diff --git a/runtime/history/SUPPORT-260923-SPB-SNIKKET-HOME-TOPOLOGY-9212R1.json b/runtime/history/SUPPORT-260923-SPB-SNIKKET-HOME-TOPOLOGY-9212R1.json
new file mode 100644
index 00000000..8b925ffa
--- /dev/null
+++ b/runtime/history/SUPPORT-260923-SPB-SNIKKET-HOME-TOPOLOGY-9212R1.json
@@ -0,0 +1,38 @@
+{
+  "schema_version": 1,
+  "channel": "homelab-runtime",
+  "command_id": "SUPPORT-260923-SPB-SNIKKET-HOME-TOPOLOGY-9212R1",
+  "status": "OK",
+  "rc": 0,
+  "host": "pve01",
+  "mode": "read-only",
+  "component": "spb-snikket-home-topology-preflight",
+  "started_at_utc": "2026-09-23T15:29:19Z",
+  "finished_at_utc": "2026-09-23T15:29:56Z",
+  "reference_register_checked": true,
+  "reference_sha256": "5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66",
+  "error_register_checked": true,
+  "error_register_sha256": "3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0",
+  "command_sha256": "8b782274900f6bc9aa802887320595dc8daddda038b74f5bb47d7037e275cc95",
+  "duplicate_failed_command_blocked": false,
+  "block_reason": null,
+  "execution_started": true,
+  "change_declared": false,
+  "result_contract_valid": true,
+  "result_contract_status": null,
+  "result_contract_error": null,
+  "command_rc": 0,
+  "changes_made": false,
+  "rollback_started": false,
+  "rollback_restored": null,
+  "mutation_outcome": "NO_MUTATION",
+  "sanitized": true,
+  "secrets_included": false,
+  "private_addresses_included": false,
+  "raw_evidence_retained_locally": true,
+  "raw_evidence_sha256": "4647a1f838f614aee3bb390bbb1a36f357f9a8bf88e819fbd5f9d977f7cda299",
+  "sanitized_output_sha256": "4647a1f838f614aee3bb390bbb1a36f357f9a8bf88e819fbd5f9d977f7cda299",
+  "output_truncated_in_json": false,
+  "full_sanitized_output_url": "https://git.gram1.ru/.well-known/homelab-runtime/latest.txt",
+  "output": "SNIKKET9212_BEGIN=true\nMODE=READ_ONLY_TOPOLOGY_PREFLIGHT\nMUTATION_BOUNDARY=NONE;NO_SPB_WRITE;NO_HOME_WRITE;NO_DNS_WRITE;NO_SHUTDOWN\nLOCAL9209_BEGIN=true\nCID=SUPPORT-260923-SPB-SNIKKET-HOME-TOPOLOGY-9212R1\nPLINK_PRESENT=true\nSPB_CANDIDATE_COUNT=1\nSPB_CANDIDATE_SHA16=6d6149f42864ce03\nHOME_CANDIDATE_COUNT=1\nHOME_CANDIDATE_SHA16=bc517b4af3298846\nSPB_HASH_MATCH=true\nSPB_PINNED_PROBE_RC=0\nDPAPI_DECRYPTABLE_COUNT=1\nOLD9208_LOCAL_ERR_SHA16=5a00a4ad6f6ef637\nLOCAL_ACCESS_STATUS=PASS\nLOCAL9209_END=true\nSPB_PINNED_ACCESS=PASS\nSPB_SNIKKET_EXTRACT_RC=0\nSPB_SNIKKET_EXTRACT_STDERR_SHA16=01ba4719c80b6fe9\nHOME_TOPOLOGY_AUDIT_RC=0\nSPB_TO_HOME_PORT_PROBE_RC=0\nSPB_TO_HOME_PORT_PROBE_STDERR_SHA16=e3b0c44298fc1c14\nSPB_SNIKKET_RAW_SAFE={\"dnat_target_count\":1,\"dnat_target_sha16\":\"0b7870e2230336f5\",\"egress_exists\":true,\"egress_sha16\":\"6f95765c03a345c9\",\"egress_source_count\":1,\"egress_source_sha16\":\"4e29a2729bbc4066\",\"ingress_exists\":true,\"ingress_sha16\":\"a195c34384dd7b2c\",\"wg_exists\":true,\"wg_listen_port\":51820,\"wg_peer_count\":1,\"wg_sha16\":\"445cd0dd63bffe31\"}\nHOME_TOPOLOGY9212={\"classification\":{\"automatable_direct_edge\":true,\"home_public_owner_count\":1,\"home_public_owners\":[{\"has_wg_home\":false,\"mentions_egress_source\":true,\"mentions_target\":true,\"name\":\"edge-vm\",\"node\":\"pve03\",\"owns_home_ip\":true,\"rc\":0,\"type\":\"qemu\",\"vmid\":130}],\"needs_router_specific_migration\":false,\"snikket_egress_source_owner_count\":2,\"snikket_egress_source_owners\":[{\"has_wg_home\":false,\"mentions_egress_source\":true,\"mentions_target\":true,\"name\":\"edge-vm\",\"node\":\"pve03\",\"owns_home_ip\":true,\"rc\":0,\"type\":\"qemu\",\"vmid\":130},{\"has_wg_home\":false,\"mentions_egress_source\":true,\"mentions_target\":false,\"name\":\"snikket\",\"node\":\"pve01\",\"owns_home_ip\":false,\"rc\":0,\"type\":\"qemu\",\"vmid\":150}],\"snikket_target_owner_count\":1,\"snikket_target_owners\":[{\"has_wg_home\":false,\"mentions_egress_source\":true,\"mentions_target\":true,\"name\":\"edge-vm\",\"node\":\"pve03\",\"owns_home_ip\":true,\"rc\":0,\"type\":\"qemu\",\"vmid\":130}],\"wg_home_owner_count\":0,\"wg_home_owners\":[]},\"config_hits\":[],\"guests\":[{\"has_wg_home\":false,\"mentions_egress_source\":true,\"mentions_target\":true,\"name\":\"edge-vm\",\"node\":\"pve03\",\"owns_home_ip\":true,\"rc\":0,\"type\":\"qemu\",\"vmid\":130},{\"has_wg_home\":false,\"mentions_egress_source\":true,\"mentions_target\":false,\"name\":\"snikket\",\"node\":\"pve01\",\"owns_home_ip\":false,\"rc\":0,\"type\":\"qemu\",\"vmid\":150}],\"hosts\":[{\"has_wg_home\":false,\"mentions_egress_source\":false,\"mentions_target\":false,\"node\":\"pve01\",\"owns_home_ip\":false,\"rc\":0},{\"has_wg_home\":false,\"mentions_egress_source\":false,\"mentions_target\":false,\"node\":\"pve02\",\"owns_home_ip\":false,\"rc\":0},{\"has_wg_home\":false,\"mentions_egress_source\":false,\"mentions_target\":false,\"node\":\"pve03\",\"owns_home_ip\":false,\"rc\":0}],\"reference_lines\":[{\"line\":14,\"text\":\"- VM130 edge-vm | pve03 | running | KEEP\"},{\"line\":15,\"text\":\"- VM150 snikket | pve01 | running | KEEP\"},{\"line\":20,\"text\":\"- VM9130 edge-cold-standby | pve02 | stopped | KEEP_DR\"},{\"line\":73,\"text\":\"NOTE exclude_from_reference_or_delete_later=05_edge_compose_safe.tgz\"},{\"line\":75,\"text\":\"NOTE edge-vm disk scsi1 backup=0 risk must be documented\"},{\"line\":77,\"text\":\"NOTE edge health WARN/ERROR items should be documented as known current states\"},{\"line\":101,\"text\":\"04_edge_vm_basic.txt 34506 bytes\"},{\"line\":102,\"text\":\"05_edge_compose_redacted.txt 24228 bytes\"},{\"line\":103,\"text\":\"05_edge_compose_safe.tgz.QUARANTINED.txt 354 bytes\"},{\"line\":104,\"text\":\"05_edge_compose_tar_errors.txt 166 bytes\"},{\"line\":106,\"text\":\"06_edge_npmplus_routes_safe.txt 17350 bytes\"},{\"line\":107,\"text\":\"07_edge_systemd_backup_audit.txt 20694 bytes\"},{\"line\":108,\"text\":\"08_edge_scripts_redacted.txt 198622 bytes\"},{\"line\":149,\"text\":\"- \\u0423 VM130 edge-vm \\u0435\\u0441\\u0442\\u044c \\u0440\\u0438\\u0441\\u043a: \\u0434\\u043e\\u043f\\u043e\\u043b\\u043d\\u0438\\u0442\\u0435\\u043b\\u044c\\u043d\\u044b\\u0439 \\u0434\\u0438\\u0441\\u043a backup=0.\"},{\"line\":157,\"text\":\"- Edge VM: ssh debian@<IP:bc517b4af3298846>, \\u0438\\u0441\\u043f\\u043e\\u043b\\u044c\\u0437\\u043e\\u0432\\u0430\\u0442\\u044c sudo, root-login \\u043d\\u0435 \\u0438\\u0441\\u043f\\u043e\\u043b\\u044c\\u0437\\u043e\\u0432\\u0430\\u0442\\u044c.\"},{\"line\":166,\"text\":\"- VM130 edge-vm pve03 <IP:bc517b4af3298846> Docker ingress/app host.\"},{\"line\":173,\"text\":\"- Edge VM \\u0438\\u043c\\u0435\\u0435\\u0442 vzdump/offhost/restore evidence; \\u0440\\u0438\\u0441\\u043a backup=0 \\u043f\\u043e \\u0434\\u043e\\u043f\\u043e\\u043b\\u043d\\u0438\\u0442\\u0435\\u043b\\u044c\\u043d\\u043e\\u043c\\u0443 \\u0434\\u0438\\u0441\\u043a\\u0443 \\u043e\\u0441\\u0442\\u0430\\u0451\\u0442\\u0441\\u044f.\"},{\"line\":199,\"text\":\"## ROUTER_NETCRAZE_ULTRA_NC1812_20260630\"},{\"line\":226,\"text\":\"### WAN \\u0438 \\u0440\\u0435\\u0437\\u0435\\u0440\\u0432\\u043d\\u044b\\u0439 \\u0438\\u043d\\u0442\\u0435\\u0440\\u043d\\u0435\\u0442\"},{\"line\":227,\"text\":\"- Main WAN: GigabitEthernet1, renamed ISP, description \\u0420\\u043e\\u0441\\u0442\\u0435\\u043b.\"},{\"line\":228,\"text\":\"- WAN security-level: public.\"},{\"line\":229,\"text\":\"- WAN addressing: DHCP.\"},{\"line\":230,\"text\":\"- WAN MTU: 1500.\"},{\"line\":231,\"text\":\"- WAN global priority: 700.\"},{\"line\":232,\"text\":\"- WAN ping-check profile: default.\"},{\"line\":234,\"text\":\"- WAN DHCP observed in router log: <IP:18d462ba98aa4550>, gateway <IP:29948130c37b10e3>.\"},{\"line\":235,\"text\":\"- ISP DNS observed in router log: <IP:009e7a91182f3b0b>, <IP:0c2f3683ba1d821a>.\"},{\"line\":236,\"text\":\"- Backup/mobile WAN: CdcEthernet0, description SIM.\"},{\"line\":238,\"text\":\"- CdcEthernet0 security-level: public.\"},{\"line\":282,\"text\":\"- Default router: <IP:c5eb5a4cc76a5cdb>.\"},{\"line\":311,\"text\":\"- <IP:6e3573c5557733db> -> bc:24:11:f4:c5:d8 WireGuard.\"},{\"line\":312,\"text\":\"- <IP:bc517b4af3298846> -> bc:24:11:e1:f3:3c NPMplus / edge-vm.\"},{\"line\":315,\"text\":\"### NAT / port forwarding\"},{\"line\":318,\"text\":\"- ISP tcpudp/3478 -> bc:24:11:e1:9a:25, Nextcloud Talk TURN.\"},{\"line\":319,\"text\":\"- Home tcp/51820 -> bc:24:11:f4:c5:d8, WireGuard vpn1.\"},{\"line\":327,\"text\":\"### Router management\"},{\"line\":333,\"text\":\"- Telnet port configured: 2323, security-level private; router log shows Telnet disabled later on 2026-06-26.