An immutable canonical selector is installed. A final NORMAL generation restores the mutable selector by tunnel IP, byte-for-byte. Replay, unknown peer set and transactional rollback are proved in isolation. Production routing is unchanged.