# STEP_030G HMN preserve_existing apply package

This is a dry-run package only.

## Intended future result

Create a generic egress pool with five slots:

- `hmn_slot_1` / `vpn1` / table `201` / fwmark `0x201`
- `hmn_slot_2` / `vpn2` / table `202` / fwmark `0x202`
- `hmn_slot_3` / `vpn3` / table `203` / fwmark `0x203`
- `hmn_slot_4` / `vpn4` / table `204` / fwmark `0x204`
- `hmn_slot_5` / `vpn5` / table `205` / fwmark `0x205`

Initial strategy: `preserve_existing`.

That means:

- preserve current legacy `vpn1`
- preserve current legacy `vpn2`
- fill `vpn3`-`vpn5` from validated HMN primary candidates
- do not switch production traffic to new policy yet
- do not remove legacy table `200` yet
- do not flush ip rules

## Future apply phases

### Phase 1: provider-private load only

Use existing HMN config files to prepare/load `vpn3`, `vpn4`, `vpn5`.

No production routing switch yet.

### Phase 2: add firewall membership

Add `vpn3`, `vpn4`, `vpn5` to `vpn_out`.

No global network restart.

### Phase 3: create routing tables

Populate:

- table 201 for vpn1
- table 202 for vpn2
- table 203 for vpn3
- table 204 for vpn4
- table 205 for vpn5

Do not alter legacy table 200 yet.

### Phase 4: read-only smoke

Verify:

- interfaces exist
- handshakes/transfer
- routes/tables
- firewall zone membership
- VM121/admin access still works
- VM100 wg_remote/wg_paid unchanged

### Phase 5: later policy engine

Only after smoke: introduce generic policy/balancer.

## Not included in this step

This package does not apply changes.
This package does not include raw WireGuard/AmneziaWG config content.
This package does not include private keys.