STEP_037B_ADD_CS2_SELECTOR_ENTRY PASS_CS2_SELECTOR_ENTRY_APPLIED
timestamp: 20260708-134547

VM100 selector:
- added entry: 10.253.1.11 cs2 canary_vpn4
- selector append rc: 0
- selector service start/enabled rc: 0 / 0
- active entry count before/after: 1 / 2
- existing canary entry rc: 0
- cs2 selector entry rc: 0
- nft existing/cs2 rule visible rc: 0 / 0
- wg_paid peer count after: 2
- cs2 peer in wg_paid rc: 0

VM101 read-only:
- egress slots service rc: 0
- mapper service/pre/post: 0 / 5 / 5
- mark routes 0x201..0x205 rc: 0 / 0 / 0 / 0 / 0
- table200 default vpn1 rc: 0

VM121 read-only:
- peer_count: 22
- enabled_peer_count: 2
- pending_job_count: 0
- cs2_peer_enabled: True

Rollback:
- VM100: /root/rollback-step037b-cs2-selector-entry.sh

Changes:
- VM100 selector file entry added
- VM100 selector service restarted
- no VM101 changes
- no mapper changes
- no policy changes
- no backend restart
- no peer changes

Next:
- run cs2 temporary client traffic observe:
  10.253.1.11 -> cs2 -> 0x204 -> vpn4
