diff --git a/runtime/history/SUPPORT-260911-INFRA-DR-VPS-AUX-HOSTKEY-LIVE-DIAG-221R1.json b/runtime/history/SUPPORT-260911-INFRA-DR-VPS-AUX-HOSTKEY-LIVE-DIAG-221R1.json
new file mode 100644
index 00000000..10d78357
--- /dev/null
+++ b/runtime/history/SUPPORT-260911-INFRA-DR-VPS-AUX-HOSTKEY-LIVE-DIAG-221R1.json
@@ -0,0 +1,38 @@
+{
+  "schema_version": 1,
+  "channel": "homelab-runtime",
+  "command_id": "SUPPORT-260911-INFRA-DR-VPS-AUX-HOSTKEY-LIVE-DIAG-221R1",
+  "status": "OK",
+  "rc": 0,
+  "host": "pve01",
+  "mode": "read-only",
+  "component": "infra-dr-vps-aux-hostkey-live-diag",
+  "started_at_utc": "2026-09-11T14:04:48Z",
+  "finished_at_utc": "2026-09-11T14:04:48Z",
+  "reference_register_checked": true,
+  "reference_sha256": "5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66",
+  "error_register_checked": true,
+  "error_register_sha256": "3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0",
+  "command_sha256": "70d545ce7f1e3e8f7558606b0d500b16a503c463866b4e4af29291de85d12105",
+  "duplicate_failed_command_blocked": false,
+  "block_reason": null,
+  "execution_started": true,
+  "change_declared": false,
+  "result_contract_valid": true,
+  "result_contract_status": null,
+  "result_contract_error": null,
+  "command_rc": 0,
+  "changes_made": false,
+  "rollback_started": false,
+  "rollback_restored": null,
+  "mutation_outcome": "NO_MUTATION",
+  "sanitized": true,
+  "secrets_included": false,
+  "private_addresses_included": false,
+  "raw_evidence_retained_locally": true,
+  "raw_evidence_sha256": "e83264ef01b94ea9fe6727289cfa43bd056efc6abe91410acc94399b7ae815f7",
+  "sanitized_output_sha256": "e83264ef01b94ea9fe6727289cfa43bd056efc6abe91410acc94399b7ae815f7",
+  "output_truncated_in_json": false,
+  "full_sanitized_output_url": "https://git.gram1.ru/.well-known/homelab-runtime/latest.txt",
+  "output": "VPS221_BEGIN\nCOMMAND_ID=SUPPORT-260911-INFRA-DR-VPS-AUX-HOSTKEY-LIVE-DIAG-221R1\nMODE=HOSTKEY_DIAG_NO_TRUST_CHANGE\nEXPECTED_SHARED_HOSTKEY=SHA256:2FBYDI2YEYcdzkiAAC306AtebdfeH6NWR5WJZAeH+5E\nEXTERNAL_SSH_HANDSHAKE_ATTEMPTS=2\nMAILCOW_TARGET=185.139.214.215\nMAILCOW_USER=ops\nMAILCOW_PLINK_RC=1\nMAILCOW_LIVE_HOSTKEY_FINGERPRINT=SHA256:rnQFOD0WgeMQ5s+ZB6Xr4b4EA3HnUdWjC9VXGnogXDU\nMAILCOW_DIAG=Server also has ecdsa-sha2-nistp256/rsa-sha2-512/rsa-sha2-256/ssh-rsa host keys, but we don't know any of them\nMAILCOW_DIAG=Host key fingerprint is:\nMAILCOW_DIAG=ssh-ed25519 255 SHA256:rnQFOD0WgeMQ5s+ZB6Xr4b4EA3HnUdWjC9VXGnogXDU\nMAILCOW_DIAG=Host key not in manually configured list\nMAILCOW_DIAG=FATAL ERROR: Host key not in manually configured list\nMAILCOW_LIVE_HOSTKEY_MATCH_EXPECTED=false\nNETBIRD2_TARGET=185.139.214.156\nNETBIRD2_USER=ops\nNETBIRD2_PLINK_RC=1\nNETBIRD2_LIVE_HOSTKEY_FINGERPRINT=SHA256:O13RQnp5MITTbVKjUh4N6Y1xE5e/k4SlFDCcBxZebjg\nNETBIRD2_DIAG=Server