diff --git a/runtime/history/SUPPORT-261001-BACKUPV2-GREENRUN-REPLICA-SEMANTICS-99286R1.json b/runtime/history/SUPPORT-261001-BACKUPV2-GREENRUN-REPLICA-SEMANTICS-99286R1.json
new file mode 100644
index 00000000..0637cd2a
--- /dev/null
+++ b/runtime/history/SUPPORT-261001-BACKUPV2-GREENRUN-REPLICA-SEMANTICS-99286R1.json
@@ -0,0 +1,38 @@
+{
+  "schema_version": 1,
+  "channel": "homelab-runtime",
+  "command_id": "SUPPORT-261001-BACKUPV2-GREENRUN-REPLICA-SEMANTICS-99286R1",
+  "status": "OK",
+  "rc": 0,
+  "host": "pve01",
+  "mode": "read-only",
+  "component": "backupv2-greenrun-replica-semantics",
+  "started_at_utc": "2026-10-01T11:56:33Z",
+  "finished_at_utc": "2026-10-01T11:56:33Z",
+  "reference_register_checked": true,
+  "reference_sha256": "5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66",
+  "error_register_checked": true,
+  "error_register_sha256": "3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0",
+  "command_sha256": "61da54040f32177be6f3809e8495cb184cceb11de39b9d9bf7eb6119c2720e57",
+  "duplicate_failed_command_blocked": false,
+  "block_reason": null,
+  "execution_started": true,
+  "change_declared": false,
+  "result_contract_valid": true,
+  "result_contract_status": null,
+  "result_contract_error": null,
+  "command_rc": 0,
+  "changes_made": false,
+  "rollback_started": false,
+  "rollback_restored": null,
+  "mutation_outcome": "NO_MUTATION",
+  "sanitized": true,
+  "secrets_included": false,
+  "private_addresses_included": false,
+  "raw_evidence_retained_locally": true,
+  "raw_evidence_sha256": "f0929f6271f6d6f73ad0dba877ee9ff7adf6772ceb58510da01fc056a0920840",
+  "sanitized_output_sha256": "f0929f6271f6d6f73ad0dba877ee9ff7adf6772ceb58510da01fc056a0920840",
+  "output_truncated_in_json": false,
+  "full_sanitized_output_url": "https://git.gram1.ru/.well-known/homelab-runtime/latest.txt",
+  "output": "BACKUPV2_GREENRUN_REPLICA_SEMANTICS=V1\nINGRESS_HOSTKEY_SELF_BOUND=true\nBACKUPV2_TARGETS_SHA_EXACT=true\nBACKUPV2_RETIRED_US_NETBIRD_EXACT=true\nFN_GREEN_RUN_PRESENT=true\nFN_GREEN_RUN_PARAMS=label\nFN_GREEN_RUN_DIRECT_CALLS=BackupError,append,backup_target,bootstrap_vps_keys,dumps,ensure_router_known_hosts,get,join,len,load_targets,print,sub,sum,upper\nFN_GREEN_RUN_IF_TESTS=failures,_allocator_healthy_ in r\nFN_GREEN_RUN_COMP_FILTERS=t.get(_green1_),t[_type_] _= _control_,t[_type_] == _control_\nFN_GREEN_RUN_IMPORTANT_CALLS=load_targets(),bootstrap_vps_keys(targets),backup_target(t, green_verify=t[_type_] _= _control_)\nFN_GREEN_RUN_RETURNS=0\nFN_GREEN_RUN_KEYS=allocator_healthy,generation,green1,logical_id,payload_bytes,replicas,type\nFN_GREEN_RUN_STRINGS=_CLOUD_BACKUP_TARGET_COUNT=,_CONTROL_VERIFY_TARGET_COUNT=,_GENERATION=,_REPLICAS=,_TARGET_COUNT=,_TARGET_FAILURES,generation,green1,logical_id,replicas\nFN_BACKUP_TARGET_PRESENT=true\nFN_BACKUP_TARGET_PARAMS=t,green_verify\nFN_BACKUP_TARGET_DIRECT_CALLS=BackupError,Path,bool,capture_target,cleanup_source,control_verify,ensure_dir,epoch,exists,generation_id,reconstruct_replica,rmtree,unlink,upload_and_seal,validate_payload,write_state\nFN_BACKUP_TARGET_IF_TESTS=t[_type_] == _control_,green_verify,pathlib.Path(payload).exists(),ha _= hb or ha _= manifest[_payload_sha256_]\nFN_BACKUP_TARGET_COMP_FILTERS=NONE\nFN_BACKUP_TARGET_IMPORTANT_CALLS=capture_target(t, gen, work),upload_and_seal(t, payload, meta),write_state(t[_logical_id_], _SUCCESS_, generation=gen, payload_sha256=manifest[_payload_sha256_], manifest_sha256=msha, replicas=manifest[_replicas_], green_verified=bool(green_verify), last_success_epoch=epoch()),reconstruct_replica(manifest, manifest[_replicas_][0], a),validate_payload(t, a),reconstruct_replica(manifest, manifest[_replicas_][1], b),validate_payload(t, b),write_state(t[_logical_id_], result, generation=gen, reason=e.code, sealed=sealed)\nFN_BACKUP_TARGET_RETURNS=control_verify(t),{_logical_id_: t[_logical_id_], _generation_: gen, _result_: _SUCCESS_, _payload_bytes_: manifest[_payload_bytes_], _replicas_: 2, _allocator_healthy_: alloc[_healthy_]}\nFN_BACKUP_TARGET_KEYS=allocator_healthy,generation,healthy,logical_id,payload_bytes,payload_sha256,replicas,result,type\nFN_BACKUP_TARGET_STRINGS=GREEN_REPLICA_COMPARE,SUCCESS,generation,logical_id,replicas\nFN_SELECT_REPLICAS_PRESENT=true\nFN_SELECT_REPLICAS_PARAMS=rows,payload_bytes,reserve_bytes\nFN_SELECT_REPLICAS_DIRECT_CALLS=BackupError,add,append,dict,get,isinstance,len,set,sort\nFN_SELECT_REPLICAS_IF_TESTS=len(out) _= 2,not isinstance(r.get(_free_), int),r[_free_] < payload_bytes + reserve_bytes,r[_physical_] in phys,len(out) == 2\nFN_SELECT_REPLICAS_COMP_FILTERS=NONE\nFN_SELECT_REPLICAS_IMPORTANT_CALLS=NONE\nFN_SELECT_REPLICAS_RETURNS=out\nFN_SELECT_REPLICAS_KEYS=crypt,free,physical\nFN_SELECT_REPLICAS_STRINGS=NONE\nFN_UPLOAD_AND_SEAL_PRESENT=true\nFN_UPLOAD_AND_SEAL_PARAMS=t,payload_path,source_meta\nFN_UPLOAD_AND_SEAL_DIRECT_CALLS=BackupError,Path,allocator,canonical_json,make_manifest,part_plan,rclone_cat_bytes,rclone_cat_hash,rclone_rcat,remote_exists_any,remote_generation_path,sha256_bytes,sha256_file,stat,utcnow\nFN_UPLOAD_AND_SEAL_IF_TESTS=remote_exists_any(t[_scope_], t[_logical_id_], gen),rclone_cat_bytes(base + _/manifest.json_) _= mb,rclone_cat_bytes(base + _/SEALED.json_) _= sb,got _= part[_sha256_]\nFN_UPLOAD_AND_SEAL_COMP_FILTERS=NONE\nFN_UPLOAD_AND_SEAL_IMPORTANT_CALLS=make_manifest(t[_scope_], t[_logical_id_], gen, n, psha, parts, reps, source_meta),rclone_rcat(base + _/manifest.json_, data=mb),rclone_rcat(base + _/SEALED.json_, data=sb),rclone_rcat(rp, source_path=payload_path, offset=part[_offset_], length=part[_bytes_]),rclone_cat_hash(rp, part[_bytes_]),rclone_cat_bytes(base + _/manifest.json_),rclone_cat_bytes(base + _/SEALED.json_)\nFN_UPLOAD_AND_SEAL_RETURNS=(manifest, msha, {_unhealthy_: bad, _healthy_: healthy})\nFN_UPLOAD_AND_SEAL_KEYS=bytes,crypt,generation,healthy,logical_id,manifest_sha256,name,offset,payload_sha256,schema,scope,sealed_at_utc,sha256,status,unhealthy\nFN_UPLOAD_AND_SEAL_STRINGS=/manifest.json,GENERATION_COLLISION,MANIFEST_READBACK_MISMATCH,generation,logical_id,manifest_sha256\nFN_WRITE_STATE_PRESENT=true\nFN_WRITE_STATE_PARAMS=logical_id,result\nFN_WRITE_STATE_DIRECT_CALLS=BackupError,atomic_write,canonical_json,epoch,utcnow\nFN_WRITE_STATE_IF_TESTS=result not in RESULT_CLASSES,result == _SUCCESS_\nFN_WRITE_STATE_COMP_FILTERS=NONE\nFN_WRITE_STATE_IMPORTANT_CALLS=NONE\nFN_WRITE_STATE_RETURNS=j\nFN_WRITE_STATE_KEYS=last_success_epoch,logical_id,result,schema,updated_at_utc\nFN_WRITE_STATE_STRINGS=SUCCESS,last_success_epoch,logical_id,state\nFN_SCHEDULED_RUN_PRESENT=true\nFN_SCHEDULED_RUN_PARAMS=NONE\nFN_SCHEDULED_RUN_DIRECT_CALLS=backup_target,choose_due_target,load_state_all,load_targets,print\nFN_SCHEDULED_RUN_IF_TESTS=t is None\nFN_SCHEDULED_RUN_COMP_FILTERS=NONE\nFN_SCHEDULED_RUN_IMPORTANT_CALLS=load_targets(),choose_due_target(targets, state),backup_target(t, green_verify=False)\nFN_SCHEDULED_RUN_RETURNS=0,0,2\nFN_SCHEDULED_RUN_KEYS=logical_id\nFN_SCHEDULED_RUN_STRINGS=SCHEDULE_DECISION=DEFER_NO_DUE_TARGET,SCHEDULE_RESULT=SUCCESS,SCHEDULE_TARGET=,logical_id\nFN_CHOOSE_DUE_TARGET_PRESENT=true\nFN_CHOOSE_DUE_TARGET_PARAMS=targets,state,now\nFN_CHOOSE_DUE_TARGET_DIRECT_CALLS=append,epoch,get,int,max,sort\nFN_CHOOSE_DUE_TARGET_IF_TESTS=not c,not t.get(_enabled_, True),last == 0 or age >= due\nFN_CHOOSE_DUE_TARGET_COMP_FILTERS=NONE\nFN_CHOOSE_DUE_TARGET_IMPORTANT_CALLS=NONE\nFN_CHOOSE_DUE_TARGET_RETURNS=c[0][3],None\nFN_CHOOSE_DUE_TARGET_KEYS=due_seconds,enabled,last_success_epoch,logical_id\nFN_CHOOSE_DUE_TARGET_STRINGS=due_seconds,enabled,last_success_epoch,logical_id\nFN_RCLONE_RCAT_PRESENT=true\nFN_RCLONE_RCAT_PARAMS=remote_path,source_path,offset,length,data,timeout\nFN_RCLONE_RCAT_DIRECT_CALLS=BackupError,Popen,close,communicate,kill,len,min,open,rclone_base_args,read,seek,str,write\nFN_RCLONE_RCAT_IF_TESTS=p.returncode _= 0,data is not None,not b\nFN_RCLONE_RCAT_COMP_FILTERS=NONE\nFN_RCLONE_RCAT_IMPORTANT_CALLS=NONE\nFN_RCLONE_RCAT_RETURNS=NONE\nFN_RCLONE_RCAT_KEYS=NONE\nFN_RCLONE_RCAT_STRINGS=RCLONE_RCAT_FAILED\nFN_MAKE_MANIFEST_PRESENT=true\nFN_MAKE_MANIFEST_PARAMS=scope,logical_id,generation,payload_bytes,payload_sha256,parts,replicas,source_meta\nFN_MAKE_MANIFEST_DIRECT_CALLS=BackupError,fullmatch,int,len,sum,utcnow\nFN_MAKE_MANIFEST_IF_TESTS=len(replicas) _= 2 or len({r[_physical_] for r in replicas}) _= 2,not re.fullmatch(_[0-9a-f]{64}_, payload_sha256),sum((int(p[_bytes_]) for p in parts)) _= payload_bytes\nFN_MAKE_MANIFEST_COMP_FILTERS=NONE\nFN_MAKE_MANIFEST_IMPORTANT_CALLS=NONE\nFN_MAKE_MANIFEST_RETURNS={_schema_: 2, _scope_: scope, _logical_id_: logical_id, _generation_: generation, _created_at_utc_: utcnow(), _payload_bytes_: payload_bytes, _payload_sha256_: payload_sha256, _part_size_: PART_SIZE, _parts_: parts, _replicas_: [{_crypt_: r[_crypt_], _physical_: r[_physical_]} for r in replicas], _source_meta_: source_meta}\nFN_MAKE_MANIFEST_KEYS=bytes,created_at_utc,crypt,generation,logical_id,part_size,parts,payload_bytes,payload_sha256,physical,replicas,schema,scope,source_meta\nFN_MAKE_MANIFEST_STRINGS=MANIFEST_PART_TOTAL_MISMATCH,MANIFEST_PAYLOAD_SHA_INVALID,MANIFEST_REPLICA_PHYSICAL_DUPLICATE,generation,logical_id,replicas\nFN_GENERATION_ID_PRESENT=true\nFN_GENERATION_ID_PARAMS=logical_id\nFN_GENERATION_ID_DIRECT_CALLS=hex,now,strftime,urandom\nFN_GENERATION_ID_IF_TESTS=NONE\nFN_GENERATION_ID_COMP_FILTERS=NONE\nFN_GENERATION_ID_IMPORTANT_CALLS=NONE\nFN_GENERATION_ID_RETURNS=f_v2-{logical_id}-{ts}-{os.urandom(6).hex()}_\nFN_GENERATION_ID_KEYS=NONE\nFN_GENERATION_ID_STRINGS=NONE\nFN_LOAD_TARGETS_PRESENT=true\nFN_LOAD_TARGETS_PARAMS=NONE\nFN_LOAD_TARGETS_DIRECT_CALLS=BackupError,get,isinstance,len,loads,read_text,set\nFN_LOAD_TARGETS_IF_TESTS=j.get(_schema_) _= 