balancer-lite-lua/balancer-lite-lua.dlog

# balancer-lite-lua.dlog — Deployment Log

## 2026-09-04 Initial Prototype

### What
Created new workspace project `balancer-lite-lua/` for OpenWrt 22.03 Lua 5.1 port of
balancer-lite's hysteresis watchdog, flap detection, signed webhook outbox, and retention store.
Thin-layer only (~800–1000 LOC) — composes with mwan3/netifd rather than replacing them.

### Commit
Not yet committed (pending lint).

### Files
- `src/balancerlite/state.lua` — 8-state hysteresis machine (INIT, WAN_A_PRIMARY, WAN_B_PRIMARY, SWITCHING_TO_A, SWITCHING_TO_B, DEGRADED, BOTH_DOWN)
- `src/balancerlite/probes.lua` — ICMP/TCP/DNS health checks via ping/nc/nslookup subprocesses
- `src/balancerlite/store.lua` — JSONL append-only event log + compaction
- `src/balancerlite/outbox.lua` — Signed webhook retry queue with exponential backoff + circuit breaker
- `src/balancerlite/sha256.lua` — SHA-256/HMAC-SHA256 via `openssl dgst` CLI
- `src/balancerlite/config.lua` — UCI config file parser
- `src/balancerlite/main.lua` — procd-compatible poll loop daemon
- `src/balancerlite/json.lua` — Pure-Lua JSON encoder (JSON.stringify only)
- `etc/init.d/balancerlite` — procd init script
- `etc/config/balancerlite` — UCI config example
- `Makefile` — lint + test targets
- `tests/state.lua` — 8 state machine tests (all passing)
- `tests/sha256.lua` — SHA-256 + HMAC-SHA256 test vectors (all passing)
- `MEMORY.md`, `README.md`

### Test Results
```
lua5.1 tests/state.lua  →  PASS: state (8/8 tests)
lua5.1 tests/sha256.lua →  PASS: sha256 (3/3 vectors)
```

### Verification Commands
```sh
cd /root/.openclaw/workspace/balancer-lite-lua
make test
make lint
```

### Notes
- HMAC-SHA256 uses `openssl dgst -hmac` CLI (openssl-util package on OpenWrt 22.03)
- No lua-crypto dependency; no raw sockets; all probes via subprocess
- State machine behavior verified against Go source: 8 states, same transition logic
- SWITCHING_TO_* are intermediate (one-drive-cycle) states; BOTH_DOWN transitions directly to stable primary (no intermediate)
- BOTH_DOWN clears switch_times (flap detection not counted during all-down)
- DEGRADED entry: flap check counts #record_switch calls; needs `flap_threshold` of them before DEGRADED triggers

### Next Steps
1. Run lua51-openwrt-lint on all modules
2. Run openwrt-testbed for runtime validation
3. Write remaining modules: routing.lua (policy routing), wg.lua (WG endpoint re-point)
4. Write balancerlite-ctl CLI tool
5. Commit and push to git3