{
  "action": "append",
  "apply_performed": false,
  "contract_valid": true,
  "error_count": 0,
  "errors": [],
  "exact_line": "10.253.1.14 cs5 canary_vpn2",
  "idempotent_noop": false,
  "mode": "remote-dry-run",
  "payload_summary": {
    "fwmark": "0x202",
    "interface_name": "vpn2",
    "manager_id": "hmn_pool",
    "provider_type": "hmn_amneziawg",
    "selector_class": "cs5",
    "selector_label": "canary_vpn2",
    "slot_code": "vpn2",
    "table_id": 202,
    "tunnel_ip": "10.253.1.14"
  },
  "remote_command_count": 8,
  "remote_commands": [
    {
      "command": "test -f /etc/router-wgpay-selector.d/peers.conf",
      "expected_rc": 0,
      "name": "precheck_selector_conf_exists",
      "phase": "precheck"
    },
    {
      "command": "BACKUP='/root/peers.conf.before-agent-selector-apply-$(date +%Y%m%d-%H%M%S)'; cp /etc/router-wgpay-selector.d/peers.conf \"$BACKUP\"; echo \"$BACKUP\"",
      "expected_rc": 0,
      "name": "backup_selector_conf",
      "phase": "apply"
    },
    {
      "command": "LINE='10.253.1.14 cs5 canary_vpn2'; CONF=/etc/router-wgpay-selector.d/peers.conf; grep -Fxq \"$LINE\" \"$CONF\" || printf '%s\\n' \"$LINE\" >> \"$CONF\"",
      "expected_rc": 0,
      "name": "append_selector_line_if_missing",
      "phase": "apply"
    },
    {
      "command": "ROLLBACK=/root/rollback-agent-selector-apply.sh; cat > \"$ROLLBACK\" <<'RB'\n#!/bin/sh\nset -u\n# Runtime will replace BACKUP path with actual backup emitted during apply.\n# cp /root/peers.conf.before-agent-selector-apply-YYYYmmdd-HHMMSS /etc/router-wgpay-selector.d/peers.conf\n/etc/init.d/router-wgpay-canary start\nRB\nchmod 700 \"$ROLLBACK\"",
      "expected_rc": 0,
      "name": "write_rollback_script",
      "phase": "apply"
    },
    {
      "command": "/etc/init.d/router-wgpay-canary start",
      "expected_rc": 0,
      "name": "start_selector_service",
      "phase": "apply"
    },
    {
      "command": "LINE='10.253.1.14 cs5 canary_vpn2'; grep -Fxq \"$LINE\" /etc/router-wgpay-selector.d/peers.conf",
      "expected_rc": 0,
      "name": "postcheck_selector_line_present",
      "phase": "postcheck"
    },
    {
      "command": "/etc/init.d/router-wgpay-canary enabled",
      "expected_rc": 0,
      "name": "postcheck_selector_service_enabled",
      "phase": "postcheck"
    },
    {
      "command": "nft -a list ruleset 2>/dev/null | grep -q '10.253.1.14.*cs5'",
      "expected_rc": 0,
      "name": "postcheck_nft_rule_visible_after_service_start",
      "phase": "postcheck"
    }
  ],
  "remote_commands_executed": false,
  "requires_wg_peer_before_real_apply": true,
  "rollback_command_count": 2,
  "rollback_commands": [
    {
      "command": "cp /root/peers.conf.before-agent-selector-apply-YYYYmmdd-HHMMSS /etc/router-wgpay-selector.d/peers.conf",
      "expected_rc": 0,
      "name": "restore_selector_backup"
    },
    {
      "command": "/etc/init.d/router-wgpay-canary start",
      "expected_rc": 0,
      "name": "restart_selector_service_after_restore"
    }
  ],
  "rollback_path": "/root/rollback-agent-selector-apply.sh",
  "schema": "wg-access-agent-selector-remote-plan-v1",
  "selector_plan": {
    "action": "append",
    "apply_performed": false,
    "contract_valid": true,
    "errors": [],
    "exact_line": "10.253.1.14 cs5 canary_vpn2",
    "exact_present": false,
    "idempotent_noop": false,
    "mode": "dry-run",
    "payload_summary": {
      "fwmark": "0x202",
      "interface_name": "vpn2",
      "manager_id": "hmn_pool",
      "peer_id": "DRY_RUN_FUTURE_PEER_ID",
      "provider_type": "hmn_amneziawg",
      "selector_class": "cs5",
      "selector_label": "canary_vpn2",
      "slot_code": "vpn2",
      "subscription_id": "DRY_RUN_FUTURE_SUBSCRIPTION_ID",
      "table_id": 202,
      "tunnel_ip": "10.253.1.14"
    },
    "same_ip_conflict_count": 0,
    "same_selector_class_conflict_count": 0,
    "same_selector_label_conflict_count": 0,
    "schema": "wg-access-agent-selector-apply-plan-v1",
    "selector_entry_count_after_planned": 5,
    "selector_entry_count_before": 4,
    "slot_status": "healthy",
    "warnings": [],
    "would_append": true
  },
  "selector_plan_rc": 0,
  "target": {
    "host": "10.71.100.1",
    "name": "vm100",
    "selector_conf": "/etc/router-wgpay-selector.d/peers.conf",
    "selector_service": "router-wgpay-canary"
  },
  "would_append": true
}