diff --git a/runtime/history/SUPPORT-261008-CT112-PINNED-ACTIVE-ONEFILE-REPAIR-99855R1.json b/runtime/history/SUPPORT-261008-CT112-PINNED-ACTIVE-ONEFILE-REPAIR-99855R1.json
index d599c379..a1b932f3 100644
--- a/runtime/history/SUPPORT-261008-CT112-PINNED-ACTIVE-ONEFILE-REPAIR-99855R1.json
+++ b/runtime/history/SUPPORT-261008-CT112-PINNED-ACTIVE-ONEFILE-REPAIR-99855R1.json
@@ -2,37 +2,37 @@
   "schema_version": 1,
   "channel": "homelab-runtime",
   "command_id": "SUPPORT-261008-CT112-PINNED-ACTIVE-ONEFILE-REPAIR-99855R1",
-  "status": "FAIL",
-  "rc": 76,
+  "status": "BLOCKED",
+  "rc": 73,
   "host": "pve01",
   "mode": "change",
   "component": "ct112-pinned-active-onefile-repair",
-  "started_at_utc": "2026-10-08T04:13:33Z",
-  "finished_at_utc": "2026-10-08T04:13:46Z",
+  "started_at_utc": "2026-10-08T04:16:05Z",
+  "finished_at_utc": "2026-10-08T04:16:05Z",
   "reference_register_checked": true,
   "reference_sha256": "5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66",
   "error_register_checked": true,
   "error_register_sha256": "3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0",
   "command_sha256": "301bb8b10558a649156acf2dbaf83a60c0c0c91e2e91ef1a498cfc2077de46e5",
-  "duplicate_failed_command_blocked": false,
-  "block_reason": null,
-  "execution_started": true,
+  "duplicate_failed_command_blocked": true,
+  "block_reason": "EXACT_FAILED_COMMAND_REPEAT",
+  "execution_started": false,
   "change_declared": true,
-  "result_contract_valid": false,
-  "result_contract_status": null,
-  "result_contract_error": "INVALID_CONTRACT:ValueError",
-  "command_rc": 0,
-  "changes_made": null,
-  "rollback_started": null,
+  "result_contract_valid": true,
+  "result_contract_status": "BLOCKED",
+  "result_contract_error": "RUNNER_PREEXECUTION_BLOCK",
+  "command_rc": null,
+  "changes_made": false,
+  "rollback_started": false,
   "rollback_restored": null,
-  "mutation_outcome": "UNKNOWN",
+  "mutation_outcome": "NO_MUTATION",
   "sanitized": true,
   "secrets_included": false,
   "private_addresses_included": false,
   "raw_evidence_retained_locally": true,
-  "raw_evidence_sha256": "f87825083940edf19938517594b1cf27a14616d13eb8bc644409d312fbf5a9b8",
-  "sanitized_output_sha256": "f87825083940edf19938517594b1cf27a14616d13eb8bc644409d312fbf5a9b8",
+  "raw_evidence_sha256": "035edd3f12dd45ad128d68de9a90d981dcb06d51c531ae49bad298ebe0c97160",
+  "sanitized_output_sha256": "035edd3f12dd45ad128d68de9a90d981dcb06d51c531ae49bad298ebe0c97160",
   "output_truncated_in_json": false,
   "full_sanitized_output_url": "https://git.gram1.ru/.well-known/homelab-runtime/latest.txt",
