{
  "apply_strategy": "agent renders selector entries from active/idle leases and calls existing VM100 selector apply",
  "example": "10.253.1.25 cs4 peer_<uuid>",
  "safety": [
    "do not change WireGuard client config",
    "do not change public/private keys",
    "do not reassign while active",
    "reassign only after idle threshold and cooldown"
  ],
  "source_of_truth": "public.peer_egress_leases joined to public.peers",
  "vm100_selector_line": "tunnel_ip egress_class peer_id"
}