\"},{\"line\":339,\"text\":\"### Router services\"},{\"line\":354,\"text\":\"### Router automation warning\"},{\"line\":357,\"text\":\"- Automation must use router CLI syntax, not bash syntax.\"},{\"line\":366,\"text\":\"- edge-vm: no UPS/NUT/APCUPSD integration discovered.\"},{\"line\":371,\"text\":\"- NetBird service is active on pve01, pve02, pve03 and edge-vm.\"},{\"line\":376,\"text\":\"- edge-vm: FQDN edge-vm.netbird.selfhosted, IPv4 <IP:8ffeea43651fd0fa>.\"},{\"line\":378,\"text\":\"- WireGuard port: 51820.\"},{\"line\":395,\"text\":\"- edge-vm owns most application health, dashboard, ingress, backup, NetBox, NPMplus, certificate, Trivy and vulnerability jobs.\"},{\"line\":455,\"text\":\"- edge-vm timers cover runtime dashboard, Paperless guard, external canary, health metrics, restore drill index, AdGuard rewrite sync, NPMplus cert expiry, NetBox backup/sync, retention, cluster daily status, vulnerability and Trivy scans, ingress hardening and NPMplus admin bind.\"},{\"line\":456,\"text\":\"- pve01 timers cover VPN/NetBird health, health metrics, smartctl, disk space, MkDocs refresh, VPS identity audit, storage capacity, quality gate, evidence catalog, backup freshness, docker health, Filebrowser backup/offhost/restore, NPMplus/Kuma backup, NetBird VPS backup/offhost, Authentik/Gitea/Vaultwarden backup, SOPS secret coverage, mail cloud upload/restore, Immich/Memos/Paperless backup/offhost/restore, auto backup, edge-vm vzdump, secret sanity.\"},{\"line\":459,\"text\":\"- Script hashes were captured for /usr/local/sbin and /usr/local/bin on edge-vm, pve01, pve02 and pve03.\"},{\"line\":531,\"text\":\"- Main active workload: VM130 edge-vm.\"},{\"line\":545,\"text\":\"- Network: vmbr0, gateway <IP:4f9da1283166a1e9>.\"},{\"line\":560,\"text\":\"- Network: vmbr0, gateway <IP:4f9da1283166a1e9>.\"},{\"line\":575,\"text\":\"- Network: vmbr0, gateway <IP:4f9da1283166a1e9>.\"},{\"line\":590,\"text\":\"- Network: vmbr0, gateway <IP:4f9da1283166a1e9>.\"},{\"line\":597,\"text\":\"### VM130 edge-vm\"},{\"line\":600,\"text\":\"- Name: edge-vm.\"},{\"line\":604,\"text\":\"- Role: edge application host / reverse proxy / monitoring / backup automation host.\"},{\"line\":608,\"text\":\"- Network: vmbr0, gateway <IP:4f9da1283166a1e9>.\"},{\"line\":626,\"text\":\"- Network: vmbr0, gateway <IP:4f9da1283166a1e9>.\"},{\"line\":643,\"text\":\"- Network: vmbr0, gateway <IP:4f9da1283166a1e9>.\"},{\"line\":682,\"text\":\"### Router ingress\"},{\"line\":683,\"text\":\"- Public WAN router forwards TCP/80 and TCP/443 to NPMplus on edge-vm, <IP:bc517b4af3298846>.\"},{\"line\":684,\"text\":\"- Router forwards TCP/UDP 3478 to Nextcloud Talk TURN on <IP:4e29a2729bbc4066>.\"},{\"line\":685,\"text\":\"- Router forwards Home TCP/51820 to WireGuard host <IP:6e3573c5557733db>.\"},{\"line\":686,\"text\":\"- NPMplus admin listener is bound to localhost on edge-vm, <IP:12ca17b49af22894>:81; public disabled legacy host npm.gram1.ru exists but enabled=0.\"},{\"line\":689,\"text\":\"- Host: edge-vm, <IP:bc517b4af3298846>.\"},{\"line\":694,\"text\":\"- Public listen ports on edge-vm: <IP:19e36255972107d4>:80 and <IP:19e36255972107d4>:443 by nginx/NPMplus.\"},{\"line\":698,\"text\":\"### Public NPMplus proxy hosts\"},{\"line\":766,\"text\":\"## EDGE_DOCKER_STACKS_REFERENCE_20260630\"},{\"line\":769,\"text\":\"- Host: edge-vm, IP <IP:bc517b4af3298846>.\"},{\"line\":774,\"text\":\"- Public ingress terminates through NPMplus on ports 80/443.\"},{\"line\":864,\"text\":\"- NPMplus public ingress: <IP:19e36255972107d4>:80 and <IP:19e36255972107d4>:443.\"},{\"line\":869,\"text\":\"- Full path inventory is in 133_EDGE_DOCKER_STACKS_SAFE_INVENTORY.txt.\"},{\"line\":870,\"text\":\"- Normalized runtime map is in 134_EDGE_DOCKER_CONTAINER_NORMALIZED_MAP.txt.\"},{\"line\":873,\"text\":\"- Raw Docker/stacks inventory: 133_EDGE_DOCKER_STACKS_SAFE_INVENTORY.txt.\"},{\"line\":874,\"text\":\"- Normalized container map: 134_EDGE_DOCKER_CONTAINER_NORMALIZED_MAP.txt.\"},{\"line\":895,\"text\":\"- VM130 edge-vm: included in homelab-nightly-all, local backup on pve03.\"},{\"line\":898,\"text\":\"- VM130 also has dedicated edge-vm-vzdump backup/offhost/restore health proofs.\"},{\"line\":902,\"text\":\"### Edge VM / VM130 full-image protection\"},{\"line\":903,\"text\":\"- edge-vm-vzdump-backup: STATUS=OK, archive size about 28.2G, SHA256 recorded.\"},{\"line\":904,\"text\":\"- edge-vm-vzdump-offhost: STATUS=OK, destination pve02 /mnt/staging/offhost/edge-vm-vzdump-from-pve03.\"},{\"line\":905,\"text\":\"- edge-vm-vzdump-restore: STATUS=OK, zstd and vma verification OK.\"},{\"line\":906,\"text\":\"- mail-cloud-edge-vm: STATUS=OK, recurring chunked upload, 53 parts, download verification enabled.\"},{\"line\":907,\"text\":\"- Retention for edge-vm cloud upload: RETENTION_KEEP=4.\"},{\"line\":908,\"text\":\"- Edge restore proof offhost: STATUS=OK, ITEMS=14, OK=14.\"},{\"line\":915,\"text\":\"- mail-cloud-restore-drill: STATUS=OK, CRITICAL_OK=2, EDGE_OK=1.\"},{\"line\":934,\"text\":\"- Router self-test config is stored as uploaded/generated reference evidence, not yet automated as recurring router backup.\"},{\"line\":999,\"text\":\"- XenForo SMTP rotation has DB backup proof from earlier rotation work; production forum application-level backup catalog should be expanded separately with CodeVipe-specific DB/files/cron/public cutover details.\"},{\"line\":1003,\"text\":\"- Disk retention policy: STATUS=OK, root used pct observed 70 on edge-vm, removed dirs 0, Docker volume prune NO.\"},{\"line\":1004,\"text\":\"- App backup retention dry-run timer exists on edge-vm.\"},{\"line\":1017,\"text\":\"- Router config backup is currently reference/self-test based, not confirmed as recurring automated backup.\"},{\"line\":1027,\"text\":\"- Primary monitoring host: edge-vm, <IP:bc517b4af3298846>.\"},{\"line\":1033,\"text\":\"- Uptime Kuma container: uptime-kuma, local port <IP:12ca17b49af22894>:3001, public route uptime.gram1.ru and VPN route kuma.vpn.gram1.ru.\"},{\"line\":1034,\"text\":\"- Gotify container: gotify, local port <IP:12ca17b49af22894>:8082, public route gotify.gram1.ru.\"},{\"line\":1039,\"text\":\"- Node exporter on edge-vm: node-exporter, local port <IP:12ca17b49af22894>:9100.\"},{\"line\":1062,\"text\":\"- Edge node exporter scrape target: node-exporter:9100.\"},{\"line\":1084,\"text\":\"- HomelabP0WeeklyEdgeVmVzdumpHealthStale: weekly edge-vm vzdump health older than 8d.\"},{\"line\":1103,\"text\":\"- Alloy relabels container, compose_project, compose_service and host=edge-vm.\"},{\"line\":1137,\"text\":\"- Main health dir on edge-vm: /var/lib/homelab-health.\"},{\"line\":1209,\"text\":\"- edge-vm is reached as debian@<IP:bc517b4af3298846> with sudo.\"},{\"line\":1215,\"text\":\"- pve01 root keys observed: id_rsa, id_ed25519 and public keys.\"}],\"spb_safe\":{\"dnat_target_count\":1,\"dnat_target_sha16\":\"0b7870e2230336f5\",\"egress_exists\":true,\"egress_sha16\":\"6f95765c03a345c9\",\"egress_source_count\":1,\"egress_source_sha16\":\"4e29a2729bbc4066\",\"ingress_exists\":true,\"ingress_sha16\":\"a195c34384dd7b2c\",\"wg_exists\":true,\"wg_listen_port\":51820,\"wg_peer_count\":1,\"wg_sha16\":\"445cd0dd63bffe31\"}}\nSPB_TO_HOME_PORT_PROBE={\"tcp\":{\"3478\":\"TIMEOUT\",\"3479\":\"TIMEOUT\",\"5000\":\"TIMEOUT\",\"5222\":\"TIMEOUT\",\"5349\":\"TIMEOUT\",\"5350\":\"TIMEOUT\"},\"udp_stun\":{\"3478\":{\"ok\":false,\"result\":\"TIMEOUT\"},\"3479\":{\"ok\":false,\"result\":\"TIMEOUT\"}}}\nHOME_PUBLIC_OWNER_COUNT=1\nSNIKKET_TARGET_OWNER_COUNT=1\nSNIKKET_EGRESS_SOURCE_OWNER_COUNT=2\nWG_HOME_OWNER_COUNT=0\nMIGRATION_AUTOMATABLE_ON_KNOWN_HOME_HOST=true\nNEEDS_ROUTER_SPECIFIC_MIGRATION=false\nDIRECT_HOME_TCP_OPEN_COUNT=0\nDIRECT_HOME_STUN_OK_COUNT=0\nDIRECT_SNIKKET_INGRESS_APPEARS_READY=false\nNEXT_ACTION=APPLY_GUARDED_HOME_NFT_MIGRATION\nTASK_COMPLETE=true\nTASK_RESULT=PASS_SPB_SNIKKET_HOME_TOPOLOGY_PREFLIGHT\nDECISION=READ_EXACT_9212_AND_APPLY_ONLY_PROVEN_HOME_EDGE_PATH\nNEXT_GATE=EXACT_9212_HOME_EDGE_TOPOLOGY\nHOMELAB_RESULT_CONTRACT={\"version\":1,\"command_id\":\"SUPPORT-260923-SPB-SNIKKET-HOME-TOPOLOGY-9212R1\",\"status\":\"OK\",\"changes_made\":false,\"rollback_started\":false,\"rollback_restored\":null}\n"
+}
diff --git a/runtime/history/SUPPORT-260923-SPB-SNIKKET-HOME-TOPOLOGY-9212R1.txt b/runtime/history/SUPPORT-260923-SPB-SNIKKET-HOME-TOPOLOGY-9212R1.txt
new file mode 100644
index 00000000..91506ae1
