/health` = 503; these are not generic readiness gates for this deployment. Old USA `[IP_REDACTED]` has Mailcow/NetBird server stopped and observer disabled, but remains in rollback window. Permanent new-USA operator SSH hardening is still P0.
+SOURCE_78_LINE=kb/private/archive/2026-08-19/docs/20_NETBIRD_USA_MIGRATION_2026-08-18.md:20:- temporary hostname `nb2`
+SOURCE_79_LINE=kb/runbooks/04_NETBIRD_USA.md:3:Current production: `[IP_REDACTED]`, NetBird `0.73.2`, hostname `nb2`.
+SOURCE_80_LINE=kb/private/archive/2026-08-19/docs/01_CURRENT_AUTHORITATIVE_STATE.md:183:## 6. New USA NetBird production
+SOURCE_MATCH_COUNT=80
+NB_SSH_TRY_e16ce208_RC=255
+NB_SERVER_REACHABLE=false
+RCA_CLASS=NETBIRD_SERVER_NOT_REACHABLE_FROM_PVE01
+DECISION=HOLD_NETBIRD_PEER_DNS_POLICY_RCA
+NEXT_GATE=NETBIRD_SERVER_ACCESS_RECONCILE
+TASK_RESULT=HOME_GRAM1_NETBIRD_PEER_DNS_POLICY_RCA
+CHANGES_MADE=false
+ROLLBACK_STARTED=false
+ROLLBACK_RESTORED=null
+MUTATION_OUTCOME=NO_MUTATION
+
+OUTPUT_END
+CHAT_OUTPUT_END
diff --git a/runtime/latest.json b/runtime/latest.json
index c815f5bc..cdacc844 100644
--- a/runtime/latest.json
+++ b/runtime/latest.json
@@ -1,19 +1,19 @@
 {
   "schema_version": 1,
   "channel": "homelab-runtime",
-  "command_id": "SUPPORT-261005-SNIKKET-HOSTNAME-RESULT-RELAY-99599R1",
-  "status": "OK",
-  "rc": 0,
+  "command_id": "SUPPORT-261005-HOME-GRAM1-NETBIRD-PEER-DNS-POLICY-RCA-99599R1",
+  "status": "FAIL",
+  "rc": 52,
   "host": "pve01",
   "mode": "read-only",
-  "component": "snikket-hostname-result-relay",
-  "started_at_utc": "2026-10-05T09:43:58Z",
-  "finished_at_utc": "2026-10-05T09:43:58Z",
+  "component": "home-gram1-netbird-peer-dns-policy-rca",
+  "started_at_utc": "2026-10-05T09:49:33Z",
+  "finished_at_utc": "2026-10-05T09:49:34Z",
   "reference_register_checked": true,
   "reference_sha256": "5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66",
   "error_register_checked": true,
   "error_register_sha256": "3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0",
-  "command_sha256": "4ee9530ed716738043f6c859438a04ef2b0c016ba133c2aa76aec4b6b8e16f5c",
+  "command_sha256": "a57b891fd2971bb26a4c101ed2507e8c6833907b817e0de6daee5ff3a5d28e63",
   "duplicate_failed_command_blocked": false,
   "block_reason": null,
   "execution_started": true,
@@ -21,7 +21,7 @@
   "result_contract_valid": true,
   "result_contract_status": null,
   "result_contract_error": null,
-  "command_rc": 0,
+  "command_rc": 52,
   "changes_made": false,
   "rollback_started": false,
   "rollback_restored": null,
@@ -30,9 +30,9 @@
   "secrets_included": false,
   "private_addresses_included": false,
   "raw_evidence_retained_locally": true,
-  "raw_evidence_sha256": "83ab2d0bdcf82cde20c209b76bb02ddc033e4c854de697f319ea347e9f0c5623",
-  "sanitized_output_sha256": "83ab2d0bdcf82cde20c209b76bb02ddc033e4c854de697f319ea347e9f0c5623",
+  "raw_evidence_sha256": "3e4f1879b00ba16d89d6709bc923bab558aa7be4cbca2319e9cfcdfef16019ad",
+  "sanitized_output_sha256": "3e4f1879b00ba16d89d6709bc923bab558aa7be4cbca2319e9cfcdfef16019ad",
   "output_truncated_in_json": false,
   "full_sanitized_output_url": "https://git.gram1.ru/.well-known/homelab-runtime/latest.txt",
-  "output": "SNIKKET_HOSTNAME_RESULT_RELAY=V1\nMODE=read-only\nNO_VM_MUTATION=true\nNO_BACKUP_MUTATION=true\nNO_SOURCE_MUTATION=true\nNO_MONITOR_MUTATION=true\nNO_DNS_MUTATION=true\nSELF_EXACT_CODE_1=404\nSELF_EXACT_CODE_2=404\nSELF_EXACT_CODE_3=404\nSELF_EXACT_CODE_4=404\nSELF_EXACT_404X4=true\nPREV_TXT_HTTP=200\nPREV_JSON_HTTP=200\nHEAD_HTTP=200\nPREV_COMMAND_ID_MATCH=true\nPREV_STATUS=OK\nPREV_RC=0\nPREV_MODE=read-only\nPREV_COMPONENT=snikket-restored-hostname-rca\nPREV_CHANGES_MADE=false\nPREV_SANITIZED=true\nHEAD_ID=8820ed9ea3d7ff42ff7741b41cfac3935ea86c9f\nHEAD_MESSAGE_SHA256=cda47bc4f0475b9a0f766b71330096f364befa891c91d9ab5f175ac58ea4f06d\nHEAD_IS_PREV=false\nVM150_RUNNING=true\nVM150_QGA=true\nVM150_CONFIG_MATCH_KNOWN=true\nVM150_PVE_NAME_PRESENT=true\nVM150_PVE_NAME_SNIKKET=true\nVM150_CLOUDINIT_CONFIG_LINE_COUNT=1\nVM150_HAS_CLOUDINIT_DRIVE=true\nVM150_CIUSER_PRESENT=true\nVM150_CICUSTOM_PRESENT=false\nVM150_IPCONFIG_PRESENT=true\nQM_CLOUDINIT_DUMP_META_RC=0\nQM_CLOUDINIT_DUMP_USER_RC=0\nQM_CLOUDINIT_DUMP_NETWORK_RC=0\nCI_META_LOCAL_HOSTNAME_PRESENT=false\nCI_META_LOCAL_HOSTNAME_SNIKKET=false\nCI_META_INSTANCE_ID_PRESENT=true\nVM150_GUEST_EXITCODE=0\nVM150_GUEST_MARKER=true\nCLOUD_INIT_PRESENT=true\nCLOUD_PRESERVE_HOSTNAME_COUNT=1\nCLOUD_PRESERVE_HOSTNAME_1=false\nCLOUD_MANAGE_ETC_HOSTS_COUNT=0\nCLOUD_DATASOURCE_LIST_COUNT=0\nCLOUD_INSTANCE_ID_PRESENT=true\nQEMU_BOOT_DEF_PRESENT=true\nQEMU_BOOT_ARGS=archive,tempid,wait_sec,run_id\nQEMU_BOOT_SETS_NAME=false\nQEMU_BOOT_NAME_PREFIX_DRILL=false\nQEMU_BOOT_DELETES_NETWORK=false\nQEMU_BOOT_SETS_ONBOOT_ZERO=false\nQEMU_BOOT_STARTS_VM=true\nQEMU_BOOT_TOUCHES_CLOUDINIT=false\nFRESH_STATE_PRESENT=true\nFRESH_RESTORE_PRESENT=true\nTEMP_VM_9600_PRESENT=false\nPUBLIC_DNS_OK_COUNT=3\nPUBLIC_HTTPS_OK_COUNT=3\nPUBLIC_STUN_3479_PASS=true\nHOSTNAME_RCA_COMPLETE=true\nDECISION=ANALYZE_EXACT_99598_HOSTNAME_EFFECT\nNEXT_GATE=SNIKKET_FINAL_OPS_SEAL_OR_TARGETED_BACKUP_FIX\nTASK_RESULT=SNIKKET_RESTORED_HOSTNAME_RCA\nCLOUD_INIT_CAN_MANAGE_HOSTNAME=true\nHOSTNAME_HARNESS_EFFECT_PROVEN=false\nQEMU_BOOT_SOURCE_B64_SELECTED_SHA256=b0bda1f610e26501b6d4dbc6ccdb91c695a19cc3d4f4f7918d9ead7cb1845b58\nQEMU_BOOT_SOURCE_B64_SELECTED_B64=NjI1OiAgICBydW5fdHR5KFtRTSwic3RhcnQiLHN0cih0ZW1waWQpXSx0aW1lb3V0PTEyMCk=\nCLOUD_INIT_STATUS_B64_SELECTED_SHA256=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\nCLOUD_INIT_STATUS_B64_SELECTED_B64=\nRELAY_PASS=true\nDECISION=ANALYZE_RELAYED_99598\nNEXT_GATE=FINAL_SEAL_OR_TARGETED_FIX\nTASK_RESULT=PASS_SNIKKET_HOSTNAME_RESULT_RELAY\nCHANGES_MADE=false\nROLLBACK_STARTED=false\nROLLBACK_RESTORED=null\nMUTATION_OUTCOME=NO_MUTATION\n"
