=== STEP_036A 5-SLOT READINESS READONLY === timestamp=20260708-125112 mode=read-only inventory + local plan current proven: cs1->0x203/vpn3, cs2->0x204/vpn4, cs3->0x205/vpn5 candidate extension: cs4->0x201/vpn1, cs5->0x202/vpn2 forbidden: remote writes, vpn reloads, network/firewall reloads, peer changes, production switch === VM101 five-slot egress readiness === date=Wed Jul 8 12:51:13 UTC 2026 === interface brief === eth1 UP 10.200.0.2/24 fe80::be24:11ff:fe09:4e2c/64 vpn1 UNKNOWN 10.91.233.132/32 vpn3 UNKNOWN 10.104.58.24/32 vpn4 UNKNOWN 10.103.120.171/32 vpn5 UNKNOWN 10.97.189.145/32 === link checks vpn1..vpn5 === vpn1_link_rc=0 vpn1 UNKNOWN 10.91.233.132/32 vpn2_link_rc=1 vpn3_link_rc=0 vpn3 UNKNOWN 10.104.58.24/32 vpn4_link_rc=0 vpn4 UNKNOWN 10.103.120.171/32 vpn5_link_rc=0 vpn5 UNKNOWN 10.97.189.145/32 === amneziawg/wg status, no secrets === --- amneziawg vpn1 --- awg_latest_vpn1 CAZ2FgESKM67A3XofKNoftcFcy9mtaVga8t/3qcCABI= 1783515027 awg_transfer_vpn1 CAZ2FgESKM67A3XofKNoftcFcy9mtaVga8t/3qcCABI= 499808 309798 --- amneziawg vpn2 --- --- amneziawg vpn3 --- awg_latest_vpn3 +QikXdZgJpfsgBVA0hIlE3ar0f2TBOweA8moEdo9DRU= 1783515048 awg_transfer_vpn3 +QikXdZgJpfsgBVA0hIlE3ar0f2TBOweA8moEdo9DRU= 13824 47150 --- amneziawg vpn4 --- awg_latest_vpn4 Fg9PtmJsEOicU+ULA1V7hwbqrvtG+NQ1CSEAG1qoJi0= 1783515004 awg_transfer_vpn4 Fg9PtmJsEOicU+ULA1V7hwbqrvtG+NQ1CSEAG1qoJi0= 8848 45287 --- amneziawg vpn5 --- awg_latest_vpn5 f/KyaIqKy6wV5cuyhzqhYdk9Zf6i7ckp0GvC3xyTA0I= 1783514989 awg_transfer_vpn5 f/KyaIqKy6wV5cuyhzqhYdk9Zf6i7ckp0GvC3xyTA0I= 9124 41525 === policy rules relevant === 10013: from all fwmark 0x203 lookup 203 10014: from all fwmark 0x204 lookup 204 10015: from all fwmark 0x205 lookup 205 10019: from all iif eth1 lookup 200 10020: from 10.200.0.0/24 lookup 200 rule_0x201_rc=1 rule_0x202_rc=1 rule_0x203_rc=0 rule_0x204_rc=0 rule_0x205_rc=0 === route tables 200..205 === --- table 200 --- default dev vpn1 scope link 10.200.0.0/24 dev eth1 scope link src 10.200.0.2 10.201.0.0/24 dev eth3 scope link src 10.201.0.2 --- table 201 --- --- table 202 --- --- table 203 --- default dev vpn3 scope link --- table 204 --- default dev vpn4 scope link --- table 205 --- default dev vpn5 scope link table201_vpn1_rc=1 Error: ipv4: FIB table does not exist. Dump terminated Error: ipv4: FIB table does not exist. Dump terminated Error: ipv4: FIB table does not exist. Dump terminated table202_vpn2_rc=1 table203_vpn3_rc=0 table204_vpn4_rc=0 table205_vpn5_rc=0 === mark route checks === MARK201 1.1.1.1 via 95.165.96.1 dev eth0 src 95.165.105.4 mark 0x201 uid 0 MARK201 cache MARK202 1.1.1.1 via 95.165.96.1 dev eth0 src 95.165.105.4 mark 0x202 uid 0 MARK202 cache MARK203 1.1.1.1 dev vpn3 table 203 src 10.104.58.24 mark 0x203 uid 0 MARK203 cache MARK204 1.1.1.1 dev vpn4 table 204 src 10.103.120.171 mark 0x204 uid 0 MARK204 cache MARK205 1.1.1.1 dev vpn5 table 205 src 