--- /dev/null
+++ b/runtime/history/SUPPORT-260923-SPB-SNIKKET-HOME-TOPOLOGY-9212R1.txt
@@ -0,0 +1,72 @@
+CHAT_OUTPUT_BEGIN
+COMMAND_ID=SUPPORT-260923-SPB-SNIKKET-HOME-TOPOLOGY-9212R1
+STATUS=OK
+RC=0
+HOST=pve01
+MODE=read-only
+COMPONENT=spb-snikket-home-topology-preflight
+REFERENCE_REGISTER_CHECK=OK
+REFERENCE_SHA256=5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66
+ERROR_REGISTER_CHECK=OK
+ERROR_REGISTER_SHA256=3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0
+COMMAND_SHA256=8b782274900f6bc9aa802887320595dc8daddda038b74f5bb47d7037e275cc95
+DUPLICATE_FAILED_COMMAND_BLOCKED=false
+EXECUTION_STARTED=true
+CHANGE_DECLARED=false
+RESULT_CONTRACT_VALID=true
+RESULT_CONTRACT_STATUS=NOT_APPLICABLE
+RESULT_CONTRACT_ERROR=NONE
+COMMAND_RC=0
+CHANGES_MADE=false
+ROLLBACK_STARTED=false
+ROLLBACK_RESTORED=null
+MUTATION_OUTCOME=NO_MUTATION
+SANITIZED=yes
+SECRETS_INCLUDED=no
+PRIVATE_ADDRESSES_INCLUDED=no
+RAW_EVIDENCE_SHA256=4647a1f838f614aee3bb390bbb1a36f357f9a8bf88e819fbd5f9d977f7cda299
+SANITIZED_OUTPUT_SHA256=4647a1f838f614aee3bb390bbb1a36f357f9a8bf88e819fbd5f9d977f7cda299
+OUTPUT_BEGIN
+SNIKKET9212_BEGIN=true
+MODE=READ_ONLY_TOPOLOGY_PREFLIGHT
+MUTATION_BOUNDARY=NONE;NO_SPB_WRITE;NO_HOME_WRITE;NO_DNS_WRITE;NO_SHUTDOWN
+LOCAL9209_BEGIN=true
+CID=SUPPORT-260923-SPB-SNIKKET-HOME-TOPOLOGY-9212R1
+PLINK_PRESENT=true
+SPB_CANDIDATE_COUNT=1
+SPB_CANDIDATE_SHA16=6d6149f42864ce03
+HOME_CANDIDATE_COUNT=1
+HOME_CANDIDATE_SHA16=bc517b4af3298846
+SPB_HASH_MATCH=true
+SPB_PINNED_PROBE_RC=0
+DPAPI_DECRYPTABLE_COUNT=1
+OLD9208_LOCAL_ERR_SHA16=5a00a4ad6f6ef637
+LOCAL_ACCESS_STATUS=PASS
+LOCAL9209_END=true
+SPB_PINNED_ACCESS=PASS
+SPB_SNIKKET_EXTRACT_RC=0
+SPB_SNIKKET_EXTRACT_STDERR_SHA16=01ba4719c80b6fe9
+HOME_TOPOLOGY_AUDIT_RC=0
+SPB_TO_HOME_PORT_PROBE_RC=0
+SPB_TO_HOME_PORT_PROBE_STDERR_SHA16=e3b0c44298fc1c14
+SPB_SNIKKET_RAW_SAFE={"dnat_target_count":1,"dnat_target_sha16":"0b7870e2230336f5","egress_exists":true,"egress_sha16":"6f95765c03a345c9","egress_source_count":1,"egress_source_sha16":"4e29a2729bbc4066","ingress_exists":true,"ingress_sha16":"a195c34384dd7b2c","wg_exists":true,"wg_listen_port":51820,"wg_peer_count":1,"wg_sha16":"445cd0dd63bffe31"}
+HOME_TOPOLOGY9212={"classification":{"automatable_direct_edge":true,"home_public_owner_count":1,"home_public_owners":[{"has_wg_home":false,"mentions_egress_source":true,"mentions_target":true,"name":"edge-vm","node":"pve03","owns_home_ip":true,"rc":0,"type":"qemu","vmid":130}],"needs_router_specific_migration":false,"snikket_egress_source_owner_count":2,"snikket_egress_source_owners":[{"has_wg_home":false,"mentions_egress_source":true,"mentions_target":true,"name":"edge-vm","node":"pve03","owns_home_ip":true,"rc":0,"type":"qemu","vmid":130},{"has_wg_home":false,"mentions_egress_source":true,"mentions_target":false,"name":"snikket","node":"pve01","owns_home_ip":false,"rc":0,"type":"qemu","vmid":150}],"snikket_target_owner_count":1,"snikket_target_owners":[{"has_wg_home":false,"mentions_egress_source":true,"mentions_target":true,"name":"edge-vm","node":"pve03","owns_home_ip":true,"rc":0,"type":"qemu","vmid":130}],"wg_home_owner_count":0,"wg_home_owners":[]},"config_hits":[],"guests":[{"has_wg_home":false,"mentions_egress_source":true,"mentions_target":true,"name":"edge-vm","node":"pve03","owns_home_ip":true,"rc":0,"type":"qemu","vmid":130},{"has_wg_home":false,"mentions_egress_source":true,"mentions_target":false,"name":"snikket","node":"pve01","owns_home_ip":false,"rc":0,"type":"qemu","vmid":150}],"hosts":[{"has_wg_home":false,"mentions_egress_source":false,"mentions_target":false,"node":"pve01","owns_home_ip":false,"rc":0},{"has_wg_home":false,"mentions_egress_source":false,"mentions_target":false,"node":"pve02","owns_home_ip":false,"rc":0},{"has_wg_home":false,"mentions_egress_source":false,"mentions_target":false,"node":"pve03","owns_home_ip":false,"rc":0}],"reference_lines":[{"line":14,"text":"- VM130 edge-vm | pve03 | running | KEEP"},{"line":15,"text":"- VM150 snikket | pve01 | running | KEEP"},{"line":20,"text":"- VM9130 edge-cold-standby | pve02 | stopped | KEEP_DR"},{"line":73,"text":"NOTE exclude_from_reference_or_delete_later=05_edge_compose_safe.tgz"},{"line":75,"text":"NOTE edge-vm disk scsi1 backup=0 risk must be documented"},{"line":77,"text":"NOTE edge health WARN/ERROR items should be documented as known current states"},{"line":101,"text":"04_edge_vm_basic.txt 34506 bytes"},{"line":102,"text":"05_edge_compose_redacted.txt 24228 bytes"},{"line":103,"text":"05_edge_compose_safe.tgz.QUARANTINED.txt 354 bytes"},{"line":104,"text":"05_edge_compose_tar_errors.txt 166 bytes"},{"line":106,"text":"06_edge_npmplus_routes_safe.txt 17350 bytes"},{"line":107,"text":"07_edge_systemd_backup_audit.txt 20694 bytes"},{"line":108,"text":"08_edge_scripts_redacted.txt 198622 bytes"},{"line":149,"text":"- \u0423 VM130 edge-vm \u0435\u0441\u0442\u044c \u0440\u0438\u0441\u043a: \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0439 \u0434\u0438\u0441\u043a backup=0."},{"line":157,"text":"- Edge VM: ssh debian@<IP:bc517b4af3298846>, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c sudo, root-login \u043d\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c."},{"line":166,"text":"- VM130 edge-vm pve03 <IP:bc517b4af3298846> Docker ingress/app host."},{"line":173,"text":"- Edge VM \u0438\u043c\u0435\u0435\u0442 vzdump/offhost/restore evidence; \u0440\u0438\u0441\u043a backup=0 \u043f\u043e \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u043c\u0443 \u0434\u0438\u0441\u043a\u0443 \u043e\u0441\u0442\u0430\u0451\u0442\u0441\u044f."},{"line":199,"text":"## ROUTER_NETCRAZE_ULTRA_NC1812_20260630"},{"line":226,"text":"### WAN \u0438 \u0440\u0435\u0437\u0435\u0440\u0432\u043d\u044b\u0439 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442"},{"line":227,"text":"- Main WAN: GigabitEthernet1, renamed ISP, description \u0420\u043e\u0441\u0442\u0435\u043b."},{"line":228,"text":"- WAN security-level: public."},{"line":229,"text":"- WAN addressing: DHCP."},{"line":230,"text":"- WAN MTU: 1500."},{"line":231,"text":"- WAN global priority: 700."},{"line":232,"text":"- WAN ping-check profile: default."},{"line":234,"text":"- WAN DHCP observed in router log: <IP:18d462ba98aa4550>, gateway <IP:29948130c37b10e3>."},{"line":235,"text":"- ISP DNS observed in router log: <IP:009e7a91182f3b0b>, <IP:0c2f3683ba1d821a>."},{"line":236,"text":"- Backup/mobile WAN: CdcEthernet0, description SIM."},{"line":238,"text":"- CdcEthernet0 security-level: public."},{"line":282,"text":"- Default router: <IP:c5eb5a4cc76a5cdb>."},{"line":311,"text":"- <IP:6e3573c5557733db> -> bc:24:11:f4:c5:d8 WireGuard."},{"line":312,"text":"- <IP:bc517b4af3298846> -> bc:24:11:e1:f3:3c NPMplus / edge-vm."},{"line":315,"text":"### NAT / port forwarding"},{"line":318,"text":"- ISP tcpudp/3478 -> bc:24:11:e1:9a:25, Nextcloud Talk TURN."},{"line":319,"text":"- Home tcp/51820 -> bc:24:11:f4:c5:d8, WireGuard vpn1."},{"line":327,"text":"### Router management"},{"line":333,"text":"- Telnet port configured: 2323, security-level private; router log shows Telnet disabled later on 2026-06-26."},{"line":339,"text":"### Router services"},{"line":354,"text":"### Router automation warning"},{"line":357,"text":"- Automation must use router CLI syntax, not bash syntax."},{"line":366,"text":"- edge-vm: no UPS/NUT/APCUPSD integration discovered."},{"line":371,"text":"- NetBird service is active on pve01, pve02, pve03 and edge-vm."},{"line":376,"text":"- edge-vm: FQDN edge-vm.netbird.selfhosted, IPv4 <IP:8ffeea43651fd0fa>."},{"line":378,"text":"- WireGuard port: 51820."},{"line":395,"text":"- edge-vm owns most application health, dashboard, ingress, backup, NetBox, NPMplus, certificate, Trivy and vulnerability jobs."},{"line":455,"text":"- edge-vm timers cover runtime dashboard, Paperless guard, external canary, health metrics, restore drill index, AdGuard rewrite sync, NPMplus cert expiry, NetBox backup/sync, retention, cluster daily status, vulnerability and Trivy scans, ingress hardening and NPMplus admin bind."},{"line":456,"text":"- pve01 timers cover VPN/NetBird health, health metrics, smartctl, disk space, MkDocs refresh, VPS identity audit, storage capacity, quality gate, evidence catalog, backup freshness, docker health, Filebrowser backup/offhost/restore, NPMplus/Kuma backup, NetBird VPS backup/offhost, Authentik/Gitea/Vaultwarden backup, SOPS secret coverage, mail cloud upload/restore, Immich/Memos/Paperless backup/offhost/restore, auto backup, edge-vm vzdump, secret sanity."