=== STEP_035B VM100 SELECTOR FILE CANARY ===
timestamp=20260708-123837
mode=real change VM100 only: convert hardcoded canary to selector file model
canary_ip=10.253.1.10
forbidden: VM101 writes, production-wide switch, firewall reload, network reload, wg reload, peer changes
=== VM100 apply selector-file model ===
date=Wed Jul  8 12:38:37 UTC 2026
backup_dir=/root/router-ops-backups/step035b-vm100-selector-file-20260708-123837

=== guards before change ===
guard_canary_ip_in_wg_paid_rc=0
guard_init_exists_rc=0
guard_init_enabled_rc=0
guard_existing_canary_rule_visible_rc=0
uci_changes_rc=0

=== backup current files ===
backup_done=1

=== write selector file ===
selector_file=/etc/router-wgpay-selector.d/peers.conf
# router WGPay selector file
# format: tunnel_ip dscp_class comment
# STEP_035B: one proven canary only, no production-wide switch
10.253.1.10 cs1 canary_vpn3

=== write selector-based apply script ===

=== write rollback ===
rollback_vm100=/root/rollback-step035b-vm100-selector-file.sh

=== start existing init service with selector model ===
applied_vm100_wgpay_selector_rules=1
selector_service_start_rc=0

=== verify selector model ===
init_enabled_rc=0
selector_rule_visible_rc=0
selector_ip_visible_rc=0
selector_rule_count=1

=== active table ===
table inet wgpay_dscp_canary {
	chain prerouting {
		type filter hook prerouting priority mangle; policy accept;
		iifname "wg_paid" ip saddr 10.253.1.10 ip dscp set cs1 counter packets 0 bytes 0 comment "STEP_035B_SELECTOR_WGPAY_canary_vpn3_10.253.1.10_cs1"
	}
}

=== UCI changes after ===
uci_changes_after_rc=0

=== no forbidden action proof VM100 ===
no_firewall_reload_vm100=1
no_network_reload_vm100=1
no_wg_reload_vm100=1
no_peer_change_vm100=1
vm100_selector_apply_done=1

=== VM101 read-only verify unchanged ===
vm101_init_exists_rc=0
vm101_init_enabled_rc=0
vm101_prerouting_rule_visible_rc=0
vm101_postrouting_rule_visible_rc=0
vm101_mark_route_vpn3_rc=0
no_remote_write_vm101=1
no_firewall_reload_vm101=1
no_network_reload_vm101=1
no_wg_reload_vm101=1
no_peer_change_vm101=1
vm101_readonly_done=1

=== STEP_035B RESULT ===
guard_canary_ip_in_wg_paid_rc=0
guard_init_enabled_rc=0
selector_service_start_rc=0
init_enabled_rc=0
selector_rule_visible_rc=0
selector_ip_visible_rc=0
selector_rule_count=1
vm101_init_enabled_rc=0
vm101_prerouting_rule_visible_rc=0
vm101_postrouting_rule_visible_rc=0
vm101_mark_route_vpn3_rc=0
rollback_vm100=/root/rollback-step035b-vm100-selector-file.sh
decision=PASS_VM100_SELECTOR_FILE_CANARY_APPLIED