# WG Paid / MGTS — R20K R02 service isolation hardening and candidate config-binding diagnostics

## Trigger

R20K R01 completed its baseline preflight with five healthy active slots, repair counter `0`, all three target candidate configs present, and the R20J adapter baseline proven. It then stopped before any candidate test with `STOP_R20K_SERVICE_STOP_NOT_PROVEN`.

The remote transcript shows that R01 created its verified backup, issued service isolation, and immediately stopped. Its cleanup reported `SYSTEM_RESTORED=true`. The R01 harness had only a fixed two-second delay between `/etc/init.d/... stop` and a process check. That delay is not a reliable proof boundary for OpenWrt procd respawn services.

No candidate mode ran in R01. `ENDPOINT_ONLY_PASS_COUNT=0`, `FULL_CONFIG_PASS_COUNT=0`, and `DIAGNOSIS=PENDING` are therefore absence-of-test values, not candidate failures.

## R02 service-isolation correction

R20K R02:

1. captures exact pre-stop `ps w` evidence;
2. stops `router-egress-health-repair` and `router-egress-full-pool-refresh-retry` through their init scripts;
3. polls both generic procd status and exact script command lines for up to 30 seconds;
4. retries both stop actions if required;
5. sends TERM and then KILL only to exact remaining PIDs for:
   - `/usr/local/sbin/router-egress-health-repair-watch.sh`;
   - `/usr/local/sbin/router-egress-full-pool-refresh-retry.sh --loop`;
6. requires both service status and exact process counts to prove stopped;
7. records a timestamped status/PID timeline;
8. restores the services to their exact baseline running/stopped state and polls that state for up to 20 seconds.

The process search is performed against a saved `ps w` snapshot, not through a live `ps | grep` pipeline, preventing self-matching diagnostic commands.

## Snapshot continuation

R02 reuses snapshot `r20k-pre-0722-071406`, created by R20K R01 before its diagnostic phase. R02 verifies that snapshot exists and does not create a duplicate. A new verified local backup of network, state mirrors, quarantine mirrors, events, counter and active endpoints is created before R02 runtime mutation.

## Candidate hypothesis and matrix

R20H R05 proved that R20J can apply a selected endpoint consistently to metadata UCI, anonymous peer UCI and live AmneziaWG. Three selected endpoints still failed strict egress.

The main hypothesis remains that a HideMyName AmneziaWG candidate is bound to its complete config: client private key, tunnel address, peer public key, AWG obfuscation parameters, AllowedIPs, keepalive and endpoint. Current `LOCAL_REPAIR` changes only endpoint host/port.

Each exact R20H R05 candidate is tested on `vpn_test` in two modes:

- `endpoint_only`: active `egress2.conf` with only Endpoint replaced;
- `full_config`: candidate's own complete `.conf`.

Each mode is observed near 12 and 45 seconds with live endpoint, peer UCI endpoint, handshake epoch, RX/TX and pings to `1.1.1.1`, `8.8.8.8` and informational `9.9.9.9`.

## Safety boundary

- no failure is injected into `vpn1..vpn5`;
- production LOCAL_REPAIR and full refresh are not called;
- active generation is unchanged;
- `/etc/config/network` is restored byte-for-byte;
- state, durable state, quarantine mirrors, events and counter must remain unchanged;
- all five active slots must be healthy before PASS;
- private provider config contents are not published;
- no Machine Git source or VM130 shared workflow source is changed.

## Diagnostic classifications

- `FULL_CONFIG_REQUIRED_FOR_LOCAL_REPAIR`;
- `FULL_CONFIG_REQUIRED_PARTIAL_CANDIDATE_SUCCESS`;
- `CANDIDATES_OR_COMMON_TEST_PATH_FAILED`;
- `MIXED_ENDPOINT_ONLY_AND_FULL_CONFIG_SUCCESS`;
- `MIXED_DIAGNOSTIC_RESULT`.

A completed diagnostic may PASS even when candidate probes fail; the diagnosis is the result. Execution or restoration failure remains STOP.