1 or not isinstance(j.get(_targets_), list),len(ids) _= len(set(ids))\nFN_LOAD_TARGETS_COMP_FILTERS=NONE\nFN_LOAD_TARGETS_IMPORTANT_CALLS=NONE\nFN_LOAD_TARGETS_RETURNS=j[_targets_]\nFN_LOAD_TARGETS_KEYS=logical_id,schema,targets\nFN_LOAD_TARGETS_STRINGS=TARGET_MANIFEST_DUPLICATE,TARGET_MANIFEST_SCHEMA,logical_id,targets\nFN_BOOTSTRAP_VPS_KEYS_PRESENT=true\nFN_BOOTSTRAP_VPS_KEYS_PARAMS=targets\nFN_BOOTSTRAP_VPS_KEYS_DIRECT_CALLS=BackupError,decode,ensure_vps_known_hosts,get,operator_key_fingerprint,run,str,strip,vps_run\nFN_BOOTSTRAP_VPS_KEYS_IF_TESTS=t[_type_] not in (_vps_md_, _vps_spb_),probe.returncode == 0,not os.environ.get(_SSH_AUTH_SOCK_),tag not in (_ADDED_, _ALREADY_)\nFN_BOOTSTRAP_VPS_KEYS_COMP_FILTERS=x[_type_] == _vps_us_\nFN_BOOTSTRAP_VPS_KEYS_IMPORTANT_CALLS=NONE\nFN_BOOTSTRAP_VPS_KEYS_RETURNS=results\nFN_BOOTSTRAP_VPS_KEYS_KEYS=SSH_AUTH_SOCK,logical_id,type\nFN_BOOTSTRAP_VPS_KEYS_STRINGS=SSH_AUTH_SOCK,logical_id,ssh-keygen\nFN_VPS_SSH_ARGV_PRESENT=true\nFN_VPS_SSH_ARGV_PARAMS=t\nFN_VPS_SSH_ARGV_DIRECT_CALLS=str\nFN_VPS_SSH_ARGV_IF_TESTS=use_agent\nFN_VPS_SSH_ARGV_COMP_FILTERS=NONE\nFN_VPS_SSH_ARGV_IMPORTANT_CALLS=NONE\nFN_VPS_SSH_ARGV_RETURNS=a\nFN_VPS_SSH_ARGV_KEYS=host,port,user\nFN_VPS_SSH_ARGV_STRINGS=IdentityAgent=none,StrictHostKeyChecking=yes\nFN_CAPTURE_VPS_US_PRESENT=true\nFN_CAPTURE_VPS_US_PARAMS=t,gen,work\nFN_CAPTURE_VPS_US_DIRECT_CALLS=join,pipe_to_zstd,vps_ssh_argv\nFN_CAPTURE_VPS_US_IF_TESTS=NONE\nFN_CAPTURE_VPS_US_COMP_FILTERS=NONE\nFN_CAPTURE_VPS_US_IMPORTANT_CALLS=NONE\nFN_CAPTURE_VPS_US_RETURNS=(payload, {_generation_: gen, _source_class_: _vps_us_, _consistency_: _SQLITE_ONLINE_BACKUP_PLUS_NONDB_FILES_, _sqlite_count_: 4}, None)\nFN_CAPTURE_VPS_US_KEYS=consistency,generation,source_class,sqlite_count\nFN_CAPTURE_VPS_US_STRINGS=generation\nMAIN_IF_TESTS=len(argv) < 2,cmd == _selftest_,cmd == _green1_,cmd == _green2_,cmd == _scheduled_,cmd == _discover_ and len(argv) == 3\nMAIN_IMPORTANT_CALLS=selftest(),green_run(_GREEN1_),green_run(_GREEN2_),scheduled_run(),discover(argv[2])\nCALLSITE_GREEN_RUN=green_run(_GREEN1_),green_run(_GREEN2_)\nCALLSITE_SCHEDULED_RUN=scheduled_run()\nCALLSITE_BACKUP_TARGET=backup_target(t, green_verify=False),backup_target(t, green_verify=t[_type_] _= _control_)\nCALLSITE_SELECT_REPLICAS=select_replicas(rows, payload_bytes, RESERVE_BYTES)\nCALLSITE_UPLOAD_AND_SEAL=upload_and_seal(t, payload, meta)\nCALLSITE_WRITE_STATE=write_state(t[_logical_id_], _SUCCESS_, generation=gen, verification=_existing_control_engine_verify_, last_success_epoch=epoch()),write_state(t[_logical_id_], _SUCCESS_, generation=gen, payload_sha256=manifest[_payload_sha256_], manifest_sha256=msha, replicas=manifest[_replicas_], green_verified=bool(green_verify), last_success_epoch=epoch()),write_state(t[_logical_id_], result, generation=gen, reason=e.code, sealed=sealed)\nTARGET_VPS_US_COUNT=1\nTARGET_VPS_US_1_SAFE={\"due_seconds\":86400,\"enabled\":false,\"green1\":true,\"logical_id\":\"us-netbird\",\"port\":22,\"scope\":\"vps\",\"type\":\"vps_us\",\"user\":\"root\"}\nTARGET_VPS_MD_COUNT=1\nTARGET_VPS_MD_1_SAFE={\"due_seconds\":86400,\"enabled\":false,\"green1\":true,\"logical_id\":\"md-relay\",\"port\":22,\"scope\":\"vps\",\"type\":\"vps_md\",\"user\":\"ops\"}\nTARGET_VPS_SPB_COUNT=1\nTARGET_VPS_SPB_1_SAFE={\"due_seconds\":86400,\"enabled\":false,\"green1\":true,\"logical_id\":\"spb-ingress\",\"port\":22,\"scope\":\"vps\",\"type\":\"vps_spb\",\"user\":\"edgeadmin\"}\nUS_NETBIRD_AST_OCCURRENCES={t[_logical_id_] for t in default_targets() if t.get(_green1_)} == {_ct112_, _node-pve01_, _md-relay_, _spb-ingress_, _us-netbird_, _router-netcraze_, _xf-codevipe_, _xf-zakrutim_, _control-bootstrap-v2_}\nBACKUPV2_SERVICE_EXECSTART=/usr/local/sbin/homelab-backup-v2 scheduled\nBACKUPV2_TIMER_ACTIVE=active\nBACKUPV2_TIMER_ENABLED=enabled\nBACKUPV2_GREENRUN_REPLICA_READY=true\nDECISION=PASS_BACKUPV2_GREENRUN_REPLICA_SEMANTICS\nNEXT_GATE=FINAL_BACKUPV2_NEW_TARGET_INTEGRATION_AND_GLOBAL_CLOSEOUT\nTASK_RESULT=BACKUPV2_GREENRUN_REPLICA_SEMANTICS\nCHANGES_MADE=false\nROLLBACK_STARTED=false\nROLLBACK_RESTORED=null\nMUTATION_OUTCOME=NO_MUTATION\nHOMELAB_RESULT_CONTRACT={\"version\":1,\"command_id\":\"SUPPORT-261001-BACKUPV2-GREENRUN-REPLICA-SEMANTICS-99286R1\",\"status\":\"OK\",\"changes_made\":false,\"rollback_started\":false,\"rollback_restored\":null}\n"
+}
diff --git a/runtime/history/SUPPORT-261001-BACKUPV2-GREENRUN-REPLICA-SEMANTICS-99286R1.txt b/runtime/history/SUPPORT-261001-BACKUPV2-GREENRUN-REPLICA-SEMANTICS-99286R1.txt
new file mode 100644
index 00000000..674b1502
--- /dev/null
+++ b/runtime/history/SUPPORT-261001-BACKUPV2-GREENRUN-REPLICA-SEMANTICS-99286R1.txt
@@ -0,0 +1,189 @@
+CHAT_OUTPUT_BEGIN
+COMMAND_ID=SUPPORT-261001-BACKUPV2-GREENRUN-REPLICA-SEMANTICS-99286R1
+STATUS=OK
+RC=0
+HOST=pve01
+MODE=read-only
+COMPONENT=backupv2-greenrun-replica-semantics
+REFERENCE_REGISTER_CHECK=OK
+REFERENCE_SHA256=5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66
+ERROR_REGISTER_CHECK=OK
+ERROR_REGISTER_SHA256=3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0
+COMMAND_SHA256=61da54040f32177be6f3809e8495cb184cceb11de39b9d9bf7eb6119c2720e57
+DUPLICATE_FAILED_COMMAND_BLOCKED=false
+EXECUTION_STARTED=true
+CHANGE_DECLARED=false
+RESULT_CONTRACT_VALID=true
+RESULT_CONTRACT_STATUS=NOT_APPLICABLE
+RESULT_CONTRACT_ERROR=NONE
+COMMAND_RC=0
+CHANGES_MADE=false
+ROLLBACK_STARTED=false
+ROLLBACK_RESTORED=null
+MUTATION_OUTCOME=NO_MUTATION
+SANITIZED=yes
+SECRETS_INCLUDED=no
+PRIVATE_ADDRESSES_INCLUDED=no
+RAW_EVIDENCE_SHA256=f0929f6271f6d6f73ad0dba877ee9ff7adf6772ceb58510da01fc056a0920840
+SANITIZED_OUTPUT_SHA256=f0929f6271f6d6f73ad0dba877ee9ff7adf6772ceb58510da01fc056a0920840
+OUTPUT_BEGIN
+BACKUPV2_GREENRUN_REPLICA_SEMANTICS=V1
+INGRESS_HOSTKEY_SELF_BOUND=true
+BACKUPV2_TARGETS_SHA_EXACT=true
+BACKUPV2_RETIRED_US_NETBIRD_EXACT=true
+FN_GREEN_RUN_PRESENT=true
+FN_GREEN_RUN_PARAMS=label
+FN_GREEN_RUN_DIRECT_CALLS=BackupError,append,backup_target,bootstrap_vps_keys,dumps,ensure_router_known_hosts,get,join,len,load_targets,print,sub,sum,upper
+FN_GREEN_RUN_IF_TESTS=failures,_allocator_healthy_ in r
+FN_GREEN_RUN_COMP_FILTERS=t.get(_green1_),t[_type_] _= _control_,t[_type_] == _control_
+FN_GREEN_RUN_IMPORTANT_CALLS=load_targets(),bootstrap_vps_keys(targets),backup_target(t, green_verify=t[_type_] _= _control_)
+FN_GREEN_RUN_RETURNS=0
+FN_GREEN_RUN_KEYS=allocator_healthy,generation,green1,logical_id,payload_bytes,replicas,type
+FN_GREEN_RUN_STRINGS=_CLOUD_BACKUP_TARGET_COUNT=,_CONTROL_VERIFY_TARGET_COUNT=,_GENERATION=,_REPLICAS=,_TARGET_COUNT=,_TARGET_FAILURES,generation,green1,logical_id,replicas
+FN_BACKUP_TARGET_PRESENT=true
+FN_BACKUP_TARGET_PARAMS=t,green_verify
+FN_BACKUP_TARGET_DIRECT_CALLS=BackupError,Path,bool,capture_target,cleanup_source,control_verify,ensure_dir,epoch,exists,generation_id,reconstruct_replica,rmtree,unlink,upload_and_seal,validate_payload,write_state
+FN_BACKUP_TARGET_IF_TESTS=t[_type_] == _control_,green_verify,pathlib.Path(payload).exists(),ha _= hb or ha _= manifest[_payload_sha256_]
+FN_BACKUP_TARGET_COMP_FILTERS=NONE
+FN_BACKUP_TARGET_IMPORTANT_CALLS=capture_target(t, gen, work),upload_and_seal(t, payload, meta),write_state(t[_logical_id_], _SUCCESS_, generation=gen, payload_sha256=manifest[_payload_sha256_], manifest_sha256=msha, replicas=manifest[_replicas_], green_verified=bool(green_verify), last_success_epoch=epoch()),reconstruct_replica(manifest, manifest[_replicas_][0], a),validate_payload(t, a),reconstruct_replica(manifest, manifest[_replicas_][1], b),validate_payload(t, b),write_state(t[_logical_id_], result, generation=gen, reason=e.code, sealed=sealed)
+FN_BACKUP_TARGET_RETURNS=control_verify(t),{_logical_id_: t[_logical_id_], _generation_: gen, _result_: _SUCCESS_, _payload_bytes_: manifest[_payload_bytes_], _replicas_: 2, _allocator_healthy_: alloc[_healthy_]}
+FN_BACKUP_TARGET_KEYS=allocator_healthy,generation,healthy,logical_id,payload_bytes,payload_sha256,replicas,result,type
+FN_BACKUP_TARGET_STRINGS=GREEN_REPLICA_COMPARE,SUCCESS,generation,logical_id,replicas
+FN_SELECT_REPLICAS_PRESENT=true
+FN_SELECT_REPLICAS_PARAMS=rows,payload_bytes,reserve_bytes
+FN_SELECT_REPLICAS_DIRECT_CALLS=BackupError,add,append,dict,get,isinstance,len,set,sort
+FN_SELECT_REPLICAS_IF_TESTS=len(out) _= 2,not isinstance(r.get(_free_), int),r[_free_] < payload_bytes + reserve_bytes,r[_physical_] in phys,len(out) == 2
+FN_SELECT_REPLICAS_COMP_FILTERS=NONE
+FN_SELECT_REPLICAS_IMPORTANT_CALLS=NONE
+FN_SELECT_REPLICAS_RETURNS=out
+FN_SELECT_REPLICAS_KEYS=crypt,free,physical
+FN_SELECT_REPLICAS_STRINGS=NONE
+FN_UPLOAD_AND_SEAL_PRESENT=true
+FN_UPLOAD_AND_SEAL_PARAMS=t,payload_path,source_meta
+FN_UPLOAD_AND_SEAL_DIRECT_CALLS=BackupError,Path,allocator,canonical_json,make_manifest,part_plan,rclone_cat_bytes,rclone_cat_hash,rclone_rcat,remote_exists_any,remote_generation_path,sha256_bytes,sha256_file,stat,utcnow
+FN_UPLOAD_AND_SEAL_IF_TESTS=remote_exists_any(t[_scope_], t[_logical_id_], gen),rclone_cat_bytes(base + _/manifest.json_) _= mb,rclone_cat_bytes(base + _/SEALED.json_) _= sb,got _= part[_sha256_]
+FN_UPLOAD_AND_SEAL_COMP_FILTERS=NONE
+FN_UPLOAD_AND_SEAL_IMPORTANT_CALLS=make_manifest(t[_scope_], t[_logical_id_], gen, n, psha, parts, reps, source_meta),rclone_rcat(base + _/manifest.json_, data=mb),rclone_rcat(base + _/SEALED.json_, data=sb),rclone_rcat(rp, source_path=payload_path, offset=part[_offset_], length=part[_bytes_]),rclone_cat_hash(rp, part[_bytes_]),rclone_cat_bytes(base + _/manifest.json_),rclone_cat_bytes(base + _/SEALED.json_)
