feat(diagnostics): add read-only WireGuard health checks

PLANS.md

@@ -267,7 +267,7 @@ Allowed status values: `NOT STARTED`, `IN PROGRESS`, `BLOCKED`, `DONE`.
 | M4        | DONE        | Safe client creation                                 |
 | M5        | DONE        | Client detail, config export, and QR display         |
 | M6        | DONE        | Safe client removal and archival                     |
-| M7        | NOT STARTED | Diagnostics engine and report                        |
+| M7        | DONE        | Diagnostics engine and report                        |
 | M8        | NOT STARTED | Backup listing/restoration and audit log UX          |
 | M9        | NOT STARTED | TUI foundation, dashboard, and read-only screens     |
 | M10       | NOT STARTED | Complete TUI mutation workflows                      |
@@ -1649,6 +1649,20 @@ Use this template:
 - Suggested commit message: `feat(clients): add safe client removal and archival`
 - Next milestone: M7
 
+## 2026-10-13 — M7 — DONE
+
+- Implemented: read-only `diagnose [--quiet]` with stable `OK`, `WARN`, `FAIL`, and `SKIP` records; required-command, configuration and key permission, parser invariant, interface/runtime, systemd, forwarding, IPv4/IPv6 address and route, UDP listener, NAT visibility, disk/runtime peer, and bounded journal checks; plus fixture-controlled mocks and machine-friendly output.
+- Coordinator: `gpt-5.6-sol` (`high`)
+- Subagents: `milestone_worker` / `milestone_repairer`, `gpt-5.6-luna` (`medium`)
+- Repair cycles: 6
+- Sol review: replaced aliased shallow tests and diagnostic stubs; separated independent checks; corrected fresh-process configuration loading, exact command contracts, systemd capability detection, IPv4/IPv6 and UDP parsing, exact NAT evidence, config/key symlink and permission safety, duplicate/overlap classification, disk/runtime AllowedIPs comparison, exit codes, and read-only proof; added regression coverage for every material finding.
+- Verification: `bash -n wg-manager.sh`, `bash -n tests/run.sh`, `bash -n tests/mocks/bin/*`, `bash tests/run.sh diagnostics`, `bash tests/run.sh diagnostics-systemd`, `bash tests/run.sh diagnostics-firewall`, `bash tests/run.sh diagnostics-forwarding`, `bash tests/run.sh diagnostics-runtime-diff`, `bash tests/run.sh diagnostics-read-only`, `bash tests/run.sh diagnostics-exit-codes`, `bash tests/run.sh`, `git diff --check`, permission, scope, command-contract, and secret-pattern review.
+- Result: all required checks passed; diagnostics/systemd/firewall/forwarding/runtime-diff/read-only/exit-code suites passed 20/12/11/14/31/42/43 assertions, and the full regression suite passed 634 assertions. Optional `shellcheck wg-manager.sh tests/*.sh tests/mocks/bin/*` was `SKIP` because ShellCheck is unavailable.
+- Decisions: none
+- Known limitations: real WireGuard, `/etc/wireguard`, networking, systemd, firewall, routes, sysctl, journal, and deployment-server behavior were not accessed or tested; M7 verification is fixture- and mock-based as required. Firewall `OK` confirms only expected NAT evidence visibility, and journal/handshake data is not a complete activity history.
+- Suggested commit message: `feat(diagnostics): add read-only WireGuard health checks`
+- Next milestone: M8
+
 # 8. Final completion rule
 
 The MVP is complete only when: