{
  "schema": "vm101-m07-source-contract-v1",
  "sources": {
    "runner": {
      "path": "/opt/router-ops/public/r/e94a0859747d7b96f29c7fdafc2d0351ba603bb0a7e9e5a4/20260711-181714_step050m07a_readonly_review_full_hmn_refresh_contract/sources/router-egress-emergency-refresh.sh",
      "size_bytes": 9034
    },
    "refresh": {
      "path": "/opt/router-ops/public/r/e94a0859747d7b96f29c7fdafc2d0351ba603bb0a7e9e5a4/20260711-181714_step050m07a_readonly_review_full_hmn_refresh_contract/sources/hmn-refresh-pool-safe.sh",
      "size_bytes": 8670
    },
    "apply": {
      "path": "/opt/router-ops/public/r/e94a0859747d7b96f29c7fdafc2d0351ba603bb0a7e9e5a4/20260711-181714_step050m07a_readonly_review_full_hmn_refresh_contract/sources/router-egress-hmn-rebalance-top5-apply.sh",
      "size_bytes": 7723
    },
    "planner": {
      "path": "/opt/router-ops/public/r/e94a0859747d7b96f29c7fdafc2d0351ba603bb0a7e9e5a4/20260711-181714_step050m07a_readonly_review_full_hmn_refresh_contract/sources/router-egress-hmn-plan-top5.sh",
      "size_bytes": 5273
    },
    "helper": {
      "path": "/opt/router-ops/public/r/e94a0859747d7b96f29c7fdafc2d0351ba603bb0a7e9e5a4/20260711-181714_step050m07a_readonly_review_full_hmn_refresh_contract/sources/router-egress-recovery-state.sh",
      "size_bytes": 6638
    },
    "hook": {
      "path": "/opt/router-ops/public/r/e94a0859747d7b96f29c7fdafc2d0351ba603bb0a7e9e5a4/20260711-181714_step050m07a_readonly_review_full_hmn_refresh_contract/sources/router-egress-emergency-decision-hook.sh",
      "size_bytes": 2511
    }
  },
  "known_runtime_paths": {
    "refresh": "/root/hmn/hmn-refresh-pool-safe.sh",
    "apply": "/usr/local/sbin/router-egress-hmn-rebalance-top5-apply.sh",
    "planner": "/usr/local/sbin/router-egress-hmn-plan-top5.sh",
    "helper": "/usr/local/lib/router-egress-recovery-state.sh"
  },
  "features": {
    "runner": {
      "references_refresh": true,
      "references_apply": true,
      "references_planner": true,
      "references_state_helper": true,
      "dry_run_refs": [
        {
          "line": 21,
          "text": "mode=\"dry-run\""
        },
        {
          "line": 35,
          "text": "    --dry-run|--dryrun)"
        },
        {
          "line": 36,
          "text": "      mode=\"dry-run\""
        },
        {
          "line": 39,
          "text": "      mode=\"dry-run\""
        },
        {
          "line": 215,
          "text": "if [ \"$mode\" = \"dry-run\" ]; then"
        }
      ],
      "commit_refs": [
        {
          "line": 9,
          "text": "EMERGENCY_COMMIT_ENABLED=\"${EMERGENCY_COMMIT_ENABLED:-false}\""
        },
        {
          "line": 41,
          "text": "    --commit|--apply)"
        },
        {
          "line": 168,
          "text": "  echo \"  \\\"commit_enabled\\\": $(json_bool \"$EMERGENCY_COMMIT_ENABLED\"),\""
        },
        {
          "line": 229,
          "text": "  if [ \"$EMERGENCY_COMMIT_ENABLED\" != \"true\" ]; then"
        },
        {
          "line": 273,
          "text": "      \"$EMERGENCY_REBALANCE_APPLY_CMD\" --commit --confirm REBALANCE_TOP5_DAILY >> \"$EMERGENCY_LOG\" 2>&1"
        }
      ],
      "refresh_invocation_refs": [
        {
          "line": 13,
          "text": "EMERGENCY_REFRESH_CMD=\"${EMERGENCY_REFRESH_CMD:-/root/hmn/hmn-refresh-pool-safe.sh}\""
        },
        {
          "line": 172,
          "text": "  echo \"  \\\"refresh_cmd\\\": \\\"$(json_s \"$EMERGENCY_REFRESH_CMD\")\\\",\""
        }
      ],
      "apply_invocation_refs": [
        {
          "line": 15,
          "text": "EMERGENCY_REBALANCE_APPLY_CMD=\"${EMERGENCY_REBALANCE_APPLY_CMD:-/usr/local/sbin/router-egress-hmn-rebalance-top5-apply.sh}\""