-  "output": "CT112_PINNED_ACTIVE_ONEFILE_REPAIR=V1\nMODE=change\nSCOPE=ACTIVE_HANDLER_PVE265_ONLY\nNO_BACKUP_OR_VM_OR_NETWORK_CONFIG_CHANGE=true\nSSH_TRANSPORT=PINNED_ED25519_OOB\nPRODUCTION_POLICY_APPROVAL=false\nPINNED_HOSTKEY_MATCH=true\nACTIVE_HANDLER_OWNER_VERIFIED=true\nORIGINAL_SHA256=cd2f634414a8e38a3789015aeca5a9b47821f77d7d1fa61dcdbdc866172963be\nCANDIDATE_SHA256=1db1087702ac916177f091792057bb2d7784181997477d543723d9a22f98d108\nCHILD_PROCESS_RC=0\nCHILD_STDERR_SHA256=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\nFAIL_STAGE=FRESH_ISOLATED_CANDIDATE_TEST\nEXCEPTION_TYPE=Gate\nEXCEPTION_SAFE_CODE=CHILD_POSTTEST_FAILED\nDECISION=HOLD_BEFORE_PRODUCTION_SWAP\nCHANGE_COMPLETED=false\nCHANGES_MADE=false\nROLLBACK_STARTED=false\nROLLBACK_RESTORED=null\nMUTATION_OUTCOME=NO_PRODUCTION_MUTATION\nEND_MARKER=true\nHOMELAB_RESULT_CONTRACT={\"version\":1,\"command_id\":\"SUPPORT-261008-CT112-PINNED-ACTIVE-ONEFILE-REPAIR-99855R1\",\"status\":\"FAIL\",\"changes_made\":false,\"rollback_started\":false,\"rollback_restored\":null}\nONEFILE_REPAIR_PYTHON_RC=0\n"
+  "output": "COMMAND_EXECUTION_BLOCKED=yes\nREASON=EXACT_FAILED_COMMAND_REPEAT\nPREVIOUS_RC=76\nCOMMAND_SHA256=301bb8b10558a649156acf2dbaf83a60c0c0c91e2e91ef1a498cfc2077de46e5\n\nSet HOMELAB_ALLOW_REPEAT=1 only after reviewing the previous failure.\n"
 }
diff --git a/runtime/history/SUPPORT-261008-CT112-PINNED-ACTIVE-ONEFILE-REPAIR-99855R1.txt b/runtime/history/SUPPORT-261008-CT112-PINNED-ACTIVE-ONEFILE-REPAIR-99855R1.txt
index 78269767..beca4984 100644
--- a/runtime/history/SUPPORT-261008-CT112-PINNED-ACTIVE-ONEFILE-REPAIR-99855R1.txt
+++ b/runtime/history/SUPPORT-261008-CT112-PINNED-ACTIVE-ONEFILE-REPAIR-99855R1.txt
@@ -1,7 +1,7 @@
 CHAT_OUTPUT_BEGIN
 COMMAND_ID=SUPPORT-261008-CT112-PINNED-ACTIVE-ONEFILE-REPAIR-99855R1
-STATUS=FAIL
-RC=76
+STATUS=BLOCKED
+RC=73
 HOST=pve01
 MODE=change
 COMPONENT=ct112-pinned-active-onefile-repair
@@ -10,47 +10,29 @@ REFERENCE_SHA256=5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d6
 ERROR_REGISTER_CHECK=OK
 ERROR_REGISTER_SHA256=3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0
 COMMAND_SHA256=301bb8b10558a649156acf2dbaf83a60c0c0c91e2e91ef1a498cfc2077de46e5
-DUPLICATE_FAILED_COMMAND_BLOCKED=false
-EXECUTION_STARTED=true
+DUPLICATE_FAILED_COMMAND_BLOCKED=true
+EXECUTION_STARTED=false
 CHANGE_DECLARED=true
-RESULT_CONTRACT_VALID=false
-RESULT_CONTRACT_STATUS=UNKNOWN
-RESULT_CONTRACT_ERROR=INVALID_CONTRACT:ValueError
-COMMAND_RC=0
-CHANGES_MADE=unknown
-ROLLBACK_STARTED=unknown
-ROLLBACK_RESTORED=null
-MUTATION_OUTCOME=UNKNOWN
-SANITIZED=yes
-SECRETS_INCLUDED=no
-PRIVATE_ADDRESSES_INCLUDED=no
-RAW_EVIDENCE_SHA256=f87825083940edf19938517594b1cf27a14616d13eb8bc644409d312fbf5a9b8
-SANITIZED_OUTPUT_SHA256=f87825083940edf19938517594b1cf27a14616d13eb8bc644409d312fbf5a9b8
-OUTPUT_BEGIN
-CT112_PINNED_ACTIVE_ONEFILE_REPAIR=V1
-MODE=change
-SCOPE=ACTIVE_HANDLER_PVE265_ONLY
