=== STEP_037A2 CREATE CS2 TEST PEER FIXED ===
timestamp=20260708-133412
mode=safe corrected create second WGPay test peer through backend + agent
target=second canary for future cs2 -> 0x204 -> vpn4 proof
note=037A wrapper produced empty fields; this step guards against duplicate enabled peer first
forbidden: selector changes, mapper changes, policy switch, backend restart, network/firewall reload
=== VM121 guarded create subscription + apply agent ===
remote_backup_dir=/root/router-ops-backups/canary-test-subscription-cs2-fixed-20260708-133412
private_create_json=/root/router-ops-backups/canary-test-subscription-cs2-fixed-20260708-133412/create-full.private.json

=== backend health ===
{"status":"ok","service":"wg-access-backend","environment":"dev"}
{"status":"ok","db":1}

=== before counts / duplicate guard ===
peers_before_curl_rc=0
jobs_before_curl_rc=0
peer_count_before=21
enabled_peer_count_before=1
job_count_before=37
pending_job_count_before=0
existing_canary_enabled_count=1
create_guard_safe=1
create_guard_safe_final=1

=== create second canary subscription, private response saved only ===
create_curl_rc=0
create_http_code=422
cs2_subscription_id=
cs2_peer_id=
cs2_job_id=
cs2_tunnel_ip=
cs2_client_endpoint=
cs2_parse_ok=0
cs2_parse_reasons=missing_subscription_id,missing_peer_id,missing_tunnel_ip
cs2_parse_script_rc=0

=== rollback script for cs2 test peer ===
rollback_vm121=/root/rollback-step037a2-cs2-test-peer.sh

=== apply pending job with agent ===
agent_start_rc=0

=== after counts/state ===
peers_after_curl_rc=0
jobs_after_curl_rc=0
peer_count_after=21
enabled_peer_count_after=1
job_count_after=37
pending_job_count_after=0
enabled_peer_count_delta=0
cs2_peer_found=False
cs2_job_found=False

=== backend endpoint final ===
WG_CLIENT_ENDPOINT=wg-studio.secret-studio.ru:51830

=== safety ===
private_response_not_published=1
no_selector_change=1
no_backend_restart=1
no_peer_disable=1
vm121_create_done=1

=== VM100 read-only verify cs2 peer applied, selector unchanged ===
vm100_wg_paid_peer_count=missing_cs2_ip
vm100_existing_canary_visible_rc=missing_cs2_ip
vm100_cs2_peer_visible_rc=missing_cs2_ip
vm100_selector_active_entry_count=missing_cs2_ip
vm100_selector_has_cs2_ip_rc=missing_cs2_ip
vm100_selector_rule_visible_rc=missing_cs2_ip

=== STEP_037A2 RESULT ===
create_guard_safe_final=1
create_curl_rc=0
create_http_code=422
cs2_parse_ok=0
cs2_parse_script_rc=0
cs2_parse_reasons=missing_subscription_id,missing_peer_id,missing_tunnel_ip
cs2_subscription_id=
cs2_peer_id=
cs2_tunnel_ip=
agent_start_rc=0
peer_count_after=21
enabled_peer_count_after=1
enabled_peer_count_delta=0
pending_job_count_after=0
cs2_peer_found=False
cs2_peer_enabled=
cs2_tunnel_ip_matches=
cs2_job_found=False
cs2_job_status=
endpoint_final_lines=1
vm100_wg_paid_peer_count=missing_cs2_ip
vm100_existing_canary_visible_rc=missing_cs2_ip
vm100_cs2_peer_visible_rc=missing_cs2_ip
vm100_selector_active_entry_count=missing_cs2_ip
vm100_selector_has_cs2_ip_rc=missing_cs2_ip
vm100_selector_rule_visible_rc=missing_cs2_ip
rollback_vm121=/root/rollback-step037a2-cs2-test-peer.sh
decision=BLOCK_SAFETY_PROOF_MISSING