STEP_034M2_PERSIST_VM100_CANARY_ONLY PASS_VM100_CANARY_PERSISTED_AND_VM101_VERIFIED
timestamp: 20260708-122853

VM100 persistence:
- service: /etc/init.d/router-wgpay-canary
- apply script: /usr/local/sbin/router-wgpay-canary-apply.sh
- rollback: /root/rollback-step034m2-persistent-canary-vm100.sh

Validation:
- vm100_guard_tunnel_ip_in_wg_paid_rc: 0
- vm100_init_enable_rc: 0
- vm100_init_start_rc: 0
- vm100_init_enabled_rc: 0
- vm100_persistent_rule_visible_rc: 0
- vm101_init_exists_rc: 0
- vm101_init_enabled_rc: 0
- vm101_persistent_prerouting_rule_visible_rc: 0
- vm101_persistent_postrouting_rule_visible_rc: 0
- vm101_mark_route_vpn3_rc: 0

Changes:
- VM100 missing persistence added
- VM101 read-only verification only
- no firewall reload
- no network reload
- no WG reload
- no peer changes
- no production policy switch

Next:
- run canary traffic observe again to confirm persistent service rules behave like runtime rules.