+FN_UPLOAD_AND_SEAL_RETURNS=(manifest, msha, {_unhealthy_: bad, _healthy_: healthy})
+FN_UPLOAD_AND_SEAL_KEYS=bytes,crypt,generation,healthy,logical_id,manifest_sha256,name,offset,payload_sha256,schema,scope,sealed_at_utc,sha256,status,unhealthy
+FN_UPLOAD_AND_SEAL_STRINGS=/manifest.json,GENERATION_COLLISION,MANIFEST_READBACK_MISMATCH,generation,logical_id,manifest_sha256
+FN_WRITE_STATE_PRESENT=true
+FN_WRITE_STATE_PARAMS=logical_id,result
+FN_WRITE_STATE_DIRECT_CALLS=BackupError,atomic_write,canonical_json,epoch,utcnow
+FN_WRITE_STATE_IF_TESTS=result not in RESULT_CLASSES,result == _SUCCESS_
+FN_WRITE_STATE_COMP_FILTERS=NONE
+FN_WRITE_STATE_IMPORTANT_CALLS=NONE
+FN_WRITE_STATE_RETURNS=j
+FN_WRITE_STATE_KEYS=last_success_epoch,logical_id,result,schema,updated_at_utc
+FN_WRITE_STATE_STRINGS=SUCCESS,last_success_epoch,logical_id,state
+FN_SCHEDULED_RUN_PRESENT=true
+FN_SCHEDULED_RUN_PARAMS=NONE
+FN_SCHEDULED_RUN_DIRECT_CALLS=backup_target,choose_due_target,load_state_all,load_targets,print
+FN_SCHEDULED_RUN_IF_TESTS=t is None
+FN_SCHEDULED_RUN_COMP_FILTERS=NONE
+FN_SCHEDULED_RUN_IMPORTANT_CALLS=load_targets(),choose_due_target(targets, state),backup_target(t, green_verify=False)
+FN_SCHEDULED_RUN_RETURNS=0,0,2
+FN_SCHEDULED_RUN_KEYS=logical_id
+FN_SCHEDULED_RUN_STRINGS=SCHEDULE_DECISION=DEFER_NO_DUE_TARGET,SCHEDULE_RESULT=SUCCESS,SCHEDULE_TARGET=,logical_id
+FN_CHOOSE_DUE_TARGET_PRESENT=true
+FN_CHOOSE_DUE_TARGET_PARAMS=targets,state,now
+FN_CHOOSE_DUE_TARGET_DIRECT_CALLS=append,epoch,get,int,max,sort
+FN_CHOOSE_DUE_TARGET_IF_TESTS=not c,not t.get(_enabled_, True),last == 0 or age >= due
+FN_CHOOSE_DUE_TARGET_COMP_FILTERS=NONE
+FN_CHOOSE_DUE_TARGET_IMPORTANT_CALLS=NONE
+FN_CHOOSE_DUE_TARGET_RETURNS=c[0][3],None
+FN_CHOOSE_DUE_TARGET_KEYS=due_seconds,enabled,last_success_epoch,logical_id
+FN_CHOOSE_DUE_TARGET_STRINGS=due_seconds,enabled,last_success_epoch,logical_id
+FN_RCLONE_RCAT_PRESENT=true
+FN_RCLONE_RCAT_PARAMS=remote_path,source_path,offset,length,data,timeout
+FN_RCLONE_RCAT_DIRECT_CALLS=BackupError,Popen,close,communicate,kill,len,min,open,rclone_base_args,read,seek,str,write
+FN_RCLONE_RCAT_IF_TESTS=p.returncode _= 0,data is not None,not b
+FN_RCLONE_RCAT_COMP_FILTERS=NONE
+FN_RCLONE_RCAT_IMPORTANT_CALLS=NONE
+FN_RCLONE_RCAT_RETURNS=NONE
+FN_RCLONE_RCAT_KEYS=NONE
+FN_RCLONE_RCAT_STRINGS=RCLONE_RCAT_FAILED
+FN_MAKE_MANIFEST_PRESENT=true
+FN_MAKE_MANIFEST_PARAMS=scope,logical_id,generation,payload_bytes,payload_sha256,parts,replicas,source_meta
+FN_MAKE_MANIFEST_DIRECT_CALLS=BackupError,fullmatch,int,len,sum,utcnow
+FN_MAKE_MANIFEST_IF_TESTS=len(replicas) _= 2 or len({r[_physical_] for r in replicas}) _= 2,not re.fullmatch(_[0-9a-f]{64}_, payload_sha256),sum((int(p[_bytes_]) for p in parts)) _= payload_bytes
+FN_MAKE_MANIFEST_COMP_FILTERS=NONE
+FN_MAKE_MANIFEST_IMPORTANT_CALLS=NONE
+FN_MAKE_MANIFEST_RETURNS={_schema_: 2, _scope_: scope, _logical_id_: logical_id, _generation_: generation, _created_at_utc_: utcnow(), _payload_bytes_: payload_bytes, _payload_sha256_: payload_sha256, _part_size_: PART_SIZE, _parts_: parts, _replicas_: [{_crypt_: r[_crypt_], _physical_: r[_physical_]} for r in replicas], _source_meta_: source_meta}
+FN_MAKE_MANIFEST_KEYS=bytes,created_at_utc,crypt,generation,logical_id,part_size,parts,payload_bytes,payload_sha256,physical,replicas,schema,scope,source_meta
+FN_MAKE_MANIFEST_STRINGS=MANIFEST_PART_TOTAL_MISMATCH,MANIFEST_PAYLOAD_SHA_INVALID,MANIFEST_REPLICA_PHYSICAL_DUPLICATE,generation,logical_id,replicas
+FN_GENERATION_ID_PRESENT=true
+FN_GENERATION_ID_PARAMS=logical_id
+FN_GENERATION_ID_DIRECT_CALLS=hex,now,strftime,urandom
+FN_GENERATION_ID_IF_TESTS=NONE
+FN_GENERATION_ID_COMP_FILTERS=NONE
+FN_GENERATION_ID_IMPORTANT_CALLS=NONE
+FN_GENERATION_ID_RETURNS=f_v2-{logical_id}-{ts}-{os.urandom(6).hex()}_
+FN_GENERATION_ID_KEYS=NONE
+FN_GENERATION_ID_STRINGS=NONE
+FN_LOAD_TARGETS_PRESENT=true
+FN_LOAD_TARGETS_PARAMS=NONE
+FN_LOAD_TARGETS_DIRECT_CALLS=BackupError,get,isinstance,len,loads,read_text,set
+FN_LOAD_TARGETS_IF_TESTS=j.get(_schema_) _= 1 or not isinstance(j.get(_targets_), list),len(ids) _= len(set(ids))
+FN_LOAD_TARGETS_COMP_FILTERS=NONE
+FN_LOAD_TARGETS_IMPORTANT_CALLS=NONE
+FN_LOAD_TARGETS_RETURNS=j[_targets_]
+FN_LOAD_TARGETS_KEYS=logical_id,schema,targets
+FN_LOAD_TARGETS_STRINGS=TARGET_MANIFEST_DUPLICATE,TARGET_MANIFEST_SCHEMA,logical_id,targets
+FN_BOOTSTRAP_VPS_KEYS_PRESENT=true
+FN_BOOTSTRAP_VPS_KEYS_PARAMS=targets
+FN_BOOTSTRAP_VPS_KEYS_DIRECT_CALLS=BackupError,decode,ensure_vps_known_hosts,get,operator_key_fingerprint,run,str,strip,vps_run
+FN_BOOTSTRAP_VPS_KEYS_IF_TESTS=t[_type_] not in (_vps_md_, _vps_spb_),probe.returncode == 0,not os.environ.get(_SSH_AUTH_SOCK_),tag not in (_ADDED_, _ALREADY_)
+FN_BOOTSTRAP_VPS_KEYS_COMP_FILTERS=x[_type_] == _vps_us_
+FN_BOOTSTRAP_VPS_KEYS_IMPORTANT_CALLS=NONE
+FN_BOOTSTRAP_VPS_KEYS_RETURNS=results
+FN_BOOTSTRAP_VPS_KEYS_KEYS=SSH_AUTH_SOCK,logical_id,type
+FN_BOOTSTRAP_VPS_KEYS_STRINGS=SSH_AUTH_SOCK,logical_id,ssh-keygen
+FN_VPS_SSH_ARGV_PRESENT=true
+FN_VPS_SSH_ARGV_PARAMS=t
+FN_VPS_SSH_ARGV_DIRECT_CALLS=str
+FN_VPS_SSH_ARGV_IF_TESTS=use_agent
+FN_VPS_SSH_ARGV_COMP_FILTERS=NONE
+FN_VPS_SSH_ARGV_IMPORTANT_CALLS=NONE
+FN_VPS_SSH_ARGV_RETURNS=a
+FN_VPS_SSH_ARGV_KEYS=host,port,user
+FN_VPS_SSH_ARGV_STRINGS=IdentityAgent=none,StrictHostKeyChecking=yes
+FN_CAPTURE_VPS_US_PRESENT=true
+FN_CAPTURE_VPS_US_PARAMS=t,gen,work
+FN_CAPTURE_VPS_US_DIRECT_CALLS=join,pipe_to_zstd,vps_ssh_argv
+FN_CAPTURE_VPS_US_IF_TESTS=NONE
+FN_CAPTURE_VPS_US_COMP_FILTERS=NONE
+FN_CAPTURE_VPS_US_IMPORTANT_CALLS=NONE
+FN_CAPTURE_VPS_US_RETURNS=(payload, {_generation_: gen, _source_class_: _vps_us_, _consistency_: _SQLITE_ONLINE_BACKUP_PLUS_NONDB_FILES_, _sqlite_count_: 4}, None)
+FN_CAPTURE_VPS_US_KEYS=consistency,generation,source_class,sqlite_count
+FN_CAPTURE_VPS_US_STRINGS=generation
+MAIN_IF_TESTS=len(argv) < 2,cmd == _selftest_,cmd == _green1_,cmd == _green2_,cmd == _scheduled_,cmd == _discover_ and len(argv) == 3
+MAIN_IMPORTANT_CALLS=selftest(),green_run(_GREEN1_),green_run(_GREEN2_),scheduled_run(),discover(argv[2])
+CALLSITE_GREEN_RUN=green_run(_GREEN1_),green_run(_GREEN2_)
+CALLSITE_SCHEDULED_RUN=scheduled_run()
+CALLSITE_BACKUP_TARGET=backup_target(t, green_verify=False),backup_target(t, green_verify=t[_type_] _= _control_)
+CALLSITE_SELECT_REPLICAS=select_replicas(rows, payload_bytes, RESERVE_BYTES)
+CALLSITE_UPLOAD_AND_SEAL=upload_and_seal(t, payload, meta)
+CALLSITE_WRITE_STATE=write_state(t[_logical_id_], _SUCCESS_, generation=gen, verification=_existing_control_engine_verify_, last_success_epoch=epoch()),write_state(t[_logical_id_], _SUCCESS_, generation=gen, payload_sha256=manifest[_payload_sha256_], manifest_sha256=msha, replicas=manifest[_replicas_], green_verified=bool(green_verify), last_success_epoch=epoch()),write_state(t[_logical_id_], result, generation=gen, reason=e.code, sealed=sealed)
+TARGET_VPS_US_COUNT=1
+TARGET_VPS_US_1_SAFE={"due_seconds":86400,"enabled":false,"green1":true,"logical_id":"us-netbird","port":22,"scope":"vps","type":"vps_us","user":"root"}
+TARGET_VPS_MD_COUNT=1
+TARGET_VPS_MD_1_SAFE={"due_seconds":86400,"enabled":false,"green1":true,"logical_id":"md-relay","port":22,"scope":"vps","type":"vps_md","user":"ops"}
+TARGET_VPS_SPB_COUNT=1
+TARGET_VPS_SPB_1_SAFE={"due_seconds":86400,"enabled":false,"green1":true,"logical_id":"spb-ingress","port":22,"scope":"vps","type":"vps_spb","user":"edgeadmin"}
+US_NETBIRD_AST_OCCURRENCES={t[_logical_id_] for t in default_targets() if t.get(_green1_)} == {_ct112_, _node-pve01_, _md-relay_, _spb-ingress_, _us-netbird_, _router-netcraze_, _xf-codevipe_, _xf-zakrutim_, _control-bootstrap-v2_}
+BACKUPV2_SERVICE_EXECSTART=/usr/local/sbin/homelab-backup-v2 scheduled
+BACKUPV2_TIMER_ACTIVE=active
+BACKUPV2_TIMER_ENABLED=enabled
+BACKUPV2_GREENRUN_REPLICA_READY=true
+DECISION=PASS_BACKUPV2_GREENRUN_REPLICA_SEMANTICS
+NEXT_GATE=FINAL_BACKUPV2_NEW_TARGET_INTEGRATION_AND_GLOBAL_CLOSEOUT
+TASK_RESULT=BACKUPV2_GREENRUN_REPLICA_SEMANTICS
+CHANGES_MADE=false
+ROLLBACK_STARTED=false
+ROLLBACK_RESTORED=null
+MUTATION_OUTCOME=NO_MUTATION
+HOMELAB_RESULT_CONTRACT={"version":1,"command_id":"SUPPORT-261001-BACKUPV2-GREENRUN-REPLICA-SEMANTICS-99286R1","status":"OK","changes_made":false,"rollback_started":false,"rollback_restored":null}
+
+OUTPUT_END
+CHAT_OUTPUT_END
diff --git a/runtime/latest.json b/runtime/latest.json
index bd6ba614..0637cd2a 100644
--- a/runtime/latest.json
+++ b/runtime/latest.json
@@ -1,19 +1,19 @@
 {
   "schema_version": 1,
   "channel": "homelab-runtime",
-  "command_id": "SUPPORT-261001-BACKUPV2-VPSUS-TRANSITIVE-SEMANTICS-99285R1",
+  "command_id": "SUPPORT-261001-BACKUPV2-GREENRUN-REPLICA-SEMANTICS-99286R1",
   "status": "OK",
   "rc": 0,
   "host": "pve01",
   "mode": "read-only",
-  "component": "backupv2-vpsus-transitive-semantics",
-  "started_at_utc": "2026-10-01T11:50:49Z",
-  "finished_at_utc": "2026-10-01T11:50:50Z",
+  "component": "backupv2-greenrun-replica-semantics",
+  "started_at_utc": "2026-10-01T11:56:33Z",
+  "finished_at_utc": "2026-10-01T11:56:33Z",
   "reference_register_checked": true,
   "reference_sha256": "5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66",
   "error_register_checked": true,
   "error_register_sha256": "3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0",
-  "command_sha256": "27b102f3e3240a033380d3a6f3392e21bdca6d812921151fa1106998c22f94dc",