        }
      ],
      "counter_reset_refs": [
        {
          "line": 105,
          "text": "    reg_daily_repair_get 2>/dev/null || echo 0"
        }
      ],
      "success_guard_refs": [
        {
          "line": 114,
          "text": "    if ip link show dev \"$iface\" >/dev/null 2>&1 && ping -I \"$iface\" -c 1 -W 3 1.1.1.1 >/tmp/emergency-refresh-ping-${iface}.$$ 2>/dev/null; then"
        },
        {
          "line": 260,
          "text": "  if [ ! -x \"$EMERGENCY_REFRESH_CMD\" ]; then"
        },
        {
          "line": 270,
          "text": "  if [ \"$refresh_rc\" = \"0\" ]; then"
        },
        {
          "line": 272,
          "text": "    if [ -x \"$EMERGENCY_REBALANCE_APPLY_CMD\" ]; then"
        },
        {
          "line": 280,
          "text": "    if [ \"$rebalance_rc\" = \"0\" ]; then"
        }
      ],
      "lock_refs": [
        {
          "line": 18,
          "text": "EMERGENCY_LOCK_DIR=\"${EMERGENCY_LOCK_DIR:-/var/lock/router-egress-emergency-refresh.lock}\""
        }
      ],
      "direct_failopen_refs": [
        {
          "line": 10,
          "text": "EMERGENCY_DIRECT_FAILOPEN_ENABLED=\"${EMERGENCY_DIRECT_FAILOPEN_ENABLED:-false}\""
        },
        {
          "line": 169,
          "text": "  echo \"  \\\"direct_failopen_enabled\\\": $(json_bool \"$EMERGENCY_DIRECT_FAILOPEN_ENABLED\"),\""
        },
        {
          "line": 170,
          "text": "  echo \"  \\\"direct_failopen_action\\\": \\\"disabled_not_allowed_in_step050f\\\",\""
        },
        {
          "line": 258,
          "text": "  printf '%s action=emergency_refresh_start count=%s threshold=%s direct_failopen=false\\n' \"$(date -u '+%Y-%m-%dT%H:%M:%SZ' 2>/dev/null || date)\" \"$cnt\" \"$EMERGENCY_DAILY_FAIL_THRESHOLD\" >> \"$EMERGENCY_LOG\" 2>/dev/null || true"
        },
        {
          "line": 290,
          "text": "      emit_json \"refresh_ok_rebalance_failed\" \"refresh_succeeded_but_rebalance_failed_no_direct_failopen\""
        },
        {
          "line": 298,
          "text": "    emit_json \"refresh_failed_degraded_no_direct\" \"refresh_failed_but_direct_failopen_disabled_in_state_machine\""
        }
      ]
    },
    "refresh": {
      "backup_refs": [
        {
          "line": 60,
          "text": "    say \"rollback: no backup dir available\""
        },
        {
          "line": 64,
          "text": "  say \"rollback: restoring published pointers/tables from $BACK\""
        },
        {
          "line": 73,
          "text": "    say \"rollback: latest symlink restored to readlink target: $OLD_LINK\""
        },
        {
          "line": 77,
          "text": "    say \"rollback: latest symlink restored to realpath: $OLD_REAL\""
        },
        {
          "line": 79,
          "text": "    say \"rollback WARN: no usable old latest target\""
        },
        {
          "line": 89,
          "text": "      say \"rollback: restored cache/$BN\""
        },
        {
          "line": 149,
          "text": "  echo \"=== backup current published pointers/tables ===\""
        },
        {
          "line": 164,
          "text": "  say \"backup=$BACK\""
        },
        {
          "line": 216,
          "text": "      echo \"rollback-after-fresh-validation-failed\" > \"$LAST_REFRESH_POOL_SOURCE\""
        },
        {
          "line": 237,
          "text": "      echo \"rollback-after-old-validation-failed\" > \"$LAST_REFRESH_POOL_SOURCE\""
        }
      ],
      "atomic_write_refs": [
        {
          "line": 14,
          "text": "LOCK=\"/tmp/hmn-refresh-pool-safe.lock\""
        },
        {
          "line": 22,