},{"line":459,"text":"- Script hashes were captured for /usr/local/sbin and /usr/local/bin on edge-vm, pve01, pve02 and pve03."},{"line":531,"text":"- Main active workload: VM130 edge-vm."},{"line":545,"text":"- Network: vmbr0, gateway <IP:4f9da1283166a1e9>."},{"line":560,"text":"- Network: vmbr0, gateway <IP:4f9da1283166a1e9>."},{"line":575,"text":"- Network: vmbr0, gateway <IP:4f9da1283166a1e9>."},{"line":590,"text":"- Network: vmbr0, gateway <IP:4f9da1283166a1e9>."},{"line":597,"text":"### VM130 edge-vm"},{"line":600,"text":"- Name: edge-vm."},{"line":604,"text":"- Role: edge application host / reverse proxy / monitoring / backup automation host."},{"line":608,"text":"- Network: vmbr0, gateway <IP:4f9da1283166a1e9>."},{"line":626,"text":"- Network: vmbr0, gateway <IP:4f9da1283166a1e9>."},{"line":643,"text":"- Network: vmbr0, gateway <IP:4f9da1283166a1e9>."},{"line":682,"text":"### Router ingress"},{"line":683,"text":"- Public WAN router forwards TCP/80 and TCP/443 to NPMplus on edge-vm, <IP:bc517b4af3298846>."},{"line":684,"text":"- Router forwards TCP/UDP 3478 to Nextcloud Talk TURN on <IP:4e29a2729bbc4066>."},{"line":685,"text":"- Router forwards Home TCP/51820 to WireGuard host <IP:6e3573c5557733db>."},{"line":686,"text":"- NPMplus admin listener is bound to localhost on edge-vm, <IP:12ca17b49af22894>:81; public disabled legacy host npm.gram1.ru exists but enabled=0."},{"line":689,"text":"- Host: edge-vm, <IP:bc517b4af3298846>."},{"line":694,"text":"- Public listen ports on edge-vm: <IP:19e36255972107d4>:80 and <IP:19e36255972107d4>:443 by nginx/NPMplus."},{"line":698,"text":"### Public NPMplus proxy hosts"},{"line":766,"text":"## EDGE_DOCKER_STACKS_REFERENCE_20260630"},{"line":769,"text":"- Host: edge-vm, IP <IP:bc517b4af3298846>."},{"line":774,"text":"- Public ingress terminates through NPMplus on ports 80/443."},{"line":864,"text":"- NPMplus public ingress: <IP:19e36255972107d4>:80 and <IP:19e36255972107d4>:443."},{"line":869,"text":"- Full path inventory is in 133_EDGE_DOCKER_STACKS_SAFE_INVENTORY.txt."},{"line":870,"text":"- Normalized runtime map is in 134_EDGE_DOCKER_CONTAINER_NORMALIZED_MAP.txt."},{"line":873,"text":"- Raw Docker/stacks inventory: 133_EDGE_DOCKER_STACKS_SAFE_INVENTORY.txt."},{"line":874,"text":"- Normalized container map: 134_EDGE_DOCKER_CONTAINER_NORMALIZED_MAP.txt."},{"line":895,"text":"- VM130 edge-vm: included in homelab-nightly-all, local backup on pve03."},{"line":898,"text":"- VM130 also has dedicated edge-vm-vzdump backup/offhost/restore health proofs."},{"line":902,"text":"### Edge VM / VM130 full-image protection"},{"line":903,"text":"- edge-vm-vzdump-backup: STATUS=OK, archive size about 28.2G, SHA256 recorded."},{"line":904,"text":"- edge-vm-vzdump-offhost: STATUS=OK, destination pve02 /mnt/staging/offhost/edge-vm-vzdump-from-pve03."},{"line":905,"text":"- edge-vm-vzdump-restore: STATUS=OK, zstd and vma verification OK."},{"line":906,"text":"- mail-cloud-edge-vm: STATUS=OK, recurring chunked upload, 53 parts, download verification enabled."},{"line":907,"text":"- Retention for edge-vm cloud upload: RETENTION_KEEP=4."},{"line":908,"text":"- Edge restore proof offhost: STATUS=OK, ITEMS=14, OK=14."},{"line":915,"text":"- mail-cloud-restore-drill: STATUS=OK, CRITICAL_OK=2, EDGE_OK=1."},{"line":934,"text":"- Router self-test config is stored as uploaded/generated reference evidence, not yet automated as recurring router backup."},{"line":999,"text":"- XenForo SMTP rotation has DB backup proof from earlier rotation work; production forum application-level backup catalog should be expanded separately with CodeVipe-specific DB/files/cron/public cutover details."},{"line":1003,"text":"- Disk retention policy: STATUS=OK, root used pct observed 70 on edge-vm, removed dirs 0, Docker volume prune NO."},{"line":1004,"text":"- App backup retention dry-run timer exists on edge-vm."},{"line":1017,"text":"- Router config backup is currently reference/self-test based, not confirmed as recurring automated backup."},{"line":1027,"text":"- Primary monitoring host: edge-vm, <IP:bc517b4af3298846>."},{"line":1033,"text":"- Uptime Kuma container: uptime-kuma, local port <IP:12ca17b49af22894>:3001, public route uptime.gram1.ru and VPN route kuma.vpn.gram1.ru."},{"line":1034,"text":"- Gotify container: gotify, local port <IP:12ca17b49af22894>:8082, public route gotify.gram1.ru."},{"line":1039,"text":"- Node exporter on edge-vm: node-exporter, local port <IP:12ca17b49af22894>:9100."},{"line":1062,"text":"- Edge node exporter scrape target: node-exporter:9100."},{"line":1084,"text":"- HomelabP0WeeklyEdgeVmVzdumpHealthStale: weekly edge-vm vzdump health older than 8d."},{"line":1103,"text":"- Alloy relabels container, compose_project, compose_service and host=edge-vm."},{"line":1137,"text":"- Main health dir on edge-vm: /var/lib/homelab-health."},{"line":1209,"text":"- edge-vm is reached as debian@<IP:bc517b4af3298846> with sudo."},{"line":1215,"text":"- pve01 root keys observed: id_rsa, id_ed25519 and public keys."}],"spb_safe":{"dnat_target_count":1,"dnat_target_sha16":"0b7870e2230336f5","egress_exists":true,"egress_sha16":"6f95765c03a345c9","egress_source_count":1,"egress_source_sha16":"4e29a2729bbc4066","ingress_exists":true,"ingress_sha16":"a195c34384dd7b2c","wg_exists":true,"wg_listen_port":51820,"wg_peer_count":1,"wg_sha16":"445cd0dd63bffe31"}}
+SPB_TO_HOME_PORT_PROBE={"tcp":{"3478":"TIMEOUT","3479":"TIMEOUT","5000":"TIMEOUT","5222":"TIMEOUT","5349":"TIMEOUT","5350":"TIMEOUT"},"udp_stun":{"3478":{"ok":false,"result":"TIMEOUT"},"3479":{"ok":false,"result":"TIMEOUT"}}}
+HOME_PUBLIC_OWNER_COUNT=1
+SNIKKET_TARGET_OWNER_COUNT=1
+SNIKKET_EGRESS_SOURCE_OWNER_COUNT=2
+WG_HOME_OWNER_COUNT=0
+MIGRATION_AUTOMATABLE_ON_KNOWN_HOME_HOST=true
+NEEDS_ROUTER_SPECIFIC_MIGRATION=false
+DIRECT_HOME_TCP_OPEN_COUNT=0
+DIRECT_HOME_STUN_OK_COUNT=0
+DIRECT_SNIKKET_INGRESS_APPEARS_READY=false
+NEXT_ACTION=APPLY_GUARDED_HOME_NFT_MIGRATION
+TASK_COMPLETE=true
+TASK_RESULT=PASS_SPB_SNIKKET_HOME_TOPOLOGY_PREFLIGHT
+DECISION=READ_EXACT_9212_AND_APPLY_ONLY_PROVEN_HOME_EDGE_PATH
+NEXT_GATE=EXACT_9212_HOME_EDGE_TOPOLOGY
+HOMELAB_RESULT_CONTRACT={"version":1,"command_id":"SUPPORT-260923-SPB-SNIKKET-HOME-TOPOLOGY-9212R1","status":"OK","changes_made":false,"rollback_started":false,"rollback_restored":null}
+
+OUTPUT_END
+CHAT_OUTPUT_END
diff --git a/runtime/latest.json b/runtime/latest.json
index bcb5996c..8b925ffa 100644
--- a/runtime/latest.json
+++ b/runtime/latest.json
@@ -1,19 +1,19 @@
 {
   "schema_version": 1,
   "channel": "homelab-runtime",
-  "command_id": "SUPPORT-260923-SKLADCHIK-WINDOWS-USA-TRANSPORT-HISTORY-960R1",
+  "command_id": "SUPPORT-260923-SPB-SNIKKET-HOME-TOPOLOGY-9212R1",
   "status": "OK",
   "rc": 0,
   "host": "pve01",
   "mode": "read-only",
-  "component": "windows-usa-transport-history",
-  "started_at_utc": "2026-09-23T15:17:12Z",
-  "finished_at_utc": "2026-09-23T15:17:14Z",
+  "component": "spb-snikket-home-topology-preflight",
+  "started_at_utc": "2026-09-23T15:29:19Z",
+  "finished_at_utc": "2026-09-23T15:29:56Z",
   "reference_register_checked": true,
   "reference_sha256": "5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66",
   "error_register_checked": true,
   "error_register_sha256": "3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0",
-  "command_sha256": "2786db5883b2bbe88426826e9e1794c686766cfaeca376f5d22bea4cdaf6acb4",
+  "command_sha256": "8b782274900f6bc9aa802887320595dc8daddda038b74f5bb47d7037e275cc95",
   "duplicate_failed_command_blocked": false,
   "block_reason": null,
   "execution_started": true,
@@ -30,9 +30,9 @@
   "secrets_included": false,
   "private_addresses_included": false,
   "raw_evidence_retained_locally": true,
-  "raw_evidence_sha256": "13ab3832027257022765185e9798bfca2f0888ace7f3e0cf5f4a32ba3bf60ac1",
-  "sanitized_output_sha256": "13ab3832027257022765185e9798bfca2f0888ace7f3e0cf5f4a32ba3bf60ac1",
+  "raw_evidence_sha256": "4647a1f838f614aee3bb390bbb1a36f357f9a8bf88e819fbd5f9d977f7cda299",
+  "sanitized_output_sha256": "4647a1f838f614aee3bb390bbb1a36f357f9a8bf88e819fbd5f9d977f7cda299",
   "output_truncated_in_json": false,
   "full_sanitized_output_url": "https://git.gram1.ru/.well-known/homelab-runtime/latest.txt",
