# STEP_035A production selector plan, read-only

Current proven model:

- VM100 marks selected WGPay peer traffic with DSCP cs1 before NAT:
  - canary tunnel_ip: 10.253.1.10
- VM101 maps DSCP cs1 from VM100 transit source 10.200.0.1 to fwmark 0x203
- fwmark 0x203 routes via table 203 / vpn3
- DSCP is cleared on marked egress

Recommended next apply model, still canary-scope only:

1. Do not change global table 200 or legacy production policy yet.
2. Replace hardcoded one-peer VM100 canary script with managed selector file:
   - /etc/router-wgpay-selector.d/peers.conf
   - format: tunnel_ip dscp_class comment
   - initial content only: 10.253.1.10 cs1 canary_vpn3
3. Keep VM101 DSCP cs1 -> fwmark 0x203 as current proven mapping.
4. After selector-file model is proven, add more explicit peer entries one by one.
5. Only later design multi-class mapping:
   - cs1 -> 0x203 / vpn3
   - cs2 -> 0x204 / vpn4
   - cs3 -> 0x205 / vpn5

Rollback remains:
- VM100: /root/rollback-step034m2-persistent-canary-vm100.sh
- VM101: /root/rollback-step034m-persistent-canary.sh