=== STEP_037A3 CREATE CS2 FROM KNOWN GOOD ===
timestamp=20260708-133626
mode=guarded create second WGPay test peer using previous successful payload shape
why=A2 got HTTP 422; likely request schema/email/plan_code mismatch
target=second canary for future cs2 -> 0x204 -> vpn4 proof
forbidden: selector changes, mapper changes, policy switch, backend restart, network/firewall reload
=== VM121 guarded create from known-good payload ===
remote_backup_dir=/root/router-ops-backups/canary-test-subscription-cs2-knowngood-20260708-133626
private_create_json=/root/router-ops-backups/canary-test-subscription-cs2-knowngood-20260708-133626/create-full.private.json

=== backend health ===
{"status":"ok","service":"wg-access-backend","environment":"dev"}
{"status":"ok","db":1}

=== before counts / duplicate guard ===
peers_before_curl_rc=0
jobs_before_curl_rc=0
peer_count_before=21
enabled_peer_count_before=1
job_count_before=37
pending_job_count_before=0
existing_canary_enabled_count=1
create_guard_safe=1
create_guard_safe_final=1

=== inspect previous known-good request ===
known_good_request_source=
known_good_request_found=0
create_skipped_no_known_good_request=1
vm121_create_done=1

=== VM100 read-only verify cs2 peer applied, selector unchanged ===
vm100_wg_paid_peer_count=missing_cs2_ip
vm100_existing_canary_visible_rc=missing_cs2_ip
vm100_cs2_peer_visible_rc=missing_cs2_ip
vm100_selector_active_entry_count=missing_cs2_ip
vm100_selector_has_cs2_ip_rc=missing_cs2_ip
vm100_selector_rule_visible_rc=missing_cs2_ip

=== STEP_037A3 RESULT ===
create_guard_safe_final=1
known_good_request_found=0
derive_request_rc=
create_curl_rc=
create_http_code=
cs2_parse_ok=
cs2_parse_script_rc=
cs2_parse_reasons=
cs2_subscription_id=
cs2_peer_id=
cs2_tunnel_ip=
agent_start_rc=
peer_count_after=
enabled_peer_count_after=
enabled_peer_count_delta=
new_enabled_peer_count=
pending_job_count_after=
cs2_peer_found=
cs2_peer_enabled=
cs2_tunnel_ip_matches=
cs2_job_found=
cs2_job_status=
endpoint_final_lines=0
vm100_wg_paid_peer_count=missing_cs2_ip
vm100_existing_canary_visible_rc=missing_cs2_ip
vm100_cs2_peer_visible_rc=missing_cs2_ip
vm100_selector_active_entry_count=missing_cs2_ip
vm100_selector_has_cs2_ip_rc=missing_cs2_ip
vm100_selector_rule_visible_rc=missing_cs2_ip
rollback_vm121=/root/rollback-step037a3-cs2-test-peer.sh
decision=BLOCK_SAFETY_PROOF_MISSING