feat(tui): add safe client and backup workflows

PLANS.md

@@ -270,7 +270,7 @@ Allowed status values: `NOT STARTED`, `IN PROGRESS`, `BLOCKED`, `DONE`.
 | M7        | DONE        | Diagnostics engine and report                        |
 | M8        | DONE        | Backup listing/restoration and audit log UX          |
 | M9        | DONE        | TUI foundation, dashboard, and read-only screens     |
-| M10       | NOT STARTED | Complete TUI mutation workflows                      |
+| M10       | DONE        | Complete TUI mutation workflows                      |
 | M11       | NOT STARTED | Hardening, documentation, and MVP acceptance         |
 
 ---
@@ -1691,6 +1691,20 @@ Use this template:
 - Suggested commit message: `feat(tui): add gum dashboard and read-only workflows`
 - Next milestone: M10
 
+## 2026-10-14 — M10 — DONE
+
+- Implemented: shared-backend `gum` workflows for full- and split-tunnel client creation, exact managed-client actions and archival removal, explicit config and QR confirmation, manual backup, validated deliberate restore, bounded backend failures, and immediate nonzero exit after critical rollback failure; added custom split-network CLI support needed by the TUI.
+- Coordinator: senior Sol coordinator
+- Subagents: `milestone_worker` / `milestone_repairer`, `gpt-5.6-luna` (`medium`)
+- Repair cycles: 15
+- Sol review: replaced aliased and stubbed M10 coverage with real isolated backend scenarios; fixed exact-identity revalidation, archive-result transport from transaction subshells, QR status loss and missing-dependency fallback, overlong destructive prompts, invalid failed-audit categories, fixture runtime sequencing and cross-group contamination, secret-bearing output boundaries, and critical rollback propagation; every material finding received regression coverage.
+- Verification: `bash -n wg-manager.sh tests/run.sh tests/mocks/bin/gum`, `bash tests/run.sh tui-add`, `bash tests/run.sh tui-remove`, `bash tests/run.sh tui-client-actions`, `bash tests/run.sh tui-backup`, `bash tests/run.sh tui-restore`, `bash tests/run.sh tui-backend-failure`, `bash tests/run.sh tui-no-secret-args`, `bash tests/run.sh remove-rollback`, `bash tests/run.sh restore-rollback`, `bash tests/run.sh`, `git diff --check`, full changed-file, permission, rollback, audit, and secret-pattern review.
+- Result: all required checks passed; tui-add/tui-remove/tui-client-actions/tui-backup/tui-restore/tui-backend-failure/tui-no-secret-args passed 52/40/28/6/20/9/11 assertions, and the full regression suite passed 947 assertions. Optional ShellCheck and real-`gum` interactive smoke were `SKIP` because neither ShellCheck nor a usable production `gum` environment is available.
+- Decisions: none
+- Known limitations: real WireGuard, `/etc/wireguard`, networking, systemd, firewall, routes, sysctl, journal, and production terminal state were not accessed; M10 verification is fixture- and mock-based as required.
+- Suggested commit message: `feat(tui): add safe client and backup workflows`
+- Next milestone: M11
+
 # 8. Final completion rule
 
 The MVP is complete only when: