Fix systemd service restart

2026-10-27 21:55:59 +02:00
parent 4bb975f122
commit 86c28a35b5
5 changed files with 516 additions and 45 deletions
@@ -0,0 +1,68 @@
+# Milestone 14 acceptance evidence: restart with valid legacy peers
+
+Validated 2026-10-27T21:55:11+02:00 on the native
+`x86_64-unknown-linux-gnu` development host. Results below use synthetic
+saved files, fake service/runtime adapters, and existing pure runtime comparison
+tests. They do not establish a real systemd restart.
+
+## Behavior and review
+
+Restart preview and confirmation now use the complete `SavedPeerProjection`
+derived from the authoritative saved configuration. It includes every valid
+peer's public key and complete normalized `AllowedIPs`, independently of
+optional managed alias metadata and the narrower management `Client` shape.
+The existing runtime comparator still requires a complete observed peer set
+and checks all saved peers and routes before verification can be recorded.
+The management applied snapshot remains absent when it cannot represent the
+whole saved peer set; no partial `Client` snapshot is marked applied.
+
+Synthetic fixtures cover a saved managed client alongside metadata-free legacy
+peers, IPv4-only host routes, and valid subnet routes outside the management
+model. Preview preserves server bytes and creates no backup. Fake successful
+service completion plus a full runtime match creates the required pre-restart
+backup, records verified historical status, and releases deleted-address
+reservations only after durable installation. Reopening retains that history,
+starts with runtime `Unknown`, and does not regain a partial applied snapshot.
+A missing legacy runtime peer leaves reservations durable and runtime unknown.
+Malformed AllowedIPs, duplicate public identity, and malformed section headers
+block preview before backup/service mutation with a secret-free public identity
+or section line and condition. Existing tests also cover backup failure,
+service timeout/failure, stale saved generation, runtime mismatch, persistence
+failure, draft cancellation and `SaveConfig` rejection.
+
+An independent GPT-6-Luna/high reviewer found no actionable behavior finding.
+The first coordinator Clippy gate found M14-R1 (P3), a collapsible diagnostic
+guard in `src/app.rs`. A separate GPT-6-Luna/high repairer fixed it; the
+reviewer confirmed equivalent logic and closed R1. The final integrated gates
+below ran after that repair.
+
+## Commands and source identity
+
+Pinned rustc/Cargo 1.97.1, rustfmt 1.9.0 and Clippy 0.1.97 were verified.
+The following commands ran from the repository root and exited 0 on the
+integrated revision:
+
+- `cargo test --locked app::tests::`: 57 passed.
+- `cargo test --locked --test runtime_restart`: 3 passed.
+- `cargo fmt --all -- --check`.
+- `cargo clippy --locked --all-targets -- -D warnings`.
+- `cargo test --locked`: 357 passed, 3 explicitly ignored, 0 failed,
+  including 2 documentation tests.
+- `cargo build --locked --release`.
+- `git diff --check`.
+
+Base commit: `4bb975f122abfdeabbd04fe6b737eec5706596f5`. Dirty Rust inputs
+at validation were `src/app.rs`, `src/domain.rs`, and `tests/runtime_restart.rs`;
+`PLANS.md` was dirty with this milestone's execution record. SHA256 inputs:
+
+- `src/app.rs`: `01cf281f5b8ae62877dcf63ece7d51b5cca5522f6bc5c9e99dbc0e718a4121f4`
+- `src/domain.rs`: `179ecbe66ad7b6e022233a6da3b62a6ce57d92d26d32b0ae6c750ccd2edc5f01`
+- `tests/runtime_restart.rs`: `4cff0de16a18cccc846ace86808840567165fc110d121fd7bdc459481379e05f`
+
+Native release artifact `target/release/wireguard-admin` SHA256:
+`a7c946297d2a0140ddcca1c15bb3f651fe6ddc494c2eb7e8e713fdfc700e6b5a`.
+
+No Alpine rerun, disposable systemd VM, or production operation was performed.
+The accepted M8 Alpine artifact identity predates this revision; it does not
+validate this build. M9's real systemd/D-Bus acceptance remains retired and
+unverified.