diff --git a/runtime/history/GITEA-V4-DRY-RUN-TIMEOUT-SOURCE-PROBE-20260730T194343Z.json b/runtime/history/GITEA-V4-DRY-RUN-TIMEOUT-SOURCE-PROBE-20260730T194343Z.json
new file mode 100644
index 0000000..94e9f42
--- /dev/null
+++ b/runtime/history/GITEA-V4-DRY-RUN-TIMEOUT-SOURCE-PROBE-20260730T194343Z.json
@@ -0,0 +1,38 @@
+{
+  "schema_version": 1,
+  "channel": "homelab-runtime",
+  "command_id": "GITEA-V4-DRY-RUN-TIMEOUT-SOURCE-PROBE-20260730T194343Z",
+  "status": "OK",
+  "rc": 0,
+  "host": "pve01",
+  "mode": "verify",
+  "component": "gitea-machine-identity",
+  "started_at_utc": "2026-07-30T19:44:36Z",
+  "finished_at_utc": "2026-07-30T19:44:36Z",
+  "reference_register_checked": true,
+  "reference_sha256": "5763f2f8edc75fcf6f3951f8c95896d1cc112ceccb6cf5b64a383f540a4deb8e",
+  "error_register_checked": true,
+  "error_register_sha256": "24934a2c7fa5c26f6e828583c4aefac7f143b40c0171736ed7571e617d55ab83",
+  "command_sha256": "a571191a9f200a5086dfa94a7a08706bc0babddd80e4220a0d7f85b936f88d7c",
+  "duplicate_failed_command_blocked": false,
+  "block_reason": null,
+  "execution_started": true,
+  "change_declared": false,
+  "result_contract_valid": true,
+  "result_contract_status": null,
+  "result_contract_error": null,
+  "command_rc": 0,
+  "changes_made": false,
+  "rollback_started": false,
+  "rollback_restored": null,
+  "mutation_outcome": "NO_MUTATION",
+  "sanitized": true,
+  "secrets_included": false,
+  "private_addresses_included": false,
+  "raw_evidence_retained_locally": true,
+  "raw_evidence_sha256": "d5b93af3b15139eeb2a8a4294b3e4031eea04f404d051eaac1501e886051d677",
+  "sanitized_output_sha256": "d5b93af3b15139eeb2a8a4294b3e4031eea04f404d051eaac1501e886051d677",
+  "output_truncated_in_json": false,
+  "full_sanitized_output_url": "https://git.gram1.ru/.well-known/homelab-runtime/latest.txt",
+  "output": "{\"capability_branch\":[],\"changes_made\":false,\"command_id\":\"GITEA-V4-DRY-RUN-TIMEOUT-SOURCE-PROBE-20260730T194343Z\",\"dry_run\":{\"bytes\":2784,\"interesting_context\":[\"0004: on_err(){\",\"0005:   local rc=$?\",\"0006:   trap - ERR\",\"0007:   printf 'ROOT_CAUSE=UNEXPECTED_PHASE_ERROR\",\"0008: '\",\"0009:   printf 'ROOT_CAUSE_COUNT=1\",\"0010: '\",\"0011:   printf 'DETAIL=line:%s rc:%s\",\"0012: ' \\\"${1:-0}\\\" \\\"$rc\\\"\",\"0013:   exit \\\"$rc\\\"\",\"0014: }\",\"0015: trap 'on_err \\\"$LINENO\\\"' ERR\",\"0016: \",\"0017: TASK_ID=\\\"gitea-machine-identity-controlled-migration-v4\\\"\",\"0018: STAGING=\\\"/var/lib/homelab-admin/staging/$TASK_ID\\\"\",\"0019: PINNED=\\\"$STAGING/known_hosts.vm170\\\"\",\"0020: REMOTE=\\\"https://git.gram1.ru/homelab-admin/homelab-ops.git\\\"\",\"0021: CREDENTIAL_FILE=\\\"/etc/homelab-admin/credentials/gitea-homelab-ops\\\"\",\"0022: HELPER_FILE=\\\"/usr/local/libexec/homelab-git-credential\\\"\",\"0023: \",\"0024: OUT=\\\"$HOMELAB_RUN_DIR/vm170-capability.txt\\\"\",\"....\",\"0034: host=git.gram1.ru\",\"0035: path=unrelated/repo.git\",\"0036: \",\"0037: ' | \\\"$HOMELAB_TASK_DIR/assets/git-credential-helper.sh\\\" get | grep -q . && { printf 'ROOT_CAUSE=HELPER_LEAKS_TO_UNRELATED_REPO\",\"0038: ROOT_CAUSE_COUNT=1\",\"0039: '; exit 1; } || true\",\"0040: \",\"0041: \",\"0042: set +e\",\"0043: timeout --signal=TERM --kill-after=2s 24s ssh \\\\\",\"0044:   -o BatchMode=yes \\\\\",\"0045:   -o ConnectTimeout=6 \\\\\",\"0046:   -o IdentitiesOnly=yes \\\\\",\"0047:   -o IdentityFile=[SENSITIVE_SSH_PATH] \\\\\",\"0048:   -o StrictHostKeyChecking=yes \\\\\",\"0049:   -o UserKnownHostsFile=\\\"$PINNED\\\" \\\\\",\"0050:   root@[PRIVATE_IP] \\\\\",\"0051:   'bash -s --' capability \\\"$TASK_ID\\\" \\\"$plan_b64\\\" \\\\\",\"0052:   <\\\"$HOMELAB_TASK_DIR/assets/vm170-machine-identity.sh\\\" \\\\\",\"0053:   >\\\"$OUT\\\" 2>&1\",\"0054: ssh_rc=$?\",\"0055: set -e\",\"0056: case \\\"$ssh_rc\\\" in\",\"0057:   0) ;;\",\"0058:   124|137|143)\",\"0059:     printf 'ROOT_CAUSE=VM170_CAPABILITY_SSH_TIMEOUT\",\"0060: ROOT_CAUSE_COUNT=1\",\"0061: DETAIL=24s\",\"0062: '\",\"0063:     exit 1\",\"0064:     ;;\",\"0065:   *)\",\"0066:     sed -n '/^[A-Z][A-Z0-9_]*=/p' \\\"$OUT\\\"\",\"0067:     printf 'ROOT_CAUSE=VM170_CAPABILITY_FAILED\",\"0068: ROOT_CAUSE_COUNT=1\",\"0069: DETAIL=rc:%s\",\"0070: ' \\\"$ssh_rc\\\"\",\"0071:     exit \\\"$ssh_rc\\\"\",\"0072:     ;;\",\"0073: esac\",\"0074: \",\"....\",\"0076: grep -Fq 'GITEA_CLI_CALLS=1' \\\"$OUT\\\"\",\"0077: grep -Fq 'PASSWORD_FLAGS_FOR_BOT=ABSENT_BY_PLAN' \\\"$OUT\\\"\",\"0078: \",\"0079: jq -n --arg task_id \\\"$TASK_ID\\\" '{status:\\\"OK\\\",root_cause_count:0,task_id:$task_id,production_changed:false,bot_capability:true,single_call_material_capability:true,password_flags_for_bot:false,helper_scope_contract:true,gitea_cli_calls:1,package_tests:true}' >\\\"$HOMELAB_RUN_DIR/dry-run.json\\\"\",\"0080: printf 'DRY_RUN_STATUS=OK\",\"0081: '\",\"0082: printf 'ROOT_CAUSE_COUNT=0\",\"0083: '\",\"0084: printf 'GITEA_BOT_USER_CAPABILITY=YES\",\"0085: '\"],\"lines\":97,\"path\":\"/root/gitea-machine-identity-controlled-migration-v4/phases/dry-run.sh\",\"sha256\":\"c5edfe7553ffb7f44a80dd530b805fb732ee0e09097f5b3a6ca77d1f9bc27329\",\"timeout_records\":[{\"durations\":[\"2s\",\"24s\"],\"line\":43,\"text\":\"timeout --signal=TERM --kill-after=2s 24s ssh \\\\\"},{\"durations\":[],\"line\":45,\"text\":\"  -o ConnectTimeout=6 \\\\\"}]},\"dry_run_lines_34_65\":[\"0034: host=git.gram1.ru\",\"0035: path=unrelated/repo.git\",\"0036: \",\"0037: ' | \\\"$HOMELAB_TASK_DIR/assets/git-credential-helper.sh\\\" get | grep -q . && { printf 'ROOT_CAUSE=HELPER_LEAKS_TO_UNRELATED_REPO\",\"0038: ROOT_CAUSE_COUNT=1\",\"0039: '; exit 1; } || true\",\"0040: \",\"0041: \",\"0042: set +e\",\"0043: timeout --signal=TERM --kill-after=2s 24s ssh \\\\\",\"0044:   -o BatchMode=yes \\\\\",\"0045:   -o ConnectTimeout=6 \\\\\",\"0046:   -o IdentitiesOnly=yes \\\\\",\"0047:   -o IdentityFile=[SENSITIVE_SSH_PATH] \\\\\",\"0048:   -o StrictHostKeyChecking=yes \\\\\",\"0049:   -o UserKnownHostsFile=\\\"$PINNED\\\" \\\\\",\"0050:   root@[PRIVATE_IP] \\\\\",\"0051:   'bash -s --' capability \\\"$TASK_ID\\\" \\\"$plan_b64\\\" \\\\\",\"0052:   <\\\"$HOMELAB_TASK_DIR/assets/vm170-machine-identity.sh\\\" \\\\\",\"0053:   >\\\"$OUT\\\" 2>&1\",\"0054: ssh_rc=$?\",\"0055: set -e\",\"0056: case \\\"$ssh_rc\\\" in\",\"0057:   0) ;;\",\"0058:   124|137|143)\",\"0059:     printf 'ROOT_CAUSE=VM170_CAPABILITY_SSH_TIMEOUT\",\"0060: ROOT_CAUSE_COUNT=1\",\"0061: DETAIL=24s\",\"0062: '\",\"0063:     exit 1\",\"0064:     ;;\",\"0065:   *)\"],\"mutation_outcome\":\"NO_MUTATION\",\"next_stage\":\"PATCH_EXACT_INTERNAL_TIMEOUT_AND_RUN_MIGRATION\",\"output_truncated_in_json\":false,\"private_addresses_included\":false,\"rc\":0,\"remote_asset\":{\"bytes\":7616,\"interesting_context\":[\"0002: set -Eeuo pipefail\",\"0003: \",\"0004: fail(){\",\"0005:   printf 'ROOT_CAUSE=%s\",\"0006: ROOT_CAUSE_COUNT=1\",\"0007: DETAIL=%s\",\"0008: ' \\\"$1\\\" \\\"$2\\\"\",\"0009:   exit 1\",\"0010: }\",\"....