# WG Paid / MGTS — R20N R02 repair-counter threshold and automatic full refresh

## R02 continuation boundary

R20N R01 stopped inside the VM130 layered bundle gate before `install.sh` was invoked. No VM101 preflight, snapshot, backup or failure injection occurred. R02 changes only the bundle-policy fixture basename from `publication-safe-payload-runtime.sh` to the exact R20-required `publication_safe_payload_runtime.sh`, updates revision/publication labels, and preserves the production threshold-test logic unchanged.

## Baseline

- VM101 Machine Git commit `d0c0a77486665b0abfef8133f0cccd20c6232b46`.
- R20M R02 installed a fresh generation and reserve pool.
- R20H R07/R08 proved one real full-binding LOCAL_REPAIR.
- Current required start state: `NORMAL`, five healthy slots, `repair_events_since_full_refresh=1`, `full_refresh_due=false`, Direct disabled.

## Test sequence

The harness injects only a bad live AmneziaWG peer port, without changing UCI, the active generation, routes, pools or policy rules. Targets are different slots to avoid the 900-second per-slot cooldown:

1. `egress3 / vpn3`: counter `1 -> 2`.
2. `egress4 / vpn4`: counter `2 -> 3`.
3. `egress5 / vpn5`: counter `3 -> 4`.
4. `egress1 / vpn1`: counter `4 -> 5`; state must become full-refresh due.

Each repair requires watcher threshold evidence, `commit_ok`, full candidate-config binding, metadata/peer/live endpoint convergence, one successful event, correct quarantine transaction, correct recovery log row, preservation of the other four endpoints and five-slot health.

## Automatic refresh boundary

The test does not execute `router-egress-full-pool-refresh.sh`. After the fourth repair it observes the health watcher's `full-refresh-last.log`, state and events. PASS requires:

- threshold repair event `4 -> 5`;
- repair log `full_refresh_due=true`;
- watcher-produced full-refresh log newer than the threshold repair;
- one successful `full_pool_refresh` event `5 -> 0`;
- new active generation;
- `mode=NORMAL`, `full_refresh_due=false`, counter `0`;
- five healthy consistent VPN slots;
- at least one fresh non-active full-config candidate;
- Direct not used;
- watcher and retry services running;
- Machine Git unchanged.

## Safety

Before a production commit, the harness may restore only its live endpoint injection and target watch-state files. After `commit_dispatch`, the production transaction owns rollback. Successful earlier repairs are never automatically undone if a later phase stops. A Proxmox snapshot is created before the first injection.