{
  "active_formula": "delta_packets >= 10 OR delta_bytes >= 16384",
  "counter_pair_per_peer": {
    "in": "peer_10_253_1_X_in_vpn",
    "out": "peer_10_253_1_X_out_vpn"
  },
  "dryrun_formula_used_here": "absolute_observed_packets >= 10 OR absolute_observed_bytes >= 16384",
  "future_delta_formula": "current_observed_total - stored_previous_observed_total",
  "observed_total_formula": "out_packets + in_packets and out_bytes + in_bytes",
  "read_command": "nft list counters table inet router_egress_activity",
  "settings": {
    "allocator_enabled": "1",
    "bytes_min": 16384,
    "cooldown_seconds": 900,
    "force_mode": "off",
    "idle_seconds": 900,
    "packets_min": 10,
    "rebalance_paused": "0",
    "sample_seconds": 120
  },
  "source": "VM100 nft counters table inet router_egress_activity",
  "write_policy": {
    "next_real_sampler": "store baselines, last_activity_at, state transitions, updated_at, reason if columns exist or after migration",
    "this_step": "no DB writes"
  }
}