OBD-II signals renamed obd_*, plus timing, trims, O2; GNSS signals; elm_connected; reboot command

Decision 30: CAN feeds displays, OBD-II (K-line via the ELM) calibrates, so every
obd2 signal carries the obd_ prefix and the plain names are left for decoded ones.
yukart/gnss/<signal> gives displays the fix as single values; gnss/fix stays for
navigation. Boundary: reboot beside poweroff, same guards.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DDwfd6Ki8UfG4hK6W5YpJz

docs/BOUNDARY.md

@@ -37,7 +37,7 @@ The two channels from decision 24 share the socket but keep different guarantees
 | `ack` | reply to a `cmd` | `id`, `ok`, `detail`, `dup` (true when answered from the cache) |
 
 With `source: bus`, `signals` is the newest envelope of every signal svc-gw has
-seen on `yukart/vehicle/+` and `yukart/host/+`. svc-gw marks one
+seen on `yukart/vehicle/+`, `yukart/host/+` and `yukart/gnss/+`. svc-gw marks one
 `quality: "stale"` when it has not been refreshed for 5 s, or is known only from
 the broker's retained copy (which may predate a reboot). A signal once seen is
 never removed.
@@ -66,18 +66,20 @@ tablet, or an Orin behind a replugged hub, looks connected at the link layer.
 |---|---|---|
 | `ping` | — | `ack` with `detail: "pong"` |
 | `mark` | `text`, `delay_ms` (optional: how long the command waited before this send) | stamped into the open recording; fails with no session open |
-| `poweroff` | `confirm: "poweroff"`, `boot_id` (from this connection's `hello`) | acks, then shuts the host down cleanly (`systemctl poweroff`) about 2 s later. Refused unless svc-gw runs with `--allow-poweroff` (the Orin's unit only), and when `boot_id` is not the current boot's |
+| `poweroff` | `confirm: "poweroff"`, `boot_id` (from this connection's `hello`) | acks, then shuts the host down cleanly (`systemctl poweroff`) about 2 s later. Refused unless svc-gw runs with `--allow-power` (the Orin's unit only), and when `boot_id` is not the current boot's |
+| `reboot` | `confirm: "reboot"`, `boot_id` | the same, with `systemctl reboot`; the same flag and refusals |
 
 A repeated `id` returns the original `ack` (last 256 kept, shared across
 connections) and never re-runs the command.
 
-`poweroff` is the exception to retry-until-acked: the ack cache does not survive
-the reboot it causes, so a resend could shut the next boot down too. The client
-sends it once and does not resend it; `boot_id` makes svc-gw refuse one from a
-previous boot regardless.
+`poweroff` and `reboot` are the exception to retry-until-acked: the ack cache does
+not survive the restart they cause, so a resend could shut the next boot down (or
+reboot it again). The client sends them once and does not resend; `boot_id` makes
+svc-gw refuse one from a previous boot regardless.
 
 ## Not yet
 
 - TTS utterances (id, chunk sequence, terminator, expiry) — when there is a TTS.
-- `gnss`: its fix is an object, which the envelope's `value` does not allow yet.
+- `gnss/fix` as one object (navigation's input): the envelope's `value` does not allow
+  one yet. Displays get the fix as single values on `yukart/gnss/<signal>` instead.
 - Any version beyond `proto: 0`. A breaking change bumps it; the client checks it.

docs/GUIDELINES.md

@@ -9,7 +9,7 @@ type: guidelines
 - ⚠ **The unit appears in both the topic name and the payload, so they can
   contradict each other.** Generating both from one entry is what stops that; a
   hand-written `"unit"` reintroduces the failure it was meant to prevent.
-- Signal names carry their unit (`vehicle_speed_kph`, `coolant_temp_c`), so a unit
+- Signal names carry their unit (`gnss_speed_kph`, `obd_coolant_temp_c`), so a unit
   mismatch is visible at the call site rather than one registry lookup away.
 
 ## 2. Two clocks, and they answer different questions