          "text": "RCFILE=\"/tmp/hmn-refresh-pool-safe.rc.$$\""
        }
      ],
      "failure_guard_refs": [
        {
          "line": 60,
          "text": "    say \"rollback: no backup dir available\""
        },
        {
          "line": 64,
          "text": "  say \"rollback: restoring published pointers/tables from $BACK\""
        },
        {
          "line": 73,
          "text": "    say \"rollback: latest symlink restored to readlink target: $OLD_LINK\""
        },
        {
          "line": 77,
          "text": "    say \"rollback: latest symlink restored to realpath: $OLD_REAL\""
        },
        {
          "line": 79,
          "text": "    say \"rollback WARN: no usable old latest target\""
        },
        {
          "line": 89,
          "text": "      say \"rollback: restored cache/$BN\""
        },
        {
          "line": 140,
          "text": "  trap 'rmdir \"$LOCK\" 2>/dev/null || true' EXIT"
        },
        {
          "line": 216,
          "text": "      echo \"rollback-after-fresh-validation-failed\" > \"$LAST_REFRESH_POOL_SOURCE\""
        },
        {
          "line": 237,
          "text": "      echo \"rollback-after-old-validation-failed\" > \"$LAST_REFRESH_POOL_SOURCE\""
        }
      ],
      "pool_refs": [
        {
          "line": 11,
          "text": "VALIDATE=\"$BASE/hmn-validate-current-pool.sh\""
        },
        {
          "line": 14,
          "text": "LOCK=\"/tmp/hmn-refresh-pool-safe.lock\""
        },
        {
          "line": 21,
          "text": "LOG=\"$LOGDIR/refresh-pool-safe-$TS-$$.log\""
        },
        {
          "line": 22,
          "text": "RCFILE=\"/tmp/hmn-refresh-pool-safe.rc.$$\""
        },
        {
          "line": 30,
          "text": "LAST_REFRESH_POOL_SOURCE=\"$STATE/last-refresh-pool-source\""
        },
        {
          "line": 83,
          "text": "    ok-awg1-strict-all-latest.tsv \\"
        },
        {
          "line": 84,
          "text": "    ok-awg1-strict-foreign-latest.tsv \\"
        },
        {
          "line": 85,
          "text": "    selected-awg1-latest.tsv"
        },
        {
          "line": 116,
          "text": "  say \"=== hmn-refresh-pool-safe start ===\""
        },
        {
          "line": 157,
          "text": "    \"$BASE/cache/ok-awg1-strict-all-latest.tsv\" \\"
        },
        {
          "line": 158,
          "text": "    \"$BASE/cache/ok-awg1-strict-foreign-latest.tsv\" \\"
        },
        {
          "line": 159,
          "text": "    \"$BASE/cache/selected-awg1-latest.tsv\""
        },
        {
          "line": 205,
          "text": "    say \"validate fresh/current latest pool through vpn_test\""
        },
        {
          "line": 213,
          "text": "      say \"fresh pool validation failed; rolling back to previous published pool\""
        },
        {
          "line": 222,
          "text": "    say \"fallback: keep old configs/latest and validate current local pool through vpn_test\""
        },
        {
          "line": 234,
          "text": "      say \"old/current pool validation failed; rolling back published tables\""
        },
        {
          "line": 282,
          "text": "  head -n 12 \"$BASE/cache/ok-awg1-strict-foreign-latest.tsv\" 2>/dev/null || echo \"missing\""
        },
        {
          "line": 286,
          "text": "  cat \"$BASE/cache/selected-awg1-latest.tsv\" 2>/dev/null || echo \"missing\""
        },
        {
          "line": 293,
          "text": "  say \"=== hmn-refresh-pool-safe done ===\""
        }
      ],
      "provider_fetch_refs": [
        {
          "line": 5,
          "text": "BASE=\"/root/hmn\""
