diff --git a/runtime/history/NEWFI-260908-A-STAGINGEDGE-NETBIRD-TRUSTEDPATH-DISCOVERY11.json b/runtime/history/NEWFI-260908-A-STAGINGEDGE-NETBIRD-TRUSTEDPATH-DISCOVERY11.json
new file mode 100644
index 00000000..40476614
--- /dev/null
+++ b/runtime/history/NEWFI-260908-A-STAGINGEDGE-NETBIRD-TRUSTEDPATH-DISCOVERY11.json
@@ -0,0 +1,38 @@
+{
+  "schema_version": 1,
+  "channel": "homelab-runtime",
+  "command_id": "NEWFI-260908-A-STAGINGEDGE-NETBIRD-TRUSTEDPATH-DISCOVERY11",
+  "status": "OK",
+  "rc": 0,
+  "host": "pve01",
+  "mode": "read-only",
+  "component": "newfi-stagingedge-netbird-trustedpath-discovery-readonly",
+  "started_at_utc": "2026-09-08T12:41:35Z",
+  "finished_at_utc": "2026-09-08T12:41:35Z",
+  "reference_register_checked": true,
+  "reference_sha256": "5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66",
+  "error_register_checked": true,
+  "error_register_sha256": "3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0",
+  "command_sha256": "0a2978e059f179306f2837a519ca9bfb6564bc3310e174392472e8847b3508d6",
+  "duplicate_failed_command_blocked": false,
+  "block_reason": null,
+  "execution_started": true,
+  "change_declared": false,
+  "result_contract_valid": true,
+  "result_contract_status": null,
+  "result_contract_error": null,
+  "command_rc": 0,
+  "changes_made": false,
+  "rollback_started": false,
+  "rollback_restored": null,
+  "mutation_outcome": "NO_MUTATION",
+  "sanitized": true,
+  "secrets_included": false,
+  "private_addresses_included": false,
+  "raw_evidence_retained_locally": true,
+  "raw_evidence_sha256": "df7df330d75ac609c04c83316f088906b7687eec55dfe5b2f92c1019ee065d39",
+  "sanitized_output_sha256": "fa0f4f51da57bf621027059915562fefe256db077b5ff1a1cfc50daa7a0a75e0",
+  "output_truncated_in_json": false,
+  "full_sanitized_output_url": "https://git.gram1.ru/.well-known/homelab-runtime/latest.txt",
+  "output": "DISCOVERY11_BEGIN=true\nCOMMAND_ID=NEWFI-260908-A-STAGINGEDGE-NETBIRD-TRUSTEDPATH-DISCOVERY11\nMODE=read-only\nMUTATIONS_PERFORMED=NO\nERROR_REGISTER_CHECK=OK\nERROR_REGISTER_SHA256=3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0\nREFERENCE_CHECK=OK\nREFERENCE_SHA256=5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66\nRUNNER_SHA256=b248a4c32c9cc64e5747e7dce6c7fc0a23f5124a77c71ce72e27a81aceae9d2d\nTRUST_FILE_PRESENT=true\nTRUST_FILE_SHA256=092eaa2c4f3a5f623e9440135d36e6bae7d8ae46a03d380d14a5e95657812b61\nTRUSTED_NETBIRD_IDENTITY_EDGEVM=true\nPUBLIC_VPS_REJECTED_HOSTKEY_MISMATCH=true\nTRUST_SEAL_STATUS_OK_SIGNAL=true\nNETBIRD_STATUS_JSON_RC=0\nNETBIRD_STATUS_DETAIL_RC=0\nEDGEVM_OVERLAY_IP_COUNT=1\nEDGEVM_OVERLAY_IP_UNIQUE=true\nEDGEVM_KNOWN_HOST_RC=0\nEDGEVM_KNOWN_HOST_KEY_COUNT=1\nEDGEVM_KNOWN_HOST_HASHES={\"ssh-ed25519\":\"0e70c47cbb89d3651089d1c7b16e31a69def06234236cd16ccb801fdeae7b0d1\"}\nEDGEVM_KEYSCAN_RC=0\nEDGEVM_KEYSCAN_KEY_COUNT=3\nEDGEVM_KEYSCAN_HASHES={\"ecdsa-sha2-nistp256\":\"2408a3334d153e2aca1071a5bdc7404a479db925bf6fabe31a33b1d24103243a\",\"ssh-ed25519\":\"0e70c47cbb89d3651089d1c7b16e31a69def06234236cd16ccb801fdeae7b0d1\",\"ssh-rsa\":\"dd7e969c71686f792e368eb8ea3218ba287c9bd8d929b526c9f9411de2f1e338\"}\nEDGEVM_EXISTING_HOSTKEY_MATCH=true\nEDGEVM_EXISTING_HOSTKEY_ALGORITHMS=ssh-ed25519\nDERIVED_SSH_USER_COUNT=3\nDERIVED_SSH_USERS=debian,edgeadmin,root\nDERIVED_SSH_USER_REFS=[{\"path\":\"/root/post-reboot-pve01-check.sh\",\"line\":32,\"user\":\"debian\",\"kind\":\"user_at_target\"},{\"path\":\"/var/lib/homelab-netbird-vps-trust/latest.md\",\"line\":64,\"user\":\"debian\",\"kind\":\"scoped_assignment\",\"var\":\"REMOTE_USER\"},{\"path\":\"/var/lib/homelab-netbird-vps-trust/latest.md\",\"line\":78,\"user\":\"debian\",\"kind\":\"scoped_assignment\",\"var\":\"REMOTE_USER\"},{\"path\":\"/srv/homelab-ops/docs/superpowers/specs/2026-08-17-snikket-edge-cutover-design.md\",\"line\":16,\"user\":\"root\",\"kind\":\"user_at_target\"},{\"path\":\"/srv/homelab-ops/docs/superpowers/plans/2026-08-18-gitea-edge-publisher-v3.md\",\"line\":845,\"user\":\"edgeadmin\",\"kind\":\"user_at_target\"},{\"path\":\"/srv/homelab-ops/tasks/snikket-edge-cutover-v1/tools/cutover.py\",\"line\":16,\"user\":\"debian\",\"kind\":\"user_at_target\"}]\nTRUSTED_PATH_SOURCE_EVIDENCE=[{\"path\":\"/usr/local/sbin/homelab-vps-identity-audit\",\"line\":14,\"text\":\"ssh-keygen -F \\\"$VPS_IP\\\" -f [SENSITIVE_PATH] > \\\"$TMP/old-ip-known-hosts.txt\\\" 2>/dev/null || true\"},{\"path\":\"/usr/local/sbin/homelab-vps-identity-audit\",\"line\":15,\"text\":\"ssh-keygen -F \\\"$VPS_ALIAS\\\" -f [SENSITIVE_PATH] > \\\"$TMP/old-alias-known-hosts.txt\\\" 2>/dev/null || true\"},{\"path\":\"/usr/local/sbin/homelab-vps-identity-audit\",\"line\":20,\"text\":\"ssh-keyscan -T 10 -t ed25519,rsa,ecdsa \\\"$VPS_IP\\\" > \\\"$TMP/current-known-hosts\\\" 2>/dev/null || true\"},{\"path\":\"/usr/local/sbin/homelab-external-probe-vps\",\"line\":12,\"text\":\"grep -q \\\"TRUSTED_NETBIRD_IDENTITY=edge-vm\\\" /var/lib/homelab-health/netbird-vps-trust-clean-seal.txt 2>/dev/null || BAD=$((BAD+1))\"},{\"path\":\"/usr/local/sbin/homelab-external-probe-vps\",\"line\":13,\"text\":\"grep -q \\\"PUBLIC_VPS_DECISION=REJECTED_HOSTKEY_MISMATCH\\\" /var/lib/homelab-health/netbird-vps-trust-clean-seal.txt 2>/dev/null || BAD=$((BAD+1))\"},{\"path\":\"/usr/local/sbin/homelab-external-probe-vps\",\"line\":38,\"text\":\"trusted_netbird_identity=edge-vm\"},{\"path\":\"/usr/local/sbin/homelab-external-probe-vps\",\"line\":41,\"text\":\"public_vps_decision=REJECTED_HOSTKEY_MISMATCH\"},{\"path\":\"/usr/local/sbin/homelab-external-probe-vps\",\"line\":46,\"text\":\"closed_tail=public_vps_rejected_hostkey_mismatch\"},{\"path\":\"/usr/local/sbin/homelab-external-probe-vps\",\"line\":51,\"text\":\"echo \\\"STATUS=$STATUS TS=$TS TYPE=external-probe-vps BAD=$BAD WARN=$WARN MODE=STRATEGY_ONLY_NO_INDEPENDENT_RUNNER DEPLOYED=NO DEPLOY_DECISION=NO_DEPLOY VPS_TRUST=edge_vm_trusted_public_vps_rejected BACKUP_HOSTKEYS=not_used_public_vps_rejected PVE01_PUBLIC_SMOKE_BAD=$PVE01_PUBLIC_SMOKE_BAD INDEPENDENT_RUNNER=missing INDEPENDENT_RUNNER_AVAILABLE=no TRUSTED_NETBIRD_IDENTITY=edge-vm TRUSTED_NETBIRD_IP=[PRIVATE_IP] PUBLIC_\"},{\"path\":\"/var/lib/homelab-netbird-vps-trust/closure-latest.md\",\"line\":14,\"text\":\"trusted_netbird_identity=edge-vm\"},{\"path\":\"/var/lib/homelab-netbird-vps-trust/closure-latest.md\",\"line\":16,\"text\":\"edge_vm_netbird_peer_ok=1\"},{\"path\":\"/var/lib/homelab-netbird-vps-trust/closure-latest.md\",\"line\":18,\"text\":\"public_vps_decision=REJECTED_HOSTKEY_MISMATCH\"},{\"path\":\"/var/lib/homelab-netbird-vps-trust/clean-seal-latest.md\",\"line\":10,\"text\":\"trusted_netbird_identity=edge-vm\"},{\"path\":\"/var/lib/homelab-netbird-vps-trust/clean-seal-latest.md\",\"line\":13,\"text\":\"public_vps_decision=REJECTED_HOSTKEY_MISMATCH\"},{\"path\":\"/var/lib/homelab-netbird-vps-trust/clean-seal-latest.md\",\"line\":22,\"text\":\"STATUS=OK TS=2026-07-07T15:29:49Z TYPE=netbird-vps-trust-closure BAD=0 WARN=0 MODE=TRUST_CLOSURE_NO_KNOWN_HOSTS_CHANGE TRUSTED_NETBIRD_IDENTITY=edge-vm TRUSTED_NETBIRD_IP=[PRIVATE_IP] PUBLIC_VPS_IP=188.127.235.6 PUBLIC_VPS_DECISION=REJECTED_HOSTKEY_MISMATCH PUBLIC_IP_STRICT_BLOCKED=YES PUBLIC_IP_KEYSCAN_MATCH=NO EDGE_REF_OK=1 NETBIRD_PEER_OK=1 REPORT=/var/lib/homelab-netbird-vps-trust/closure-latest.md\"},{\"path\":\"/var/lib/homelab-netbird-vps-trust/clean-seal-latest.md\",\"line\":23,\"text\":\"STATUS=OK TS=2026-07-07T15:29:49Z TYPE=external-probe-runner-decision BAD=0 WARN=0 MODE=NO_DEPLOY_DECISION INDEPENDENT_RUNNER_AVAILABLE=no DEPLOY_DECISION=NO_DEPLOY REASON=netbird_alias_is_edge_vm_and_public_vps_hostkey_mismatch TRUSTED_EDGE_IP=[PRIVATE_IP] PUBLIC_VPS_IP=188.127.235.6 PUBLIC_VPS_DECISION=REJECTED_HOSTKEY_MISMATCH REPORT=/var/lib/homelab-external-probe-vps/runner-decision-latest.md\"}]\nSAFE_NETBIRD_SSH_GATE=false\nSAFE_NETBIRD_SSH_USER=UNRESOLVED\nREMOTE_INSPECTION_RAN=false\nREMOTE_INSPECTION_RC=SKIPPED\nREMOTE_NGINX_FILTERED_LINE_COUNT=0\nDISCOVERY11_DECISION=HOLD_TRUSTED_PATH_SSH_USER_AMBIGUOUS\nDISCOVERY11_END=true\n"
+}
diff --git a/runtime/history/NEWFI-260908-A-STAGINGEDGE-NETBIRD-TRUSTEDPATH-DISCOVERY11.txt b/runtime/history/NEWFI-260908-A-STAGINGEDGE-NETBIRD-TRUSTEDPATH-DISCOVERY11.txt
new file mode 100644
index 00000000..75fc0661
--- /dev/null
+++ b/runtime/history/NEWFI-260908-A-STAGINGEDGE-NETBIRD-TRUSTEDPATH-DISCOVERY11.txt
@@ -0,0 +1,69 @@
+CHAT_OUTPUT_BEGIN
+COMMAND_ID=NEWFI-260908-A-STAGINGEDGE-NETBIRD-TRUSTEDPATH-DISCOVERY11
+STATUS=OK
+RC=0
+HOST=pve01
+MODE=read-only
+COMPONENT=newfi-stagingedge-netbird-trustedpath-discovery-readonly
+REFERENCE_REGISTER_CHECK=OK
+REFERENCE_SHA256=5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66
+ERROR_REGISTER_CHECK=OK
+ERROR_REGISTER_SHA256=3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0
+COMMAND_SHA256=0a2978e059f179306f2837a519ca9bfb6564bc3310e174392472e8847b3508d6
+DUPLICATE_FAILED_COMMAND_BLOCKED=false
+EXECUTION_STARTED=true
+CHANGE_DECLARED=false
+RESULT_CONTRACT_VALID=true
+RESULT_CONTRACT_STATUS=NOT_APPLICABLE
+RESULT_CONTRACT_ERROR=NONE
+COMMAND_RC=0
+CHANGES_MADE=false
+ROLLBACK_STARTED=false
+ROLLBACK_RESTORED=null
+MUTATION_OUTCOME=NO_MUTATION
+SANITIZED=yes
+SECRETS_INCLUDED=no
+PRIVATE_ADDRESSES_INCLUDED=no
+RAW_EVIDENCE_SHA256=df7df330d75ac609c04c83316f088906b7687eec55dfe5b2f92c1019ee065d39
+SANITIZED_OUTPUT_SHA256=fa0f4f51da57bf621027059915562fefe256db077b5ff1a1cfc50daa7a0a75e0
+OUTPUT_BEGIN
+DISCOVERY11_BEGIN=true
