How to use OpenWrt, SQM, and VPN on multiple connected routers?

@moeller0 I am trying to help someone using Asus Merlin get cake to work properly in the context of a WireGuard setup - see here:

Looks like he now has 'flows nonat' + diffserv3. Will the latter kill the desired flow differentiation despite encryption? What effect will diffserv3 have when 'flows' is set? Can diffserv3 and this flow differentiation work together somehow?