# VM101 autonomous HMN recovery — canonical M07 plan

## Current completed foundation

- Five production slots: egress1..egress5 / vpn1..vpn5 / tables 201..205.
- R14B: transactional LOCAL_REPAIR normalized, Git-managed, quarantine-aware, candidate retry and rollback proven.
- R15A: legacy execution frozen and physically removed; one production loop remains: health watcher -> dispatcher -> LOCAL_REPAIR.
- `/root/hmn` owns provider download, low-level `vpn_test` candidate testing and ranking only.
- `/var/lib/router-egress-recovery` owns quarantine, counters, locks and state.
- Table 200, old two-slot managers, old refresh/rebalance/emergency entry points and daily counters are not production dependencies.

## Next implementation sequence

1. R15B — five-slot generation builder and validator. It stages exactly five unique tested candidates without changing active slots.
2. R16 — transactional FULL_POOL_REFRESH: stage, validate, apply all five, independent proof, activate generation or rollback all five.
3. R17 — DEGRADED_POOL and consolidation state transitions.
4. R18 — BOOTSTRAP_RECOVERY and controlled Direct emergency/return, gated by explicit configuration.
5. Final cold-bootstrap and destructive negative proof from a clean VM101 state.

## Locked invariants

- No direct failopen unless separately approved and explicitly enabled.
- Failed candidates enter unified quarantine.
- A failed generation never partially replaces the active generation.
- `repair_events_since_full_refresh` resets only after a fully proven generation activation.
- Machine Git and permanent HTTPS publication are mandatory after every changing STEP.