+  "command_sha256": "61da54040f32177be6f3809e8495cb184cceb11de39b9d9bf7eb6119c2720e57",
   "duplicate_failed_command_blocked": false,
   "block_reason": null,
   "execution_started": true,
@@ -30,9 +30,9 @@
   "secrets_included": false,
   "private_addresses_included": false,
   "raw_evidence_retained_locally": true,
-  "raw_evidence_sha256": "b77913f393173f1e230d495c3fc0664a38043598a85e35cc42690270c1cf3cde",
-  "sanitized_output_sha256": "b6cb5200d2c3b090aa71baba03c91c14d87ff55fd915dfedff95ac4be1a503ac",
+  "raw_evidence_sha256": "f0929f6271f6d6f73ad0dba877ee9ff7adf6772ceb58510da01fc056a0920840",
+  "sanitized_output_sha256": "f0929f6271f6d6f73ad0dba877ee9ff7adf6772ceb58510da01fc056a0920840",
   "output_truncated_in_json": false,
   "full_sanitized_output_url": "https://git.gram1.ru/.well-known/homelab-runtime/latest.txt",
-  "output": "BACKUPV2_VPSUS_TRANSITIVE_SEMANTICS=V1\nINGRESS_HOSTKEY_SELF_BOUND=true\nOPERATOR_KEY_PRESENT=true\nOPERATOR_KEY_FP_MATCH=true\nBACKUPV2_TARGETS_SHA_EXACT=true\nBACKUPV2_RETIRED_US_NETBIRD_EXACT=true\nLEGACY_AST_PASS=true\nENTRY_CAPTURE_VPS_US_PRESENT=true\nENTRY_CAPTURE_VPS_US_REACHABLE=capture_vps_us,pipe_to_zstd,vps_ssh_argv\nENTRY_CAPTURE_VPS_US_DIRECT_CALLS=join,pipe_to_zstd,vps_ssh_argv\nENTRY_BOOTSTRAP_VPS_KEYS_PRESENT=true\nENTRY_BOOTSTRAP_VPS_KEYS_REACHABLE=atomic_write,bootstrap_vps_keys,ensure_dir,ensure_vps_known_hosts,operator_key_fingerprint,run,scan_hostkey_line,vps_run,vps_ssh_argv\nENTRY_BOOTSTRAP_VPS_KEYS_DIRECT_CALLS=BackupError,decode,ensure_vps_known_hosts,get,operator_key_fingerprint,run,str,strip,vps_run\nENTRY_ENSURE_VPS_KNOWN_HOSTS_PRESENT=true\nENTRY_ENSURE_VPS_KNOWN_HOSTS_REACHABLE=atomic_write,ensure_dir,ensure_vps_known_hosts,run,scan_hostkey_line\nENTRY_ENSURE_VPS_KNOWN_HOSTS_DIRECT_CALLS=append,atomic_write,encode,join,scan_hostkey_line\nENTRY_CAPTURE_TARGET_PRESENT=true\nENTRY_CAPTURE_TARGET_REACHABLE=_default_unprivileged_lxc,_historical_graph_env,_isolated_guest266_dump_argv,_lxc_job,_require_exact_source,_router_assignments,_router_expand,_router_matching_brace,_router_passfile_literals,_router_strip_outer_quotes,_stream_argv_to_local,canonical_json,capture_node_bundle,capture_pve_guest,capture_router,capture_target,capture_vps_md,capture_vps_spb,capture_vps_us,capture_xenforo,cluster_inventory,epoch,make_tar_zst_bytes,mapped_scratch_probe,node_bundle_paths,parse_router_legacy,pipe_to_zstd,proven_lxc_dump_argv,qga_exec,remote_hashset,router_read,run,sha256_bytes,sha256_file,ssh_remote,vps_run,vps_ssh_argv,xf_guest_builder\nENTRY_CAPTURE_TARGET_DIRECT_CALLS=BackupError,capture_node_bundle,capture_pve_guest,capture_router,capture_vps_md,capture_vps_spb,capture_vps_us,capture_xenforo\nENTRY_GREEN_RUN_PRESENT=true\nENTRY_GREEN_RUN_REACHABLE=_default_unprivileged_lxc,_historical_graph_env,_isolated_guest266_dump_argv,_lxc_job,_require_exact_source,_router_assignments,_router_expand,_router_matching_brace,_router_passfile_literals,_router_strip_outer_quotes,_stream_argv_to_local,allocator,atomic_write,backup_target,bootstrap_vps_keys,canonical_json,capture_node_bundle,capture_pve_guest,capture_router,capture_target,capture_vps_md,capture_vps_spb,capture_vps_us,capture_xenforo,cleanup_source,cluster_inventory,control_verify,ensure_dir,ensure_router_known_hosts,ensure_vps_known_hosts,epoch,generation_id,green_run,load_targets,locate_exact_sha,make_manifest,make_tar_zst_bytes,mapped_scratch_probe,node_bundle_paths,operator_key_fingerprint,parse_router_legacy,part_plan,pipe_to_zstd,proven_lxc_dump_argv,qga_exec,rclone_about,rclone_base_args,rclone_cat_bytes,rclone_cat_hash,rclone_rcat,reconstruct_replica,remote_exists_any,remote_generation_path,remote_hashset,router_read,run,scan_hostkey_line,select_replicas,sha256_bytes,sha256_file,ssh_remote,upload_and_seal,utcnow,validate_payload,validate_tar_zst,vps_run,vps_ssh_argv,write_state,xf_guest_builder\nENTRY_GREEN_RUN_DIRECT_CALLS=BackupError,append,backup_target,bootstrap_vps_keys,dumps,ensure_router_known_hosts,get,join,len,load_targets,print,sub,sum,upper\nENTRY_MAIN_PRESENT=true\nENTRY_MAIN_REACHABLE=_default_unprivileged_lxc,_historical_graph_env,_isolated_guest266_dump_argv,_isolated_release_graph_selftest,_lxc_job,_pve_dumpdir_spec,_require_exact_source,_router_assignments,_router_expand,_router_matching_brace,_router_passfile_literals,_router_strip_outer_quotes,_stream_argv_to_local,allocator,atomic_write,backup_target,bootstrap_vps_keys,canonical_json,capture_node_bundle,capture_pve_guest,capture_router,capture_target,capture_vps_md,capture_vps_spb,capture_vps_us,capture_xenforo,choose_due_target,cleanup_source,cluster_inventory,control_verify,default_targets,discover,ensure_dir,ensure_router_known_hosts,ensure_vps_known_hosts,epoch,generation_id,green_run,load_state_all,load_targets,locate_exact_sha,main,make_manifest,make_tar_zst_bytes,mapped_scratch_probe,node_bundle_paths,operator_key_fingerprint,parse_router_legacy,part_plan,pipe_to_zstd,proven_lxc_dump_argv,qga_exec,rclone_about,rclone_base_args,rclone_cat_bytes,rclone_cat_hash,rclone_rcat,reconstruct_replica,remote_exists_any,remote_generation_path,remote_hashset,router_read,run,scan_hostkey_line,scheduled_run,select_replicas,selftest,sha256_bytes,sha256_file,ssh_remote,upload_and_seal,utcnow,validate_payload,validate_tar_zst,vps_run,vps_ssh_argv,write_state,xf_guest_builder\nENTRY_MAIN_DIRECT_CALLS=discover,green_run,len,print,scheduled_run,selftest\nENTRY_DEFAULT_TARGETS_PRESENT=true\nENTRY_DEFAULT_TARGETS_REACHABLE=default_targets\nENTRY_DEFAULT_TARGETS_DIRECT_CALLS=append,str\nENTRY_VALIDATE_PAYLOAD_PRESENT=true\nENTRY_VALIDATE_PAYLOAD_REACHABLE=run,validate_payload,validate_tar_zst\nENTRY_VALIDATE_PAYLOAD_DIRECT_CALLS=BackupError,Popen,close,communicate,len,run,str,validate_tar_zst,wait,which\nVPS_US_IF_TESTS=typ in (_pve_node_bundle_, _vps_md_, _vps_spb_, _vps_us_, _router_),typ == _vps_us_,t[_type_] not in (_vps_md_, _vps_spb_, _vps_us_)\nVPS_US_IF_TEST_COUNT=3\nUS_NETBIRD_IF_TESTS=NONE\nUS_NETBIRD_IF_TEST_COUNT=0\nGREEN1_IF_TESTS=cmd == _green1_\nGREEN1_IF_TEST_COUNT=1\nALL_IF_TESTS=NONE\nALL_IF_TEST_COUNT=0\nVPS_US_TRANSITIVE_STRINGS=IdentityAgent=none,StrictHostKeyChecking=yes,UserKnownHostsFile=,host,port,user,vps_us\nBOOTSTRAP_TRANSITIVE_STRINGS=HOSTKEY_PIN_MISMATCH,IdentityAgent=none,SSH_AUTH_SOCK,StrictHostKeyChecking=yes,UserKnownHostsFile=,host,hostkey_fingerprint,logical_id,port,ssh-ed25519,ssh-keygen,user,vps_us\nKNOWNHOST_TRANSITIVE_STRINGS=HOSTKEY_PIN_MISMATCH,host,hostkey_fingerprint,port,ssh-ed25519,vps_us\nGREEN_TRANSITIVE_STRINGS=/manifest.json,[SENSITIVE_PATH],/usr/bin/lxc-usernsexec,CONTROL_ENGINE_IDENTITY,GREEN_REPLICA_COMPARE,HISTORICAL_RELEASE_GRAPH_IDENTITY,HOSTKEY_PIN_MISMATCH,IMPORT_PACKAGE_OR_SAFE_CLI_NOT_BLIND_CONFIG_REPLACE,IdentityAgent=none,LXC_CUSTOM_IDMAP_UNSUPPORTED,MANIFEST_PART_TOTAL_MISMATCH,MANIFEST_PAYLOAD_SHA_INVALID,MANIFEST_READBACK_MISMATCH,MANIFEST_REPLICA_PHYSICAL_DUPLICATE,P270_IDENTITY,P282_IDENTITY,PATH=/usr/sbin:/usr/bin:/sbin:/bin_ export PATH_ exec ,PYTHONNOUSERSITE,RCLONE_ABOUT_JSON,RCLONE_CAT_FAILED,RCLONE_CAT_SIZE_MISMATCH,RCLONE_CAT_TIMEOUT,RCLONE_FREE_UNKNOWN,RCLONE_RCAT_FAILED,RCLONE_SMALL_OBJECT_TOO_LARGE,ROUTER_KNOWN_HOSTS_IDENTITY,ROUTER_LEGACY_SCRIPT_IDENTITY,SSH_AUTH_SOCK,StrictHostKeyChecking=yes,TARGET_MANIFEST_DUPLICATE,TARGET_MANIFEST_SCHEMA,UserKnownHostsFile=,_REPLICAS=,__s_(_:export_s+)_([A-Za-z_][A-Za-z0-9_]_)=(._)_,_bsshpass_b[__n]__(_:___s)-f_s+(__[___]_____[__]___[__s_]+),_if not root.startswith(_/var/www/forums/_) or not db.startswith(_xf__): raise SystemExit(20)_tmp=pathlib.Path(_/tmp/homelab-v2-xf-_+token)_ tmp.mkdir(mode=0o700,exist_ok=False)_dump=tmp/_db.sql__ out=pathlib.Path(_/tmp/homelab-v2-xf-_+token+_.tar.zst_)_lock=None_try:_  if strategy==_global_read_lock_:_    lock=subprocess.Popen([_mariadb_,_--user=root_,_--batch_,_--skip-column-names_,_--unbuffered_],stdin=subprocess.PIPE,stdout=subprocess.PIPE,stderr=subprocess.DEVNULL,text=True,bufsize=1)_    lock.stdin.write(_FLUSH TABLES WITH READ LOCK_ SELECT _LOCKED___n_)_ lock.stdin.flush()_    rr,_,_=select.select([lock.stdout],[],[],5)_    if not rr or lock.stdout.readline().strip()_=_LOCKED_: raise RuntimeError(_LOCK_ACQUIRE_)_    dump_timeout=15_  else: dump_timeout=180_  with open(dump,_wb_) as f:_    argv=[_mariadb-dump_,_--user=root_,_--quick_,_--skip-lock-tables_,_--hex-blob_,_--routines_,_,etc/hostname,etc/hosts,etc/pve/user.cfg,green1,host,hostkey_fingerprint,import base64,sys_ p=sys.argv[1]_ o=int(sys.argv[2])_ n=int(sys.argv[3])_ f=open(p,_rb_)_ f.seek(o)_ b=f.read(n)_ f.close()_ sys.stdout.write(base64.b64encode(b).decode()),import hashlib,json,os,pathlib,select,shutil,subprocess,tempfile,time_root=,logical_id,lxc-usernsexec,manifest_sha256,port,replicas,reported_maxdisk_bytes,reported_maxmem_bytes,root/.ssh/id_ed25519_netbird_operator,root/.ssh/id_ed25519_netbird_operator.pub,ssh-ed25519,ssh-keygen,user,vps_us\nVPS_US_TRANSITIVE_KEYS=host,port,user\nGREEN_TRANSITIVE_KEYS=SSH_AUTH_SOCK,allocator_healthy,app_root,archive_cap_bytes,bytes,crypt,db_bytes,db_name,dump_strategy,exit-code,exitcode,exited,free,generation,green1,guest_type,healthy,host,hostkey_fingerprint,kind,last_success_epoch,logical_id,maxdisk,maxmem,name,node,offset,out-data,parts,path,payload_bytes,payload_sha256,physical,port,replicas,schema,scope,sha256,slug,status,targets,template,type,user,vmid\nBOOTSTRAP_TRANSITIVE_KEYS=SSH_AUTH_SOCK,host,hostkey_fingerprint,logical_id,port,type,user\nSEMANTIC_PATH_LITERALS=/etc/homelab-backup-v2,[SENSITIVE_PATH],[SENSITIVE_PATH]\nTRANSITIVE_EXTERNAL_COMMANDS=python3,ssh,ssh-keygen,tar,zstd\nVPS_US_SSH_CLI_FLAGS=-T,-i,-o,-p,-q\nUS_NETBIRD_COMPARISONS=_t[_logical_id_] for