-NO_BACKUP_OR_VM_OR_NETWORK_CONFIG_CHANGE=true
-SSH_TRANSPORT=PINNED_ED25519_OOB
-PRODUCTION_POLICY_APPROVAL=false
-PINNED_HOSTKEY_MATCH=true
-ACTIVE_HANDLER_OWNER_VERIFIED=true
-ORIGINAL_SHA256=cd2f634414a8e38a3789015aeca5a9b47821f77d7d1fa61dcdbdc866172963be
-CANDIDATE_SHA256=1db1087702ac916177f091792057bb2d7784181997477d543723d9a22f98d108
-CHILD_PROCESS_RC=0
-CHILD_STDERR_SHA256=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
-FAIL_STAGE=FRESH_ISOLATED_CANDIDATE_TEST
-EXCEPTION_TYPE=Gate
-EXCEPTION_SAFE_CODE=CHILD_POSTTEST_FAILED
-DECISION=HOLD_BEFORE_PRODUCTION_SWAP
-CHANGE_COMPLETED=false
+RESULT_CONTRACT_VALID=true
+RESULT_CONTRACT_STATUS=BLOCKED
+RESULT_CONTRACT_ERROR=RUNNER_PREEXECUTION_BLOCK
+COMMAND_RC=
 CHANGES_MADE=false
 ROLLBACK_STARTED=false
 ROLLBACK_RESTORED=null
-MUTATION_OUTCOME=NO_PRODUCTION_MUTATION
-END_MARKER=true
-HOMELAB_RESULT_CONTRACT={"version":1,"command_id":"SUPPORT-261008-CT112-PINNED-ACTIVE-ONEFILE-REPAIR-99855R1","status":"FAIL","changes_made":false,"rollback_started":false,"rollback_restored":null}
-ONEFILE_REPAIR_PYTHON_RC=0
+MUTATION_OUTCOME=NO_MUTATION
+SANITIZED=yes
+SECRETS_INCLUDED=no
+PRIVATE_ADDRESSES_INCLUDED=no
+RAW_EVIDENCE_SHA256=035edd3f12dd45ad128d68de9a90d981dcb06d51c531ae49bad298ebe0c97160
+SANITIZED_OUTPUT_SHA256=035edd3f12dd45ad128d68de9a90d981dcb06d51c531ae49bad298ebe0c97160
+OUTPUT_BEGIN
+COMMAND_EXECUTION_BLOCKED=yes
+REASON=EXACT_FAILED_COMMAND_REPEAT
+PREVIOUS_RC=76
+COMMAND_SHA256=301bb8b10558a649156acf2dbaf83a60c0c0c91e2e91ef1a498cfc2077de46e5
+
+Set HOMELAB_ALLOW_REPEAT=1 only after reviewing the previous failure.
 
 OUTPUT_END
 CHAT_OUTPUT_END
diff --git a/runtime/latest.json b/runtime/latest.json
index d599c379..a1b932f3 100644
--- a/runtime/latest.json
+++ b/runtime/latest.json
@@ -2,37 +2,37 @@
   "schema_version": 1,
   "channel": "homelab-runtime",
   "command_id": "SUPPORT-261008-CT112-PINNED-ACTIVE-ONEFILE-REPAIR-99855R1",
-  "status": "FAIL",
-  "rc": 76,
+  "status": "BLOCKED",
+  "rc": 73,
   "host": "pve01",
   "mode": "change",
   "component": "ct112-pinned-active-onefile-repair",
-  "started_at_utc": "2026-10-08T04:13:33Z",
-  "finished_at_utc": "2026-10-08T04:13:46Z",
+  "started_at_utc": "2026-10-08T04:16:05Z",
+  "finished_at_utc": "2026-10-08T04:16:05Z",
   "reference_register_checked": true,
   "reference_sha256": "5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66",
   "error_register_checked": true,
   "error_register_sha256": "3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0",
   "command_sha256": "301bb8b10558a649156acf2dbaf83a60c0c0c91e2e91ef1a498cfc2077de46e5",
-  "duplicate_failed_command_blocked": false,
-  "block_reason": null,
-  "execution_started": true,
+  "duplicate_failed_command_blocked": true,
+  "block_reason": "EXACT_FAILED_COMMAND_REPEAT",