10.97.189.145 mark 0x205 uid 0 MARK205 cache mark201_route_vpn1_rc=1 mark202_route_vpn2_rc=1 mark203_route_vpn3_rc=0 mark204_route_vpn4_rc=0 Error: ipv4: FIB table does not exist. Dump terminated mark205_route_vpn5_rc=0 === current multiclass mapper === mapper_service_enabled_rc=0 table inet router_egress_dscp_canary { chain prerouting { type filter hook prerouting priority mangle; policy accept; iifname "eth1" ip saddr 10.200.0.1 ip dscp cs1 meta mark set 0x00000203 counter packets 4 bytes 336 comment "STEP_035F_DSCP_CS1_TO_FW_MARK_0x203" iifname "eth1" ip saddr 10.200.0.1 ip dscp cs2 meta mark set 0x00000204 counter packets 0 bytes 0 comment "STEP_035F_DSCP_CS2_TO_FW_MARK_0x204" iifname "eth1" ip saddr 10.200.0.1 ip dscp cs3 meta mark set 0x00000205 counter packets 0 bytes 0 comment "STEP_035F_DSCP_CS3_TO_FW_MARK_0x205" } chain postrouting { type filter hook postrouting priority mangle; policy accept; meta mark 0x00000203 ip dscp cs1 ip dscp set cs0 counter packets 4 bytes 336 comment "STEP_035F_CLEAR_DSCP_CS1_MARK_0x203" meta mark 0x00000204 ip dscp cs2 ip dscp set cs0 counter packets 0 bytes 0 comment "STEP_035F_CLEAR_DSCP_CS2_MARK_0x204" meta mark 0x00000205 ip dscp cs3 ip dscp set cs0 counter packets 0 bytes 0 comment "STEP_035F_CLEAR_DSCP_CS3_MARK_0x205" } } current_prerouting_mapper_rule_count=3 current_postrouting_clear_rule_count=3 === firewall vpn_out zone === firewall.@zone[4].name='vpn_out' firewall.@zone[4].network='vpn1' 'vpn2' 'vpn_user' 'vpn3' 'vpn4' 'vpn5' firewall.@forwarding[1].dest='vpn_out' === egress config hints === drwx------ 12 root root 4096 Jul 8 10:33 . drwxr-x--- 16 root root 4096 Jul 8 12:45 .. drwx------ 19 root root 24576 Jul 8 10:42 backups drwx------ 2 root root 8192 Jul 8 06:16 cache drwxr-xr-x 8 root root 4096 Jun 1 15:29 checkpoints drwxr-xr-x 3 root root 4096 Jun 1 10:06 configs -rwxr-xr-x 1 root root 6765 Jun 1 14:32 hmn-apply-selected.sh -rwxr-xr-x 1 root root 541 Jul 1 08:22 hmn-clean-old-files.sh -rwxr-xr-x 1 root root 1525 Jun 1 10:04 hmn-code-test.sh -rwxr-xr-x 1 root root 8926 Jun 1 13:58 hmn-download-all-awg.sh -rwx------ 1 root root 4331 Jul 8 10:33 hmn-load-egress-slot.sh -rwxr-xr-x 1 root root 5125 Jun 3 16:20 hmn-load-vpn-slot.sh -rwxr-xr-x 1 root root 4949 Jun 3 16:20 hmn-load-vpn-test.sh -rwxr-xr-x 1 root root 7032 Jul 6 14:24 hmn-load-vpn-user.sh -rwxr-xr-x 1 root root 3181 Jun 1 15:12 hmn-plan-selected.sh -rwxr-xr-x 1 root root 2908 Jun 1 14:00 hmn-plan-selected.sh.before-active-not-top2-fix-20260601-151230 -rwxr-xr-x 1 root root 6149 Jun 3 16:20 hmn-pool-low-watermark-check.sh -rwxr-xr-x 1 root root 3169 Jun 1 13:55 hmn-rank-awg.sh -rwxr-xr-x 1 root root 6084 Jun 3 16:20 hmn-refill-slot.sh -rwxr-xr-x 1 root root 4979 Jun 1 15:28 hmn-refresh-awg.sh -rwxr-xr-x 1 root root 4726 Jun 1 14:41 hmn-refresh-awg.sh.before-awk-lock-20260601-152842 -rwxr-xr-x 1 root root 4726 Jun 1 14:41 