+COMMAND_ID=NEWFI-260908-A-STAGINGEDGE-NETBIRD-TRUSTEDPATH-DISCOVERY11
+MODE=read-only
+MUTATIONS_PERFORMED=NO
+ERROR_REGISTER_CHECK=OK
+ERROR_REGISTER_SHA256=3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0
+REFERENCE_CHECK=OK
+REFERENCE_SHA256=5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66
+RUNNER_SHA256=b248a4c32c9cc64e5747e7dce6c7fc0a23f5124a77c71ce72e27a81aceae9d2d
+TRUST_FILE_PRESENT=true
+TRUST_FILE_SHA256=092eaa2c4f3a5f623e9440135d36e6bae7d8ae46a03d380d14a5e95657812b61
+TRUSTED_NETBIRD_IDENTITY_EDGEVM=true
+PUBLIC_VPS_REJECTED_HOSTKEY_MISMATCH=true
+TRUST_SEAL_STATUS_OK_SIGNAL=true
+NETBIRD_STATUS_JSON_RC=0
+NETBIRD_STATUS_DETAIL_RC=0
+EDGEVM_OVERLAY_IP_COUNT=1
+EDGEVM_OVERLAY_IP_UNIQUE=true
+EDGEVM_KNOWN_HOST_RC=0
+EDGEVM_KNOWN_HOST_KEY_COUNT=1
+EDGEVM_KNOWN_HOST_HASHES={"ssh-ed25519":"0e70c47cbb89d3651089d1c7b16e31a69def06234236cd16ccb801fdeae7b0d1"}
+EDGEVM_KEYSCAN_RC=0
+EDGEVM_KEYSCAN_KEY_COUNT=3
+EDGEVM_KEYSCAN_HASHES={"ecdsa-sha2-nistp256":"2408a3334d153e2aca1071a5bdc7404a479db925bf6fabe31a33b1d24103243a","ssh-ed25519":"0e70c47cbb89d3651089d1c7b16e31a69def06234236cd16ccb801fdeae7b0d1","ssh-rsa":"dd7e969c71686f792e368eb8ea3218ba287c9bd8d929b526c9f9411de2f1e338"}
+EDGEVM_EXISTING_HOSTKEY_MATCH=true
+EDGEVM_EXISTING_HOSTKEY_ALGORITHMS=ssh-ed25519
+DERIVED_SSH_USER_COUNT=3
+DERIVED_SSH_USERS=debian,edgeadmin,root
+DERIVED_SSH_USER_REFS=[{"path":"/root/post-reboot-pve01-check.sh","line":32,"user":"debian","kind":"user_at_target"},{"path":"/var/lib/homelab-netbird-vps-trust/latest.md","line":64,"user":"debian","kind":"scoped_assignment","var":"REMOTE_USER"},{"path":"/var/lib/homelab-netbird-vps-trust/latest.md","line":78,"user":"debian","kind":"scoped_assignment","var":"REMOTE_USER"},{"path":"/srv/homelab-ops/docs/superpowers/specs/2026-08-17-snikket-edge-cutover-design.md","line":16,"user":"root","kind":"user_at_target"},{"path":"/srv/homelab-ops/docs/superpowers/plans/2026-08-18-gitea-edge-publisher-v3.md","line":845,"user":"edgeadmin","kind":"user_at_target"},{"path":"/srv/homelab-ops/tasks/snikket-edge-cutover-v1/tools/cutover.py","line":16,"user":"debian","kind":"user_at_target"}]
+TRUSTED_PATH_SOURCE_EVIDENCE=[{"path":"/usr/local/sbin/homelab-vps-identity-audit","line":14,"text":"ssh-keygen -F \"$VPS_IP\" -f [SENSITIVE_PATH] > \"$TMP/old-ip-known-hosts.txt\" 2>/dev/null || true"},{"path":"/usr/local/sbin/homelab-vps-identity-audit","line":15,"text":"ssh-keygen -F \"$VPS_ALIAS\" -f [SENSITIVE_PATH] > \"$TMP/old-alias-known-hosts.txt\" 2>/dev/null || true"},{"path":"/usr/local/sbin/homelab-vps-identity-audit","line":20,"text":"ssh-keyscan -T 10 -t ed25519,rsa,ecdsa \"$VPS_IP\" > \"$TMP/current-known-hosts\" 2>/dev/null || true"},{"path":"/usr/local/sbin/homelab-external-probe-vps","line":12,"text":"grep -q \"TRUSTED_NETBIRD_IDENTITY=edge-vm\" /var/lib/homelab-health/netbird-vps-trust-clean-seal.txt 2>/dev/null || BAD=$((BAD+1))"},{"path":"/usr/local/sbin/homelab-external-probe-vps","line":13,"text":"grep -q \"PUBLIC_VPS_DECISION=REJECTED_HOSTKEY_MISMATCH\" /var/lib/homelab-health/netbird-vps-trust-clean-seal.txt 2>/dev/null || BAD=$((BAD+1))"},{"path":"/usr/local/sbin/homelab-external-probe-vps","line":38,"text":"trusted_netbird_identity=edge-vm"},{"path":"/usr/local/sbin/homelab-external-probe-vps","line":41,"text":"public_vps_decision=REJECTED_HOSTKEY_MISMATCH"},{"path":"/usr/local/sbin/homelab-external-probe-vps","line":46,"text":"closed_tail=public_vps_rejected_hostkey_mismatch"},{"path":"/usr/local/sbin/homelab-external-probe-vps","line":51,"text":"echo \"STATUS=$STATUS TS=$TS TYPE=external-probe-vps BAD=$BAD WARN=$WARN MODE=STRATEGY_ONLY_NO_INDEPENDENT_RUNNER DEPLOYED=NO DEPLOY_DECISION=NO_DEPLOY VPS_TRUST=edge_vm_trusted_public_vps_rejected BACKUP_HOSTKEYS=not_used_public_vps_rejected PVE01_PUBLIC_SMOKE_BAD=$PVE01_PUBLIC_SMOKE_BAD INDEPENDENT_RUNNER=missing INDEPENDENT_RUNNER_AVAILABLE=no TRUSTED_NETBIRD_IDENTITY=edge-vm TRUSTED_NETBIRD_IP=[PRIVATE_IP] PUBLIC_"},{"path":"/var/lib/homelab-netbird-vps-trust/closure-latest.md","line":14,"text":"trusted_netbird_identity=edge-vm"},{"path":"/var/lib/homelab-netbird-vps-trust/closure-latest.md","line":16,"text":"edge_vm_netbird_peer_ok=1"},{"path":"/var/lib/homelab-netbird-vps-trust/closure-latest.md","line":18,"text":"public_vps_decision=REJECTED_HOSTKEY_MISMATCH"},{"path":"/var/lib/homelab-netbird-vps-trust/clean-seal-latest.md","line":10,"text":"trusted_netbird_identity=edge-vm"},{"path":"/var/lib/homelab-netbird-vps-trust/clean-seal-latest.md","line":13,"text":"public_vps_decision=REJECTED_HOSTKEY_MISMATCH"},{"path":"/var/lib/homelab-netbird-vps-trust/clean-seal-latest.md","line":22,"text":"STATUS=OK TS=2026-07-07T15:29:49Z TYPE=netbird-vps-trust-closure BAD=0 