=== STEP_044J2 RESULT ===
step=STEP_044J2_CONTROLLED_TRAFFIC_KEY_MAPPING_DIAGNOSIS
mode=READONLY_DIAGNOSE_WHY_CONTROLLED_TRAFFIC_DID_NOT_INCREMENT_VM100_ACTIVITY_COUNTERS

diagnosis:
  target_tunnel_ip=10.253.1.10
  target_egress_class=cs1
  target_id=cs1_vpn3
  client_public_key_prefix=zUUEdc+Lac
  vm100_target_peer_public_key_prefix=fmcqSUy1fE
  client_public_key_matches_vm100_target_peer=False
  client_endpoint_from_config=10.71.100.1:51830
  server_latest_handshake_for_target=0
  server_transfer_for_target=0	0
  server_endpoint_for_target=(none)
  probable_root_cause=stale_private_client_config_public_key_mismatch

safety:
  read-only diagnosis
  no private material published
  VM100 unchanged
  VM101 unchanged
  VM121 DB unchanged
  public_index_rebuilt=True

success_checks:
  vm121_client_diag_collected=True
  secret_path_exists=True
  private_key_available_but_not_published=True
  client_public_key_derived=True
  vm100_diag_collected=True
  vm100_peer_count_five=True
  vm100_allowed_ip_count_five=True
  vm100_selector_rows_five=True
  vm100_uci_peer_count_zero=True
  target_allowed_ip_line_found=True
  vm100_target_peer_public_key_resolved=True
  activity_service_enabled=True
  activity_service_status_ok=True
  key_mapping_diagnosis_created=True
  vm101_slot_map_collected=True
  vm101_cs1_to_vpn3_seen=True
  vm101_cs2_to_vpn4_seen=True
  vm101_cs3_to_vpn5_seen=True
  vm101_cs4_to_vpn1_seen=True
  vm101_cs5_to_vpn2_seen=True
  vm121_db_collected=True
  enabled_peers_five=True
  lease_rows_five=True
  idle_leases_five=True
  active_leases_zero=True
  forced_leases_zero=True
  pending_jobs_zero=True
  public_report_created=True
  public_index_rebuilt=True

expected_absence:
  private_material_published=False
  manual_agent_service_start_used=False
  vm100_changed=False
  vm101_changed=False
  vm121_db_changed=False
  selector_changed=False
  wg_peer_runtime_changed=False
  client_config_published=False
  force_mode_enabled=False
  rebalance_paused=False
  activity_eval_written_to_db=False

warnings:
  - STEP_044J2 is read-only diagnosis after STEP_044J produced no counter delta.
  - Public key hashes/prefixes are published; private key/config is not published.
  - Existing private client config appears stale for the current VM100 target peer; next traffic proof should create/use a fresh private config tied to a current runtime peer.

all_ok=True
decision=PASS_STEP_044J2_CONTROLLED_TRAFFIC_KEY_MAPPING_DIAGNOSIS
next_step=STEP_044J3_CONTROLLED_TRAFFIC_WITH_CURRENT_RUNTIME_PEER_CONFIG
LOCAL_REPORT=http://127.0.0.1:8099/r/e94a0859747d7b96f29c7fdafc2d0351ba603bb0a7e9e5a4/20260709-141007_step044j2_controlled_traffic_key_mapping_diagnosis/
TRYCF_REPORT=https://helena-background-beam-harry.trycloudflare.com/r/e94a0859747d7b96f29c7fdafc2d0351ba603bb0a7e9e5a4/20260709-141007_step044j2_controlled_traffic_key_mapping_diagnosis/