\",\"0014: task_id=\\\"$2\\\"\",\"0015: plan_b64=\\\"${3:-}\\\"\",\"0016: \",\"0017: [[ \\\"$task_id\\\" == \\\"gitea-machine-identity-controlled-migration-v4\\\" ]] || fail TASK_ID_MISMATCH \\\"$task_id\\\"\",\"0018: case \\\"$mode\\\" in\",\"0019:   capability|apply|verify-state|rollback|cleanup-owned|seal) ;;\",\"0020:   *) fail INVALID_MODE \\\"$mode\\\" ;;\",\"....\",\"0036:   shift\",\"0037:   local captured rc\",\"0038:   set +e\",\"0039:   captured=\\\"$(timeout --signal=TERM --kill-after=1s 3s docker \\\"$@\\\" 2>&1)\\\"\",\"0040:   rc=$?\",\"0041:   set -e\",\"0042:   case \\\"$rc\\\" in\",\"....\",\"0048: }\",\"0049: \",\"0050: find_container(){\",\"0051:   container_id=\\\"$(docker_capture container-discovery ps --filter 'ancestor=docker.gitea.com/gitea:1.26.2' --format '{{.ID}}')\\\"\",\"0052:   [[ \\\"$(printf '%s\",\"0053: ' \\\"$container_id\\\" | awk 'NF{n++} END{print n+0}')\\\" -eq 1 ]] ||\",\"0054:     fail GITEA_CONTAINER_CARDINALITY vm170\",\"0055:   image_value=\\\"$(docker_capture container-inspect inspect \\\"$container_id\\\" --format '{{.Config.Image}}')\\\"\",\"0056:   [[ \\\"$image_value\\\" == 'docker.gitea.com/gitea:1.26.2' ]] ||\",\"0057:     fail GITEA_IMAGE_MISMATCH \\\"$image_value\\\"\",\"0058: }\",\"0059: \",\"....\",\"0063:   shift 2\",\"0064:   local captured rc\",\"0065:   set +e\",\"0066:   captured=\\\"$(timeout --signal=TERM --kill-after=2s \\\"$seconds_value\\\" docker exec --user git \\\"$container_id\\\" gitea \\\"$@\\\" 2>&1)\\\"\",\"0067:   rc=$?\",\"0068:   set -e\",\"0069:   case \\\"$rc\\\" in\",\"....\",\"0076: \",\"0077: gitea_quiet_best_effort(){\",\"0078:   set +e\",\"0079:   timeout --signal=TERM --kill-after=2s 18s docker exec --user git \\\"$container_id\\\" gitea \\\"$@\\\" >/dev/null 2>&1\",\"0080:   local rc=$?\",\"0081:   set -e\",\"0082:   return \\\"$rc\\\"\",\"....\",\"0101: if [[ \\\"$mode\\\" == 'seal' ]]; then\",\"0102:   [[ -n \\\"$plan_b64\\\" ]] || fail PLAN_MISSING seal\",\"0103:   plan_json=\\\"$(printf '%s' \\\"$plan_b64\\\" | base64 -d)\\\"\",\"0104:   jq -e '.task_id==\\\"gitea-machine-identity-controlled-migration-v4\\\" and .machine_user==\\\"homelab-ops-bot\\\"' <<<\\\"$plan_json\\\" >/dev/null\",\"0105:   [[ -f \\\"$state_dir/verified\\\" ]] || fail VERIFY_MARKER_MISSING vm170\",\"0106:   [[ -f \\\"$state_dir/user-type-bot\\\" ]] || fail BOT_TYPE_MARKER_MISSING vm170\",\"0107:   [[ -f \\\"$state_dir/admin-flag-absent\\\" ]] || fail ADMIN_FLAG_MARKER_MISSING vm170\",\"....\",\"0120: [[ -n \\\"$plan_b64\\\" ]] || fail PLAN_MISSING \\\"$mode\\\"\",\"0121: plan_json=\\\"$(printf '%s' \\\"$plan_b64\\\" | base64 -d)\\\"\",\"0122: jq -e '\",\"0123:   .task_id==\\\"gitea-machine-identity-controlled-migration-v4\\\" and\",\"0124:   .machine_user==\\\"homelab-ops-bot\\\" and\",\"0125:   .repository==\\\"homelab-admin/homelab-ops\\\" and\",\"0126:   .permission==\\\"write\\\" and\"],\"lines\":248,\"path\":\"/root/gitea-machine-identity-controlled-migration-v4/assets/vm170-machine-identity.sh\",\"sha256\":\"6281daf0cb4cd27345b4c63f90d0c4908387d86e09f3acee371d23fc63ab3aa4\",\"timeout_records\":[{\"durations\":[\"1s\",\"3s\"],\"line\":39,\"text\":\"  captured=\\\"$(timeout --signal=TERM --kill-after=1s 3s docker \\\"$@\\\" 2>&1)\\\"\"},{\"durations\":[\"2s\"],\"line\":66,\"text\":\"  captured=\\\"$(timeout --signal=TERM --kill-after=2s \\\"$seconds_value\\\" docker exec --user git \\\"$container_id\\\" gitea \\\"$@\\\" 2>&1)\\\"\"},{\"durations\":[\"2s\",\"18s\"],\"line\":79,\"text\":\"  timeout --signal=TERM --kill-after=2s 18s docker exec --user git \\\"$container_id\\\" gitea \\\"$@\\\" >/dev/null 2>&1\"}]},\"rollback_restored\":null,\"rollback_started\":false,\"schema\":1,\"secrets_included\":false,\"stage\":\"DRY_RUN_TIMEOUT_SOURCE_CAPTURED\",\"status\":\"OK\"}\n"
+}
diff --git a/runtime/history/GITEA-V4-DRY-RUN-TIMEOUT-SOURCE-PROBE-20260730T194343Z.txt b/runtime/history/GITEA-V4-DRY-RUN-TIMEOUT-SOURCE-PROBE-20260730T194343Z.txt
new file mode 100644
index 0000000..5e317de
--- /dev/null
+++ b/runtime/history/GITEA-V4-DRY-RUN-TIMEOUT-SOURCE-PROBE-20260730T194343Z.txt
@@ -0,0 +1,33 @@
+CHAT_OUTPUT_BEGIN
+COMMAND_ID=GITEA-V4-DRY-RUN-TIMEOUT-SOURCE-PROBE-20260730T194343Z
+STATUS=OK
+RC=0
+HOST=pve01
+MODE=verify
+COMPONENT=gitea-machine-identity
+REFERENCE_REGISTER_CHECK=OK
+REFERENCE_SHA256=5763f2f8edc75fcf6f3951f8c95896d1cc112ceccb6cf5b64a383f540a4deb8e
+ERROR_REGISTER_CHECK=OK
+ERROR_REGISTER_SHA256=24934a2c7fa5c26f6e828583c4aefac7f143b40c0171736ed7571e617d55ab83
+COMMAND_SHA256=a571191a9f200a5086dfa94a7a08706bc0babddd80e4220a0d7f85b936f88d7c
+DUPLICATE_FAILED_COMMAND_BLOCKED=false
+EXECUTION_STARTED=true
+CHANGE_DECLARED=false
+RESULT_CONTRACT_VALID=true
+RESULT_CONTRACT_STATUS=NOT_APPLICABLE
+RESULT_CONTRACT_ERROR=NONE
+COMMAND_RC=0
+CHANGES_MADE=false
+ROLLBACK_STARTED=false
+ROLLBACK_RESTORED=null
+MUTATION_OUTCOME=NO_MUTATION
+SANITIZED=yes
+SECRETS_INCLUDED=no
+PRIVATE_ADDRESSES_INCLUDED=no
+RAW_EVIDENCE_SHA256=d5b93af3b15139eeb2a8a4294b3e4031eea04f404d051eaac1501e886051d677
+SANITIZED_OUTPUT_SHA256=d5b93af3b15139eeb2a8a4294b3e4031eea04f404d051eaac1501e886051d677
+OUTPUT_BEGIN
+{"capability_branch":[],"changes_made":false,"command_id":"GITEA-V4-DRY-RUN-TIMEOUT-SOURCE-PROBE-20260730T194343Z","dry_run":{"bytes":2784,"interesting_context":["0004: on_err(){","0005:   local rc=$?","0006:   trap - ERR","0007:   printf 'ROOT_CAUSE=UNEXPECTED_PHASE_ERROR","0008: '","0009:   printf 'ROOT_CAUSE_COUNT=1","0010: '","0011:   printf 'DETAIL=line:%s rc:%s","0012: ' \"${1:-0}\" \"$rc\"","0013:   exit \"$rc\"","0014: }","0015: trap 'on_err \"$LINENO\"' ERR","0016: ","0017: TASK_ID=\"gitea-machine-identity-controlled-migration-v4\"","0018: STAGING=\"/var/lib/homelab-admin/staging/$TASK_ID\"","0019: PINNED=\"$STAGING/known_hosts.vm170\"","0020: REMOTE=\"https://git.gram1.ru/homelab-admin/homelab-ops.git\"","0021: CREDENTIAL_FILE=\"/etc/homelab-admin/credentials/gitea-homelab-ops\"","0022: HELPER_FILE=\"/usr/local/libexec/homelab-git-credential\"","0023: ","0024: OUT=\"$HOMELAB_RUN_DIR/vm170-capability.txt\"","....","0034: host=git.gram1.ru","0035: path=unrelated/repo.git","0036: ","0037: ' | \"$HOMELAB_TASK_DIR/assets/git-credential-helper.sh\" get | grep -q . && { printf 'ROOT_CAUSE=HELPER_LEAKS_TO_UNRELATED_REPO","0038: ROOT_CAUSE_COUNT=1","0039: '; exit 1; } || true","0040: ","0041: ","0042: set +e","0043: timeout --signal=TERM --kill-after=2s 24s ssh \\","0044:   -o BatchMode=yes \\","0045:   -o ConnectTimeout=6 \\","0046:   -o IdentitiesOnly=yes \\","0047:   -o IdentityFile=[SENSITIVE_SSH_PATH] \\","0048:   -o StrictHostKeyChecking=yes \\","0049:   -o UserKnownHostsFile=\"$PINNED\" \\","0050:   root@[PRIVATE_IP] \\","0051:   'bash -s --' capability \"$TASK_ID\" \"$plan_b64\" \\","0052:   <\"$HOMELAB_TASK_DIR/assets/vm170-machine-identity.sh\" \\","0053:   >\"$OUT\" 2>&1","0054: ssh_rc=$?","0055: set -e","0056: case \"$ssh_rc\" in","0057:   0) ;;","0058:   124|137|143)","0059:     printf 'ROOT_CAUSE=VM170_CAPABILITY_SSH_TIMEOUT","0060: ROOT_CAUSE_COUNT=1","0061: DETAIL=24s","0062: '","0063:     exit 1","0064:     ;;","0065:   *)","0066:     sed -n '/^[A-Z][A-Z0-9_]*=/p' \"$OUT\"","0067:     printf 'ROOT_CAUSE=VM170_CAPABILITY_FAILED","0068: ROOT_CAUSE_COUNT=1","0069: DETAIL=rc:%s","0070: ' \"$ssh_rc\"","0071:     exit \"$ssh_rc\"","0072:     ;;","0073: esac","0074: ","....","0076: grep -Fq 'GITEA_CLI_CALLS=1' \"$OUT\"","0077: grep -Fq 'PASSWORD_FLAGS_FOR_BOT=ABSENT_BY_PLAN' \"$OUT\"","0078: ","0079: jq -n --arg task_id \"$TASK_ID\" '{status:\"OK\",root_cause_count:0,task_id:$task_id,production_changed:false,bot_capability:true,single_call_material_capability:true,password_flags_for_bot:false,helper_scope_contract:true,gitea_cli_calls:1,package_tests:true}' >\"$HOMELAB_RUN_DIR/dry-run.json\"","0080: printf 'DRY_RUN_STATUS=OK","0081: '","0082: printf 'ROOT_CAUSE_COUNT=0","0083: '","0084: printf 'GITEA_BOT_USER_CAPABILITY=YES","0085: '"],"lines":97,"path":"/root/gitea-machine-identity-controlled-migration-v4/phases/dry-run.sh","sha256":"c5edfe7553ffb7f44a80dd530b805fb732ee0e09097f5b3a6ca77d1f9bc27329","timeout_records":[{"durations":["2s","24s"],"line":43,"text":"timeout --signal=TERM --kill-after=2s 24s ssh \\"},{"durations":[],"line":45,"text":"  -o ConnectTimeout=6 \\"}]},"dry_run_lines_34_65":["0034: host=git.gram1.ru","0035: path=unrelated/repo.git","0036: ","0037: ' | \"$HOMELAB_TASK_DIR/assets/git-credential-helper.sh\" get | grep -q . && { printf 'ROOT_CAUSE=HELPER_LEAKS_TO_UNRELATED_REPO","0038: ROOT_CAUSE_COUNT=1","0039: '; exit 1; } || true","0040: ","0041: ","0042: set +e","0043: timeout --signal=TERM --kill-after=2s 24s ssh \\","0044:   -o BatchMode=yes \\","0045:   -o ConnectTimeout=6 \\","0046:   -o IdentitiesOnly=yes \\","0047:   -o IdentityFile=[SENSITIVE_SSH_PATH] \\","0048:   -o StrictHostKeyChecking=yes \\","0049:   -o UserKnownHostsFile=\"$PINNED\" \\","0050:   root@[PRIVATE_IP] \\","0051:   'bash -s --' capability \"$TASK_ID\" \"$plan_b64\" \\","0052:   <\"$HOMELAB_TASK_DIR/assets/vm170-machine-identity.sh\" \\","0053:   >\"$OUT\" 2>&1","0054: ssh_rc=$?","0055: set -e","0056: case \"$ssh_rc\" in","0057:   0) ;;","0058:   124|137|143)","0059:     printf 'ROOT_CAUSE=VM170_CAPABILITY_SSH_TIMEOUT","0060: ROOT_CAUSE_COUNT=1","0061: DETAIL=24s","0062: '","0063:     exit 1","0064:     ;;","0065:   *)"],"mutation_outcome":"NO_MUTATION","next_stage":"PATCH_EXACT_INTERNAL_TIMEOUT_AND_RUN_MIGRATION","output_truncated_in_json":false,"private_addresses_included":false,"rc":0,"remote_asset":{"bytes":7616,"interesting_context":["0002: set -Eeuo pipefail","0003: ","0004: fail(){","0005:   printf 'ROOT_CAUSE=%s","0006: ROOT_CAUSE_COUNT=1","0007: DETAIL=%s","0008: ' \"$1\" \"$2\"","0009:   exit 1","0010: }","....","0014: task_id=\"$2\"","0015: plan_b64=\"${3:-}\"","0016: ","0017: [[ \"$task_id\" == \"gitea-machine-identity-controlled-migration-v4\" ]] || fail TASK_ID_MISMATCH \"$task_id\"","0018: case \"$mode\" in","0019:   capability|apply|verify-state|rollback|cleanup-owned|seal) ;;","0020:   *) fail INVALID_MODE \"$mode\" ;;","....","0036:   shift","0037:   local captured rc","0038:   set +e","0039:   captured=\"$(timeout --signal=TERM --kill-after=1s 3s docker \"$@\" 2>&1)\"","0040:   rc=$?","0041:   set -e","0042:   case \"$rc\" in","....","0048: }","0049: ","0050: find_container(){","0051:   container_id=\"$(docker_capture container-discovery ps --filter 'ancestor=docker.gitea.com/gitea:1.26.2' --format '{{.ID}}')\"","0052:   [[ \"$(printf '%s","0053: ' \"$container_id\" | awk 'NF{n++} END{print n+0}')\" -eq 1 ]] ||","0054:     fail GITEA_CONTAINER_CARDINALITY vm170","0055:   image_value=\"$(docker_capture container-inspect inspect \"$container_id\" --format '{{.Config.Image}}')\"","0056:   [[ \"$image_value\" == 'docker.gitea.com/gitea:1.26.2' ]] ||","0057:     fail GITEA_IMAGE_MISMATCH \"$image_value\"","0058: }","0059: ","....","0063:   shift 2","0064:   local captured rc","0065:   set +e","0066:   captured=\"$(timeout --signal=TERM --kill-after=2s \"$seconds_value\" docker exec --user git \"$container_id\" gitea \"$@\" 2>&1)\"","0067:   rc=$?","0068:   set -e","0069:   case \"$rc\" in","....","0076: ","0077: gitea_quiet_best_effort(){","0078:   set +e","0079:   timeout --signal=TERM --kill-after=2s 18s docker exec --user git \"$container_id\" gitea \"$@\" >/dev/null 2>&1","0080:   local rc=$?","0081:   set -e","0082:   return \"$rc\"","....","0101: if [[ \"$mode\" == 'seal' ]]; then","0102:   [[ -n \"$plan_b64\" ]] || fail PLAN_MISSING seal","0103:   plan_json=\"$(printf '%s' \"$plan_b64\" | base64 -d)\"","0104:   jq -e '.task_id==\"gitea-machine-identity-controlled-migration-v4\" and .machine_user==\"homelab-ops-bot\"' <<<\"$plan_json\" >/dev/null","0105:   [[ -f \"$state_dir/verified\" ]] || fail VERIFY_MARKER_MISSING vm170","0106:   [[ -f \"$state_dir/user-type-bot\" ]] || fail BOT_TYPE_MARKER_MISSING vm170","0107:   [[ -f \"$state_dir/admin-flag-absent\" ]] || fail ADMIN_FLAG_MARKER_MISSING vm170","....","0120: [[ -n \"$plan_b64\" ]] || fail PLAN_MISSING \"$mode\"","0121: plan_json=\"$(printf '%s' \"$plan_b64\" | base64 -d)\"","0122: jq -e '","0123:   .task_id==\"gitea-machine-identity-controlled-migration-v4\" and","0124:   .machine_user==\"homelab-ops-bot\" and","0125:   .repository==\"homelab-admin/homelab-ops\" and","0126:   .permission==\"write\" and"],"lines":248,"path":"/root/gitea-machine-identity-controlled-migration-v4/assets/vm170-machine-identity.sh","sha256":"6281daf0cb4cd27345b4c63f90d0c4908387d86e09f3acee371d23fc63ab3aa4","timeout_records":[{"durations":["1s","3s"],"line":39,"text":"  captured=\"$(timeout --signal=TERM --kill-after=1s 3s docker \"$@\" 2>&1)\""},{"durations":["2s"],"line":66,"text":"  captured=\"$(timeout --signal=TERM --kill-after=2s \"$seconds_value\" docker exec --user git \"$container_id\" gitea \"$@\" 2>&1)\""},{"durations":["2s","18s"],"line":79,"text":"  timeout --signal=TERM --kill-after=2s 18s docker exec --user git \"$container_id\" gitea \"$@\" >/dev/null 2>&1"}]},"rollback_restored":null,"rollback_started":false,"schema":1,"secrets_included":false,"stage":"DRY_RUN_TIMEOUT_SOURCE_CAPTURED","status":"OK"}
+
+OUTPUT_END
+CHAT_OUTPUT_END
diff --git a/runtime/latest.json b/runtime/latest.json
index fb433b5..94e9f42 100644
--- a/runtime/latest.json
+++ b/runtime/latest.json
@@ -1,38 +1,38 @@
 {
   "schema_version": 1,
   "channel": "homelab-runtime",
-  "command_id": "GITEA-V4-MACHINE-IDENTITY-MIGRATION-V5-20260730T193350Z",
-  "status": "FAIL",
-  "rc": 1,
+  "command_id": "GITEA-V4-DRY-RUN-TIMEOUT-SOURCE-PROBE-20260730T194343Z",