WARN=0 MODE=TRUST_CLOSURE_NO_KNOWN_HOSTS_CHANGE TRUSTED_NETBIRD_IDENTITY=edge-vm TRUSTED_NETBIRD_IP=[PRIVATE_IP] PUBLIC_VPS_IP=188.127.235.6 PUBLIC_VPS_DECISION=REJECTED_HOSTKEY_MISMATCH PUBLIC_IP_STRICT_BLOCKED=YES PUBLIC_IP_KEYSCAN_MATCH=NO EDGE_REF_OK=1 NETBIRD_PEER_OK=1 REPORT=/var/lib/homelab-netbird-vps-trust/closure-latest.md"},{"path":"/var/lib/homelab-netbird-vps-trust/clean-seal-latest.md","line":23,"text":"STATUS=OK TS=2026-07-07T15:29:49Z TYPE=external-probe-runner-decision BAD=0 WARN=0 MODE=NO_DEPLOY_DECISION INDEPENDENT_RUNNER_AVAILABLE=no DEPLOY_DECISION=NO_DEPLOY REASON=netbird_alias_is_edge_vm_and_public_vps_hostkey_mismatch TRUSTED_EDGE_IP=[PRIVATE_IP] PUBLIC_VPS_IP=188.127.235.6 PUBLIC_VPS_DECISION=REJECTED_HOSTKEY_MISMATCH REPORT=/var/lib/homelab-external-probe-vps/runner-decision-latest.md"}]
+SAFE_NETBIRD_SSH_GATE=false
+SAFE_NETBIRD_SSH_USER=UNRESOLVED
+REMOTE_INSPECTION_RAN=false
+REMOTE_INSPECTION_RC=SKIPPED
+REMOTE_NGINX_FILTERED_LINE_COUNT=0
+DISCOVERY11_DECISION=HOLD_TRUSTED_PATH_SSH_USER_AMBIGUOUS
+DISCOVERY11_END=true
+
+OUTPUT_END
+CHAT_OUTPUT_END
diff --git a/runtime/latest.json b/runtime/latest.json
index 5c8bbe3a..40476614 100644
--- a/runtime/latest.json
+++ b/runtime/latest.json
@@ -1,19 +1,19 @@
 {
   "schema_version": 1,
   "channel": "homelab-runtime",
-  "command_id": "NEWFI-260908-A-STAGINGEDGE-VPS-ACCESSPATH-DISCOVERY10",
+  "command_id": "NEWFI-260908-A-STAGINGEDGE-NETBIRD-TRUSTEDPATH-DISCOVERY11",
   "status": "OK",
   "rc": 0,
   "host": "pve01",
   "mode": "read-only",
-  "component": "newfi-stagingedge-vps-accesspath-discovery-readonly",
-  "started_at_utc": "2026-09-08T12:37:36Z",
-  "finished_at_utc": "2026-09-08T12:37:37Z",
+  "component": "newfi-stagingedge-netbird-trustedpath-discovery-readonly",
+  "started_at_utc": "2026-09-08T12:41:35Z",
+  "finished_at_utc": "2026-09-08T12:41:35Z",
   "reference_register_checked": true,
   "reference_sha256": "5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66",
   "error_register_checked": true,
   "error_register_sha256": "3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0",
-  "command_sha256": "5309a444e53ed4c78eed6a3306a25ff9563bfd9c11e9df3cf6008b63552216b3",
+  "command_sha256": "0a2978e059f179306f2837a519ca9bfb6564bc3310e174392472e8847b3508d6",
   "duplicate_failed_command_blocked": false,
   "block_reason": null,
   "execution_started": true,
@@ -30,9 +30,9 @@
   "secrets_included": false,
   "private_addresses_included": false,
   "raw_evidence_retained_locally": true,
-  "raw_evidence_sha256": "dc18579fe0405cd572abe1b4cd0f6a1548c65529697d0332db889836e8d35140",
-  "sanitized_output_sha256": "dc18579fe0405cd572abe1b4cd0f6a1548c65529697d0332db889836e8d35140",
+  "raw_evidence_sha256": "df7df330d75ac609c04c83316f088906b7687eec55dfe5b2f92c1019ee065d39",
+  "sanitized_output_sha256": "fa0f4f51da57bf621027059915562fefe256db077b5ff1a1cfc50daa7a0a75e0",
   "output_truncated_in_json": false,
   "full_sanitized_output_url": "https://git.gram1.ru/.well-known/homelab-runtime/latest.txt",
-  "output": "DISCOVERY10_BEGIN=true\nCOMMAND_ID=NEWFI-260908-A-STAGINGEDGE-VPS-ACCESSPATH-DISCOVERY10\nMODE=read-only\nMUTATIONS_PERFORMED=NO\nERROR_REGISTER_CHECK=OK\nERROR_REGISTER_SHA256=3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0\nREFERENCE_CHECK=OK\nREFERENCE_SHA256=5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66\nRUNNER_SHA256=b248a4c32c9cc64e5747e7dce6c7fc0a23f5124a77c71ce72e27a81aceae9d2d\nPUBLIC_KEYSCAN_RC=0\nPUBLIC_KEYSCAN_KEY_COUNT=3\nPUBLIC_KEYSCAN_KEY_HASHES={\"ecdsa-sha2-nistp256\":\"7aeeeaf6fb7414ec7031405eaa85162f890f550b628ff3bfc26c759586b2604d\",\"ssh-ed25519\":\"476dae5d1f1c18a4296021f038a26ca9c5999f66fcd3bd517e9c08173890a93f\",\"ssh-rsa\":\"ae83af33f09b6994a50a607056769a9946616a4c7bec6cf503d18dc00f9839b1\"}\nPUBLIC_KNOWN_HOST_RC=1\nPUBLIC_KNOWN_HOST_KEY_COUNT=0\nPUBLIC_KNOWN_HOST_ROWS=[]\nPUBLIC_EXACT_KNOWN_HOST_MATCH=false\nPUBLIC_EXACT_KNOWN_HOST_ALGORITHMS=NONE\nPUBLIC_KEY_MATCHES_ANY_KNOWN_HOST_COUNT=0\nPUBLIC_KEY_MATCHES_ANY_KNOWN_HOST_META=[]\nSSH_CONFIG_RELEVANT_BLOCK_COUNT=0\nSSH_CONFIG_RELEVANT_BLOCKS=[]\nOPERATIONAL_SSH_USER_COUNT=0\nOPERATIONAL_SSH_USERS=NONE\nOPERATIONAL_SSH_USER_REFS=[]\nVPS_TRUST_SCHEMA_REFS=[{\"path\":\"/usr/local/sbin/homelab-external-probe-vps\",\"line\":12,\"text\":\"grep -q \\\"TRUSTED_NETBIRD_IDENTITY=edge-vm\\\" /var/lib/homelab-health/netbird-vps-trust-clean-seal.txt 2>/dev/null || BAD=$((BAD+1))\"},{\"path\":\"/usr/local/sbin/homelab-external-probe-vps\",\"line\":13,\"text\":\"grep -q \\\"PUBLIC_VPS_DECISION=REJECTED_HOSTKEY_MISMATCH\\\" /var/lib/homelab-health/netbird-vps-trust-clean-seal.txt 2>/dev/null || BAD=$((BAD+1))\"},{\"path\":\"/usr/local/sbin/homelab-external-probe-vps\",\"line\":41,\"text\":\"public_vps_decision=REJECTED_HOSTKEY_MISMATCH\"},{\"path\":\"/usr/local/sbin/homelab-external-probe-vps\",\"line\":51,\"text\":\"echo \\\"STATUS=$STATUS TS=$TS TYPE=external-probe-vps BAD=$BAD WARN=$WARN MODE=STRATEGY_ONLY_NO_INDEPENDENT_RUNNER DEPLOYED=NO DEPLOY_DECISION=NO_DEPLOY VPS_TRUST=edge_vm_trusted_public_vps_rejected BACKUP_HOSTKEYS=not_used_public_vps_rejected PVE01_PUBLIC_SMOKE_BAD=$PVE01_PUBLIC_SMOKE_BAD INDEPENDENT_RUNNER=missing INDEPENDENT_RUNNER_AVAILABLE=no TRUSTED_NETBIRD_IDENTITY=edge-vm TRUSTED_NETBIRD_IP=[PRIVATE_IP] PUBLIC_VPS_IP=188.127.235.6 PUBLIC_VPS_DECISION=REJECTED_HOSTKEY_MISMATCH REPORT=$REPOR\"}]\nTRUST_FILE_MARKER_COUNT=2\nTRUST_FILE_MARKERS=[{\"file\":\"/var/lib/homelab-health/netbird-vps-trust-clean-seal.txt\",\"line\":1,\"text\":\"STATUS=OK TS=2026-07-07T15:55:43Z TYPE=netbird-vps-trust-clean-seal BAD=0 WARN=0 MODE=CLEAN_SEAL_NO_AWK_TAIL TRUSTED_NETBIRD_IDENTITY=edge-vm TRUSTED_NETBIRD_IP=[PRIVATE_IP] PUBLIC_VPS_IP=188.127.235.6 PUBLIC_VPS_DECISION=REJECTED_HOSTKEY_MISMATCH INDEPENDENT_RUNNER_AVAILABLE=no DEPLOY_DECISION=NO_DEPLOY KNOWN_HOSTS_CHANGED=no PRIVATE_KEYS_READ=no PROBE_DEPLOYED=no REPORT=/var/lib/homelab-netbird-vps-trust/clean-seal-latest.md\"},{\"file\":\"/var/lib/homelab-health/netbird-vps-trust-closure.txt\",\"line\":1,\"text\":\"STATUS=OK TS=2026-07-07T15:29:49Z TYPE=netbird-vps-trust-closure BAD=0 WARN=0 MODE=TRUST_CLOSURE_NO_KNOWN_HOSTS_CHANGE TRUSTED_NETBIRD_IDENTITY=edge-vm TRUSTED_NETBIRD_IP=[PRIVATE_IP] PUBLIC_VPS_IP=188.127.235.6 PUBLIC_VPS_DECISION=REJECTED_HOSTKEY_MISMATCH PUBLIC_IP_STRICT_BLOCKED=YES PUBLIC_IP_KEYSCAN_MATCH=NO EDGE_REF_OK=1 NETBIRD_PEER_OK=1 REPORT=/var/lib/homelab-netbird-vps-trust/closure-latest.md\"}]\nTRUST_EDGEVM_TEXT_SIGNAL=true\nHISTORICAL_PUBLIC_HOSTKEY_MISMATCH_SIGNAL=true\nSAFE_EXISTING_SSH_TARGET_FOUND=false\nSAFE_EXISTING_SSH_USER=UNRESOLVED\nSAFE_EXISTING_SSH_REASON=NONE\nREMOTE_INSPECTION_RAN=false\nREMOTE_INSPECTION_RC=SKIPPED\nREMOTE_NGINX_FILTERED_LINE_COUNT=0\nDISCOVERY10_DECISION=HOLD_PUBLIC_VPS_ACCESS_PATH_NOT_YET_TRUSTED_HISTORICAL_HOSTKEY_MISMATCH\nDISCOVERY10_END=true\n"
+  "output": "DISCOVERY11_BEGIN=true\nCOMMAND_ID=NEWFI-260908-A-STAGINGEDGE-NETBIRD-TRUSTEDPATH-DISCOVERY11\nMODE=read-only\nMUTATIONS_PERFORMED=NO\nERROR_REGISTER_CHECK=OK\nERROR_REGISTER_SHA256=3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0\nREFERENCE_CHECK=OK\nREFERENCE_SHA256=5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66\nRUNNER_SHA256=b248a4c32c9cc64e5747e7dce6c7fc0a23f5124a77c71ce72e27a81aceae9d2d\nTRUST_FILE_PRESENT=true\nTRUST_FILE_SHA256=092eaa2c4f3a5f623e9440135d36e6bae7d8ae46a03d380d14a5e95657812b61\nTRUSTED_NETBIRD_IDENTITY_EDGEVM=true\nPUBLIC_VPS_REJECTED_HOSTKEY_MISMATCH=true\nTRUST_SEAL_STATUS_OK_SIGNAL=true\nNETBIRD_STATUS_JSON_RC=0\nNETBIRD_STATUS_DETAIL_RC=0\nEDGEVM_OVERLAY_IP_COUNT=1\nEDGEVM_OVERLAY_IP_UNIQUE=true\nEDGEVM_KNOWN_HOST_RC=0\nEDGEVM_KNOWN_HOST_KEY_COUNT=1\nEDGEVM_KNOWN_HOST_HASHES={\"ssh-ed25519\":\"0e70c47cbb89d3651089d1c7b16e31a69def06234236cd16ccb801fdeae7b0d1\"}\nEDGEVM_KEYSCAN_RC=0\nEDGEVM_KEYSCAN_KEY_COUNT=3\nEDGEVM_KEYSCAN_HASHES={\"ecdsa-sha2-nistp256\":\"2408a3334d153e2aca1071a5bdc7404a479db925bf6fabe31a33b1d24103243a\",\"ssh-ed25519\":\"0e70c47cbb89d3651089d1c7b16e31a69def06234236cd16ccb801fdeae7b0d1\",\"ssh-rsa\":\"dd7e969c71686f792e368eb8ea3218ba287c9bd8d929b526c9f9411de2f1e338\"}\nEDGEVM_EXISTING_HOSTKEY_MATCH=true\nEDGEVM_EXISTING_HOSTKEY_ALGORITHMS=ssh-ed25519\nDERIVED_SSH_USER_COUNT=3\nDERIVED_SSH_USERS=debian,edgeadmin,root\nDERIVED_SSH_USER_REFS=[{\"path\":\"/root/post-reboot-pve01-check.sh\",\"line\":32,\"user\":\"debian\",\"kind\":\"user_at_target\"},{\"path\":\"/var/lib/homelab-netbird-vps-trust/latest.md\",\"line\":64,\"user\":\"debian\",\"kind\":\"scoped_assignment\",\"var\":\"REMOTE_USER\"},{\"path\":\"/var/lib/homelab-netbird-vps-trust/latest.md\",\"line\":78,\"user\":\"debian\",\"kind\":\"scoped_assignment\",\"var\":\"REMOTE_USER\"},{\"path\":\"/srv/homelab-ops/docs/superpowers/specs/2026-08-17-snikket-edge-cutover-design.md\",\"line\":16,\"user\":\"root\",\"kind\":\"user_at_target\"},{\"path\":\"/srv/homelab-ops/docs/superpowers/plans/2026-08-18-gitea-edge-publisher-v3.md\",\"line\":845,\"user\":\"edgeadmin\",\"kind\":\"user_at_target\"},{\"path\":\"/srv/homelab-ops/tasks/snikket-edge-cutover-v1/tools/cutover.py\",\"line\":16,\"user\":\"debian\",\"kind\":\"user_at_target\"}]\nTRUSTED_PATH_SOURCE_EVIDENCE=[{\"path\":\"/usr/local/sbin/homelab-vps-identity-audit\",\"line\":14,\"text\":\"ssh-keygen -F \\\"$VPS_IP\\\" -f [SENSITIVE_PATH] > \\\"$TMP/old-ip-known-hosts.txt\\\" 2>/dev/null || true\"},{\"path\":\"/usr/local/sbin/homelab-vps-identity-audit\",\"line\":15,\"text\":\"ssh-keygen -F \\\"$VPS_ALIAS\\\" -f [SENSITIVE_PATH] > \\\"$TMP/old-alias-known-hosts.txt\\\" 2>/dev/null || true\"},{\"path\":\"/usr/local/sbin/homelab-vps-identity-audit\",\"line\":20,\"text\":\"ssh-keyscan -T 10 -t ed25519,rsa,ecdsa \\\"$VPS_IP\\\" > \\\"$TMP/current-known-hosts\\\" 2>/dev/null || true\"},{\"path\":\"/usr/local/sbin/homelab-external-probe-vps\",\"line\":12,\"text\":\"grep -q \\\"TRUSTED_NETBIRD_IDENTITY=edge-vm\\\" /var/lib/homelab-health/netbird-vps-trust-clean-seal.txt 2>/dev/null || BAD=$((BAD+1))\"},{\"path\":\"/usr/local/sbin/homelab-external-probe-vps\",\"line\":13,\"text\":\"grep -q \\\"PUBLIC_VPS_DECISION=REJECTED_HOSTKEY_MISMATCH\\\" /var/lib/homelab-health/netbird-vps-trust-clean-seal.txt 2>/dev/null || BAD=$((BAD+1))\"},{\"path\":\"/usr/local/sbin/homelab-external-probe-vps\",\"line\":38,\"text\":\"trusted_netbird_identity=edge-vm\"},{\"path\":\"/usr/local/sbin/homelab-external-probe-vps\",\"line\":41,\"text\":\"public_vps_decision=REJECTED_HOSTKEY_MISMATCH\"},{\"path\":\"/usr/local/sbin/homelab-external-probe-vps\",\"line\":46,\"text\":\"closed_tail=public_vps_rejected_hostkey_mismatch\"},{\"path\":\"/usr/local/sbin/homelab-external-probe-vps\",\"line\":51,\"text\":\"echo \\\"STATUS=$STATUS TS=$TS TYPE=external-probe-vps BAD=$BAD WARN=$WARN MODE=STRATEGY_ONLY_NO_INDEPENDENT_RUNNER DEPLOYED=NO DEPLOY_DECISION=NO_DEPLOY VPS_TRUST=edge_vm_trusted_public_vps_rejected BACKUP_HOSTKEYS=not_used_public_vps_rejected PVE01_PUBLIC_SMOKE_BAD=$PVE01_PUBLIC_SMOKE_BAD INDEPENDENT_RUNNER=missing INDEPENDENT_RUNNER_AVAILABLE=no TRUSTED_NETBIRD_IDENTITY=edge-vm TRUSTED_NETBIRD_IP=[PRIVATE_IP] PUBLIC_\"},{\"path\":\"/var/lib/homelab-netbird-vps-trust/closure-latest.md\",\"line\":14,\"text\":\"trusted_netbird_identity=edge-vm\"},{\"path\":\"/var/lib/homelab-netbird-vps-trust/closure-latest.md\",\"line\":16,\"text\":\"edge_vm_netbird_peer_ok=1\"},{\"path\":\"/var/lib/homelab-netbird-vps-trust/closure-latest.md\",\"line\":18,\"text\":\"public_vps_decision=REJECTED_HOSTKEY_MISMATCH\"},{\"path\":\"/var/lib/homelab-netbird-vps-trust/clean-seal-latest.md\",\"line\":10,\"text\":\"trusted_netbird_identity=edge-vm\"},{\"path\":\"/var/lib/homelab-netbird-vps-trust/clean-seal-latest.md\",\"line\":13,\"text\":\"public_vps_decision=REJECTED_HOSTKEY_MISMATCH\"},{\"path\":\"/var/lib/homelab-netbird-vps-trust/clean-seal-latest.md\",\"line\":22,\"text\":\"STATUS=OK TS=2026-07-07T15:29:49Z TYPE=netbird-vps-trust-closure BAD=0 WARN=0 MODE=TRUST_CLOSURE_NO_KNOWN_HOSTS_CHANGE TRUSTED_NETBIRD_IDENTITY=edge-vm TRUSTED_NETBIRD_IP=[PRIVATE_IP] PUBLIC_VPS_IP=188.127.235.6 PUBLIC_VPS_DECISION=REJECTED_HOSTKEY_MISMATCH PUBLIC_IP_STRICT_BLOCKED=YES PUBLIC_IP_KEYSCAN_MATCH=NO EDGE_REF_OK=1 NETBIRD_PEER_OK=1 REPORT=/var/lib/homelab-netbird-vps-trust/closure-latest.md\"},{\"path\":\"/var/lib/homelab-netbird-vps-trust/clean-seal-latest.md\",\"line\":23,\"text\":\"STATUS=OK TS=2026-07-07T15:29:49Z TYPE=external-probe-runner-decision BAD=0 WARN=0 MODE=NO_DEPLOY_DECISION INDEPENDENT_RUNNER_AVAILABLE=no DEPLOY_DECISION=NO_DEPLOY REASON=netbird_alias_is_edge_vm_and_public_vps_hostkey_mismatch TRUSTED_EDGE_IP=[PRIVATE_IP] PUBLIC_VPS_IP=188.127.235.6 PUBLIC_VPS_DECISION=REJECTED_HOSTKEY_MISMATCH REPORT=/var/lib/homelab-external-probe-vps/runner-decision-latest.md\"}]\nSAFE_NETBIRD_SSH_GATE=false\nSAFE_NETBIRD_SSH_USER=UNRESOLVED\nREMOTE_INSPECTION_RAN=false\nREMOTE_INSPECTION_RC=SKIPPED\nREMOTE_NGINX_FILTERED_LINE_COUNT=0\nDISCOVERY11_DECISION=HOLD_TRUSTED_PATH_SSH_USER_AMBIGUOUS\nDISCOVERY11_END=true\n"
 }
diff --git a/runtime/latest.txt b/runtime/latest.txt
index 7a752d00..75fc0661 100644
--- a/runtime/latest.txt
+++ b/runtime/latest.txt
@@ -1,15 +1,15 @@
 CHAT_OUTPUT_BEGIN
-COMMAND_ID=NEWFI-260908-A-STAGINGEDGE-VPS-ACCESSPATH-DISCOVERY10
+COMMAND_ID=NEWFI-260908-A-STAGINGEDGE-NETBIRD-TRUSTEDPATH-DISCOVERY11
 STATUS=OK
 RC=0
 HOST=pve01
 MODE=read-only
-COMPONENT=newfi-stagingedge-vps-accesspath-discovery-readonly
+COMPONENT=newfi-stagingedge-netbird-trustedpath-discovery-readonly
 REFERENCE_REGISTER_CHECK=OK
 REFERENCE_SHA256=5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66
 ERROR_REGISTER_CHECK=OK
 ERROR_REGISTER_SHA256=3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0
-COMMAND_SHA256=5309a444e53ed4c78eed6a3306a25ff9563bfd9c11e9df3cf6008b63552216b3
+COMMAND_SHA256=0a2978e059f179306f2837a519ca9bfb6564bc3310e174392472e8847b3508d6
 DUPLICATE_FAILED_COMMAND_BLOCKED=false
 EXECUTION_STARTED=true
 CHANGE_DECLARED=false
@@ -24,11 +24,11 @@ MUTATION_OUTCOME=NO_MUTATION
 SANITIZED=yes
 SECRETS_INCLUDED=no
 PRIVATE_ADDRESSES_INCLUDED=no
-RAW_EVIDENCE_SHA256=dc18579fe0405cd572abe1b4cd0f6a1548c65529697d0332db889836e8d35140
