=== STEP_035A PRODUCTION SELECTOR PLAN READONLY === timestamp=20260708-123706 mode=read-only inventory + local plan package canary_ip=10.253.1.10 forbidden: remote writes, policy switch, peer changes, wg reload, network/firewall reload === VM121 WG Access peers/jobs inventory === peers_curl_rc=0 jobs_curl_rc=0 peer_count 21 enabled_peer_count 1 job_count 37 pending_job_count 0 PEER_NODE_COUNT ddn-test 21 PEER id=376dfa07-0ba4-4182-af39-389a2cb3badd node_id=ddn-test tunnel_ip=10.253.1.10 enabled=True canary=True PEER id=3d03a7a2-c009-48a4-b6ff-214326d26fc0 node_id=ddn-test tunnel_ip=10.253.1.10 enabled=False canary=True PEER id=0f808400-74ad-437b-a716-c6389aa3f057 node_id=ddn-test tunnel_ip=10.253.1.10 enabled=False canary=True PEER id=28aefe9e-25b0-434a-aedc-a4df15609e98 node_id=ddn-test tunnel_ip=10.253.1.10 enabled=False canary=True PEER id=40b76a1d-e1ef-4a26-ac11-f39043a6a190 node_id=ddn-test tunnel_ip=10.253.1.10 enabled=False canary=True PEER id=f45a349d-25a7-426d-b88a-4479b28aec18 node_id=ddn-test tunnel_ip=10.253.1.10 enabled=False canary=True PEER id=3460b486-358c-44d6-8f47-c960d6254e3a node_id=ddn-test tunnel_ip=10.253.1.10 enabled=False canary=True PEER id=486ee88e-2515-4203-8541-44f89cdaba89 node_id=ddn-test tunnel_ip=10.253.1.10 enabled=False canary=True PEER id=da134a09-caa8-4209-bbfa-93dd06f310fb node_id=ddn-test tunnel_ip=10.253.1.10 enabled=False canary=True PEER id=966f8262-b25c-4a13-ae1d-694b0378910a node_id=ddn-test tunnel_ip=10.253.1.10 enabled=False canary=True PEER id=00fde00e-a169-4397-841f-5cc99de475d5 node_id=ddn-test tunnel_ip=10.253.1.10 enabled=False canary=True PEER id=267835b6-84b6-4527-bd47-eee963e7a5c9 node_id=ddn-test tunnel_ip=10.253.1.10 enabled=False canary=True PEER id=6a5f1655-8ebe-435e-bba6-1af2412d40c2 node_id=ddn-test tunnel_ip=10.253.1.10 enabled=False canary=True PEER id=9298ec04-26cf-44a7-8079-7a13664612fa node_id=ddn-test tunnel_ip=10.253.1.10 enabled=False canary=True PEER id=1b19ed83-1cad-4d57-be9f-fded5270213c node_id=ddn-test tunnel_ip=10.253.1.16 enabled=False canary=False PEER id=13543224-39f7-4cfc-917d-66a16e2e0e55 node_id=ddn-test tunnel_ip=10.253.1.15 enabled=False canary=False PEER id=813515db-bf25-46c9-bc83-c9c45d51ba68 node_id=ddn-test tunnel_ip=10.253.1.14 enabled=False canary=False PEER id=754b76bd-0e69-4184-ac0b-a9c5706dbf19 node_id=ddn-test tunnel_ip=10.253.1.13 enabled=False canary=False PEER id=4b39aa87-4b59-4c71-950b-cf2dca3e606f node_id=ddn-test tunnel_ip=10.253.1.12 enabled=False canary=False PEER id=37361fae-0ad5-4a7a-8096-a59e1dde2d78 node_id=ddn-test tunnel_ip=10.253.1.11 enabled=False canary=False PEER id=1c152b56-8f35-4bee-bdd7-154ff551077e node_id=ddn-test tunnel_ip=10.253.1.10 enabled=False canary=True === backend endpoint env === WG_CLIENT_ENDPOINT=wg-studio.secret-studio.ru:51830 no_remote_write_vm121=1 no_peer_change_vm121=1 vm121_inventory_done=1 === VM100 wg_paid + selector/persistence inventory === date=Wed Jul 8 12:37:07 UTC 2026 === wg_paid summary === vm100_wg_paid_peer_count=1 VM100_WG_PAID_PEER public_key=fmcqSUy1fErB... allowed_ips=10.253.1.10/32 vm100_canary_peer_visible_rc=0 === persistent canary service === vm100_canary_init_exists_rc=0 vm100_canary_init_enabled_rc=0 === active canary nft === table inet wgpay_dscp_canary { chain prerouting { type filter hook prerouting priority mangle; policy accept; iifname "wg_paid" ip saddr 10.253.1.10 ip dscp set cs1 counter packets 4 bytes 336 comment "STEP_034M2_PERSIST_WGPAY_CANARY_DSCP_CS1" } } vm100_canary_rule_visible_rc=0 === possible future persistence files === -rwxr-xr-x 1 root root 928 Jul 8 