Полностью доведена production-логика AWG2 harness по up2: strict execution, tc parser, anti-torrent, status и документация

docs/IMPLEMENTATION_SPEC.md

@@ -176,6 +176,12 @@ wg show
 
 The fallback parser should support the old output format from `wg-peers.txt`, extracting `allowed ips:` lines.
 
+Execution policy for production:
+
+- do not use shell wrappers (`sh -c`) for `wg` invocation;
+- do not suppress stderr via redirection in command strings;
+- execute `wg` directly and handle non-zero exit codes in Rust.
+
 ## 8. Desired traffic topology
 
 The expected topology exactly mirrors old bash.
@@ -244,6 +250,24 @@ reconcile_traffic():
 
 For v1, `full_rebuild_on_drift = true` is the safer default.
 
+Parser hardening requirements:
+
+- `tc filter show` must be parsed block-by-block (state-machine), not by naive token scanning across unrelated lines;
+- mapping `peer_ip -> class_id` must be validated for both egress (`1:`) and ingress (`2:`) sides;
+- verification must fail when classes/filters exist but mapping differs from deterministic assignment.
+
+Apply/verify policy:
+
+- all apply steps are explicit command invocations;
+- expected idempotency conflicts (`already exists`) may be tolerated selectively;
+- any other apply error is fatal;
+- `verify_after_apply` is mandatory for both traffic and anti-torrent subsystems.
+
+Anti-torrent observability contract:
+
+- named counter `antitorrent_dropped_v4` must be present in owned table;
+- status output must expose both dropped packets and dropped bytes.
+
 ## 10. Owned state and teardown rules
 
 The binary owns:

docs/INSTALLATION.md

@@ -52,6 +52,10 @@ install -d -m 0755 /etc/awg2-harness
 install -m 0644 config.toml /etc/awg2-harness/config.toml
 ```
 
+Важно: production-установка **не должна** автоматически копировать [`config.example.toml`](config.example.toml) как боевой конфиг.
+Если используется [`tools/build.sh`](tools/build.sh), режим `--install` завершится ошибкой при отсутствии `/etc/awg2-harness/config.toml`.
+Сначала подготовьте осознанный production-конфиг вручную.
+
 Проверка конфига:
 
 ```bash