chore: update submodule refs, add plan files

.sisyphus/evidence/task-1-nftables-clean.txt

@@ -0,0 +1,19 @@
+table ip nexusguard {
+	chain forward {
+		type filter hook forward priority filter; policy accept;
+		ct state established,related accept comment "fwd_estab"
+		ip saddr 10.172.21.2 ip daddr 10.172.21.0/24 accept comment "peer_gogo2"
+		ip saddr 10.172.21.3 ip daddr 10.172.21.0/24 accept comment "peer_gogo3"
+		ip saddr 10.172.21.0/24 drop comment "wg_isolation_default"
+	}
+}
+
+# Rule counts:
+#   total = 4
+#   peer_ = 2 (peer_gogo2, peer_gogo3)
+#   fwd_estab = 1
+#   wg_isolation_default = 1
+#   duplicates: NONE (verified via `sort | uniq -c`)
+#
+# Rule order: CORRECT (fwd_estab first for fast-path, wg_isolation last for default drop)
+# Persistence: STABLE (no process re-adding rules; verified across 30s window)

.sisyphus/evidence/task-1-wg-gogo2.txt

@@ -0,0 +1,23 @@
+# gogo2 (10.172.21.2) AllowedIPs Evidence
+# Public Key: Akp/KlNcbN3xe6nZ3Icfn/HVJQ4ueRHPIxlQOCUwTwM=
+#
+# === STATE TIMELINE ===
+# BASELINE (before fix):
+#   allowed ips: 10.172.21.0/24  <-- already correct from prior setup
+#
+# AFTER IMMEDIATE FIX:
+#   allowed ips: 10.172.21.0/24  <-- re-set and confirmed
+#
+# === OBSERVATION ===
+# gogo2's AllowedIPs was already set to 10.172.21.0/24 in the baseline.
+# gogo2 has is_active=false in the DB (per inherited wisdom).
+# The server-core sync DOES NOT touch gogo2 (it likely queries only
+# active devices, and gogo2 is excluded).
+#
+# After setting AllowedIPs manually, gogo2 STAYS set across multiple
+# verification cycles (1s, 3s, 10s, 30s).
+#
+# === VERIFICATION COMMANDS ===
+# ssh root@172.20.8.191 'wg show wg0 | grep -A 4 "Akp/KlNcbN3xe6nZ3Icfn/HVJQ4ueRHPIxlQOCUwTwM="'
+# Expected:  allowed ips: 10.172.21.0/24
+# Actual:    allowed ips: 10.172.21.0/24  ✓ STABLE

.sisyphus/evidence/task-1-wg-gogo3.txt

@@ -0,0 +1,30 @@
+# gogo3 (10.172.21.3) AllowedIPs Evidence
+# Public Key: F4M0nSSI7TkdOOb7IDNKLuhu++jvYxJUtF4gwqQAiHY=
+#
+# === STATE TIMELINE ===
+# BASELINE (before fix):
+#   allowed ips: (none)  <-- BUG: even though DB has 10.172.21.0/24
+#
+# AFTER IMMEDIATE FIX (wg set wg0 peer F4M0nSSI7TkdOOb7IDNKLuhu++jvYxJUtF4gwqQAiHY= allowed-ips 10.172.21.0/24):
+#   allowed ips: 10.172.21.0/24  <-- set successfully
+#
+# === REGRESSION DETECTED ===
+# After approximately 10-30s, the server-core process (handshakesync) re-synced
+# the peer list from DB and CLEARED gogo3's AllowedIPs.
+# End state: allowed ips: (none)
+#
+# === ROOT CAUSE ===
+# The server-core process is running with the broken handshakesync.go (per
+# the plan's investigation). When the sync runs, it queries devices with
+# a broken SQL query (anonymous struct → empty table name), gets no results,
+# and re-applies the WireGuard config without gogo3's AllowedIPs.
+#
+# === VERIFICATION COMMANDS ===
+# ssh root@172.20.8.191 'wg show wg0 | grep -A 4 "F4M0nSSI7TkdOOb7IDNKLuhu++jvYxJUtF4gwqQAiHY="'
+# Expected (transient):  allowed ips: 10.172.21.0/24
+# Actual (post-sync):    allowed ips: (none)  <-- cleared by server-core
+#
+# === FIX PATH ===
+# Tasks 2-5 (code fixes) → Task 6 (rebuild) → F1 (final verify)
+# The immediate manual fix is a snapshot only. Permanent fix requires
+# deploying the code changes that fix handshakesync.go SQL.