fix31: финальный polish формулировок без исторических отсылок

2026-05-12 18:05:27 +05:00
parent bb37da72c0
commit d1d919a615
3 changed files with 14 additions and 14 deletions
@@ -123,7 +123,7 @@ struct PeerTrafficClass {
 }
 ```

-Class assignment must be deterministic. Peer IP strings are sorted lexicographically, then assigned `class_start_id + index`. Do not silently switch this to numeric IPv4 sorting in v1: the production class-id contract maps `10.8.1.10` before `10.8.1.2` because sorting is textual, not numeric.
+Class assignment must be deterministic. Peer IP strings are sorted lexicographically, then assigned `class_start_id + index`. Do not silently switch this to numeric IPv4 sorting: the production class-id contract maps `10.8.1.10` before `10.8.1.2` because sorting is textual, not numeric.

 ## 5. Namespace strategy

@@ -136,7 +136,7 @@ Preferred strategy:

 Implementation options:

- transitional v1: spawn host tools with namespace entry, for example `nsenter -t <pid> -n tc ...`, `nsenter -t <pid> -n ip ...`, `nsenter -t <pid> -n wg ...`;
+- current path: spawn host tools with namespace entry, for example `nsenter -t <pid> -n tc ...`, `nsenter -t <pid> -n ip ...`, `nsenter -t <pid> -n wg ...`;
 - later/native: use netlink crates and explicit namespace switching where practical.

 `docker exec` should not be the architectural default. It can remain as compatibility fallback if `nsenter`/host tools are unavailable, but the design assumption is that the Rust binary has host authority and controls the relevant namespace.
@@ -174,7 +174,7 @@ Parsing rules:
 - parse lines structurally into peer public key and allowed IPs;
 - keep IPv4 `/32` addresses within `amnezia.peer_ipv4_cidr`;
 - include offline peers; online state is not a requirement for shaping;
- sort peer IP strings lexicographically before class assignment to preserve the v1 lexicographic class-id contract.
+- sort peer IP strings lexicographically before class assignment to preserve the current lexicographic class-id contract.

 Fallback:

@@ -182,7 +182,7 @@ Fallback:
 wg show
 ```

-The fallback parser should support the old output format from `wg-peers.txt`, extracting `allowed ips:` lines.
+The fallback parser should support standard `wg show` text output by extracting `allowed ips:` lines.

 Execution policy for production:

@@ -192,7 +192,7 @@ Execution policy for production:

 ## 8. Desired traffic topology

-The expected topology is the v1 AWG2 traffic topology.
+The expected topology is the AWG2 traffic topology contract.

 Egress:

@@ -253,7 +253,7 @@ reconcile_traffic():
      verify_firewall_after_apply(target, firewall_desired)
 ```

-For production v1, controlled full rebuild on drift is the only supported path.
+For production, controlled full rebuild on drift is the only supported path.

 Parser hardening requirements:

@@ -300,7 +300,7 @@ The rule must not be implemented as a global subnet limit:
 ip saddr 10.8.1.0/24 ct count over 200 drop
 ```

-That form can become one shared counter for the whole matched traffic set, depending on how it is written and where it is placed. For per-peer behavior, key the stateful object by source VPN IP. Recommended v1 shape:
+That form can become one shared counter for the whole matched traffic set, depending on how it is written and where it is placed. For per-peer behavior, key the stateful object by source VPN IP. Recommended shape:

 ```nft
 table inet awg2_harness {
@@ -416,7 +416,7 @@ Last actions:
  last error if any
 ```

-The old status banner “system ready” is not enough. Rust status must be falsifiable: it should clearly say when state is partial.
+A generic status banner like “system ready” is not enough. Rust status must be falsifiable: it should clearly say when state is partial.

 ## 16. Reboot module integration