-SANITIZED_OUTPUT_SHA256=dc18579fe0405cd572abe1b4cd0f6a1548c65529697d0332db889836e8d35140
+RAW_EVIDENCE_SHA256=df7df330d75ac609c04c83316f088906b7687eec55dfe5b2f92c1019ee065d39
+SANITIZED_OUTPUT_SHA256=fa0f4f51da57bf621027059915562fefe256db077b5ff1a1cfc50daa7a0a75e0
 OUTPUT_BEGIN
-DISCOVERY10_BEGIN=true
-COMMAND_ID=NEWFI-260908-A-STAGINGEDGE-VPS-ACCESSPATH-DISCOVERY10
+DISCOVERY11_BEGIN=true
+COMMAND_ID=NEWFI-260908-A-STAGINGEDGE-NETBIRD-TRUSTEDPATH-DISCOVERY11
 MODE=read-only
 MUTATIONS_PERFORMED=NO
 ERROR_REGISTER_CHECK=OK
@@ -36,34 +36,34 @@ ERROR_REGISTER_SHA256=3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4
 REFERENCE_CHECK=OK
 REFERENCE_SHA256=5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66
 RUNNER_SHA256=b248a4c32c9cc64e5747e7dce6c7fc0a23f5124a77c71ce72e27a81aceae9d2d
-PUBLIC_KEYSCAN_RC=0
-PUBLIC_KEYSCAN_KEY_COUNT=3
-PUBLIC_KEYSCAN_KEY_HASHES={"ecdsa-sha2-nistp256":"7aeeeaf6fb7414ec7031405eaa85162f890f550b628ff3bfc26c759586b2604d","ssh-ed25519":"476dae5d1f1c18a4296021f038a26ca9c5999f66fcd3bd517e9c08173890a93f","ssh-rsa":"ae83af33f09b6994a50a607056769a9946616a4c7bec6cf503d18dc00f9839b1"}
-PUBLIC_KNOWN_HOST_RC=1
-PUBLIC_KNOWN_HOST_KEY_COUNT=0
-PUBLIC_KNOWN_HOST_ROWS=[]
-PUBLIC_EXACT_KNOWN_HOST_MATCH=false
-PUBLIC_EXACT_KNOWN_HOST_ALGORITHMS=NONE
-PUBLIC_KEY_MATCHES_ANY_KNOWN_HOST_COUNT=0
-PUBLIC_KEY_MATCHES_ANY_KNOWN_HOST_META=[]
-SSH_CONFIG_RELEVANT_BLOCK_COUNT=0
-SSH_CONFIG_RELEVANT_BLOCKS=[]
-OPERATIONAL_SSH_USER_COUNT=0
-OPERATIONAL_SSH_USERS=NONE
-OPERATIONAL_SSH_USER_REFS=[]
-VPS_TRUST_SCHEMA_REFS=[{"path":"/usr/local/sbin/homelab-external-probe-vps","line":12,"text":"grep -q \"TRUSTED_NETBIRD_IDENTITY=edge-vm\" /var/lib/homelab-health/netbird-vps-trust-clean-seal.txt 2>/dev/null || BAD=$((BAD+1))"},{"path":"/usr/local/sbin/homelab-external-probe-vps","line":13,"text":"grep -q \"PUBLIC_VPS_DECISION=REJECTED_HOSTKEY_MISMATCH\" /var/lib/homelab-health/netbird-vps-trust-clean-seal.txt 2>/dev/null || BAD=$((BAD+1))"},{"path":"/usr/local/sbin/homelab-external-probe-vps","line":41,"text":"public_vps_decision=REJECTED_HOSTKEY_MISMATCH"},{"path":"/usr/local/sbin/homelab-external-probe-vps","line":51,"text":"echo \"STATUS=$STATUS TS=$TS TYPE=external-probe-vps BAD=$BAD WARN=$WARN MODE=STRATEGY_ONLY_NO_INDEPENDENT_RUNNER DEPLOYED=NO DEPLOY_DECISION=NO_DEPLOY VPS_TRUST=edge_vm_trusted_public_vps_rejected BACKUP_HOSTKEYS=not_used_public_vps_rejected PVE01_PUBLIC_SMOKE_BAD=$PVE01_PUBLIC_SMOKE_BAD INDEPENDENT_RUNNER=missing INDEPENDENT_RUNNER_AVAILABLE=no TRUSTED_NETBIRD_IDENTITY=edge-vm TRUSTED_NETBIRD_IP=[PRIVATE_IP] PUBLIC_VPS_IP=188.127.235.6 PUBLIC_VPS_DECISION=REJECTED_HOSTKEY_MISMATCH REPORT=$REPOR"}]
-TRUST_FILE_MARKER_COUNT=2
-TRUST_FILE_MARKERS=[{"file":"/var/lib/homelab-health/netbird-vps-trust-clean-seal.txt","line":1,"text":"STATUS=OK TS=2026-07-07T15:55:43Z TYPE=netbird-vps-trust-clean-seal BAD=0 WARN=0 MODE=CLEAN_SEAL_NO_AWK_TAIL TRUSTED_NETBIRD_IDENTITY=edge-vm TRUSTED_NETBIRD_IP=[PRIVATE_IP] PUBLIC_VPS_IP=188.127.235.6 PUBLIC_VPS_DECISION=REJECTED_HOSTKEY_MISMATCH INDEPENDENT_RUNNER_AVAILABLE=no DEPLOY_DECISION=NO_DEPLOY KNOWN_HOSTS_CHANGED=no PRIVATE_KEYS_READ=no PROBE_DEPLOYED=no REPORT=/var/lib/homelab-netbird-vps-trust/clean-seal-latest.md"},{"file":"/var/lib/homelab-health/netbird-vps-trust-closure.txt","line":1,"text":"STATUS=OK TS=2026-07-07T15:29:49Z TYPE=netbird-vps-trust-closure BAD=0 WARN=0 MODE=TRUST_CLOSURE_NO_KNOWN_HOSTS_CHANGE TRUSTED_NETBIRD_IDENTITY=edge-vm TRUSTED_NETBIRD_IP=[PRIVATE_IP] PUBLIC_VPS_IP=188.127.235.6 PUBLIC_VPS_DECISION=REJECTED_HOSTKEY_MISMATCH PUBLIC_IP_STRICT_BLOCKED=YES PUBLIC_IP_KEYSCAN_MATCH=NO EDGE_REF_OK=1 NETBIRD_PEER_OK=1 REPORT=/var/lib/homelab-netbird-vps-trust/closure-latest.md"}]
-TRUST_EDGEVM_TEXT_SIGNAL=true
-HISTORICAL_PUBLIC_HOSTKEY_MISMATCH_SIGNAL=true
-SAFE_EXISTING_SSH_TARGET_FOUND=false
-SAFE_EXISTING_SSH_USER=UNRESOLVED
-SAFE_EXISTING_SSH_REASON=NONE
+TRUST_FILE_PRESENT=true
+TRUST_FILE_SHA256=092eaa2c4f3a5f623e9440135d36e6bae7d8ae46a03d380d14a5e95657812b61
+TRUSTED_NETBIRD_IDENTITY_EDGEVM=true
+PUBLIC_VPS_REJECTED_HOSTKEY_MISMATCH=true
+TRUST_SEAL_STATUS_OK_SIGNAL=true
+NETBIRD_STATUS_JSON_RC=0
+NETBIRD_STATUS_DETAIL_RC=0
+EDGEVM_OVERLAY_IP_COUNT=1
+EDGEVM_OVERLAY_IP_UNIQUE=true
+EDGEVM_KNOWN_HOST_RC=0
+EDGEVM_KNOWN_HOST_KEY_COUNT=1
+EDGEVM_KNOWN_HOST_HASHES={"ssh-ed25519":"0e70c47cbb89d3651089d1c7b16e31a69def06234236cd16ccb801fdeae7b0d1"}
+EDGEVM_KEYSCAN_RC=0
+EDGEVM_KEYSCAN_KEY_COUNT=3
+EDGEVM_KEYSCAN_HASHES={"ecdsa-sha2-nistp256":"2408a3334d153e2aca1071a5bdc7404a479db925bf6fabe31a33b1d24103243a","ssh-ed25519":"0e70c47cbb89d3651089d1c7b16e31a69def06234236cd16ccb801fdeae7b0d1","ssh-rsa":"dd7e969c71686f792e368eb8ea3218ba287c9bd8d929b526c9f9411de2f1e338"}