12:28 /usr/local/sbin/router-wgpay-canary-apply.sh -rwxr-xr-x 1 root root 233 Jul 8 12:28 /etc/init.d/router-wgpay-canary === uci pending === no_remote_write_vm100=1 no_wg_reload_vm100=1 no_network_reload_vm100=1 no_firewall_reload_vm100=1 no_peer_change_vm100=1 vm100_inventory_done=1 === VM101 egress slots + selector/persistence inventory === date=Wed Jul 8 12:37:07 UTC 2026 === live interfaces === eth1 UP 10.200.0.2/24 fe80::be24:11ff:fe09:4e2c/64 vpn1 UNKNOWN 10.91.233.132/32 vpn3 UNKNOWN 10.104.58.24/32 vpn4 UNKNOWN 10.103.120.171/32 vpn5 UNKNOWN 10.97.189.145/32 === policy rules === 10013: from all fwmark 0x203 lookup 203 10014: from all fwmark 0x204 lookup 204 10015: from all fwmark 0x205 lookup 205 10019: from all iif eth1 lookup 200 10020: from 10.200.0.0/24 lookup 200 === egress tables 200..205 === --- table 200 --- default dev vpn1 scope link 10.200.0.0/24 dev eth1 scope link src 10.200.0.2 10.201.0.0/24 dev eth3 scope link src 10.201.0.2 --- table 201 --- Error: ipv4: FIB table does not exist--- table 202 --- --- table 203 --- default dev vpn3 scope link --- table 204 --- default dev vpn4 scope link --- table 205 --- default dev vpn5 scope link === mark route checks === MARK_ROUTE 0x201 1.1.1.1 via 95.165.96.1 dev eth0 src 95.165.105.4 mark 0x201 uid 0 MARK_ROUTE 0x201 cache MARK_ROUTE 0x202 1.1.1.1 via 95.165.96.1 dev eth0 src 95.165.105.4 mark 0x202 uid 0 MARK_ROUTE 0x202 cache MARK_ROUTE 0x203 1.1.1.1 dev vpn3 table 203 src 10.104.58.24 mark 0x203 uid 0 MARK_ROUTE 0x203 cache MARK_ROUTE 0x204 1.1.1.1 dev vpn4 table 204 src 10.103.120.171 mark 0x204 uid 0 MARK_ROUTE 0x204 cache MARK_ROUTE 0x205 1.1.1.1 dev vpn5 table 205 src 10.97.189.145 mark 0x205 uid 0 MARK_ROUTE 0x205 cache === persistent canary service === vm101_canary_init_exists_rc=0 . Dump terminated Error: ipv4: FIB table does not exist. Dump terminated vm101_canary_init_enabled_rc=0 === active canary nft === table inet router_egress_dscp_canary { chain prerouting { type filter hook prerouting priority mangle; policy accept; iifname "eth1" ip saddr 10.200.0.1 ip dscp cs1 meta mark set 0x00000203 counter packets 4 bytes 336 comment "STEP_034M_PERSIST_DSCP_CS1_TO_FW_MARK_0x203" } chain postrouting { type filter hook postrouting priority mangle; policy accept; meta mark 0x00000203 ip dscp cs1 ip dscp set cs0 counter packets 4 bytes 336 comment "STEP_034M_PERSIST_CLEAR_DSCP_ON_MARKED_EGRESS" } } vm101_canary_prerouting_rule_visible_rc=0 vm101_canary_postrouting_rule_visible_rc=0 === firewall vpn_out zone === firewall.@zone[4].name='vpn_out' firewall.@zone[4].network='vpn1' 'vpn2' 'vpn_user' 'vpn3' 'vpn4' 'vpn5' firewall.@forwarding[1].dest='vpn_out' === possible future persistence files === -rwxr-xr-x 1 root root 1380 Jul 8 12:27 /usr/local/sbin/router-wgpay-canary-apply.sh -rwxr-xr-x 1 root root 233 Jul 8 12:27 /etc/init.d/router-wgpay-canary === uci pending === no_remote_write_vm101=1 no_wg_reload_vm101=1 no_network_reload_vm101=1 no_firewall_reload_vm101=1 no_peer_change_vm101=1 vm101_inventory_done=1 === STEP_035A RESULT === peer_count=21 enabled_peer_count=1 pending_job_count=0 endpoint_final_lines=1 vm100_wg_paid_peer_count=1 vm100_canary_peer_visible_rc=0 vm100_canary_init_enabled_rc=0 vm100_canary_rule_visible_rc=0 vm101_canary_init_enabled_rc=0 vm101_canary_prerouting_rule_visible_rc=0 vm101_canary_postrouting_rule_visible_rc=0 mark203_routes_vpn3_lines=1 mark204_routes_vpn4_lines=1 mark205_routes_vpn5_lines=1 package=/opt/router-ops/apply-packages/20260708-123706_step035a_production_selector_plan_readonly decision=PASS_PRODUCTION_SELECTOR_PLAN_READONLY