STEP_033D_APPLY_CANARY_RUNTIME PASS_CANARY_RUNTIME_APPLIED
timestamp: 20260708-111338

Action:
- runtime nft canary:
  - table inet router_egress_canary
  - iifname eth1 ip saddr 10.200.0.1 meta mark set 0x203
  - target table 203 / vpn3

Validation:
- apply_canary_rc: 0
- ping_vm100_i_eth2_after_rc: 0
- ping_vm101_vpn1_rc: 0
- ping_vm101_vpn3_rc: 0
- nft_rule_lines: 2
- nft_counter_lines: 1
- rule203_lines: 1
- table200_default_vpn1_lines: 1
- table203_default_vpn3_lines: 1
- unmarked_route_vpn1_lines: 1
- marked_route_vpn3_lines: 1
- uci_pending_lines: 0

Remote changes:
- runtime nft canary rule only
- no UCI changes
- no firewall reload
- no broad production switch

Rollback:
- on VM101:
  /root/router-ops-step033d-canary/ROLLBACK_CANARY_VM100_ETH2_TO_VPN3_RUNTIME.sh