docs: distinguish historical safeguard validation from current test limits

Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>

2 files changed, 24 insertions, 1 deletions

diff --git a/docs/ng40-safeguards-review.md b/docs/ng40-safeguards-review.md
index 592869c6..8dfbe32e 100644
--- a/docs/ng40-safeguards-review.md
+++ b/docs/ng40-safeguards-review.md
@@ -95,7 +95,8 @@ fixes and this integration are by **Denys Fedoryshchenko**.
 
 ## Validation
 
-Run from the repository root:
+The following commands and results record validation when these safeguards
+were integrated. Run the commands from the repository root at that revision:
 
 ```sh
 cmake -S . -B /tmp/accel-ppp-ng40-build -DCMAKE_BUILD_TYPE=Debug \
@@ -105,6 +106,12 @@ sh tests/unit/run_safeguards.sh /tmp/accel-ppp-ng40-build
 git diff --check
 ```
 
+For current checkouts, see the [focused unit test instructions](../tests/README.md#focused-unit-tests).
+The later IPv6 DNS storage refactor removed `conf_dns_count`, which the
+DHCPv6 fixture still references, and the runner needs to link `ipv6_dns.c`.
+The full command above therefore does not currently compile on master. The
+historical results below do not establish that the current full suite passes.
+
 Build, the existing IPv6 DNS selection test, and five standalone suites passed. Tests compile production code with
 small external-service stubs. DHCPv6, RADIUS, VRF, and pool tests use ASan,
 UBSan, and LeakSanitizer; the LCP test uses UBSan (ASan's global registration
diff --git a/tests/README.md b/tests/README.md
index 566d760c..870cf8c8 100644
--- a/tests/README.md
+++ b/tests/README.md
@@ -15,6 +15,22 @@ sh tests/unit/run_safeguards.sh build log_line
 These tests do not require installed kernel modules or root privileges. The
 sanitizer runtime needs an environment that permits its process inspection.
 
+The runner has six suites: `dhcpv6`, `radius`, `vrf`, `lcp`, `mempool`, and
+`log_line`. With no names it attempts all six. The DHCPv6 fixture currently
+refers to the removed `conf_dns_count` variable, and the runner does not link
+the `ipv6_dns.c` implementation now used by the reply builder. That fixture
+and its build command must be updated before a full run can pass.
+
+The other five suites can be run explicitly while that regression is being fixed:
+
+```bash
+sh tests/unit/run_safeguards.sh build radius vrf lcp mempool log_line
+```
+
+A successful subset run does not validate the DHCPv6 safeguards. The
+[integration validation record](../docs/ng40-safeguards-review.md#validation)
+describes results from the revision at which those safeguards were introduced.
+
 ## Kernel module installation test
 
 The kernel module installation regression test is rootless and does not need