# VM101 model — LOCAL_REPAIR normalization

Timestamp: 20260716-062248
STEP: STEP_050M07R14B_LOCAL_REPAIR_NORMALIZATION_BUNDLE_R02
Git commit: 0a6998cfead6a1e8b820cce9c00171dd6e81c6a1
Git tree: b2646e97025823532daa549235e1643f75f11c4e
Managed files: 47

## Active slots

- egress1 -> vpn1 -> table 201 -> mark 0x201 -> DSCP cs4
- egress2 -> vpn2 -> table 202 -> mark 0x202 -> DSCP cs5
- egress3 -> vpn3 -> table 203 -> mark 0x203 -> DSCP cs1
- egress4 -> vpn4 -> table 204 -> mark 0x204 -> DSCP cs2
- egress5 -> vpn5 -> table 205 -> mark 0x205 -> DSCP cs3

## LOCAL_REPAIR contract

1. Slot is mandatory.
2. Candidate must be from a fresh tested HMN pool.
3. Active endpoints and quarantined endpoints are excluded.
4. Up to LOCAL_REPAIR_CANDIDATE_RETRIES candidates are attempted.
5. Failed candidates enter quarantine.
6. Successful replacement requires link, the repaired slot route table and strict egress proof.
7. Route apply targets only the repaired slot and does not require unrelated slot links.
8. If every candidate fails, the original endpoint is restored.
9. Dispatcher accepts success only when adapter decision=commit_ok and adapter rc=0.
10. Commit operations are serialized by one LOCAL_REPAIR lock.
11. State-record failure restores both recovery state and the original endpoint.
12. Only commit_ok increments repair_events_since_full_refresh.
13. FULL_REFRESH_AFTER_REPAIRS=5.
14. No LOCAL_REPAIR dependency on routing table 200.

## Runtime ownership

- Candidate acquisition/testing remains under /root/hmn.
- Recovery state/quarantine/counters: /var/lib/router-egress-recovery.
- Slot repair core: /usr/local/lib/router-egress-hmn-slot-replace.sh.
- Dispatcher: /usr/local/sbin/router-egress-recovery-dispatcher.sh.
- Adapter wrapper: /usr/local/sbin/router-egress-recovery-hmn-pool-replace.sh.
- Routing tables: /usr/local/sbin/router-egress-slots-apply.sh.