Fix systemd unloaded unit

PLANS.md

@@ -124,6 +124,7 @@ Each row is a delivery milestone, not a completion claim. Expand its record befo
 | 12  | Aligned, responsive client table                        | 11                                        | accepted    |
 | 13  | Compact terminal QR disclosure                           | 12                                        | accepted    |
 | 14  | Restart verification for valid legacy peers              | 13                                        | accepted    |
+| 15  | Diagnosable systemd restart and unloaded-unit resolution | 14                                        | accepted    |
 
 ### Milestone 1 — Rust foundation, settings, and domain states
 
@@ -3645,8 +3646,36 @@ and all integrated gates passed. [M14 evidence](docs/evidence/milestone-14.md)
 records source identity and tests. No disposable-VM systemd acceptance or
 production access is claimed; M9 remains retired and unaccepted.
 
+### Milestone 15 — Diagnosable systemd restart and unloaded-unit resolution
+
+Status: accepted (2026-10-27T22:19:58+02:00) for synthetic adapter and application behavior. M14 is accepted; M9 real systemd acceptance remains retired and unaccepted.
+
+#### Outcome and scope
+
+Preserve the service adapter's typed failure through application reporting and readable TUI status, including operation phase and configured unit without raw D-Bus/service text. Resolve existing unloaded units through the documented systemd loading API while preserving alias identity, deadlines, signal ordering, conservative submission status, mandatory backup, explicit confirmation and full runtime verification before durable applied recording.
+
+#### Tasks and acceptance
+
+| Task | Owner | State | Evidence required |
+| --- | --- | --- | --- |
+| M15.1 | implementer | complete for implementation scope | `src/service.rs`, `src/service/dbus.rs`, `src/app.rs`, `src/tui/terminal.rs`, mechanical `src/container_driver.rs`; synthetic tests |
+| M15.2 | independent reviewer; repairer | complete | R1 uncertainty and R2 unloaded-unit test gap repaired and independently re-reviewed |
+| M15.3 | coordinator | complete | Integrated diff, pinned Rust gates and [M15 evidence](docs/evidence/milestone-15.md) |
+
+- [x] M15-A1: every service failure category survives into application report and readable unit/phase TUI status; raw bus/service text is excluded.
+- [x] M15-A2: synthetic API tests exercise the production `LoadUnit` resolution flow for unloaded and aliased units; missing units and access denial stop before restart, with shared deadline and subscription-before-request preserved. Real systemd remains unverified.
+- [x] M15-A3: failures retain conservative submitted/uncertainty flags and never mark applied; backup, confirmation, generation and runtime gates remain intact.
+- [x] M15-A4: independent review closes actionable findings; focused tests and required pinned Rust gates pass. Synthetic evidence and disposable-VM acceptance are reported separately.
+
+Checks: focused service/application/TUI tests; `cargo fmt --all -- --check`; `cargo clippy --locked --all-targets -- -D warnings`; `cargo test --locked`; `cargo build --locked --release`; `git diff --check`. All passed on the repaired Rust inputs. Tests used synthetic fixtures only; no host service or production configuration. Detailed outcomes and identities: [M15 evidence](docs/evidence/milestone-15.md).
+
+#### Outcome and handoff
+
+Accepted for the synthetic adapter and application scope after R1 (owner-change uncertainty) and R2 (unit-resolution test gap) were repaired and independently re-reviewed. Official systemd D-Bus documentation confirms `GetUnit` fails for an unloaded unit and `LoadUnit` loads it from disk if possible; the prior call was a confirmed API mismatch. The cause of the reported host failure and actual systemd acceptance remain unproven without a disposable-VM run. [M15 evidence](docs/evidence/milestone-15.md) records the reviewed source, tests and release artifact.
+
 ## Current progress and resume point
 
+- Milestone 15 is accepted (2026-10-27) for synthetic service-adapter and application behavior: typed failure/phase/unit reporting, documented `LoadUnit` resolution, conservative uncertainty, independent R1/R2 closure and pinned Rust gates. [M15 evidence](docs/evidence/milestone-15.md) records source/artifact identity. Disposable-VM systemd acceptance remains incomplete and unclaimed.
 - Milestone 14 is accepted (2026-10-27) for fixture restart orchestration: complete saved-peer projection, legacy/IPv4-only/broader-route eligibility, safe blockers and durable verified history passed independent review and pinned Rust gates. [M14 evidence](docs/evidence/milestone-14.md) records source/artifact identity. No disposable-VM systemd acceptance or production result is claimed.
 - Milestone 13 is accepted (2026-10-27): compact, explicitly colored QR disclosure, complete quiet zone and dimensioned fallback passed synthetic rendering tests, independent R5 closure and pinned Rust gates. [M13 evidence](docs/evidence/milestone-13.md) records the reviewed source and release artifact. No manual scan, Alpine rerun, VM or production validation is claimed.
 - Bounded TUI maintenance TUI-TS-001 (2026-10-27): new-client form creation timestamps now have whole-second UTC precision before strict metadata rendering. A fixed fractional-second instant and a synthetic blank-IP form-to-draft workflow passed; saved bytes stayed unchanged. Independent review found no actionable issue, and pinned-toolchain Rust completion gates passed. [Timestamp repair evidence](docs/evidence/tui-creation-timestamp.md) identifies the source and release artifact. This repairs M7 behavior without claiming new Alpine or VM validation; earlier artifact identities remain historical after this Rust change.
@@ -3667,7 +3696,7 @@ production access is claimed; M9 remains retired and unaccepted.
 
 - Milestone 8 delivered reviewed opt-in Alpine Testcontainers coverage for real IPv4 WireGuard peers, application lifecycle, saved/runtime separation, restoration, import/reissue, backup failures and the real Rustix reader. Host gates and three fresh real-container runs passed on one stable source fingerprint; M8-A1–A10 accepted. Real IPv6 behavior is unverified by user-authorized scope.
 - Milestone 9 is retired and unaccepted: the reviewed disposable VM preparation and guarded first start did not establish Debian/systemd acceptance. The exact VM was powered off after the user stopped work. M9.2–M9.3 were not started; M9-A1–A9 are unchecked.
-- Next action: await user direction after M14. Do not restart the VM, access production, commit, or deploy.
+- Next action: use a disposable systemd VM if actual D-Bus acceptance is requested; no VM result is claimed here. Do not access production, commit, or deploy.
 
 ## Plan maintenance