+  "execution_started": false,
   "change_declared": true,
-  "result_contract_valid": false,
-  "result_contract_status": null,
-  "result_contract_error": "INVALID_CONTRACT:ValueError",
-  "command_rc": 0,
-  "changes_made": null,
-  "rollback_started": null,
+  "result_contract_valid": true,
+  "result_contract_status": "BLOCKED",
+  "result_contract_error": "RUNNER_PREEXECUTION_BLOCK",
+  "command_rc": null,
+  "changes_made": false,
+  "rollback_started": false,
   "rollback_restored": null,
-  "mutation_outcome": "UNKNOWN",
+  "mutation_outcome": "NO_MUTATION",
   "sanitized": true,
   "secrets_included": false,
   "private_addresses_included": false,
   "raw_evidence_retained_locally": true,
-  "raw_evidence_sha256": "f87825083940edf19938517594b1cf27a14616d13eb8bc644409d312fbf5a9b8",
-  "sanitized_output_sha256": "f87825083940edf19938517594b1cf27a14616d13eb8bc644409d312fbf5a9b8",
+  "raw_evidence_sha256": "035edd3f12dd45ad128d68de9a90d981dcb06d51c531ae49bad298ebe0c97160",
+  "sanitized_output_sha256": "035edd3f12dd45ad128d68de9a90d981dcb06d51c531ae49bad298ebe0c97160",
   "output_truncated_in_json": false,
   "full_sanitized_output_url": "https://git.gram1.ru/.well-known/homelab-runtime/latest.txt",
-  "output": "CT112_PINNED_ACTIVE_ONEFILE_REPAIR=V1\nMODE=change\nSCOPE=ACTIVE_HANDLER_PVE265_ONLY\nNO_BACKUP_OR_VM_OR_NETWORK_CONFIG_CHANGE=true\nSSH_TRANSPORT=PINNED_ED25519_OOB\nPRODUCTION_POLICY_APPROVAL=false\nPINNED_HOSTKEY_MATCH=true\nACTIVE_HANDLER_OWNER_VERIFIED=true\nORIGINAL_SHA256=cd2f634414a8e38a3789015aeca5a9b47821f77d7d1fa61dcdbdc866172963be\nCANDIDATE_SHA256=1db1087702ac916177f091792057bb2d7784181997477d543723d9a22f98d108\nCHILD_PROCESS_RC=0\nCHILD_STDERR_SHA256=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\nFAIL_STAGE=FRESH_ISOLATED_CANDIDATE_TEST\nEXCEPTION_TYPE=Gate\nEXCEPTION_SAFE_CODE=CHILD_POSTTEST_FAILED\nDECISION=HOLD_BEFORE_PRODUCTION_SWAP\nCHANGE_COMPLETED=false\nCHANGES_MADE=false\nROLLBACK_STARTED=false\nROLLBACK_RESTORED=null\nMUTATION_OUTCOME=NO_PRODUCTION_MUTATION\nEND_MARKER=true\nHOMELAB_RESULT_CONTRACT={\"version\":1,\"command_id\":\"SUPPORT-261008-CT112-PINNED-ACTIVE-ONEFILE-REPAIR-99855R1\",\"status\":\"FAIL\",\"changes_made\":false,\"rollback_started\":false,\"rollback_restored\":null}\nONEFILE_REPAIR_PYTHON_RC=0\n"
+  "output": "COMMAND_EXECUTION_BLOCKED=yes\nREASON=EXACT_FAILED_COMMAND_REPEAT\nPREVIOUS_RC=76\nCOMMAND_SHA256=301bb8b10558a649156acf2dbaf83a60c0c0c91e2e91ef1a498cfc2077de46e5\n\nSet HOMELAB_ALLOW_REPEAT=1 only after reviewing the previous failure.\n"
 }
diff --git a/runtime/latest.txt b/runtime/latest.txt
index 78269767..beca4984 100644
--- a/runtime/latest.txt
+++ b/runtime/latest.txt
@@ -1,7 +1,7 @@
 CHAT_OUTPUT_BEGIN
 COMMAND_ID=SUPPORT-261008-CT112-PINNED-ACTIVE-ONEFILE-REPAIR-99855R1
