diff --git a/runtime/history/NEWFI-260920-NEWFDOM-MESSENGERS214-FWD231.json b/runtime/history/NEWFI-260920-NEWFDOM-MESSENGERS214-FWD231.json
new file mode 100644
index 00000000..24b9657b
--- /dev/null
+++ b/runtime/history/NEWFI-260920-NEWFDOM-MESSENGERS214-FWD231.json
@@ -0,0 +1,38 @@
+{
+  "schema_version": 1,
+  "channel": "homelab-runtime",
+  "command_id": "NEWFI-260920-NEWFDOM-MESSENGERS214-FWD231",
+  "status": "OK",
+  "rc": 0,
+  "host": "pve01",
+  "mode": "read-only",
+  "component": "newfi-newfdom-messengers214-usa-tunnel-dotnet-tls-proof-readonly",
+  "started_at_utc": "2026-09-20T05:21:30Z",
+  "finished_at_utc": "2026-09-20T05:21:30Z",
+  "reference_register_checked": true,
+  "reference_sha256": "5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66",
+  "error_register_checked": true,
+  "error_register_sha256": "3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0",
+  "command_sha256": "f92a07e66001d9254540281acca6910239d37ba30a7d8d692bc5fa72234b2867",
+  "duplicate_failed_command_blocked": false,
+  "block_reason": null,
+  "execution_started": true,
+  "change_declared": false,
+  "result_contract_valid": true,
+  "result_contract_status": null,
+  "result_contract_error": null,
+  "command_rc": 0,
+  "changes_made": false,
+  "rollback_started": false,
+  "rollback_restored": null,
+  "mutation_outcome": "NO_MUTATION",
+  "sanitized": true,
+  "secrets_included": false,
+  "private_addresses_included": false,
+  "raw_evidence_retained_locally": true,
+  "raw_evidence_sha256": "1006b11ecd51aa6eabfb3c7c6722967cdd9a701f9e6f485c0832979c4bb04a9e",
+  "sanitized_output_sha256": "1006b11ecd51aa6eabfb3c7c6722967cdd9a701f9e6f485c0832979c4bb04a9e",
+  "output_truncated_in_json": false,
+  "full_sanitized_output_url": "https://git.gram1.ru/.well-known/homelab-runtime/latest.txt",
+  "output": "NEWFI231_BEGIN=true\nMODE=read-only\nCHANGES_MADE=false\nMUTATION_OUTCOME=NO_MUTATION\nAUTHORITY_OK=true\nPRECHECK_OK=true\nTUNNEL_ATTEMPTS=1\nTUNNEL_STARTED=true\nTUNNEL_PAGEANT_PROVEN=false\nTUNNEL_ACCESS_GRANTED=false\nLOCAL_FORWARD_OPEN=true\nTLS_AUTHENTICATED=false\nTUNNEL_TELEGRAM_HTTP=000\nTLS_ERROR_CLASS=NONE\nLIVE_LOCAL_FORWARD_PROVEN=false\nPHASE=ERROR\nERROR_CODE=LOCAL_ERROR\nDECISION=HOLD_FWD231_FORWARD_OPEN_TLS_FAILED\nNEXT_GATE=RECONCILE_DOTNET_TLS_FAILURE_CLASS\nCLOUD_WRITES=0\nVPS_CONFIG_MUTATIONS=0\nMESSENGERS214_CLOSED=false\nMAJOR_STAGES_REMAINING=8\nNEWFI231_END=true\n"
+}
diff --git a/runtime/history/NEWFI-260920-NEWFDOM-MESSENGERS214-FWD231.txt b/runtime/history/NEWFI-260920-NEWFDOM-MESSENGERS214-FWD231.txt