        },
        {
          "line": 10,
          "text": "DOWNLOADER=\"$BASE/hmn-download-all-awg.sh\""
        },
        {
          "line": 11,
          "text": "VALIDATE=\"$BASE/hmn-validate-current-pool.sh\""
        },
        {
          "line": 14,
          "text": "LOCK=\"/tmp/hmn-refresh-pool-safe.lock\""
        },
        {
          "line": 22,
          "text": "RCFILE=\"/tmp/hmn-refresh-pool-safe.rc.$$\""
        },
        {
          "line": 116,
          "text": "  say \"=== hmn-refresh-pool-safe start ===\""
        },
        {
          "line": 173,
          "text": "      say \"trying fresh HMN download via: $DOWNLOADER\""
        },
        {
          "line": 188,
          "text": "      say \"simulating HMN fresh download failure\""
        },
        {
          "line": 293,
          "text": "  say \"=== hmn-refresh-pool-safe done ===\""
        }
      ]
    },
    "apply": {
      "backup_refs": [
        {
          "line": 151,
          "text": "        cat > \"$backup_dir/rollback-${slot}.sh\" <<EOF"
        },
        {
          "line": 159,
          "text": "echo rollback_done=true"
        },
        {
          "line": 161,
          "text": "        chmod 700 \"$backup_dir/rollback-${slot}.sh\""
        },
        {
          "line": 175,
          "text": "          \"$backup_dir/rollback-${slot}.sh\" >/dev/null 2>&1 || true"
        },
        {
          "line": 211,
          "text": "echo '  \"safety\": {\"commit_requires_confirm\": true, \"per_slot_strict_check\": true, \"per_slot_rollback\": true}'"
        }
      ],
      "rollback_refs": [
        {
          "line": 64,
          "text": "trap 'rm -f \"$tmp_top\" \"$tmp_current\" \"$tmp_missing\" \"$tmp_plan\"' EXIT"
        },
        {
          "line": 151,
          "text": "        cat > \"$backup_dir/rollback-${slot}.sh\" <<EOF"
        },
        {
          "line": 159,
          "text": "echo rollback_done=true"
        },
        {
          "line": 161,
          "text": "        chmod 700 \"$backup_dir/rollback-${slot}.sh\""
        },
        {
          "line": 175,
          "text": "          \"$backup_dir/rollback-${slot}.sh\" >/dev/null 2>&1 || true"
        },
        {
          "line": 211,
          "text": "echo '  \"safety\": {\"commit_requires_confirm\": true, \"per_slot_strict_check\": true, \"per_slot_rollback\": true}'"
        }
      ],
      "validation_refs": [
        {
          "line": 9,
          "text": "PREFERRED_POOL_FILES=\"${PREFERRED_POOL_FILES:-ok-awg1-strict-foreign-latest.tsv ok-awg1-strict-all-latest.tsv}\""
        },
        {
          "line": 27,
          "text": "strict_ping() {"
        },
        {
          "line": 31,
          "text": "    ping -I \"$iface\" -c 3 -W 2 \"$target\" >/tmp/rebalance-ping.out 2>/tmp/rebalance-ping.err"
        },
        {
          "line": 33,
          "text": "    recv=\"$(grep -Eo '[0-9]+ packets received' /tmp/rebalance-ping.out 2>/dev/null | awk '{print $1}' | tail -1)\""
        },
        {
          "line": 37,
          "text": "  rm -f /tmp/rebalance-ping.out /tmp/rebalance-ping.err"
        },
        {
          "line": 150,
          "text": "        ip route show table \"$table\" > \"$backup_dir/table.before\" 2>/dev/null || true"
        },
        {
          "line": 171,
          "text": "        if [ \"$rc\" != \"0\" ] || ! ip route show table \"$table\" 2>/dev/null | grep -q . || ! strict_ping \"$iface\"; then"
        },
        {
          "line": 211,
          "text": "echo '  \"safety\": {\"commit_requires_confirm\": true, \"per_slot_strict_check\": true, \"per_slot_rollback\": true}'"
        }
      ],