+  "status": "OK",
+  "rc": 0,
   "host": "pve01",
-  "mode": "change",
+  "mode": "verify",
   "component": "gitea-machine-identity",
-  "started_at_utc": "2026-07-30T19:34:24Z",
-  "finished_at_utc": "2026-07-30T19:34:46Z",
+  "started_at_utc": "2026-07-30T19:44:36Z",
+  "finished_at_utc": "2026-07-30T19:44:36Z",
   "reference_register_checked": true,
   "reference_sha256": "5763f2f8edc75fcf6f3951f8c95896d1cc112ceccb6cf5b64a383f540a4deb8e",
   "error_register_checked": true,
   "error_register_sha256": "24934a2c7fa5c26f6e828583c4aefac7f143b40c0171736ed7571e617d55ab83",
-  "command_sha256": "5e635622291f11e949d0dcdd51755c61db105a889c01dbdef3fa2fe0958f52c0",
+  "command_sha256": "a571191a9f200a5086dfa94a7a08706bc0babddd80e4220a0d7f85b936f88d7c",
   "duplicate_failed_command_blocked": false,
   "block_reason": null,
   "execution_started": true,
-  "change_declared": true,
+  "change_declared": false,
   "result_contract_valid": true,
-  "result_contract_status": "FAIL",
+  "result_contract_status": null,
   "result_contract_error": null,
-  "command_rc": 1,
-  "changes_made": true,
-  "rollback_started": true,
-  "rollback_restored": true,
-  "mutation_outcome": "ROLLED_BACK",
+  "command_rc": 0,
+  "changes_made": false,
+  "rollback_started": false,
+  "rollback_restored": null,
+  "mutation_outcome": "NO_MUTATION",
   "sanitized": true,
   "secrets_included": false,
   "private_addresses_included": false,
   "raw_evidence_retained_locally": true,
-  "raw_evidence_sha256": "e0bd3d90d4927d580255b86e089469ce3c4658cd16d3b9d63deb4f16bd4d9827",
-  "sanitized_output_sha256": "e0bd3d90d4927d580255b86e089469ce3c4658cd16d3b9d63deb4f16bd4d9827",
+  "raw_evidence_sha256": "d5b93af3b15139eeb2a8a4294b3e4031eea04f404d051eaac1501e886051d677",
+  "sanitized_output_sha256": "d5b93af3b15139eeb2a8a4294b3e4031eea04f404d051eaac1501e886051d677",
   "output_truncated_in_json": false,
   "full_sanitized_output_url": "https://git.gram1.ru/.well-known/homelab-runtime/latest.txt",
-  "output": "HOMELAB_RESULT_CONTRACT={\"changes_made\":true,\"command_id\":\"GITEA-V4-MACHINE-IDENTITY-MIGRATION-V5-20260730T193350Z\",\"rollback_restored\":true,\"rollback_started\":true,\"status\":\"FAIL\",\"version\":1}\n{\"changes_made\":true,\"command_id\":\"GITEA-V4-MACHINE-IDENTITY-MIGRATION-V5-20260730T193350Z\",\"credential_partition\":{\"original_sha256\":\"fc18813a7f008130cbc291df849b8c72359985ef697717460fbc39d2056be2b1\",\"residual_bytes\":68,\"residual_sha256\":\"10d1a19537be0dd0dd1ab37cd4a1e5e239c1970a4d16d65aaa7ae7edf2739ec0\",\"target_bytes\":69,\"target_sha256\":\"b52c89cef273de1aa4afc607ee5d4323ef88553ed4b94da24df049b2251f03d8\"},\"error\":\"RuntimeError: phase failed: dry-run retry rc=142\",\"failed_phase\":\"dry-run\",\"mutation_outcome\":\"ROLLED_BACK\",\"package\":{\"admin_sha256\":\"5398600c15b63f3872116e6d1ae6f65e2d7a5d1752349c9de0de07d801967bd1\",\"phase_hashes\":{\"apply\":\"c2cee33db773dd58b0eadb0405c33933773a559b150ad478aa9c0018dac762e3\",\"dry-run\":\"c5edfe7553ffb7f44a80dd530b805fb732ee0e09097f5b3a6ca77d1f9bc27329\",\"preflight\":\"2ca95ea8d0871351133f946d481665c059b4533c2ec80ea35d81424d7b1d5f7a\",\"prepare\":\"d7cc381878e06f0896219616354c70b042c227ab6254d6a9a36061cc24c13f8c\",\"rollback\":\"2b801fcea7096cdefe2cd294175d1d48ac3dfb394776dbda52299ded470fee0e\",\"seal\":\"c88cb5e9f63aac3888e3822a5eab9e2456b04f5eda16756f626a664eb558c0bc\",\"verify\":\"e57af844675486bb897dd05cfd529bc618c6f32fec9a9257eeeaca1748cbb7cc\"},\"sha256_check_stdout_sha256\":\"edc33fce6cfbf4052ebe804dee6cb9f86d114eb0953f2dba3b5fa9148af70fb3\",\"sha256s_sha256\":\"0aa34f98ccb74f2a8c00460781f56f7b29805e21a284e59a8052936f8dcdc511\",\"task_sha256\":\"10fa2a21164397e2d28f6a44c452c431e64e3cafadd2b4e8098a060c30fab5d9\",\"v3_block_rc\":64,\"validation_stdout_sha256\":\"cce2200e849fd3b7418a9dc011e5566097c620f46da0e2520ea380f2c883e3de\"},\"phases\":[{\"duration_seconds\":0.425,\"phase\":\"preflight\",\"rc\":0,\"safe_stderr\":[],\"safe_stdout\":[\"LINT_STATUS=OK\",\"TASK_ID=gitea-machine-identity-controlled-migration-v4\",\"POLICY_ID=homelab-admin-guardrails-v1.2\",\"RULES_CHECKED=14\",\"SOURCE_FILES_CHECKED=11\",\"GITEA_MACHINE_IDENTITY_MIGRATION_V3_TESTS=OK\",\"REG_157_PREFLIGHT_GITEA_CLI=BLOCKED\",\"REG_158_AGGREGATE_SSH_TIMEOUT_UNCLASSIFIED=BLOCKED\",\"REG_159_BOOTSTRAP_ADMINISTRATOR=BLOCKED\",\"REG_162_LEGACY_REPO_ADMIN_REQUIRED=BLOCKED\",\"REG_163_REPOSITORY_ONLY_SCOPE_REQUIRED=BLOCKED\",\"REG_164_USER_SCOPE_ACCESS=BLOCKED\",\"REG_165_TASK_OWNED_REMOTE_CLEANUP=BLOCKED\",\"REG_166_REPOSITORY_SPECIFIC_HELPER_REQUIRED=BLOCKED\",\"REG_167_PROTECTED_WORKTREE_PUSH_DISABLED=BLOCKED\",\"REG_168_PHASE_RUN_DIR_ISOLATION=BLOCKED\",\"REG_014_GITEA_VERSION_AUTHENTICATION=BLOCKED\",\"REG_015_GITEA_OWNER_PERMISSION=BLOCKED\",\"PREFLIGHT_STATUS=OK\",\"ROOT_CAUSE_COUNT=0\",\"LEGACY_IDENTITY_API=OK\",\"LEGACY_REPOSITORY_PERMISSION=admin\",\"MACHINE_USER_STATE=ABSENT\",\"PREFLIGHT_GITEA_CLI_CALLS=0\",\"FAILED_UNIT_COUNT=2\",\"FAILED_UNIT_POLICY=EXACT_KNOWN_UNRELATED_ALLOWLIST\",\"PACKAGE_TESTS=OK\",\"PRODUCTION_CHANGED=NO\",\"RUN_DIR=/var/lib/homelab-admin/runs/gitea-machine-identity-controlled-migration-v4/20260730T193425Z-2497470-preflight\",\"RUN_RC=0\"],\"stderr_bytes\":0,\"stderr_sha256\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"stdout_bytes\":1188,\"stdout_sha256\":\"19de4ada678b1e607f244da9587ab0c899d3bf3543cc18ede79e6c83bd7f6341\"},{\"duration_seconds\":0.203,\"phase\":\"prepare\",\"rc\":0,\"safe_stderr\":[],\"safe_stdout\":[\"LINT_STATUS=OK\",\"TASK_ID=gitea-machine-identity-controlled-migration-v4\",\"POLICY_ID=homelab-admin-guardrails-v1.2\",\"RULES_CHECKED=14\",\"SOURCE_FILES_CHECKED=11\",\"PREPARE_STATUS=OK\",\"ROOT_CAUSE_COUNT=0\",\"VM170_PINNED_HOST_KEY_READY=YES\",\"LEGACY_GIT_CONFIG_BACKED_UP=YES\",\"MIGRATION_PLAN_READY=YES\",\"ROLLBACK_PLAN_READY=YES\",\"PRODUCTION_CHANGED=NO\",\"RUN_DIR=/var/lib/homelab-admin/runs/gitea-machine-identity-controlled-migration-v4/20260730T193425Z-2497585-prepare\",\"RUN_RC=0\"],\"stderr_bytes\":0,\"stderr_sha256\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"stdout_bytes\":485,\"stdout_sha256\":\"b552687b70b07a0107ec67fa4330bc05a2a1b02f334011951e5a382e3397f32a\"},{\"duration_seconds\":10.526,\"phase\":\"dry-run-initial\",\"rc\":142,\"safe_stderr\":[],\"safe_stdout\":[\"LINT_STATUS=OK\",\"TASK_ID=gitea-machine-identity-controlled-migration-v4\",\"POLICY_ID=homelab-admin-guardrails-v1.2\",\"RULES_CHECKED=14\",\"SOURCE_FILES_CHECKED=11\",\"GITEA_MACHINE_IDENTITY_MIGRATION_V3_TESTS=OK\",\"REG_157_PREFLIGHT_GITEA_CLI=BLOCKED\",\"REG_158_AGGREGATE_SSH_TIMEOUT_UNCLASSIFIED=BLOCKED\",\"REG_159_BOOTSTRAP_ADMINISTRATOR=BLOCKED\",\"REG_162_LEGACY_REPO_ADMIN_REQUIRED=BLOCKED\",\"REG_163_REPOSITORY_ONLY_SCOPE_REQUIRED=BLOCKED\",\"REG_164_USER_SCOPE_ACCESS=BLOCKED\",\"REG_165_TASK_OWNED_REMOTE_CLEANUP=BLOCKED\",\"REG_166_REPOSITORY_SPECIFIC_HELPER_REQUIRED=BLOCKED\",\"REG_167_PROTECTED_WORKTREE_PUSH_DISABLED=BLOCKED\",\"REG_168_PHASE_RUN_DIR_ISOLATION=BLOCKED\",\"REG_014_GITEA_VERSION_AUTHENTICATION=BLOCKED\",\"REG_015_GITEA_OWNER_PERMISSION=BLOCKED\",\"ROOT_CAUSE=UNEXPECTED_PHASE_ERROR\",\"ROOT_CAUSE_COUNT=1\",\"DETAIL=line:43 