t in default_targets() if t.get(_green1_)_ == __ct112_, _node-pve01_, _md-relay_, _spb-ingress_, _us-netbird_, _router-netcraze_, _xf-codevipe_, _xf-zakrutim_, _control-bootstrap-v2__\nVPS_US_COMPARISONS=typ in (_pve_node_bundle_, _vps_md_, _vps_spb_, _vps_us_, _router_),typ == _vps_us_,t[_type_] not in (_vps_md_, _vps_spb_, _vps_us_),x[_type_] == _vps_us_\nCAPTURE_VPS_US_CALLSITES=capture_vps_us(t, gen, work)\nGREEN_RUN_CALLSITES=green_run(_GREEN1_),green_run(_GREEN2_)\nTARGET_TYPE_SUMMARY=control:1:1:1,pve_guest:13:13:1,pve_node_bundle:3:3:1,router:1:1:1,vps_md:1:0:1,vps_spb:1:0:1,vps_us:1:0:1,xenforo:7:7:2\nRCLONE_REMOTE_COUNT=26\nRCLONE_REMOTE_NAMES=pve01-mail-01,pve01-mail-01-crypt,pve01-mail-02,pve01-mail-02-crypt,pve01-mail-03,pve01-mail-03-crypt,pve01-mail-04,pve01-mail-04-crypt,pve01-mail-05,pve01-mail-05-crypt,pve02-mail-01,pve02-mail-01-crypt,pve02-mail-02,pve02-mail-02-crypt,pve02-mail-03,pve02-mail-03-crypt,pve02-mail-04,pve02-mail-04-crypt,pve03-mail-01,pve03-mail-01-crypt,pve03-mail-02,pve03-mail-02-crypt,pve03-mail-03,pve03-mail-03-crypt,pve03-mail-04,pve03-mail-04-crypt\nRCLONE_GREEN_NAMED_REMOTES=NONE\nRUNNER_REALPATH=/usr/local/sbin/homelab-backup-v2\nRUNNER_SHA=894f8ea346b53a3d7846dbd6eeb5b89333957eb6d7a4f2f64fd4557cae176e1c\nBACKUPV2_SERVICE_EXECSTART=/usr/local/sbin/homelab-backup-v2 scheduled\nPVE01_TARGET_PIN_SUCCESS=0/3\nPVE01_OPERATOR_TARGET_SSH_PASS=false\nPVE01_OPERATOR_TARGET_UID0=false\nBACKUPV2_FINAL_CHANGE_INPUT_READY=false\nDECISION=HOLD_BACKUPV2_VPSUS_TRANSITIVE_SEMANTICS\nNEXT_GATE=RCA_BACKUPV2_VPSUS_KEY_OR_GREEN_REPLICA\nTASK_RESULT=BACKUPV2_VPSUS_TRANSITIVE_SEMANTICS\nCHANGES_MADE=false\nROLLBACK_STARTED=false\nROLLBACK_RESTORED=null\nMUTATION_OUTCOME=NO_MUTATION\nHOMELAB_RESULT_CONTRACT={\"version\":1,\"command_id\":\"SUPPORT-261001-BACKUPV2-VPSUS-TRANSITIVE-SEMANTICS-99285R1\",\"status\":\"OK\",\"changes_made\":false,\"rollback_started\":false,\"rollback_restored\":null}\n"
+  "output": "BACKUPV2_GREENRUN_REPLICA_SEMANTICS=V1\nINGRESS_HOSTKEY_SELF_BOUND=true\nBACKUPV2_TARGETS_SHA_EXACT=true\nBACKUPV2_RETIRED_US_NETBIRD_EXACT=true\nFN_GREEN_RUN_PRESENT=true\nFN_GREEN_RUN_PARAMS=label\nFN_GREEN_RUN_DIRECT_CALLS=BackupError,append,backup_target,bootstrap_vps_keys,dumps,ensure_router_known_hosts,get,join,len,load_targets,print,sub,sum,upper\nFN_GREEN_RUN_IF_TESTS=failures,_allocator_healthy_ in r\nFN_GREEN_RUN_COMP_FILTERS=t.get(_green1_),t[_type_] _= _control_,t[_type_] == _control_\nFN_GREEN_RUN_IMPORTANT_CALLS=load_targets(),bootstrap_vps_keys(targets),backup_target(t, green_verify=t[_type_] _= _control_)\nFN_GREEN_RUN_RETURNS=0\nFN_GREEN_RUN_KEYS=allocator_healthy,generation,green1,logical_id,payload_bytes,replicas,type\nFN_GREEN_RUN_STRINGS=_CLOUD_BACKUP_TARGET_COUNT=,_CONTROL_VERIFY_TARGET_COUNT=,_GENERATION=,_REPLICAS=,_TARGET_COUNT=,_TARGET_FAILURES,generation,green1,logical_id,replicas\nFN_BACKUP_TARGET_PRESENT=true\nFN_BACKUP_TARGET_PARAMS=t,green_verify\nFN_BACKUP_TARGET_DIRECT_CALLS=BackupError,Path,bool,capture_target,cleanup_source,control_verify,ensure_dir,epoch,exists,generation_id,reconstruct_replica,rmtree,unlink,upload_and_seal,validate_payload,write_state\nFN_BACKUP_TARGET_IF_TESTS=t[_type_] == _control_,green_verify,pathlib.Path(payload).exists(),ha _= hb or ha _= manifest[_payload_sha256_]\nFN_BACKUP_TARGET_COMP_FILTERS=NONE\nFN_BACKUP_TARGET_IMPORTANT_CALLS=capture_target(t, gen, work),upload_and_seal(t, payload, meta),write_state(t[_logical_id_], _SUCCESS_, generation=gen, payload_sha256=manifest[_payload_sha256_], manifest_sha256=msha, replicas=manifest[_replicas_], green_verified=bool(green_verify), last_success_epoch=epoch()),reconstruct_replica(manifest, manifest[_replicas_][0], a),validate_payload(t, a),reconstruct_replica(manifest, manifest[_replicas_][1], b),validate_payload(t, b),write_state(t[_logical_id_], result, generation=gen, reason=e.code, sealed=sealed)\nFN_BACKUP_TARGET_RETURNS=control_verify(t),{_logical_id_: t[_logical_id_], _generation_: gen, _result_: _SUCCESS_, _payload_bytes_: manifest[_payload_bytes_], _replicas_: 2, _allocator_healthy_: alloc[_healthy_]}\nFN_BACKUP_TARGET_KEYS=allocator_healthy,generation,healthy,logical_id,payload_bytes,payload_sha256,replicas,result,type\nFN_BACKUP_TARGET_STRINGS=GREEN_REPLICA_COMPARE,SUCCESS,generation,logical_id,replicas\nFN_SELECT_REPLICAS_PRESENT=true\nFN_SELECT_REPLICAS_PARAMS=rows,payload_bytes,reserve_bytes\nFN_SELECT_REPLICAS_DIRECT_CALLS=BackupError,add,append,dict,get,isinstance,len,set,sort\nFN_SELECT_REPLICAS_IF_TESTS=len(out) _= 2,not isinstance(r.get(_free_), int),r[_free_] < payload_bytes + reserve_bytes,r[_physical_] in phys,len(out) == 2\nFN_SELECT_REPLICAS_COMP_FILTERS=NONE\nFN_SELECT_REPLICAS_IMPORTANT_CALLS=NONE\nFN_SELECT_REPLICAS_RETURNS=out\nFN_SELECT_REPLICAS_KEYS=crypt,free,physical\nFN_SELECT_REPLICAS_STRINGS=NONE\nFN_UPLOAD_AND_SEAL_PRESENT=true\nFN_UPLOAD_AND_SEAL_PARAMS=t,payload_path,source_meta\nFN_UPLOAD_AND_SEAL_DIRECT_CALLS=BackupError,Path,allocator,canonical_json,make_manifest,part_plan,rclone_cat_bytes,rclone_cat_hash,rclone_rcat,remote_exists_any,remote_generation_path,sha256_bytes,sha256_file,stat,utcnow\nFN_UPLOAD_AND_SEAL_IF_TESTS=remote_exists_any(t[_scope_], t[_logical_id_], gen),rclone_cat_bytes(base + _/manifest.json_) _= mb,rclone_cat_bytes(base + _/SEALED.json_) _= sb,got _= part[_sha256_]\nFN_UPLOAD_AND_SEAL_COMP_FILTERS=NONE\nFN_UPLOAD_AND_SEAL_IMPORTANT_CALLS=make_manifest(t[_scope_], t[_logical_id_], gen, n, psha, parts, reps, source_meta),rclone_rcat(base + _/manifest.json_, data=mb),rclone_rcat(base + _/SEALED.json_, data=sb),rclone_rcat(rp, source_path=payload_path, offset=part[_offset_], length=part[_bytes_]),rclone_cat_hash(rp, part[_bytes_]),rclone_cat_bytes(base + _/manifest.json_),rclone_cat_bytes(base + _/SEALED.json_)\nFN_UPLOAD_AND_SEAL_RETURNS=(manifest, msha, {_unhealthy_: bad, _healthy_: healthy})\nFN_UPLOAD_AND_SEAL_KEYS=bytes,crypt,generation,healthy,logical_id,manifest_sha256,name,offset,payload_sha256,schema,scope,sealed_at_utc,sha256,status,unhealthy\nFN_UPLOAD_AND_SEAL_STRINGS=/manifest.json,GENERATION_COLLISION,MANIFEST_READBACK_MISMATCH,generation,logical_id,manifest_sha256\nFN_WRITE_STATE_PRESENT=true\nFN_WRITE_STATE_PARAMS=logical_id,result\nFN_WRITE_STATE_DIRECT_CALLS=BackupError,atomic_write,canonical_json,epoch,utcnow\nFN_WRITE_STATE_IF_TESTS=result not in RESULT_CLASSES,result == _SUCCESS_\nFN_WRITE_STATE_COMP_FILTERS=NONE\nFN_WRITE_STATE_IMPORTANT_CALLS=NONE\nFN_WRITE_STATE_RETURNS=j\nFN_WRITE_STATE_KEYS=last_success_epoch,logical_id,result,schema,updated_at_utc\nFN_WRITE_STATE_STRINGS=SUCCESS,last_success_epoch,logical_id,state\nFN_SCHEDULED_RUN_PRESENT=true\nFN_SCHEDULED_RUN_PARAMS=NONE\nFN_SCHEDULED_RUN_DIRECT_CALLS=backup_target,choose_due_target,load_state_all,load_targets,print\nFN_SCHEDULED_RUN_IF_TESTS=t is None\nFN_SCHEDULED_RUN_COMP_FILTERS=NONE\nFN_SCHEDULED_RUN_IMPORTANT_CALLS=load_targets(),choose_due_target(targets, state),backup_target(t, green_verify=False)\nFN_SCHEDULED_RUN_RETURNS=0,0,2\nFN_SCHEDULED_RUN_KEYS=logical_id\nFN_SCHEDULED_RUN_STRINGS=SCHEDULE_DECISION=DEFER_NO_DUE_TARGET,SCHEDULE_RESULT=SUCCESS,SCHEDULE_TARGET=,logical_id\nFN_CHOOSE_DUE_TARGET_PRESENT=true\nFN_CHOOSE_DUE_TARGET_PARAMS=targets,state,now\nFN_CHOOSE_DUE_TARGET_DIRECT_CALLS=append,epoch,get,int,max,sort\nFN_CHOOSE_DUE_TARGET_IF_TESTS=not c,not t.get(_enabled_, True),last == 0 or age >= due\nFN_CHOOSE_DUE_TARGET_COMP_FILTERS=NONE\nFN_CHOOSE_DUE_TARGET_IMPORTANT_CALLS=NONE\nFN_CHOOSE_DUE_TARGET_RETURNS=c[0][3],None\nFN_CHOOSE_DUE_TARGET_KEYS=due_seconds,enabled,last_success_epoch,logical_id\nFN_CHOOSE_DUE_TARGET_STRINGS=due_seconds,enabled,last_success_epoch,logical_id\nFN_RCLONE_RCAT_PRESENT=true\nFN_RCLONE_RCAT_PARAMS=remote_path,source_path,offset,length,data,timeout\nFN_RCLONE_RCAT_DIRECT_CALLS=BackupError,Popen,close,communicate,kill,len,min,open,rclone_base_args,read,seek,str,write\nFN_RCLONE_RCAT_IF_TESTS=p.returncode _= 0,data is not None,not b\nFN_RCLONE_RCAT_COMP_FILTERS=NONE\nFN_RCLONE_RCAT_IMPORTANT_CALLS=NONE\nFN_RCLONE_RCAT_RETURNS=NONE\nFN_RCLONE_RCAT_KEYS=NONE\nFN_RCLONE_RCAT_STRINGS=RCLONE_RCAT_FAILED\nFN_MAKE_MANIFEST_PRESENT=true\nFN_MAKE_MANIFEST_PARAMS=scope,logical_id,generation,payload_bytes,payload_sha256,parts,replicas,source_meta\nFN_MAKE_MANIFEST_DIRECT_CALLS=BackupError,fullmatch,int,len,sum,utcnow\nFN_MAKE_MANIFEST_IF_TESTS=len(replicas) _= 2 or len({r[_physical_] for r in replicas}) _= 2,not re.fullmatch(_[0-9a-f]{64}_, payload_sha256),sum((int(p[_bytes_]) for p in parts)) _= payload_bytes\nFN_MAKE_MANIFEST_COMP_FILTERS=NONE\nFN_MAKE_MANIFEST_IMPORTANT_CALLS=NONE\nFN_MAKE_MANIFEST_RETURNS={_schema_: 2, _scope_: scope, _logical_id_: logical_id, _generation_: generation, _created_at_utc_: utcnow(), _payload_bytes_: payload_bytes, _payload_sha256_: payload_sha256, _part_size_: PART_SIZE, _parts_: parts, _replicas_: [{_crypt_: r[_crypt_], _physical_: r[_physical_]} for r in replicas], _source_meta_: source_meta}\nFN_MAKE_MANIFEST_KEYS=bytes,created_at_utc,crypt,generation,logical_id,part_size,parts,payload_bytes,payload_sha256,physical,replicas,schema,scope,source_meta\nFN_MAKE_MANIFEST_STRINGS=MANIFEST_PART_TOTAL_MISMATCH,MANIFEST_PAYLOAD_SHA_INVALID,MANIFEST_REPLICA_PHYSICAL_DUPLICATE,generation,logical_id,replicas\nFN_GENERATION_ID_PRESENT=true\nFN_GENERATION_ID_PARAMS=logical_id\nFN_GENERATION_ID_DIRECT_CALLS=hex,now,strftime,urandom\nFN_GENERATION_ID_IF_TESTS=NONE\nFN_GENERATION_ID_COMP_FILTERS=NONE\nFN_GENERATION_ID_IMPORTANT_CALLS=NONE\nFN_GENERATION_ID_RETURNS=f_v2-{logical_id}-{ts}-{os.urandom(6).hex()}_\nFN_GENERATION_ID_KEYS=NONE\nFN_GENERATION_ID_STRINGS=NONE\nFN_LOAD_TARGETS_PRESENT=true\nFN_LOAD_TARGETS_PARAMS=NONE\nFN_LOAD_TARGETS_DIRECT_CALLS=BackupError,get,isinstance,len,loads,read_text,set\nFN_LOAD_TARGETS_IF_TESTS=j.get(_schema_) _= 