Harden TreeGuard node and circuit identity handling

docs/v2.0/treeguard.md

@@ -86,6 +86,15 @@ When enabled and not dry-run, TreeGuard may persist decisions to:
 
 TreeGuard is designed to avoid fighting operator-owned overrides. If operator overrides exist for enrolled entities, TreeGuard skips those entities and reports warnings.
 
+TreeGuard also refuses to manage nodes that are already marked `"virtual": true` in the base `network.json`. If stale TreeGuard-owned node-virtualization overrides exist for those nodes, TreeGuard clears its own override layer and falls back to the base topology definition.
+
+For circuit SQM management, TreeGuard treats duplicate `device_id` values as unsafe identity collisions. If the same `device_id` appears in more than one circuit in `ShapedDevices.csv`, TreeGuard skips those affected circuits and clears any TreeGuard-owned SQM overrides for those duplicate device IDs.
+
+Recent TreeGuard activity is available in two places:
+
+- The WebUI TreeGuard status/activity views.
+- The `lqosd` journal, where TreeGuard now logs each recorded activity event so reloads, override cleanup, SQM changes, and failures are diagnosable without websocket inspection.
+
 ## Related Pages
 
 - [HTB + fq_codel + CAKE: Detailed Queueing Behavior](htb_fq_codel_cake.md)