=== STEP_035E MULTICLASS SELECTOR PLAN READONLY ===
timestamp=20260708-124404
mode=read-only inspection + local plan package
canary_ip=10.253.1.10
target mapping: cs1->0x203/vpn3, cs2->0x204/vpn4, cs3->0x205/vpn5
forbidden: remote writes, selector changes, nft changes, reloads, peer changes
=== VM100 selector readiness read-only ===
date=Wed Jul  8 12:44:04 UTC 2026

=== selector file ===
# router WGPay selector file
# format: tunnel_ip dscp_class comment
# STEP_035B: one proven canary only, no production-wide switch
10.253.1.10 cs1 canary_vpn3
vm100_selector_canary_entry_rc=0
vm100_apply_script_mentions_cs123_rc=0
vm100_apply_script_dscp_validation_visible_rc=0
vm100_selector_service_enabled_rc=0
vm100_selector_rule_visible_rc=0
vm100_selector_rule_count=1
vm100_wg_paid_peer_count=1
vm100_canary_ip_in_wg_paid_rc=0

=== current selector nft table ===
table inet wgpay_dscp_canary {
	chain prerouting {
		type filter hook prerouting priority mangle; policy accept;
		iifname "wg_paid" ip saddr 10.253.1.10 ip dscp set cs1 counter packets 4 bytes 336 comment "STEP_035B_SELECTOR_WGPAY_canary_vpn3_10.253.1.10_cs1"
	}
}

=== UCI pending ===
no_remote_write_vm100=1
no_selector_change_vm100=1
no_nft_change_vm100=1
no_reload_vm100=1
no_peer_change_vm100=1
vm100_readonly_done=1

=== VM101 multiclass route readiness read-only ===
date=Wed Jul  8 12:44:05 UTC 2026

=== live egress interfaces ===
eth1             UP             10.200.0.2/24 fe80::be24:11ff:fe09:4e2c/64 
vpn3             UNKNOWN        10.104.58.24/32 
vpn4             UNKNOWN        10.103.120.171/32 
vpn5             UNKNOWN        10.97.189.145/32 
vm101_vpn3_link_rc=0
vm101_vpn4_link_rc=0
vm101_vpn5_link_rc=0

=== fwmark rules ===
vm101_rule_0x203_rc=0
vm101_rule_0x204_rc=0
vm101_rule_0x205_rc=0

=== route tables ===
--- table 203 ---
default dev vpn3 scope link 
--- table 204 ---
default dev vpn4 scope link 
--- table 205 ---
default dev vpn5 scope link 
vm101_table203_vpn3_rc=0
vm101_table204_vpn4_rc=0
vm101_table205_vpn5_rc=0

=== mark route checks ===
MARK203 1.1.1.1 dev vpn3 table 203 src 10.104.58.24 mark 0x203 uid 0 
MARK203     cache 
MARK204 1.1.1.1 dev vpn4 table 204 src 10.103.120.171 mark 0x204 uid 0 
MARK204     cache 
MARK205 1.1.1.1 dev vpn5 table 205 src 10.97.189.145 mark 0x205 uid 0 
MARK205     cache 
vm101_mark203_route_vpn3_rc=0
vm101_mark204_route_vpn4_rc=0
vm101_mark205_route_vpn5_rc=0

=== current VM101 canary mapper ===
vm101_mapper_service_exists_rc=0
vm101_mapper_service_enabled_rc=0
table inet router_egress_dscp_canary {
	chain prerouting {
		type filter hook prerouting priority mangle; policy accept;
		iifname "eth1" ip saddr 10.200.0.1 ip dscp cs1 meta mark set 0x00000203 counter packets 9 bytes 712 comment "STEP_034M_PERSIST_DSCP_CS1_TO_FW_MARK_0x203"
	}

	chain postrouting {
		type filter hook postrouting priority mangle; policy accept;
		meta mark 0x00000203 ip dscp cs1 ip dscp set cs0 counter packets 9 bytes 712 comment "STEP_034M_PERSIST_CLEAR_DSCP_ON_MARKED_EGRESS"
	}
}
vm101_current_cs1_mapper_visible_rc=0

=== current VM101 apply script excerpt ===
#!/bin/sh
set -u

TABLE="router_egress_dscp_canary"

case "${1:-start}" in
  start|restart|reload)
    ip rule show | grep -E 'fwmark 0x203.*lookup 203|fwmark 0x203/0xffffffff.*lookup 203' >/dev/null || {
      echo "BLOCK: fwmark_rule_203_missing"
      exit 2
    }
    ip route show table 203 | grep -E 'default .* dev vpn3|default dev vpn3' >/dev/null || {
      echo "BLOCK: table203_not_vpn3"
      exit 3
    }

    nft delete table inet "$TABLE" 2>/dev/null || true
    nft add table inet "$TABLE"
    nft add chain inet "$TABLE" prerouting '{ type filter hook prerouting priority mangle; policy accept; }'
    nft add chain inet "$TABLE" postrouting '{ type filter hook postrouting priority mangle; policy accept; }'
    nft add rule inet "$TABLE" prerouting iifname "eth1" ip saddr 10.200.0.1 ip dscp cs1 meta mark set 0x203 counter comment "STEP_034M_PERSIST_DSCP_CS1_TO_FW_MARK_0x203"
    nft add rule inet "$TABLE" postrouting meta mark 0x203 ip dscp cs1 ip dscp set cs0 counter comment "STEP_034M_PERSIST_CLEAR_DSCP_ON_MARKED_EGRESS"
    echo "applied_vm101_router_egress_dscp_canary=1"
    ;;

  stop)
    nft delete table inet "$TABLE" 2>/dev/null || true
    echo "stopped_vm101_router_egress_dscp_canary=1"
    ;;

  status)
    nft list table inet "$TABLE" 2>/dev/null
    ;;

  *)
    echo "usage: $0 {start|stop|restart|reload|status}"
    exit 1
    ;;
esac

=== UCI pending ===
no_remote_write_vm101=1
no_mapper_change_vm101=1
no_nft_change_vm101=1
no_reload_vm101=1
no_peer_change_vm101=1
vm101_readonly_done=1

=== VM121 WGPay state read-only ===
peers_curl_rc=0
jobs_curl_rc=0
peer_count 21
enabled_peer_count 1
job_count 37
pending_job_count 0
ENABLED_PEER id=376dfa07-0ba4-4182-af39-389a2cb3badd node_id=ddn-test tunnel_ip=10.253.1.10 canary=True
WG_CLIENT_ENDPOINT=wg-studio.secret-studio.ru:51830
no_remote_write_vm121=1
no_peer_change_vm121=1
vm121_readonly_done=1

=== STEP_035E RESULT ===
vm100_apply_script_mentions_cs123_rc=0
vm100_selector_rule_count=1
vm100_wg_paid_peer_count=1
vm100_canary_ip_in_wg_paid_rc=0
vm101_vpn3_link_rc=0
vm101_vpn4_link_rc=0
vm101_vpn5_link_rc=0
vm101_table203_vpn3_rc=0
vm101_table204_vpn4_rc=0
vm101_table205_vpn5_rc=0
vm101_mark203_route_vpn3_rc=0
vm101_mark204_route_vpn4_rc=0
vm101_mark205_route_vpn5_rc=0
vm101_current_cs1_mapper_visible_rc=0
peer_count=21
enabled_peer_count=1
pending_job_count=0
endpoint_final_lines=1
package=/opt/router-ops/apply-packages/20260708-124404_step035e_multiclass_selector_plan_readonly
decision=PASS_MULTICLASS_SELECTOR_PLAN_READONLY