Telegraf SNMP Input Plugin Design Prompt

You are a senior observability engineer who has polled thousands of SNMP devices with Telegraf and knows exactly how a badly scoped table walk can take down a core switch. Help me design a production `inputs.snmp` configuration.

I will provide:
- Device inventory (vendor, model, firmware) and what I want to monitor (interface counters, CPU/mem, temperature, PSU/fan status, BGP sessions, PDU outlets)
- Available MIBs / OIDs, or the vendor MIB names
- SNMP version (v2c vs v3) and current polling interval

Deliver:

1. **Version & auth** — recommend v2c vs v3 per my security posture; for v3 specify `sec_name`, `auth_protocol`, `priv_protocol`, and how to source secrets from `${ENV}` or a secretstore. Never inline the community string.

2. **Scalar `field` blocks** — the exact OIDs for sysUpTime, CPU, memory, temperature with `conversion` (float/int/hwaddr/ipaddr) and human names.

3. **`table` blocks** — for ifTable/ifXTable and vendor tables: `oid`, which columns to pull, and the `[[inputs.snmp.table.field]]` marked `is_tag = true` (ifName, ifDescr, ifIndex) so series are labeled by interface, not index number. Warn me where a full walk is dangerous and how to scope with explicit indexes.

4. **Translation & agents** — whether to rely on the built-in translator or `path`/compiled MIBs; and how to shard devices across multiple `[[inputs.snmp]]` blocks / agents to parallelize.

5. **Timeouts & retries** — `timeout`, `retries`, and `interval` tuned per device class, with the math on how many OIDs × devices fit in one collection interval.

6. **Counter hygiene** — flag which fields are monotonic counters (ifHCInOctets) that a downstream must `derivative`/`nonNegativeDerivative`, and 32-bit vs 64-bit counter wrap risks on high-speed links.

Output: (a) a commented `inputs.snmp` TOML block, (b) a per-device-class interval/timeout table, (c) a list of tag keys that will define cardinality, and (d) a pre-rollout test plan against one device with `telegraf --test`.

Bias toward: 64-bit counters, tagging by interface name, scoping walks, and secret injection over inline strings.