+  "output": "HOME_GRAM1_NETBIRD_PEER_DNS_POLICY_RCA=V1\nNO_LOCAL_WINDOWS_MUTATION=true\nNO_NETBIRD_CLIENT_MUTATION=true\nNO_NETBIRD_SERVER_MUTATION=true\nNO_DNS_POLICY_MUTATION=true\nNO_GROUP_MUTATION=true\nNO_SERVER_RESTART=true\nMODE=read-only\nHOST_PVE01=true\nL_PEER_DIAG_OK=true\nL_NB_PRESENT=true\nL_NB_CONNECTED=true\nL_NB_STATUS_SHA=MISSING\nL_NB_DETAIL_SHA=MISSING\nL_PC_HOSTNAME_SHA=MISSING\nL_NB_ADAPTER_COUNT=1\nL_NB_IP_COUNT=1\nL_NB_IP_1_SHA=MISSING\nL_NB_IP_2_SHA=MISSING\nL_NB_IP_3_SHA=MISSING\nL_NB_IP_4_SHA=MISSING\nL_NB_IP_5_SHA=MISSING\nL_STATUS_HOSTNAME_HINT_SHA=MISSING\nL_STATUS_IP_HINT_SHA=MISSING\nL_HOME_DNS_COUNT=1\nNB_SSH_ALIAS_COUNT=0\nSOURCE_1_LINE=kb/AI_CONTEXT.md:32:Production NetBird is new USA `[IP_REDACTED]`, Debian 12, hostname `nb2`, NetBird `0.73.2`. Exact deployment caveat: `/api/health` = 404 and combined `:9000/health` = 503; these are not generic readiness gates for this deployment. Old USA `[IP_REDACTED]` has Mailcow/NetBird server stopped and observer disabled, but remains in rollback window. Permanent new-USA operator SSH hardening is still P0.\nSOURCE_2_LINE=kb/private/archive/2026-08-19/docs/20_NETBIRD_USA_MIGRATION_2026-08-18.md:20:- temporary hostname `nb2`\nSOURCE_3_LINE=kb/runbooks/04_NETBIRD_USA.md:3:Current production: `[IP_REDACTED]`, NetBird `0.73.2`, hostname `nb2`.\nSOURCE_4_LINE=kb/private/archive/2026-08-19/docs/01_CURRENT_AUTHORITATIVE_STATE.md:183:## 6. New USA NetBird production\nSOURCE_5_LINE=kb/AI_CONTEXT.md:32:Production NetBird is new USA `[IP_REDACTED]`, Debian 12, hostname `nb2`, NetBird `0.73.2`. Exact deployment caveat: `/api/health` = 404 and combined `:9000/health` = 503; these are not generic readiness gates for this deployment. Old USA `[IP_REDACTED]` has Mailcow/NetBird server stopped and observer disabled, but remains in rollback window. Permanent new-USA operator SSH hardening is still P0.\nSOURCE_6_LINE=kb/private/archive/2026-08-19/docs/20_NETBIRD_USA_MIGRATION_2026-08-18.md:20:- temporary hostname `nb2`\nSOURCE_7_LINE=kb/runbooks/04_NETBIRD_USA.md:3:Current production: `[IP_REDACTED]`, NetBird `0.73.2`, hostname `nb2`.\nSOURCE_8_LINE=kb/private/archive/2026-08-19/docs/01_CURRENT_AUTHORITATIVE_STATE.md:183:## 6. New USA NetBird production\nSOURCE_9_LINE=kb/AI_CONTEXT.md:32:Production NetBird is new USA `[IP_REDACTED]`, Debian 12, hostname `nb2`, NetBird `0.73.2`. Exact deployment caveat: `/api/health` = 404 and combined `:9000/health` = 503; these are not generic readiness gates for this deployment. Old USA `[IP_REDACTED]` has Mailcow/NetBird server stopped and observer disabled, but remains in rollback window. Permanent new-USA operator SSH hardening is still P0.\nSOURCE_10_LINE=kb/private/archive/2026-08-19/docs/20_NETBIRD_USA_MIGRATION_2026-08-18.md:20:- temporary hostname `nb2`\nSOURCE_11_LINE=kb/runbooks/04_NETBIRD_USA.md:3:Current production: `[IP_REDACTED]`, NetBird `0.73.2`, hostname `nb2`.\nSOURCE_12_LINE=kb/private/archive/2026-08-19/docs/01_CURRENT_AUTHORITATIVE_STATE.md:183:## 6. New USA NetBird production\nSOURCE_13_LINE=kb/AI_CONTEXT.md:32:Production NetBird is new USA `[IP_REDACTED]`, Debian 12, hostname `nb2`, NetBird `0.73.2`. Exact deployment caveat: `/api/health` = 404 and combined `:9000/health` = 503; these are not generic readiness gates for this deployment. Old USA `[IP_REDACTED]` has Mailcow/NetBird server stopped and observer disabled, but remains in rollback window. Permanent new-USA operator SSH hardening is still P0.\nSOURCE_14_LINE=kb/private/archive/2026-08-19/docs/20_NETBIRD_USA_MIGRATION_2026-08-18.md:20:- temporary hostname `nb2`\nSOURCE_15_LINE=kb/runbooks/04_NETBIRD_USA.md:3:Current production: `[IP_REDACTED]`, NetBird `0.73.2`, hostname `nb2`.\nSOURCE_16_LINE=kb/private/archive/2026-08-19/docs/01_CURRENT_AUTHORITATIVE_STATE.md:183:## 6. New USA NetBird production\nSOURCE_17_LINE=kb/AI_CONTEXT.md:32:Production NetBird is new USA `[IP_REDACTED]`, Debian 12, hostname `nb2`, NetBird `0.73.2`. Exact deployment caveat: `/api/health` = 404 and combined `:9000/health` = 503; these are not generic readiness gates for this deployment. Old USA `[IP_REDACTED]` has Mailcow/NetBird server stopped and observer disabled, but remains in rollback window. Permanent new-USA operator SSH hardening is still P0.\nSOURCE_18_LINE=kb/private/archive/2026-08-19/docs/20_NETBIRD_USA_MIGRATION_2026-08-18.md:20:- temporary hostname `nb2`\nSOURCE_19_LINE=kb/runbooks/04_NETBIRD_USA.md:3:Current production: `[IP_REDACTED]`, NetBird `0.73.2`, hostname `nb2`.\nSOURCE_20_LINE=kb/private/archive/2026-08-19/docs/01_CURRENT_AUTHORITATIVE_STATE.md:183:## 6. New USA NetBird production\nSOURCE_21_LINE=kb/AI_CONTEXT.md:32:Production NetBird is new USA `[IP_REDACTED]`, Debian 12, hostname `nb2`, NetBird `0.73.2`. Exact deployment caveat: `/api/health` = 404 and combined `:9000/health` = 503; these are not generic readiness gates for this deployment. Old USA `[IP_REDACTED]` has Mailcow/NetBird server stopped and observer disabled, but remains in rollback window. Permanent new-USA operator SSH hardening is still P0.