new file mode 100644
index 00000000..3f77b59a
--- /dev/null
+++ b/runtime/history/NEWFI-260920-NEWFDOM-MESSENGERS214-FWD231.txt
@@ -0,0 +1,56 @@
+CHAT_OUTPUT_BEGIN
+COMMAND_ID=NEWFI-260920-NEWFDOM-MESSENGERS214-FWD231
+STATUS=OK
+RC=0
+HOST=pve01
+MODE=read-only
+COMPONENT=newfi-newfdom-messengers214-usa-tunnel-dotnet-tls-proof-readonly
+REFERENCE_REGISTER_CHECK=OK
+REFERENCE_SHA256=5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66
+ERROR_REGISTER_CHECK=OK
+ERROR_REGISTER_SHA256=3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0
+COMMAND_SHA256=f92a07e66001d9254540281acca6910239d37ba30a7d8d692bc5fa72234b2867
+DUPLICATE_FAILED_COMMAND_BLOCKED=false
+EXECUTION_STARTED=true
+CHANGE_DECLARED=false
+RESULT_CONTRACT_VALID=true
+RESULT_CONTRACT_STATUS=NOT_APPLICABLE
+RESULT_CONTRACT_ERROR=NONE
+COMMAND_RC=0
+CHANGES_MADE=false
+ROLLBACK_STARTED=false
+ROLLBACK_RESTORED=null
+MUTATION_OUTCOME=NO_MUTATION
+SANITIZED=yes
+SECRETS_INCLUDED=no
+PRIVATE_ADDRESSES_INCLUDED=no
+RAW_EVIDENCE_SHA256=1006b11ecd51aa6eabfb3c7c6722967cdd9a701f9e6f485c0832979c4bb04a9e
+SANITIZED_OUTPUT_SHA256=1006b11ecd51aa6eabfb3c7c6722967cdd9a701f9e6f485c0832979c4bb04a9e
+OUTPUT_BEGIN
+NEWFI231_BEGIN=true
+MODE=read-only
+CHANGES_MADE=false
+MUTATION_OUTCOME=NO_MUTATION
+AUTHORITY_OK=true
+PRECHECK_OK=true
+TUNNEL_ATTEMPTS=1
+TUNNEL_STARTED=true
+TUNNEL_PAGEANT_PROVEN=false
+TUNNEL_ACCESS_GRANTED=false
+LOCAL_FORWARD_OPEN=true
+TLS_AUTHENTICATED=false
+TUNNEL_TELEGRAM_HTTP=000
+TLS_ERROR_CLASS=NONE
+LIVE_LOCAL_FORWARD_PROVEN=false
+PHASE=ERROR
+ERROR_CODE=LOCAL_ERROR
+DECISION=HOLD_FWD231_FORWARD_OPEN_TLS_FAILED
+NEXT_GATE=RECONCILE_DOTNET_TLS_FAILURE_CLASS
+CLOUD_WRITES=0
+VPS_CONFIG_MUTATIONS=0
+MESSENGERS214_CLOSED=false
+MAJOR_STAGES_REMAINING=8
+NEWFI231_END=true
+
+OUTPUT_END
+CHAT_OUTPUT_END
diff --git a/runtime/latest.json b/runtime/latest.json
index b9240134..24b9657b 100644
--- a/runtime/latest.json
+++ b/runtime/latest.json
@@ -1,19 +1,19 @@
 {
   "schema_version": 1,
   "channel": "homelab-runtime",
-  "command_id": "NEWFI-260920-NEWFDOM-MESSENGERS214-FWD230",
+  "command_id": "NEWFI-260920-NEWFDOM-MESSENGERS214-FWD231",
   "status": "OK",
   "rc": 0,
   "host": "pve01",
   "mode": "read-only",
-  "component": "newfi-newfdom-messengers214-usa-sshd-forwarding-live-proof-readonly",
-  "started_at_utc": "2026-09-20T05:17:43Z",
-  "finished_at_utc": "2026-09-20T05:17:43Z",
+  "component": "newfi-newfdom-messengers214-usa-tunnel-dotnet-tls-proof-readonly",
+  "started_at_utc": "2026-09-20T05:21:30Z",
+  "finished_at_utc": "2026-09-20T05:21:30Z",