1 or not isinstance(j.get(_targets_), list),len(ids) _= len(set(ids))\nFN_LOAD_TARGETS_COMP_FILTERS=NONE\nFN_LOAD_TARGETS_IMPORTANT_CALLS=NONE\nFN_LOAD_TARGETS_RETURNS=j[_targets_]\nFN_LOAD_TARGETS_KEYS=logical_id,schema,targets\nFN_LOAD_TARGETS_STRINGS=TARGET_MANIFEST_DUPLICATE,TARGET_MANIFEST_SCHEMA,logical_id,targets\nFN_BOOTSTRAP_VPS_KEYS_PRESENT=true\nFN_BOOTSTRAP_VPS_KEYS_PARAMS=targets\nFN_BOOTSTRAP_VPS_KEYS_DIRECT_CALLS=BackupError,decode,ensure_vps_known_hosts,get,operator_key_fingerprint,run,str,strip,vps_run\nFN_BOOTSTRAP_VPS_KEYS_IF_TESTS=t[_type_] not in (_vps_md_, _vps_spb_),probe.returncode == 0,not os.environ.get(_SSH_AUTH_SOCK_),tag not in (_ADDED_, _ALREADY_)\nFN_BOOTSTRAP_VPS_KEYS_COMP_FILTERS=x[_type_] == _vps_us_\nFN_BOOTSTRAP_VPS_KEYS_IMPORTANT_CALLS=NONE\nFN_BOOTSTRAP_VPS_KEYS_RETURNS=results\nFN_BOOTSTRAP_VPS_KEYS_KEYS=SSH_AUTH_SOCK,logical_id,type\nFN_BOOTSTRAP_VPS_KEYS_STRINGS=SSH_AUTH_SOCK,logical_id,ssh-keygen\nFN_VPS_SSH_ARGV_PRESENT=true\nFN_VPS_SSH_ARGV_PARAMS=t\nFN_VPS_SSH_ARGV_DIRECT_CALLS=str\nFN_VPS_SSH_ARGV_IF_TESTS=use_agent\nFN_VPS_SSH_ARGV_COMP_FILTERS=NONE\nFN_VPS_SSH_ARGV_IMPORTANT_CALLS=NONE\nFN_VPS_SSH_ARGV_RETURNS=a\nFN_VPS_SSH_ARGV_KEYS=host,port,user\nFN_VPS_SSH_ARGV_STRINGS=IdentityAgent=none,StrictHostKeyChecking=yes\nFN_CAPTURE_VPS_US_PRESENT=true\nFN_CAPTURE_VPS_US_PARAMS=t,gen,work\nFN_CAPTURE_VPS_US_DIRECT_CALLS=join,pipe_to_zstd,vps_ssh_argv\nFN_CAPTURE_VPS_US_IF_TESTS=NONE\nFN_CAPTURE_VPS_US_COMP_FILTERS=NONE\nFN_CAPTURE_VPS_US_IMPORTANT_CALLS=NONE\nFN_CAPTURE_VPS_US_RETURNS=(payload, {_generation_: gen, _source_class_: _vps_us_, _consistency_: _SQLITE_ONLINE_BACKUP_PLUS_NONDB_FILES_, _sqlite_count_: 4}, None)\nFN_CAPTURE_VPS_US_KEYS=consistency,generation,source_class,sqlite_count\nFN_CAPTURE_VPS_US_STRINGS=generation\nMAIN_IF_TESTS=len(argv) < 2,cmd == _selftest_,cmd == _green1_,cmd == _green2_,cmd == _scheduled_,cmd == _discover_ and len(argv) == 3\nMAIN_IMPORTANT_CALLS=selftest(),green_run(_GREEN1_),green_run(_GREEN2_),scheduled_run(),discover(argv[2])\nCALLSITE_GREEN_RUN=green_run(_GREEN1_),green_run(_GREEN2_)\nCALLSITE_SCHEDULED_RUN=scheduled_run()\nCALLSITE_BACKUP_TARGET=backup_target(t, green_verify=False),backup_target(t, green_verify=t[_type_] _= _control_)\nCALLSITE_SELECT_REPLICAS=select_replicas(rows, payload_bytes, RESERVE_BYTES)\nCALLSITE_UPLOAD_AND_SEAL=upload_and_seal(t, payload, meta)\nCALLSITE_WRITE_STATE=write_state(t[_logical_id_], _SUCCESS_, generation=gen, verification=_existing_control_engine_verify_, last_success_epoch=epoch()),write_state(t[_logical_id_], _SUCCESS_, generation=gen, payload_sha256=manifest[_payload_sha256_], manifest_sha256=msha, replicas=manifest[_replicas_], green_verified=bool(green_verify), last_success_epoch=epoch()),write_state(t[_logical_id_], result, generation=gen, reason=e.code, sealed=sealed)\nTARGET_VPS_US_COUNT=1\nTARGET_VPS_US_1_SAFE={\"due_seconds\":86400,\"enabled\":false,\"green1\":true,\"logical_id\":\"us-netbird\",\"port\":22,\"scope\":\"vps\",\"type\":\"vps_us\",\"user\":\"root\"}\nTARGET_VPS_MD_COUNT=1\nTARGET_VPS_MD_1_SAFE={\"due_seconds\":86400,\"enabled\":false,\"green1\":true,\"logical_id\":\"md-relay\",\"port\":22,\"scope\":\"vps\",\"type\":\"vps_md\",\"user\":\"ops\"}\nTARGET_VPS_SPB_COUNT=1\nTARGET_VPS_SPB_1_SAFE={\"due_seconds\":86400,\"enabled\":false,\"green1\":true,\"logical_id\":\"spb-ingress\",\"port\":22,\"scope\":\"vps\",\"type\":\"vps_spb\",\"user\":\"edgeadmin\"}\nUS_NETBIRD_AST_OCCURRENCES={t[_logical_id_] for t in default_targets() if t.get(_green1_)} == {_ct112_, _node-pve01_, _md-relay_, _spb-ingress_, _us-netbird_, _router-netcraze_, _xf-codevipe_, _xf-zakrutim_, _control-bootstrap-v2_}\nBACKUPV2_SERVICE_EXECSTART=/usr/local/sbin/homelab-backup-v2 scheduled\nBACKUPV2_TIMER_ACTIVE=active\nBACKUPV2_TIMER_ENABLED=enabled\nBACKUPV2_GREENRUN_REPLICA_READY=true\nDECISION=PASS_BACKUPV2_GREENRUN_REPLICA_SEMANTICS\nNEXT_GATE=FINAL_BACKUPV2_NEW_TARGET_INTEGRATION_AND_GLOBAL_CLOSEOUT\nTASK_RESULT=BACKUPV2_GREENRUN_REPLICA_SEMANTICS\nCHANGES_MADE=false\nROLLBACK_STARTED=false\nROLLBACK_RESTORED=null\nMUTATION_OUTCOME=NO_MUTATION\nHOMELAB_RESULT_CONTRACT={\"version\":1,\"command_id\":\"SUPPORT-261001-BACKUPV2-GREENRUN-REPLICA-SEMANTICS-99286R1\",\"status\":\"OK\",\"changes_made\":false,\"rollback_started\":false,\"rollback_restored\":null}\n"
 }
diff --git a/runtime/latest.txt b/runtime/latest.txt
index 66f1ba50..674b1502 100644
--- a/runtime/latest.txt
+++ b/runtime/latest.txt
@@ -1,15 +1,15 @@
 CHAT_OUTPUT_BEGIN
-COMMAND_ID=SUPPORT-261001-BACKUPV2-VPSUS-TRANSITIVE-SEMANTICS-99285R1
+COMMAND_ID=SUPPORT-261001-BACKUPV2-GREENRUN-REPLICA-SEMANTICS-99286R1
 STATUS=OK
 RC=0
 HOST=pve01
 MODE=read-only
-COMPONENT=backupv2-vpsus-transitive-semantics
+COMPONENT=backupv2-greenrun-replica-semantics
 REFERENCE_REGISTER_CHECK=OK
 REFERENCE_SHA256=5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66
 ERROR_REGISTER_CHECK=OK
 ERROR_REGISTER_SHA256=3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0
-COMMAND_SHA256=27b102f3e3240a033380d3a6f3392e21bdca6d812921151fa1106998c22f94dc
+COMMAND_SHA256=61da54040f32177be6f3809e8495cb184cceb11de39b9d9bf7eb6119c2720e57
 DUPLICATE_FAILED_COMMAND_BLOCKED=false
 EXECUTION_STARTED=true
 CHANGE_DECLARED=false
@@ -24,81 +24,166 @@ MUTATION_OUTCOME=NO_MUTATION
 SANITIZED=yes
 SECRETS_INCLUDED=no
 PRIVATE_ADDRESSES_INCLUDED=no
-RAW_EVIDENCE_SHA256=b77913f393173f1e230d495c3fc0664a38043598a85e35cc42690270c1cf3cde
-SANITIZED_OUTPUT_SHA256=b6cb5200d2c3b090aa71baba03c91c14d87ff55fd915dfedff95ac4be1a503ac
+RAW_EVIDENCE_SHA256=f0929f6271f6d6f73ad0dba877ee9ff7adf6772ceb58510da01fc056a0920840
+SANITIZED_OUTPUT_SHA256=f0929f6271f6d6f73ad0dba877ee9ff7adf6772ceb58510da01fc056a0920840
 OUTPUT_BEGIN
-BACKUPV2_VPSUS_TRANSITIVE_SEMANTICS=V1
+BACKUPV2_GREENRUN_REPLICA_SEMANTICS=V1
 INGRESS_HOSTKEY_SELF_BOUND=true
-OPERATOR_KEY_PRESENT=true
-OPERATOR_KEY_FP_MATCH=true
 BACKUPV2_TARGETS_SHA_EXACT=true
 BACKUPV2_RETIRED_US_NETBIRD_EXACT=true
-LEGACY_AST_PASS=true
-ENTRY_CAPTURE_VPS_US_PRESENT=true
-ENTRY_CAPTURE_VPS_US_REACHABLE=capture_vps_us,pipe_to_zstd,vps_ssh_argv
-ENTRY_CAPTURE_VPS_US_DIRECT_CALLS=join,pipe_to_zstd,vps_ssh_argv
-ENTRY_BOOTSTRAP_VPS_KEYS_PRESENT=true
-ENTRY_BOOTSTRAP_VPS_KEYS_REACHABLE=atomic_write,bootstrap_vps_keys,ensure_dir,ensure_vps_known_hosts,operator_key_fingerprint,run,scan_hostkey_line,vps_run,vps_ssh_argv
-ENTRY_BOOTSTRAP_VPS_KEYS_DIRECT_CALLS=BackupError,decode,ensure_vps_known_hosts,get,operator_key_fingerprint,run,str,strip,vps_run
-ENTRY_ENSURE_VPS_KNOWN_HOSTS_PRESENT=true
-ENTRY_ENSURE_VPS_KNOWN_HOSTS_REACHABLE=atomic_write,ensure_dir,ensure_vps_known_hosts,run,scan_hostkey_line
-ENTRY_ENSURE_VPS_KNOWN_HOSTS_DIRECT_CALLS=append,atomic_write,encode,join,scan_hostkey_line
-ENTRY_CAPTURE_TARGET_PRESENT=true
-ENTRY_CAPTURE_TARGET_REACHABLE=_default_unprivileged_lxc,_historical_graph_env,_isolated_guest266_dump_argv,_lxc_job,_require_exact_source,_router_assignments,_router_expand,_router_matching_brace,_router_passfile_literals,_router_strip_outer_quotes,_stream_argv_to_local,canonical_json,capture_node_bundle,capture_pve_guest,capture_router,capture_target,capture_vps_md,capture_vps_spb,capture_vps_us,capture_xenforo,cluster_inventory,epoch,make_tar_zst_bytes,mapped_scratch_probe,node_bundle_paths,parse_router_legacy,pipe_to_zstd,proven_lxc_dump_argv,qga_exec,remote_hashset,router_read,run,sha256_bytes,sha256_file,ssh_remote,vps_run,vps_ssh_argv,xf_guest_builder
-ENTRY_CAPTURE_TARGET_DIRECT_CALLS=BackupError,capture_node_bundle,capture_pve_guest,capture_router,capture_vps_md,capture_vps_spb,capture_vps_us,capture_xenforo
-ENTRY_GREEN_RUN_PRESENT=true
-ENTRY_GREEN_RUN_REACHABLE=_default_unprivileged_lxc,_historical_graph_env,_isolated_guest266_dump_argv,_lxc_job,_require_exact_source,_router_assignments,_router_expand,_router_matching_brace,_router_passfile_literals,_router_strip_outer_quotes,_stream_argv_to_local,allocator,atomic_write,backup_target,bootstrap_vps_keys,canonical_json,capture_node_bundle,capture_pve_guest,capture_router,capture_target,capture_vps_md,capture_vps_spb,capture_vps_us,capture_xenforo,cleanup_source,cluster_inventory,control_verify,ensure_dir,ensure_router_known_hosts,ensure_vps_known_hosts,epoch,generation_id,green_run,load_targets,locate_exact_sha,make_manifest,make_tar_zst_bytes,mapped_scratch_probe,node_bundle_paths,operator_key_fingerprint,parse_router_legacy,part_plan,pipe_to_zstd,proven_lxc_dump_argv,qga_exec,rclone_about,rclone_base_args,rclone_cat_bytes,rclone_cat_hash,rclone_rcat,reconstruct_replica,remote_exists_any,remote_generation_path,remote_hashset,router_read,run,scan_hostkey_line,select_replicas,sha256_bytes,sha256_file,ssh_remote,upload_and_seal,utcnow,validate_payload,validate_tar_zst,vps_run,vps_ssh_argv,write_state,xf_guest_builder
-ENTRY_GREEN_RUN_DIRECT_CALLS=BackupError,append,backup_target,bootstrap_vps_keys,dumps,ensure_router_known_hosts,get,join,len,load_targets,print,sub,sum,upper
-ENTRY_MAIN_PRESENT=true
