{
  "changes": {
    "backend_restart_done": "NO",
    "db_changed": "NO",
    "firewall_reload_done": "NO",
    "manager_invoked": "NO",
    "mapper_changed": "NO",
    "network_reload_done": "NO",
    "new_peer_created": "NO",
    "policy_changed": "NO",
    "private_material_published": "NO",
    "remote_commands_executed": "NO",
    "selector_changed": "NO_REMOTE_DRY_RUN_ONLY",
    "wg_reload_done": "NO"
  },
  "mode": "REMOTE_SELECTOR_APPLY_PLAN_DRY_RUN",
  "plans": {
    "bad_conflict": {
      "rc": 2,
      "result": {
        "action": "error",
        "apply_performed": false,
        "contract_valid": false,
        "error_count": 1,
        "errors": [
          "same_ip_conflict"
        ],
        "exact_line": "10.253.1.13 cs5 canary_vpn2",
        "idempotent_noop": false,
        "mode": "remote-dry-run",
        "payload_summary": {
          "fwmark": "0x202",
          "interface_name": "vpn2",
          "manager_id": "hmn_pool",
          "provider_type": "hmn_amneziawg",
          "selector_class": "cs5",
          "selector_label": "canary_vpn2",
          "slot_code": "vpn2",
          "table_id": 202,
          "tunnel_ip": "10.253.1.13"
        },
        "remote_command_count": 8,
        "remote_commands": [
          {
            "command": "test -f /etc/router-wgpay-selector.d/peers.conf",
            "expected_rc": 0,
            "name": "precheck_selector_conf_exists",
            "phase": "precheck"
          },
          {
            "command": "BACKUP='/root/peers.conf.before-agent-selector-apply-$(date +%Y%m%d-%H%M%S)'; cp /etc/router-wgpay-selector.d/peers.conf \"$BACKUP\"; echo \"$BACKUP\"",
            "expected_rc": 0,
            "name": "backup_selector_conf",
            "phase": "apply"
          },
          {
            "command": "false",
            "expected_rc": 1,
            "name": "no_apply_due_to_invalid_plan",
            "phase": "apply"
          },
          {
            "command": "ROLLBACK=/root/rollback-agent-selector-apply.sh; cat > \"$ROLLBACK\" <<'RB'\n#!/bin/sh\nset -u\n# Runtime will replace BACKUP path with actual backup emitted during apply.\n# cp /root/peers.conf.before-agent-selector-apply-YYYYmmdd-HHMMSS /etc/router-wgpay-selector.d/peers.conf\n/etc/init.d/router-wgpay-canary start\nRB\nchmod 700 \"$ROLLBACK\"",
            "expected_rc": 0,
            "name": "write_rollback_script",
            "phase": "apply"
          },
          {
            "command": "/etc/init.d/router-wgpay-canary start",
            "expected_rc": 0,
            "name": "start_selector_service",
            "phase": "apply"
          },
          {
            "command": "LINE='10.253.1.13 cs5 canary_vpn2'; grep -Fxq \"$LINE\" /etc/router-wgpay-selector.d/peers.conf",
            "expected_rc": 0,
            "name": "postcheck_selector_line_present",
            "phase": "postcheck"
          },
          {
            "command": "/etc/init.d/router-wgpay-canary enabled",
            "expected_rc": 0,
            "name": "postcheck_selector_service_enabled",
            "phase": "postcheck"
          },
          {
            "command": "nft -a list ruleset 2>/dev/null | grep -q '10.253.1.13.*cs5'",
            "expected_rc": 0,
            "name": "postcheck_nft_rule_visible_after_service_start",
            "phase": "postcheck"
          }
        ],
        "remote_commands_executed": false,
        "requires_wg_peer_before_real_apply": true,
        "rollback_command_count": 2,
        "rollback_commands": [
          {
            "command": "cp /root/peers.conf.before-agent-selector-apply-YYYYmmdd-HHMMSS /etc/router-wgpay-selector.d/peers.conf",
            "expected_rc": 0,
            "name": "restore_selector_backup"
          },
          {
            "command": "/etc/init.d/router-wgpay-canary start",
            "expected_rc": 0,
            "name": "restart_selector_service_after_restore"
          }
        ],