   "reference_register_checked": true,
   "reference_sha256": "5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66",
   "error_register_checked": true,
   "error_register_sha256": "3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0",
-  "command_sha256": "586ec5c53b390ff8856c2e5f2b83c53c9edb1d2b39098433fd19ef354891eada",
+  "command_sha256": "f92a07e66001d9254540281acca6910239d37ba30a7d8d692bc5fa72234b2867",
   "duplicate_failed_command_blocked": false,
   "block_reason": null,
   "execution_started": true,
@@ -30,9 +30,9 @@
   "secrets_included": false,
   "private_addresses_included": false,
   "raw_evidence_retained_locally": true,
-  "raw_evidence_sha256": "8ed2063b398c03a0e6aeab39a27a5018b5d9b0c721d484970efa5375109e28de",
-  "sanitized_output_sha256": "8ed2063b398c03a0e6aeab39a27a5018b5d9b0c721d484970efa5375109e28de",
+  "raw_evidence_sha256": "1006b11ecd51aa6eabfb3c7c6722967cdd9a701f9e6f485c0832979c4bb04a9e",
+  "sanitized_output_sha256": "1006b11ecd51aa6eabfb3c7c6722967cdd9a701f9e6f485c0832979c4bb04a9e",
   "output_truncated_in_json": false,
   "full_sanitized_output_url": "https://git.gram1.ru/.well-known/homelab-runtime/latest.txt",
-  "output": "NEWFI230_BEGIN=true\nMODE=read-only\nCHANGES_MADE=false\nMUTATION_OUTCOME=NO_MUTATION\nAUTHORITY_OK=true\nPRECHECK_OK=true\nPAGEANT_LOGIN_PROVEN=true\nNONINTERACTIVE_ROOT_SHELL=true\nSSHD_POLICY_READY=true\nLIVE_LOCAL_FORWARD_PROVEN=false\nDIRECT_TELEGRAM_HTTPS=true\nREMOTE_UID=1000\nSSHD_PATH_CLASS=USR_SBIN\nSSHD_T_RC=0\nALLOWTCPFORWARDING=yes\nGATEWAYPORTS=no\nDISABLEFORWARDING=no\nPERMITOPEN=any\nPERMITLISTEN=any\nDIRECT_TELEGRAM_HTTP=302\nTUNNEL_ATTEMPTS=1\nTUNNEL_LOCAL_PORT_OPEN=true\nTUNNEL_TELEGRAM_HTTP=000\nPHASE=ERROR\nERROR_CODE=LOCAL_ERROR\nDECISION=HOLD_FWD230_POLICY_READY_LIVE_FORWARD_FAILED\nNEXT_GATE=RECONCILE_EPHEMERAL_FORWARD_FAILURE\nCLOUD_WRITES=0\nVPS_CONFIG_MUTATIONS=0\nMESSENGERS214_CLOSED=false\nMAJOR_STAGES_REMAINING=8\nNEWFI230_END=true\n"
+  "output": "NEWFI231_BEGIN=true\nMODE=read-only\nCHANGES_MADE=false\nMUTATION_OUTCOME=NO_MUTATION\nAUTHORITY_OK=true\nPRECHECK_OK=true\nTUNNEL_ATTEMPTS=1\nTUNNEL_STARTED=true\nTUNNEL_PAGEANT_PROVEN=false\nTUNNEL_ACCESS_GRANTED=false\nLOCAL_FORWARD_OPEN=true\nTLS_AUTHENTICATED=false\nTUNNEL_TELEGRAM_HTTP=000\nTLS_ERROR_CLASS=NONE\nLIVE_LOCAL_FORWARD_PROVEN=false\nPHASE=ERROR\nERROR_CODE=LOCAL_ERROR\nDECISION=HOLD_FWD231_FORWARD_OPEN_TLS_FAILED\nNEXT_GATE=RECONCILE_DOTNET_TLS_FAILURE_CLASS\nCLOUD_WRITES=0\nVPS_CONFIG_MUTATIONS=0\nMESSENGERS214_CLOSED=false\nMAJOR_STAGES_REMAINING=8\nNEWFI231_END=true\n"
