# Milestone 14 acceptance evidence: restart with valid legacy peers

Validated 2026-10-27T21:55:11+02:00 on the native
`x86_64-unknown-linux-gnu` development host. Results below use synthetic
saved files, fake service/runtime adapters, and existing pure runtime comparison
tests. They do not establish a real systemd restart.

## Behavior and review

Restart preview and confirmation now use the complete `SavedPeerProjection`
derived from the authoritative saved configuration. It includes every valid
peer's public key and complete normalized `AllowedIPs`, independently of
optional managed alias metadata and the narrower management `Client` shape.
The existing runtime comparator still requires a complete observed peer set
and checks all saved peers and routes before verification can be recorded.
The management applied snapshot remains absent when it cannot represent the
whole saved peer set; no partial `Client` snapshot is marked applied.

Synthetic fixtures cover a saved managed client alongside metadata-free legacy
peers, IPv4-only host routes, and valid subnet routes outside the management
model. Preview preserves server bytes and creates no backup. Fake successful
service completion plus a full runtime match creates the required pre-restart
backup, records verified historical status, and releases deleted-address
reservations only after durable installation. Reopening retains that history,
starts with runtime `Unknown`, and does not regain a partial applied snapshot.
A missing legacy runtime peer leaves reservations durable and runtime unknown.
Malformed AllowedIPs, duplicate public identity, and malformed section headers
block preview before backup/service mutation with a secret-free public identity
or section line and condition. Existing tests also cover backup failure,
service timeout/failure, stale saved generation, runtime mismatch, persistence
failure, draft cancellation and `SaveConfig` rejection.

An independent GPT-6-Luna/high reviewer found no actionable behavior finding.
The first coordinator Clippy gate found M14-R1 (P3), a collapsible diagnostic
guard in `src/app.rs`. A separate GPT-6-Luna/high repairer fixed it; the
reviewer confirmed equivalent logic and closed R1. The final integrated gates
below ran after that repair.

## Commands and source identity

Pinned rustc/Cargo 1.97.1, rustfmt 1.9.0 and Clippy 0.1.97 were verified.
The following commands ran from the repository root and exited 0 on the
integrated revision:

- `cargo test --locked app::tests::`: 57 passed.
- `cargo test --locked --test runtime_restart`: 3 passed.
- `cargo fmt --all -- --check`.
- `cargo clippy --locked --all-targets -- -D warnings`.
- `cargo test --locked`: 357 passed, 3 explicitly ignored, 0 failed,
  including 2 documentation tests.
- `cargo build --locked --release`.
- `git diff --check`.

Base commit: `4bb975f122abfdeabbd04fe6b737eec5706596f5`. Dirty Rust inputs
at validation were `src/app.rs`, `src/domain.rs`, and `tests/runtime_restart.rs`;
`PLANS.md` was dirty with this milestone's execution record. SHA256 inputs:

- `src/app.rs`: `01cf281f5b8ae62877dcf63ece7d51b5cca5522f6bc5c9e99dbc0e718a4121f4`
- `src/domain.rs`: `179ecbe66ad7b6e022233a6da3b62a6ce57d92d26d32b0ae6c750ccd2edc5f01`
- `tests/runtime_restart.rs`: `4cff0de16a18cccc846ace86808840567165fc110d121fd7bdc459481379e05f`

Native release artifact `target/release/wireguard-admin` SHA256:
`a7c946297d2a0140ddcca1c15bb3f651fe6ddc494c2eb7e8e713fdfc700e6b5a`.

No Alpine rerun, disposable systemd VM, or production operation was performed.
The accepted M8 Alpine artifact identity predates this revision; it does not
validate this build. M9's real systemd/D-Bus acceptance remains retired and
unverified.