-  "output": "W960_BEGIN=true\nCOMMAND_ID=SUPPORT-260923-SKLADCHIK-WINDOWS-USA-TRANSPORT-HISTORY-960R1\nMODE=read-only\nCOMPONENT=windows-usa-transport-history\nPREDECESSOR_959=ONLY_SELF_PVE01_PLINK_FOUND\nMUTATION_BOUNDARY=NONE_READ_ONLY\nPAGEANT_PROCESS_COUNT=1\nSOCKS64020_NETSTAT_COUNT=0\nHISTORY_FILE_PRESENT=true\nHISTORY_MATCH_HASH=69758058b095e0a5\nHISTORY_MATCH_HASH=4f9832fa88994748\nHISTORY_MATCH_HASH=fcc5840574088229\nHISTORY_MATCH_HASH=247490651a395b52\nHISTORY_MATCH_HASH=247490651a395b52\nHISTORY_MATCH_COUNT=5\nPAGEANT_LIST_VIA_PVE_RC=1\nPAGEANT_KEY_COUNT=0\nWINDOWS_NETBIRD_CLI_PRESENT=true\nWINDOWS_NETBIRD_STATUS_RC=0\nPVEPRO_OVERLAY_IP_FOUND=true\nPVEPRO_OVERLAY_IP_HASH=0f61feb58699a097\nTRANSPORT_CANDIDATE_COUNT=6\nCAND_0_USER_HASH=4813494d137e1631\nCAND_0_HOST_HASH=1fc73136d6d7ddbd\nCAND_0_PORT=22\nCAND_0_SOURCE=PS_HISTORY\nCAND_0_RC=1\nCAND_1_USER_HASH=4813494d137e1631\nCAND_1_HOST_HASH=0f61feb58699a097\nCAND_1_PORT=22\nCAND_1_SOURCE=NETBIRD_OVERLAY\nCAND_1_RC=1\nCAND_2_USER_HASH=a92c36e66a25ee99\nCAND_2_HOST_HASH=0f61feb58699a097\nCAND_2_PORT=22\nCAND_2_SOURCE=NETBIRD_OVERLAY\nCAND_2_RC=1\nCAND_3_USER_HASH=81d93757457f9885\nCAND_3_HOST_HASH=0f61feb58699a097\nCAND_3_PORT=22\nCAND_3_SOURCE=NETBIRD_OVERLAY\nCAND_3_RC=1\nCAND_4_USER_HASH=7804a56a5c7636cc\nCAND_4_HOST_HASH=0f61feb58699a097\nCAND_4_PORT=22\nCAND_4_SOURCE=NETBIRD_OVERLAY\nCAND_4_RC=1\nCAND_5_USER_HASH=8c6976e5b5410415\nCAND_5_HOST_HASH=0f61feb58699a097\nCAND_5_PORT=22\nCAND_5_SOURCE=NETBIRD_OVERLAY\nCAND_5_RC=1\nWORKING_USA_TRANSPORT_FOUND=false\nUSA_SERVER_AUDIT_RC=NOT_RUN\nCHANGES_MADE_BY_960=false\nROLLBACK_STARTED=false\nROLLBACK_RESTORED=null\nDECISION=HOLD_WINDOWS_USA_TRANSPORT_HISTORY\nNEXT_GATE=TARGETED_TRANSPORT_FIX\nHOMELAB_RESULT_CONTRACT={\"version\":1,\"command_id\":\"SUPPORT-260923-SKLADCHIK-WINDOWS-USA-TRANSPORT-HISTORY-960R1\",\"status\":\"FAIL\",\"changes_made\":false,\"rollback_started\":false,\"rollback_restored\":null}\nW960_END=true\n"
+  "output": "SNIKKET9212_BEGIN=true\nMODE=READ_ONLY_TOPOLOGY_PREFLIGHT\nMUTATION_BOUNDARY=NONE;NO_SPB_WRITE;NO_HOME_WRITE;NO_DNS_WRITE;NO_SHUTDOWN\nLOCAL9209_BEGIN=true\nCID=SUPPORT-260923-SPB-SNIKKET-HOME-TOPOLOGY-9212R1\nPLINK_PRESENT=true\nSPB_CANDIDATE_COUNT=1\nSPB_CANDIDATE_SHA16=6d6149f42864ce03\nHOME_CANDIDATE_COUNT=1\nHOME_CANDIDATE_SHA16=bc517b4af3298846\nSPB_HASH_MATCH=true\nSPB_PINNED_PROBE_RC=0\nDPAPI_DECRYPTABLE_COUNT=1\nOLD9208_LOCAL_ERR_SHA16=5a00a4ad6f6ef637\nLOCAL_ACCESS_STATUS=PASS\nLOCAL9209_END=true\nSPB_PINNED_ACCESS=PASS\nSPB_SNIKKET_EXTRACT_RC=0\nSPB_SNIKKET_EXTRACT_STDERR_SHA16=01ba4719c80b6fe9\nHOME_TOPOLOGY_AUDIT_RC=0\nSPB_TO_HOME_PORT_PROBE_RC=0\nSPB_TO_HOME_PORT_PROBE_STDERR_SHA16=e3b0c44298fc1c14\nSPB_SNIKKET_RAW_SAFE={\"dnat_target_count\":1,\"dnat_target_sha16\":\"0b7870e2230336f5\",\"egress_exists\":true,\"egress_sha16\":\"6f95765c03a345c9\",\"egress_source_count\":1,\"egress_source_sha16\":\"4e29a2729bbc4066\",\"ingress_exists\":true,\"ingress_sha16\":\"a195c34384dd7b2c\",\"wg_exists\":true,\"wg_listen_port\":51820,\"wg_peer_count\":1,\"wg_sha16\":\"445cd0dd63bffe31\"}\nHOME_TOPOLOGY9212={\"classification\":{\"automatable_direct_edge\":true,\"home_public_owner_count\":1,\"home_public_owners\":[{\"has_wg_home\":false,\"mentions_egress_source\":true,\"mentions_target\":true,\"name\":\"edge-vm\",\"node\":\"pve03\",\"owns_home_ip\":true,\"rc\":0,\"type\":\"qemu\",\"vmid\":130}],\"needs_router_specific_migration\":false,\"snikket_egress_source_owner_count\":2,\"snikket_egress_source_owners\":[{\"has_wg_home\":false,\"mentions_egress_source\":true,\"mentions_target\":true,\"name\":\"edge-vm\",\"node\":\"pve03\",\"owns_home_ip\":true,\"rc\":0,\"type\":\"qemu\",\"vmid\":130},{\"has_wg_home\":false,\"mentions_egress_source\":true,\"mentions_target\":false,\"name\":\"snikket\",\"node\":\"pve01\",\"owns_home_ip\":false,\"rc\":0,\"type\":\"qemu\",\"vmid\":150}],\"snikket_target_owner_count\":1,\"snikket_target_owners\":[{\"has_wg_home\":false,\"mentions_egress_source\":true,\"mentions_target\":true,\"name\":\"edge-vm\",\"node\":\"pve03\",\"owns_home_ip\":true,\"rc\":0,\"type\":\"qemu\",\"vmid\":130}],\"wg_home_owner_count\":0,\"wg_home_owners\":[]},\"config_hits\":[],\"guests\":[{\"has_wg_home\":false,\"mentions_egress_source\":true,\"mentions_target\":true,\"name\":\"edge-vm\",\"node\":\"pve03\",\"owns_home_ip\":true,\"rc\":0,\"type\":\"qemu\",\"vmid\":130},{\"has_wg_home\":false,\"mentions_egress_source\":true,\"mentions_target\":false,\"name\":\"snikket\",\"node\":\"pve01\",\"owns_home_ip\":false,\"rc\":0,\"type\":\"qemu\",\"vmid\":150}],\"hosts\":[{\"has_wg_home\":false,\"mentions_egress_source\":false,\"mentions_target\":false,\"node\":\"pve01\",\"owns_home_ip\":false,\"rc\":0},{\"has_wg_home\":false,\"mentions_egress_source\":false,\"mentions_target\":false,\"node\":\"pve02\",\"owns_home_ip\":false,\"rc\":0},{\"has_wg_home\":false,\"mentions_egress_source\":false,\"mentions_target\":false,\"node\":\"pve03\",\"owns_home_ip\":false,\"rc\":0}],\"reference_lines\":[{\"line\":14,\"text\":\"- VM130 edge-vm | pve03 | running | KEEP\"},{\"line\":15,\"text\":\"- VM150 snikket | pve01 | running | KEEP\"},{\"line\":20,\"text\":\"- VM9130 edge-cold-standby | pve02 | stopped | KEEP_DR\"},{\"line\":73,\"text\":\"NOTE exclude_from_reference_or_delete_later=05_edge_compose_safe.tgz\"},{\"line\":75,\"text\":\"NOTE edge-vm disk scsi1 backup=0 risk must be documented\"},{\"line\":77,\"text\":\"NOTE edge health WARN/ERROR items should be documented as known current states\"},{\"line\":101,\"text\":\"04_edge_vm_basic.txt 34506 bytes\"},{\"line\":102,\"text\":\"05_edge_compose_redacted.txt 24228 bytes\"},{\"line\":103,\"text\":\"05_edge_compose_safe.tgz.QUARANTINED.txt 354 bytes\"},{\"line\":104,\"text\":\"05_edge_compose_tar_errors.txt 166 bytes\"},{\"line\":106,\"text\":\"06_edge_npmplus_routes_safe.txt 17350 bytes\"},{\"line\":107,\"text\":\"07_edge_systemd_backup_audit.txt 20694 bytes\"},{\"line\":108,\"text\":\"08_edge_scripts_redacted.txt 198622 bytes\"},{\"line\":149,\"text\":\"- \\u0423 VM130 edge-vm \\u0435\\u0441\\u0442\\u044c \\u0440\\u0438\\u0441\\u043a: \\u0434\\u043e\\u043f\\u043e\\u043b\\u043d\\u0438\\u0442\\u0435\\u043b\\u044c\\u043d\\u044b\\u0439 \\u0434\\u0438\\u0441\\u043a backup=0.\"},{\"line\":157,\"text\":\"- Edge VM: ssh debian@<IP:bc517b4af3298846>, \\u0438\\u0441\\u043f\\u043e\\u043b\\u044c\\u0437\\u043e\\u0432\\u0430\\u0442\\u044c sudo, root-login \\u043d\\u0435 \\u0438\\u0441\\u043f\\u043e\\u043b\\u044c\\u0437\\u043e\\u0432\\u0430\\u0442\\u044c.\"},{\"line\":166,\"text\":\"- VM130 edge-vm pve03 <IP:bc517b4af3298846> Docker ingress/app host.\"},{\"line\":173,\"text\":\"- Edge VM \\u0438\\u043c\\u0435\\u0435\\u0442 vzdump/offhost/restore evidence; \\u0440\\u0438\\u0441\\u043a backup=0 \\u043f\\u043e \\u0434\\u043e\\u043f\\u043e\\u043b\\u043d\\u0438\\u0442\\u0435\\u043b\\u044c\\u043d\\u043e\\u043c\\u0443 \\u0434\\u0438\\u0441\\u043a\\u0443 \\u043e\\u0441\\u0442\\u0430\\u0451\\u0442\\u0441\\u044f.\"},{\"line\":199,\"text\":\"## ROUTER_NETCRAZE_ULTRA_NC1812_20260630\"},{\"line\":226,\"text\":\"### WAN \\u0438 \\u0440\\u0435\\u0437\\u0435\\u0440\\u0432\\u043d\\u044b\\u0439 \\u0438\\u043d\\u0442\\u0435\\u0440\\u043d\\u0435\\u0442\"},{\"line\":227,\"text\":\"- Main WAN: GigabitEthernet1, renamed ISP, description \\u0420\\u043e\\u0441\\u0442\\u0435\\u043b.\"},{\"line\":228,\"text\":\"- WAN security-level: public.\"},{\"line\":229,\"text\":\"- WAN addressing: DHCP.\"},{\"line\":230,\"text\":\"- WAN MTU: 1500.\"},{\"line\":231,\"text\":\"- WAN global priority: 700.\"},{\"line\":232,\"text\":\"- WAN ping-check profile: default.\"},{\"line\":234,\"text\":\"- WAN DHCP observed in router log: <IP:18d462ba98aa4550>, gateway <IP:29948130c37b10e3>.\"},{\"line\":235,\"text\":\"- ISP DNS observed in router log: <IP:009e7a91182f3b0b>, <IP:0c2f3683ba1d821a>.\"},{\"line\":236,\"text\":\"- Backup/mobile WAN: CdcEthernet0, description SIM.\"},{\"line\":238,\"text\":\"- CdcEthernet0 security-level: public.\"},{\"line\":282,\"text\":\"- Default router: <IP:c5eb5a4cc76a5cdb>.\"},{\"line\":311,\"text\":\"- <IP:6e3573c5557733db> -> bc:24:11:f4:c5:d8 WireGuard.\"},{\"line\":312,\"text\":\"- <IP:bc517b4af3298846> -> bc:24:11:e1:f3:3c NPMplus / edge-vm.\"},{\"line\":315,\"text\":\"### NAT / port forwarding\"},{\"line\":318,\"text\":\"- ISP tcpudp/3478 -> bc:24:11:e1:9a:25, Nextcloud Talk TURN.\"},{\"line\":319,\"text\":\"- Home tcp/51820 -> bc:24:11:f4:c5:d8, WireGuard vpn1.\"},{\"line\":327,\"text\":\"### Router management\"},{\"line\":333,\"text\":\"- Telnet port configured: 2323, security-level private; router log shows Telnet disabled later on 2026-06-26.