STEP_035C_OBSERVE_SELECTOR_FILE_CANARY PASS_SELECTOR_FILE_CANARY_TRAFFIC_CONFIRMED
timestamp: 20260708-123955

Selector canary:
- selector file: /etc/router-wgpay-selector.d/peers.conf
- entry: 10.253.1.10 cs1 canary_vpn3

Selector state:
- vm100_selector_entry_visible_rc: 0
- vm100_selector_rule_visible_rc: 0
- vm100_selector_service_enabled_rc: 0

Temporary client:
- extract_script_rc: 0
- wg_link_add_rc: 0
- wg_setconf_rc: 0
- wg_link_up_rc: 0
- wg_default_route_rc: 0
- canary_ping_rc: 0
- netns_cleanup_rc: 0
- temp_iface_still_exists_rc: 1

Counters:
- VM100 selector delta packets: 4
- VM101 mark delta packets: 4
- VM101 clear DSCP delta packets: 4
- VM101 mark route vpn3 rc: 0

Safety:
- no secrets published
- no server WG reload
- no peer changes

Next:
- if PASS, selector-file model is proven end-to-end for one WGPay peer.
- next safe step: checkpoint snapshot, then plan adding more selector entries or multi-class DSCP mapping.