-ENTRY_MAIN_REACHABLE=_default_unprivileged_lxc,_historical_graph_env,_isolated_guest266_dump_argv,_isolated_release_graph_selftest,_lxc_job,_pve_dumpdir_spec,_require_exact_source,_router_assignments,_router_expand,_router_matching_brace,_router_passfile_literals,_router_strip_outer_quotes,_stream_argv_to_local,allocator,atomic_write,backup_target,bootstrap_vps_keys,canonical_json,capture_node_bundle,capture_pve_guest,capture_router,capture_target,capture_vps_md,capture_vps_spb,capture_vps_us,capture_xenforo,choose_due_target,cleanup_source,cluster_inventory,control_verify,default_targets,discover,ensure_dir,ensure_router_known_hosts,ensure_vps_known_hosts,epoch,generation_id,green_run,load_state_all,load_targets,locate_exact_sha,main,make_manifest,make_tar_zst_bytes,mapped_scratch_probe,node_bundle_paths,operator_key_fingerprint,parse_router_legacy,part_plan,pipe_to_zstd,proven_lxc_dump_argv,qga_exec,rclone_about,rclone_base_args,rclone_cat_bytes,rclone_cat_hash,rclone_rcat,reconstruct_replica,remote_exists_any,remote_generation_path,remote_hashset,router_read,run,scan_hostkey_line,scheduled_run,select_replicas,selftest,sha256_bytes,sha256_file,ssh_remote,upload_and_seal,utcnow,validate_payload,validate_tar_zst,vps_run,vps_ssh_argv,write_state,xf_guest_builder
-ENTRY_MAIN_DIRECT_CALLS=discover,green_run,len,print,scheduled_run,selftest
-ENTRY_DEFAULT_TARGETS_PRESENT=true
-ENTRY_DEFAULT_TARGETS_REACHABLE=default_targets
-ENTRY_DEFAULT_TARGETS_DIRECT_CALLS=append,str
-ENTRY_VALIDATE_PAYLOAD_PRESENT=true
-ENTRY_VALIDATE_PAYLOAD_REACHABLE=run,validate_payload,validate_tar_zst
-ENTRY_VALIDATE_PAYLOAD_DIRECT_CALLS=BackupError,Popen,close,communicate,len,run,str,validate_tar_zst,wait,which
-VPS_US_IF_TESTS=typ in (_pve_node_bundle_, _vps_md_, _vps_spb_, _vps_us_, _router_),typ == _vps_us_,t[_type_] not in (_vps_md_, _vps_spb_, _vps_us_)
-VPS_US_IF_TEST_COUNT=3
-US_NETBIRD_IF_TESTS=NONE
-US_NETBIRD_IF_TEST_COUNT=0
-GREEN1_IF_TESTS=cmd == _green1_
-GREEN1_IF_TEST_COUNT=1
-ALL_IF_TESTS=NONE
-ALL_IF_TEST_COUNT=0
-VPS_US_TRANSITIVE_STRINGS=IdentityAgent=none,StrictHostKeyChecking=yes,UserKnownHostsFile=,host,port,user,vps_us
-BOOTSTRAP_TRANSITIVE_STRINGS=HOSTKEY_PIN_MISMATCH,IdentityAgent=none,SSH_AUTH_SOCK,StrictHostKeyChecking=yes,UserKnownHostsFile=,host,hostkey_fingerprint,logical_id,port,ssh-ed25519,ssh-keygen,user,vps_us
-KNOWNHOST_TRANSITIVE_STRINGS=HOSTKEY_PIN_MISMATCH,host,hostkey_fingerprint,port,ssh-ed25519,vps_us
-GREEN_TRANSITIVE_STRINGS=/manifest.json,[SENSITIVE_PATH],/usr/bin/lxc-usernsexec,CONTROL_ENGINE_IDENTITY,GREEN_REPLICA_COMPARE,HISTORICAL_RELEASE_GRAPH_IDENTITY,HOSTKEY_PIN_MISMATCH,IMPORT_PACKAGE_OR_SAFE_CLI_NOT_BLIND_CONFIG_REPLACE,IdentityAgent=none,LXC_CUSTOM_IDMAP_UNSUPPORTED,MANIFEST_PART_TOTAL_MISMATCH,MANIFEST_PAYLOAD_SHA_INVALID,MANIFEST_READBACK_MISMATCH,MANIFEST_REPLICA_PHYSICAL_DUPLICATE,P270_IDENTITY,P282_IDENTITY,PATH=/usr/sbin:/usr/bin:/sbin:/bin_ export PATH_ exec ,PYTHONNOUSERSITE,RCLONE_ABOUT_JSON,RCLONE_CAT_FAILED,RCLONE_CAT_SIZE_MISMATCH,RCLONE_CAT_TIMEOUT,RCLONE_FREE_UNKNOWN,RCLONE_RCAT_FAILED,RCLONE_SMALL_OBJECT_TOO_LARGE,ROUTER_KNOWN_HOSTS_IDENTITY,ROUTER_LEGACY_SCRIPT_IDENTITY,SSH_AUTH_SOCK,StrictHostKeyChecking=yes,TARGET_MANIFEST_DUPLICATE,TARGET_MANIFEST_SCHEMA,UserKnownHostsFile=,_REPLICAS=,__s_(_:export_s+)_([A-Za-z_][A-Za-z0-9_]_)=(._)_,_bsshpass_b[__n]__(_:___s)-f_s+(__[___]_____[__]___[__s_]+),_if not root.startswith(_/var/www/forums/_) or not db.startswith(_xf__): raise SystemExit(20)_tmp=pathlib.Path(_/tmp/homelab-v2-xf-_+token)_ tmp.mkdir(mode=0o700,exist_ok=False)_dump=tmp/_db.sql__ out=pathlib.Path(_/tmp/homelab-v2-xf-_+token+_.tar.zst_)_lock=None_try:_  if strategy==_global_read_lock_:_    lock=subprocess.Popen([_mariadb_,_--user=root_,_--batch_,_--skip-column-names_,_--unbuffered_],stdin=subprocess.PIPE,stdout=subprocess.PIPE,stderr=subprocess.DEVNULL,text=True,bufsize=1)_    lock.stdin.write(_FLUSH TABLES WITH READ LOCK_ SELECT _LOCKED___n_)_ lock.stdin.flush()_    rr,_,_=select.select([lock.stdout],[],[],5)_    if not rr or lock.stdout.readline().strip()_=_LOCKED_: raise RuntimeError(_LOCK_ACQUIRE_)_    dump_timeout=15_  else: dump_timeout=180_  with open(dump,_wb_) as f:_    argv=[_mariadb-dump_,_--user=root_,_--quick_,_--skip-lock-tables_,_--hex-blob_,_--routines_,_,etc/hostname,etc/hosts,etc/pve/user.cfg,green1,host,hostkey_fingerprint,import base64,sys_ p=sys.argv[1]_ o=int(sys.argv[2])_ n=int(sys.argv[3])_ f=open(p,_rb_)_ f.seek(o)_ b=f.read(n)_ f.close()_ sys.stdout.write(base64.b64encode(b).decode()),import hashlib,json,os,pathlib,select,shutil,subprocess,tempfile,time_root=,logical_id,lxc-usernsexec,manifest_sha256,port,replicas,reported_maxdisk_bytes,reported_maxmem_bytes,root/.ssh/id_ed25519_netbird_operator,root/.ssh/id_ed25519_netbird_operator.pub,ssh-ed25519,ssh-keygen,user,vps_us
-VPS_US_TRANSITIVE_KEYS=host,port,user
-GREEN_TRANSITIVE_KEYS=SSH_AUTH_SOCK,allocator_healthy,app_root,archive_cap_bytes,bytes,crypt,db_bytes,db_name,dump_strategy,exit-code,exitcode,exited,free,generation,green1,guest_type,healthy,host,hostkey_fingerprint,kind,last_success_epoch,logical_id,maxdisk,maxmem,name,node,offset,out-data,parts,path,payload_bytes,payload_sha256,physical,port,replicas,schema,scope,sha256,slug,status,targets,template,type,user,vmid
-BOOTSTRAP_TRANSITIVE_KEYS=SSH_AUTH_SOCK,host,hostkey_fingerprint,logical_id,port,type,user
-SEMANTIC_PATH_LITERALS=/etc/homelab-backup-v2,[SENSITIVE_PATH],[SENSITIVE_PATH]
-TRANSITIVE_EXTERNAL_COMMANDS=python3,ssh,ssh-keygen,tar,zstd
-VPS_US_SSH_CLI_FLAGS=-T,-i,-o,-p,-q
-US_NETBIRD_COMPARISONS=_t[_logical_id_] for t in default_targets() if t.get(_green1_)_ == __ct112_, _node-pve01_, _md-relay_, _spb-ingress_, _us-netbird_, _router-netcraze_, _xf-codevipe_, _xf-zakrutim_, _control-bootstrap-v2__
-VPS_US_COMPARISONS=typ in (_pve_node_bundle_, _vps_md_, _vps_spb_, _vps_us_, _router_),typ == _vps_us_,t[_type_] not in (_vps_md_, _vps_spb_, _vps_us_),x[_type_] == _vps_us_
-CAPTURE_VPS_US_CALLSITES=capture_vps_us(t, gen, work)
-GREEN_RUN_CALLSITES=green_run(_GREEN1_),green_run(_GREEN2_)
-TARGET_TYPE_SUMMARY=control:1:1:1,pve_guest:13:13:1,pve_node_bundle:3:3:1,router:1:1:1,vps_md:1:0:1,vps_spb:1:0:1,vps_us:1:0:1,xenforo:7:7:2
-RCLONE_REMOTE_COUNT=26
-RCLONE_REMOTE_NAMES=pve01-mail-01,pve01-mail-01-crypt,pve01-mail-02,pve01-mail-02-crypt,pve01-mail-03,pve01-mail-03-crypt,pve01-mail-04,pve01-mail-04-crypt,pve01-mail-05,pve01-mail-05-crypt,pve02-mail-01,pve02-mail-01-crypt,pve02-mail-02,pve02-mail-02-crypt,pve02-mail-03,pve02-mail-03-crypt,pve02-mail-04,pve02-mail-04-crypt,pve03-mail-01,pve03-mail-01-crypt,pve03-mail-02,pve03-mail-02-crypt,pve03-mail-03,pve03-mail-03-crypt,pve03-mail-04,pve03-mail-04-crypt
-RCLONE_GREEN_NAMED_REMOTES=NONE
-RUNNER_REALPATH=/usr/local/sbin/homelab-backup-v2
-RUNNER_SHA=894f8ea346b53a3d7846dbd6eeb5b89333957eb6d7a4f2f64fd4557cae176e1c
+FN_GREEN_RUN_PRESENT=true
+FN_GREEN_RUN_PARAMS=label
+FN_GREEN_RUN_DIRECT_CALLS=BackupError,append,backup_target,bootstrap_vps_keys,dumps,ensure_router_known_hosts,get,join,len,load_targets,print,sub,sum,upper
+FN_GREEN_RUN_IF_TESTS=failures,_allocator_healthy_ in r
+FN_GREEN_RUN_COMP_FILTERS=t.get(_green1_),t[_type_] _= _control_,t[_type_] == _control_
+FN_GREEN_RUN_IMPORTANT_CALLS=load_targets(),bootstrap_vps_keys(targets),backup_target(t, green_verify=t[_type_] _= _control_)
+FN_GREEN_RUN_RETURNS=0
+FN_GREEN_RUN_KEYS=allocator_healthy,generation,green1,logical_id,payload_bytes,replicas,type
+FN_GREEN_RUN_STRINGS=_CLOUD_BACKUP_TARGET_COUNT=,_CONTROL_VERIFY_TARGET_COUNT=,_GENERATION=,_REPLICAS=,_TARGET_COUNT=,_TARGET_FAILURES,generation,green1,logical_id,replicas
+FN_BACKUP_TARGET_PRESENT=true
+FN_BACKUP_TARGET_PARAMS=t,green_verify
+FN_BACKUP_TARGET_DIRECT_CALLS=BackupError,Path,bool,capture_target,cleanup_source,control_verify,ensure_dir,epoch,exists,generation_id,reconstruct_replica,rmtree,unlink,upload_and_seal,validate_payload,write_state
+FN_BACKUP_TARGET_IF_TESTS=t[_type_] == _control_,green_verify,pathlib.Path(payload).exists(),ha _= hb or ha _= manifest[_payload_sha256_]
+FN_BACKUP_TARGET_COMP_FILTERS=NONE
+FN_BACKUP_TARGET_IMPORTANT_CALLS=capture_target(t, gen, work),upload_and_seal(t, payload, meta),write_state(t[_logical_id_], _SUCCESS_, generation=gen, payload_sha256=manifest[_payload_sha256_], manifest_sha256=msha, replicas=manifest[_replicas_], green_verified=bool(green_verify), last_success_epoch=epoch()),reconstruct_replica(manifest, manifest[_replicas_][0], a),validate_payload(t, a),reconstruct_replica(manifest, manifest[_replicas_][1], b),validate_payload(t, b),write_state(t[_logical_id_], result, generation=gen, reason=e.code, sealed=sealed)
+FN_BACKUP_TARGET_RETURNS=control_verify(t),{_logical_id_: t[_logical_id_], _generation_: gen, _result_: _SUCCESS_, _payload_bytes_: manifest[_payload_bytes_], _replicas_: 2, _allocator_healthy_: alloc[_healthy_]}
+FN_BACKUP_TARGET_KEYS=allocator_healthy,generation,healthy,logical_id,payload_bytes,payload_sha256,replicas,result,type
+FN_BACKUP_TARGET_STRINGS=GREEN_REPLICA_COMPARE,SUCCESS,generation,logical_id,replicas
+FN_SELECT_REPLICAS_PRESENT=true
+FN_SELECT_REPLICAS_PARAMS=rows,payload_bytes,reserve_bytes
+FN_SELECT_REPLICAS_DIRECT_CALLS=BackupError,add,append,dict,get,isinstance,len,set,sort
+FN_SELECT_REPLICAS_IF_TESTS=len(out) _= 2,not isinstance(r.get(_free_), int),r[_free_] < payload_bytes + reserve_bytes,r[_physical_] in phys,len(out) == 2
+FN_SELECT_REPLICAS_COMP_FILTERS=NONE
+FN_SELECT_REPLICAS_IMPORTANT_CALLS=NONE
+FN_SELECT_REPLICAS_RETURNS=out
+FN_SELECT_REPLICAS_KEYS=crypt,free,physical
+FN_SELECT_REPLICAS_STRINGS=NONE
+FN_UPLOAD_AND_SEAL_PRESENT=true
+FN_UPLOAD_AND_SEAL_PARAMS=t,payload_path,source_meta
+FN_UPLOAD_AND_SEAL_DIRECT_CALLS=BackupError,Path,allocator,canonical_json,make_manifest,part_plan,rclone_cat_bytes,rclone_cat_hash,rclone_rcat,remote_exists_any,remote_generation_path,sha256_bytes,sha256_file,stat,utcnow
