STEP_034N_OBSERVE_PERSISTED_CANARY_TRAFFIC PASS_PERSISTED_CANARY_TRAFFIC_CONFIRMED
timestamp: 20260708-123013

Canary:
- tunnel_ip: 10.253.1.10
- temporary WG client on VM121
- persisted VM100/VM101 services/rules

Temporary client:
- extract_script_rc: 0
- wg_link_add_rc: 0
- wg_setconf_rc: 0
- wg_link_up_rc: 0
- wg_default_route_rc: 0
- canary_ping_rc: 0
- netns_cleanup_rc: 0
- temp_iface_still_exists_rc: 1

Counters:
- VM100 persisted DSCP delta packets: 4
- VM101 persisted mark delta packets: 4
- VM101 persisted clear DSCP delta packets: 4
- VM101 mark route vpn3 rc: 0

Safety:
- no secrets published
- no server WG reload
- no peer changes

Next:
- if PASS, persistent per-peer canary is proven after service persistence.
- next safe step: checkpoint/snapshot after persistence, then decide whether to keep canary active or rollback runtime/persistence before broader policy work.