netplan: restore the Pi-identical comment; rollback re-runs van-br0-setup

- ap/50-van-wan.yaml: revert the comment to "see STARLINK_IFACE in deploy.conf" so the
  rendered file is byte-identical to the Pi 5's installed netplan (it otherwise reports
  "differs" forever); note in deploy.sh next to render_wan_netplan.
- check 14: baseline 3d117e7, keep byte-identity for wan.conf, assert no /etc/vanlink.conf;
  the failure branch no longer aborts the suite under pipefail.
- helper restore(): restart van-br0-setup (unit present, timeout 30, non-fatal) after the
  re-apply, before the connectivity re-check; asserted in the rollback sandbox scenario.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KqhjP7nud5gdBg25zCiRk9

ap/50-van-wan.yaml

@@ -10,7 +10,7 @@ network:
   version: 2
   ethernets:
     # Starlink dish uplink (RTL8153 USB NIC, MAC-named — travels with the
-    # adapter, see STARLINK_IFACE in /etc/vanlink.conf). The /32 link route keeps the
+    # adapter, see STARLINK_IFACE in deploy.conf). The /32 link route keeps the
     # dish's management address reachable no matter which WAN holds the
     # default route: the dish answers on 192.168.100.1 (gRPC :9200) even while
     # the uplink sits behind CGNAT.

deploy.sh

@@ -106,6 +106,9 @@ render() {  # render <file> -> stdout, with @TOKEN@ placeholders substituted
 # The netplan is two templates: ap/50-van-wan.yaml (ethernet/Starlink) and
 # ap/50-van-wan-wifi.yaml (the wifis: stanza, appended verbatim only for hosts
 # with a Wi-Fi uplink, so a host without one gets no empty/invalid wifis: block).
+# The rendered netplan must stay byte-identical to what live hosts have installed (comments included:
+# nm_wan_state_netplan compares bytes, and "differs" invites an --apply-network that flaps the uplinks).
+# Do not edit comments in ap/50-van-wan*.yaml without re-checking `--wan-plan` on every host.
 render_wan_netplan() {  # ap/50-van-wan.yaml, plus the wifis stanza when the host has a Wi-Fi uplink
     render ap/50-van-wan.yaml
     if [ -n "${WIFI_WAN_IFACE:-}" ]; then
@@ -401,7 +404,7 @@ PY
 #   (netplan generate/apply run under timeout -k AN_KILL_T: +AN_KILL_T each in the worst case)
 #   forward path  AN_FWD = NM conf reload + generate + apply + 2*kill + van-br0-setup (unit check + restart)
 #                          + stage 1 + restart + stage 2 + networkd info line + diagnostics (logged once, on a failed gate)
-#   rollback path AN_RB  = generate + apply + 2*kill + NM conf reload + restart + connectivity recheck
+#   rollback path AN_RB  = generate + apply + 2*kill + NM conf reload + van-br0-setup (unit check + restart) + restart + connectivity recheck
 #   helper worst case AN_HELPER_MAX = AN_FWD + AN_RB + AN_SLOP (loop iterations overshoot their
 #     deadline by a few nmcli/ping timeouts)
 #   foreground waits AN_WAIT = AN_HELPER_MAX + 30
@@ -413,7 +416,7 @@ PY
 AN_KILL_T=10 AN_APPLY_T=90 AN_GEN_T=30 AN_NM_T=5 AN_RESTART_T=30 AN_S1=60 AN_S2=120 AN_RC=60 AN_SLOP=60
 AN_DIAG=$(( 5 * AN_NM_T ))   # diag(): five commands, each under timeout AN_NM_T
 AN_FWD=$(( AN_NM_T + AN_GEN_T + AN_APPLY_T + 2 * AN_KILL_T + AN_NM_T + AN_RESTART_T + AN_S1 + AN_RESTART_T + AN_S2 + AN_NM_T + AN_DIAG ))
-AN_RB=$(( AN_GEN_T + AN_APPLY_T + 2 * AN_KILL_T + AN_NM_T + AN_RESTART_T + AN_RC ))
+AN_RB=$(( AN_GEN_T + AN_APPLY_T + 2 * AN_KILL_T + AN_NM_T + AN_NM_T + AN_RESTART_T + AN_RESTART_T + AN_RC ))
 AN_HELPER_MAX=$(( AN_FWD + AN_RB + AN_SLOP ))
 AN_WAIT=$(( AN_HELPER_MAX + 30 ))
 AN_RUNMAX=$(( AN_HELPER_MAX + 60 ))
@@ -517,6 +520,10 @@ restore() {  # restore <reason>: put the pre-run netplan back, re-check connecti
     fi
     timeout -k $AN_KILL_T $AN_GEN_T netplan generate && timeout -k $AN_KILL_T $AN_APPLY_T netplan apply || { [ "\$rb" != ok ] || rb=APPLY-FAILED; }
     [ ! -f "\$ncd/$pc" ] || timeout $AN_NM_T nmcli general reload conf || echo "nmcli general reload conf failed"
+    # the re-apply restarted networkd too, which can drop br0's members (as on the forward path; not gating)
+    if timeout $AN_NM_T systemctl cat van-br0-setup >/dev/null 2>&1; then
+        timeout $AN_RESTART_T systemctl restart van-br0-setup || echo "van-br0-setup restart failed (continuing)"
+    fi
     timeout $AN_RESTART_T systemctl restart van-failover || true
     end=\$((SECONDS+$d3))
     while :; do

