# STEP_033H3 WGPay exact peer plan

No remote changes were applied.

Correct model:
- WGPay clients are WireGuard peers on VM100 `wg_paid`.
- DHCP leases are expected to be empty and should not be used for WGPay canary selection.

If `wg_paid` peer count is 0:
- do not proceed with real-client canary.
- create a dedicated temporary test WGPay peer in a separate staged step.
- test-peer source should be its tunnel IP, for example `10.253.x.y/32`.

Future canary shape:
- VM100 before NAT:
  - match `iifname wg_paid ip saddr <WGPay_peer_tunnel_IP>`
  - set DSCP cs1
- VM101:
  - match `iifname eth1 ip saddr 10.200.0.1 ip dscp cs1`
  - set fwmark 0x203
  - existing fwmark rule sends it to table 203 / vpn3