hmn-refresh-awg.sh.before-lock-20260601-152728 -rwxr-xr-x 1 root root 533 Jun 3 16:20 hmn-refresh-pool-cron.sh -rwxr-xr-x 1 root root 8534 Jun 3 16:20 hmn-refresh-pool-safe.sh -rwxr-xr-x 1 root root 4309 Jun 3 16:20 hmn-refresh-retry-cron.sh -rwxr-xr-x 1 root root 1648 Jun 1 10:03 hmn-set-code.sh -rwxr-xr-x 1 root root 5925 Jun 3 16:20 hmn-test-all-awg.sh -rwxr-xr-x 1 root root 7298 Jun 3 16:20 hmn-validate-current-pool.sh -rwxr-xr-x 1 root root 5011 Jul 6 14:24 hmn-vpn-egress-revive.sh -rwxr-xr-x 1 root root 7379 Jul 6 10:00 hmn-vpn-user-override.sh -rw------- 1 root root 434 Jul 6 16:10 hmn.env drwx------ 2 root root 4096 Jul 8 04:20 logs drwxr-xr-x 9 root root 4096 Jul 6 14:24 patch-backups -rw-r--r-- 1 root root 201414 Jul 8 06:16 refill.log drwx------ 2 root root 4096 Jul 8 04:31 reports drwx------ 17 root root 4096 Jul 8 04:20 runs drwx------ 2 root root 4096 Jul 8 04:31 state drwxr-xr-x 19 root root 4096 Jul 8 04:20 test-runs drwx------ 2 root root 8192 Jul 8 06:16 . drwx------ 12 root root 4096 Jul 8 10:33 .. -rw------- 1 root root 37 Jul 8 04:20 fail-awg1-latest.tsv -rw------- 1 root root 3754 Jul 8 04:31 ok-awg1-strict-all-latest.tsv -rw------- 1 root root 3203 Jul 6 16:24 ok-awg1-strict-all-latest.tsv.before-validate-20260707-042048 -rw------- 1 root root 3754 Jul 7 04:31 ok-awg1-strict-all-latest.tsv.before-validate-20260708-042044 -rw------- 1 root root 2829 Jul 8 04:31 ok-awg1-strict-foreign-latest.tsv -rw------- 1 root root 2456 Jul 6 16:24 ok-awg1-strict-foreign-latest.tsv.before-validate-20260707-042048 -rw------- 1 root root 2829 Jul 7 04:31 ok-awg1-strict-foreign-latest.tsv.before-validate-20260708-042044 -rw------- 1 root root 3754 Jul 8 04:31 ok-awg1-strict-latest.tsv -rw------- 1 root root 3203 Jul 6 16:24 ok-awg1-strict-latest.tsv.before-validate-20260707-042048 -rw------- 1 root root 3754 Jul 7 04:31 ok-awg1-strict-latest.tsv.before-validate-20260708-042044 -rw------- 1 root root 30 Jul 8 04:31 quarantine-awg1-latest.tsv -rw------- 1 root root 30 Jul 6 16:14 quarantine-awg1-latest.tsv.before-validate-20260706-161434 -rw------- 1 root root 30 Jul 7 04:20 quarantine-awg1-latest.tsv.before-validate-20260707-042048 -rw------- 1 root root 30 Jul 8 04:20 quarantine-awg1-latest.tsv.before-validate-20260708-042044 -rw------- 1 root root 2410 Jun 1 11:03 ranked-awg1-20260601-110304.tsv -rw------- 1 root root 2410 Jun 1 11:07 ranked-awg1-20260601-110707.tsv -rw------- 1 root root 2241 Jun 1 13:55 ranked-awg1-20260601-135559.tsv -rw------- 1 root root 2920 Jun 1 14:52 ranked-awg1-20260601-145208.tsv -rw------- 1 root root 2410 Jun 1 15:24 ranked-awg1-20260601-152436.tsv -rw------- 1 root root 2410 Jun 1 15:24 ranked-awg1-latest.tsv -rw------- 1 root root 372 Jun 1 11:07 selected-awg1-20260601-110707.tsv -rw------- 1 root root 384 Jun 1 13:55 selected-awg1-20260601-135559.tsv -rw------- 1 root root 386 Jun 1 14:52 