Enhance documentation and validation for VM lifecycle and network management; add tests for legacy cleanup and address validation.

README.md

@@ -308,6 +308,9 @@ forward rules for return traffic. Guest IPs, gateway, bridge name, and guest
 boot netmask derive from the configured CIDR.
 
 The existing `iptables` egress NAT/forwarding behavior is unchanged. Private
+VM creation and start require an RFC 1918 subnet (`10.0.0.0/8`,
+`172.16.0.0/12`, or `192.168.0.0/16`). Retained VMs prevent incompatible
+gateway, subnet, or bridge changes within the same registry. Private
 port enforcement uses separate per-VM native nftables `bridge` tables, not
 DNAT or host listeners. Policy is installed and read back before an owned TAP
 is activated and before the guest starts. The software bridge must have STP
@@ -325,6 +328,9 @@ There is no autostart service or daemon reconciliation. After externally lost
 or changed UVM rules, inspect policy status and explicitly run `ports sync`.
 Read-only commands do not repair rules; sync does not boot stopped VMs.
 
+Use one authoritative registry per bridge/subnet. Independent `UVM_BASE`
+directories do not coordinate IP or MAC allocation with each other.
+
 ## Persistent State
 
 The default data directory is `/var/lib/uvm`: