=== CMD1: apply already done above (client + multidr echo deployments + multidr-first DR), waits already confirmed Ready/Available ===
$ kubectl -n istio-vt-t54 get pods
NAME                               READY   STATUS    RESTARTS   AGE
client                             2/2     Running   0          17s
multidr-echo-v1-69f96ddf68-ljrmz   2/2     Running   0          17s
multidr-echo-v2-9748fbf8d-6hjbm    2/2     Running   0          17s

=== CMD2: sleep 3 ===
(slept 3s)

=== CMD3: apply second DestinationRule (multidr-second) ===
$ kubectl apply -f - <<YAML (multidr-second DR)
apiVersion: networking.istio.io/v1
kind: DestinationRule
metadata:
  name: multidr-second
  namespace: istio-vt-t54
spec:
  host: multidr-echo.istio-vt-t54.svc.homelab.local
  trafficPolicy:
    connectionPool:
      tcp:
        maxConnections: 999
  subsets:
  - name: v2
    labels:
      version: v2
destinationrule.networking.istio.io/multidr-second created

=== CMD4: sleep 5 ===
(slept 5s)

=== CMD5: istioctl proxy-config cluster (check merged clusters + maxConnections) ===
$ istioctl proxy-config cluster client.istio-vt-t54 --fqdn multidr-echo.istio-vt-t54.svc.homelab.local -o json | jq ".[] | {name, maxConn: .circuitBreakers.thresholds[0].maxConnections}"

=== CMD5 RESULT (before correction): empty [] -- host mismatch discovered, see notes below ===
$ istioctl proxy-config cluster client.istio-vt-t54 --fqdn multidr-echo.istio-vt-t54.svc.homelab.local -o json | jq ...
[]

=== ENVIRONMENT DISCOVERY: DR host domain mismatch ===
The initial --fqdn query using multidr-echo.istio-vt-t54.svc.homelab.local returned
an empty array. Investigation showed:
  $ istiod discovery args include: --domain cluster.local
  $ sidecar TRUST_DOMAIN env = cluster.local
  $ istioctl proxy-config cluster client.istio-vt-t54 (no --fqdn filter) lists ALL
    outbound clusters as *.svc.cluster.local (e.g. multidr-echo.istio-vt-t54.svc.cluster.local),
    NOT *.svc.homelab.local, even though kubelet clusterDomain=homelab.local and CoreDNS
    serves homelab.local (confirmed via nslookup from the client pod).
Conclusion: this Istio control plane's internal service-registry hostname convention
(global.proxy.clusterDomain / istiod --domain) is hardcoded/installed as "cluster.local",
independent of the actual kubelet/CoreDNS cluster domain (homelab.local). This is an
install-time mismatch on this cluster, separate from the harness-notes.md guidance
(which is correct for pod-level DNS/curl targets, but does NOT apply to DestinationRule/
VirtualService "host" fields, which must match Istio's internal registry hostname).
Corrective action: re-created both DestinationRules using host
multidr-echo.istio-vt-t54.svc.cluster.local (matching the real Envoy cluster name),
preserving creation order (multidr-first before multidr-second), and re-ran the query.

=== CMD3' (corrected): delete mis-hosted DRs, recreate with correct host, preserving creation order ===
$ kubectl -n istio-vt-t54 delete destinationrule multidr-first multidr-second
destinationrule.networking.istio.io "multidr-first" deleted from istio-vt-t54 namespace
destinationrule.networking.istio.io "multidr-second" deleted from istio-vt-t54 namespace

$ kubectl apply -f - (multidr-first, host=multidr-echo.istio-vt-t54.svc.cluster.local, maxConnections=11, subset v1)
destinationrule.networking.istio.io/multidr-first created

=== CMD4' (corrected): sleep 3 ===
(slept 3s)

$ kubectl apply -f - (multidr-second, host=multidr-echo.istio-vt-t54.svc.cluster.local, maxConnections=999, subset v2)
destinationrule.networking.istio.io/multidr-second created

=== sleep 5 ===
(slept 5s)

=== CMD5' (corrected): istioctl proxy-config cluster with corrected fqdn ===
$ istioctl proxy-config cluster client.istio-vt-t54 --fqdn multidr-echo.istio-vt-t54.svc.cluster.local -o json | jq '.[] | {name, maxConn: .circuitBreakers.thresholds[0].maxConnections}'
{
  "name": "outbound|80||multidr-echo.istio-vt-t54.svc.cluster.local",
  "maxConn": 11
}
{
  "name": "outbound|80|v1|multidr-echo.istio-vt-t54.svc.cluster.local",
  "maxConn": 11
}
{
  "name": "outbound|80|v2|multidr-echo.istio-vt-t54.svc.cluster.local",
  "maxConn": 11
}

=== OBSERVATION SUMMARY ===
1) Both v1 and v2 subset clusters exist in the client sidecar's config for the
   multidr-echo host (union/merge of subsets from BOTH DestinationRules) -- confirms (a).
2) The default (no-subset) cluster "outbound|80||multidr-echo...cluster.local" has
   maxConnections=11, matching multidr-first's (oldest DR) top-level trafficPolicy,
   NOT 999 from multidr-second (newer DR) -- confirms (b): the newer DR's top-level
   trafficPolicy is silently ignored.
3) Note: v1 and v2 subset clusters ALSO show maxConn=11 (not 999) -- this is expected
   and consistent, because NEITHER subset entry (v1 in multidr-first, v2 in
   multidr-second) defines its OWN subset-level trafficPolicy; each subset with no
   subset-level override simply inherits whatever the winning top-level trafficPolicy
   is (11, from the oldest DR). This does not contradict the claim; it is additional
   confirmation that only the oldest DR's top-level policy is in effect mesh-wide for
   this host.