selected-awg1-20260601-145208.tsv -rw------- 1 root root 372 Jun 1 15:24 selected-awg1-20260601-152436.tsv -rw-r--r-- 1 root root 375 Jul 8 06:16 selected-awg1-latest.tsv -rw------- 1 root root 386 Jul 6 16:09 selected-awg1-latest.tsv.before-refill-20260706-165740 -rw-r--r-- 1 root root 385 Jul 6 16:57 selected-awg1-latest.tsv.before-refill-20260706-170839 -rw------- 1 root root 391 Jul 6 17:08 selected-awg1-latest.tsv.before-refill-20260708-061633 -rw------- 1 root root 385 Jun 1 14:35 selected-awg1-loadpath-check.tsv -rw------- 1 root root 33274 Jul 8 04:20 serverlist-latest.json -rw------- 1 root root 1653 Jul 8 04:20 wg-candidates-latest.tsv -rw------- 1 root root 6294 Jul 8 04:20 working-awg1-latest.tsv lrwxrwxrwx 1 root root 38 Jul 8 04:20 /root/hmn/configs/awg1/latest -> /root/hmn/configs/awg1/20260708-042000 hmn_load_egress_slot_exists_rc=0 === uci pending === no_remote_write_vm101=1 no_vpn_reload_vm101=1 no_network_reload_vm101=1 no_firewall_reload_vm101=1 no_peer_change_vm101=1 no_production_switch_vm101=1 vm101_readonly_done=1 === VM100 selector readiness === date=Wed Jul 8 12:51:13 UTC 2026 === selector file === # router WGPay selector file # format: tunnel_ip dscp_class comment # STEP_035B: one proven canary only, no production-wide switch 10.253.1.10 cs1 canary_vpn3 selector_canary_entry_rc=0 selector_active_entry_count=1 selector_script_supports_cs4_cs5_rc=0 selector_service_enabled_rc=0 selector_rule_visible_rc=0 wg_paid_peer_count=1 no_remote_write_vm100=1 no_selector_change_vm100=1 no_wg_reload_vm100=1 no_network_reload_vm100=1 no_firewall_reload_vm100=1 no_peer_change_vm100=1 vm100_readonly_done=1 === VM121 WG Access state === peers_curl_rc=0 jobs_curl_rc=0 peer_count 21 enabled_peer_count 1 job_count 37 pending_job_count 0 ENABLED_PEER id=376dfa07-0ba4-4182-af39-389a2cb3badd node_id=ddn-test tunnel_ip=10.253.1.10 WG_CLIENT_ENDPOINT=wg-studio.secret-studio.ru:51830 no_remote_write_vm121=1 no_peer_change_vm121=1 vm121_readonly_done=1 === STEP_036A RESULT === vpn1_link_rc=0 vpn2_link_rc=1 vpn3_link_rc=0 vpn4_link_rc=0 vpn5_link_rc=0 rule_0x201_rc=1 rule_0x202_rc=1 rule_0x203_rc=0 rule_0x204_rc=0 rule_0x205_rc=0 table201_vpn1_rc=1 table202_vpn2_rc=1 table203_vpn3_rc=0 table204_vpn4_rc=0 table205_vpn5_rc=0 mark201_route_vpn1_rc=1 mark202_route_vpn2_rc=1 mark203_route_vpn3_rc=0 mark204_route_vpn4_rc=0 mark205_route_vpn5_rc=0 mapper_service_enabled_rc=0 current_prerouting_mapper_rule_count=3 current_postrouting_clear_rule_count=3 hmn_load_egress_slot_exists_rc=0 selector_canary_entry_rc=0 selector_active_entry_count=1 selector_script_supports_cs4_cs5_rc=0 vm100_wg_paid_peer_count=1 peer_count=21 enabled_peer_count=1 pending_job_count=0 endpoint_final_lines=1 package=/opt/router-ops/apply-packages/20260708-125112_step036a_5slot_readiness_readonly next_action=repair_or_load_vpn2_slot202_first decision=PLAN_5SLOT_NEEDS_VPN2_SLOT202_REPAIR