wireguard-admin/docs/evidence/milestone-26.md

Milestone 26 evidence — application read model and TUI command adapter

Run date: 2026-10-30T22:59:07+02:00. Baseline commit: 9a143e9; the working tree contains uncommitted M26 source, test and layout changes below, plus coordinator-owned PLANS.md. Rust/Cargo: 1.97.1, native host target. Tests used synthetic fixtures, buffer rendering and PTY workflows only. No production configuration, keys, VPN, host service, Docker environment or VM was accessed.

Integrated inputs

Input	SHA-256
src/app.rs	5aeab061f45a75f3b4f4ec41b078cbecce3cbdd5a49ec2c47c0a98f062747023
src/app/read_model.rs	92a1945ca0ad0d4f6dc7aad255643d3d515712a1750c466738d29655f69d282d
src/app/first_delivery.rs	b9e80c7802b083f0ffa6e1e99898e9be9459e9eb9f3ea415b00e5592020a6ef3
src/tui/state.rs	da429e61bf918bf8524b7d131bc553460eb260f76f39d3763824e399764dcfac
src/tui/terminal.rs	9131ef9ae1e4d6f8a84715cdcdfcdd528262930dc95834991916484ff5ce4e21
src/tui/render.rs	3fa3b6496b792f3d7d3db16405a847c91736f2e975e5dba892d6921ca367df19
src/tui/events.rs	114c9505e69a1e9ec0782b149daf2ff9dcdc1a29af99abdb28df91fee70b758c
src/tui/events/executor.rs	4a46a8b03b1f708ab89d2e50ceceb60674c30e3bc1bcbb4c87af93b57815cd57
tests/tui_workflow.rs	8050c2e7887366ca6145c62fa8ded25b9dcd36f01062afa85ce85518ce64733f
docs/PROJECT_LAYOUT.md	06b83f3c0a26de4a7c3f8ccbaf1d37a697afb17cf67c297b69326018d144262c
target/release/wireguard-admin	70b45b51e2e345e1d914b1196355fde9f5688f123bed47332690d56752ca5cbe

No dependency, manifest or lockfile changed. The release artifact hash identifies the binary built from this integrated source; no deployment occurred.

Checks on integrated tree

Command	Result
cargo test --locked app::	Exit 0; 74 app tests passed.
cargo test --locked tui::	Exit 0; 88 TUI tests passed.
cargo test --locked --test tui_workflow	Exit 0; 9 tests passed.
cargo test --locked --test client_delivery	Exit 0; 5 tests passed.
cargo fmt --all -- --check	Exit 0.
cargo clippy --locked --all-targets -- -D warnings	Exit 0.
cargo test --locked	Exit 0; library 352 passed, 2 ignored; integration and doc tests passed. Opt-in Alpine scenarios stayed ignored.
cargo build --locked --release	Exit 0.
git diff --check	Exit 0.

Acceptance mapping and review

• M26-A1: Application::read_model owns the secret-free peer rows, saved peer count, draft/saved public client changes, issue classes, reservations, applied knowledge, vault/draft flags and per-action eligibility. SessionView::from_application consumes those facts and maps them into compatibility UI fields without accessing saved server bytes or ClientStates. Malformed, duplicate and no-key draft peer rows remain available for inspection, and removed saved peers outside manageable ClientStates remain visible.
• M26-A2: Selection binds action presentation to public identity and peer index. App eligibility separates rename, deletion, first delivery, reissue and restart; execution still checks its own preconditions. Exact-host-route deletion remains available even for a peer outside the manageable client projection, and the removed row is inspection-only. First-delivery session availability is queried without secret disclosure. Unrelated saved-document issues do not suppress a valid selected reissue; selected-peer issues and vault conflicts do.
• M26-A3: TUI, workflow and delivery suites cover worker generations, stale continuations and statistics, shutdown, QR, selection, list/help/footer buffers and synthetic PTY behavior. Existing dimensioned tests include 34x8, 40x9, 60x16, 80x24, 100x30 and 180x50 cases. No assertions were weakened to pass the refactor.
• M26-A4: src/tui/events/executor.rs owns command adaptation and prepared destination/restore contexts; events.rs keeps the single-owner worker queue and generation lifecycle. docs/PROJECT_LAYOUT.md matches the integrated modules. Broader terminal/render splitting was deferred because it would broaden visibility across shared lifecycle and layout helpers without a cohesive ownership gain in M26.

Fresh independent reviewer /root/m26_review reviewed the integrated diff. M26-R1 (removed unprojectable peer omitted) and M26-R2 (unrelated issue overblocked reissue) were fixed by repairer /root/m26_repair. Coordinator found M26-R3 (false Removed row for unchanged saved client) in the repair; it was fixed with a one-row regression. Reviewer found M26-R4 (reissue shown for selected capability-issue peer); the repair aligned eligibility with delivery validation and added a failing-before/passing-after regression. The reviewer independently re-reviewed and closed R1–R4 with no remaining source finding, then verified all 11 evidence hashes, reran the full test suite, app tests and release build, and found no evidence issue.

This is host/synthetic evidence only. No fresh Alpine Testcontainers scenario or disposable systemd VM test was run; prior Alpine results do not identify this M26 source, and Alpine does not prove systemd behavior. Real systemd/D-Bus and live IPv6 behavior remain unverified. The retired M9 real-system limitation remains outside M26.