        "rollback_path": "/root/rollback-agent-selector-apply.sh",
        "schema": "wg-access-agent-selector-remote-plan-v1",
        "selector_plan": {
          "action": "error",
          "apply_performed": false,
          "contract_valid": false,
          "errors": [
            "same_ip_conflict"
          ],
          "exact_line": "10.253.1.13 cs5 canary_vpn2",
          "exact_present": false,
          "idempotent_noop": false,
          "mode": "dry-run",
          "payload_summary": {
            "fwmark": "0x202",
            "interface_name": "vpn2",
            "manager_id": "hmn_pool",
            "peer_id": "DRY_RUN_BAD_PEER_ID",
            "provider_type": "hmn_amneziawg",
            "selector_class": "cs5",
            "selector_label": "canary_vpn2",
            "slot_code": "vpn2",
            "subscription_id": "DRY_RUN_BAD_SUBSCRIPTION_ID",
            "table_id": 202,
            "tunnel_ip": "10.253.1.13"
          },
          "same_ip_conflict_count": 1,
          "same_selector_class_conflict_count": 0,
          "same_selector_label_conflict_count": 0,
          "schema": "wg-access-agent-selector-apply-plan-v1",
          "selector_entry_count_after_planned": 4,
          "selector_entry_count_before": 4,
          "slot_status": "healthy",
          "warnings": [],
          "would_append": false
        },
        "selector_plan_rc": 2,
        "target": {
          "host": "10.71.100.1",
          "name": "vm100",
          "selector_conf": "/etc/router-wgpay-selector.d/peers.conf",
          "selector_service": "router-wgpay-canary"
        },
        "would_append": false
      }
    },
    "existing_cs4": {
      "rc": 0,
      "result": {
        "action": "noop",
        "apply_performed": false,
        "contract_valid": true,
        "error_count": 0,
        "errors": [],
        "exact_line": "10.253.1.13 cs4 canary_vpn1",
        "idempotent_noop": true,
        "mode": "remote-dry-run",
        "payload_summary": {
          "fwmark": "0x201",
          "interface_name": "vpn1",
          "manager_id": "hmn_pool",
          "provider_type": "hmn_amneziawg",
          "selector_class": "cs4",
          "selector_label": "canary_vpn1",
          "slot_code": "vpn1",
          "table_id": 201,
          "tunnel_ip": "10.253.1.13"
        },
        "remote_command_count": 8,
        "remote_commands": [
          {
            "command": "test -f /etc/router-wgpay-selector.d/peers.conf",
            "expected_rc": 0,
            "name": "precheck_selector_conf_exists",
            "phase": "precheck"
          },
          {
            "command": "BACKUP='/root/peers.conf.before-agent-selector-apply-$(date +%Y%m%d-%H%M%S)'; cp /etc/router-wgpay-selector.d/peers.conf \"$BACKUP\"; echo \"$BACKUP\"",
            "expected_rc": 0,
            "name": "backup_selector_conf",
            "phase": "apply"
          },
          {
            "command": "LINE='10.253.1.13 cs4 canary_vpn1'; CONF=/etc/router-wgpay-selector.d/peers.conf; grep -Fxq \"$LINE\" \"$CONF\"",
            "expected_rc": 0,
            "name": "verify_selector_line_already_present",
            "phase": "apply"
          },
          {
            "command": "ROLLBACK=/root/rollback-agent-selector-apply.sh; cat > \"$ROLLBACK\" <<'RB'\n#!/bin/sh\nset -u\n# Runtime will replace BACKUP path with actual backup emitted during apply.\n# cp /root/peers.conf.before-agent-selector-apply-YYYYmmdd-HHMMSS /etc/router-wgpay-selector.d/peers.conf\n/etc/init.d/router-wgpay-canary start\nRB\nchmod 700 \"$ROLLBACK\"",
            "expected_rc": 0,
            "name": "write_rollback_script",
            "phase": "apply"
          },
          {
            "command": "/etc/init.d/router-wgpay-canary start",
            "expected_rc": 0,
            "name": "start_selector_service",
            "phase": "apply"
          },
          {
            "command": "LINE='10.253.1.13 cs4 canary_vpn1'; grep -Fxq \"$LINE\" /etc/router-wgpay-selector.d/peers.conf",
