diff --git a/AGENTS.md b/AGENTS.md
index 81bdc75..c88ee34 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -13,7 +13,7 @@ NexusGuard SD-WAN Suite — Enterprise Zero-Trust SD-WAN with WireGuard tunnelin
 ├── apps/
 │   ├── server-core/    # Go/Gin API backend (submodule)
 │   ├── dashboard-ui/   # Vue 3 + Vite frontend (submodule)
-│   └── device-agent/   # Go stealth daemon (submodule)
+│   └── device-agent/   # Go stealth daemon + system tray (submodule)
 ├── docker-compose.yml  # Production orchestration
 ├── docker-compose.dev.yml  # Dev (air hot-reload)
 ├── Makefile            # up/down/dev/migrate/reset-db
@@ -50,7 +50,10 @@ NexusGuard SD-WAN Suite — Enterprise Zero-Trust SD-WAN with WireGuard tunnelin
 | Symbol | Type | Location | Role |
 |--------|------|----------|------|
 | `main()` (server-core) | func | `apps/server-core/main.go` | Entry: CLI flags + Gin init |
-| `main()` (device-agent) | func | `apps/device-agent/main.go` | Entry: agent daemon lifecycle |
+| `main()` (device-agent) | func | `apps/device-agent/main.go` | Entry: systray + agent daemon lifecycle |
+| `onReady()` / `onExit()` | func | `apps/device-agent/main.go` | System tray setup and cleanup |
+| `startAgent()` / `stopAgent()` | func | `apps/device-agent/main.go` | Agent connect/disconnect lifecycle |
+| `generateIcon()` | func | `apps/device-agent/icon.go` | 16x16 shield icon for tray |
 | `config.Load()` | func | `apps/server-core/internal/config/` | Env-based config loader |
 | `config.LoadConfFile()` | func | `apps/server-core/internal/config/config_loader.go` | Config file parser (.env / nexusguard.conf) |
 | `auth.Init()` | func | `apps/server-core/internal/auth/` | JWT sign/verify init |
diff --git a/apps/server-core b/apps/server-core
index f9766cd..efea4bf 160000
--- a/apps/server-core
+++ b/apps/server-core
@@ -1 +1 @@
-Subproject commit f9766cdad63ba53a87d79be9661b1264fa4dbdd8
+Subproject commit efea4bf2ea2b19615e011bb46f9e9eaaa9ca3f40