{
  "assessment": {
    "all_ok": true,
    "blockers": [],
    "decision": "PASS_STEP_044B_RUNTIME_EGRESS_LEASE_DRYRUN_DESIGN",
    "expected_absence": {
      "lease_rows_inserted": false,
      "manual_agent_service_start_used": false,
      "private_material_published": false,
      "schema_applied": false,
      "vm100_changed": false,
      "vm101_changed": false,
      "vm121_changed": false
    },
    "success_checks": {
      "dryrun_new_returning_peer_decision_built": true,
      "dryrun_peer_rows_built": true,
      "enabled_peer_count_five": true,
      "inner_counter_contract_created": true,
      "no_existing_lease_schema_confirmed": true,
      "pending_jobs_zero": true,
      "proposed_schema_sql_created_not_applied": true,
      "public_report_created": true,
      "selector_apply_contract_created": true,
      "tunables_env_created": true,
      "vm100_peer_count_five_seen": true,
      "vm100_selector_entries_count_five": true,
      "vm100_state_collected": true,
      "vm100_wg_paid_listen_51830_seen": true,
      "vm101_cs1_to_vpn3_seen": true,
      "vm101_cs2_to_vpn4_seen": true,
      "vm101_cs3_to_vpn5_seen": true,
      "vm101_cs4_to_vpn1_seen": true,
      "vm101_cs5_to_vpn2_seen": true,
      "vm101_slot_map_collected": true,
      "vm121_safe_peer_query_ok": true
    },
    "warnings": [
      "STEP_044B is dry-run only; schema SQL is generated but intentionally not applied."
    ]
  },
  "changes": {
    "lease_rows_inserted": "NO",
    "manual_agent_service_start_used": "NO",
    "private_material_published": "NO",
    "schema_applied": "NO",
    "vm100_changed": "NO",
    "vm101_changed": "NO",
    "vm121_changed": "NO"
  },
  "current_state": {
    "class_to_slot": {
      "cs1": {
        "mark": "0x203",
        "table": 203,
        "vpn": "vpn3"
      },
      "cs2": {
        "mark": "0x204",
        "table": 204,
        "vpn": "vpn4"
      },
      "cs3": {
        "mark": "0x205",
        "table": 205,
        "vpn": "vpn5"
      },
      "cs4": {
        "mark": "0x201",
        "table": 201,
        "vpn": "vpn1"
      },
      "cs5": {
        "mark": "0x202",
        "table": 202,
        "vpn": "vpn2"
      }
    },
    "enabled_peers": 5,
    "pending_jobs": 0,
    "selector_class_counts": {
      "cs1": 1,
      "cs2": 1,
      "cs3": 1,
      "cs4": 1,
      "cs5": 1
    }
  },
  "design": {
    "inner_counter_contract": {
      "active_threshold": {
        "bytes_delta_min": 16384,
        "packets_delta_min": 10
      },
      "idle_threshold_seconds": 900,
      "implementation_note": "If per-peer nft dynamic counters are too heavy, collect aggregate conn/flow stats or render counters only for enabled peers.",
      "metric": "iif wg_paid ip saddr <tunnel_ip> oif transit_vpn counter",
      "not_metric": "WireGuard latest-handshake/keepalive alone",
      "preferred_location": "VM100 nft inet fw4 or dedicated table",
      "sample_window_seconds": 120
    },
    "policy": {
      "active_min_bytes": 16384,
      "active_min_packets": 10,
      "cooldown_seconds": 900,
      "idle_seconds": 900,
      "reassign_after_idle": true,
      "runtime_assignment": "public.peer_egress_leases",
      "stable_identity": "public.peers.id/user_id/node_id/tunnel_ip",
      "sticky_while_active": true
    },
    "proposed_schema_sql_file": "proposed_peer_egress_leases.sql",
    "selector_apply_contract": {
      "apply_strategy": "agent renders selector entries from active/idle leases and calls existing VM100 selector apply",
      "example": "10.253.1.25 cs4 peer_<uuid>",
      "safety": [
        "do not change WireGuard client config",
        "do not change public/private keys",
        "do not reassign while active",
        "reassign only after idle threshold and cooldown"
      ],
      "source_of_truth": "public.peer_egress_leases joined to public.peers",
      "vm100_selector_line": "tunnel_ip egress_class peer_id"
    },
    "tunables_env_file": "runtime_egress_allocator.env.example"
  },
  "dryrun": {
    "new_returning_peer_decision": {
      "chosen_class_for_new_or_returning_peer": "cs1",
      "chosen_slot": {
        "mark": "0x203",
        "table": 203,
        "vpn": "vpn3"
      },
      "input_class_counts_from_selector": {
        "cs1": 1,
        "cs2": 1,
        "cs3": 1,
        "cs4": 1,
        "cs5": 1
      },
      "note": "All five classes currently have one proven peer, so tie resolves by stable order cs1..cs5.",
      "policy": "least_active_leases_then_stable_class_order"
    },
    "peer_rows": [
      {
        "current_selector_class": "cs1",
        "current_slot": {
          "mark": "0x203",
          "table": 203,
          "vpn": "vpn3"
        },
        "dryrun_activity_state": "unknown_no_inner_counters_yet",
        "dryrun_lease_state": "would_bootstrap_from_selector",
        "peer_id": "376dfa07-0ba4-4182-af39-389a2cb3badd",
        "reason": "read-only dryrun; no per-peer inner traffic counters installed yet",
        "reassign_now": false,
        "tunnel_ip": "10.253.1.10"
      },
      {
        "current_selector_class": "cs2",
        "current_slot": {
          "mark": "0x204",
          "table": 204,
          "vpn": "vpn4"
        },
        "dryrun_activity_state": "unknown_no_inner_counters_yet",
        "dryrun_lease_state": "would_bootstrap_from_selector",
        "peer_id": "cb533a1a-7070-416d-9272-846327545060",
        "reason": "read-only dryrun; no per-peer inner traffic counters installed yet",
        "reassign_now": false,
        "tunnel_ip": "10.253.1.11"
      },
      {
        "current_selector_class": "cs3",
        "current_slot": {
          "mark": "0x205",
          "table": 205,
          "vpn": "vpn5"
        },
        "dryrun_activity_state": "unknown_no_inner_counters_yet",
        "dryrun_lease_state": "would_bootstrap_from_selector",
        "peer_id": "a3cbe3b5-8416-4847-b5ee-21f42359b465",
        "reason": "read-only dryrun; no per-peer inner traffic counters installed yet",
        "reassign_now": false,
        "tunnel_ip": "10.253.1.12"
      },
      {
        "current_selector_class": "cs4",
        "current_slot": {
          "mark": "0x201",
          "table": 201,
          "vpn": "vpn1"
        },
        "dryrun_activity_state": "unknown_no_inner_counters_yet",
        "dryrun_lease_state": "would_bootstrap_from_selector",
        "peer_id": "219a1f63-ec47-4f72-9663-c1a17d82301e",
        "reason": "read-only dryrun; no per-peer inner traffic counters installed yet",
        "reassign_now": false,
        "tunnel_ip": "10.253.1.13"
      },
      {
        "current_selector_class": "cs5",
        "current_slot": {
          "mark": "0x202",
          "table": 202,
          "vpn": "vpn2"
        },
        "dryrun_activity_state": "unknown_no_inner_counters_yet",
        "dryrun_lease_state": "would_bootstrap_from_selector",
        "peer_id": "e4adcfa1-6fbc-4471-b66b-8d7837f35f9d",
        "reason": "read-only dryrun; no per-peer inner traffic counters installed yet",
        "reassign_now": false,
        "tunnel_ip": "10.253.1.14"
      }
    ]
  },
  "mode": "READONLY_DRYRUN_DESIGN_FOR_RUNTIME_EGRESS_LEASE_ALLOCATOR",
  "publish": {
    "local_report": "http://127.0.0.1:8099/r/e94a0859747d7b96f29c7fdafc2d0351ba603bb0a7e9e5a4/20260709-122635_step044b_runtime_egress_lease_dryrun_design/",
    "trycf_report": "https://helena-background-beam-harry.trycloudflare.com/r/e94a0859747d7b96f29c7fdafc2d0351ba603bb0a7e9e5a4/20260709-122635_step044b_runtime_egress_lease_dryrun_design/"
  },
  "schema": "router-step-facts-v1",
  "step": "STEP_044B_RUNTIME_EGRESS_LEASE_DRYRUN_DESIGN"
}