            "expected_rc": 0,
            "name": "postcheck_selector_line_present",
            "phase": "postcheck"
          },
          {
            "command": "/etc/init.d/router-wgpay-canary enabled",
            "expected_rc": 0,
            "name": "postcheck_selector_service_enabled",
            "phase": "postcheck"
          },
          {
            "command": "nft -a list ruleset 2>/dev/null | grep -q '10.253.1.13.*cs4'",
            "expected_rc": 0,
            "name": "postcheck_nft_rule_visible_after_service_start",
            "phase": "postcheck"
          }
        ],
        "remote_commands_executed": false,
        "requires_wg_peer_before_real_apply": true,
        "rollback_command_count": 2,
        "rollback_commands": [
          {
            "command": "cp /root/peers.conf.before-agent-selector-apply-YYYYmmdd-HHMMSS /etc/router-wgpay-selector.d/peers.conf",
            "expected_rc": 0,
            "name": "restore_selector_backup"
          },
          {
            "command": "/etc/init.d/router-wgpay-canary start",
            "expected_rc": 0,
            "name": "restart_selector_service_after_restore"
          }
        ],
        "rollback_path": "/root/rollback-agent-selector-apply.sh",
        "schema": "wg-access-agent-selector-remote-plan-v1",
        "selector_plan": {
          "action": "noop",
          "apply_performed": false,
          "contract_valid": true,
          "errors": [],
          "exact_line": "10.253.1.13 cs4 canary_vpn1",
          "exact_present": true,
          "idempotent_noop": true,
          "mode": "dry-run",
          "payload_summary": {
            "fwmark": "0x201",
            "interface_name": "vpn1",
            "manager_id": "hmn_pool",
            "peer_id": "219a1f63-ec47-4f72-9663-c1a17d82301e",
            "provider_type": "hmn_amneziawg",
            "selector_class": "cs4",
            "selector_label": "canary_vpn1",
            "slot_code": "vpn1",
            "subscription_id": "b782fb4e-b43c-4b76-966e-28a145b80485",
            "table_id": 201,
            "tunnel_ip": "10.253.1.13"
          },
          "same_ip_conflict_count": 0,
          "same_selector_class_conflict_count": 0,
          "same_selector_label_conflict_count": 0,
          "schema": "wg-access-agent-selector-apply-plan-v1",
          "selector_entry_count_after_planned": 4,
          "selector_entry_count_before": 4,
          "slot_status": "healthy",
          "warnings": [],
          "would_append": false
        },
        "selector_plan_rc": 0,
        "target": {
          "host": "10.71.100.1",
          "name": "vm100",
          "selector_conf": "/etc/router-wgpay-selector.d/peers.conf",
          "selector_service": "router-wgpay-canary"
        },
        "would_append": false
      }
    },
    "future_cs5": {
      "rc": 0,
      "result": {
        "action": "append",
        "apply_performed": false,
        "contract_valid": true,
        "error_count": 0,
        "errors": [],
        "exact_line": "10.253.1.14 cs5 canary_vpn2",
        "idempotent_noop": false,
        "mode": "remote-dry-run",
        "payload_summary": {
          "fwmark": "0x202",
          "interface_name": "vpn2",
          "manager_id": "hmn_pool",
          "provider_type": "hmn_amneziawg",
          "selector_class": "cs5",
          "selector_label": "canary_vpn2",
          "slot_code": "vpn2",
          "table_id": 202,
          "tunnel_ip": "10.253.1.14"
        },
        "remote_command_count": 8,
        "remote_commands": [
          {
            "command": "test -f /etc/router-wgpay-selector.d/peers.conf",
            "expected_rc": 0,
            "name": "precheck_selector_conf_exists",
            "phase": "precheck"
          },
          {
            "command": "BACKUP='/root/peers.conf.before-agent-selector-apply-$(date +%Y%m%d-%H%M%S)'; cp /etc/router-wgpay-selector.d/peers.conf \"$BACKUP\"; echo \"$BACKUP\"",