also has ecdsa-sha2-nistp256/rsa-sha2-512/rsa-sha2-256/ssh-rsa host keys, but we don't know any of them\nNETBIRD2_DIAG=Host key fingerprint is:\nNETBIRD2_DIAG=ssh-ed25519 255 SHA256:O13RQnp5MITTbVKjUh4N6Y1xE5e/k4SlFDCcBxZebjg\nNETBIRD2_DIAG=Host key not in manually configured list\nNETBIRD2_DIAG=FATAL ERROR: Host key not in manually configured list\nNETBIRD2_LIVE_HOSTKEY_MATCH_EXPECTED=false\nHOSTKEY_ACCEPTED=false\nAUTH_SECRET_USED=false\nCHANGES_MADE=false\nVPS221_DECISION=AUX_HOSTKEY_MISMATCH_OR_NOT_CAPTURED_HOLD\nVPS221_END\n"
+}
diff --git a/runtime/history/SUPPORT-260911-INFRA-DR-VPS-AUX-HOSTKEY-LIVE-DIAG-221R1.txt b/runtime/history/SUPPORT-260911-INFRA-DR-VPS-AUX-HOSTKEY-LIVE-DIAG-221R1.txt
new file mode 100644
index 00000000..e718162d
--- /dev/null
+++ b/runtime/history/SUPPORT-260911-INFRA-DR-VPS-AUX-HOSTKEY-LIVE-DIAG-221R1.txt
@@ -0,0 +1,62 @@
+CHAT_OUTPUT_BEGIN
+COMMAND_ID=SUPPORT-260911-INFRA-DR-VPS-AUX-HOSTKEY-LIVE-DIAG-221R1
+STATUS=OK
+RC=0
+HOST=pve01
+MODE=read-only
+COMPONENT=infra-dr-vps-aux-hostkey-live-diag
+REFERENCE_REGISTER_CHECK=OK
+REFERENCE_SHA256=5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66
+ERROR_REGISTER_CHECK=OK
+ERROR_REGISTER_SHA256=3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0
+COMMAND_SHA256=70d545ce7f1e3e8f7558606b0d500b16a503c463866b4e4af29291de85d12105
+DUPLICATE_FAILED_COMMAND_BLOCKED=false
+EXECUTION_STARTED=true
+CHANGE_DECLARED=false
+RESULT_CONTRACT_VALID=true
+RESULT_CONTRACT_STATUS=NOT_APPLICABLE
+RESULT_CONTRACT_ERROR=NONE
+COMMAND_RC=0
+CHANGES_MADE=false
+ROLLBACK_STARTED=false
+ROLLBACK_RESTORED=null
+MUTATION_OUTCOME=NO_MUTATION
+SANITIZED=yes
+SECRETS_INCLUDED=no
+PRIVATE_ADDRESSES_INCLUDED=no
+RAW_EVIDENCE_SHA256=e83264ef01b94ea9fe6727289cfa43bd056efc6abe91410acc94399b7ae815f7
+SANITIZED_OUTPUT_SHA256=e83264ef01b94ea9fe6727289cfa43bd056efc6abe91410acc94399b7ae815f7
+OUTPUT_BEGIN
+VPS221_BEGIN
+COMMAND_ID=SUPPORT-260911-INFRA-DR-VPS-AUX-HOSTKEY-LIVE-DIAG-221R1
+MODE=HOSTKEY_DIAG_NO_TRUST_CHANGE
+EXPECTED_SHARED_HOSTKEY=SHA256:2FBYDI2YEYcdzkiAAC306AtebdfeH6NWR5WJZAeH+5E
+EXTERNAL_SSH_HANDSHAKE_ATTEMPTS=2
+MAILCOW_TARGET=185.139.214.215
+MAILCOW_USER=ops
+MAILCOW_PLINK_RC=1
+MAILCOW_LIVE_HOSTKEY_FINGERPRINT=SHA256:rnQFOD0WgeMQ5s+ZB6Xr4b4EA3HnUdWjC9VXGnogXDU
+MAILCOW_DIAG=Server also has ecdsa-sha2-nistp256/rsa-sha2-512/rsa-sha2-256/ssh-rsa host keys, but we don't know any of them
+MAILCOW_DIAG=Host key fingerprint is:
+MAILCOW_DIAG=ssh-ed25519 255 SHA256:rnQFOD0WgeMQ5s+ZB6Xr4b4EA3HnUdWjC9VXGnogXDU
+MAILCOW_DIAG=Host key not in manually configured list
+MAILCOW_DIAG=FATAL ERROR: Host key not in manually configured list
+MAILCOW_LIVE_HOSTKEY_MATCH_EXPECTED=false
