=== STEP_037A CREATE CS2 TEST PEER ===
timestamp=20260708-133223
mode=create second real WGPay test peer through backend + agent
target=second canary for future cs2 -> 0x204 -> vpn4 proof
forbidden: selector changes, VM100 writes except agent-applied WG peer, policy switch, mapper changes, network/firewall reload
=== VM121 create subscription + apply agent ===
/tmp/step037a-create-cs2-test-peer.sh: 29: cs2_subscription_id: parameter not set

=== VM100 read-only verify cs2 peer applied, selector unchanged ===
vm100_wg_paid_peer_count=missing_cs2_ip
vm100_existing_canary_visible_rc=missing_cs2_ip
vm100_cs2_peer_visible_rc=missing_cs2_ip
vm100_selector_active_entry_count=missing_cs2_ip
vm100_selector_has_cs2_ip_rc=missing_cs2_ip
vm100_selector_rule_visible_rc=missing_cs2_ip

=== STEP_037A RESULT ===
create_curl_rc=
create_http_code=
cs2_parse_ok=
cs2_parse_script_rc=
cs2_parse_reasons=
cs2_subscription_id=
cs2_peer_id=
cs2_tunnel_ip=
agent_start_rc=
peer_count_after=
enabled_peer_count_after=
enabled_peer_count_delta=
pending_job_count_after=
cs2_peer_found=
cs2_peer_enabled=
cs2_tunnel_ip_matches=
cs2_job_found=
cs2_job_status=
endpoint_final_lines=0
vm100_wg_paid_peer_count=missing_cs2_ip
vm100_existing_canary_visible_rc=missing_cs2_ip
vm100_cs2_peer_visible_rc=missing_cs2_ip
vm100_selector_active_entry_count=missing_cs2_ip
vm100_selector_has_cs2_ip_rc=missing_cs2_ip
vm100_selector_rule_visible_rc=missing_cs2_ip
rollback_vm121=/root/rollback-step037a-cs2-test-peer.sh
decision=BLOCK_SAFETY_PROOF_MISSING