=== STEP_034I APPLY DSCP CANARY RUNTIME ===
timestamp=20260708-121845
mode=runtime-only nft canary
peer_id=376dfa07-0ba4-4182-af39-389a2cb3badd
job_id=95463317-b0a0-4117-84fd-2a0dcf387741
tunnel_ip=10.253.1.10
VM100: wg_paid source 10.253.1.10 -> DSCP cs1
VM101: eth1 source 10.200.0.1 DSCP cs1 -> fwmark 0x203 -> table 203/vpn3
forbidden: UCI changes, network reload, wg reload, peer changes
=== VM121 guard: job completed / peer enabled ===
vm121_peer_found=True
vm121_peer_enabled=True
vm121_peer_tunnel_ip=10.253.1.10
vm121_job_found=True
vm121_job_status=completed
vm121_guard_done=1

=== VM101 guard: fwmark 0x203 route to vpn3 ===
date=Wed Jul  8 12:18:47 UTC 2026

=== interfaces ===
eth1             UP             10.200.0.2/24 fe80::be24:11ff:fe09:4e2c/64 
vpn3             UNKNOWN        10.104.58.24/32 

=== ip rules fwmark ===
10013:	from all fwmark 0x203 lookup 203

=== table 203 ===
default dev vpn3 scope link 

=== route check mark 0x203 ===
1.1.1.1 dev vpn3 table 203 src 10.104.58.24 mark 0x203 uid 0 
    cache 
vm101_fwmark_rule_203_rc=0
vm101_table203_default_vpn3_rc=0
vm101_vpn3_link_rc=0
vm101_guard_done=1

=== VM100 guard + apply DSCP source marker ===
date=Wed Jul  8 12:18:47 UTC 2026

=== before UCI changes ===

=== wg_paid peer guard ===
vm100_tunnel_ip_in_wg_paid_rc=0
vm100_wg_paid_link_rc=0

=== create rollback script ===
vm100_rollback_script=/root/rollback-step034i-dscp-canary.sh
vm100_nft_apply_rc=0

=== nft table after ===
table inet wgpay_dscp_canary {
	chain prerouting {
		type filter hook prerouting priority mangle; policy accept;
		iifname "wg_paid" ip saddr 10.253.1.10 ip dscp set cs1 counter packets 0 bytes 0 comment "STEP_034I_WGPAY_CANARY_DSCP_CS1"
	}
}
vm100_nft_rule_visible_rc=0

=== after UCI changes ===

no_uci_change_vm100=1
no_network_reload_vm100=1
no_wg_reload_vm100=1
no_peer_change_vm100=1
vm100_apply_done=1

=== VM101 apply DSCP->fwmark mapper ===
date=Wed Jul  8 12:18:48 UTC 2026

=== before UCI changes ===

=== create rollback script ===
vm101_rollback_script=/root/rollback-step034i-dscp-canary.sh

=== apply mapper ===
vm101_nft_apply_rc=0

=== nft table after ===
table inet router_egress_dscp_canary {
	chain prerouting {
		type filter hook prerouting priority mangle; policy accept;
		iifname "eth1" ip saddr 10.200.0.1 ip dscp cs1 meta mark set 0x00000203 counter packets 0 bytes 0 comment "STEP_034I_DSCP_CS1_TO_FW_MARK_0x203"
	}

	chain postrouting {
		type filter hook postrouting priority mangle; policy accept;
		meta mark 0x00000203 ip dscp cs1 ip dscp set cs0 counter packets 0 bytes 0 comment "STEP_034I_CLEAR_DSCP_ON_MARKED_EGRESS"
	}
}
vm101_nft_prerouting_rule_visible_rc=0
vm101_nft_postrouting_rule_visible_rc=0
vm101_mark_route_vpn3_rc=0

=== after UCI changes ===

no_uci_change_vm101=1
no_network_reload_vm101=1
no_wg_reload_vm101=1
no_peer_change_vm101=1
vm101_apply_done=1

=== STEP_034I RESULT ===
vm121_peer_enabled=True
vm121_job_status=completed
vm101_fwmark_rule_203_rc=0
vm101_table203_default_vpn3_rc=0
vm101_vpn3_link_rc=0
vm100_tunnel_ip_in_wg_paid_rc=0
vm100_nft_rule_visible_rc=0
vm101_nft_prerouting_rule_visible_rc=0
vm101_nft_postrouting_rule_visible_rc=0
vm101_mark_route_vpn3_rc=0
rollback_vm100=/root/rollback-step034i-dscp-canary.sh
rollback_vm101=/root/rollback-step034i-dscp-canary.sh
decision=PASS_DSCP_CANARY_RUNTIME_APPLIED