рабочий вариант, но скороть 10 МБит

docs/architecture/VPN_IP_TUNNEL_SERVICE_TARGET.md

@@ -12,6 +12,10 @@ Core. It does not redefine node-to-node transport. Current fabric inter-node
 transport is QUIC-only; VPN/IP tunnel runtime must request and use fabric
 routes instead of introducing a separate packet transport contract.
 
+The general service-over-fabric contract is defined in
+[FABRIC_SERVICE_OVER_TRANSPORT_MODEL.md](\\nas\\MST\\codex\\rdp-proxy\\docs\\architecture\\FABRIC_SERVICE_OVER_TRANSPORT_MODEL.md).
+VPN is one service class over that transport model, not an exception to it.
+
 ## Purpose
 
 VPN/IP tunnel is a service above the Fabric Core, not a node-local setting.
@@ -25,6 +29,9 @@ platform's core rules:
 - Nodes execute leased work only.
 - Organizations must not see mesh topology.
 - Interactive services such as RDP must not be harmed by VPN bulk traffic.
+- VPN ingress may accept external client traffic, but after acceptance it must
+  map that traffic into a fabric service channel rather than inventing an
+  alternate inter-node carrier.
 
 ## Non-Goals