\"},{\"line\":339,\"text\":\"### Router services\"},{\"line\":354,\"text\":\"### Router automation warning\"},{\"line\":357,\"text\":\"- Automation must use router CLI syntax, not bash syntax.\"},{\"line\":366,\"text\":\"- edge-vm: no UPS/NUT/APCUPSD integration discovered.\"},{\"line\":371,\"text\":\"- NetBird service is active on pve01, pve02, pve03 and edge-vm.\"},{\"line\":376,\"text\":\"- edge-vm: FQDN edge-vm.netbird.selfhosted, IPv4 <IP:8ffeea43651fd0fa>.\"},{\"line\":378,\"text\":\"- WireGuard port: 51820.\"},{\"line\":395,\"text\":\"- edge-vm owns most application health, dashboard, ingress, backup, NetBox, NPMplus, certificate, Trivy and vulnerability jobs.\"},{\"line\":455,\"text\":\"- edge-vm timers cover runtime dashboard, Paperless guard, external canary, health metrics, restore drill index, AdGuard rewrite sync, NPMplus cert expiry, NetBox backup/sync, retention, cluster daily status, vulnerability and Trivy scans, ingress hardening and NPMplus admin bind.\"},{\"line\":456,\"text\":\"- pve01 timers cover VPN/NetBird health, health metrics, smartctl, disk space, MkDocs refresh, VPS identity audit, storage capacity, quality gate, evidence catalog, backup freshness, docker health, Filebrowser backup/offhost/restore, NPMplus/Kuma backup, NetBird VPS backup/offhost, Authentik/Gitea/Vaultwarden backup, SOPS secret coverage, mail cloud upload/restore, Immich/Memos/Paperless backup/offhost/restore, auto backup, edge-vm vzdump, secret sanity.\"},{\"line\":459,\"text\":\"- Script hashes were captured for /usr/local/sbin and /usr/local/bin on edge-vm, pve01, pve02 and pve03.\"},{\"line\":531,\"text\":\"- Main active workload: VM130 edge-vm.\"},{\"line\":545,\"text\":\"- Network: vmbr0, gateway <IP:4f9da1283166a1e9>.\"},{\"line\":560,\"text\":\"- Network: vmbr0, gateway <IP:4f9da1283166a1e9>.\"},{\"line\":575,\"text\":\"- Network: vmbr0, gateway <IP:4f9da1283166a1e9>.\"},{\"line\":590,\"text\":\"- Network: vmbr0, gateway <IP:4f9da1283166a1e9>.\"},{\"line\":597,\"text\":\"### VM130 edge-vm\"},{\"line\":600,\"text\":\"- Name: edge-vm.\"},{\"line\":604,\"text\":\"- Role: edge application host / reverse proxy / monitoring / backup automation host.\"},{\"line\":608,\"text\":\"- Network: vmbr0, gateway <IP:4f9da1283166a1e9>.\"},{\"line\":626,\"text\":\"- Network: vmbr0, gateway <IP:4f9da1283166a1e9>.\"},{\"line\":643,\"text\":\"- Network: vmbr0, gateway <IP:4f9da1283166a1e9>.\"},{\"line\":682,\"text\":\"### Router ingress\"},{\"line\":683,\"text\":\"- Public WAN router forwards TCP/80 and TCP/443 to NPMplus on edge-vm, <IP:bc517b4af3298846>.\"},{\"line\":684,\"text\":\"- Router forwards TCP/UDP 3478 to Nextcloud Talk TURN on <IP:4e29a2729bbc4066>.\"},{\"line\":685,\"text\":\"- Router forwards Home TCP/51820 to WireGuard host <IP:6e3573c5557733db>.\"},{\"line\":686,\"text\":\"- NPMplus admin listener is bound to localhost on edge-vm, <IP:12ca17b49af22894>:81; public disabled legacy host npm.gram1.ru exists but enabled=0.\"},{\"line\":689,\"text\":\"- Host: edge-vm, <IP:bc517b4af3298846>.\"},{\"line\":694,\"text\":\"- Public listen ports on edge-vm: <IP:19e36255972107d4>:80 and <IP:19e36255972107d4>:443 by nginx/NPMplus.\"},{\"line\":698,\"text\":\"### Public NPMplus proxy hosts\"},{\"line\":766,\"text\":\"## EDGE_DOCKER_STACKS_REFERENCE_20260630\"},{\"line\":769,\"text\":\"- Host: edge-vm, IP <IP:bc517b4af3298846>.\"},{\"line\":774,\"text\":\"- Public ingress terminates through NPMplus on ports 80/443.\"},{\"line\":864,\"text\":\"- NPMplus public ingress: <IP:19e36255972107d4>:80 and <IP:19e36255972107d4>:443.\"},{\"line\":869,\"text\":\"- Full path inventory is in 133_EDGE_DOCKER_STACKS_SAFE_INVENTORY.txt.\"},{\"line\":870,\"text\":\"- Normalized runtime map is in 134_EDGE_DOCKER_CONTAINER_NORMALIZED_MAP.txt.\"},{\"line\":873,\"text\":\"- Raw Docker/stacks inventory: 133_EDGE_DOCKER_STACKS_SAFE_INVENTORY.txt.\"},{\"line\":874,\"text\":\"- Normalized container map: 134_EDGE_DOCKER_CONTAINER_NORMALIZED_MAP.txt.\"},{\"line\":895,\"text\":\"- VM130 edge-vm: included in homelab-nightly-all, local backup on pve03.\"},{\"line\":898,\"text\":\"- VM130 also has dedicated edge-vm-vzdump backup/offhost/restore health proofs.\"},{\"line\":902,\"text\":\"### Edge VM / VM130 full-image protection\"},{\"line\":903,\"text\":\"- edge-vm-vzdump-backup: STATUS=OK, archive size about 28.2G, SHA256 recorded.\"},{\"line\":904,\"text\":\"- edge-vm-vzdump-offhost: STATUS=OK, destination pve02 /mnt/staging/offhost/edge-vm-vzdump-from-pve03.\"},{\"line\":905,\"text\":\"- edge-vm-vzdump-restore: STATUS=OK, zstd and vma verification OK.\"},{\"line\":906,\"text\":\"- mail-cloud-edge-vm: STATUS=OK, recurring chunked upload, 53 parts, download verification enabled.\"},{\"line\":907,\"text\":\"- Retention for edge-vm cloud upload: RETENTION_KEEP=4.\"},{\"line\":908,\"text\":\"- Edge restore proof offhost: STATUS=OK, ITEMS=14, OK=14.\"},{\"line\":915,\"text\":\"- mail-cloud-restore-drill: STATUS=OK, CRITICAL_OK=2, EDGE_OK=1.\"},{\"line\":934,\"text\":\"- Router self-test config is stored as uploaded/generated reference evidence, not yet automated as recurring router backup.\"},{\"line\":999,\"text\":\"- XenForo SMTP rotation has DB backup proof from earlier rotation work; production forum application-level backup catalog should be expanded separately with CodeVipe-specific DB/files/cron/public cutover details.\"},{\"line\":1003,\"text\":\"- Disk retention policy: STATUS=OK, root used pct observed 70 on edge-vm, removed dirs 0, Docker volume prune NO.\"},{\"line\":1004,\"text\":\"- App backup retention dry-run timer exists on edge-vm.\"},{\"line\":1017,\"text\":\"- Router config backup is currently reference/self-test based, not confirmed as recurring automated backup.\"},{\"line\":1027,\"text\":\"- Primary monitoring host: edge-vm, <IP:bc517b4af3298846>.\"},{\"line\":1033,\"text\":\"- Uptime Kuma container: uptime-kuma, local port <IP:12ca17b49af22894>:3001, public route uptime.gram1.ru and VPN route kuma.vpn.gram1.ru.\"},{\"line\":1034,\"text\":\"- Gotify container: gotify, local port <IP:12ca17b49af22894>:8082, public route gotify.gram1.ru.\"},{\"line\":1039,\"text\":\"- Node exporter on edge-vm: node-exporter, local port <IP:12ca17b49af22894>:9100.\"},{\"line\":1062,\"text\":\"- Edge node exporter scrape target: node-exporter:9100.\"},{\"line\":1084,\"text\":\"- HomelabP0WeeklyEdgeVmVzdumpHealthStale: weekly edge-vm vzdump health older than 8d.\"},{\"line\":1103,\"text\":\"- Alloy relabels container, compose_project, compose_service and host=edge-vm.\"},{\"line\":1137,\"text\":\"- Main health dir on edge-vm: /var/lib/homelab-health.\"},{\"line\":1209,\"text\":\"- edge-vm is reached as debian@<IP:bc517b4af3298846> with sudo.\"},{\"line\":1215,\"text\":\"- pve01 root keys observed: id_rsa, id_ed25519 and public keys.\"}],\"spb_safe\":{\"dnat_target_count\":1,\"dnat_target_sha16\":\"0b7870e2230336f5\",\"egress_exists\":true,\"egress_sha16\":\"6f95765c03a345c9\",\"egress_source_count\":1,\"egress_source_sha16\":\"4e29a2729bbc4066\",\"ingress_exists\":true,\"ingress_sha16\":\"a195c34384dd7b2c\",\"wg_exists\":true,\"wg_listen_port\":51820,\"wg_peer_count\":1,\"wg_sha16\":\"445cd0dd63bffe31\"}}\nSPB_TO_HOME_PORT_PROBE={\"tcp\":{\"3478\":\"TIMEOUT\",\"3479\":\"TIMEOUT\",\"5000\":\"TIMEOUT\",\"5222\":\"TIMEOUT\",\"5349\":\"TIMEOUT\",\"5350\":\"TIMEOUT\"},\"udp_stun\":{\"3478\":{\"ok\":false,\"result\":\"TIMEOUT\"},\"3479\":{\"ok\":false,\"result\":\"TIMEOUT\"}}}\nHOME_PUBLIC_OWNER_COUNT=1\nSNIKKET_TARGET_OWNER_COUNT=1\nSNIKKET_EGRESS_SOURCE_OWNER_COUNT=2\nWG_HOME_OWNER_COUNT=0\nMIGRATION_AUTOMATABLE_ON_KNOWN_HOME_HOST=true\nNEEDS_ROUTER_SPECIFIC_MIGRATION=false\nDIRECT_HOME_TCP_OPEN_COUNT=0\nDIRECT_HOME_STUN_OK_COUNT=0\nDIRECT_SNIKKET_INGRESS_APPEARS_READY=false\nNEXT_ACTION=APPLY_GUARDED_HOME_NFT_MIGRATION\nTASK_COMPLETE=true\nTASK_RESULT=PASS_SPB_SNIKKET_HOME_TOPOLOGY_PREFLIGHT\nDECISION=READ_EXACT_9212_AND_APPLY_ONLY_PROVEN_HOME_EDGE_PATH\nNEXT_GATE=EXACT_9212_HOME_EDGE_TOPOLOGY\nHOMELAB_RESULT_CONTRACT={\"version\":1,\"command_id\":\"SUPPORT-260923-SPB-SNIKKET-HOME-TOPOLOGY-9212R1\",\"status\":\"OK\",\"changes_made\":false,\"rollback_started\":false,\"rollback_restored\":null}\n"
 }
diff --git a/runtime/latest.txt b/runtime/latest.txt
index a1448b04..91506ae1 100644
--- a/runtime/latest.txt
+++ b/runtime/latest.txt
@@ -1,15 +1,15 @@
 CHAT_OUTPUT_BEGIN
-COMMAND_ID=SUPPORT-260923-SKLADCHIK-WINDOWS-USA-TRANSPORT-HISTORY-960R1
+COMMAND_ID=SUPPORT-260923-SPB-SNIKKET-HOME-TOPOLOGY-9212R1
 STATUS=OK
 RC=0
 HOST=pve01
 MODE=read-only
-COMPONENT=windows-usa-transport-history
+COMPONENT=spb-snikket-home-topology-preflight
 REFERENCE_REGISTER_CHECK=OK
 REFERENCE_SHA256=5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66
 ERROR_REGISTER_CHECK=OK
 ERROR_REGISTER_SHA256=3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0
-COMMAND_SHA256=2786db5883b2bbe88426826e9e1794c686766cfaeca376f5d22bea4cdaf6acb4
+COMMAND_SHA256=8b782274900f6bc9aa802887320595dc8daddda038b74f5bb47d7037e275cc95
 DUPLICATE_FAILED_COMMAND_BLOCKED=false
 EXECUTION_STARTED=true
 CHANGE_DECLARED=false
@@ -24,70 +24,49 @@ MUTATION_OUTCOME=NO_MUTATION
 SANITIZED=yes
 SECRETS_INCLUDED=no
 PRIVATE_ADDRESSES_INCLUDED=no
-RAW_EVIDENCE_SHA256=13ab3832027257022765185e9798bfca2f0888ace7f3e0cf5f4a32ba3bf60ac1
-SANITIZED_OUTPUT_SHA256=13ab3832027257022765185e9798bfca2f0888ace7f3e0cf5f4a32ba3bf60ac1
+RAW_EVIDENCE_SHA256=4647a1f838f614aee3bb390bbb1a36f357f9a8bf88e819fbd5f9d977f7cda299
+SANITIZED_OUTPUT_SHA256=4647a1f838f614aee3bb390bbb1a36f357f9a8bf88e819fbd5f9d977f7cda299
 OUTPUT_BEGIN
-W960_BEGIN=true
-COMMAND_ID=SUPPORT-260923-SKLADCHIK-WINDOWS-USA-TRANSPORT-HISTORY-960R1
-MODE=read-only
-COMPONENT=windows-usa-transport-history
-PREDECESSOR_959=ONLY_SELF_PVE01_PLINK_FOUND
-MUTATION_BOUNDARY=NONE_READ_ONLY
-PAGEANT_PROCESS_COUNT=1
-SOCKS64020_NETSTAT_COUNT=0
-HISTORY_FILE_PRESENT=true
-HISTORY_MATCH_HASH=69758058b095e0a5
-HISTORY_MATCH_HASH=4f9832fa88994748
-HISTORY_MATCH_HASH=fcc5840574088229
-HISTORY_MATCH_HASH=247490651a395b52
-HISTORY_MATCH_HASH=247490651a395b52
-HISTORY_MATCH_COUNT=5
-PAGEANT_LIST_VIA_PVE_RC=1
-PAGEANT_KEY_COUNT=0
-WINDOWS_NETBIRD_CLI_PRESENT=true
-WINDOWS_NETBIRD_STATUS_RC=0
-PVEPRO_OVERLAY_IP_FOUND=true
-PVEPRO_OVERLAY_IP_HASH=0f61feb58699a097
-TRANSPORT_CANDIDATE_COUNT=6
-CAND_0_USER_HASH=4813494d137e1631
-CAND_0_HOST_HASH=1fc73136d6d7ddbd
-CAND_0_PORT=22
-CAND_0_SOURCE=PS_HISTORY
-CAND_0_RC=1
-CAND_1_USER_HASH=4813494d137e1631
-CAND_1_HOST_HASH=0f61feb58699a097
-CAND_1_PORT=22
-CAND_1_SOURCE=NETBIRD_OVERLAY
-CAND_1_RC=1
-CAND_2_USER_HASH=a92c36e66a25ee99
-CAND_2_HOST_HASH=0f61feb58699a097
-CAND_2_PORT=22
-CAND_2_SOURCE=NETBIRD_OVERLAY
-CAND_2_RC=1
-CAND_3_USER_HASH=81d93757457f9885
-CAND_3_HOST_HASH=0f61feb58699a097
-CAND_3_PORT=22
-CAND_3_SOURCE=NETBIRD_OVERLAY
-CAND_3_RC=1
-CAND_4_USER_HASH=7804a56a5c7636cc
-CAND_4_HOST_HASH=0f61feb58699a097
-CAND_4_PORT=22
-CAND_4_SOURCE=NETBIRD_OVERLAY
-CAND_4_RC=1
-CAND_5_USER_HASH=8c6976e5b5410415
-CAND_5_HOST_HASH=0f61feb58699a097
-CAND_5_PORT=22
-CAND_5_SOURCE=NETBIRD_OVERLAY
-CAND_5_RC=1
-WORKING_USA_TRANSPORT_FOUND=false
-USA_SERVER_AUDIT_RC=NOT_RUN
-CHANGES_MADE_BY_960=false
-ROLLBACK_STARTED=false
-ROLLBACK_RESTORED=null
-DECISION=HOLD_WINDOWS_USA_TRANSPORT_HISTORY
-NEXT_GATE=TARGETED_TRANSPORT_FIX
-HOMELAB_RESULT_CONTRACT={"version":1,"command_id":"SUPPORT-260923-SKLADCHIK-WINDOWS-USA-TRANSPORT-HISTORY-960R1","status":"FAIL","changes_made":false,"rollback_started":false,"rollback_restored":null}
-W960_END=true
+SNIKKET9212_BEGIN=true
+MODE=READ_ONLY_TOPOLOGY_PREFLIGHT
+MUTATION_BOUNDARY=NONE;NO_SPB_WRITE;NO_HOME_WRITE;NO_DNS_WRITE;NO_SHUTDOWN
+LOCAL9209_BEGIN=true
+CID=SUPPORT-260923-SPB-SNIKKET-HOME-TOPOLOGY-9212R1
+PLINK_PRESENT=true
+SPB_CANDIDATE_COUNT=1
+SPB_CANDIDATE_SHA16=6d6149f42864ce03
+HOME_CANDIDATE_COUNT=1
+HOME_CANDIDATE_SHA16=bc517b4af3298846
+SPB_HASH_MATCH=true
+SPB_PINNED_PROBE_RC=0
+DPAPI_DECRYPTABLE_COUNT=1
+OLD9208_LOCAL_ERR_SHA16=5a00a4ad6f6ef637
+LOCAL_ACCESS_STATUS=PASS
+LOCAL9209_END=true
+SPB_PINNED_ACCESS=PASS
+SPB_SNIKKET_EXTRACT_RC=0
+SPB_SNIKKET_EXTRACT_STDERR_SHA16=01ba4719c80b6fe9
+HOME_TOPOLOGY_AUDIT_RC=0
+SPB_TO_HOME_PORT_PROBE_RC=0
+SPB_TO_HOME_PORT_PROBE_STDERR_SHA16=e3b0c44298fc1c14
+SPB_SNIKKET_RAW_SAFE={"dnat_target_count":1,"dnat_target_sha16":"0b7870e2230336f5","egress_exists":true,"egress_sha16":"6f95765c03a345c9","egress_source_count":1,"egress_source_sha16":"4e29a2729bbc4066","ingress_exists":true,"ingress_sha16":"a195c34384dd7b2c","wg_exists":true,"wg_listen_port":51820,"wg_peer_count":1,"wg_sha16":"445cd0dd63bffe31"}
+HOME_TOPOLOGY9212={"classification":{"automatable_direct_edge":true,"home_public_owner_count":1,"home_public_owners":[{"has_wg_home":false,"mentions_egress_source":true,"mentions_target":true,"name":"edge-vm","node":"pve03","owns_home_ip":true,"rc":0,"type":"qemu","vmid":130}],"needs_router_specific_migration":false,"snikket_egress_source_owner_count":2,"snikket_egress_source_owners":[{"has_wg_home":false,"mentions_egress_source":true,"mentions_target":true,"name":"edge-vm","node":"pve03","owns_home_ip":true,"rc":0,"type":"qemu","vmid":130},{"has_wg_home":false,"mentions_egress_source":true,"mentions_target":false,"name":"snikket","node":"pve01","owns_home_ip":false,"rc":0,"type":"qemu","vmid":150}],"snikket_target_owner_count":1,"snikket_target_owners":[{"has_wg_home":false,"mentions_egress_source":true,"mentions_target":true,"name":"edge-vm","node":"pve03","owns_home_ip":true,"rc":0,"type":"qemu","vmid":130}],"wg_home_owner_count":0,"wg_home_owners":[]},"config_hits":[],"guests":[{"has_wg_home":false,"mentions_egress_source":true,"mentions_target":true,"name":"edge-vm","node":"pve03","owns_home_ip":true,"rc":0,"type":"qemu","vmid":130},{"has_wg_home":false,"mentions_egress_source":true,"mentions_target":false,"name":"snikket","node":"pve01","owns_home_ip":false,"rc":0,"type":"qemu","vmid":150}],"hosts":[{"has_wg_home":false,"mentions_egress_source":false,"mentions_target":false,"node":"pve01","owns_home_ip":false,"rc":0},{"has_wg_home":false,"mentions_egress_source":false,"mentions_target":false,"node":"pve02","owns_home_ip":false,"rc":0},{"has_wg_home":false,"mentions_egress_source":false,"mentions_target":false,"node":"pve03","owns_home_ip":false,"rc":0}],"reference_lines":[{"line":14,"text":"- VM130 edge-vm | pve03 | running | KEEP"},{"line":15,"text":"- VM150 snikket | pve01 | running | KEEP"},{"line":20,"text":"- VM9130 edge-cold-standby | pve02 | stopped | KEEP_DR"},{"line":73,"text":"NOTE exclude_from_reference_or_delete_later=05_edge_compose_safe.tgz"},{"line":75,"text":"NOTE edge-vm disk scsi1 backup=0 risk must be documented"},{"line":77,"text":"NOTE edge health WARN/ERROR items should be documented as known current states"},{"line":101,"text":"04_edge_vm_basic.txt 34506 bytes"},{"line":102,"text":"05_edge_compose_redacted.txt 24228 bytes"},{"line":103,"text":"05_edge_compose_safe.tgz.QUARANTINED.txt 354 bytes"},{"line":104,"text":"05_edge_compose_tar_errors.txt 166 bytes"},{"line":106,"text":"06_edge_npmplus_routes_safe.txt 17350 bytes"},{"line":107,"text":"07_edge_systemd_backup_audit.txt 20694 bytes"},{"line":108,"text":"08_edge_scripts_redacted.txt 198622 bytes"},{"line":149,"text":"- \u0423 VM130 edge-vm \u0435\u0441\u0442\u044c \u0440\u0438\u0441\u043a: \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0439 \u0434\u0438\u0441\u043a backup=0."},{"line":157,"text":"- Edge VM: ssh debian@<IP:bc517b4af3298846>, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c sudo, root-login \u043d\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c."},{"line":166,"text":"- VM130 edge-vm pve03 <IP:bc517b4af3298846> Docker ingress/app host."},{"line":173,"text":"- Edge VM \u0438\u043c\u0435\u0435\u0442 vzdump/offhost/restore evidence; \u0440\u0438\u0441\u043a backup=0 \u043f\u043e \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u043c\u0443 \u0434\u0438\u0441\u043a\u0443 \u043e\u0441\u0442\u0430\u0451\u0442\u0441\u044f."},{"line":199,"text":"## ROUTER_NETCRAZE_ULTRA_NC1812_20260630"},{"line":226,"text":"### WAN \u0438 \u0440\u0435\u0437\u0435\u0440\u0432\u043d\u044b\u0439 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442"},{"line":227,"text":"- Main WAN: GigabitEthernet1, renamed ISP, description \u0420\u043e\u0441\u0442\u0435\u043b."},{"line":228,"text":"- WAN security-level: public."},{"line":229,"text":"- WAN addressing: DHCP."},{"line":230,"text":"- WAN MTU: 1500."},{"line":231,"text":"- WAN global priority: 700."},{"line":232,"text":"- WAN ping-check profile: default."},{"line":234,"text":"- WAN DHCP observed in router log: <IP:18d462ba98aa4550>, gateway <IP:29948130c37b10e3>."},{"line":235,"text":"- ISP DNS observed in router log: <IP:009e7a91182f3b0b>, <IP:0c2f3683ba1d821a>."},{"line":236,"text":"- Backup/mobile WAN: CdcEthernet0, description SIM."