STEP_035B_VM100_SELECTOR_FILE_CANARY PASS_VM100_SELECTOR_FILE_CANARY_APPLIED
timestamp: 20260708-123837

VM100 selector-file model:
- selector file: /etc/router-wgpay-selector.d/peers.conf
- entry: 10.253.1.10 cs1 canary_vpn3
- apply script: /usr/local/sbin/router-wgpay-canary-apply.sh
- init service: /etc/init.d/router-wgpay-canary
- rollback: /root/rollback-step035b-vm100-selector-file.sh

Validation:
- guard_canary_ip_in_wg_paid_rc: 0
- guard_init_enabled_rc: 0
- selector_service_start_rc: 0
- init_enabled_rc: 0
- selector_rule_visible_rc: 0
- selector_ip_visible_rc: 0
- selector_rule_count: 1
- vm101_init_enabled_rc: 0
- vm101_prerouting_rule_visible_rc: 0
- vm101_postrouting_rule_visible_rc: 0
- vm101_mark_route_vpn3_rc: 0

Changes:
- VM100 canary persistence converted from hardcoded one-peer rule to selector-file model
- VM101 read-only verification only
- no production-wide switch
- no firewall reload
- no network reload
- no WG reload
- no peer changes

Next:
- run real canary traffic observe again to confirm selector-file model works end-to-end.
