If I have two rules both adding a (say) packet mark to the same packet, would the second over-write the first or would the packet happily carry both marks?

It is my belief that the last mark processed is the one that sticks. All the rest are over written

each packet may only carry one packet mark, one connection mark and one routing mark, all previuos ones are overwritten. in most cases you may workaround this by assigning combined marks. for example, one check means packetmark "a", other check sets packetmak "b". if both checks succeed, you may put the packetmark "ab"