tests/check-templates.sh

@@ -207,12 +207,14 @@ done
 
 # 14. the netplan split leaves the Pi 5's rendered WAN netplan byte-identical, and the R5C (no Wi-Fi WAN) omits wifis
 old=$(mktemp)
-git show 223652b:ap/50-van-wan.yaml > "$old"
+# 3d117e7: the last commit with the original comments, byte-identical to what the Pi 5 has installed
+git show 3d117e7:ap/50-van-wan.yaml > "$old"
 want=$(VANLINK_CONF=hosts/wan.conf ./deploy.sh render "$old")
 tmpw=$(mktemp)
 # render_wan_netplan is internal; expose it through --render-wan-netplan (documented in the header)
 VANLINK_CONF=hosts/wan.conf ./deploy.sh --render-wan-netplan > "$tmpw"
-if [ "$want" = "$(cat "$tmpw")" ]; then ok "wan.conf: split netplan renders identical to the old single template"; else bad "wan.conf: netplan render changed by the split"; diff <(echo "$want") "$tmpw" | head -10 | sed 's/^/       /'; fi
+if [ "$want" = "$(cat "$tmpw")" ]; then ok "wan.conf: split netplan renders identical to the old single template"; else bad "wan.conf: netplan render changed by the split"; diff <(echo "$want") "$tmpw" | head -10 | sed 's/^/       /' || true; fi
+if grep -qF '/etc/vanlink.conf' "$tmpw"; then bad "wan.conf: rendered netplan mentions /etc/vanlink.conf (a comment was re-edited; live hosts would report differs)"; else ok "wan.conf: rendered netplan keeps the original comments (no /etc/vanlink.conf)"; fi
 if VANLINK_CONF=hosts/van.conf ./deploy.sh --render-wan-netplan | grep -q '^  wifis:'; then bad "van.conf: wifis stanza must be omitted (WIFI_WAN_IFACE empty)"; else ok "van.conf: no wifis stanza"; fi
 rm -f "$tmpw" "$old"
 
@@ -445,6 +447,10 @@ STUB
     a_is "stage2 dhcp-only default route: exit 1" "$rc" 1; a_is "stage2 dhcp-only default route: status" "$(st_word)" rolled-back
     grep -q '^ip route show default dev enP2p33s0 proto static$' "$sb/calls" && ok "apply helper stage2: checks van-failover's proto static route on the port" || bad "apply helper stage2: no proto static route check"
     grep -qF -- '--- diagnostics: stage 2' "$sb/log" && ok "apply helper stage2: diagnostics logged" || bad "apply helper stage2: diagnostics missing"
+    # rollback: van-br0-setup restarted after the re-apply (the 2nd netplan apply), before the connectivity re-check (last ping)
+    l_ap2=$(grep -n '^netplan apply' "$sb/calls" | sed -n 2p | cut -d: -f1 || true); l_br2=$(grep -n '^systemctl restart van-br0-setup$' "$sb/calls" | sed -n 2p | cut -d: -f1 || true)
+    l_pg=$(grep -n '^ping -c1 -W2 1.1.1.1$' "$sb/calls" | tail -1 | cut -d: -f1 || true)
+    [ -n "$l_ap2" ] && [ -n "$l_br2" ] && [ -n "$l_pg" ] && [ "$l_ap2" -lt "$l_br2" ] && [ "$l_br2" -lt "$l_pg" ] && ok "apply helper rollback: van-br0-setup restarted after the re-apply, before the connectivity re-check" || bad "apply helper rollback: van-br0-setup restart missing or misplaced (apply '$l_ap2', br0 '$l_br2', ping '$l_pg')"
     [ -e "$sb/netplan/10-dhcp-all-interfaces.yaml" ] && cmp -s "$sb/nmconf/zz-van-wan-pending.conf" "$sb/bak/nm-pending.conf" && ok "apply helper stage2: Armbian file and pending conf restored" || bad "apply helper stage2: Armbian file / pending conf not restored"
     rm -rf "$sb"
     # (5c) port absent: stage 2 needs no proto static route on it