Yes, what I want is a complete picture that includes VRF, because like you I have never been able to design a system using VRF that does exactly what I want.
I think it would be possible when I exactly knew the interaction between VRF, routing rules, and routing marks.
(i.e. how you can use routing rules and/or routing marks to partially override the operation of VRF)
The existing documentation suggests that it would be possible, but doesn’t tell how. And it is too much work for me finding out by poking in the black box.
At the moment I run a VRF-like configuration using routing rules with source interface as a matcher, but it requires additional rules based on source address because “local router originated” traffic cannot be matched that way. And unfortunately it also requires manual copying of connected routes to the second table.
With VRF it could be better, but unfortunately it also makes wrong decisions w.r.t. source address selection, at least as far as I observed.
With a combination, it could be OK.