      "slot_refs": [],
      "planner_refs": []
    },
    "planner": {
      "quarantine_refs": [
        {
          "line": 78,
          "text": "  QUARANTINE_ENABLED=true"
        },
        {
          "line": 80,
          "text": "  QUARANTINE_ENABLED=false"
        },
        {
          "line": 96,
          "text": "quarantine_excluded=0"
        },
        {
          "line": 110,
          "text": "    if [ \"$QUARANTINE_ENABLED\" = \"true\" ] && reg_endpoint_quarantined_for_pool \"$endpoint\" \"$POOL\"; then"
        },
        {
          "line": 111,
          "text": "      quarantine_excluded=$((quarantine_excluded + 1))"
        },
        {
          "line": 172,
          "text": "echo \"  \\\"quarantine_enabled\\\": $QUARANTINE_ENABLED,\""
        },
        {
          "line": 173,
          "text": "echo \"  \\\"quarantine_excluded_count\\\": $quarantine_excluded,\""
        }
      ],
      "five_slot_refs": [
        {
          "line": 7,
          "text": "WORK=\"/tmp/router-egress-hmn-plan-top5.$$\""
        },
        {
          "line": 8,
          "text": "SLOTS=\"egress1:vpn1 egress2:vpn2 egress3:vpn3 egress4:vpn4 egress5:vpn5\""
        },
        {
          "line": 71,
          "text": "  echo \"{\\\"schema\\\":\\\"router-egress-hmn-plan-top5-v2\\\",\\\"decision\\\":\\\"missing_pool\\\",\\\"pool\\\":\\\"$(json_s \"$POOL\")\\\",\\\"changes_count\\\":0,\\\"plan\\\":[]}\""
        },
        {
          "line": 168,
          "text": "echo \"  \\\"schema\\\": \\\"router-egress-hmn-plan-top5-v2\\\",\""
        }
      ],
      "json_refs": [
        {
          "line": 13,
          "text": "json_s() {"
        },
        {
          "line": 71,
          "text": "  echo \"{\\\"schema\\\":\\\"router-egress-hmn-plan-top5-v2\\\",\\\"decision\\\":\\\"missing_pool\\\",\\\"pool\\\":\\\"$(json_s \"$POOL\")\\\",\\\"changes_count\\\":0,\\\"plan\\\":[]}\""
        },
        {
          "line": 115,
          "text": "    printf '%s\\t%s\\t%s\\n' \"$endpoint\" \"${rank:-0}\" \"${avg_ms:-}\" >> \"$CAND\""
        },
        {
          "line": 138,
          "text": "    rank=\"$(printf '%s\\n' \"$row\" | awk -F '\\t' '{print $2}')\""
        },
        {
          "line": 139,
          "text": "    avg=\"$(printf '%s\\n' \"$row\" | awk -F '\\t' '{print $3}')\""
        },
        {
          "line": 143,
          "text": "    target=\"$(printf '%s\\n' \"$row\" | awk -F '\\t' '{print $1}')\""
        },
        {
          "line": 144,
          "text": "    rank=\"$(printf '%s\\n' \"$row\" | awk -F '\\t' '{print $2}')\""
        },
        {
          "line": 145,
          "text": "    avg=\"$(printf '%s\\n' \"$row\" | awk -F '\\t' '{print $3}')\""
        },
        {
          "line": 169,
          "text": "echo \"  \\\"decision\\\": \\\"$(json_s \"$decision\")\\\",\""
        },
        {
          "line": 170,
          "text": "echo \"  \\\"pool\\\": \\\"$(json_s \"$POOL\")\\\",\""
        },
        {
          "line": 181,
          "text": "  printf '    {\"slot\":\"%s\",\"iface\":\"%s\",\"current\":\"%s\",\"target\":\"%s\",\"change\":%s,\"target_rank\":\"%s\",\"target_avg_ms\":\"%s\"}\\n' \\"
        },
        {
          "line": 182,
          "text": "    \"$(json_s \"$slot\")\" \\"
        },
        {
          "line": 183,
          "text": "    \"$(json_s \"$iface\")\" \\"
        },
        {
          "line": 184,
          "text": "    \"$(json_s \"$cur\")\" \\"
        },
        {
          "line": 185,
          "text": "    \"$(json_s \"$target\")\" \\"
        },
        {
          "line": 187,
          "text": "    \"$(json_s \"$rank\")\" \\"
        },
        {
          "line": 188,