},{"line":238,"text":"- CdcEthernet0 security-level: public."},{"line":282,"text":"- Default router: <IP:c5eb5a4cc76a5cdb>."},{"line":311,"text":"- <IP:6e3573c5557733db> -> bc:24:11:f4:c5:d8 WireGuard."},{"line":312,"text":"- <IP:bc517b4af3298846> -> bc:24:11:e1:f3:3c NPMplus / edge-vm."},{"line":315,"text":"### NAT / port forwarding"},{"line":318,"text":"- ISP tcpudp/3478 -> bc:24:11:e1:9a:25, Nextcloud Talk TURN."},{"line":319,"text":"- Home tcp/51820 -> bc:24:11:f4:c5:d8, WireGuard vpn1."},{"line":327,"text":"### Router management"},{"line":333,"text":"- Telnet port configured: 2323, security-level private; router log shows Telnet disabled later on 2026-06-26."},{"line":339,"text":"### Router services"},{"line":354,"text":"### Router automation warning"},{"line":357,"text":"- Automation must use router CLI syntax, not bash syntax."},{"line":366,"text":"- edge-vm: no UPS/NUT/APCUPSD integration discovered."},{"line":371,"text":"- NetBird service is active on pve01, pve02, pve03 and edge-vm."},{"line":376,"text":"- edge-vm: FQDN edge-vm.netbird.selfhosted, IPv4 <IP:8ffeea43651fd0fa>."},{"line":378,"text":"- WireGuard port: 51820."},{"line":395,"text":"- edge-vm owns most application health, dashboard, ingress, backup, NetBox, NPMplus, certificate, Trivy and vulnerability jobs."},{"line":455,"text":"- edge-vm timers cover runtime dashboard, Paperless guard, external canary, health metrics, restore drill index, AdGuard rewrite sync, NPMplus cert expiry, NetBox backup/sync, retention, cluster daily status, vulnerability and Trivy scans, ingress hardening and NPMplus admin bind."},{"line":456,"text":"- pve01 timers cover VPN/NetBird health, health metrics, smartctl, disk space, MkDocs refresh, VPS identity audit, storage capacity, quality gate, evidence catalog, backup freshness, docker health, Filebrowser backup/offhost/restore, NPMplus/Kuma backup, NetBird VPS backup/offhost, Authentik/Gitea/Vaultwarden backup, SOPS secret coverage, mail cloud upload/restore, Immich/Memos/Paperless backup/offhost/restore, auto backup, edge-vm vzdump, secret sanity."},{"line":459,"text":"- Script hashes were captured for /usr/local/sbin and /usr/local/bin on edge-vm, pve01, pve02 and pve03."},{"line":531,"text":"- Main active workload: VM130 edge-vm."},{"line":545,"text":"- Network: vmbr0, gateway <IP:4f9da1283166a1e9>."},{"line":560,"text":"- Network: vmbr0, gateway <IP:4f9da1283166a1e9>."},{"line":575,"text":"- Network: vmbr0, gateway <IP:4f9da1283166a1e9>."},{"line":590,"text":"- Network: vmbr0, gateway <IP:4f9da1283166a1e9>."},{"line":597,"text":"### VM130 edge-vm"},{"line":600,"text":"- Name: edge-vm."},{"line":604,"text":"- Role: edge application host / reverse proxy / monitoring / backup automation host."},{"line":608,"text":"- Network: vmbr0, gateway <IP:4f9da1283166a1e9>."},{"line":626,"text":"- Network: vmbr0, gateway <IP:4f9da1283166a1e9>."},{"line":643,"text":"- Network: vmbr0, gateway <IP:4f9da1283166a1e9>."},{"line":682,"text":"### Router ingress"},{"line":683,"text":"- Public WAN router forwards TCP/80 and TCP/443 to NPMplus on edge-vm, <IP:bc517b4af3298846>."},{"line":684,"text":"- Router forwards TCP/UDP 3478 to Nextcloud Talk TURN on <IP:4e29a2729bbc4066>."},{"line":685,"text":"- Router forwards Home TCP/51820 to WireGuard host <IP:6e3573c5557733db>."},{"line":686,"text":"- NPMplus admin listener is bound to localhost on edge-vm, <IP:12ca17b49af22894>:81; public disabled legacy host npm.gram1.ru exists but enabled=0."},{"line":689,"text":"- Host: edge-vm, <IP:bc517b4af3298846>."},{"line":694,"text":"- Public listen ports on edge-vm: <IP:19e36255972107d4>:80 and <IP:19e36255972107d4>:443 by nginx/NPMplus."},{"line":698,"text":"### Public NPMplus proxy hosts"},{"line":766,"text":"## EDGE_DOCKER_STACKS_REFERENCE_20260630"},{"line":769,"text":"- Host: edge-vm, IP <IP:bc517b4af3298846>."},{"line":774,"text":"- Public ingress terminates through NPMplus on ports 80/443."},{"line":864,"text":"- NPMplus public ingress: <IP:19e36255972107d4>:80 and <IP:19e36255972107d4>:443."},{"line":869,"text":"- Full path inventory is in 133_EDGE_DOCKER_STACKS_SAFE_INVENTORY.txt."},{"line":870,"text":"- Normalized runtime map is in 134_EDGE_DOCKER_CONTAINER_NORMALIZED_MAP.txt."},{"line":873,"text":"- Raw Docker/stacks inventory: 133_EDGE_DOCKER_STACKS_SAFE_INVENTORY.txt."},{"line":874,"text":"- Normalized container map: 134_EDGE_DOCKER_CONTAINER_NORMALIZED_MAP.txt."},{"line":895,"text":"- VM130 edge-vm: included in homelab-nightly-all, local backup on pve03."},{"line":898,"text":"- VM130 also has dedicated edge-vm-vzdump backup/offhost/restore health proofs."},{"line":902,"text":"### Edge VM / VM130 full-image protection"},{"line":903,"text":"- edge-vm-vzdump-backup: STATUS=OK, archive size about 28.2G, SHA256 recorded."},{"line":904,"text":"- edge-vm-vzdump-offhost: STATUS=OK, destination pve02 /mnt/staging/offhost/edge-vm-vzdump-from-pve03."},{"line":905,"text":"- edge-vm-vzdump-restore: STATUS=OK, zstd and vma verification OK."},{"line":906,"text":"- mail-cloud-edge-vm: STATUS=OK, recurring chunked upload, 53 parts, download verification enabled."},{"line":907,"text":"- Retention for edge-vm cloud upload: RETENTION_KEEP=4."},{"line":908,"text":"- Edge restore proof offhost: STATUS=OK, ITEMS=14, OK=14."},{"line":915,"text":"- mail-cloud-restore-drill: STATUS=OK, CRITICAL_OK=2, EDGE_OK=1."},{"line":934,"text":"- Router self-test config is stored as uploaded/generated reference evidence, not yet automated as recurring router backup."},{"line":999,"text":"- XenForo SMTP rotation has DB backup proof from earlier rotation work; production forum application-level backup catalog should be expanded separately with CodeVipe-specific DB/files/cron/public cutover details."},{"line":1003,"text":"- Disk retention policy: STATUS=OK, root used pct observed 70 on edge-vm, removed dirs 0, Docker volume prune NO."},{"line":1004,"text":"- App backup retention dry-run timer exists on edge-vm."},{"line":1017,"text":"- Router config backup is currently reference/self-test based, not confirmed as recurring automated backup."},{"line":1027,"text":"- Primary monitoring host: edge-vm, <IP:bc517b4af3298846>."},{"line":1033,"text":"- Uptime Kuma container: uptime-kuma, local port <IP:12ca17b49af22894>:3001, public route uptime.gram1.ru and VPN route kuma.vpn.gram1.ru."},{"line":1034,"text":"- Gotify container: gotify, local port <IP:12ca17b49af22894>:8082, public route gotify.gram1.ru."},{"line":1039,"text":"- Node exporter on edge-vm: node-exporter, local port <IP:12ca17b49af22894>:9100."},{"line":1062,"text":"- Edge node exporter scrape target: node-exporter:9100."},{"line":1084,"text":"- HomelabP0WeeklyEdgeVmVzdumpHealthStale: weekly edge-vm vzdump health older than 8d."},{"line":1103,"text":"- Alloy relabels container, compose_project, compose_service and host=edge-vm."},{"line":1137,"text":"- Main health dir on edge-vm: /var/lib/homelab-health."},{"line":1209,"text":"- edge-vm is reached as debian@<IP:bc517b4af3298846> with sudo."},{"line":1215,"text":"- pve01 root keys observed: id_rsa, id_ed25519 and public keys."}],"spb_safe":{"dnat_target_count":1,"dnat_target_sha16":"0b7870e2230336f5","egress_exists":true,"egress_sha16":"6f95765c03a345c9","egress_source_count":1,"egress_source_sha16":"4e29a2729bbc4066","ingress_exists":true,"ingress_sha16":"a195c34384dd7b2c","wg_exists":true,"wg_listen_port":51820,"wg_peer_count":1,"wg_sha16":"445cd0dd63bffe31"}}
+SPB_TO_HOME_PORT_PROBE={"tcp":{"3478":"TIMEOUT","3479":"TIMEOUT","5000":"TIMEOUT","5222":"TIMEOUT","5349":"TIMEOUT","5350":"TIMEOUT"},"udp_stun":{"3478":{"ok":false,"result":"TIMEOUT"},"3479":{"ok":false,"result":"TIMEOUT"}}}
+HOME_PUBLIC_OWNER_COUNT=1
+SNIKKET_TARGET_OWNER_COUNT=1
+SNIKKET_EGRESS_SOURCE_OWNER_COUNT=2
+WG_HOME_OWNER_COUNT=0
+MIGRATION_AUTOMATABLE_ON_KNOWN_HOME_HOST=true
+NEEDS_ROUTER_SPECIFIC_MIGRATION=false
+DIRECT_HOME_TCP_OPEN_COUNT=0
+DIRECT_HOME_STUN_OK_COUNT=0
+DIRECT_SNIKKET_INGRESS_APPEARS_READY=false
+NEXT_ACTION=APPLY_GUARDED_HOME_NFT_MIGRATION
+TASK_COMPLETE=true
+TASK_RESULT=PASS_SPB_SNIKKET_HOME_TOPOLOGY_PREFLIGHT
+DECISION=READ_EXACT_9212_AND_APPLY_ONLY_PROVEN_HOME_EDGE_PATH
+NEXT_GATE=EXACT_9212_HOME_EDGE_TOPOLOGY
+HOMELAB_RESULT_CONTRACT={"version":1,"command_id":"SUPPORT-260923-SPB-SNIKKET-HOME-TOPOLOGY-9212R1","status":"OK","changes_made":false,"rollback_started":false,"rollback_restored":null}
 
 OUTPUT_END
 CHAT_OUTPUT_END