=== 0. baseline (before apply) ===
debuggable: 0
dns1: 1.1.1.1
ps redsocks/pxd: root          5551     1   49484   2248 0                   0 S pxd

=== 1. apply proxy egress (bound proxy 3, JP) ===
apply: {'instance_id': 32, 'applied': True, 'mode': 'bound', 'guest': {'egress': 'proxy', 'upstream': {'host': '172.16.1.2', 'port': 57781}}}

=== 2. root-trace state after apply ===
debuggable: 0
ps redsocks/pxd: root          6554     1   49484   2244 0                   0 S pxd

=== 3. DNS state after apply ===
dns1: 1.1.1.1
dns2: 1.0.0.1
nat OUTPUT: Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
DNAT       udp  --  0.0.0.0/0            0.0.0.0/0            udp dpt:53 to:172.16.1.2:1053
DNAT       tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:53 to:172.16.1.2:1053
RETURN     all  --  0.0.0.0/0            172.16.1.0/24       
REDIRECT   tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:80 redir ports 8123
REDIRECT   tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:8080 redir ports 8123
REDIRECT   tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:443 redir ports 8124


=== 4. resolution proof ===
* Connected to example.com (104.20.23.154) port 443 (#0)

=== 5. hot-switch to local (Clash 7890) ===
local egress: {'egress': 'proxy', 'upstream': {'host': '172.16.1.2', 'port': 7890}}
dns1: 1.1.1.1
nat OUTPUT: Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
DNAT       udp  --  0.0.0.0/0            0.0.0.0/0            udp dpt:53 to:172.16.1.2:1053
DNAT       tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:53 to:172.16.1.2:1053
RETURN     all  --  0.0.0.0/0            172.16.1.0/24       
REDIRECT   tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:80 redir ports 8123
REDIRECT   tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:8080 redir ports 8123
REDIRECT   tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:443 redir ports 8124


=== 6. restore bound JP (idempotent re-apply) ===
re-apply: {'instance_id': 32, 'applied': True, 'mode': 'bound', 'guest': {'egress': 'proxy', 'upstream': {'host': '172.16.1.2', 'port': 57781}}}
nat OUTPUT DNAT count: 2
