# VM101 autonomous HMN recovery — canonical M07 plan

## Current completed foundation

- Five production slots: egress1..egress5 / vpn1..vpn5 / tables 201..205.
- R14B: transactional LOCAL_REPAIR normalized, Git-managed, quarantine-aware, candidate retry and rollback proven.
- R15A: legacy execution frozen and physically removed; one production loop remains: health watcher -> dispatcher -> LOCAL_REPAIR.
- R15B1: staged-generation schema and strict validator installed. Positive and destructive fixtures prove exactly five unique, fresh, tested, non-active and non-quarantined candidates; no generation builder or activation path exists yet.
- `/root/hmn` owns provider download, low-level `vpn_test` candidate testing and ranking only.
- `/var/lib/router-egress-recovery` owns quarantine, counters, locks, state and staged generations.
- Table 200, old two-slot managers, old refresh/rebalance/emergency entry points and daily counters are not production dependencies.

## Next implementation sequence

1. R15B2 — live shadow generation builder. It stages exactly five unique tested candidates without changing active slots.
2. R15B3 — independent staged-generation proof against real HideMyName output.
3. R16 — transactional FULL_POOL_REFRESH: stage, validate, apply all five, independent proof, activate generation or rollback all five.
4. R17 — DEGRADED_POOL and consolidation state transitions.
5. R18 — BOOTSTRAP_RECOVERY and controlled Direct emergency/return, gated by explicit configuration.
6. Final cold-bootstrap and destructive negative proof from a clean VM101 state.

## Locked invariants

- No direct failopen unless separately approved and explicitly enabled.
- Failed candidates enter unified quarantine.
- A failed generation never partially replaces the active generation.
- `repair_events_since_full_refresh` resets only after a fully proven generation activation.
- R15B1 validator and its selftests are read-only with respect to `vpn1..vpn5`.
- Machine Git and permanent HTTPS publication are mandatory after every changing STEP.

## R15B1 completion

- Result: PASS_R15B1_GENERATION_SCHEMA_VALIDATOR_ACTIVE
- VM101 commit: 66a24ee69f186d27cab4ae73169fab6fab636d56
- VM101 tree: 6b16f8192262116a7a1ff77c333184e548446be7
- managed file count: 32
- active generation created: false
- active slots changed: false
- runtime impact: false
- next implementation stage: R15B2 generation builder