wireguard-admin/docs/evidence/milestone-23.md

Milestone 23 evidence — saved-state Commit, backup, and restore scenarios

Run: 2026-10-29T23:32:25+02:00. Base commit: c1d4f93 (clean at start). Final dirty source inputs are src/app.rs, new src/app/commit.rs, src/app/restore.rs, src/app/backups.rs, and docs/PROJECT_LAYOUT.md. PLANS.md and this report are coordinator records. Reproduce identity with sha256sum:

Input	SHA-256
src/app.rs	9fe74372a68182dc24d7061b4409d3dd6970bc77e3528560da2cacd9d70876b2
src/app/commit.rs	e8af86c36613d91605c81c3dca82fb3d1b3b0dd9b41fdbfeaba9e84984fc091b
src/app/restore.rs	5dd96ee9650ce66e17378eebea2adf18da746264814f0f0d6258a6ebbda651e4
src/app/backups.rs	d837fb0dd29cd3affd9ae12233ecb0337e9a308d730b24a4c892c7bc2605e6ef
docs/PROJECT_LAYOUT.md	c9d873caf3c46d48392e6352b5aed036ce3fdaa471c66b4df8d92994c1a2f5ef
target/release/wireguard-admin	44444967d552bbb7bac2d36423cc943cde2ced783190946aae67f12e0283541e

Native host toolchain: rustc/Cargo 1.97.1, rustfmt 1.9.0, Clippy 0.1.97. Cargo.toml, Cargo.lock, src/persistence.rs, and src/backup.rs have no diff.

Implementation and review

• M23.1 extracted Commit into a private scenario: prepare and validate proposed bytes, parsed document, and next client state; complete a pre-Commit archive of the installed generation; perform journaled install; then publish the prepared in-memory state. A failed install reads back conservatively to retain or revoke session-first-delivery rights. The public Application facade and narrow test callback remain. No service or runtime call is made by Commit.
• M23.2 extracted manual/pre-restart backup listing/creation and previewed restore. Preview is read-only and holds the exact installed generation and selected archive bytes. Confirmation rejects a stale generation before backup, prepares path-compatible settings/document/vault/state, completes a pre-restore archive, performs journaled full replacement, then publishes. An install failure clears session-only delivery rights and reports recovery uncertainty. Absent optional components and archive/historical labels retain their documented semantics. No vault password or runtime call is used.
• The M19 exact-host restore gap is repaired: removed unprojectable peers' exact IPv4 /32 and IPv6 /128 routes are retained as reservations through reopen and allocation. Broad routes are not expanded into guessed addresses.
• Fresh GPT-6-Luna/high reviewer /root/m23_review, separate from implementer /root/m23_commit, found M23-R1: newly carried routes were reserved even when still present in the restored document. GPT-6-Luna/high repairer /root/m23_repair separated archived reservations from carried current/pending addresses and excluded carried exact routes still owned by the restored document. Focused tests cover retained, removed, pending-deletion and archived-reservation cases. Independent re-review closed M23-R1 with no remaining code finding. M23-R2 identified that this evidence file was pending during the first review; it is now present for final verification.

Integrated validation

Exact command	Result
cargo fmt --all -- --check	exit 0
cargo clippy --locked --all-targets -- -D warnings	exit 0
cargo test --locked	exit 0; 404 passed, 3 ignored opt-in Alpine tests, 0 failed, including 2 doctests
cargo build --locked --release	exit 0
git diff --check	exit 0

Focused implementer/repairer/reviewer runs covered cargo test --locked app:: (final 67), cargo test --locked persistence:: (15), cargo test --locked backup:: (8), cargo test --locked --test commit_restore (9), and cargo test --locked --test client_delivery (5), all passed on the final code. The full test command supersedes those focused runs as integrated host evidence. The independent review inspected backup-before-install order, saved-only dependencies, path/generation binding, optional components, secret handling, recovery and preserved formats.

Acceptance scope and limits

M23-A1 is supported by reviewed operation ordering and backup/install/cancel failure tests. M23-A2 is supported by restored settings/path, optional-component, recovery, historical-status and old-archive tests. M23-A3 is supported by fixture old-state backups, compatibility tests, the saved-only dependency audit, independent re-review and required Rust gates. This is host/synthetic evidence. No opt-in Alpine or disposable systemd VM run was made for M23; no real systemd, live VPN, production or IPv6 integration behavior is claimed. M9 remains retired/unaccepted.