rc:142\",\"RUN_DIR=/var/lib/homelab-admin/runs/gitea-machine-identity-controlled-migration-v4/20260730T193425Z-2497675-dry-run\",\"RUN_RC=142\"],\"stderr_bytes\":0,\"stderr_sha256\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"stdout_bytes\":1002,\"stdout_sha256\":\"5abdd5abc86a3b54da0974d81881880831cc3a1b90a8a4baf487689cc056e136\"},{\"duration_seconds\":10.376,\"phase\":\"dry-run-retry-60s\",\"rc\":142,\"safe_stderr\":[],\"safe_stdout\":[\"LINT_STATUS=OK\",\"TASK_ID=gitea-machine-identity-controlled-migration-v4\",\"POLICY_ID=homelab-admin-guardrails-v1.2\",\"RULES_CHECKED=14\",\"SOURCE_FILES_CHECKED=11\",\"GITEA_MACHINE_IDENTITY_MIGRATION_V3_TESTS=OK\",\"REG_157_PREFLIGHT_GITEA_CLI=BLOCKED\",\"REG_158_AGGREGATE_SSH_TIMEOUT_UNCLASSIFIED=BLOCKED\",\"REG_159_BOOTSTRAP_ADMINISTRATOR=BLOCKED\",\"REG_162_LEGACY_REPO_ADMIN_REQUIRED=BLOCKED\",\"REG_163_REPOSITORY_ONLY_SCOPE_REQUIRED=BLOCKED\",\"REG_164_USER_SCOPE_ACCESS=BLOCKED\",\"REG_165_TASK_OWNED_REMOTE_CLEANUP=BLOCKED\",\"REG_166_REPOSITORY_SPECIFIC_HELPER_REQUIRED=BLOCKED\",\"REG_167_PROTECTED_WORKTREE_PUSH_DISABLED=BLOCKED\",\"REG_168_PHASE_RUN_DIR_ISOLATION=BLOCKED\",\"REG_014_GITEA_VERSION_AUTHENTICATION=BLOCKED\",\"REG_015_GITEA_OWNER_PERMISSION=BLOCKED\",\"ROOT_CAUSE=UNEXPECTED_PHASE_ERROR\",\"ROOT_CAUSE_COUNT=1\",\"DETAIL=line:43 rc:142\",\"RUN_DIR=/var/lib/homelab-admin/runs/gitea-machine-identity-controlled-migration-v4/20260730T193436Z-2497880-dry-run\",\"RUN_RC=142\"],\"stderr_bytes\":0,\"stderr_sha256\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"stdout_bytes\":1002,\"stdout_sha256\":\"20511a6ce19e3f8359c9722c78115ed98ee1687329ef3c772409933f1148dbe3\"}],\"rc\":1,\"rollback_restored\":true,\"rollback_started\":true,\"schema\":1,\"seal_started\":false,\"secrets_included\":false,\"status\":\"FAIL\",\"wrapper_recovery_state_retained\":false}\n"
+  "output": "{\"capability_branch\":[],\"changes_made\":false,\"command_id\":\"GITEA-V4-DRY-RUN-TIMEOUT-SOURCE-PROBE-20260730T194343Z\",\"dry_run\":{\"bytes\":2784,\"interesting_context\":[\"0004: on_err(){\",\"0005:   local rc=$?\",\"0006:   trap - ERR\",\"0007:   printf 'ROOT_CAUSE=UNEXPECTED_PHASE_ERROR\",\"0008: '\",\"0009:   printf 'ROOT_CAUSE_COUNT=1\",\"0010: '\",\"0011:   printf 'DETAIL=line:%s rc:%s\",\"0012: ' \\\"${1:-0}\\\" \\\"$rc\\\"\",\"0013:   exit \\\"$rc\\\"\",\"0014: }\",\"0015: trap 'on_err \\\"$LINENO\\\"' ERR\",\"0016: \",\"0017: TASK_ID=\\\"gitea-machine-identity-controlled-migration-v4\\\"\",\"0018: STAGING=\\\"/var/lib/homelab-admin/staging/$TASK_ID\\\"\",\"0019: PINNED=\\\"$STAGING/known_hosts.vm170\\\"\",\"0020: REMOTE=\\\"https://git.gram1.ru/homelab-admin/homelab-ops.git\\\"\",\"0021: CREDENTIAL_FILE=\\\"/etc/homelab-admin/credentials/gitea-homelab-ops\\\"\",\"0022: HELPER_FILE=\\\"/usr/local/libexec/homelab-git-credential\\\"\",\"0023: \",\"0024: OUT=\\\"$HOMELAB_RUN_DIR/vm170-capability.txt\\\"\",\"....\",\"0034: host=git.gram1.ru\",\"0035: path=unrelated/repo.git\",\"0036: \",\"0037: ' | \\\"$HOMELAB_TASK_DIR/assets/git-credential-helper.sh\\\" get | grep -q . && { printf 'ROOT_CAUSE=HELPER_LEAKS_TO_UNRELATED_REPO\",\"0038: ROOT_CAUSE_COUNT=1\",\"0039: '; exit 1; } || true\",\"0040: \",\"0041: \",\"0042: set +e\",\"0043: timeout --signal=TERM --kill-after=2s 24s ssh \\\\\",\"0044:   -o BatchMode=yes \\\\\",\"0045:   -o ConnectTimeout=6 \\\\\",\"0046:   -o IdentitiesOnly=yes \\\\\",\"0047:   -o IdentityFile=[SENSITIVE_SSH_PATH] \\\\\",\"0048:   -o StrictHostKeyChecking=yes \\\\\",\"0049:   -o UserKnownHostsFile=\\\"$PINNED\\\" \\\\\",\"0050:   root@[PRIVATE_IP] \\\\\",\"0051:   'bash -s --' capability \\\"$TASK_ID\\\" \\\"$plan_b64\\\" \\\\\",\"0052:   <\\\"$HOMELAB_TASK_DIR/assets/vm170-machine-identity.sh\\\" \\\\\",\"0053:   >\\\"$OUT\\\" 2>&1\",\"0054: ssh_rc=$?\",\"0055: set -e\",\"0056: case \\\"$ssh_rc\\\" in\",\"0057:   0) ;;\",\"0058:   124|137|143)\",\"0059:     printf 'ROOT_CAUSE=VM170_CAPABILITY_SSH_TIMEOUT\",\"0060: ROOT_CAUSE_COUNT=1\",\"0061: DETAIL=24s\",\"0062: '\",\"0063:     exit 1\",\"0064:     ;;\",\"0065:   *)\",\"0066:     sed -n '/^[A-Z][A-Z0-9_]*=/p' \\\"$OUT\\\"\",\"0067:     printf 'ROOT_CAUSE=VM170_CAPABILITY_FAILED\",\"0068: ROOT_CAUSE_COUNT=1\",\"0069: DETAIL=rc:%s\",\"0070: ' \\\"$ssh_rc\\\"\",\"0071:     exit \\\"$ssh_rc\\\"\",\"0072:     ;;\",\"0073: esac\",\"0074: \",\"....\",\"0076: grep -Fq 'GITEA_CLI_CALLS=1' \\\"$OUT\\\"\",\"0077: grep -Fq 'PASSWORD_FLAGS_FOR_BOT=ABSENT_BY_PLAN' \\\"$OUT\\\"\",\"0078: \",\"0079: jq -n --arg task_id \\\"$TASK_ID\\\" '{status:\\\"OK\\\",root_cause_count:0,task_id:$task_id,production_changed:false,bot_capability:true,single_call_material_capability:true,password_flags_for_bot:false,helper_scope_contract:true,gitea_cli_calls:1,package_tests:true}' >\\\"$HOMELAB_RUN_DIR/dry-run.json\\\"\",\"0080: printf 'DRY_RUN_STATUS=OK\",\"0081: '\",\"0082: printf 'ROOT_CAUSE_COUNT=0\",\"0083: '\",\"0084: printf 'GITEA_BOT_USER_CAPABILITY=YES\",\"0085: '\"],\"lines\":97,\"path\":\"/root/gitea-machine-identity-controlled-migration-v4/phases/dry-run.sh\",\"sha256\":\"c5edfe7553ffb7f44a80dd530b805fb732ee0e09097f5b3a6ca77d1f9bc27329\",\"timeout_records\":[{\"durations\":[\"2s\",\"24s\"],\"line\":43,\"text\":\"timeout --signal=TERM --kill-after=2s 24s ssh \\\\\"},{\"durations\":[],\"line\":45,\"text\":\"  -o ConnectTimeout=6 \\\\\"}]},\"dry_run_lines_34_65\":[\"0034: host=git.gram1.ru\",\"0035: path=unrelated/repo.git\",\"0036: \",\"0037: ' | \\\"$HOMELAB_TASK_DIR/assets/git-credential-helper.sh\\\" get | grep -q . && { printf 'ROOT_CAUSE=HELPER_LEAKS_TO_UNRELATED_REPO\",\"0038: ROOT_CAUSE_COUNT=1\",\"0039: '; exit 1; } || true\",\"0040: \",\"0041: \",\"0042: set +e\",\"0043: timeout --signal=TERM --kill-after=2s 24s ssh \\\\\",\"0044:   -o BatchMode=yes \\\\\",\"0045:   -o ConnectTimeout=6 \\\\\",\"0046:   -o IdentitiesOnly=yes \\\\\",\"0047:   -o IdentityFile=[SENSITIVE_SSH_PATH] \\\\\",\"0048:   -o StrictHostKeyChecking=yes \\\\\",\"0049:   -o UserKnownHostsFile=\\\"$PINNED\\\" \\\\\",\"0050:   root@[PRIVATE_IP] \\\\\",\"0051:   'bash -s --' capability \\\"$TASK_ID\\\" \\\"$plan_b64\\\" \\\\\",\"0052:   <\\\"$HOMELAB_TASK_DIR/assets/vm170-machine-identity.sh\\\" \\\\\",\"0053:   >\\\"$OUT\\\" 2>&1\",\"0054: ssh_rc=$?