=== STEP_035F VM101 MULTICLASS MAPPER ===
timestamp=20260708-124526
mode=real change VM101 mapper only
mapping=cs1->0x203/vpn3, cs2->0x204/vpn4, cs3->0x205/vpn5
forbidden: VM100 writes, peer changes, production-wide switch, firewall/network/WG reload
=== VM101 apply multiclass mapper ===
date=Wed Jul  8 12:45:27 UTC 2026
backup_dir=/root/router-ops-backups/step035f-vm101-multiclass-mapper-20260708-124527

=== guards before change ===
guard_vpn3_link_rc=0
guard_vpn4_link_rc=0
guard_vpn5_link_rc=0
guard_table203_vpn3_rc=0
guard_table204_vpn4_rc=0
guard_table205_vpn5_rc=0
guard_mark203_vpn3_rc=0
guard_mark204_vpn4_rc=0
guard_mark205_vpn5_rc=0
guard_init_exists_rc=0
guard_init_enabled_rc=0
uci_changes_before_rc=0

=== backup current files ===
backup_done=1

=== write multiclass VM101 apply script ===

=== rollback ===
rollback_vm101=/root/rollback-step035f-vm101-multiclass-mapper.sh

=== start existing init service with multiclass mapper ===
applied_vm101_multiclass_mapper=1
mapper_service_start_rc=0

=== verify multiclass rules ===
mapper_service_enabled_rc=0
rule_cs1_to_203_visible_rc=0
rule_cs2_to_204_visible_rc=0
rule_cs3_to_205_visible_rc=0
clear_cs1_visible_rc=0
clear_cs2_visible_rc=0
clear_cs3_visible_rc=0
prerouting_mapper_rule_count=3
postrouting_clear_rule_count=3
mark203_route_vpn3_rc=0
mark204_route_vpn4_rc=0
mark205_route_vpn5_rc=0

=== active table ===
table inet router_egress_dscp_canary {
	chain prerouting {
		type filter hook prerouting priority mangle; policy accept;
		iifname "eth1" ip saddr 10.200.0.1 ip dscp cs1 meta mark set 0x00000203 counter packets 0 bytes 0 comment "STEP_035F_DSCP_CS1_TO_FW_MARK_0x203"
		iifname "eth1" ip saddr 10.200.0.1 ip dscp cs2 meta mark set 0x00000204 counter packets 0 bytes 0 comment "STEP_035F_DSCP_CS2_TO_FW_MARK_0x204"
		iifname "eth1" ip saddr 10.200.0.1 ip dscp cs3 meta mark set 0x00000205 counter packets 0 bytes 0 comment "STEP_035F_DSCP_CS3_TO_FW_MARK_0x205"
	}

	chain postrouting {
		type filter hook postrouting priority mangle; policy accept;
		meta mark 0x00000203 ip dscp cs1 ip dscp set cs0 counter packets 0 bytes 0 comment "STEP_035F_CLEAR_DSCP_CS1_MARK_0x203"
		meta mark 0x00000204 ip dscp cs2 ip dscp set cs0 counter packets 0 bytes 0 comment "STEP_035F_CLEAR_DSCP_CS2_MARK_0x204"
		meta mark 0x00000205 ip dscp cs3 ip dscp set cs0 counter packets 0 bytes 0 comment "STEP_035F_CLEAR_DSCP_CS3_MARK_0x205"
	}
}

=== UCI changes after ===
uci_changes_after_rc=0

=== no forbidden action proof VM101 ===
no_firewall_reload_vm101=1
no_network_reload_vm101=1
no_wg_reload_vm101=1
no_peer_change_vm101=1
no_production_switch_vm101=1
vm101_multiclass_apply_done=1

=== VM100 read-only verify selector unchanged ===
vm100_selector_entry_rc=0
vm100_selector_active_entry_count=1
vm100_selector_service_enabled_rc=0
vm100_selector_rule_visible_rc=0
no_remote_write_vm100=1
no_firewall_reload_vm100=1
no_network_reload_vm100=1
no_wg_reload_vm100=1
no_peer_change_vm100=1
vm100_readonly_verify_done=1

=== STEP_035F RESULT ===
guard_vpn3_link_rc=0
guard_vpn4_link_rc=0
guard_vpn5_link_rc=0
guard_table203_vpn3_rc=0
guard_table204_vpn4_rc=0
guard_table205_vpn5_rc=0
mapper_service_start_rc=0
mapper_service_enabled_rc=0
rule_cs1_to_203_visible_rc=0
rule_cs2_to_204_visible_rc=0
rule_cs3_to_205_visible_rc=0
clear_cs1_visible_rc=0
clear_cs2_visible_rc=0
clear_cs3_visible_rc=0
prerouting_mapper_rule_count=3
postrouting_clear_rule_count=3
mark203_route_vpn3_rc=0
mark204_route_vpn4_rc=0
mark205_route_vpn5_rc=0
vm100_selector_entry_rc=0
vm100_selector_active_entry_count=1
vm100_selector_rule_visible_rc=0
rollback_vm101=/root/rollback-step035f-vm101-multiclass-mapper.sh
decision=PASS_VM101_MULTICLASS_MAPPER_APPLIED