\nSOURCE_22_LINE=kb/private/archive/2026-08-19/docs/20_NETBIRD_USA_MIGRATION_2026-08-18.md:20:- temporary hostname `nb2`\nSOURCE_23_LINE=kb/runbooks/04_NETBIRD_USA.md:3:Current production: `[IP_REDACTED]`, NetBird `0.73.2`, hostname `nb2`.\nSOURCE_24_LINE=kb/private/archive/2026-08-19/docs/01_CURRENT_AUTHORITATIVE_STATE.md:183:## 6. New USA NetBird production\nSOURCE_25_LINE=kb/AI_CONTEXT.md:32:Production NetBird is new USA `[IP_REDACTED]`, Debian 12, hostname `nb2`, NetBird `0.73.2`. Exact deployment caveat: `/api/health` = 404 and combined `:9000/health` = 503; these are not generic readiness gates for this deployment. Old USA `[IP_REDACTED]` has Mailcow/NetBird server stopped and observer disabled, but remains in rollback window. Permanent new-USA operator SSH hardening is still P0.\nSOURCE_26_LINE=kb/private/archive/2026-08-19/docs/20_NETBIRD_USA_MIGRATION_2026-08-18.md:20:- temporary hostname `nb2`\nSOURCE_27_LINE=kb/runbooks/04_NETBIRD_USA.md:3:Current production: `[IP_REDACTED]`, NetBird `0.73.2`, hostname `nb2`.\nSOURCE_28_LINE=kb/private/archive/2026-08-19/docs/01_CURRENT_AUTHORITATIVE_STATE.md:183:## 6. New USA NetBird production\nSOURCE_29_LINE=kb/AI_CONTEXT.md:32:Production NetBird is new USA `[IP_REDACTED]`, Debian 12, hostname `nb2`, NetBird `0.73.2`. Exact deployment caveat: `/api/health` = 404 and combined `:9000/health` = 503; these are not generic readiness gates for this deployment. Old USA `[IP_REDACTED]` has Mailcow/NetBird server stopped and observer disabled, but remains in rollback window. Permanent new-USA operator SSH hardening is still P0.\nSOURCE_30_LINE=kb/private/archive/2026-08-19/docs/20_NETBIRD_USA_MIGRATION_2026-08-18.md:20:- temporary hostname `nb2`\nSOURCE_31_LINE=kb/runbooks/04_NETBIRD_USA.md:3:Current production: `[IP_REDACTED]`, NetBird `0.73.2`, hostname `nb2`.\nSOURCE_32_LINE=kb/private/archive/2026-08-19/docs/01_CURRENT_AUTHORITATIVE_STATE.md:183:## 6. New USA NetBird production\nSOURCE_33_LINE=kb/AI_CONTEXT.md:32:Production NetBird is new USA `[IP_REDACTED]`, Debian 12, hostname `nb2`, NetBird `0.73.2`. Exact deployment caveat: `/api/health` = 404 and combined `:9000/health` = 503; these are not generic readiness gates for this deployment. Old USA `[IP_REDACTED]` has Mailcow/NetBird server stopped and observer disabled, but remains in rollback window. Permanent new-USA operator SSH hardening is still P0.\nSOURCE_34_LINE=kb/private/archive/2026-08-19/docs/20_NETBIRD_USA_MIGRATION_2026-08-18.md:20:- temporary hostname `nb2`\nSOURCE_35_LINE=kb/runbooks/04_NETBIRD_USA.md:3:Current production: `[IP_REDACTED]`, NetBird `0.73.2`, hostname `nb2`.\nSOURCE_36_LINE=kb/private/archive/2026-08-19/docs/01_CURRENT_AUTHORITATIVE_STATE.md:183:## 6. New USA NetBird production\nSOURCE_37_LINE=kb/AI_CONTEXT.md:32:Production NetBird is new USA `[IP_REDACTED]`, Debian 12, hostname `nb2`, NetBird `0.73.2`. Exact deployment caveat: `/api/health` = 404 and combined `:9000/health` = 503; these are not generic readiness gates for this deployment. Old USA `[IP_REDACTED]` has Mailcow/NetBird server stopped and observer disabled, but remains in rollback window. Permanent new-USA operator SSH hardening is still P0.\nSOURCE_38_LINE=kb/private/archive/2026-08-19/docs/20_NETBIRD_USA_MIGRATION_2026-08-18.md:20:- temporary hostname `nb2`\nSOURCE_39_LINE=kb/runbooks/04_NETBIRD_USA.md:3:Current production: `[IP_REDACTED]`, NetBird `0.73.2`, hostname `nb2`.\nSOURCE_40_LINE=kb/private/archive/2026-08-19/docs/01_CURRENT_AUTHORITATIVE_STATE.md:183:## 6. New USA NetBird production\nSOURCE_41_LINE=kb/AI_CONTEXT.md:32:Production NetBird is new USA `[IP_REDACTED]`, Debian 12, hostname `nb2`, NetBird `0.73.2`. Exact deployment caveat: `/api/health` = 404 and combined `:9000/health` = 503; these are not generic readiness gates for this deployment. Old USA `[IP_REDACTED]` has Mailcow/NetBird server stopped and observer disabled, but remains in rollback window. Permanent new-USA operator SSH hardening is still P0.\nSOURCE_42_LINE=kb/private/archive/2026-08-19/docs/20_NETBIRD_USA_MIGRATION_2026-08-18.md:20:- temporary hostname `nb2`\nSOURCE_43_LINE=kb/runbooks/04_NETBIRD_USA.md:3:Current production: `[IP_REDACTED]`, NetBird `0.73.2`, hostname `nb2`.\nSOURCE_44_LINE=kb/private/archive/2026-08-19/docs/01_CURRENT_AUTHORITATIVE_STATE.md:183:## 6. New USA NetBird production\nSOURCE_45_LINE=kb/AI_CONTEXT.md:32:Production NetBird is new USA `[IP_REDACTED]`, Debian 12, hostname `nb2`, NetBird `0.73.2`. Exact deployment caveat: `/api/health` = 404 and combined `:9000/health` = 503; these are not generic readiness gates for this deployment. Old USA `[IP_REDACTED]` has Mailcow/NetBird server stopped and observer disabled, but remains in rollback window. Permanent new-USA operator SSH hardening is still P0.\nSOURCE_46_LINE=kb/private/archive/2026-08-19/docs/20_NETBIRD_USA_MIGRATION_2026-08-18.md:20:- temporary hostname `nb2`\nSOURCE_47_LINE=kb/runbooks/04_NETBIRD_USA.md:3:Current production: `[IP_REDACTED]`, NetBird `0.73.2`, hostname `nb2`.