Fix systemd restart support

PLANS.md

@@ -125,6 +125,7 @@ Each row is a delivery milestone, not a completion claim. Expand its record befo
 | 13  | Compact terminal QR disclosure                           | 12                                        | accepted    |
 | 14  | Restart verification for valid legacy peers              | 13                                        | accepted    |
 | 15  | Diagnosable systemd restart and unloaded-unit resolution | 14                                        | accepted    |
+| 16  | Root systemd private peer restart transport              | 15                                        | blocked     |
 
 ### Milestone 1 — Rust foundation, settings, and domain states
 
@@ -3673,8 +3674,37 @@ Checks: focused service/application/TUI tests; `cargo fmt --all -- --check`; `ca
 
 Accepted for the synthetic adapter and application scope after R1 (owner-change uncertainty) and R2 (unit-resolution test gap) were repaired and independently re-reviewed. Official systemd D-Bus documentation confirms `GetUnit` fails for an unloaded unit and `LoadUnit` loads it from disk if possible; the prior call was a confirmed API mismatch. The cause of the reported host failure and actual systemd acceptance remain unproven without a disposable-VM run. [M15 evidence](docs/evidence/milestone-15.md) records the reviewed source, tests and release artifact.
 
+### Milestone 16 — Root systemd private peer restart transport
+
+Status: blocked (2026-10-27T22:42:48+02:00) on end-to-end private-peer and disposable-VM systemd checks. M15 is accepted for synthetic behavior; M9 disposable-VM systemd acceptance remains retired and unaccepted.
+
+#### Outcome and scope
+
+Support explicit restart on a root-managed systemd host without a system bus by connecting directly to systemd's root-only private Unix socket using pinned zbus. Retain the system-bus path when available. Audit destination, signal match, owner monitoring and disconnect behavior separately for each transport; choose transport before `RestartUnit` and never retry after possible submission. Keep backup, confirmation, generation, full runtime verification, durable applied state and Commit/restore isolation unchanged. No production or host service access.
+
+#### Tasks and acceptance
+
+| Task | Owner | State | Evidence required |
+| --- | --- | --- | --- |
+| M16.1 | explorer | complete | Pinned zbus 5.19.0 source and official systemd private-socket protocol findings |
+| M16.2 | implementer | complete for implementation scope | Transport implementation, zbus feature/docs and 16 focused synthetic tests |
+| M16.3 | independent reviewer; repairer | blocked | R1 private permission category closed on re-review; R2 private-path behavioral evidence remains unavailable |
+| M16.4 | coordinator | complete for available checks | Integrated source, pinned Rust gates and [M16 evidence](docs/evidence/milestone-16.md); VM unavailable |
+
+- [ ] M16-A1: root-only private peer connection and system-bus path work against real systemd with correct method destination and job signal tracking. Source audit and synthetic selection checks pass; real transport checks remain unavailable.
+- [x] M16-A2: source and synthetic checks preserve subscribe-before-request, canonical alias ID, bounded deadline, disconnect/uncertainty behavior, and no retry after possible submission.
+- [ ] M16-A3: synthetic selection/failure and existing job-tracker tests pass, but the private `SystemdBus` branch was not exercised end to end because local peer credential access returned sandbox `EPERM`.
+- [ ] M16-A4: R1 was closed, but R2 remains open; pinned Rust gates pass. Disposable-VM private and system-bus acceptance is unavailable.
+
+Available checks: focused service/application tests, `cargo fmt --all -- --check`, `cargo clippy --locked --all-targets -- -D warnings`, `cargo test --locked`, `cargo build --locked --release`, `git diff --check` all passed on repaired inputs. Synthetic checks used no production socket or keys. [M16 evidence](docs/evidence/milestone-16.md) records exact results and identities. Disposable-VM checks were not run.
+
+#### Outcome and handoff
+
+Official systemd source confirms root `systemctl` connects to `/run/systemd/private` directly when PID 1 is systemd; official `systemd(1)` docs caution this socket is private to systemd. Pinned zbus 5.19.0 exposes peer mode behind its approved crate's `p2p` feature. The implementation uses destination-free peer calls and local signal matching without bus owner monitoring; the bus path remains available. M16-R1 (P2, private permission category) was repaired and independently closed. M16-R2 (P2, private-branch behavioral evidence) remains open: local zbus peer credential access returned sandbox `EPERM`, and the prior disposable Debian VM has no installed/verified guest. No production or host socket was touched. The next action is a disposable-VM run with synthetic configuration covering both transports; until then M16 cannot be accepted.
+
 ## Current progress and resume point
 
+- Milestone 16 is blocked after implementation, independent review/repair and passing pinned Rust gates: synthetic tests cover selection/failures, but private-peer behavior and both real systemd transports lack disposable-VM evidence. [M16 evidence](docs/evidence/milestone-16.md) records the source and artifact. No production result is claimed.
 - Milestone 15 is accepted (2026-10-27) for synthetic service-adapter and application behavior: typed failure/phase/unit reporting, documented `LoadUnit` resolution, conservative uncertainty, independent R1/R2 closure and pinned Rust gates. [M15 evidence](docs/evidence/milestone-15.md) records source/artifact identity. Disposable-VM systemd acceptance remains incomplete and unclaimed.
 - Milestone 14 is accepted (2026-10-27) for fixture restart orchestration: complete saved-peer projection, legacy/IPv4-only/broader-route eligibility, safe blockers and durable verified history passed independent review and pinned Rust gates. [M14 evidence](docs/evidence/milestone-14.md) records source/artifact identity. No disposable-VM systemd acceptance or production result is claimed.
 - Milestone 13 is accepted (2026-10-27): compact, explicitly colored QR disclosure, complete quiet zone and dimensioned fallback passed synthetic rendering tests, independent R5 closure and pinned Rust gates. [M13 evidence](docs/evidence/milestone-13.md) records the reviewed source and release artifact. No manual scan, Alpine rerun, VM or production validation is claimed.
@@ -3696,7 +3726,7 @@ Accepted for the synthetic adapter and application scope after R1 (owner-change
 
 - Milestone 8 delivered reviewed opt-in Alpine Testcontainers coverage for real IPv4 WireGuard peers, application lifecycle, saved/runtime separation, restoration, import/reissue, backup failures and the real Rustix reader. Host gates and three fresh real-container runs passed on one stable source fingerprint; M8-A1–A10 accepted. Real IPv6 behavior is unverified by user-authorized scope.
 - Milestone 9 is retired and unaccepted: the reviewed disposable VM preparation and guarded first start did not establish Debian/systemd acceptance. The exact VM was powered off after the user stopped work. M9.2–M9.3 were not started; M9-A1–A9 are unchecked.
-- Next action: use a disposable systemd VM if actual D-Bus acceptance is requested; no VM result is claimed here. Do not access production, commit, or deploy.
+- Next action: finish the selected disposable VM's guest installation/authorization, then run synthetic private-peer and system-bus restart acceptance before considering M16 accepted. Do not access production, commit, or deploy.
 
 ## Plan maintenance