\",\"0055: set -e\",\"0056: case \\\"$ssh_rc\\\" in\",\"0057:   0) ;;\",\"0058:   124|137|143)\",\"0059:     printf 'ROOT_CAUSE=VM170_CAPABILITY_SSH_TIMEOUT\",\"0060: ROOT_CAUSE_COUNT=1\",\"0061: DETAIL=24s\",\"0062: '\",\"0063:     exit 1\",\"0064:     ;;\",\"0065:   *)\"],\"mutation_outcome\":\"NO_MUTATION\",\"next_stage\":\"PATCH_EXACT_INTERNAL_TIMEOUT_AND_RUN_MIGRATION\",\"output_truncated_in_json\":false,\"private_addresses_included\":false,\"rc\":0,\"remote_asset\":{\"bytes\":7616,\"interesting_context\":[\"0002: set -Eeuo pipefail\",\"0003: \",\"0004: fail(){\",\"0005:   printf 'ROOT_CAUSE=%s\",\"0006: ROOT_CAUSE_COUNT=1\",\"0007: DETAIL=%s\",\"0008: ' \\\"$1\\\" \\\"$2\\\"\",\"0009:   exit 1\",\"0010: }\",\"....\",\"0014: task_id=\\\"$2\\\"\",\"0015: plan_b64=\\\"${3:-}\\\"\",\"0016: \",\"0017: [[ \\\"$task_id\\\" == \\\"gitea-machine-identity-controlled-migration-v4\\\" ]] || fail TASK_ID_MISMATCH \\\"$task_id\\\"\",\"0018: case \\\"$mode\\\" in\",\"0019:   capability|apply|verify-state|rollback|cleanup-owned|seal) ;;\",\"0020:   *) fail INVALID_MODE \\\"$mode\\\" ;;\",\"....\",\"0036:   shift\",\"0037:   local captured rc\",\"0038:   set +e\",\"0039:   captured=\\\"$(timeout --signal=TERM --kill-after=1s 3s docker \\\"$@\\\" 2>&1)\\\"\",\"0040:   rc=$?\",\"0041:   set -e\",\"0042:   case \\\"$rc\\\" in\",\"....\",\"0048: }\",\"0049: \",\"0050: find_container(){\",\"0051:   container_id=\\\"$(docker_capture container-discovery ps --filter 'ancestor=docker.gitea.com/gitea:1.26.2' --format '{{.ID}}')\\\"\",\"0052:   [[ \\\"$(printf '%s\",\"0053: ' \\\"$container_id\\\" | awk 'NF{n++} END{print n+0}')\\\" -eq 1 ]] ||\",\"0054:     fail GITEA_CONTAINER_CARDINALITY vm170\",\"0055:   image_value=\\\"$(docker_capture container-inspect inspect \\\"$container_id\\\" --format '{{.Config.Image}}')\\\"\",\"0056:   [[ \\\"$image_value\\\" == 'docker.gitea.com/gitea:1.26.2' ]] ||\",\"0057:     fail GITEA_IMAGE_MISMATCH \\\"$image_value\\\"\",\"0058: }\",\"0059: \",\"....\",\"0063:   shift 2\",\"0064:   local captured rc\",\"0065:   set +e\",\"0066:   captured=\\\"$(timeout --signal=TERM --kill-after=2s \\\"$seconds_value\\\" docker exec --user git \\\"$container_id\\\" gitea \\\"$@\\\" 2>&1)\\\"\",\"0067:   rc=$?\",\"0068:   set -e\",\"0069:   case \\\"$rc\\\" in\",\"....\",\"0076: \",\"0077: gitea_quiet_best_effort(){\",\"0078:   set +e\",\"0079:   timeout --signal=TERM --kill-after=2s 18s docker exec --user git \\\"$container_id\\\" gitea \\\"$@\\\" >/dev/null 2>&1\",\"0080:   local rc=$?\",\"0081:   set -e\",\"0082:   return \\\"$rc\\\"\",\"....\",\"0101: if [[ \\\"$mode\\\" == 'seal' ]]; then\",\"0102:   [[ -n \\\"$plan_b64\\\" ]] || fail PLAN_MISSING seal\",\"0103:   plan_json=\\\"$(printf '%s' \\\"$plan_b64\\\" | base64 -d)\\\"\",\"0104:   jq -e '.task_id==\\\"gitea-machine-identity-controlled-migration-v4\\\" and .machine_user==\\\"homelab-ops-bot\\\"' <<<\\\"$plan_json\\\" >/dev/null\",\"0105:   [[ -f \\\"$state_dir/verified\\\" ]] || fail VERIFY_MARKER_MISSING vm170\",\"0106:   [[ -f \\\"$state_dir/user-type-bot\\\" ]] || fail BOT_TYPE_MARKER_MISSING vm170\",\"0107:   [[ -f \\\"$state_dir/admin-flag-absent\\\" ]] || fail ADMIN_FLAG_MARKER_MISSING vm170\",\"....\",\"0120: [[ -n \\\"$plan_b64\\\" ]] || fail PLAN_MISSING \\\"$mode\\\"\",\"0121: plan_json=\\\"$(printf '%s' \\\"$plan_b64\\\" | base64 -d)\\\"\",\"0122: jq -e '\",\"0123:   .task_id==\\\"gitea-machine-identity-controlled-migration-v4\\\" and\",\"0124:   .machine_user==\\\"homelab-ops-bot\\\" and\",\"0125:   .repository==\\\"homelab-admin/homelab-ops\\\" and\",\"0126:   .permission==\\\"write\\\" and\"],\"lines\":248,\"path\":\"/root/gitea-machine-identity-controlled-migration-v4/assets/vm170-machine-identity.sh\",\"sha256\":\"6281daf0cb4cd27345b4c63f90d0c4908387d86e09f3acee371d23fc63ab3aa4\",\"timeout_records\":[{\"durations\":[\"1s\",\"3s\"],\"line\":39,\"text\":\"  captured=\\\"$(timeout --signal=TERM --kill-after=1s 3s docker \\\"$@\\\" 2>&1)\\\"\"},{\"durations\":[\"2s\"],\"line\":66,\"text\":\"  captured=\\\"$(timeout --signal=TERM --kill-after=2s \\\"$seconds_value\\\" docker exec --user git \\\"$container_id\\\" gitea \\\"$@\\\" 2>&1)\\\"\"},{\"durations\":[\"2s\",\"18s\"],\"line\":79,\"text\":\"  timeout --signal=TERM --kill-after=2s 18s docker exec --user git \\\"$container_id\\\" gitea \\\"$@\\\" >/dev/null 2>&1\"}]},\"rollback_restored\":null,\"rollback_started\":false,\"schema\":1,\"secrets_included\":false,\"stage\":\"DRY_RUN_TIMEOUT_SOURCE_CAPTURED\",\"status\":\"OK\"}\n"
 }
diff --git a/runtime/latest.txt b/runtime/latest.txt
index 810f76a..5e317de 100644
--- a/runtime/latest.txt
+++ b/runtime/latest.txt
@@ -1,34 +1,33 @@
 CHAT_OUTPUT_BEGIN
-COMMAND_ID=GITEA-V4-MACHINE-IDENTITY-MIGRATION-V5-20260730T193350Z
-STATUS=FAIL
-RC=1
+COMMAND_ID=GITEA-V4-DRY-RUN-TIMEOUT-SOURCE-PROBE-20260730T194343Z
+STATUS=OK
+RC=0
 HOST=pve01
-MODE=change
+MODE=verify
 COMPONENT=gitea-machine-identity
 REFERENCE_REGISTER_CHECK=OK
 REFERENCE_SHA256=5763f2f8edc75fcf6f3951f8c95896d1cc112ceccb6cf5b64a383f540a4deb8e
 ERROR_REGISTER_CHECK=OK
 ERROR_REGISTER_SHA256=24934a2c7fa5c26f6e828583c4aefac7f143b40c0171736ed7571e617d55ab83
-COMMAND_SHA256=5e635622291f11e949d0dcdd51755c61db105a889c01dbdef3fa2fe0958f52c0
+COMMAND_SHA256=a571191a9f200a5086dfa94a7a08706bc0babddd80e4220a0d7f85b936f88d7c
 DUPLICATE_FAILED_COMMAND_BLOCKED=false
 EXECUTION_STARTED=true
-CHANGE_DECLARED=true
+CHANGE_DECLARED=false
 RESULT_CONTRACT_VALID=true
-RESULT_CONTRACT_STATUS=FAIL
+RESULT_CONTRACT_STATUS=NOT_APPLICABLE
 RESULT_CONTRACT_ERROR=NONE
-COMMAND_RC=1
-CHANGES_MADE=true
-ROLLBACK_STARTED=true
-ROLLBACK_RESTORED=true
-MUTATION_OUTCOME=ROLLED_BACK
+COMMAND_RC=0
+CHANGES_MADE=false
+ROLLBACK_STARTED=false
+ROLLBACK_RESTORED=null
+MUTATION_OUTCOME=NO_MUTATION
 SANITIZED=yes
 SECRETS_INCLUDED=no
 PRIVATE_ADDRESSES_INCLUDED=no
-RAW_EVIDENCE_SHA256=e0bd3d90d4927d580255b86e089469ce3c4658cd16d3b9d63deb4f16bd4d9827
-SANITIZED_OUTPUT_SHA256=e0bd3d90d4927d580255b86e089469ce3c4658cd16d3b9d63deb4f16bd4d9827
+RAW_EVIDENCE_SHA256=d5b93af3b15139eeb2a8a4294b3e4031eea04f404d051eaac1501e886051d677
+SANITIZED_OUTPUT_SHA256=d5b93af3b15139eeb2a8a4294b3e4031eea04f404d051eaac1501e886051d677
 OUTPUT_BEGIN
-HOMELAB_RESULT_CONTRACT={"changes_made":true,"command_id":"GITEA-V4-MACHINE-IDENTITY-MIGRATION-V5-20260730T193350Z","rollback_restored":true,"rollback_started":true,"status":"FAIL","version":1}
