{
  "architecture_ready_for_vm100_local_implementation": false,
  "decision": {
    "vm100_is_live_loop_owner": true,
    "vm101_is_static_mapper_only": true,
    "vm121_is_not_live_loop_owner": true,
    "vm130_is_ops_only": true
  },
  "local_controller_design": {
    "config_file": "/etc/router-wgpay-egress.conf",
    "force_file": "/etc/router-wgpay-egress.force",
    "implementation_style": "POSIX shell + nft/wg/awk/sed; no VM121 dependency",
    "invariants": [
      "never move active peers",
      "never move forced peers unless explicit force mode is active",
      "respect cooldown",
      "never change WG public/private/preshared keys",
      "never add/remove wg_paid peers",
      "never touch VM101 slot mapper",
      "never require VM121 for live decision/apply",
      "traffic continues with last selector state if local controller is stopped"
    ],
    "lock_file": "/var/run/router-wgpay-egress/lock",
    "loop_steps": [
      "read wg_paid allowed IPs and selector rows locally",
      "read nft router_egress_activity counters locally",
      "compute per-peer packet/byte deltas",
      "update local active/idle state",
      "respect pause/force/cooldown",
      "propose idle-only reassignments",
      "update VM100 selector entry for selected peer",
      "run existing selector apply path",
      "write local audit/rollback artifact",
      "optionally emit telemetry snapshot for VM121/backend"
    ],
    "pause_file": "/etc/router-wgpay-egress.pause",
    "runtime_dir": "/var/run/router-wgpay-egress",
    "script": "/usr/local/sbin/router-wgpay-egress-local.sh",
    "service": "/etc/init.d/router-wgpay-egress-local",
    "state_dir": "/var/lib/router-wgpay-egress",
    "state_file": "/var/lib/router-wgpay-egress/state.jsonl_or_kv"
  },
  "mode": "readonly-architecture-design-no-patch",
  "next_steps": [
    "STEP_046E_VM100_LOCAL_ACTIVITY_SAMPLER_DRYRUN",
    "STEP_046F_VM100_LOCAL_REBALANCER_DRYRUN",
    "STEP_046G_VM100_LOCAL_SELECTOR_APPLY_DRYRUN",
    "STEP_046H_VM100_LOCAL_ONE_IDLE_SELECTOR_CHANGE"
  ],
  "prototype_status": {
    "current_apply_preview": {
      "action_count": 0,
      "mode": "apply-preview-no-write",
      "would_create_jobs": 0,
      "would_update_lease_rows": 0
    },
    "current_rebalancer_dryrun": {
      "action_count": 0,
      "active_count": 1,
      "blocked": false,
      "forced_count": 0,
      "idle_count": 4,
      "lease_rows": 5,
      "noop": true,
      "selector_match_count": 5,
      "slot_seen_count": 5,
      "target_count": 5
    },
    "old_vm121_peer_egress_reassign_handler": "contract_probe_only_not_production_path",
    "old_vm130_vm121_sampler_rebalancer": "prototype_only_not_final_architecture",
    "real_apply_should_remain_disabled": true
  },
  "safety": {
    "jobs_created": false,
    "real_apply_enabled": false,
    "selector_changed": false,
    "vm100_changed": false,
    "vm101_changed": false,
    "vm121_db_written": false,
    "wg_runtime_changed": false
  },
  "schema": "wgpaid-vm100-local-dynamic-egress-architecture-v1",
  "vm100_capabilities": {
    "activity_counter_evidence_lines": [],
    "activity_table_seen": false,
    "local_state_paths_available": {
      "/etc/router-wgpay-selector.d": false,
      "/tmp": false,
      "/usr/local/sbin": false,
      "/var/lib": false,
      "/var/run": false
    },
    "optional_json_tools": {
      "jq": false,
      "jsonfilter": false,
      "python3": false,
      "sqlite3": false
    },
    "selector_apply_script_seen": false,
    "selector_file_exists": false,
    "selector_init_service_seen": false,
    "selector_rows": [],
    "selector_rows_count": 0,
    "tools_present": {
      "awk": false,
      "flock": false,
      "grep": false,
      "ip": false,
      "logger": false,
      "nft": false,
      "sed": false,
      "service": false,
      "uci": false,
      "wg": false
    },
    "wg_paid_allowed_ip_count_5": false,
    "wg_paid_peer_count_5": false
  },
  "vm101_static_mapper": {
    "cs1_to_vpn3": false,
    "cs2_to_vpn4": false,
    "cs3_to_vpn5": false,
    "cs4_to_vpn1": false,
    "cs5_to_vpn2": false,
    "dynamic_changes_required": false,
    "slot_rows": [],
    "slot_rows_count": 0
  },
  "vm121_role": {
    "vm121_may_hold_backend_db": true,
    "vm121_may_hold_billing_subscriptions_users": true,
    "vm121_may_receive_telemetry": true,
    "vm121_must_not_be_dynamic_egress_decision_owner": true,
    "vm121_must_not_be_live_traffic_accounting_owner": true,
    "vm121_must_not_be_selector_apply_owner": true
  }
}