+NETBIRD2_TARGET=185.139.214.156
+NETBIRD2_USER=ops
+NETBIRD2_PLINK_RC=1
+NETBIRD2_LIVE_HOSTKEY_FINGERPRINT=SHA256:O13RQnp5MITTbVKjUh4N6Y1xE5e/k4SlFDCcBxZebjg
+NETBIRD2_DIAG=Server also has ecdsa-sha2-nistp256/rsa-sha2-512/rsa-sha2-256/ssh-rsa host keys, but we don't know any of them
+NETBIRD2_DIAG=Host key fingerprint is:
+NETBIRD2_DIAG=ssh-ed25519 255 SHA256:O13RQnp5MITTbVKjUh4N6Y1xE5e/k4SlFDCcBxZebjg
+NETBIRD2_DIAG=Host key not in manually configured list
+NETBIRD2_DIAG=FATAL ERROR: Host key not in manually configured list
+NETBIRD2_LIVE_HOSTKEY_MATCH_EXPECTED=false
+HOSTKEY_ACCEPTED=false
+AUTH_SECRET_USED=false
+CHANGES_MADE=false
+VPS221_DECISION=AUX_HOSTKEY_MISMATCH_OR_NOT_CAPTURED_HOLD
+VPS221_END
+
+OUTPUT_END
+CHAT_OUTPUT_END
diff --git a/runtime/latest.json b/runtime/latest.json
index 12cea771..10d78357 100644
--- a/runtime/latest.json
+++ b/runtime/latest.json
@@ -1,19 +1,19 @@
 {
   "schema_version": 1,
   "channel": "homelab-runtime",
-  "command_id": "SUPPORT-260911-INFRA-DR-VPS-SPB-AUTH-LIVE-INVENTORY-220R1",
+  "command_id": "SUPPORT-260911-INFRA-DR-VPS-AUX-HOSTKEY-LIVE-DIAG-221R1",
   "status": "OK",
   "rc": 0,
   "host": "pve01",
   "mode": "read-only",
-  "component": "infra-dr-vps-spb-auth-live-inventory",
-  "started_at_utc": "2026-09-11T14:00:48Z",
-  "finished_at_utc": "2026-09-11T14:00:48Z",
+  "component": "infra-dr-vps-aux-hostkey-live-diag",
+  "started_at_utc": "2026-09-11T14:04:48Z",
+  "finished_at_utc": "2026-09-11T14:04:48Z",
   "reference_register_checked": true,
   "reference_sha256": "5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66",
   "error_register_checked": true,
   "error_register_sha256": "3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0",
-  "command_sha256": "be6d215080d3e628d3ac21b7fa2d670d2ab0cf3ab5f5011729f4fdb3d159e793",
+  "command_sha256": "70d545ce7f1e3e8f7558606b0d500b16a503c463866b4e4af29291de85d12105",
   "duplicate_failed_command_blocked": false,
   "block_reason": null,
   "execution_started": true,
@@ -30,9 +30,9 @@
   "secrets_included": false,
   "private_addresses_included": false,
   "raw_evidence_retained_locally": true,
-  "raw_evidence_sha256": "b1603e6abf252cdad00ce23889dc6ba5812e7b96a7c7005fc6d21ac0008f82fd",
-  "sanitized_output_sha256": "b1603e6abf252cdad00ce23889dc6ba5812e7b96a7c7005fc6d21ac0008f82fd",
+  "raw_evidence_sha256": "e83264ef01b94ea9fe6727289cfa43bd056efc6abe91410acc94399b7ae815f7",
+  "sanitized_output_sha256": "e83264ef01b94ea9fe6727289cfa43bd056efc6abe91410acc94399b7ae815f7",
   "output_truncated_in_json": false,
   "full_sanitized_output_url": "https://git.gram1.ru/.well-known/homelab-runtime/latest.txt",
