vrrp-wan: a flap holdoff must not tear down a live WAN session

ppp_dial() checked the flap holdoff and returned BEFORE renewing
/run/vrrp-wan/may-dial. That lease is what vrrp-wan-guard expires after
LEASE_TTL, so tripping the damper stopped the renew and the guard hung up
pppoe0 on the MASTER ~80s later. A damper meant to suppress repeated DIALS
was tearing down a working WAN instead.

Observed in labsim, end to end:

  DIAL FLAP: >=6 attempts in 600s -- holding off 900s
  GUARD: lease stale (81s > 75s) -- hanging up pppoe0

An established session now outranks every check below it: ppp_active renews
the lease and returns first. Everything after it only decides whether to
start a NEW session.

Two supporting fixes for how that storm started. The dial attempts were all
no-ops because /etc/ppp/peers/pppoe0 was missing, and nothing said so --
systemd logs "skipped because of an unmet condition check" exactly once and
the gate looks identical to a healthy backup. ppp_dial() now reports it, and
distinguishes "configured but not rendered" (re-commit the subtree) from "no
pppoe0 in config at all", which is what a reboot leaves behind when a commit
was never saved. That is precisely how the sim secondary lost its WAN.

Also `cat | wc -l` rather than `wc -l < file`: redirections are applied left
to right, so the missing-file error escapes the 2>/dev/null on every
first-ever dial.

Harness: T11 copied-then-removed instead of mv, and verifies the restore --
losing that file strands a router permanently, which cost a debugging
session. preflight now refuses to run if either router lacks the peers file
or the pppoe0 config, since every failover result would otherwise be a false
negative blamed on the ISP. New T12 forges a 900s holdoff against a live
session and asserts it survives.

migration/vyos-mode-delta.py

@@ -243,22 +243,38 @@ def build_delta(inv: dict, priority: int, wan_user: str, with_wan: bool,
         ]
 
     if not with_wan:
-        # The backup carries the identical WAN and NAT config but with the
-        # interfaces administratively DOWN. The cloned MAC is therefore never
-        # live on two boxes at once, while everything needed to route and
-        # masquerade is already present -- taking over is enabling two
-        # interfaces, not rebuilding a config under pressure.
+        # Both boxes carry the identical WAN and NAT config; only the RESTING
+        # STATE differs, and only for the DHCP line. Takeover is no longer a
+        # human deleting two lines under pressure -- vrrp-wan-reconcile does it,
+        # driven by who holds the management VIP. See migration/PPPOE-HA.md.
+        #
+        # bond0.53 stays here, on the CONFIG plane, because its lease is bound
+        # to a cloned MAC and only VyOS config can move a MAC between boxes.
+        # This is the "nothing to follow" default: a freshly built or PXE'd box
+        # has no live master to imitate, so it must come up unable to claim that
+        # MAC. On a running pair the model follows reality instead -- see the
+        # export-before-apply rule in migration/PPPOE-HA.md.
+        #
+        # pppoe0 is deliberately NOT disabled here any more. `disable` unlinks
+        # /etc/ppp/peers/pppoe0, which is pppd's own options file, so it
+        # destroys what the promotion path needs and leaves ppp@pppoe0
+        # restart-looping. Dialling is gated at the systemd unit instead.
+        #
+        # ORDERING TRAP for a rebuilt box: because pppoe0 is left ENABLED,
+        # interfaces_pppoe.py will try to dial on the first commit that touches
+        # the pppoe subtree. Install the gate FIRST --
+        # `migration/vrrp-wan-install --vip <mgmt VIP> --host vyos@<box>` --
+        # or the new box will take the single ISP session off the live master.
         #
         # NAT rules naming a down interface are harmless: VyOS warns at commit
         # ("Interface ... does not exist!") and commits anyway, verified.
         out += [
             "",
-            "# --- WAN held DOWN on this box -----------------------------",
-            "# Enable these two to take over the internet path:",
-            f"#   set interfaces bonding bond0 vif {WAN_DHCP_VIF.split('.')[1]} disable  <- delete this",
-            f"#   set interfaces pppoe {WAN_PPPOE_IF} disable                <- and this",
+            "# --- 10 gig held DOWN on this box --------------------------",
+            "# Do NOT enable by hand: vrrp-wan-reconcile owns this, keyed on",
+            "# whoever holds the management VIP. pppoe0 is gated at the unit",
+            "# (ppp@pppoe0.service.d/10-vrrp-wan-gate.conf), not in config.",
             f"set interfaces bonding bond0 vif {WAN_DHCP_VIF.split('.')[1]} disable",
-            f"set interfaces pppoe {WAN_PPPOE_IF} disable",
         ]
 
     if True: