feat(safety): add atomic WireGuard mutation and rollback engine

README.md

@@ -33,3 +33,17 @@ The explicit peer comment marker is `# wg-manager-client: NAME`; it is only a
 display candidate. A peer is considered managed only when its exact public key
 and configured addresses match a valid metadata record with `MANAGED=1`.
 
+## M3 transaction foundation
+
+The internal `run_transaction OPERATION TARGET BUILDER [METADATA_FILE...]`
+primitive acquires `WG_MANAGER_LOCK_FILE`, then
+reloads and validates the live configuration before calling its builder. It
+creates a restrictive, timestamped backup, validates a same-filesystem staged
+configuration with `wg-quick strip`, replaces the live file atomically, applies
+it with `wg syncconf`, and verifies the active peer set. Apply or verification
+failures restore both disk and runtime; a failed restoration is reported as a
+critical rollback error. No M3 mutation command is exposed yet.
+
+M3 tests use only isolated overrides and deny-by-default command mocks; they do
+not inspect or modify host WireGuard state.
+