wireguard-admin/docs/evidence/milestone-25.md

Milestone 25 evidence — explicit restart verification scenario

Run date: 2026-10-30T21:35:10+02:00. Baseline commit: 7cef400; the working tree has uncommitted M25 changes in src/app.rs, new src/app/restart.rs, and docs/PROJECT_LAYOUT.md, plus coordinator-owned PLANS.md. Rust/Cargo: 1.97.1, native host target. Tests used synthetic fixtures/adapters only. No production configuration, keys, VPN, host service, Docker environment, or VM was accessed.

Integrated inputs

Input	SHA-256
src/app.rs	784001013f90d9bbdb1579cf3c6672a27dd34dc0e295d3e6ea3f70d53d05c586
src/app/restart.rs	fb724054faec6adf1b58a31800a2a636307b2620ac3d980309638ad508a00fa3
docs/PROJECT_LAYOUT.md	8f156088800e469e6bbf7ac0f012afdb4bf1f190ab4c9161fb3c41d871e04df2
target/release/wireguard-admin	b383a1f30e776dcce983bb123af6f4e474e71d6b3d28866f3a06ba3c423228b7

No dependency, manifest, lockfile, service-adapter or runtime-transport files changed. The release artifact hash identifies the binary built from this integrated source; no deployment occurred.

Checks on integrated tree

Command	Result
cargo test --locked app::	Exit 0; 67 app tests passed.
cargo test --locked runtime::	Exit 0; 25 runtime tests passed.
cargo test --locked service::	Exit 0; 26 service tests passed.
cargo test --locked --test commit_restore	Exit 0; 9 tests passed.
cargo test --locked --test runtime_restart	Exit 0; 3 tests passed.
cargo fmt --all -- --check	Exit 0.
cargo clippy --locked --all-targets -- -D warnings	Exit 0.
cargo test --locked	Exit 0; library 337 passed, 2 ignored; integration and doc tests passed. The selected Alpine tests stayed ignored.
cargo build --locked --release	Exit 0.
git diff --check	Exit 0.

Acceptance mapping and review

• M25-A1: restart.rs contains the preview, validated preparation, completed pre-restart backup, one-use attempt, optional draft discard, service job, bounded runtime read, full comparison and durable publication in the original order. Cancel preserves draft and performs no backup/job/read. The service deadline is created after backup and shared with observation; both saved generation and attempt ID are checked before persistence.
• M25-A2: Existing app/runtime/service tests cover legacy metadata-free, IPv4-only, subnet-route and missing-IPv4 valid peers; malformed or duplicate identities, incomplete observations, mismatches, service and transport distinctions, shared deadline exhaustion, and post-match persistence failure. SavedPeerProjection remains the complete technical target while a management Snapshot is optional. Reservations release only after durable verified success.
• M25-A3: Application::restart still calls the existing service::restart_systemd_unit_report and runtime::transport::observe_interface adapters. The fixture apply method and container driver remain #[cfg(test)]; no rollback or second restart was introduced. app public restart types remain re-exported.

Fresh independent reviewer /root/m25_review examined the integrated source and original behavior, verified all five focused suites and Rust gates, and found no actionable source defect. M25-R1 was the missing specified evidence artifact; the coordinator created this report after independently running all required commands. The reviewer independently rechecked the record and all four hashes and closed M25-R1; no finding remains.

This is host/fixture evidence only. No fresh Alpine Testcontainers scenario or disposable systemd VM test was run, so real systemd/D-Bus and live IPv6 behavior remain unverified. Alpine would not establish systemd behavior. The retired M9 real-system acceptance limitation remains outside M25.