+EDGEVM_EXISTING_HOSTKEY_MATCH=true
+EDGEVM_EXISTING_HOSTKEY_ALGORITHMS=ssh-ed25519
+DERIVED_SSH_USER_COUNT=3
+DERIVED_SSH_USERS=debian,edgeadmin,root
+DERIVED_SSH_USER_REFS=[{"path":"/root/post-reboot-pve01-check.sh","line":32,"user":"debian","kind":"user_at_target"},{"path":"/var/lib/homelab-netbird-vps-trust/latest.md","line":64,"user":"debian","kind":"scoped_assignment","var":"REMOTE_USER"},{"path":"/var/lib/homelab-netbird-vps-trust/latest.md","line":78,"user":"debian","kind":"scoped_assignment","var":"REMOTE_USER"},{"path":"/srv/homelab-ops/docs/superpowers/specs/2026-08-17-snikket-edge-cutover-design.md","line":16,"user":"root","kind":"user_at_target"},{"path":"/srv/homelab-ops/docs/superpowers/plans/2026-08-18-gitea-edge-publisher-v3.md","line":845,"user":"edgeadmin","kind":"user_at_target"},{"path":"/srv/homelab-ops/tasks/snikket-edge-cutover-v1/tools/cutover.py","line":16,"user":"debian","kind":"user_at_target"}]
+TRUSTED_PATH_SOURCE_EVIDENCE=[{"path":"/usr/local/sbin/homelab-vps-identity-audit","line":14,"text":"ssh-keygen -F \"$VPS_IP\" -f [SENSITIVE_PATH] > \"$TMP/old-ip-known-hosts.txt\" 2>/dev/null || true"},{"path":"/usr/local/sbin/homelab-vps-identity-audit","line":15,"text":"ssh-keygen -F \"$VPS_ALIAS\" -f [SENSITIVE_PATH] > \"$TMP/old-alias-known-hosts.txt\" 2>/dev/null || true"},{"path":"/usr/local/sbin/homelab-vps-identity-audit","line":20,"text":"ssh-keyscan -T 10 -t ed25519,rsa,ecdsa \"$VPS_IP\" > \"$TMP/current-known-hosts\" 2>/dev/null || true"},{"path":"/usr/local/sbin/homelab-external-probe-vps","line":12,"text":"grep -q \"TRUSTED_NETBIRD_IDENTITY=edge-vm\" /var/lib/homelab-health/netbird-vps-trust-clean-seal.txt 2>/dev/null || BAD=$((BAD+1))"},{"path":"/usr/local/sbin/homelab-external-probe-vps","line":13,"text":"grep -q \"PUBLIC_VPS_DECISION=REJECTED_HOSTKEY_MISMATCH\" /var/lib/homelab-health/netbird-vps-trust-clean-seal.txt 2>/dev/null || BAD=$((BAD+1))"},{"path":"/usr/local/sbin/homelab-external-probe-vps","line":38,"text":"trusted_netbird_identity=edge-vm"},{"path":"/usr/local/sbin/homelab-external-probe-vps","line":41,"text":"public_vps_decision=REJECTED_HOSTKEY_MISMATCH"},{"path":"/usr/local/sbin/homelab-external-probe-vps","line":46,"text":"closed_tail=public_vps_rejected_hostkey_mismatch"},{"path":"/usr/local/sbin/homelab-external-probe-vps","line":51,"text":"echo \"STATUS=$STATUS TS=$TS TYPE=external-probe-vps BAD=$BAD WARN=$WARN MODE=STRATEGY_ONLY_NO_INDEPENDENT_RUNNER DEPLOYED=NO DEPLOY_DECISION=NO_DEPLOY VPS_TRUST=edge_vm_trusted_public_vps_rejected BACKUP_HOSTKEYS=not_used_public_vps_rejected PVE01_PUBLIC_SMOKE_BAD=$PVE01_PUBLIC_SMOKE_BAD INDEPENDENT_RUNNER=missing INDEPENDENT_RUNNER_AVAILABLE=no TRUSTED_NETBIRD_IDENTITY=edge-vm TRUSTED_NETBIRD_IP=[PRIVATE_IP] PUBLIC_"},{"path":"/var/lib/homelab-netbird-vps-trust/closure-latest.md","line":14,"text":"trusted_netbird_identity=edge-vm"},{"path":"/var/lib/homelab-netbird-vps-trust/closure-latest.md","line":16,"text":"edge_vm_netbird_peer_ok=1"},{"path":"/var/lib/homelab-netbird-vps-trust/closure-latest.md","line":18,"text":"public_vps_decision=REJECTED_HOSTKEY_MISMATCH"},{"path":"/var/lib/homelab-netbird-vps-trust/clean-seal-latest.md","line":10,"text":"trusted_netbird_identity=edge-vm"},{"path":"/var/lib/homelab-netbird-vps-trust/clean-seal-latest.md","line":13,"text":"public_vps_decision=REJECTED_HOSTKEY_MISMATCH"},{"path":"/var/lib/homelab-netbird-vps-trust/clean-seal-latest.md","line":22,"text":"STATUS=OK TS=2026-07-07T15:29:49Z TYPE=netbird-vps-trust-closure BAD=0 WARN=0 MODE=TRUST_CLOSURE_NO_KNOWN_HOSTS_CHANGE TRUSTED_NETBIRD_IDENTITY=edge-vm TRUSTED_NETBIRD_IP=[PRIVATE_IP] PUBLIC_VPS_IP=188.127.235.6 PUBLIC_VPS_DECISION=REJECTED_HOSTKEY_MISMATCH PUBLIC_IP_STRICT_BLOCKED=YES PUBLIC_IP_KEYSCAN_MATCH=NO EDGE_REF_OK=1 NETBIRD_PEER_OK=1 REPORT=/var/lib/homelab-netbird-vps-trust/closure-latest.md"},{"path":"/var/lib/homelab-netbird-vps-trust/clean-seal-latest.md","line":23,"text":"STATUS=OK TS=2026-07-07T15:29:49Z TYPE=external-probe-runner-decision BAD=0 WARN=0 MODE=NO_DEPLOY_DECISION INDEPENDENT_RUNNER_AVAILABLE=no DEPLOY_DECISION=NO_DEPLOY REASON=netbird_alias_is_edge_vm_and_public_vps_hostkey_mismatch TRUSTED_EDGE_IP=[PRIVATE_IP] PUBLIC_VPS_IP=188.127.235.6 PUBLIC_VPS_DECISION=REJECTED_HOSTKEY_MISMATCH REPORT=/var/lib/homelab-external-probe-vps/runner-decision-latest.md"}]
+SAFE_NETBIRD_SSH_GATE=false
+SAFE_NETBIRD_SSH_USER=UNRESOLVED
 REMOTE_INSPECTION_RAN=false
 REMOTE_INSPECTION_RC=SKIPPED
 REMOTE_NGINX_FILTERED_LINE_COUNT=0
-DISCOVERY10_DECISION=HOLD_PUBLIC_VPS_ACCESS_PATH_NOT_YET_TRUSTED_HISTORICAL_HOSTKEY_MISMATCH
-DISCOVERY10_END=true
+DISCOVERY11_DECISION=HOLD_TRUSTED_PATH_SSH_USER_AMBIGUOUS
+DISCOVERY11_END=true
 
 OUTPUT_END
 CHAT_OUTPUT_END