Implement explicit restart verification scenario

docs/PROJECT_LAYOUT.md

@@ -38,6 +38,7 @@ src/
     commit.rs              # Prepare, backup, install, and publish saved-state Commit
     restore.rs             # Bound preview and confirmed saved-state replacement
     backups.rs             # Manual/pre-operation backup and archive-list scenarios
+    restart.rs             # Bound restart preview, backup, job, verification, and publication scenario
   wireguard.rs             # Server configuration module boundary
   wireguard/
     document.rs            # Parsing and edits preserving original text

docs/evidence/milestone-25.md

@@ -0,0 +1,39 @@
+# Milestone 25 evidence — explicit restart verification scenario
+
+Run date: 2026-10-30T21:35:10+02:00. Baseline commit: `7cef400`; the working tree has uncommitted M25 changes in `src/app.rs`, new `src/app/restart.rs`, and `docs/PROJECT_LAYOUT.md`, plus coordinator-owned `PLANS.md`. Rust/Cargo: 1.97.1, native host target. Tests used synthetic fixtures/adapters only. No production configuration, keys, VPN, host service, Docker environment, or VM was accessed.
+
+## Integrated inputs
+
+| Input | SHA-256 |
+| --- | --- |
+| `src/app.rs` | `784001013f90d9bbdb1579cf3c6672a27dd34dc0e295d3e6ea3f70d53d05c586` |
+| `src/app/restart.rs` | `fb724054faec6adf1b58a31800a2a636307b2620ac3d980309638ad508a00fa3` |
+| `docs/PROJECT_LAYOUT.md` | `8f156088800e469e6bbf7ac0f012afdb4bf1f190ab4c9161fb3c41d871e04df2` |
+| `target/release/wireguard-admin` | `b383a1f30e776dcce983bb123af6f4e474e71d6b3d28866f3a06ba3c423228b7` |
+
+No dependency, manifest, lockfile, service-adapter or runtime-transport files changed. The release artifact hash identifies the binary built from this integrated source; no deployment occurred.
+
+## Checks on integrated tree
+
+| Command | Result |
+| --- | --- |
+| `cargo test --locked app::` | Exit 0; 67 app tests passed. |
+| `cargo test --locked runtime::` | Exit 0; 25 runtime tests passed. |
+| `cargo test --locked service::` | Exit 0; 26 service tests passed. |
+| `cargo test --locked --test commit_restore` | Exit 0; 9 tests passed. |
+| `cargo test --locked --test runtime_restart` | Exit 0; 3 tests passed. |
+| `cargo fmt --all -- --check` | Exit 0. |
+| `cargo clippy --locked --all-targets -- -D warnings` | Exit 0. |
+| `cargo test --locked` | Exit 0; library 337 passed, 2 ignored; integration and doc tests passed. The selected Alpine tests stayed ignored. |
+| `cargo build --locked --release` | Exit 0. |
+| `git diff --check` | Exit 0. |
+
+## Acceptance mapping and review
+
+- **M25-A1:** `restart.rs` contains the preview, validated preparation, completed pre-restart backup, one-use attempt, optional draft discard, service job, bounded runtime read, full comparison and durable publication in the original order. Cancel preserves draft and performs no backup/job/read. The service deadline is created after backup and shared with observation; both saved generation and attempt ID are checked before persistence.
+- **M25-A2:** Existing app/runtime/service tests cover legacy metadata-free, IPv4-only, subnet-route and missing-IPv4 valid peers; malformed or duplicate identities, incomplete observations, mismatches, service and transport distinctions, shared deadline exhaustion, and post-match persistence failure. `SavedPeerProjection` remains the complete technical target while a management `Snapshot` is optional. Reservations release only after durable verified success.
+- **M25-A3:** `Application::restart` still calls the existing `service::restart_systemd_unit_report` and `runtime::transport::observe_interface` adapters. The fixture apply method and container driver remain `#[cfg(test)]`; no rollback or second restart was introduced. `app` public restart types remain re-exported.
+
+Fresh independent reviewer `/root/m25_review` examined the integrated source and original behavior, verified all five focused suites and Rust gates, and found no actionable source defect. **M25-R1** was the missing specified evidence artifact; the coordinator created this report after independently running all required commands. The reviewer independently rechecked the record and all four hashes and closed M25-R1; no finding remains.
+
+This is host/fixture evidence only. No fresh Alpine Testcontainers scenario or disposable systemd VM test was run, so real systemd/D-Bus and live IPv6 behavior remain unverified. Alpine would not establish systemd behavior. The retired M9 real-system acceptance limitation remains outside M25.