Controlled live vpn2 failure was produced by a temporary local nft output drop for the exact existing endpoint. Neither UCI nor the live endpoint nor the vpn2 interface was rewritten or restarted. The production watcher detected the loss, VM101 applied bridge-first fallback, VM100 evacuated the exhausted selector, the drop was removed, receive traffic returned on the same running tunnel, NORMAL topology was acknowledged, and no mass reverse move occurred.