\nSOURCE_48_LINE=kb/private/archive/2026-08-19/docs/01_CURRENT_AUTHORITATIVE_STATE.md:183:## 6. New USA NetBird production\nSOURCE_49_LINE=kb/AI_CONTEXT.md:32:Production NetBird is new USA `[IP_REDACTED]`, Debian 12, hostname `nb2`, NetBird `0.73.2`. Exact deployment caveat: `/api/health` = 404 and combined `:9000/health` = 503; these are not generic readiness gates for this deployment. Old USA `[IP_REDACTED]` has Mailcow/NetBird server stopped and observer disabled, but remains in rollback window. Permanent new-USA operator SSH hardening is still P0.\nSOURCE_50_LINE=kb/private/archive/2026-08-19/docs/20_NETBIRD_USA_MIGRATION_2026-08-18.md:20:- temporary hostname `nb2`\nSOURCE_51_LINE=kb/runbooks/04_NETBIRD_USA.md:3:Current production: `[IP_REDACTED]`, NetBird `0.73.2`, hostname `nb2`.\nSOURCE_52_LINE=kb/private/archive/2026-08-19/docs/01_CURRENT_AUTHORITATIVE_STATE.md:183:## 6. New USA NetBird production\nSOURCE_53_LINE=kb/AI_CONTEXT.md:32:Production NetBird is new USA `[IP_REDACTED]`, Debian 12, hostname `nb2`, NetBird `0.73.2`. Exact deployment caveat: `/api/health` = 404 and combined `:9000/health` = 503; these are not generic readiness gates for this deployment. Old USA `[IP_REDACTED]` has Mailcow/NetBird server stopped and observer disabled, but remains in rollback window. Permanent new-USA operator SSH hardening is still P0.\nSOURCE_54_LINE=kb/private/archive/2026-08-19/docs/20_NETBIRD_USA_MIGRATION_2026-08-18.md:20:- temporary hostname `nb2`\nSOURCE_55_LINE=kb/runbooks/04_NETBIRD_USA.md:3:Current production: `[IP_REDACTED]`, NetBird `0.73.2`, hostname `nb2`.\nSOURCE_56_LINE=kb/private/archive/2026-08-19/docs/01_CURRENT_AUTHORITATIVE_STATE.md:183:## 6. New USA NetBird production\nSOURCE_57_LINE=kb/AI_CONTEXT.md:32:Production NetBird is new USA `[IP_REDACTED]`, Debian 12, hostname `nb2`, NetBird `0.73.2`. Exact deployment caveat: `/api/health` = 404 and combined `:9000/health` = 503; these are not generic readiness gates for this deployment. Old USA `[IP_REDACTED]` has Mailcow/NetBird server stopped and observer disabled, but remains in rollback window. Permanent new-USA operator SSH hardening is still P0.\nSOURCE_58_LINE=kb/private/archive/2026-08-19/docs/20_NETBIRD_USA_MIGRATION_2026-08-18.md:20:- temporary hostname `nb2`\nSOURCE_59_LINE=kb/runbooks/04_NETBIRD_USA.md:3:Current production: `[IP_REDACTED]`, NetBird `0.73.2`, hostname `nb2`.\nSOURCE_60_LINE=kb/private/archive/2026-08-19/docs/01_CURRENT_AUTHORITATIVE_STATE.md:183:## 6. New USA NetBird production\nSOURCE_61_LINE=kb/AI_CONTEXT.md:32:Production NetBird is new USA `[IP_REDACTED]`, Debian 12, hostname `nb2`, NetBird `0.73.2`. Exact deployment caveat: `/api/health` = 404 and combined `:9000/health` = 503; these are not generic readiness gates for this deployment. Old USA `[IP_REDACTED]` has Mailcow/NetBird server stopped and observer disabled, but remains in rollback window. Permanent new-USA operator SSH hardening is still P0.\nSOURCE_62_LINE=kb/private/archive/2026-08-19/docs/20_NETBIRD_USA_MIGRATION_2026-08-18.md:20:- temporary hostname `nb2`\nSOURCE_63_LINE=kb/runbooks/04_NETBIRD_USA.md:3:Current production: `[IP_REDACTED]`, NetBird `0.73.2`, hostname `nb2`.\nSOURCE_64_LINE=kb/private/archive/2026-08-19/docs/01_CURRENT_AUTHORITATIVE_STATE.md:183:## 6. New USA NetBird production\nSOURCE_65_LINE=kb/AI_CONTEXT.md:32:Production NetBird is new USA `[IP_REDACTED]`, Debian 12, hostname `nb2`, NetBird `0.73.2`. Exact deployment caveat: `/api/health` = 404 and combined `:9000/health` = 503; these are not generic readiness gates for this deployment. Old USA `[IP_REDACTED]` has Mailcow/NetBird server stopped and observer disabled, but remains in rollback window. Permanent new-USA operator SSH hardening is still P0.\nSOURCE_66_LINE=kb/private/archive/2026-08-19/docs/20_NETBIRD_USA_MIGRATION_2026-08-18.md:20:- temporary hostname `nb2`\nSOURCE_67_LINE=kb/runbooks/04_NETBIRD_USA.md:3:Current production: `[IP_REDACTED]`, NetBird `0.73.2`, hostname `nb2`.\nSOURCE_68_LINE=kb/private/archive/2026-08-19/docs/01_CURRENT_AUTHORITATIVE_STATE.md:183:## 6. New USA NetBird production\nSOURCE_69_LINE=kb/AI_CONTEXT.md:32:Production NetBird is new USA `[IP_REDACTED]`, Debian 12, hostname `nb2`, NetBird `0.73.2`. Exact deployment caveat: `/api/health` = 404 and combined `:9000/health` = 503; these are not generic readiness gates for this deployment. Old USA `[IP_REDACTED]` has Mailcow/NetBird server stopped and observer disabled, but remains in rollback window. Permanent new-USA operator SSH hardening is still P0.\nSOURCE_70_LINE=kb/private/archive/2026-08-19/docs/20_NETBIRD_USA_MIGRATION_2026-08-18.md:20:- temporary hostname `nb2`\nSOURCE_71_LINE=kb/runbooks/04_NETBIRD_USA.md:3:Current production: `[IP_REDACTED]`, NetBird `0.73.2`, hostname `nb2`.\nSOURCE_72_LINE=kb/private/archive/2026-08-19/docs/01_CURRENT_AUTHORITATIVE_STATE.md:183:## 6. New USA NetBird production\nSOURCE_73_LINE=kb/AI_CONTEXT.md:32:Production NetBird is new USA `[IP_REDACTED]`, Debian 12, hostname `nb2`, NetBird `0.73.2`. Exact deployment caveat: `/api/health` = 404 and combined `:9000/health` = 503; these are not generic readiness gates for this deployment. Old USA `[IP_REDACTED]` has Mailcow/NetBird server stopped and observer disabled, but remains in rollback window. Permanent new-USA operator SSH hardening is still P0.\nSOURCE_74_LINE=kb/private/archive/2026-08-19/docs/20_NETBIRD_USA_MIGRATION_2026-08-18.md:20:- temporary hostname `nb2`\nSOURCE_75_LINE=kb/runbooks/04_NETBIRD_USA.md:3:Current production: `[IP_REDACTED]`, NetBird `0.73.2`, hostname `nb2`.