fix30: очищены old-bash формулировки и уточнён class-id контракт

docs/ACCEPTANCE_CHECKLIST.md

@@ -21,7 +21,7 @@
 - [ ] Offline peers с allowed IP тоже попадают в список shaping.
 - [ ] IP вне `amnezia.peer_ipv4_cidr` не попадают в traffic shaping.
 
-## C. Traffic topology parity with old bash
+## C. Traffic topology contract
 
 - [ ] `awg2-harness apply-limits` успешно завершается.
 - [ ] На AWG/WG-интерфейсе есть root qdisc `1: htb`.

docs/CONFIGURATION.md

@@ -55,11 +55,11 @@ swappiness = 1
 
 `amnezia.interface_patterns` — fallback-паттерны для устойчивости к обновлениям Amnezia. Старые материалы прямо отмечают риск переименования интерфейса между `awg0`, `wg0`, `amnezia0`.
 
-`amnezia.peer_ipv4_cidr` — подсеть VPN peers. Сейчас старая bash-система жёстко ищет `10.8.1.x`; в Rust это должно быть конфигурируемо.
+`amnezia.peer_ipv4_cidr` — подсеть VPN peers. Production default — `10.8.1.0/24`; значение конфигурируемое.
 
 `traffic.peer_limit` — per-peer лимит в обе стороны. Текущий production default — `50mbit`.
 
-`traffic.root_rate` — верхний HTB-класс, в текущем production default — `500mbit`. Историческое значение old bash — `1000mbit`.
+`traffic.root_rate` — верхний HTB-класс, в текущем production default — `500mbit`.
 
 `traffic.reconcile_interval_secs` — период фоновой проверки. Он нужен не вместо Docker events, а вместе с ними.
 
@@ -71,7 +71,7 @@ swappiness = 1
 
 При drift orchestrator всегда делает controlled rebuild owned topology.
 
-`anti_torrent.enabled` — включает nftables connection-count guard против high-peer-count P2P-нагрузки. Это новое расширение, не часть old bash.
+`anti_torrent.enabled` — включает nftables connection-count guard против high-peer-count P2P-нагрузки. Это отдельный AWG2 Harness module и часть текущего production-контракта.
 
 `host_firewall.enabled` — включает host-level INPUT firewall в отдельной AWG2-owned таблице `inet awg2_host_firewall`.
 

docs/IMPLEMENTATION_SPEC.md

@@ -24,7 +24,7 @@ It owns the infrastructure state needed by the VPN service:
 - planned reboot;
 - emergency swap setup.
 
-It does not replace Amnezia. It controls the surrounding system state that the old bash package configured manually.
+It does not replace Amnezia. It controls the surrounding host-side infrastructure state required by the Amnezia service.
 
 ## 2. Process model
 
@@ -123,7 +123,7 @@ struct PeerTrafficClass {
 }
 ```
 
-Class assignment must be deterministic. For strict parity with bash v1, peer IP strings must be sorted lexicographically, exactly like `sort -u` in the old script, then assigned `class_start_id + index`. Do not silently switch this to numeric IPv4 sorting in v1: the production snapshot maps `10.8.1.10` before `10.8.1.2` because bash sorted text, not numeric addresses.
+Class assignment must be deterministic. Peer IP strings are sorted lexicographically, then assigned `class_start_id + index`. Do not silently switch this to numeric IPv4 sorting in v1: the production class-id contract maps `10.8.1.10` before `10.8.1.2` because sorting is textual, not numeric.
 
 ## 5. Namespace strategy
 
@@ -141,7 +141,7 @@ Implementation options:
 
 `docker exec` should not be the architectural default. It can remain as compatibility fallback if `nsenter`/host tools are unavailable, but the design assumption is that the Rust binary has host authority and controls the relevant namespace.
 
-This also reduces the risk noted in the old docs: if the Amnezia container drops `tc` or `iproute2`, host-side tools can still apply rules inside the container netns.
+This also reduces operational risk: if the Amnezia container drops `tc` or `iproute2`, host-side tools can still apply rules inside the container netns.
 
 ## 6. Discovery flow
 
@@ -174,7 +174,7 @@ Parsing rules:
 - parse lines structurally into peer public key and allowed IPs;
 - keep IPv4 `/32` addresses within `amnezia.peer_ipv4_cidr`;
 - include offline peers; online state is not a requirement for shaping;
-- sort peer IP strings lexicographically before class assignment to preserve old bash `sort -u` parity.
+- sort peer IP strings lexicographically before class assignment to preserve the v1 lexicographic class-id contract.
 
 Fallback:
 
@@ -192,7 +192,7 @@ Execution policy for production:
 
 ## 8. Desired traffic topology
 
-The expected topology exactly mirrors old bash.
+The expected topology is the v1 AWG2 traffic topology.
 
 Egress:
 

tools/README.md

@@ -14,7 +14,7 @@ reboot_module     -> awg2-reboot-scheduler
 ## Поддерживаемая build-среда
 
 - Debian 13 с `apt`.
-- amd64/x86_64.
+- Debian package architecture: amd64.
 - Rust toolchain из `rust-toolchain.toml` (`1.95.0` в текущем дереве).
 - `Cargo.lock` обязателен: build gate работает в `--locked` режиме.
 

traffic_core/src/wg.rs

@@ -272,7 +272,7 @@ mod tests {
     }
 
     #[test]
-    fn lexicographic_sorting_parity() {
+    fn lexicographic_sorting_preserves_class_id_contract() {
         let raw = "wg0 key1 10.8.1.2/32\nwg0 key2 10.8.1.10/32";
         let mut peers = parse_allowed_ips(raw, "10.8.1.0/24").expect("parse");
         peers.sort_by_key(|p| p.ipv4.to_string());