=== STEP_037B ADD CS2 SELECTOR ENTRY ===
timestamp=20260708-134547
mode=VM100 selector file add one cs2 test peer
add_selector_entry=10.253.1.11 cs2 canary_vpn4
expected_future_path=cs2 -> 0x204 -> vpn4
forbidden: VM101 writes, mapper changes, policy changes, peer changes, backend restart, network/firewall reload
=== VM100 apply selector entry ===
date=Wed Jul  8 13:45:47 UTC 2026
backup_dir=/root/router-ops-backups/step037b-add-cs2-selector-20260708-134547

=== guards before change ===
guard_selector_file_exists_rc=0
guard_selector_apply_exists_rc=0
guard_selector_init_exists_rc=0
guard_selector_service_enabled_rc=0
guard_existing_canary_entry_rc=0
guard_cs2_entry_before_rc=1
selector_active_entry_count_before=1
guard_existing_canary_in_wg_paid_rc=0
guard_cs2_peer_in_wg_paid_rc=0
wg_paid_peer_count_before=2
guard_selector_script_supports_multiclass_rc=0
uci_changes_before_rc=0

=== backups ===
backup_done=1

=== rollback script ===
rollback_vm100=/root/rollback-step037b-cs2-selector-entry.sh

=== add selector entry ===
selector_append_rc=0

=== start selector service ===
applied_vm100_wgpay_selector_rules=2
selector_service_start_rc=0

=== verify selector after ===
selector_service_enabled_rc=0
existing_canary_entry_rc=0
cs2_selector_entry_rc=0
selector_active_entry_count_after=2
nft_existing_canary_rule_visible_rc=0
nft_cs2_rule_visible_rc=0
nft_cs2_rule_or_selector_comment_rc=0
cs2_peer_in_wg_paid_rc=0
wg_paid_peer_count_after=2

=== active selector file ===
# router WGPay selector file
# format: tunnel_ip dscp_class comment
# STEP_035B: one proven canary only, no production-wide switch
10.253.1.10 cs1 canary_vpn3

# STEP_037B: second canary for cs2 -> vpn4
10.253.1.11 cs2 canary_vpn4

=== active selector nft table ===
table inet wgpay_dscp_canary {
	chain prerouting {
		type filter hook prerouting priority mangle; policy accept;
		iifname "wg_paid" ip saddr 10.253.1.10 ip dscp set cs1 counter packets 0 bytes 0 comment "STEP_035B_SELECTOR_WGPAY_canary_vpn3_10.253.1.10_cs1"
		iifname "wg_paid" ip saddr 10.253.1.11 ip dscp set cs2 counter packets 0 bytes 0 comment "STEP_035B_SELECTOR_WGPAY_canary_vpn4_10.253.1.11_cs2"
	}
}

=== UCI changes after ===
uci_changes_after_rc=0

=== no forbidden action proof VM100 ===
no_wg_reload=1
no_network_reload=1
no_firewall_reload=1
no_peer_change=1
vm100_selector_done=1

=== VM101 read-only verify 5-class mapper unchanged ===
vm101_egress_slots_service_enabled_rc=0
vm101_mapper_service_enabled_rc=0
vm101_prerouting_mapper_rule_count=5
vm101_postrouting_clear_rule_count=5
vm101_mark0x201_route_vpn1_rc=0
vm101_mark0x202_route_vpn2_rc=0
vm101_mark0x203_route_vpn3_rc=0
vm101_mark0x204_route_vpn4_rc=0
vm101_mark0x205_route_vpn5_rc=0
vm101_table200_default_vpn1_rc=0
no_remote_write_vm101=1
no_mapper_change_vm101=1
no_policy_change_vm101=1
vm101_readonly_verify_done=1

=== VM121 read-only verify cs2 backend state ===
vm121_peers_curl_rc=0
vm121_jobs_curl_rc=0
vm121_peer_count=22
vm121_enabled_peer_count=2
vm121_pending_job_count=0
vm121_cs2_peer_found=True
vm121_cs2_peer_enabled=True
vm121_cs2_peer_tunnel_ip=10.253.1.11
vm121_cs2_tunnel_ip_matches=True
no_backend_restart=1
no_peer_disable=1
vm121_readonly_verify_done=1

=== STEP_037B RESULT ===
cs2_tunnel_ip=10.253.1.11
selector_append_rc=0
selector_service_start_rc=0
selector_service_enabled_rc=0
existing_canary_entry_rc=0
cs2_selector_entry_rc=0
selector_active_entry_count_before=1
selector_active_entry_count_after=2
nft_existing_canary_rule_visible_rc=0
nft_cs2_rule_visible_rc=0
wg_paid_peer_count_after=2
cs2_peer_in_wg_paid_rc=0
vm101_egress_slots_service_enabled_rc=0
vm101_mapper_service_enabled_rc=0
vm101_prerouting_mapper_rule_count=5
vm101_postrouting_clear_rule_count=5
vm101_mark0x201_route_vpn1_rc=0
vm101_mark0x202_route_vpn2_rc=0
vm101_mark0x203_route_vpn3_rc=0
vm101_mark0x204_route_vpn4_rc=0
vm101_mark0x205_route_vpn5_rc=0
vm121_peer_count=22
vm121_enabled_peer_count=2
vm121_pending_job_count=0
vm121_cs2_peer_enabled=True
rollback_vm100=/root/rollback-step037b-cs2-selector-entry.sh
decision=PASS_CS2_SELECTOR_ENTRY_APPLIED