 }
diff --git a/runtime/latest.txt b/runtime/latest.txt
index ecdc6686..3f77b59a 100644
--- a/runtime/latest.txt
+++ b/runtime/latest.txt
@@ -1,15 +1,15 @@
 CHAT_OUTPUT_BEGIN
-COMMAND_ID=NEWFI-260920-NEWFDOM-MESSENGERS214-FWD230
+COMMAND_ID=NEWFI-260920-NEWFDOM-MESSENGERS214-FWD231
 STATUS=OK
 RC=0
 HOST=pve01
 MODE=read-only
-COMPONENT=newfi-newfdom-messengers214-usa-sshd-forwarding-live-proof-readonly
+COMPONENT=newfi-newfdom-messengers214-usa-tunnel-dotnet-tls-proof-readonly
 REFERENCE_REGISTER_CHECK=OK
 REFERENCE_SHA256=5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66
 ERROR_REGISTER_CHECK=OK
 ERROR_REGISTER_SHA256=3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0
-COMMAND_SHA256=586ec5c53b390ff8856c2e5f2b83c53c9edb1d2b39098433fd19ef354891eada
+COMMAND_SHA256=f92a07e66001d9254540281acca6910239d37ba30a7d8d692bc5fa72234b2867
 DUPLICATE_FAILED_COMMAND_BLOCKED=false
 EXECUTION_STARTED=true
 CHANGE_DECLARED=false
@@ -24,41 +24,33 @@ MUTATION_OUTCOME=NO_MUTATION
 SANITIZED=yes
 SECRETS_INCLUDED=no
 PRIVATE_ADDRESSES_INCLUDED=no
-RAW_EVIDENCE_SHA256=8ed2063b398c03a0e6aeab39a27a5018b5d9b0c721d484970efa5375109e28de
-SANITIZED_OUTPUT_SHA256=8ed2063b398c03a0e6aeab39a27a5018b5d9b0c721d484970efa5375109e28de
+RAW_EVIDENCE_SHA256=1006b11ecd51aa6eabfb3c7c6722967cdd9a701f9e6f485c0832979c4bb04a9e
+SANITIZED_OUTPUT_SHA256=1006b11ecd51aa6eabfb3c7c6722967cdd9a701f9e6f485c0832979c4bb04a9e
 OUTPUT_BEGIN
-NEWFI230_BEGIN=true
+NEWFI231_BEGIN=true
 MODE=read-only
 CHANGES_MADE=false
 MUTATION_OUTCOME=NO_MUTATION
 AUTHORITY_OK=true
 PRECHECK_OK=true
-PAGEANT_LOGIN_PROVEN=true
-NONINTERACTIVE_ROOT_SHELL=true
-SSHD_POLICY_READY=true
-LIVE_LOCAL_FORWARD_PROVEN=false
-DIRECT_TELEGRAM_HTTPS=true
-REMOTE_UID=1000
-SSHD_PATH_CLASS=USR_SBIN
-SSHD_T_RC=0
-ALLOWTCPFORWARDING=yes
-GATEWAYPORTS=no
-DISABLEFORWARDING=no
-PERMITOPEN=any
-PERMITLISTEN=any
-DIRECT_TELEGRAM_HTTP=302
 TUNNEL_ATTEMPTS=1
-TUNNEL_LOCAL_PORT_OPEN=true
+TUNNEL_STARTED=true
+TUNNEL_PAGEANT_PROVEN=false
+TUNNEL_ACCESS_GRANTED=false
+LOCAL_FORWARD_OPEN=true
+TLS_AUTHENTICATED=false
 TUNNEL_TELEGRAM_HTTP=000
+TLS_ERROR_CLASS=NONE
+LIVE_LOCAL_FORWARD_PROVEN=false
 PHASE=ERROR
 ERROR_CODE=LOCAL_ERROR
-DECISION=HOLD_FWD230_POLICY_READY_LIVE_FORWARD_FAILED
-NEXT_GATE=RECONCILE_EPHEMERAL_FORWARD_FAILURE
+DECISION=HOLD_FWD231_FORWARD_OPEN_TLS_FAILED
+NEXT_GATE=RECONCILE_DOTNET_TLS_FAILURE_CLASS
 CLOUD_WRITES=0
 VPS_CONFIG_MUTATIONS=0
 MESSENGERS214_CLOSED=false
 MAJOR_STAGES_REMAINING=8
-NEWFI230_END=true
+NEWFI231_END=true
 
 OUTPUT_END
 CHAT_OUTPUT_END