=== STEP_039A RESULT === prev038d=/opt/router-ops/public/r/e94a0859747d7b96f29c7fdafc2d0351ba603bb0a7e9e5a4/20260708-141356_step038d_checkpoint_cs3_proven/report.txt prev038d_rc=0 prev038d_pass_rc=0 mode=READ_ONLY_DESIGN new_peer_created=NO selector_changed=NO mapper_changed=NO policy_changed=NO network_reload_done=NO firewall_reload_done=NO wg_reload_done=NO backend_restart_done=NO private_material_published=NO === STEP_039A DESIGN ANALYSIS === backend_has_subscription_api=NO backend_has_peer_tunnel_ip=YES backend_mentions_selector_or_slot=NO vm100_selector_file_exists=YES vm100_selector_service_enabled=YES vm101_5slot_policy_enabled=YES vm101_5class_mapper_enabled=YES vm101_existing_hmn_manager_material=YES === LIVE CREATE FLOW TARGET === POST /admin/subscriptions -> backend validates plan/node -> backend selects healthy egress slot -> backend stores peer.slot_code / selector_class / egress_policy_version -> backend creates create_peer job with selector data -> agent applies wg_paid peer on VM100 -> agent applies VM100 selector entry atomically/idempotently -> agent verifies wg peer + selector nft rule -> response/report includes assigned slot/class but never private keys === REQUIRED DATA MODEL ADDITIONS === egress_slots table or config-backed model: slot_code, selector_class, fwmark, table_id, interface_name provider_type, manager_id, status, last_health_at, health_reason peer/subscription assignment: peer_id, tunnel_ip, slot_code, selector_class, assigned_at, assignment_reason === AGENT CONTRACT ADDITIONS === create_peer job must carry or resolve: tunnel_ip selector_class selector_label slot_code Agent VM100 apply must be idempotent: add/update exact selector line avoid duplicates restart only selector service verify nft rule rollback file before mutation === HEALTH PLANE TARGET === VM101 slot checker: checks vpn1..vpn5 uniformly validates route table, interface, connectivity, optional WG/AWG handshake writes status JSON invokes provider-specific manager on repeated failure Provider manager interface: check(slot) repair(slot) replace(slot) status(slot) Provider types: hmn_amneziawg static_wireguard openvpn emergency_custom === RECOMMENDED NEXT BUILD ORDER === 1. STEP_039B implement read-only slot registry/status file format on VM101. 2. STEP_039C implement VM121 read-only slot selection library using mocked health JSON. 3. STEP_039D add backend DB fields/migration for peer slot/class assignment. 4. STEP_039E extend agent to apply selector entry from job metadata. 5. STEP_039F near-live cs4: one backend/API action -> peer + assigned slot + selector + observe. 6. STEP_039G build health checker MVP for vpn1..vpn5. 7. STEP_039H build provider-manager interface; first adapter hmn_amneziawg, then static_wireguard/openvpn stubs. 8. STEP_039I make backend allocator skip unhealthy slots. decision=PASS_LIVE_PEER_CREATE_FLOW_DESIGNED_READONLY