Документация и runtime: полный production-fix по fix6 без legacy

docs/CONFIGURATION.md

@@ -13,8 +13,8 @@ peer_ipv4_cidr = "10.8.1.0/24"
 
 [traffic]
 enabled = true
-peer_limit = "50mbit"
-root_rate = "500mbit"
+peer_limit = "70mbit"
+root_rate = "1000mbit"
 reconcile_interval_secs = 15
 container_ready_timeout_secs = 120
 class_start_id = 10

docs/IMPLEMENTATION_SPEC.md

@@ -2,7 +2,12 @@
 
 ## 1. Architectural role
 
-`awg2-harness` is a single Rust binary acting as a host-side multi-orchestrator for a dedicated Debian 13 amd64 AmneziaWG/AWG 2.0 server.
+AWG2 Harness production package contains two Rust binaries:
+
+- `awg2-harness` — host-side traffic/firewall/status/swap orchestrator;
+- `awg2-reboot-scheduler` — dedicated reboot scheduler service.
+
+`awg2-harness` remains the main host-side multi-orchestrator for a dedicated Debian 13 amd64 AmneziaWG/AWG 2.0 server.
 
 It owns the infrastructure state needed by the VPN service:
 
@@ -23,13 +28,16 @@ It does not replace Amnezia. It controls the surrounding system state that the o
 
 ## 2. Process model
 
-One systemd service runs:
+Two systemd services run:
 
 ```bash
 /usr/sbin/awg2-harness daemon --config /etc/awg2-harness/config.toml
+/usr/sbin/awg2-reboot-scheduler --config /etc/awg2-harness/config.toml
 ```
 
-The daemon starts as root and keeps running. On startup it performs initial reconcile. During runtime it reacts to Docker events and also runs a periodic reconcile loop.
+`awg2-harness` daemon starts as root and keeps running. On startup it performs initial reconcile. During runtime it reacts to Docker events and also runs a periodic reconcile loop.
+
+Reboot scheduling authority belongs to `awg2-reboot-scheduler` service. `awg2-harness` does not schedule reboots internally.
 
 Subcommands:
 
@@ -40,6 +48,7 @@ awg2-harness apply-firewall
 awg2-harness status
 awg2-harness ensure-swap
 awg2-harness validate-config
+awg2-harness validate-runtime
 ```
 
 ## 3. Module layout
@@ -71,7 +80,6 @@ src/
 │   ├── apply.rs
 │   └── nft.rs
 ├── status.rs
-├── reboot.rs
 ├── swap.rs
 └── error.rs
 ```

docs/INSTALLATION.md

@@ -55,15 +55,17 @@ install -m 0644 /root/awg2-harness.config.toml /etc/awg2-harness/config.toml
 
 ```bash
 awg2-harness validate-config --config /etc/awg2-harness/config.toml
+awg2-harness validate-runtime --config /etc/awg2-harness/config.toml
 awg2-harness apply-limits --config /etc/awg2-harness/config.toml
 awg2-harness apply-firewall --config /etc/awg2-harness/config.toml
 awg2-harness status --config /etc/awg2-harness/config.toml
 ```
 
-### C4. Enable daemon
+### C4. Enable services
 
 ```bash
 systemctl enable --now awg2-harness.service
+systemctl enable --now awg2-reboot-scheduler.service
 ```
 
 ## D. Manual source-tree install (staging/debug only)