STEP_034H3_RUN_AGENT_ONCE_GUARDED PASS_AGENT_APPLIED_CANARY_PEER
timestamp: 20260708-121659

Canary peer:
- peer_id: 376dfa07-0ba4-4182-af39-389a2cb3badd
- job_id: 95463317-b0a0-4117-84fd-2a0dcf387741
- tunnel_ip: 10.253.1.10

Guard/action:
- guard_only_target: 1
- agent_start_rc: 0
- used_existing_agent_service: 1

Result:
- target_job_status_after: completed
- target_job_attempts_after: 1
- pending_job_count_after: 0
- wg_paid_peer_count_after: 1
- vm100_pubkey_in_wg_show_rc: 0
- vm100_pubkey_in_wg_dump_rc: 0
- vm100_allowed_ip_match_rc: 0

Changes:
- ran existing wg-access-agent.service once
- no manual wg set
- no backend/postgres restart

Next:
- if PASS, proceed to VM100-side DSCP canary for tunnel_ip 10.253.1.10.
- if blocked, inspect agent journal/error and do not manually add peer.