Fix subnets validation

tests/config_preservation.rs

@@ -372,6 +372,45 @@ fn unsupported_routes_multiple_addresses_and_ipv6_only_round_trip_but_projection
     }
 }
 
+#[test]
+fn valid_subnet_routes_are_classified_without_changing_source_or_mutation_safety() {
+    let source = format!(
+        "# wg-admin:begin\n# wg-admin:version=1\n# wg-admin:alias=Y2xpZW50\n# wg-admin:end\n[Peer]\nPublicKey = {KEY_A}\nAllowedIPs = 10.9.0.10/32, 192.168.88.0/24, 192.168.8.0/24\n"
+    );
+    let document = ConfigDocument::parse(&source).unwrap();
+    let peer = &document.peers()[0];
+    assert!(peer.has_subnet_routes);
+    assert_eq!(peer.allowed_ips.len(), 3);
+    assert!(peer.issues.iter().any(|issue| matches!(
+        issue,
+        PeerIssue::UnsupportedAllowedIpShape { field: 0, item: 1 }
+    )));
+    assert_eq!(document.render(), source.as_bytes());
+    assert_eq!(
+        document.project_client(&key(KEY_A)),
+        Err(EditError::UnsupportedAddresses)
+    );
+    let renamed = document
+        .rename_client(&key(KEY_A), "alias-only edit remains byte-preserving")
+        .expect("safe alias-only edit remains supported");
+    assert!(
+        String::from_utf8_lossy(renamed.render())
+            .contains("AllowedIPs = 10.9.0.10/32, 192.168.88.0/24, 192.168.8.0/24")
+    );
+
+    let malformed = format!(
+        "[Peer]\nPublicKey = {KEY_A}\nAllowedIPs = 10.9.0.10/32, 192.168.88.0/24, not-an-address\n"
+    );
+    let mixed = ConfigDocument::parse(&malformed).unwrap();
+    assert!(mixed.peers()[0].has_subnet_routes);
+    assert!(
+        mixed.peers()[0]
+            .issues
+            .iter()
+            .any(|issue| matches!(issue, PeerIssue::MalformedAllowedIp { .. }))
+    );
+}
+
 #[test]
 fn parse_errors_debug_and_failed_edits_never_expose_document_secrets() {
     let document = ConfigDocument::parse(FIXTURE).unwrap();