Fix subnets validation

docs/evidence/milestone-11.md

@@ -0,0 +1,62 @@
+# Milestone 11 acceptance evidence
+
+Run: 2026-10-26T21:20:07Z, local development workspace. This report covers
+presentation of valid but unsupported peer `AllowedIPs` shapes. It does not
+establish runtime WireGuard, Alpine or systemd behavior.
+
+## Source and environment
+
+- HEAD `18f28eef02d6a9f94a1d34ad94e25079ebf125a2`; the working tree was
+  dirty with `PLANS.md`, `src/app.rs`, `src/tui/render.rs`,
+  `src/tui/terminal.rs`, and `tests/config_preservation.rs`. An external
+  workspace actor created HEAD during implementation; this team created no
+  commit. The integrated inputs at the gates have SHA-256 values:
+  `app.rs` `75935d694d85cad11511ffbcff093cc7ebded08f02eb26589cb552fdbe1c7720`;
+  `document.rs` `af4fed6c25fe4b801112d19fe4867ed809c6a05e68492c3a53cc4829ac3b766b`;
+  `render.rs` `2f673febaba9e6f0ada1c274f33c0db02fe78fd2bca50310b1215d5a22dd8c9f`;
+  `terminal.rs` `ed9a99932dddbaf508667c5f17886704bda749264c53cc60c7e29b889a56e074`;
+  `config_preservation.rs` `0cdac39ac6ac370aaa85ea13610cb00f778a7efc559a39896212d96c6147f0b0`;
+  `Cargo.lock` `b8549df27f971dc550218cfc28e788f6630a1e13e7df538aded38e969ab713b6`.
+- `rustc 1.97.1 (8bab26f4f 2026-07-14)`; `cargo 1.97.1
+  (c980f4866 2026-06-30)`. Synthetic fixtures and Ratatui TestBackend only;
+  no production, Docker, VM or live VPN action.
+
+## Checks and scope
+
+| Exact command | Result |
+| --- | --- |
+| `cargo test --locked valid_subnet_routes_are_classified_without_changing_source_or_mutation_safety` | Exit 0; focused config preservation test passed. |
+| `cargo test --locked tui::render::tests::client_rows_show_draft_state_and_escape_anomalous_unsupported_peers` | Exit 0; focused list/details test passed. |
+| `cargo test --locked --lib issues_screen_hides_valid_address_shape_limits_but_keeps_genuine_errors` | Exit 0; focused issue-screen test passed after repair. |
+| `cargo test --locked --test config_preservation` | Exit 0; 10 tests passed. |
+| `cargo fmt --all -- --check` | Exit 0. |
+| `cargo clippy --locked --all-targets -- -D warnings` | Exit 0. |
+| `cargo test --locked` | Exit 0; 272 library tests passed, 2 opt-in drivers ignored; integration and 2 compile-fail doctests passed. Testcontainers target reported 25 passed and 1 ignored without starting Alpine. |
+| `cargo build --locked --release` | Exit 0. |
+| `git diff --check` | Exit 0. |
+
+The parser preserves the valid example's original source and all three routes.
+The application leaves its raw peer issues and unsupported projection intact;
+the TUI presents parsed-valid address-shape limitations separately from
+malformed input. The list and issue screen omit capability-only diagnostics;
+details show the exact subnet explanation. Tests also cover a normal supported
+client, extra host routes, IPv6-only shape, mixed malformed route, and existing
+broad-route deletion safety. Alias-only rename of an unprojectable peer retains
+its existing behavior and preserves routes. The TUI still blocks normal client
+mutations for unprojectable peers.
+
+## Review and decision
+
+Fresh independent review initially raised M11-R1, treating a second distinct
+`/32` host route as a configuration error. After checking the WireGuard
+[`wg(8)` AllowedIPs format](https://man7.org/linux/man-pages/man8/wg.8.html),
+the reviewer withdrew R1: a valid additional host route is another model
+capability limitation. The coordinator raised M11-R2 because non-subnet valid
+address shapes were still displayed as anomalies. A repairer classified the
+two parsed-valid shape variants consistently for presentation, kept all raw
+issues for safety, and added regressions. Independent re-review reported no
+remaining actionable finding. A1–A4 passed within source/fixture scope; the
+integrated gates above satisfy A5.
+
+No real WireGuard or systemd behavior was exercised. Milestone 9 remains
+retired and unaccepted; real systemd/D-Bus and IPv6 capability are unverified.