+FN_UPLOAD_AND_SEAL_IF_TESTS=remote_exists_any(t[_scope_], t[_logical_id_], gen),rclone_cat_bytes(base + _/manifest.json_) _= mb,rclone_cat_bytes(base + _/SEALED.json_) _= sb,got _= part[_sha256_]
+FN_UPLOAD_AND_SEAL_COMP_FILTERS=NONE
+FN_UPLOAD_AND_SEAL_IMPORTANT_CALLS=make_manifest(t[_scope_], t[_logical_id_], gen, n, psha, parts, reps, source_meta),rclone_rcat(base + _/manifest.json_, data=mb),rclone_rcat(base + _/SEALED.json_, data=sb),rclone_rcat(rp, source_path=payload_path, offset=part[_offset_], length=part[_bytes_]),rclone_cat_hash(rp, part[_bytes_]),rclone_cat_bytes(base + _/manifest.json_),rclone_cat_bytes(base + _/SEALED.json_)
+FN_UPLOAD_AND_SEAL_RETURNS=(manifest, msha, {_unhealthy_: bad, _healthy_: healthy})
+FN_UPLOAD_AND_SEAL_KEYS=bytes,crypt,generation,healthy,logical_id,manifest_sha256,name,offset,payload_sha256,schema,scope,sealed_at_utc,sha256,status,unhealthy
+FN_UPLOAD_AND_SEAL_STRINGS=/manifest.json,GENERATION_COLLISION,MANIFEST_READBACK_MISMATCH,generation,logical_id,manifest_sha256
+FN_WRITE_STATE_PRESENT=true
+FN_WRITE_STATE_PARAMS=logical_id,result
+FN_WRITE_STATE_DIRECT_CALLS=BackupError,atomic_write,canonical_json,epoch,utcnow
+FN_WRITE_STATE_IF_TESTS=result not in RESULT_CLASSES,result == _SUCCESS_
+FN_WRITE_STATE_COMP_FILTERS=NONE
+FN_WRITE_STATE_IMPORTANT_CALLS=NONE
+FN_WRITE_STATE_RETURNS=j
+FN_WRITE_STATE_KEYS=last_success_epoch,logical_id,result,schema,updated_at_utc
+FN_WRITE_STATE_STRINGS=SUCCESS,last_success_epoch,logical_id,state
+FN_SCHEDULED_RUN_PRESENT=true
+FN_SCHEDULED_RUN_PARAMS=NONE
+FN_SCHEDULED_RUN_DIRECT_CALLS=backup_target,choose_due_target,load_state_all,load_targets,print
+FN_SCHEDULED_RUN_IF_TESTS=t is None
+FN_SCHEDULED_RUN_COMP_FILTERS=NONE
+FN_SCHEDULED_RUN_IMPORTANT_CALLS=load_targets(),choose_due_target(targets, state),backup_target(t, green_verify=False)
+FN_SCHEDULED_RUN_RETURNS=0,0,2
+FN_SCHEDULED_RUN_KEYS=logical_id
+FN_SCHEDULED_RUN_STRINGS=SCHEDULE_DECISION=DEFER_NO_DUE_TARGET,SCHEDULE_RESULT=SUCCESS,SCHEDULE_TARGET=,logical_id
+FN_CHOOSE_DUE_TARGET_PRESENT=true
+FN_CHOOSE_DUE_TARGET_PARAMS=targets,state,now
+FN_CHOOSE_DUE_TARGET_DIRECT_CALLS=append,epoch,get,int,max,sort
+FN_CHOOSE_DUE_TARGET_IF_TESTS=not c,not t.get(_enabled_, True),last == 0 or age >= due
+FN_CHOOSE_DUE_TARGET_COMP_FILTERS=NONE
+FN_CHOOSE_DUE_TARGET_IMPORTANT_CALLS=NONE
+FN_CHOOSE_DUE_TARGET_RETURNS=c[0][3],None
+FN_CHOOSE_DUE_TARGET_KEYS=due_seconds,enabled,last_success_epoch,logical_id
+FN_CHOOSE_DUE_TARGET_STRINGS=due_seconds,enabled,last_success_epoch,logical_id
+FN_RCLONE_RCAT_PRESENT=true
+FN_RCLONE_RCAT_PARAMS=remote_path,source_path,offset,length,data,timeout
+FN_RCLONE_RCAT_DIRECT_CALLS=BackupError,Popen,close,communicate,kill,len,min,open,rclone_base_args,read,seek,str,write
+FN_RCLONE_RCAT_IF_TESTS=p.returncode _= 0,data is not None,not b
+FN_RCLONE_RCAT_COMP_FILTERS=NONE
+FN_RCLONE_RCAT_IMPORTANT_CALLS=NONE
+FN_RCLONE_RCAT_RETURNS=NONE
+FN_RCLONE_RCAT_KEYS=NONE
+FN_RCLONE_RCAT_STRINGS=RCLONE_RCAT_FAILED
+FN_MAKE_MANIFEST_PRESENT=true
+FN_MAKE_MANIFEST_PARAMS=scope,logical_id,generation,payload_bytes,payload_sha256,parts,replicas,source_meta
+FN_MAKE_MANIFEST_DIRECT_CALLS=BackupError,fullmatch,int,len,sum,utcnow
+FN_MAKE_MANIFEST_IF_TESTS=len(replicas) _= 2 or len({r[_physical_] for r in replicas}) _= 2,not re.fullmatch(_[0-9a-f]{64}_, payload_sha256),sum((int(p[_bytes_]) for p in parts)) _= payload_bytes
+FN_MAKE_MANIFEST_COMP_FILTERS=NONE
+FN_MAKE_MANIFEST_IMPORTANT_CALLS=NONE
+FN_MAKE_MANIFEST_RETURNS={_schema_: 2, _scope_: scope, _logical_id_: logical_id, _generation_: generation, _created_at_utc_: utcnow(), _payload_bytes_: payload_bytes, _payload_sha256_: payload_sha256, _part_size_: PART_SIZE, _parts_: parts, _replicas_: [{_crypt_: r[_crypt_], _physical_: r[_physical_]} for r in replicas], _source_meta_: source_meta}
+FN_MAKE_MANIFEST_KEYS=bytes,created_at_utc,crypt,generation,logical_id,part_size,parts,payload_bytes,payload_sha256,physical,replicas,schema,scope,source_meta
+FN_MAKE_MANIFEST_STRINGS=MANIFEST_PART_TOTAL_MISMATCH,MANIFEST_PAYLOAD_SHA_INVALID,MANIFEST_REPLICA_PHYSICAL_DUPLICATE,generation,logical_id,replicas
+FN_GENERATION_ID_PRESENT=true
+FN_GENERATION_ID_PARAMS=logical_id
+FN_GENERATION_ID_DIRECT_CALLS=hex,now,strftime,urandom
+FN_GENERATION_ID_IF_TESTS=NONE
+FN_GENERATION_ID_COMP_FILTERS=NONE
+FN_GENERATION_ID_IMPORTANT_CALLS=NONE
+FN_GENERATION_ID_RETURNS=f_v2-{logical_id}-{ts}-{os.urandom(6).hex()}_
+FN_GENERATION_ID_KEYS=NONE
+FN_GENERATION_ID_STRINGS=NONE
+FN_LOAD_TARGETS_PRESENT=true
+FN_LOAD_TARGETS_PARAMS=NONE
+FN_LOAD_TARGETS_DIRECT_CALLS=BackupError,get,isinstance,len,loads,read_text,set
+FN_LOAD_TARGETS_IF_TESTS=j.get(_schema_) _= 1 or not isinstance(j.get(_targets_), list),len(ids) _= len(set(ids))
+FN_LOAD_TARGETS_COMP_FILTERS=NONE
+FN_LOAD_TARGETS_IMPORTANT_CALLS=NONE
+FN_LOAD_TARGETS_RETURNS=j[_targets_]
+FN_LOAD_TARGETS_KEYS=logical_id,schema,targets
+FN_LOAD_TARGETS_STRINGS=TARGET_MANIFEST_DUPLICATE,TARGET_MANIFEST_SCHEMA,logical_id,targets
+FN_BOOTSTRAP_VPS_KEYS_PRESENT=true
+FN_BOOTSTRAP_VPS_KEYS_PARAMS=targets
+FN_BOOTSTRAP_VPS_KEYS_DIRECT_CALLS=BackupError,decode,ensure_vps_known_hosts,get,operator_key_fingerprint,run,str,strip,vps_run
+FN_BOOTSTRAP_VPS_KEYS_IF_TESTS=t[_type_] not in (_vps_md_, _vps_spb_),probe.returncode == 0,not os.environ.get(_SSH_AUTH_SOCK_),tag not in (_ADDED_, _ALREADY_)
+FN_BOOTSTRAP_VPS_KEYS_COMP_FILTERS=x[_type_] == _vps_us_
+FN_BOOTSTRAP_VPS_KEYS_IMPORTANT_CALLS=NONE
+FN_BOOTSTRAP_VPS_KEYS_RETURNS=results
+FN_BOOTSTRAP_VPS_KEYS_KEYS=SSH_AUTH_SOCK,logical_id,type
+FN_BOOTSTRAP_VPS_KEYS_STRINGS=SSH_AUTH_SOCK,logical_id,ssh-keygen
+FN_VPS_SSH_ARGV_PRESENT=true
+FN_VPS_SSH_ARGV_PARAMS=t
+FN_VPS_SSH_ARGV_DIRECT_CALLS=str
+FN_VPS_SSH_ARGV_IF_TESTS=use_agent
+FN_VPS_SSH_ARGV_COMP_FILTERS=NONE
+FN_VPS_SSH_ARGV_IMPORTANT_CALLS=NONE
+FN_VPS_SSH_ARGV_RETURNS=a
+FN_VPS_SSH_ARGV_KEYS=host,port,user
+FN_VPS_SSH_ARGV_STRINGS=IdentityAgent=none,StrictHostKeyChecking=yes
+FN_CAPTURE_VPS_US_PRESENT=true
+FN_CAPTURE_VPS_US_PARAMS=t,gen,work
+FN_CAPTURE_VPS_US_DIRECT_CALLS=join,pipe_to_zstd,vps_ssh_argv
+FN_CAPTURE_VPS_US_IF_TESTS=NONE
+FN_CAPTURE_VPS_US_COMP_FILTERS=NONE
+FN_CAPTURE_VPS_US_IMPORTANT_CALLS=NONE
+FN_CAPTURE_VPS_US_RETURNS=(payload, {_generation_: gen, _source_class_: _vps_us_, _consistency_: _SQLITE_ONLINE_BACKUP_PLUS_NONDB_FILES_, _sqlite_count_: 4}, None)
+FN_CAPTURE_VPS_US_KEYS=consistency,generation,source_class,sqlite_count
+FN_CAPTURE_VPS_US_STRINGS=generation
+MAIN_IF_TESTS=len(argv) < 2,cmd == _selftest_,cmd == _green1_,cmd == _green2_,cmd == _scheduled_,cmd == _discover_ and len(argv) == 3
+MAIN_IMPORTANT_CALLS=selftest(),green_run(_GREEN1_),green_run(_GREEN2_),scheduled_run(),discover(argv[2])
+CALLSITE_GREEN_RUN=green_run(_GREEN1_),green_run(_GREEN2_)
+CALLSITE_SCHEDULED_RUN=scheduled_run()
+CALLSITE_BACKUP_TARGET=backup_target(t, green_verify=False),backup_target(t, green_verify=t[_type_] _= _control_)
+CALLSITE_SELECT_REPLICAS=select_replicas(rows, payload_bytes, RESERVE_BYTES)
+CALLSITE_UPLOAD_AND_SEAL=upload_and_seal(t, payload, meta)
+CALLSITE_WRITE_STATE=write_state(t[_logical_id_], _SUCCESS_, generation=gen, verification=_existing_control_engine_verify_, last_success_epoch=epoch()),write_state(t[_logical_id_], _SUCCESS_, generation=gen, payload_sha256=manifest[_payload_sha256_], manifest_sha256=msha, replicas=manifest[_replicas_], green_verified=bool(green_verify), last_success_epoch=epoch()),write_state(t[_logical_id_], result, generation=gen, reason=e.code, sealed=sealed)
+TARGET_VPS_US_COUNT=1
+TARGET_VPS_US_1_SAFE={"due_seconds":86400,"enabled":false,"green1":true,"logical_id":"us-netbird","port":22,"scope":"vps","type":"vps_us","user":"root"}
+TARGET_VPS_MD_COUNT=1
+TARGET_VPS_MD_1_SAFE={"due_seconds":86400,"enabled":false,"green1":true,"logical_id":"md-relay","port":22,"scope":"vps","type":"vps_md","user":"ops"}
+TARGET_VPS_SPB_COUNT=1
+TARGET_VPS_SPB_1_SAFE={"due_seconds":86400,"enabled":false,"green1":true,"logical_id":"spb-ingress","port":22,"scope":"vps","type":"vps_spb","user":"edgeadmin"}
+US_NETBIRD_AST_OCCURRENCES={t[_logical_id_] for t in default_targets() if t.get(_green1_)} == {_ct112_, _node-pve01_, _md-relay_, _spb-ingress_, _us-netbird_, _router-netcraze_, _xf-codevipe_, _xf-zakrutim_, _control-bootstrap-v2_}
 BACKUPV2_SERVICE_EXECSTART=/usr/local/sbin/homelab-backup-v2 scheduled
-PVE01_TARGET_PIN_SUCCESS=0/3
-PVE01_OPERATOR_TARGET_SSH_PASS=false
-PVE01_OPERATOR_TARGET_UID0=false
-BACKUPV2_FINAL_CHANGE_INPUT_READY=false
-DECISION=HOLD_BACKUPV2_VPSUS_TRANSITIVE_SEMANTICS
-NEXT_GATE=RCA_BACKUPV2_VPSUS_KEY_OR_GREEN_REPLICA
-TASK_RESULT=BACKUPV2_VPSUS_TRANSITIVE_SEMANTICS
+BACKUPV2_TIMER_ACTIVE=active
+BACKUPV2_TIMER_ENABLED=enabled
+BACKUPV2_GREENRUN_REPLICA_READY=true
+DECISION=PASS_BACKUPV2_GREENRUN_REPLICA_SEMANTICS
+NEXT_GATE=FINAL_BACKUPV2_NEW_TARGET_INTEGRATION_AND_GLOBAL_CLOSEOUT
+TASK_RESULT=BACKUPV2_GREENRUN_REPLICA_SEMANTICS
 CHANGES_MADE=false
 ROLLBACK_STARTED=false
 ROLLBACK_RESTORED=null
 MUTATION_OUTCOME=NO_MUTATION
-HOMELAB_RESULT_CONTRACT={"version":1,"command_id":"SUPPORT-261001-BACKUPV2-VPSUS-TRANSITIVE-SEMANTICS-99285R1","status":"OK","changes_made":false,"rollback_started":false,"rollback_restored":null}
+HOMELAB_RESULT_CONTRACT={"version":1,"command_id":"SUPPORT-261001-BACKUPV2-GREENRUN-REPLICA-SEMANTICS-99286R1","status":"OK","changes_made":false,"rollback_started":false,"rollback_restored":null}
 
 OUTPUT_END
 CHAT_OUTPUT_END