STEP_035F_VM101_MULTICLASS_MAPPER PASS_VM101_MULTICLASS_MAPPER_APPLIED
timestamp: 20260708-124526

VM101 mapper:
- cs1 -> 0x203 -> vpn3
- cs2 -> 0x204 -> vpn4
- cs3 -> 0x205 -> vpn5
- clear DSCP on egress for marks 0x203/0x204/0x205

Validation:
- mapper_service_start_rc: 0
- mapper_service_enabled_rc: 0
- rule_cs1_to_203_visible_rc: 0
- rule_cs2_to_204_visible_rc: 0
- rule_cs3_to_205_visible_rc: 0
- clear_cs1_visible_rc: 0
- clear_cs2_visible_rc: 0
- clear_cs3_visible_rc: 0
- prerouting_mapper_rule_count: 3
- postrouting_clear_rule_count: 3
- mark203_route_vpn3_rc: 0
- mark204_route_vpn4_rc: 0
- mark205_route_vpn5_rc: 0

VM100 read-only:
- vm100_selector_entry_rc: 0
- vm100_selector_active_entry_count: 1
- vm100_selector_rule_visible_rc: 0

Rollback:
- VM101: /root/rollback-step035f-vm101-multiclass-mapper.sh

Changes:
- VM101 mapper script updated and service restarted
- VM100 read-only verification only
- no production-wide switch
- no firewall reload
- no network reload
- no WG reload
- no peer changes

Next:
- retest current canary traffic: it should still hit cs1 -> 0x203 -> vpn3.