STEP_034I_APPLY_DSCP_CANARY_RUNTIME PASS_DSCP_CANARY_RUNTIME_APPLIED
timestamp: 20260708-121845

Canary:
- tunnel_ip: 10.253.1.10
- VM100: wg_paid source 10.253.1.10 -> DSCP cs1
- VM101: eth1 source 10.200.0.1 DSCP cs1 -> fwmark 0x203 -> table 203/vpn3

Validation:
- vm121_peer_enabled: True
- vm121_job_status: completed
- vm101_fwmark_rule_203_rc: 0
- vm101_table203_default_vpn3_rc: 0
- vm101_vpn3_link_rc: 0
- vm100_tunnel_ip_in_wg_paid_rc: 0
- vm100_nft_rule_visible_rc: 0
- vm101_nft_prerouting_rule_visible_rc: 0
- vm101_nft_postrouting_rule_visible_rc: 0
- vm101_mark_route_vpn3_rc: 0

Rollback:
- VM100: /root/rollback-step034i-dscp-canary.sh
- VM101: /root/rollback-step034i-dscp-canary.sh

Changes:
- runtime nft canary tables only
- no UCI changes
- no network reload
- no WG reload
- no peer changes

Next:
- generate actual traffic from canary WG client 10.253.1.10 and observe counters/path.