STEP_034K_CHECKPOINT_PROVEN_CANARY PASS_PROVEN_CANARY_CHECKPOINT
timestamp: 20260708-122335

Snapshot:
- name: S034K_WGPAY_DSCP_CANARY_PROVEN
- VM100 snapshot rc/visible: 0 / 0
- VM101 snapshot rc/visible: 0 / 0

VM121 checkpoint:
- peer_count: 21
- job_count: 37
- pending_job_count: 0
- canary_peer_found: True
- canary_peer_enabled: True
- canary_tunnel_ip_matches: True
- canary_job_status: completed
- pg_dump_rc: 0
- endpoint_final_lines: 1
- backend_health_ok_lines: 2

Canary proven earlier:
- tunnel_ip: 10.253.1.10
- VM100 DSCP counter delta: 4
- VM101 mark counter delta: 4
- route mark 0x203 -> vpn3

Changes:
- snapshots VM100/VM101
- VM121 pg_dump backup only
- no policy changes
- no peer disable
- no WG reload
- no backend restart

Next options:
- persist a per-peer canary policy safely
- or rollback runtime canary tables and keep the test peer for future validation