-STATUS=FAIL
-RC=76
+STATUS=BLOCKED
+RC=73
 HOST=pve01
 MODE=change
 COMPONENT=ct112-pinned-active-onefile-repair
@@ -10,47 +10,29 @@ REFERENCE_SHA256=5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d6
 ERROR_REGISTER_CHECK=OK
 ERROR_REGISTER_SHA256=3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0
 COMMAND_SHA256=301bb8b10558a649156acf2dbaf83a60c0c0c91e2e91ef1a498cfc2077de46e5
-DUPLICATE_FAILED_COMMAND_BLOCKED=false
-EXECUTION_STARTED=true
+DUPLICATE_FAILED_COMMAND_BLOCKED=true
+EXECUTION_STARTED=false
 CHANGE_DECLARED=true
-RESULT_CONTRACT_VALID=false
-RESULT_CONTRACT_STATUS=UNKNOWN
-RESULT_CONTRACT_ERROR=INVALID_CONTRACT:ValueError
-COMMAND_RC=0
-CHANGES_MADE=unknown
-ROLLBACK_STARTED=unknown
-ROLLBACK_RESTORED=null
-MUTATION_OUTCOME=UNKNOWN
-SANITIZED=yes
-SECRETS_INCLUDED=no
-PRIVATE_ADDRESSES_INCLUDED=no
-RAW_EVIDENCE_SHA256=f87825083940edf19938517594b1cf27a14616d13eb8bc644409d312fbf5a9b8
-SANITIZED_OUTPUT_SHA256=f87825083940edf19938517594b1cf27a14616d13eb8bc644409d312fbf5a9b8
-OUTPUT_BEGIN
-CT112_PINNED_ACTIVE_ONEFILE_REPAIR=V1
-MODE=change
-SCOPE=ACTIVE_HANDLER_PVE265_ONLY
-NO_BACKUP_OR_VM_OR_NETWORK_CONFIG_CHANGE=true
-SSH_TRANSPORT=PINNED_ED25519_OOB
-PRODUCTION_POLICY_APPROVAL=false
-PINNED_HOSTKEY_MATCH=true
-ACTIVE_HANDLER_OWNER_VERIFIED=true
-ORIGINAL_SHA256=cd2f634414a8e38a3789015aeca5a9b47821f77d7d1fa61dcdbdc866172963be
-CANDIDATE_SHA256=1db1087702ac916177f091792057bb2d7784181997477d543723d9a22f98d108
-CHILD_PROCESS_RC=0
-CHILD_STDERR_SHA256=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
-FAIL_STAGE=FRESH_ISOLATED_CANDIDATE_TEST
-EXCEPTION_TYPE=Gate
-EXCEPTION_SAFE_CODE=CHILD_POSTTEST_FAILED
-DECISION=HOLD_BEFORE_PRODUCTION_SWAP
-CHANGE_COMPLETED=false
+RESULT_CONTRACT_VALID=true
+RESULT_CONTRACT_STATUS=BLOCKED
+RESULT_CONTRACT_ERROR=RUNNER_PREEXECUTION_BLOCK
+COMMAND_RC=
 CHANGES_MADE=false
 ROLLBACK_STARTED=false
 ROLLBACK_RESTORED=null
-MUTATION_OUTCOME=NO_PRODUCTION_MUTATION
-END_MARKER=true
-HOMELAB_RESULT_CONTRACT={"version":1,"command_id":"SUPPORT-261008-CT112-PINNED-ACTIVE-ONEFILE-REPAIR-99855R1","status":"FAIL","changes_made":false,"rollback_started":false,"rollback_restored":null}
-ONEFILE_REPAIR_PYTHON_RC=0
+MUTATION_OUTCOME=NO_MUTATION
+SANITIZED=yes
+SECRETS_INCLUDED=no
+PRIVATE_ADDRESSES_INCLUDED=no
+RAW_EVIDENCE_SHA256=035edd3f12dd45ad128d68de9a90d981dcb06d51c531ae49bad298ebe0c97160
+SANITIZED_OUTPUT_SHA256=035edd3f12dd45ad128d68de9a90d981dcb06d51c531ae49bad298ebe0c97160
+OUTPUT_BEGIN
+COMMAND_EXECUTION_BLOCKED=yes
+REASON=EXACT_FAILED_COMMAND_REPEAT
+PREVIOUS_RC=76
+COMMAND_SHA256=301bb8b10558a649156acf2dbaf83a60c0c0c91e2e91ef1a498cfc2077de46e5
+
+Set HOMELAB_ALLOW_REPEAT=1 only after reviewing the previous failure.
 
 OUTPUT_END
 CHAT_OUTPUT_END