STEP_034M_PERSIST_PROVEN_CANARY_INIT BLOCK_FORBIDDEN_PROOF_MISSING
timestamp: 20260708-122716

Persisted canary:
- tunnel_ip: 10.253.1.10
- VM100 service: /etc/init.d/router-wgpay-canary
- VM101 service: /etc/init.d/router-wgpay-canary

Validation:
- vm100_guard_tunnel_ip_in_wg_paid_rc: 
- vm100_init_enable_rc: 
- vm100_init_start_rc: 
- vm100_init_enabled_rc: 
- vm100_persistent_rule_visible_rc: 
- vm101_guard_fwmark_rule_203_rc: 0
- vm101_guard_table203_vpn3_rc: 0
- vm101_guard_vpn3_link_rc: 0
- vm101_init_enable_rc: 0
- vm101_init_start_rc: 0
- vm101_init_enabled_rc: 0
- vm101_persistent_prerouting_rule_visible_rc: 0
- vm101_persistent_postrouting_rule_visible_rc: 0
- vm101_mark_route_vpn3_rc: 0

Rollback:
- VM100: /root/rollback-step034m-persistent-canary.sh
- VM101: /root/rollback-step034m-persistent-canary.sh

Changes:
- added dedicated init service and apply script on VM100/VM101
- enabled dedicated service at boot
- re-applied proven canary nft runtime tables through service
- no firewall reload
- no network reload
- no WG reload
- no peer changes
- no production policy switch

Next:
- run one more real canary traffic observe to confirm persisted service rules behave the same.