            "expected_rc": 0,
            "name": "backup_selector_conf",
            "phase": "apply"
          },
          {
            "command": "LINE='10.253.1.14 cs5 canary_vpn2'; CONF=/etc/router-wgpay-selector.d/peers.conf; grep -Fxq \"$LINE\" \"$CONF\" || printf '%s\\n' \"$LINE\" >> \"$CONF\"",
            "expected_rc": 0,
            "name": "append_selector_line_if_missing",
            "phase": "apply"
          },
          {
            "command": "ROLLBACK=/root/rollback-agent-selector-apply.sh; cat > \"$ROLLBACK\" <<'RB'\n#!/bin/sh\nset -u\n# Runtime will replace BACKUP path with actual backup emitted during apply.\n# cp /root/peers.conf.before-agent-selector-apply-YYYYmmdd-HHMMSS /etc/router-wgpay-selector.d/peers.conf\n/etc/init.d/router-wgpay-canary start\nRB\nchmod 700 \"$ROLLBACK\"",
            "expected_rc": 0,
            "name": "write_rollback_script",
            "phase": "apply"
          },
          {
            "command": "/etc/init.d/router-wgpay-canary start",
            "expected_rc": 0,
            "name": "start_selector_service",
            "phase": "apply"
          },
          {
            "command": "LINE='10.253.1.14 cs5 canary_vpn2'; grep -Fxq \"$LINE\" /etc/router-wgpay-selector.d/peers.conf",
            "expected_rc": 0,
            "name": "postcheck_selector_line_present",
            "phase": "postcheck"
          },
          {
            "command": "/etc/init.d/router-wgpay-canary enabled",
            "expected_rc": 0,
            "name": "postcheck_selector_service_enabled",
            "phase": "postcheck"
          },
          {
            "command": "nft -a list ruleset 2>/dev/null | grep -q '10.253.1.14.*cs5'",
            "expected_rc": 0,
            "name": "postcheck_nft_rule_visible_after_service_start",
            "phase": "postcheck"
          }
        ],
        "remote_commands_executed": false,
        "requires_wg_peer_before_real_apply": true,
        "rollback_command_count": 2,
        "rollback_commands": [
          {
            "command": "cp /root/peers.conf.before-agent-selector-apply-YYYYmmdd-HHMMSS /etc/router-wgpay-selector.d/peers.conf",
            "expected_rc": 0,
            "name": "restore_selector_backup"
          },
          {
            "command": "/etc/init.d/router-wgpay-canary start",
            "expected_rc": 0,
            "name": "restart_selector_service_after_restore"
          }
        ],
        "rollback_path": "/root/rollback-agent-selector-apply.sh",
        "schema": "wg-access-agent-selector-remote-plan-v1",
        "selector_plan": {
          "action": "append",
          "apply_performed": false,
          "contract_valid": true,
          "errors": [],
          "exact_line": "10.253.1.14 cs5 canary_vpn2",
          "exact_present": false,
          "idempotent_noop": false,
          "mode": "dry-run",
          "payload_summary": {
            "fwmark": "0x202",
            "interface_name": "vpn2",
            "manager_id": "hmn_pool",
            "peer_id": "DRY_RUN_FUTURE_PEER_ID",
            "provider_type": "hmn_amneziawg",
            "selector_class": "cs5",
            "selector_label": "canary_vpn2",
            "slot_code": "vpn2",
            "subscription_id": "DRY_RUN_FUTURE_SUBSCRIPTION_ID",
            "table_id": 202,
            "tunnel_ip": "10.253.1.14"
          },
          "same_ip_conflict_count": 0,
          "same_selector_class_conflict_count": 0,
          "same_selector_label_conflict_count": 0,
          "schema": "wg-access-agent-selector-apply-plan-v1",
          "selector_entry_count_after_planned": 5,
          "selector_entry_count_before": 4,
          "slot_status": "healthy",
          "warnings": [],
          "would_append": true
        },
        "selector_plan_rc": 0,
        "target": {
          "host": "10.71.100.1",
          "name": "vm100",
          "selector_conf": "/etc/router-wgpay-selector.d/peers.conf",
          "selector_service": "router-wgpay-canary"