          "text": "    \"$(json_s \"$avg\")\""
        }
      ]
    },
    "helper": {
      "counter_get_refs": [
        {
          "line": 177,
          "text": "reg_daily_repair_get() {"
        }
      ],
      "counter_reset_refs": [],
      "state_dir_refs": [
        {
          "line": 3,
          "text": "REG_STATE_DIR=\"${REG_STATE_DIR:-/var/lib/router-egress-recovery}\""
        },
        {
          "line": 4,
          "text": "REG_QUARANTINE_TSV=\"${REG_QUARANTINE_TSV:-$REG_STATE_DIR/quarantine.tsv}\""
        },
        {
          "line": 5,
          "text": "REG_COUNTER_DIR=\"${REG_COUNTER_DIR:-$REG_STATE_DIR/fail-counter}\""
        },
        {
          "line": 6,
          "text": "REG_STATE_KV=\"${REG_STATE_KV:-$REG_STATE_DIR/state.kv}\""
        },
        {
          "line": 7,
          "text": "REG_LOCK_DIR=\"${REG_LOCK_DIR:-$REG_STATE_DIR/locks}\""
        },
        {
          "line": 30,
          "text": "  mkdir -p \"$REG_STATE_DIR\" \"$REG_COUNTER_DIR\" \"$REG_LOCK_DIR\" 2>/dev/null || return 1"
        },
        {
          "line": 186,
          "text": "  old_state_dir=\"$REG_STATE_DIR\""
        },
        {
          "line": 193,
          "text": "  REG_STATE_DIR=\"$test_root/state\""
        },
        {
          "line": 194,
          "text": "  REG_QUARANTINE_TSV=\"$REG_STATE_DIR/quarantine.tsv\""
        },
        {
          "line": 195,
          "text": "  REG_COUNTER_DIR=\"$REG_STATE_DIR/fail-counter\""
        },
        {
          "line": 196,
          "text": "  REG_STATE_KV=\"$REG_STATE_DIR/state.kv\""
        },
        {
          "line": 197,
          "text": "  REG_LOCK_DIR=\"$REG_STATE_DIR/locks\""
        },
        {
          "line": 255,
          "text": "  REG_STATE_DIR=\"$old_state_dir\""
        }
      ]
    },
    "hook": {
      "runner_refs": [
        {
          "line": 8,
          "text": "RUNNER=\"${EMERGENCY_DECISION_RUNNER:-/usr/local/sbin/router-egress-emergency-refresh.sh}\""
        },
        {
          "line": 47,
          "text": "  echo \"  \\\"runner\\\": \\\"$(json_s \"$RUNNER\")\\\"\""
        },
        {
          "line": 60,
          "text": "  elif [ ! -x \"$RUNNER\" ]; then"
        },
        {
          "line": 64,
          "text": "    \"$RUNNER\" --dry-run > \"$tmp\" 2> \"$err\""
        }
      ],
      "dry_run_refs": [
        {
          "line": 28,
          "text": "    --dry-run)"
        },
        {
          "line": 58,
          "text": "    emit_fallback \"unsafe_config_refused\" \"dry_run_hook_refuses_commit_or_direct_configuration\" > \"$tmp\""
        },
        {
          "line": 64,
          "text": "    \"$RUNNER\" --dry-run > \"$tmp\" 2> \"$err\""
        }
      ],
      "commit_refs": []
    }
  },
  "sequence": {
    "refresh_position": 539,
    "apply_position": 737,
    "counter_reset_position": 2459,
    "refresh_before_apply": true,
    "counter_reset_after_apply": true
  },
  "execution_contract": {
    "runner_has_dry_run": true,
    "runner_has_commit_gate": true,
    "runner_references_refresh": true,
    "runner_references_apply": true,
    "runner_references_state_helper": true,
    "refresh_has_backup_evidence": true,
    "refresh_has_atomic_write_evidence": true,
    "refresh_has_failure_guard": true,
    "apply_has_backup_evidence": true,
    "apply_has_rollback_evidence": true,
    "apply_has_validation_evidence": true,
    "planner_has_quarantine_evidence": true,
    "helper_has_counter_reset": false,
    "automatic_hook_is_dry_run": true,
    "automatic_hook_has_no_commit_path": true
  },
  "blocking_gaps": [
    "helper_has_counter_reset"
  ],
  "source_contract_ready": false
}