# VM101 next implementation sequence after R15A

## R15B1 — generation schema and validator

Purpose: define the immutable on-disk contract for a staged five-slot generation.

Deliverables:

- generation identifier and timestamps;
- exactly five candidate records mapped to `vpn1..vpn5`;
- endpoint uniqueness;
- exclusion of current-generation quarantine;
- source/rank/test evidence per candidate;
- no modification of active slots;
- deterministic fixtures for duplicate, quarantined, missing and malformed candidates.

PASS means a generation can be constructed and validated offline, but cannot be activated.

## R15B2 — live shadow generation builder

Purpose: use the real HideMyName download, low-level `vpn_test` and ranker to build a
new generation under recovery-owned state without touching active `vpn1..vpn5`.

Required proof:

- five unique tested candidates;
- active endpoints excluded;
- quarantined endpoints excluded;
- generation and all evidence stored atomically;
- interrupted build leaves no valid partial generation;
- existing production loop and five active slots remain unchanged.

## R15B3 — independent staged-generation proof

Purpose: independently re-check the shadow generation before any apply engine exists.

Required proof:

- manifest/SHA256 consistency;
- exact five-slot mapping;
- test evidence freshness;
- route and egress test contract defined for future activation;
- negative tests cannot modify the active generation.

## R16A — transactional five-slot apply engine

Purpose: apply one already validated generation as a single transaction.

Sequence:

1. snapshot current active generation;
2. prepare all five slot configurations;
3. apply and prove each slot;
4. verify tables 201..205 and real egress;
5. activate generation metadata only after all five pass;
6. rollback all five if any slot or independent proof fails.

A failed generation must never partially replace the active generation.

## R16B — FULL_POOL_REFRESH orchestration proof

Purpose: connect the repair threshold to builder, validator and transactional apply.

Required proof:

- `repair_events_since_full_refresh` triggers refresh at the configured threshold;
- successful generation activation resets the counter to zero;
- failed build or apply leaves the counter and active generation intact;
- old quarantine is archived only after successful activation.

## R17A — DEGRADED_POOL state and retry scheduler

Purpose: preserve remaining healthy VPN slots when HideMyName or generation creation fails.

Required proof:

- no working VPN is destroyed by a failed refresh;
- refresh retry interval is configurable;
- repair counter is not reset;
- Direct remains disabled.

## R17B — SLOT_EXHAUSTED and consolidation

Purpose: redistribute users only across independently healthy VPN slots.

Required proof:

- 5→4→2→1 healthy-slot consolidation;
- no Direct while at least one healthy VPN remains;
- recovery attempts continue;
- recovery back to DEGRADED_POOL or NORMAL is deterministic.

## R18A — bootstrap strategy contract with Direct gate disabled

Purpose: implement strategy interfaces without enabling customer Direct failopen.

Initial strategies:

- cached-pool bootstrap through technical `vpn1`;
- optional Dedenево WireGuard transport.

The bootstrap slot must not receive customer traffic automatically.

## R18B — explicitly approved DIRECT_EMERGENCY and return transaction

Purpose: prove the zero-healthy-slot emergency path only after separate approval.

Required proof:

- Direct entry only at `healthy_vpn_slot_count=0`;
- recovery continues while clients use Direct;
- one bootstrap tunnel is not considered full recovery;
- clients return to VPN only after a complete five-slot generation passes;
- Direct is then disabled and emergency state cleared.

## Final destructive and cold-bootstrap proof

From a clean VM101 boot:

- drive the state machine through every transition;
- test unavailable HideMyName;
- exhaust candidates;
- enter and leave Direct under explicit approval;
- reboot during staged and active states;
- prove persisted state, rollback and publication artifacts.