# WG Paid / MGTS — R20L R04 full candidate-config binding continuation

## Trigger

R20L R03 passed baseline, created snapshot `r20l-pre-0722-125511`, created verified backup `/root/router-egress-r20l-r03-backup-20260722-125511`, installed the new adapter temporarily, and then stopped at `STOP_R20L_APPLY_DRY_RUN_RC`. The backup rollback passed and restored the exact R20J adapter. No Machine Git publication or completed core change occurred.

The adapter did not fail its full-binding logic. The R20L R03 harness invoked production `--dry-run` against the live candidate pools. The latest ranked/working pool had crossed `MAX_POOL_AGE_SEC=129600`, so the adapter correctly refused it as stale. Installation correctness must not depend on whether an operational replacement pool happens to be fresh at install time.

## Accepted R20K R03 diagnosis

The corrected diagnostic result remains the basis of the production payload:

- endpoint-only replacement: `0/3` PASS;
- complete candidate config: `3/3` PASS;
- complete candidate identity proven: `3/3`.

## Continuation correction

R20L R04 keeps the production payload byte-identical. It changes only the STEP harness:

1. reuse and verify the existing R20L R03 Proxmox snapshot;
2. reuse and verify the existing R20L R03 backup and manifest;
3. install the same adapter payload;
4. create an isolated temporary recovery state, persistent state, log, cache and fresh pool on VM101;
5. select a real non-active candidate `.conf` with complete HideMyName binding;
6. run the installed adapter in `--dry-run` against that isolated fresh pool;
7. require `dry_run_candidate_full_config_selected` and a real config SHA256;
8. prove all production state, quarantine, events, counter, network and last-result artifacts are unchanged;
9. remove the isolated fixture;
10. continue with the normal postcheck, Machine Git publication and report publication.

The isolated test never invokes `--commit`, never restarts a VPN interface and never modifies the production candidate pool.

## Production correction retained

`/usr/local/lib/router-egress-hmn-slot-replace.sh` continues to replace the whole candidate binding: interface private key/address, AWG parameters, peer public key, AllowedIPs, keepalive, endpoint and source-config metadata. Success still requires binding identity, endpoint identity, route and strict egress proof.

## Next step

After R20L R04 PASS, obtain or build a fresh tested HideMyName pool before repeating the controlled live-port LOCAL_REPAIR test as R20H R06. Pool freshness is an operational precondition of the real test, not an installation precondition.