# WG Paid / MGTS — Proven Invariants and Retest Triggers

**Updated:** 2026-08-24  
**Purpose:** prevent unnecessary regressions. A proof remains reusable until a later delta invalidates the assumption it proved.

## Rule

Before adding any regression check ask:

> What exact new risk made the accepted proof below insufficient?

If there is no concrete answer, do not repeat the proof.

| Area | Accepted proof/current invariant | May rely on without repeating | Retest when |
|---|---|---|---|
| VM101 five-slot topology | Five canonical egress slots and selector mapping are established | `egress1..5` / `vpn1..5` / tables 201..205 / cs mapping | changing slot topology, PBR/mark mapping, VM101 egress architecture |
| Zero-healthy recovery | R20Q-S proved zero healthy -> Direct -> cached bootstrap/HMN refresh -> new healthy generation -> topology reconciliation -> Direct exit | autonomous recovery chain | changing recovery dispatcher, bootstrap, generation activation, Direct handoff or provider refresh semantics |
| VM100 peer lifecycle | synthetic/live provisioning work and P27C proved VM100 peer creation/presence and registry consistency | profile provisioning reaches actual `wg_paid` peer | changing VM100 peer apply/remove, registry format, provisioning adapter boundary |
| VM100 selector/nft plumbing | selector registry/nft/PBR mechanism and canonical cs mapping are established | marking mechanism itself remains valid | changing selector/nft/PBR implementation. **Active-vs-idle allocation semantics are a known pending correction and require focused tests when changed** |
| Public WG path | P26C2 external WG and later production checks proved Internet -> VM101 -> VM100 | public endpoint/DNAT works | changing public UDP DNAT, VM101 WAN, VM100 WG listener or relevant firewall |
| Production SMTP | P26C3B proved application SMTP delivery; later P27C real mail delivered | mail.nic.ru TLS/application delivery works | changing SMTP config/secret/mailer, provider, network path to SMTP |
| Browser magic-link/session | P26C4K and P27C proved real mailbox -> external browser -> fragment consume -> session | browser/session activation path | changing VM103 login/magic pages, public proxy, VM121 auth/session/token behavior |
| Magic-token secrecy | fragment transport and public evidence boundary established | raw token should not appear in initial URL/report/log | changing browser consume flow, logging or proxy behavior |
| Public VM103 ingress | P27A/P27B proved TCP 80/443 -> VM103, trusted TLS, open-onboarding read-only health semantics | VM103 is current public web ingress | changing VM101 80/443 DNAT, VM103 Caddy/public host config or network address |
| Access proxy boundary | account/auth exposed as intended; admin/agent non-public | `/v2/admin/*` and `/v2/agent/*` should remain absent publicly | changing Caddy proxy routes or VM121 public API routing |
| Authenticated config delivery | P27C R05 proved config retrieval and `Cache-Control: no-store` | profile config path works and private material is not published | changing profile delivery/auth/config rendering/cache headers |
| First production user | P27C R03/R06 created and preserved intended real user/profile/credential/job/peer/session state | do not recreate/delete merely for proof | only if explicit product change requires user-state migration or recovery |
| P27C helper cleanup | R06 removed helper auth rows while preserving real browser session | helper artifacts are not part of accepted production state | changing closure/cleanup logic or discovering real data inconsistency |
| VM103 monitoring | P27B R02 core + R03 closure established read-only open-onboarding health semantics | no login-request POST for ordinary health | changing VM103 health helper/role expectations or public onboarding mode |
| Machine Git canonical close | GitHub-backed commit -> independent VM130 HTTPS checkout -> archive/publication accepted across machine sources | use existing close/publish flow | changing Machine Git/repository/publication implementation |
| VM130 bundle gates | current release-contract, R17, R19, R20 and verify-only workflow are accepted | reuse rather than recreate validation | changing release schema/gates/bootstrap |
| VM130 incoming retention | P27C0H established retained STEP ZIP/Latest hygiene | old Latest need not remain in incoming | changing retention/incoming/finalization behavior |
| VM130 bootstrap post-PASS hardening | P27CH R01 fixed post-PASS ordering and already-retained idempotence | successful core is not invalidated by old bootstrap defect | changing bootstrap cleanup/retention/final ordering |
| Class C backup model | synthetic Class C proved exact restore; P27C used intended `PERSIST` semantics | backup is for recovery, not automatic success rollback | changing DB mutation/restore framework or schema migration behavior |
| VM121 ownership model | account/profile/credential/job authority remains VM121; peer/selector authority remains VM100 | protocol work reuses same business model | moving authority across machines or changing Domain V2 ownership |

## Known non-invariant / open architecture item

The current VM100 allocator behavior that balances total registered selector population is **not** a desired invariant. It is the known architectural drift to correct.

Desired future invariant after its dedicated VM100 STEP:

```text
selector load = ACTIVE peers only
idle peers contribute zero load
idle -> active chooses current least-loaded selector
deterministic tie-break
active peer remains stable during active period
```

Do not treat the current total-registry balancing behavior as something to preserve in regression testing.

## Durable evidence rule

When old proof detail is needed, retrieve the retained exact STEP ZIP/report/history on VM130 by immutable identity/SHA. Do not expand this file with R01/R02/R03 narratives.