-{"changes_made":true,"command_id":"GITEA-V4-MACHINE-IDENTITY-MIGRATION-V5-20260730T193350Z","credential_partition":{"original_sha256":"fc18813a7f008130cbc291df849b8c72359985ef697717460fbc39d2056be2b1","residual_bytes":68,"residual_sha256":"10d1a19537be0dd0dd1ab37cd4a1e5e239c1970a4d16d65aaa7ae7edf2739ec0","target_bytes":69,"target_sha256":"b52c89cef273de1aa4afc607ee5d4323ef88553ed4b94da24df049b2251f03d8"},"error":"RuntimeError: phase failed: dry-run retry rc=142","failed_phase":"dry-run","mutation_outcome":"ROLLED_BACK","package":{"admin_sha256":"5398600c15b63f3872116e6d1ae6f65e2d7a5d1752349c9de0de07d801967bd1","phase_hashes":{"apply":"c2cee33db773dd58b0eadb0405c33933773a559b150ad478aa9c0018dac762e3","dry-run":"c5edfe7553ffb7f44a80dd530b805fb732ee0e09097f5b3a6ca77d1f9bc27329","preflight":"2ca95ea8d0871351133f946d481665c059b4533c2ec80ea35d81424d7b1d5f7a","prepare":"d7cc381878e06f0896219616354c70b042c227ab6254d6a9a36061cc24c13f8c","rollback":"2b801fcea7096cdefe2cd294175d1d48ac3dfb394776dbda52299ded470fee0e","seal":"c88cb5e9f63aac3888e3822a5eab9e2456b04f5eda16756f626a664eb558c0bc","verify":"e57af844675486bb897dd05cfd529bc618c6f32fec9a9257eeeaca1748cbb7cc"},"sha256_check_stdout_sha256":"edc33fce6cfbf4052ebe804dee6cb9f86d114eb0953f2dba3b5fa9148af70fb3","sha256s_sha256":"0aa34f98ccb74f2a8c00460781f56f7b29805e21a284e59a8052936f8dcdc511","task_sha256":"10fa2a21164397e2d28f6a44c452c431e64e3cafadd2b4e8098a060c30fab5d9","v3_block_rc":64,"validation_stdout_sha256":"cce2200e849fd3b7418a9dc011e5566097c620f46da0e2520ea380f2c883e3de"},"phases":[{"duration_seconds":0.425,"phase":"preflight","rc":0,"safe_stderr":[],"safe_stdout":["LINT_STATUS=OK","TASK_ID=gitea-machine-identity-controlled-migration-v4","POLICY_ID=homelab-admin-guardrails-v1.2","RULES_CHECKED=14","SOURCE_FILES_CHECKED=11","GITEA_MACHINE_IDENTITY_MIGRATION_V3_TESTS=OK","REG_157_PREFLIGHT_GITEA_CLI=BLOCKED","REG_158_AGGREGATE_SSH_TIMEOUT_UNCLASSIFIED=BLOCKED","REG_159_BOOTSTRAP_ADMINISTRATOR=BLOCKED","REG_162_LEGACY_REPO_ADMIN_REQUIRED=BLOCKED","REG_163_REPOSITORY_ONLY_SCOPE_REQUIRED=BLOCKED","REG_164_USER_SCOPE_ACCESS=BLOCKED","REG_165_TASK_OWNED_REMOTE_CLEANUP=BLOCKED","REG_166_REPOSITORY_SPECIFIC_HELPER_REQUIRED=BLOCKED","REG_167_PROTECTED_WORKTREE_PUSH_DISABLED=BLOCKED","REG_168_PHASE_RUN_DIR_ISOLATION=BLOCKED","REG_014_GITEA_VERSION_AUTHENTICATION=BLOCKED","REG_015_GITEA_OWNER_PERMISSION=BLOCKED","PREFLIGHT_STATUS=OK","ROOT_CAUSE_COUNT=0","LEGACY_IDENTITY_API=OK","LEGACY_REPOSITORY_PERMISSION=admin","MACHINE_USER_STATE=ABSENT","PREFLIGHT_GITEA_CLI_CALLS=0","FAILED_UNIT_COUNT=2","FAILED_UNIT_POLICY=EXACT_KNOWN_UNRELATED_ALLOWLIST","PACKAGE_TESTS=OK","PRODUCTION_CHANGED=NO","RUN_DIR=/var/lib/homelab-admin/runs/gitea-machine-identity-controlled-migration-v4/20260730T193425Z-2497470-preflight","RUN_RC=0"],"stderr_bytes":0,"stderr_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","stdout_bytes":1188,"stdout_sha256":"19de4ada678b1e607f244da9587ab0c899d3bf3543cc18ede79e6c83bd7f6341"},{"duration_seconds":0.203,"phase":"prepare","rc":0,"safe_stderr":[],"safe_stdout":["LINT_STATUS=OK","TASK_ID=gitea-machine-identity-controlled-migration-v4","POLICY_ID=homelab-admin-guardrails-v1.2","RULES_CHECKED=14","SOURCE_FILES_CHECKED=11","PREPARE_STATUS=OK","ROOT_CAUSE_COUNT=0","VM170_PINNED_HOST_KEY_READY=YES","LEGACY_GIT_CONFIG_BACKED_UP=YES","MIGRATION_PLAN_READY=YES","ROLLBACK_PLAN_READY=YES","PRODUCTION_CHANGED=NO","RUN_DIR=/var/lib/homelab-admin/runs/gitea-machine-identity-controlled-migration-v4/20260730T193425Z-2497585-prepare","RUN_RC=0"],"stderr_bytes":0,"stderr_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","stdout_bytes":485,"stdout_sha256":"b552687b70b07a0107ec67fa4330bc05a2a1b02f334011951e5a382e3397f32a"},{"duration_seconds":10.526,"phase":"dry-run-initial","rc":142,"safe_stderr":[],"safe_stdout":["LINT_STATUS=OK","TASK_ID=gitea-machine-identity-controlled-migration-v4","POLICY_ID=homelab-admin-guardrails-v1.2","RULES_CHECKED=14","SOURCE_FILES_CHECKED=11","GITEA_MACHINE_IDENTITY_MIGRATION_V3_TESTS=OK","REG_157_PREFLIGHT_GITEA_CLI=BLOCKED","REG_158_AGGREGATE_SSH_TIMEOUT_UNCLASSIFIED=BLOCKED","REG_159_BOOTSTRAP_ADMINISTRATOR=BLOCKED","REG_162_LEGACY_REPO_ADMIN_REQUIRED=BLOCKED","REG_163_REPOSITORY_ONLY_SCOPE_REQUIRED=BLOCKED","REG_164_USER_SCOPE_ACCESS=BLOCKED","REG_165_TASK_OWNED_REMOTE_CLEANUP=BLOCKED","REG_166_REPOSITORY_SPECIFIC_HELPER_REQUIRED=BLOCKED","REG_167_PROTECTED_WORKTREE_PUSH_DISABLED=BLOCKED","REG_168_PHASE_RUN_DIR_ISOLATION=BLOCKED","REG_014_GITEA_VERSION_AUTHENTICATION=BLOCKED","REG_015_GITEA_OWNER_PERMISSION=BLOCKED","ROOT_CAUSE=UNEXPECTED_PHASE_ERROR","ROOT_CAUSE_COUNT=1","DETAIL=line:43 rc:142","RUN_DIR=/var/lib/homelab-admin/runs/gitea-machine-identity-controlled-migration-v4/20260730T193425Z-2497675-dry-run","RUN_RC=142"],"stderr_bytes":0,"stderr_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","stdout_bytes":1002,"stdout_sha256":"5abdd5abc86a3b54da0974d81881880831cc3a1b90a8a4baf487689cc056e136"},{"duration_seconds":10.376,"phase":"dry-run-retry-60s","rc":142,"safe_stderr":[],"safe_stdout":["LINT_STATUS=OK","TASK_ID=gitea-machine-identity-controlled-migration-v4","POLICY_ID=homelab-admin-guardrails-v1.2","RULES_CHECKED=14","SOURCE_FILES_CHECKED=11","GITEA_MACHINE_IDENTITY_MIGRATION_V3_TESTS=OK","REG_157_PREFLIGHT_GITEA_CLI=BLOCKED","REG_158_AGGREGATE_SSH_TIMEOUT_UNCLASSIFIED=BLOCKED","REG_159_BOOTSTRAP_ADMINISTRATOR=BLOCKED","REG_162_LEGACY_REPO_ADMIN_REQUIRED=BLOCKED","REG_163_REPOSITORY_ONLY_SCOPE_REQUIRED=BLOCKED","REG_164_USER_SCOPE_ACCESS=BLOCKED","REG_165_TASK_OWNED_REMOTE_CLEANUP=BLOCKED","REG_166_REPOSITORY_SPECIFIC_HELPER_REQUIRED=BLOCKED","REG_167_PROTECTED_WORKTREE_PUSH_DISABLED=BLOCKED","REG_168_PHASE_RUN_DIR_ISOLATION=BLOCKED","REG_014_GITEA_VERSION_AUTHENTICATION=BLOCKED","REG_015_GITEA_OWNER_PERMISSION=BLOCKED","ROOT_CAUSE=UNEXPECTED_PHASE_ERROR","ROOT_CAUSE_COUNT=1","DETAIL=line:43 rc:142","RUN_DIR=/var/lib/homelab-admin/runs/gitea-machine-identity-controlled-migration-v4/20260730T193436Z-2497880-dry-run","RUN_RC=142"],"stderr_bytes":0,"stderr_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","stdout_bytes":1002,"stdout_sha256":"20511a6ce19e3f8359c9722c78115ed98ee1687329ef3c772409933f1148dbe3"}],"rc":1,"rollback_restored":true,"rollback_started":true,"schema":1,"seal_started":false,"secrets_included":false,"status":"FAIL","wrapper_recovery_state_retained":false}
+{"capability_branch":[],"changes_made":false,"command_id":"GITEA-V4-DRY-RUN-TIMEOUT-SOURCE-PROBE-20260730T194343Z","dry_run":{"bytes":2784,"interesting_context":["0004: on_err(){","0005:   local rc=$?","0006:   trap - ERR","0007:   printf 'ROOT_CAUSE=UNEXPECTED_PHASE_ERROR","0008: '","0009:   printf 'ROOT_CAUSE_COUNT=1","0010: '","0011:   printf 'DETAIL=line:%s rc:%s","0012: ' \"${1:-0}\" \"$rc\"","0013:   exit \"$rc\"","0014: }","0015: trap 'on_err \"$LINENO\"' ERR","0016: ","0017: TASK_ID=\"gitea-machine-identity-controlled-migration-v4\"","0018: STAGING=\"/var/lib/homelab-admin/staging/$TASK_ID\"","0019: PINNED=\"$STAGING/known_hosts.vm170\"","0020: REMOTE=\"https://git.gram1.ru/homelab-admin/homelab-ops.git\"","0021: CREDENTIAL_FILE=\"/etc/homelab-admin/credentials/gitea-homelab-ops\"","0022: HELPER_FILE=\"/usr/local/libexec/homelab-git-credential\"","0023: ","0024: OUT=\"$HOMELAB_RUN_DIR/vm170-capability.txt\"","....","0034: host=git.gram1.ru","0035: path=unrelated/repo.git","0036: ","0037: ' | \"$HOMELAB_TASK_DIR/assets/git-credential-helper.sh\" get | grep -q . && { printf 'ROOT_CAUSE=HELPER_LEAKS_TO_UNRELATED_REPO","0038: ROOT_CAUSE_COUNT=1","0039: '; exit 1; } || true","0040: ","0041: ","0042: set +e","0043: timeout --signal=TERM --kill-after=2s 24s ssh \\","0044:   -o BatchMode=yes \\","0045:   -o ConnectTimeout=6 \\","0046:   -o IdentitiesOnly=yes \\","0047:   -o IdentityFile=[SENSITIVE_SSH_PATH] \\","0048:   -o StrictHostKeyChecking=yes \\","0049:   -o UserKnownHostsFile=\"$PINNED\" \\","0050:   root@[PRIVATE_IP] \\","0051:   'bash -s --' capability \"$TASK_ID\" \"$plan_b64\" \\","0052:   <\"$HOMELAB_TASK_DIR/assets/vm170-machine-identity.sh\" \\","0053:   >\"$OUT\" 2>&1","0054: ssh_rc=$?","0055: set -e","0056: case \"$ssh_rc\" in","0057:   0) ;;","0058:   124|137|143)","0059:     printf 'ROOT_CAUSE=VM170_CAPABILITY_SSH_TIMEOUT","0060: ROOT_CAUSE_COUNT=1","0061: DETAIL=24s","0062: '","0063:     exit 1","0064:     ;;","0065:   *)","0066:     sed -n '/^[A-Z][A-Z0-9_]*=/p' \"$OUT\"","0067:     printf 'ROOT_CAUSE=VM170_CAPABILITY_FAILED","0068: ROOT_CAUSE_COUNT=1","0069: DETAIL=rc:%s","0070: ' \"$ssh_rc\"","0071:     exit \"$ssh_rc\"","0072:     ;;","0073: esac","0074: ","....","0076: grep -Fq 'GITEA_CLI_CALLS=1' \"$OUT\"","0077: grep -Fq 'PASSWORD_FLAGS_FOR_BOT=ABSENT_BY_PLAN' \"$OUT\"","0078: ","0079: jq -n --arg task_id \"$TASK_ID\" '{status:\"OK\",root_cause_count:0,task_id:$task_id,production_changed:false,bot_capability:true,single_call_material_capability:true,password_flags_for_bot:false,helper_scope_contract:true,gitea_cli_calls:1,package_tests:true}' >\"$HOMELAB_RUN_DIR/dry-run.json\"","0080: printf 'DRY_RUN_STATUS=OK","0081: '","0082: printf 'ROOT_CAUSE_COUNT=0","0083: '","0084: printf 'GITEA_BOT_USER_CAPABILITY=YES","0085: '"],"lines":97,"path":"/root/gitea-machine-identity-controlled-migration-v4/phases/dry-run.sh","sha256":"c5edfe7553ffb7f44a80dd530b805fb732ee0e09097f5b3a6ca77d1f9bc27329","timeout_records":[{"durations":["2s","24s"],"line":43,"text":"timeout --signal=TERM --kill-after=2s 24s ssh \\"},{"durations":[],"line":45,"text":"  -o ConnectTimeout=6 \\"}]},"dry_run_lines_34_65":["0034: host=git.gram1.ru","0035: path=unrelated/repo.git","0036: ","0037: ' | \"$HOMELAB_TASK_DIR/assets/git-credential-helper.sh\" get | grep -q . && { printf 'ROOT_CAUSE=HELPER_LEAKS_TO_UNRELATED_REPO","0038: ROOT_CAUSE_COUNT=1","0039: '; exit 1; } || true","0040: ","0041: ","0042: set +e","0043: timeout --signal=TERM --kill-after=2s 24s ssh \\","0044:   -o BatchMode=yes \\","0045:   -o ConnectTimeout=6 \\","0046:   -o IdentitiesOnly=yes \\","0047:   -o IdentityFile=[SENSITIVE_SSH_PATH] \\","0048:   -o StrictHostKeyChecking=yes \\","0049:   -o UserKnownHostsFile=\"$PINNED\" \\","0050:   root@[PRIVATE_IP] \\","0051:   'bash -s --' capability \"$TASK_ID\" \"$plan_b64\" \\","0052:   <\"$HOMELAB_TASK_DIR/assets/vm170-machine-identity.sh\" \\","0053:   >\"$OUT\" 2>&1","0054: ssh_rc=$?","0055: set -e","0056: case \"$ssh_rc\" in","0057:   0) ;;","0058:   124|137|143)","0059:     printf 'ROOT_CAUSE=VM170_CAPABILITY_SSH_TIMEOUT","0060: ROOT_CAUSE_COUNT=1","0061: DETAIL=24s","0062: '","0063:     exit 1","0064:     ;;","0065:   *)"],"mutation_outcome":"NO_MUTATION","next_stage":"PATCH_EXACT_INTERNAL_TIMEOUT_AND_RUN_MIGRATION","output_truncated_in_json":false,"private_addresses_included":false,"rc":0,"remote_asset":{"bytes":7616,"interesting_context":["0002: set -Eeuo pipefail","0003: ","0004: fail(){","0005:   printf 'ROOT_CAUSE=%s","0006: ROOT_CAUSE_COUNT=1","0007: DETAIL=%s","0008: ' \"$1\" \"$2\"","0009:   exit 1","0010: }","....","0014: task_id=\"$2\"","0015: plan_b64=\"${3:-}\"","0016: ","0017: [[ \"$task_id\" == \"gitea-machine-identity-controlled-migration-v4\" ]] || fail TASK_ID_MISMATCH \"$task_id\"","0018: case \"$mode\" in","0019:   capability|apply|verify-state|rollback|cleanup-owned|seal) ;;","0020:   *) fail INVALID_MODE \"$mode\" ;;","....","0036:   shift","0037:   local captured rc","0038:   set +e","0039:   captured=\"$(timeout --signal=TERM --kill-after=1s 3s docker \"$@\" 2>&1)\"","0040:   rc=$?","0041:   set -e","0042:   case \"$rc\" in","....","0048: }","0049: ","0050: find_container(){","0051:   container_id=\"$(docker_capture container-discovery ps --filter 'ancestor=docker.gitea.com/gitea:1.26.2' --format '{{.ID}}')\"","0052:   [[ \"$(printf '%s","0053: ' \"$container_id\" | awk 'NF{n++} END{print n+0}')\" -eq 1 ]] ||","0054:     fail GITEA_CONTAINER_CARDINALITY vm170","0055:   image_value=\"$(docker_capture container-inspect inspect \"$container_id\" --format '{{.Config.Image}}')\"","0056:   [[ \"$image_value\" == 'docker.gitea.com/gitea:1.26.2' ]] ||","0057:     fail GITEA_IMAGE_MISMATCH \"$image_value\"","0058: }","0059: ","....","0063:   shift 2","0064:   local captured rc","0065:   set +e","0066:   captured=\"$(timeout --signal=TERM --kill-after=2s \"$seconds_value\" docker exec --user git \"$container_id\" gitea \"$@\" 2>&1)\"","0067:   rc=$?","0068:   set -e","0069:   case \"$rc\" in","....","0076: ","0077: gitea_quiet_best_effort(){","0078:   set +e","0079:   timeout --signal=TERM --kill-after=2s 18s docker exec --user git \"$container_id\" gitea \"$@\" >/dev/null 2>&1","0080:   local rc=$?","0081:   set -e","0082:   return \"$rc\"","....","0101: if [[ \"$mode\" == 'seal' ]]; then","0102:   [[ -n \"$plan_b64\" ]] || fail PLAN_MISSING seal","0103:   plan_json=\"$(printf '%s' \"$plan_b64\" | base64 -d)\"","0104:   jq -e '.task_id==\"gitea-machine-identity-controlled-migration-v4\" and .machine_user==\"homelab-ops-bot\"' <<<\"$plan_json\" >/dev/null","0105:   [[ -f \"$state_dir/verified\" ]] || fail VERIFY_MARKER_MISSING vm170","0106:   [[ -f \"$state_dir/user-type-bot\" ]] || fail BOT_TYPE_MARKER_MISSING vm170","0107:   [[ -f \"$state_dir/admin-flag-absent\" ]] || fail ADMIN_FLAG_MARKER_MISSING vm170","....","0120: [[ -n \"$plan_b64\" ]] || fail PLAN_MISSING \"$mode\"","0121: plan_json=\"$(printf '%s' \"$plan_b64\" | base64 -d)\"","0122: jq -e '","0123:   .task_id==\"gitea-machine-identity-controlled-migration-v4\" and","0124:   .machine_user==\"homelab-ops-bot\" and","0125:   .repository==\"homelab-admin/homelab-ops\" and","0126:   .permission==\"write\" and"],"lines":248,"path":"/root/gitea-machine-identity-controlled-migration-v4/assets/vm170-machine-identity.sh","sha256":"6281daf0cb4cd27345b4c63f90d0c4908387d86e09f3acee371d23fc63ab3aa4","timeout_records":[{"durations":["1s","3s"],"line":39,"text":"  captured=\"$(timeout --signal=TERM --kill-after=1s 3s docker \"$@\" 2>&1)\""},{"durations":["2s"],"line":66,"text":"  captured=\"$(timeout --signal=TERM --kill-after=2s \"$seconds_value\" docker exec --user git \"$container_id\" gitea \"$@\" 2>&1)\""},{"durations":["2s","18s"],"line":79,"text":"  timeout --signal=TERM --kill-after=2s 18s docker exec --user git \"$container_id\" gitea \"$@\" >/dev/null 2>&1"}]},"rollback_restored":null,"rollback_started":false,"schema":1,"secrets_included":false,"stage":"DRY_RUN_TIMEOUT_SOURCE_CAPTURED","status":"OK"}
 
 OUTPUT_END
 CHAT_OUTPUT_END