\nSOURCE_76_LINE=kb/private/archive/2026-08-19/docs/01_CURRENT_AUTHORITATIVE_STATE.md:183:## 6. New USA NetBird production\nSOURCE_77_LINE=kb/AI_CONTEXT.md:32:Production NetBird is new USA `[IP_REDACTED]`, Debian 12, hostname `nb2`, NetBird `0.73.2`. Exact deployment caveat: `/api/health` = 404 and combined `:9000/health` = 503; these are not generic readiness gates for this deployment. Old USA `[IP_REDACTED]` has Mailcow/NetBird server stopped and observer disabled, but remains in rollback window. Permanent new-USA operator SSH hardening is still P0.\nSOURCE_78_LINE=kb/private/archive/2026-08-19/docs/20_NETBIRD_USA_MIGRATION_2026-08-18.md:20:- temporary hostname `nb2`\nSOURCE_79_LINE=kb/runbooks/04_NETBIRD_USA.md:3:Current production: `[IP_REDACTED]`, NetBird `0.73.2`, hostname `nb2`.\nSOURCE_80_LINE=kb/private/archive/2026-08-19/docs/01_CURRENT_AUTHORITATIVE_STATE.md:183:## 6. New USA NetBird production\nSOURCE_MATCH_COUNT=80\nNB_SSH_TRY_e16ce208_RC=255\nNB_SERVER_REACHABLE=false\nRCA_CLASS=NETBIRD_SERVER_NOT_REACHABLE_FROM_PVE01\nDECISION=HOLD_NETBIRD_PEER_DNS_POLICY_RCA\nNEXT_GATE=NETBIRD_SERVER_ACCESS_RECONCILE\nTASK_RESULT=HOME_GRAM1_NETBIRD_PEER_DNS_POLICY_RCA\nCHANGES_MADE=false\nROLLBACK_STARTED=false\nROLLBACK_RESTORED=null\nMUTATION_OUTCOME=NO_MUTATION\n"
 }
diff --git a/runtime/latest.txt b/runtime/latest.txt
index 5a545efc..b7f70494 100644
--- a/runtime/latest.txt
+++ b/runtime/latest.txt
@@ -1,22 +1,22 @@
 CHAT_OUTPUT_BEGIN
-COMMAND_ID=SUPPORT-261005-SNIKKET-HOSTNAME-RESULT-RELAY-99599R1
-STATUS=OK
-RC=0
+COMMAND_ID=SUPPORT-261005-HOME-GRAM1-NETBIRD-PEER-DNS-POLICY-RCA-99599R1
+STATUS=FAIL
+RC=52
 HOST=pve01
 MODE=read-only
-COMPONENT=snikket-hostname-result-relay
+COMPONENT=home-gram1-netbird-peer-dns-policy-rca
 REFERENCE_REGISTER_CHECK=OK
 REFERENCE_SHA256=5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66
 ERROR_REGISTER_CHECK=OK
 ERROR_REGISTER_SHA256=3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0
-COMMAND_SHA256=4ee9530ed716738043f6c859438a04ef2b0c016ba133c2aa76aec4b6b8e16f5c
+COMMAND_SHA256=a57b891fd2971bb26a4c101ed2507e8c6833907b817e0de6daee5ff3a5d28e63
 DUPLICATE_FAILED_COMMAND_BLOCKED=false
 EXECUTION_STARTED=true
 CHANGE_DECLARED=false
 RESULT_CONTRACT_VALID=true
 RESULT_CONTRACT_STATUS=NOT_APPLICABLE
 RESULT_CONTRACT_ERROR=NONE
-COMMAND_RC=0
+COMMAND_RC=52
 CHANGES_MADE=false
 ROLLBACK_STARTED=false
 ROLLBACK_RESTORED=null
@@ -24,86 +24,122 @@ MUTATION_OUTCOME=NO_MUTATION
 SANITIZED=yes
 SECRETS_INCLUDED=no
 PRIVATE_ADDRESSES_INCLUDED=no
-RAW_EVIDENCE_SHA256=83ab2d0bdcf82cde20c209b76bb02ddc033e4c854de697f319ea347e9f0c5623
-SANITIZED_OUTPUT_SHA256=83ab2d0bdcf82cde20c209b76bb02ddc033e4c854de697f319ea347e9f0c5623
+RAW_EVIDENCE_SHA256=3e4f1879b00ba16d89d6709bc923bab558aa7be4cbca2319e9cfcdfef16019ad
+SANITIZED_OUTPUT_SHA256=3e4f1879b00ba16d89d6709bc923bab558aa7be4cbca2319e9cfcdfef16019ad
 OUTPUT_BEGIN
-SNIKKET_HOSTNAME_RESULT_RELAY=V1
+HOME_GRAM1_NETBIRD_PEER_DNS_POLICY_RCA=V1
+NO_LOCAL_WINDOWS_MUTATION=true
+NO_NETBIRD_CLIENT_MUTATION=true
+NO_NETBIRD_SERVER_MUTATION=true
+NO_DNS_POLICY_MUTATION=true
+NO_GROUP_MUTATION=true
+NO_SERVER_RESTART=true
 MODE=read-only
-NO_VM_MUTATION=true
-NO_BACKUP_MUTATION=true
-NO_SOURCE_MUTATION=true
-NO_MONITOR_MUTATION=true
-NO_DNS_MUTATION=true
-SELF_EXACT_CODE_1=404
-SELF_EXACT_CODE_2=404
-SELF_EXACT_CODE_3=404
-SELF_EXACT_CODE_4=404
-SELF_EXACT_404X4=true
-PREV_TXT_HTTP=200
-PREV_JSON_HTTP=200
-HEAD_HTTP=200
-PREV_COMMAND_ID_MATCH=true
-PREV_STATUS=OK
-PREV_RC=0
-PREV_MODE=read-only
-PREV_COMPONENT=snikket-restored-hostname-rca
-PREV_CHANGES_MADE=false
-PREV_SANITIZED=true
-HEAD_ID=8820ed9ea3d7ff42ff7741b41cfac3935ea86c9f
-HEAD_MESSAGE_SHA256=cda47bc4f0475b9a0f766b71330096f364befa891c91d9ab5f175ac58ea4f06d
-HEAD_IS_PREV=false
-VM150_RUNNING=true
-VM150_QGA=true
-VM150_CONFIG_MATCH_KNOWN=true
-VM150_PVE_NAME_PRESENT=true
-VM150_PVE_NAME_SNIKKET=true
-VM150_CLOUDINIT_CONFIG_LINE_COUNT=1
-VM150_HAS_CLOUDINIT_DRIVE=true
-VM150_CIUSER_PRESENT=true
-VM150_CICUSTOM_PRESENT=false
-VM150_IPCONFIG_PRESENT=true
-QM_CLOUDINIT_DUMP_META_RC=0
-QM_CLOUDINIT_DUMP_USER_RC=0
-QM_CLOUDINIT_DUMP_NETWORK_RC=0
-CI_META_LOCAL_HOSTNAME_PRESENT=false
-CI_META_LOCAL_HOSTNAME_SNIKKET=false
-CI_META_INSTANCE_ID_PRESENT=true
-VM150_GUEST_EXITCODE=0
-VM150_GUEST_MARKER=true
-CLOUD_INIT_PRESENT=true
-CLOUD_PRESERVE_HOSTNAME_COUNT=1
-CLOUD_PRESERVE_HOSTNAME_1=false
-CLOUD_MANAGE_ETC_HOSTS_COUNT=0
-CLOUD_DATASOURCE_LIST_COUNT=0
-CLOUD_INSTANCE_ID_PRESENT=true
-QEMU_BOOT_DEF_PRESENT=true
-QEMU_BOOT_ARGS=archive,tempid,wait_sec,run_id
-QEMU_BOOT_SETS_NAME=false
-QEMU_BOOT_NAME_PREFIX_DRILL=false
-QEMU_BOOT_DELETES_NETWORK=false
-QEMU_BOOT_SETS_ONBOOT_ZERO=false
-QEMU_BOOT_STARTS_VM=true
-QEMU_BOOT_TOUCHES_CLOUDINIT=false
-FRESH_STATE_PRESENT=true
-FRESH_RESTORE_PRESENT=true
-TEMP_VM_9600_PRESENT=false
-PUBLIC_DNS_OK_COUNT=3
-PUBLIC_HTTPS_OK_COUNT=3
-PUBLIC_STUN_3479_PASS=true
-HOSTNAME_RCA_COMPLETE=true
-DECISION=ANALYZE_EXACT_99598_HOSTNAME_EFFECT
-NEXT_GATE=SNIKKET_FINAL_OPS_SEAL_OR_TARGETED_BACKUP_FIX
-TASK_RESULT=SNIKKET_RESTORED_HOSTNAME_RCA
-CLOUD_INIT_CAN_MANAGE_HOSTNAME=true
-HOSTNAME_HARNESS_EFFECT_PROVEN=false
-QEMU_BOOT_SOURCE_B64_SELECTED_SHA256=b0bda1f610e26501b6d4dbc6ccdb91c695a19cc3d4f4f7918d9ead7cb1845b58
-QEMU_BOOT_SOURCE_B64_SELECTED_B64=NjI1OiAgICBydW5fdHR5KFtRTSwic3RhcnQiLHN0cih0ZW1waWQpXSx0aW1lb3V0PTEyMCk=
