Документация и runtime: полный production-fix по fix6 без legacy

docs/IMPLEMENTATION_SPEC.md

@@ -2,7 +2,12 @@
 
 ## 1. Architectural role
 
-`awg2-harness` is a single Rust binary acting as a host-side multi-orchestrator for a dedicated Debian 13 amd64 AmneziaWG/AWG 2.0 server.
+AWG2 Harness production package contains two Rust binaries:
+
+- `awg2-harness` — host-side traffic/firewall/status/swap orchestrator;
+- `awg2-reboot-scheduler` — dedicated reboot scheduler service.
+
+`awg2-harness` remains the main host-side multi-orchestrator for a dedicated Debian 13 amd64 AmneziaWG/AWG 2.0 server.
 
 It owns the infrastructure state needed by the VPN service:
 
@@ -23,13 +28,16 @@ It does not replace Amnezia. It controls the surrounding system state that the o
 
 ## 2. Process model
 
-One systemd service runs:
+Two systemd services run:
 
 ```bash
 /usr/sbin/awg2-harness daemon --config /etc/awg2-harness/config.toml
+/usr/sbin/awg2-reboot-scheduler --config /etc/awg2-harness/config.toml
 ```
 
-The daemon starts as root and keeps running. On startup it performs initial reconcile. During runtime it reacts to Docker events and also runs a periodic reconcile loop.
+`awg2-harness` daemon starts as root and keeps running. On startup it performs initial reconcile. During runtime it reacts to Docker events and also runs a periodic reconcile loop.
+
+Reboot scheduling authority belongs to `awg2-reboot-scheduler` service. `awg2-harness` does not schedule reboots internally.
 
 Subcommands:
 
@@ -40,6 +48,7 @@ awg2-harness apply-firewall
 awg2-harness status
 awg2-harness ensure-swap
 awg2-harness validate-config
+awg2-harness validate-runtime
 ```
 
 ## 3. Module layout
@@ -71,7 +80,6 @@ src/
 │   ├── apply.rs
 │   └── nft.rs
 ├── status.rs
-├── reboot.rs
 ├── swap.rs
 └── error.rs
 ```