=== STEP_034M PERSIST PROVEN CANARY INIT ===
timestamp=20260708-122716
mode=persist proven canary with dedicated init service
tunnel_ip=10.253.1.10
forbidden: firewall reload, network reload, wg reload, peer changes, production policy switch
=== VM100 persist canary init ===

=== VM101 persist canary init ===
date=Wed Jul  8 12:27:17 UTC 2026
backup_dir=/root/router-ops-backups/step034m-persist-canary-20260708-122717

=== guards ===
vm101_guard_fwmark_rule_203_rc=0
vm101_guard_table203_vpn3_rc=0
vm101_guard_vpn3_link_rc=0
vm101_uci_changes_rc=0

=== write apply script ===

=== write init script ===

=== write rollback ===

=== enable + start dedicated service ===
vm101_init_enable_rc=0
applied_vm101_router_egress_dscp_canary=1
vm101_init_start_rc=0

=== verify ===
vm101_init_enabled_rc=0
vm101_persistent_prerouting_rule_visible_rc=0
vm101_persistent_postrouting_rule_visible_rc=0
vm101_mark_route_vpn3_rc=0
table inet router_egress_dscp_canary {
	chain prerouting {
		type filter hook prerouting priority mangle; policy accept;
		iifname "eth1" ip saddr 10.200.0.1 ip dscp cs1 meta mark set 0x00000203 counter packets 0 bytes 0 comment "STEP_034M_PERSIST_DSCP_CS1_TO_FW_MARK_0x203"
	}

	chain postrouting {
		type filter hook postrouting priority mangle; policy accept;
		meta mark 0x00000203 ip dscp cs1 ip dscp set cs0 counter packets 0 bytes 0 comment "STEP_034M_PERSIST_CLEAR_DSCP_ON_MARKED_EGRESS"
	}
}

=== no forbidden action proof ===
no_firewall_reload_vm101=1
no_network_reload_vm101=1
no_wg_reload_vm101=1
no_peer_change_vm101=1
vm101_persist_done=1

=== STEP_034M RESULT ===
vm100_guard_tunnel_ip_in_wg_paid_rc=
vm100_init_enable_rc=
vm100_init_start_rc=
vm100_init_enabled_rc=
vm100_persistent_rule_visible_rc=
vm101_guard_fwmark_rule_203_rc=0
vm101_guard_table203_vpn3_rc=0
vm101_guard_vpn3_link_rc=0
vm101_init_enable_rc=0
vm101_init_start_rc=0
vm101_init_enabled_rc=0
vm101_persistent_prerouting_rule_visible_rc=0
vm101_persistent_postrouting_rule_visible_rc=0
vm101_mark_route_vpn3_rc=0
rollback_vm100=/root/rollback-step034m-persistent-canary.sh
rollback_vm101=/root/rollback-step034m-persistent-canary.sh
decision=BLOCK_FORBIDDEN_PROOF_MISSING