        },
        "would_append": true
      }
    }
  },
  "previous": {
    "check_tool_exists_rc": 0,
    "prev040f_check_rc": 0,
    "prev040f_facts_rc": 0
  },
  "publish": {
    "local_index": "http://192.168.30.84:8099/r/e94a0859747d7b96f29c7fdafc2d0351ba603bb0a7e9e5a4/",
    "published_dir": "/opt/router-ops/public/r/e94a0859747d7b96f29c7fdafc2d0351ba603bb0a7e9e5a4/20260708-165816_step040g_remote_selector_apply_plan_dry_run",
    "trycf_index": "https://maple-movie-urls-cigarettes.trycloudflare.com/r/e94a0859747d7b96f29c7fdafc2d0351ba603bb0a7e9e5a4/",
    "trycf_report": "https://maple-movie-urls-cigarettes.trycloudflare.com/r/e94a0859747d7b96f29c7fdafc2d0351ba603bb0a7e9e5a4/20260708-165816_step040g_remote_selector_apply_plan_dry_run/"
  },
  "schema": "router-step-facts-v1",
  "step": "STEP_040G_REMOTE_SELECTOR_APPLY_PLAN_DRY_RUN",
  "vm100_after": {
    "selector_active_lines": [
      "10.253.1.10 cs1 canary_vpn3",
      "10.253.1.11 cs2 canary_vpn4",
      "10.253.1.12 cs3 canary_vpn5",
      "10.253.1.13 cs4 canary_vpn1"
    ],
    "vm100_cs4_peer_visible_rc": 0,
    "vm100_cs5_peer_visible_rc": 1,
    "vm100_nft_cs4_rule_visible_rc": 0,
    "vm100_nft_cs5_rule_visible_rc": 1,
    "vm100_selector_active_entry_count": 4,
    "vm100_selector_conf_exists_rc": 0,
    "vm100_selector_cs4_present_rc": 0,
    "vm100_selector_cs5_any_present_rc": 1,
    "vm100_selector_cs5_exact_present_rc": 1,
    "vm100_selector_service_enabled_rc": 0,
    "vm100_wg_paid_peer_count": 4
  },
  "vm100_before": {
    "selector_active_lines": [
      "10.253.1.10 cs1 canary_vpn3",
      "10.253.1.11 cs2 canary_vpn4",
      "10.253.1.12 cs3 canary_vpn5",
      "10.253.1.13 cs4 canary_vpn1"
    ],
    "vm100_cs4_peer_visible_rc": 0,
    "vm100_cs5_peer_visible_rc": 1,
    "vm100_nft_cs4_rule_visible_rc": 0,
    "vm100_nft_cs5_rule_visible_rc": 1,
    "vm100_selector_active_entry_count": 4,
    "vm100_selector_conf_exists_rc": 0,
    "vm100_selector_cs4_present_rc": 0,
    "vm100_selector_cs5_any_present_rc": 1,
    "vm100_selector_cs5_exact_present_rc": 1,
    "vm100_selector_service_enabled_rc": 0,
    "vm100_wg_paid_peer_count": 4
  },
  "vm101": {
    "slots": {
      "vpn1": {
        "fwmark": "0x201",
        "interface_name": "vpn1",
        "label": "canary_vpn1",
        "selector_class": "cs4",
        "status": "healthy",
        "table_id": 201
      },
      "vpn2": {
        "fwmark": "0x202",
        "interface_name": "vpn2",
        "label": "canary_vpn2",
        "selector_class": "cs5",
        "status": "healthy",
        "table_id": 202
      },
      "vpn3": {
        "fwmark": "0x203",
        "interface_name": "vpn3",
        "label": "canary_vpn3",
        "selector_class": "cs1",
        "status": "healthy",
        "table_id": 203
      },
      "vpn4": {
        "fwmark": "0x204",
        "interface_name": "vpn4",
        "label": "canary_vpn4",
        "selector_class": "cs2",
        "status": "healthy",
        "table_id": 204
      },
      "vpn5": {
        "fwmark": "0x205",
        "interface_name": "vpn5",
        "label": "canary_vpn5",
        "selector_class": "cs3",
        "status": "healthy",
        "table_id": 205
      }
    },
    "vm101_slot_registry_exists_rc": 0,
    "vm101_status_json_parse_rc": 0,
    "vm101_status_run_rc": 0,
    "vm101_status_schema": "router-egress-slots-status-v1",
    "vm101_status_slot_count": 5,
    "vm101_status_tool_exists_rc": 0
  },
  "vm121": {
    "install": {
      "vm121_backup_dir": "/root/router-ops-backups/STEP_040G_REMOTE_SELECTOR_APPLY_PLAN_20260708-165819",
      "vm121_planner_backup_rc": 0,
      "vm121_planner_exists_rc": 0,
      "vm121_planner_install_rc": 0,
      "vm121_planner_path": "/usr/local/sbin/wg-access-agent-selector-remote-plan.py",
      "vm121_rollback_create_rc": 0,
      "vm121_rollback_path": "/root/rollback-step040g-agent-selector-remote-plan.sh",
      "vm121_selector_helper_exists_rc": 0
    }
  }
}