# STEP_034L persistent canary plan inspection

This package is local-only. No remote changes were made.

Runtime canary currently proven:

- VM100: wg_paid source 10.253.1.10 -> DSCP cs1
- VM101: eth1 source 10.200.0.1 DSCP cs1 -> fwmark 0x203 -> table 203/vpn3

Persistence options to choose after inspection:

1. Use /etc/firewall.user commands to recreate dedicated nft tables after firewall restart.
2. Use /etc/nftables.d snippets only if fw4 include context supports standalone table declarations safely.
3. Keep runtime-only canary and rollback before production policy work.

Preference for next apply:
- safest is usually a small /etc/firewall.user managed block with nft delete/add table commands, plus `fw4 check` before reload.
- do not persist broad traffic policy yet; persist only this canary peer 10.253.1.10.