=== STEP_036I VM101 5CLASS MAPPER ===
timestamp=20260708-130358
mode=real change VM101 mapper only
mapping=cs1->0x203/vpn3 cs2->0x204/vpn4 cs3->0x205/vpn5 cs4->0x201/vpn1 cs5->0x202/vpn2
forbidden: VM100 writes, selector changes, peer changes, production-wide switch, table200 changes, network/firewall/WG reload
=== VM101 apply 5-class mapper ===
date=Wed Jul  8 13:03:58 UTC 2026
backup_dir=/root/router-ops-backups/step036i-vm101-5class-mapper-20260708-130358

=== guards before mapper change ===
guard_vpn1_link_rc=0
guard_table201_vpn1_rc=0
guard_rule_0x201_table201_rc=0
guard_mark0x201_route_vpn1_rc=0
guard_vpn2_link_rc=0
guard_table202_vpn2_rc=0
guard_rule_0x202_table202_rc=0
guard_mark0x202_route_vpn2_rc=0
guard_vpn3_link_rc=0
guard_table203_vpn3_rc=0
guard_rule_0x203_table203_rc=0
guard_mark0x203_route_vpn3_rc=0
guard_vpn4_link_rc=0
guard_table204_vpn4_rc=0
guard_rule_0x204_table204_rc=0
guard_mark0x204_route_vpn4_rc=0
guard_vpn5_link_rc=0
guard_table205_vpn5_rc=0
guard_rule_0x205_table205_rc=0
guard_mark0x205_route_vpn5_rc=0
guard_table200_default_vpn1_rc=0
guard_egress_slots_init_exists_rc=0
guard_egress_slots_enabled_rc=0
guard_mapper_init_exists_rc=0
guard_mapper_init_enabled_rc=0
uci_changes_before_rc=0

=== backup current mapper files ===
backup_done=1

=== write 5-class VM101 mapper apply script ===

=== rollback ===
rollback_vm101=/root/rollback-step036i-vm101-5class-mapper.sh

=== start existing mapper service with 5-class script ===
applied_vm101_5class_mapper=1
mapper_service_start_rc=0

=== verify 5-class mapper ===
mapper_service_enabled_rc=0
rule_cs1_to_203_visible_rc=0
rule_cs2_to_204_visible_rc=0
rule_cs3_to_205_visible_rc=0
rule_cs4_to_201_visible_rc=0
rule_cs5_to_202_visible_rc=0
clear_cs1_visible_rc=0
clear_cs2_visible_rc=0
clear_cs3_visible_rc=0
clear_cs4_visible_rc=0
clear_cs5_visible_rc=0
prerouting_mapper_rule_count=5
postrouting_clear_rule_count=5
mark0x201_route_vpn1_rc=0
mark0x202_route_vpn2_rc=0
mark0x203_route_vpn3_rc=0
mark0x204_route_vpn4_rc=0
mark0x205_route_vpn5_rc=0
table200_default_vpn1_rc=0

=== active table ===
table inet router_egress_dscp_canary {
	chain prerouting {
		type filter hook prerouting priority mangle; policy accept;
		iifname "eth1" ip saddr 10.200.0.1 ip dscp cs1 meta mark set 0x00000203 counter packets 0 bytes 0 comment "STEP_036I_DSCP_CS1_TO_FW_MARK_0x203"
		iifname "eth1" ip saddr 10.200.0.1 ip dscp cs2 meta mark set 0x00000204 counter packets 0 bytes 0 comment "STEP_036I_DSCP_CS2_TO_FW_MARK_0x204"
		iifname "eth1" ip saddr 10.200.0.1 ip dscp cs3 meta mark set 0x00000205 counter packets 0 bytes 0 comment "STEP_036I_DSCP_CS3_TO_FW_MARK_0x205"
		iifname "eth1" ip saddr 10.200.0.1 ip dscp cs4 meta mark set 0x00000201 counter packets 0 bytes 0 comment "STEP_036I_DSCP_CS4_TO_FW_MARK_0x201"
		iifname "eth1" ip saddr 10.200.0.1 ip dscp cs5 meta mark set 0x00000202 counter packets 0 bytes 0 comment "STEP_036I_DSCP_CS5_TO_FW_MARK_0x202"
	}

	chain postrouting {
		type filter hook postrouting priority mangle; policy accept;
		meta mark 0x00000203 ip dscp cs1 ip dscp set cs0 counter packets 0 bytes 0 comment "STEP_036I_CLEAR_DSCP_CS1_MARK_0x203"
		meta mark 0x00000204 ip dscp cs2 ip dscp set cs0 counter packets 0 bytes 0 comment "STEP_036I_CLEAR_DSCP_CS2_MARK_0x204"
		meta mark 0x00000205 ip dscp cs3 ip dscp set cs0 counter packets 0 bytes 0 comment "STEP_036I_CLEAR_DSCP_CS3_MARK_0x205"
		meta mark 0x00000201 ip dscp cs4 ip dscp set cs0 counter packets 0 bytes 0 comment "STEP_036I_CLEAR_DSCP_CS4_MARK_0x201"
		meta mark 0x00000202 ip dscp cs5 ip dscp set cs0 counter packets 0 bytes 0 comment "STEP_036I_CLEAR_DSCP_CS5_MARK_0x202"
	}
}

=== UCI changes after ===
uci_changes_after_rc=0

=== no forbidden action proof VM101 ===
no_table200_change_intended=1
no_production_switch=1
no_network_reload=1
no_firewall_reload=1
no_wg_reload=1
no_peer_change=1
vm101_5class_mapper_done=1

=== VM100 read-only verify selector unchanged ===
vm100_selector_entry_rc=0
vm100_selector_active_entry_count=1
vm100_selector_service_enabled_rc=0
vm100_selector_rule_visible_rc=0
no_remote_write_vm100=1
no_selector_change_vm100=1
no_wg_reload_vm100=1
no_network_reload_vm100=1
no_firewall_reload_vm100=1
no_peer_change_vm100=1
vm100_readonly_verify_done=1

=== STEP_036I RESULT ===
mapper_service_start_rc=0
mapper_service_enabled_rc=0
rule_cs1_to_203_visible_rc=0
rule_cs2_to_204_visible_rc=0
rule_cs3_to_205_visible_rc=0
rule_cs4_to_201_visible_rc=0
rule_cs5_to_202_visible_rc=0
clear_cs1_visible_rc=0
clear_cs2_visible_rc=0
clear_cs3_visible_rc=0
clear_cs4_visible_rc=0
clear_cs5_visible_rc=0
prerouting_mapper_rule_count=5
postrouting_clear_rule_count=5
mark0x201_route_vpn1_rc=0
mark0x202_route_vpn2_rc=0
mark0x203_route_vpn3_rc=0
mark0x204_route_vpn4_rc=0
mark0x205_route_vpn5_rc=0
table200_default_vpn1_rc=0
vm100_selector_active_entry_count=1
vm100_selector_rule_visible_rc=0
rollback_vm101=/root/rollback-step036i-vm101-5class-mapper.sh
decision=PASS_VM101_5CLASS_MAPPER_APPLIED