[Tim55667757]

Native WireGuard completion must preserve the actual unrelated AWG/VLESS services, rather than accepting source hashes supplied by a request. Add a concrete private observer that binds complete retained server bundles before I/O, acquires existing AWG then VLESS shared locks after common/WG coordination, and retains file, enable-link and process identities through two live observations and immutable completion publication.

AWG verifies credentials, peers, configured parameters, address/MTU/forwarding and the complete native nft policy against the retained firewall compiled in a fresh transient network namespace. VLESS verifies owned runtime/upgrade receipts, exact daemon PID/executable/arguments/cgroup and its actual systemd loaded credential, including the dynamic-UID read ACL, plus ownership of the TCP listener. Source-bound absence requires existing coordination and complete native namespace/listener absence; unloaded unit overrides and unexplained entries refuse. Legacy owner algorithms, installers, keys and service files remain unchanged. Historical completion replay skips live leases.

Continues #128; does not close it. These are configuration/service preservation probes; no traffic or YouTube acceptance is claimed. Protocol RPC, controller and public CLI integration remain separate work. No desktop VPN, WSL, production guest/cloud or local network operations were performed.

Validation on exact head c1cea21:

• Canonical Linux gate: compileall, naming, Ruff, mypy (83 files), 3733 passed / 9 skipped; coverage 90.21%.
• Strict installed-wheel EN/RU/ZH documentation: 99 tests passed; 444 approved generated units per locale.
• Reproducible installed artifacts: wheel/sdist audit passed, reproducible=true, 5 installed tests passed.

Added 71 deterministic cases, including 45 portable source/AWG/credential-ACL codec checks, actual POSIX ownership/proc/loaded-credential/lease drift cases, exact observer lifetime checks, and real retained AWG nft echo/list conformance in an ephemeral namespace. All new POSIX cases ran in Linux CI. Canonical ADR/engineering and reviewed RU/ZH catalogs updated; upstream decisions link to pinned primary sources. Independent exact-head AI static review found no remaining actionable issues; see its review COMMENT.

[Tim55667757]

Independent AI static review completed for exact head c1cea21 against 0548e74. All reported findings are resolved: compare live nft to the exact retained firewall compiled in an isolated namespace; reject unconfigured AWG timing/security overrides; verify the daemon's actual loaded systemd credential, process identity and PID-attributed listener; reject unloaded owner-unit drop-ins. Legacy AWG/VLESS owner derivations are preserved. The reviewer found no remaining actionable findings, and EN/RU/ZH semantics plus all four provenance pairs agree. Static review did not execute tests; approval remains conditional on all three exact-head CI gates succeeding. This COMMENT records independent AI review and does not impersonate a human APPROVE. Configuration/service probes do not establish client traffic or media playback health.

[Tim55667757]

Reviewed