-CLOUD_INIT_STATUS_B64_SELECTED_SHA256=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
-CLOUD_INIT_STATUS_B64_SELECTED_B64=
-RELAY_PASS=true
-DECISION=ANALYZE_RELAYED_99598
-NEXT_GATE=FINAL_SEAL_OR_TARGETED_FIX
-TASK_RESULT=PASS_SNIKKET_HOSTNAME_RESULT_RELAY
+HOST_PVE01=true
+L_PEER_DIAG_OK=true
+L_NB_PRESENT=true
+L_NB_CONNECTED=true
+L_NB_STATUS_SHA=MISSING
+L_NB_DETAIL_SHA=MISSING
+L_PC_HOSTNAME_SHA=MISSING
+L_NB_ADAPTER_COUNT=1
+L_NB_IP_COUNT=1
+L_NB_IP_1_SHA=MISSING
+L_NB_IP_2_SHA=MISSING
+L_NB_IP_3_SHA=MISSING
+L_NB_IP_4_SHA=MISSING
+L_NB_IP_5_SHA=MISSING
+L_STATUS_HOSTNAME_HINT_SHA=MISSING
+L_STATUS_IP_HINT_SHA=MISSING
+L_HOME_DNS_COUNT=1
+NB_SSH_ALIAS_COUNT=0
+SOURCE_1_LINE=kb/AI_CONTEXT.md:32:Production NetBird is new USA `[IP_REDACTED]`, Debian 12, hostname `nb2`, NetBird `0.73.2`. Exact deployment caveat: `/api/health` = 404 and combined `:9000/health` = 503; these are not generic readiness gates for this deployment. Old USA `[IP_REDACTED]` has Mailcow/NetBird server stopped and observer disabled, but remains in rollback window. Permanent new-USA operator SSH hardening is still P0.
+SOURCE_2_LINE=kb/private/archive/2026-08-19/docs/20_NETBIRD_USA_MIGRATION_2026-08-18.md:20:- temporary hostname `nb2`
+SOURCE_3_LINE=kb/runbooks/04_NETBIRD_USA.md:3:Current production: `[IP_REDACTED]`, NetBird `0.73.2`, hostname `nb2`.
+SOURCE_4_LINE=kb/private/archive/2026-08-19/docs/01_CURRENT_AUTHORITATIVE_STATE.md:183:## 6. New USA NetBird production
+SOURCE_5_LINE=kb/AI_CONTEXT.md:32:Production NetBird is new USA `[IP_REDACTED]`, Debian 12, hostname `nb2`, NetBird `0.73.2`. Exact deployment caveat: `/api/health` = 404 and combined `:9000/health` = 503; these are not generic readiness gates for this deployment. Old USA `[IP_REDACTED]` has Mailcow/NetBird server stopped and observer disabled, but remains in rollback window. Permanent new-USA operator SSH hardening is still P0.
+SOURCE_6_LINE=kb/private/archive/2026-08-19/docs/20_NETBIRD_USA_MIGRATION_2026-08-18.md:20:- temporary hostname `nb2`
+SOURCE_7_LINE=kb/runbooks/04_NETBIRD_USA.md:3:Current production: `[IP_REDACTED]`, NetBird `0.73.2`, hostname `nb2`.
+SOURCE_8_LINE=kb/private/archive/2026-08-19/docs/01_CURRENT_AUTHORITATIVE_STATE.md:183:## 6. New USA NetBird production
+SOURCE_9_LINE=kb/AI_CONTEXT.md:32:Production NetBird is new USA `[IP_REDACTED]`, Debian 12, hostname `nb2`, NetBird `0.73.2`. Exact deployment caveat: `/api/health` = 404 and combined `:9000/health` = 503; these are not generic readiness gates for this deployment. Old USA `[IP_REDACTED]` has Mailcow/NetBird server stopped and observer disabled, but remains in rollback window. Permanent new-USA operator SSH hardening is still P0.
+SOURCE_10_LINE=kb/private/archive/2026-08-19/docs/20_NETBIRD_USA_MIGRATION_2026-08-18.md:20:- temporary hostname `nb2`
+SOURCE_11_LINE=kb/runbooks/04_NETBIRD_USA.md:3:Current production: `[IP_REDACTED]`, NetBird `0.73.2`, hostname `nb2`.
+SOURCE_12_LINE=kb/private/archive/2026-08-19/docs/01_CURRENT_AUTHORITATIVE_STATE.md:183:## 6. New USA NetBird production
+SOURCE_13_LINE=kb/AI_CONTEXT.md:32:Production NetBird is new USA `[IP_REDACTED]`, Debian 12, hostname `nb2`, NetBird `0.73.2`. Exact deployment caveat: `/api/health` = 404 and combined `:9000/health` = 503; these are not generic readiness gates for this deployment. Old USA `[IP_REDACTED]` has Mailcow/NetBird server stopped and observer disabled, but remains in rollback window. Permanent new-USA operator SSH hardening is still P0.
+SOURCE_14_LINE=kb/private/archive/2026-08-19/docs/20_NETBIRD_USA_MIGRATION_2026-08-18.md:20:- temporary hostname `nb2`
+SOURCE_15_LINE=kb/runbooks/04_NETBIRD_USA.md:3:Current production: `[IP_REDACTED]`, NetBird `0.73.2`, hostname `nb2`.
+SOURCE_16_LINE=kb/private/archive/2026-08-19/docs/01_CURRENT_AUTHORITATIVE_STATE.md:183:## 6. New USA NetBird production
+SOURCE_17_LINE=kb/AI_CONTEXT.md:32:Production NetBird is new USA `[IP_REDACTED]`, Debian 12, hostname `nb2`, NetBird `0.73.2`. Exact deployment caveat: `/api/health` = 404 and combined `:9000/health` = 503; these are not generic readiness gates for this deployment. Old USA `[IP_REDACTED]` has Mailcow/NetBird server stopped and observer disabled, but remains in rollback window. Permanent new-USA operator SSH hardening is still P0.
+SOURCE_18_LINE=kb/private/archive/2026-08-19/docs/20_NETBIRD_USA_MIGRATION_2026-08-18.md:20:- temporary hostname `nb2`
+SOURCE_19_LINE=kb/runbooks/04_NETBIRD_USA.md:3:Current production: `[IP_REDACTED]`, NetBird `0.73.2`, hostname `nb2`.
+SOURCE_20_LINE=kb/private/archive/2026-08-19/docs/01_CURRENT_AUTHORITATIVE_STATE.md:183:## 6. New USA NetBird production
+SOURCE_21_LINE=kb/AI_CONTEXT.md:32:Production NetBird is new USA `[IP_REDACTED]`, Debian 12, hostname `nb2`, NetBird `0.73.2`. Exact deployment caveat: `/api/health` = 404 and combined `:9000/health` = 503; these are not generic readiness gates for this deployment. Old USA `[IP_REDACTED]` has Mailcow/NetBird server stopped and observer disabled, but remains in rollback window. Permanent new-USA operator SSH hardening is still P0.
+SOURCE_22_LINE=kb/private/archive/2026-08-19/docs/20_NETBIRD_USA_MIGRATION_2026-08-18.md:20:- temporary hostname `nb2`
+SOURCE_23_LINE=kb/runbooks/04_NETBIRD_USA.md:3:Current production: `[IP_REDACTED]`, NetBird `0.73.2`, hostname `nb2`.
+SOURCE_24_LINE=kb/private/archive/2026-08-19/docs/01_CURRENT_AUTHORITATIVE_STATE.md:183:## 6. New USA NetBird production
+SOURCE_25_LINE=kb/AI_CONTEXT.md:32:Production NetBird is new USA `[IP_REDACTED]`, Debian 12, hostname `nb2`, NetBird `0.73.2`. Exact deployment caveat: `/api/health` = 404 and combined `:9000/health` = 503; these are not generic readiness gates for this deployment. Old USA `[IP_REDACTED]` has Mailcow/NetBird server stopped and observer disabled, but remains in rollback window. Permanent new-USA operator SSH hardening is still P0.
+SOURCE_26_LINE=kb/private/archive/2026-08-19/docs/20_NETBIRD_USA_MIGRATION_2026-08-18.md:20:- temporary hostname `nb2`
+SOURCE_27_LINE=kb/runbooks/04_NETBIRD_USA.md:3:Current production: `[IP_REDACTED]`, NetBird `0.73.2`, hostname `nb2`.
+SOURCE_28_LINE=kb/private/archive/2026-08-19/docs/01_CURRENT_AUTHORITATIVE_STATE.md:183:## 6. New USA NetBird production
+SOURCE_29_LINE=kb/AI_CONTEXT.md:32:Production NetBird is new USA `[IP_REDACTED]`, Debian 12, hostname `nb2`, NetBird `0.73.2`. Exact deployment caveat: `/api/health` = 404 and combined `:9000/health` = 503; these are not generic readiness gates for this deployment. Old USA `[IP_REDACTED]` has Mailcow/NetBird server stopped and observer disabled, but remains in rollback window. Permanent new-USA operator SSH hardening is still P0.
+SOURCE_30_LINE=kb/private/archive/2026-08-19/docs/20_NETBIRD_USA_MIGRATION_2026-08-18.md:20:- temporary hostname `nb2`
+SOURCE_31_LINE=kb/runbooks/04_NETBIRD_USA.md:3:Current production: `[IP_REDACTED]`, NetBird `0.73.2`, hostname `nb2`.
+SOURCE_32_LINE=kb/private/archive/2026-08-19/docs/01_CURRENT_AUTHORITATIVE_STATE.md:183:## 6. New USA NetBird production
+SOURCE_33_LINE=kb/AI_CONTEXT.md:32:Production NetBird is new USA `[IP_REDACTED]`, Debian 12, hostname `nb2`, NetBird `0.73.2`. Exact deployment caveat: `/api/health` = 404 and combined `:9000/health` = 503; these are not generic readiness gates for this deployment. Old USA `[IP_REDACTED]` has Mailcow/NetBird server stopped and observer disabled, but remains in rollback window. Permanent new-USA operator SSH hardening is still P0.
+SOURCE_34_LINE=kb/private/archive/2026-08-19/docs/20_NETBIRD_USA_MIGRATION_2026-08-18.md:20:- temporary hostname `nb2`
+SOURCE_35_LINE=kb/runbooks/04_NETBIRD_USA.md:3:Current production: `[IP_REDACTED]`, NetBird `0.73.2`, hostname `nb2`.
+SOURCE_36_LINE=kb/private/archive/2026-08-19/docs/01_CURRENT_AUTHORITATIVE_STATE.md:183:## 6. New USA NetBird production
+SOURCE_37_LINE=kb/AI_CONTEXT.md:32:Production NetBird is new USA `[IP_REDACTED]`, Debian 12, hostname `nb2`, NetBird `0.73.2`. Exact deployment caveat: `/api/health` = 404 and combined `:9000/health` = 503; these are not generic readiness gates for this deployment. Old USA `[IP_REDACTED]` has Mailcow/NetBird server stopped and observer disabled, but remains in rollback window. Permanent new-USA operator SSH hardening is still P0.
+SOURCE_38_LINE=kb/private/archive/2026-08-19/docs/20_NETBIRD_USA_MIGRATION_2026-08-18.md:20:- temporary hostname `nb2`
+SOURCE_39_LINE=kb/runbooks/04_NETBIRD_USA.md:3:Current production: `[IP_REDACTED]`, NetBird `0.73.2`, hostname `nb2`.
+SOURCE_40_LINE=kb/private/archive/2026-08-19/docs/01_CURRENT_AUTHORITATIVE_STATE.md:183:## 6. New USA NetBird production
+SOURCE_41_LINE=kb/AI_CONTEXT.md:32:Production NetBird is new USA `[IP_REDACTED]`, Debian 12, hostname `nb2`, NetBird `0.73.2`. Exact deployment caveat: `/api/health` = 404 and combined `:9000/health` = 503; these are not generic readiness gates for this deployment. Old USA `[IP_REDACTED]` has Mailcow/NetBird server stopped and observer disabled, but remains in rollback window. Permanent new-USA operator SSH hardening is still P0.
+SOURCE_42_LINE=kb/private/archive/2026-08-19/docs/20_NETBIRD_USA_MIGRATION_2026-08-18.md:20:- temporary hostname `nb2`
+SOURCE_43_LINE=kb/runbooks/04_NETBIRD_USA.md:3:Current production: `[IP_REDACTED]`, NetBird `0.73.2`, hostname `nb2`.
+SOURCE_44_LINE=kb/private/archive/2026-08-19/docs/01_CURRENT_AUTHORITATIVE_STATE.md:183:## 6. New USA NetBird production
+SOURCE_45_LINE=kb/AI_CONTEXT.md:32:Production NetBird is new USA `[IP_REDACTED]`, Debian 12, hostname `nb2`, NetBird `0.73.2`. Exact deployment caveat: `/api/health` = 404 and combined `:9000/health` = 503; these are not generic readiness gates for this deployment. Old USA `[IP_REDACTED]` has Mailcow/NetBird server stopped and observer disabled, but remains in rollback window. Permanent new-USA operator SSH hardening is still P0.
+SOURCE_46_LINE=kb/private/archive/2026-08-19/docs/20_NETBIRD_USA_MIGRATION_2026-08-18.md:20:- temporary hostname `nb2`
+SOURCE_47_LINE=kb/runbooks/04_NETBIRD_USA.md:3:Current production: `[IP_REDACTED]`, NetBird `0.73.2`, hostname `nb2`.
+SOURCE_48_LINE=kb/private/archive/2026-08-19/docs/01_CURRENT_AUTHORITATIVE_STATE.md:183:## 6. New USA NetBird production
+SOURCE_49_LINE=kb/AI_CONTEXT.md:32:Production NetBird is new USA `[IP_REDACTED]`, Debian 12, hostname `nb2`, NetBird `0.73.2`. Exact deployment caveat: `/api/health` = 404 and combined `:9000/health` = 503; these are not generic readiness gates for this deployment. Old USA `[IP_REDACTED]` has Mailcow/NetBird server stopped and observer disabled, but remains in rollback window. Permanent new-USA operator SSH hardening is still P0.
+SOURCE_50_LINE=kb/private/archive/2026-08-19/docs/20_NETBIRD_USA_MIGRATION_2026-08-18.md:20:- temporary hostname `nb2`
+SOURCE_51_LINE=kb/runbooks/04_NETBIRD_USA.md:3:Current production: `[IP_REDACTED]`, NetBird `0.73.2`, hostname `nb2`.
+SOURCE_52_LINE=kb/private/archive/2026-08-19/docs/01_CURRENT_AUTHORITATIVE_STATE.md:183:## 6. New USA NetBird production
+SOURCE_53_LINE=kb/AI_CONTEXT.md:32:Production NetBird is new USA `[IP_REDACTED]`, Debian 12, hostname `nb2`, NetBird `0.73.2`. Exact deployment caveat: `/api/health` = 404 and combined `:9000/health` = 503; these are not generic readiness gates for this deployment. Old USA `[IP_REDACTED]` has Mailcow/NetBird server stopped and observer disabled, but remains in rollback window. Permanent new-USA operator SSH hardening is still P0.
+SOURCE_54_LINE=kb/private/archive/2026-08-19/docs/20_NETBIRD_USA_MIGRATION_2026-08-18.md:20:- temporary hostname `nb2`
+SOURCE_55_LINE=kb/runbooks/04_NETBIRD_USA.md:3:Current production: `[IP_REDACTED]`, NetBird `0.73.2`, hostname `nb2`.
+SOURCE_56_LINE=kb/private/archive/2026-08-19/docs/01_CURRENT_AUTHORITATIVE_STATE.md:183:## 6. New USA NetBird production
+SOURCE_57_LINE=kb/AI_CONTEXT.md:32:Production NetBird is new USA `[IP_REDACTED]`, Debian 12, hostname `nb2`, NetBird `0.73.2`. Exact deployment caveat: `/api/health` = 404 and combined `:9000/health` = 503; these are not generic readiness gates for this deployment. Old USA `[IP_REDACTED]` has Mailcow/NetBird server stopped and observer disabled, but remains in rollback window. Permanent new-USA operator SSH hardening is still P0.
+SOURCE_58_LINE=kb/private/archive/2026-08-19/docs/20_NETBIRD_USA_MIGRATION_2026-08-18.md:20:- temporary hostname `nb2`
+SOURCE_59_LINE=kb/runbooks/04_NETBIRD_USA.md:3:Current production: `[IP_REDACTED]`, NetBird `0.73.2`, hostname `nb2`.
+SOURCE_60_LINE=kb/private/archive/2026-08-19/docs/01_CURRENT_AUTHORITATIVE_STATE.md:183:## 6. New USA NetBird production
+SOURCE_61_LINE=kb/AI_CONTEXT.md:32:Production NetBird is new USA `[IP_REDACTED]`, Debian 12, hostname `nb2`, NetBird `0.73.2`. Exact deployment caveat: `/api/health` = 404 and combined `:9000/health` = 503; these are not generic readiness gates for this deployment. Old USA `[IP_REDACTED]` has Mailcow/NetBird server stopped and observer disabled, but remains in rollback window. Permanent new-USA operator SSH hardening is still P0.
+SOURCE_62_LINE=kb/private/archive/2026-08-19/docs/20_NETBIRD_USA_MIGRATION_2026-08-18.md:20:- temporary hostname `nb2`
+SOURCE_63_LINE=kb/runbooks/04_NETBIRD_USA.md:3:Current production: `[IP_REDACTED]`, NetBird `0.73.2`, hostname `nb2`.
+SOURCE_64_LINE=kb/private/archive/2026-08-19/docs/01_CURRENT_AUTHORITATIVE_STATE.md:183:## 6. New USA NetBird production
+SOURCE_65_LINE=kb/AI_CONTEXT.md:32:Production NetBird is new USA `[IP_REDACTED]`, Debian 12, hostname `nb2`, NetBird `0.73.2`. Exact deployment caveat: `/api/health` = 404 and combined `:9000/health` = 503; these are not generic readiness gates for this deployment. Old USA `[IP_REDACTED]` has Mailcow/NetBird server stopped and observer disabled, but remains in rollback window. Permanent new-USA operator SSH hardening is still P0.
+SOURCE_66_LINE=kb/private/archive/2026-08-19/docs/20_NETBIRD_USA_MIGRATION_2026-08-18.md:20:- temporary hostname `nb2`
+SOURCE_67_LINE=kb/runbooks/04_NETBIRD_USA.md:3:Current production: `[IP_REDACTED]`, NetBird `0.73.2`, hostname `nb2`.
+SOURCE_68_LINE=kb/private/archive/2026-08-19/docs/01_CURRENT_AUTHORITATIVE_STATE.md:183:## 6. New USA NetBird production
+SOURCE_69_LINE=kb/AI_CONTEXT.md:32:Production NetBird is new USA `[IP_REDACTED]`, Debian 12, hostname `nb2`, NetBird `0.73.2`. Exact deployment caveat: `/api/health` = 404 and combined `:9000/health` = 503; these are not generic readiness gates for this deployment. Old USA `[IP_REDACTED]` has Mailcow/NetBird server stopped and observer disabled, but remains in rollback window. Permanent new-USA operator SSH hardening is still P0.
+SOURCE_70_LINE=kb/private/archive/2026-08-19/docs/20_NETBIRD_USA_MIGRATION_2026-08-18.md:20:- temporary hostname `nb2`
+SOURCE_71_LINE=kb/runbooks/04_NETBIRD_USA.md:3:Current production: `[IP_REDACTED]`, NetBird `0.73.2`, hostname `nb2`.
+SOURCE_72_LINE=kb/private/archive/2026-08-19/docs/01_CURRENT_AUTHORITATIVE_STATE.md:183:## 6. New USA NetBird production
+SOURCE_73_LINE=kb/AI_CONTEXT.md:32:Production NetBird is new USA `[IP_REDACTED]`, Debian 12, hostname `nb2`, NetBird `0.73.2`. Exact deployment caveat: `/api/health` = 404 and combined `:9000/health` = 503; these are not generic readiness gates for this deployment. Old USA `[IP_REDACTED]` has Mailcow/NetBird server stopped and observer disabled, but remains in rollback window. Permanent new-USA operator SSH hardening is still P0.
+SOURCE_74_LINE=kb/private/archive/2026-08-19/docs/20_NETBIRD_USA_MIGRATION_2026-08-18.md:20:- temporary hostname `nb2`
+SOURCE_75_LINE=kb/runbooks/04_NETBIRD_USA.md:3:Current production: `[IP_REDACTED]`, NetBird `0.73.2`, hostname `nb2`.
+SOURCE_76_LINE=kb/private/archive/2026-08-19/docs/01_CURRENT_AUTHORITATIVE_STATE.md:183:## 6. New USA NetBird production
+SOURCE_77_LINE=kb/AI_CONTEXT.md:32:Production NetBird is new USA `[IP_REDACTED]`, Debian 12, hostname `nb2`, NetBird `0.73.2`. Exact deployment caveat: `/api/health` = 404 and combined `:9000/health` = 503; these are not generic readiness gates for this deployment. Old USA `[IP_REDACTED]` has Mailcow/NetBird server stopped and observer disabled, but remains in rollback window. Permanent new-USA operator SSH hardening is still P0.
+SOURCE_78_LINE=kb/private/archive/2026-08-19/docs/20_NETBIRD_USA_MIGRATION_2026-08-18.md:20:- temporary hostname `nb2`
+SOURCE_79_LINE=kb/runbooks/04_NETBIRD_USA.md:3:Current production: `[IP_REDACTED]`, NetBird `0.73.2`, hostname `nb2`.
+SOURCE_80_LINE=kb/private/archive/2026-08-19/docs/01_CURRENT_AUTHORITATIVE_STATE.md:183:## 6. New USA NetBird production
+SOURCE_MATCH_COUNT=80
+NB_SSH_TRY_e16ce208_RC=255
+NB_SERVER_REACHABLE=false
+RCA_CLASS=NETBIRD_SERVER_NOT_REACHABLE_FROM_PVE01
+DECISION=HOLD_NETBIRD_PEER_DNS_POLICY_RCA
+NEXT_GATE=NETBIRD_SERVER_ACCESS_RECONCILE
+TASK_RESULT=HOME_GRAM1_NETBIRD_PEER_DNS_POLICY_RCA
 CHANGES_MADE=false
 ROLLBACK_STARTED=false
 ROLLBACK_RESTORED=null