-  "output": "VPS220_BEGIN\nCOMMAND_ID=SUPPORT-260911-INFRA-DR-VPS-SPB-AUTH-LIVE-INVENTORY-220R1\nROLE=SPB_INGRESS\nTARGET=185.225.35.6\nUSER=edgeadmin\nPINNED_HOSTKEY=SHA256:Ef+HsZb8lIXoadvYBXuGKIL3H7NyJMmf9EYCoJRoSv8\nPPK_BASENAME=edge01-admin-2026.ppk\nPPK_VERSION=2\nPPK_KEY_TYPE=ssh-ed25519\nPPK_ENCRYPTION=aes256-cbc\nPPK_PUBLIC_FINGERPRINT=SHA256:PS+jG8Qun3vviOwZ4A2/ozwro+Jeav/x9VkfvH/d2yI\nPPK_FILE_SHA256=44d22c545ce74a3cf3ceedfb5a73414a3748f696b0ae6cbef2c63fc26e5d8646\nEXTERNAL_SSH_ATTEMPTS=0\nCHANGES_MADE=false\nVPS220_DECISION=HOLD_SPB_PPK_ENCRYPTED_PASSPHRASE_REQUIRED\nVPS220_END\n"
+  "output": "VPS221_BEGIN\nCOMMAND_ID=SUPPORT-260911-INFRA-DR-VPS-AUX-HOSTKEY-LIVE-DIAG-221R1\nMODE=HOSTKEY_DIAG_NO_TRUST_CHANGE\nEXPECTED_SHARED_HOSTKEY=SHA256:2FBYDI2YEYcdzkiAAC306AtebdfeH6NWR5WJZAeH+5E\nEXTERNAL_SSH_HANDSHAKE_ATTEMPTS=2\nMAILCOW_TARGET=185.139.214.215\nMAILCOW_USER=ops\nMAILCOW_PLINK_RC=1\nMAILCOW_LIVE_HOSTKEY_FINGERPRINT=SHA256:rnQFOD0WgeMQ5s+ZB6Xr4b4EA3HnUdWjC9VXGnogXDU\nMAILCOW_DIAG=Server also has ecdsa-sha2-nistp256/rsa-sha2-512/rsa-sha2-256/ssh-rsa host keys, but we don't know any of them\nMAILCOW_DIAG=Host key fingerprint is:\nMAILCOW_DIAG=ssh-ed25519 255 SHA256:rnQFOD0WgeMQ5s+ZB6Xr4b4EA3HnUdWjC9VXGnogXDU\nMAILCOW_DIAG=Host key not in manually configured list\nMAILCOW_DIAG=FATAL ERROR: Host key not in manually configured list\nMAILCOW_LIVE_HOSTKEY_MATCH_EXPECTED=false\nNETBIRD2_TARGET=185.139.214.156\nNETBIRD2_USER=ops\nNETBIRD2_PLINK_RC=1\nNETBIRD2_LIVE_HOSTKEY_FINGERPRINT=SHA256:O13RQnp5MITTbVKjUh4N6Y1xE5e/k4SlFDCcBxZebjg\nNETBIRD2_DIAG=Server also has ecdsa-sha2-nistp256/rsa-sha2-512/rsa-sha2-256/ssh-rsa host keys, but we don't know any of them\nNETBIRD2_DIAG=Host key fingerprint is:\nNETBIRD2_DIAG=ssh-ed25519 255 SHA256:O13RQnp5MITTbVKjUh4N6Y1xE5e/k4SlFDCcBxZebjg\nNETBIRD2_DIAG=Host key not in manually configured list\nNETBIRD2_DIAG=FATAL ERROR: Host key not in manually configured list\nNETBIRD2_LIVE_HOSTKEY_MATCH_EXPECTED=false\nHOSTKEY_ACCEPTED=false\nAUTH_SECRET_USED=false\nCHANGES_MADE=false\nVPS221_DECISION=AUX_HOSTKEY_MISMATCH_OR_NOT_CAPTURED_HOLD\nVPS221_END\n"
 }
diff --git a/runtime/latest.txt b/runtime/latest.txt
index 906f703b..e718162d 100644
--- a/runtime/latest.txt
+++ b/runtime/latest.txt
@@ -1,15 +1,15 @@
 CHAT_OUTPUT_BEGIN
-COMMAND_ID=SUPPORT-260911-INFRA-DR-VPS-SPB-AUTH-LIVE-INVENTORY-220R1
+COMMAND_ID=SUPPORT-260911-INFRA-DR-VPS-AUX-HOSTKEY-LIVE-DIAG-221R1
 STATUS=OK
 RC=0
 HOST=pve01
 MODE=read-only
-COMPONENT=infra-dr-vps-spb-auth-live-inventory
+COMPONENT=infra-dr-vps-aux-hostkey-live-diag
 REFERENCE_REGISTER_CHECK=OK
 REFERENCE_SHA256=5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66
 ERROR_REGISTER_CHECK=OK
 ERROR_REGISTER_SHA256=3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0
-COMMAND_SHA256=be6d215080d3e628d3ac21b7fa2d670d2ab0cf3ab5f5011729f4fdb3d159e793
