=== STEP_034M2 PERSIST VM100 CANARY ONLY ===
timestamp=20260708-122853
mode=apply missing VM100 dedicated init service only
tunnel_ip=10.253.1.10
VM101 already persisted in STEP_034M; VM101 read-only verify only
forbidden: firewall reload, network reload, wg reload, peer changes, production policy switch
=== VM100 apply missing persistence ===
date=Wed Jul  8 12:28:53 UTC 2026
backup_dir=/root/router-ops-backups/step034m2-persist-vm100-canary-20260708-122853

=== guards ===
vm100_guard_tunnel_ip_in_wg_paid_rc=0
vm100_uci_changes_rc=0

=== write VM100 apply script ===

=== write VM100 init script ===

=== write VM100 rollback ===

=== enable + start VM100 dedicated service ===
vm100_init_enable_rc=0
applied_vm100_wgpay_dscp_canary=1
vm100_init_start_rc=0

=== verify VM100 ===
vm100_init_enabled_rc=0
vm100_persistent_rule_visible_rc=0
table inet wgpay_dscp_canary {
	chain prerouting {
		type filter hook prerouting priority mangle; policy accept;
		iifname "wg_paid" ip saddr 10.253.1.10 ip dscp set cs1 counter packets 0 bytes 0 comment "STEP_034M2_PERSIST_WGPAY_CANARY_DSCP_CS1"
	}
}

=== no forbidden action proof VM100 ===
no_firewall_reload_vm100=1
no_network_reload_vm100=1
no_wg_reload_vm100=1
no_peer_change_vm100=1
vm100_persist_done=1

=== VM101 read-only verify existing persistence ===
date=Wed Jul  8 12:28:54 UTC 2026
vm101_init_exists_rc=0
vm101_init_enabled_rc=0
vm101_persistent_prerouting_rule_visible_rc=0
vm101_persistent_postrouting_rule_visible_rc=0
vm101_mark_route_vpn3_rc=0

=== no forbidden action proof VM101 ===
no_firewall_reload_vm101=1
no_network_reload_vm101=1
no_wg_reload_vm101=1
no_peer_change_vm101=1
vm101_readonly_verify_done=1

=== STEP_034M2 RESULT ===
vm100_guard_tunnel_ip_in_wg_paid_rc=0
vm100_init_enable_rc=0
vm100_init_start_rc=0
vm100_init_enabled_rc=0
vm100_persistent_rule_visible_rc=0
vm101_init_exists_rc=0
vm101_init_enabled_rc=0
vm101_persistent_prerouting_rule_visible_rc=0
vm101_persistent_postrouting_rule_visible_rc=0
vm101_mark_route_vpn3_rc=0
rollback_vm100=/root/rollback-step034m2-persistent-canary-vm100.sh
rollback_vm101=/root/rollback-step034m-persistent-canary.sh
decision=PASS_VM100_CANARY_PERSISTED_AND_VM101_VERIFIED