wireguard-admin/docs/evidence/milestone-21.md

Milestone 21 evidence — domain reservations and apply knowledge

Run: 2026-10-29T23:00:09+02:00. Base commit: 8413b382b178991d2e1e597f1422d147f3454581 (clean at start). Final dirty source inputs: src/domain.rs, src/app.rs, and docs/PROJECT_LAYOUT.md; PLANS.md and this evidence record are coordinator documentation. git diff -- src/domain.rs src/app.rs docs/PROJECT_LAYOUT.md | sha256sum returned d9056e1fd05db2425a127ac57f906333ae311bdb0f3cce13b9153f39c041c982. target/release/wireguard-admin SHA-256: 60b3ad8b9c1bf2750239d3500b319cf42e5581fe027e5b6e39c8ff4115feb024. Cargo.toml and Cargo.lock have no diff. Rust and Cargo: 1.97.1, pinned toolchain.

Implementation and invariant evidence

• M21.1: AddressReservations owns private committed and draft-only pending host-address sets. Staging validates the entire exact /32 or /128 route list before mutation. The allocator sees both sets. Draft discard drops pending addresses; successful Commit promotes pending and retains addresses removed from the prior manageable saved snapshot. Persisted restoration is crate-scoped and rejects saved-client conflicts. No serialization field or version changed.
• M21.2: private ApplyKnowledge owns current runtime status and optional complete last-verified management snapshot. Historical verification remains separate in persisted application history. Session open resets current knowledge to Unknown; technical verification may publish Verified with no complete management snapshot. The restart scenario prepares a cloned verified candidate, then publishes it only after internal-state installation succeeds. Only that verified transition releases committed reservations. Backup, service, read, mismatch and persistence failure paths retain reservations.
• M21-R1: independent review found unconditional Commit demotion of Verified and Unavailable on unchanged saved client snapshots. The repair removed the extra application call; the domain Commit transition still demotes Verified when the saved management snapshot changes. Three behavioral app tests cover unchanged Verified, unchanged Unavailable, and changed Verified. The same independent reviewer re-reviewed the repair and full affected reservation/apply paths, closed M21-R1, and reported no remaining actionable finding.

Validation on integrated source

Check	Result
cargo fmt --all -- --check	exit 0
cargo clippy --locked --all-targets -- -D warnings	exit 0
cargo test --locked	exit 0; 399 passed, 3 ignored (opt-in Alpine drivers), 0 failed, including 2 doctests
cargo build --locked --release	exit 0
git diff --check	exit 0

Focused implementation, repair and review runs covered domain::, persistence::, app::, --test commit_restore, and --test runtime_restart; the final full test command supersedes those focused source results. The independent reviewer specifically inspected reservation mutation/release callers, pending/committed timing, exact-host policy, unchanged/changed Commit behavior, reopen/current versus historical state, legacy technical matching without a management snapshot, and failed verified publication.

Scope and acceptance

M21-A1: passed by reviewed transition callers and synthetic failure-path tests. M21-A2: passed by legacy/reopen/history tests and the M21-R1 behavioral repair. M21-A3: passed by allocator, reservation, persistence and application tests, independent re-review and all required Rust gates. Evidence is host/synthetic. The opt-in Alpine suites and disposable systemd VM were not run for M21, and no real systemd, live VPN, production or IPv6 integration result is claimed. M9 remains retired/unaccepted. The previously recorded unprojectable-peer restore reservation gap belongs to M23 and is not represented as resolved here.