+COMMAND_SHA256=70d545ce7f1e3e8f7558606b0d500b16a503c463866b4e4af29291de85d12105
 DUPLICATE_FAILED_COMMAND_BLOCKED=false
 EXECUTION_STARTED=true
 CHANGE_DECLARED=false
@@ -24,25 +24,39 @@ MUTATION_OUTCOME=NO_MUTATION
 SANITIZED=yes
 SECRETS_INCLUDED=no
 PRIVATE_ADDRESSES_INCLUDED=no
-RAW_EVIDENCE_SHA256=b1603e6abf252cdad00ce23889dc6ba5812e7b96a7c7005fc6d21ac0008f82fd
-SANITIZED_OUTPUT_SHA256=b1603e6abf252cdad00ce23889dc6ba5812e7b96a7c7005fc6d21ac0008f82fd
+RAW_EVIDENCE_SHA256=e83264ef01b94ea9fe6727289cfa43bd056efc6abe91410acc94399b7ae815f7
+SANITIZED_OUTPUT_SHA256=e83264ef01b94ea9fe6727289cfa43bd056efc6abe91410acc94399b7ae815f7
 OUTPUT_BEGIN
-VPS220_BEGIN
-COMMAND_ID=SUPPORT-260911-INFRA-DR-VPS-SPB-AUTH-LIVE-INVENTORY-220R1
-ROLE=SPB_INGRESS
-TARGET=185.225.35.6
-USER=edgeadmin
-PINNED_HOSTKEY=SHA256:Ef+HsZb8lIXoadvYBXuGKIL3H7NyJMmf9EYCoJRoSv8
-PPK_BASENAME=edge01-admin-2026.ppk
-PPK_VERSION=2
-PPK_KEY_TYPE=ssh-ed25519
-PPK_ENCRYPTION=aes256-cbc
-PPK_PUBLIC_FINGERPRINT=SHA256:PS+jG8Qun3vviOwZ4A2/ozwro+Jeav/x9VkfvH/d2yI
-PPK_FILE_SHA256=44d22c545ce74a3cf3ceedfb5a73414a3748f696b0ae6cbef2c63fc26e5d8646
-EXTERNAL_SSH_ATTEMPTS=0
+VPS221_BEGIN
+COMMAND_ID=SUPPORT-260911-INFRA-DR-VPS-AUX-HOSTKEY-LIVE-DIAG-221R1
+MODE=HOSTKEY_DIAG_NO_TRUST_CHANGE
+EXPECTED_SHARED_HOSTKEY=SHA256:2FBYDI2YEYcdzkiAAC306AtebdfeH6NWR5WJZAeH+5E
+EXTERNAL_SSH_HANDSHAKE_ATTEMPTS=2
+MAILCOW_TARGET=185.139.214.215
+MAILCOW_USER=ops
+MAILCOW_PLINK_RC=1
+MAILCOW_LIVE_HOSTKEY_FINGERPRINT=SHA256:rnQFOD0WgeMQ5s+ZB6Xr4b4EA3HnUdWjC9VXGnogXDU
+MAILCOW_DIAG=Server also has ecdsa-sha2-nistp256/rsa-sha2-512/rsa-sha2-256/ssh-rsa host keys, but we don't know any of them
+MAILCOW_DIAG=Host key fingerprint is:
+MAILCOW_DIAG=ssh-ed25519 255 SHA256:rnQFOD0WgeMQ5s+ZB6Xr4b4EA3HnUdWjC9VXGnogXDU
+MAILCOW_DIAG=Host key not in manually configured list
+MAILCOW_DIAG=FATAL ERROR: Host key not in manually configured list
+MAILCOW_LIVE_HOSTKEY_MATCH_EXPECTED=false
+NETBIRD2_TARGET=185.139.214.156
+NETBIRD2_USER=ops
+NETBIRD2_PLINK_RC=1
+NETBIRD2_LIVE_HOSTKEY_FINGERPRINT=SHA256:O13RQnp5MITTbVKjUh4N6Y1xE5e/k4SlFDCcBxZebjg
+NETBIRD2_DIAG=Server also has ecdsa-sha2-nistp256/rsa-sha2-512/rsa-sha2-256/ssh-rsa host keys, but we don't know any of them
+NETBIRD2_DIAG=Host key fingerprint is:
+NETBIRD2_DIAG=ssh-ed25519 255 SHA256:O13RQnp5MITTbVKjUh4N6Y1xE5e/k4SlFDCcBxZebjg
+NETBIRD2_DIAG=Host key not in manually configured list
+NETBIRD2_DIAG=FATAL ERROR: Host key not in manually configured list
+NETBIRD2_LIVE_HOSTKEY_MATCH_EXPECTED=false
+HOSTKEY_ACCEPTED=false
+AUTH_SECRET_USED=false
 CHANGES_MADE=false
-VPS220_DECISION=HOLD_SPB_PPK_ENCRYPTED_PASSPHRASE_REQUIRED
-VPS220_END
+VPS221_DECISION=AUX_HOSTKEY_MISMATCH_OR_NOT_CAPTURED_HOLD
+VPS221_END
 
 OUTPUT_END
 CHAT_OUTPUT_END