# WG Paid / MGTS — Next implementation steps after architecture lock

## Immediate next phase

Implement Phase 1 only:

    quarantine.tsv
    daily fail counter
    state.kv skeleton
    rebalance exclude quarantine
    repair path records old endpoint

Do not yet implement direct fail-open routing or external rescue strategies.

---

## STEP_050A — Read-only current state audit

Goal:

    Inspect current repair/rebalance scripts and exact insertion points.
    No production changes.

Inspect:

    /usr/local/sbin/router-egress-health-repair-watch.sh
    /usr/local/sbin/router-egress-recovery-dispatcher.sh
    /usr/local/sbin/router-egress-recovery-hmn-pool-replace.sh
    /usr/local/sbin/router-egress-hmn-rebalance-top5-apply.sh
    /etc/router-egress-health-repair.conf
    /var/lib/router-egress-recovery/

Expected result:

    PASS if all insertion points are identified and current production remains healthy.

---

## STEP_050B — Install state helpers, no behavior change

Create:

    /usr/local/lib/router-egress-recovery-state.sh
    /var/lib/router-egress-recovery/quarantine.tsv
    /var/lib/router-egress-recovery/state.kv
    /var/lib/router-egress-recovery/fail-counter/

Functions:

    record_quarantine(endpoint, slot, iface, reason, pool_mtime, replacement)
    increment_daily_failure()
    get_daily_failure_count()
    is_endpoint_quarantined_for_pool(endpoint, pool_mtime)
    set_state(mode, reason)

Expected result:

    Helpers installed and syntax checked.
    No repair/rebalance behavior changed yet.

---

## STEP_050C — Patch rebalance dry-run to exclude quarantine

Acceptance:

    Manually seed quarantine for old vpn2 endpoint.
    Rebalance dry-run must not target it if pool is older than quarantine.
    No apply.

---

## STEP_050D — Patch repair path to record quarantine + counter

Acceptance:

    Simulate controlled ifdown again or dry-run repair event.
    Old endpoint recorded.
    Counter increments.
    Repair still works.

---

## STEP_050E — Emergency refresh runner skeleton

Acceptance:

    Counter >=5 triggers guarded emergency refresh attempt.
    Lock/cooldown works.
    Failure leads to degraded_no_fresh_pool, not direct.

---

## Do not do immediately

Do not yet implement:

    direct fail-open routing switch
    external rescue strategies
    Dedenёvo WG rescue
    client rescue WG
    full automatic direct recovery

Those come after Phase 1 and Phase 2 are stable.