diff --git a/AGENTS.md b/AGENTS.md
index 83fc9b9..c6c2795 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -158,11 +158,12 @@ HTTP + gRPC share port 8080 via `cmux`:
 
 ## ANTI-PATTERNS (THIS PROJECT)
 - **NEVER** `nft flush table` — only atomic add/remove
-- **NEVER** commit temp/debug/test files (`nft-fix.sh`, `temp_*.txt` etc) in project root; use `./tests` folder
+- **NEVER** commit temp/debug/test files (`nft-fix.sh`, `temp_*.txt` etc) in project root; use `.tests/` folder
 - **NEVER** log plaintext or encryption keys
 - **NEVER** reopen completed phases/commits — fix forward only
 - **NEVER** rebuild `shared/crypto/encryptor.go` — copy identical file
-- **NEVER** commit build artifacts (binaries, `dist/`)
+- **NEVER** commit build artifacts (binaries, `dist/`, APK, `.apk`, `.aab`)
+- **NEVER** leave temp/debug/test outputs in project root — all must go in `.tests/` folder
 - **NEVER** force push
 - **NEVER** create cross-phase workarounds
 
@@ -198,6 +199,15 @@ if d.AllowInternet {
 // Do NOT override with EndpointAllowedIPs here
 ```
 
+### Client-side AllowedIPs resolution (`Device.ResolveAllowedIPs()`)
+Centralized in `internal/models/models.go`. Used by `buildConfigUpdate()`, heartbeat, and provisioning.
+Priority chain:
+1. `AllowInternet` → `0.0.0.0/0`
+2. `EndpointAllowedIPs` (if set) → use as-is
+3. Fallback → compose `IPPoolCIDR, serverWGIP/32` (e.g. `10.172.21.0/24,10.172.21.1/32`)
+
+**Never** use `InternalIP/32` as client-side AllowedIPs — that value is server-side WireGuard kernel routing only.
+
 ### Database field: `endpoint_allowed_ips`
 - Used for **client config** and **firewall rules**
 - NOT used for server-side WireGuard kernel config
diff --git a/apps/android-agent b/apps/android-agent
index b4b4558..7825165 160000
--- a/apps/android-agent
+++ b/apps/android-agent
@@ -1 +1 @@
-Subproject commit b4b4558200bffb76aba577b7846f32264eb3cc33
+Subproject commit 78251651bacc948d3398786d5379add1dfe629d7
diff --git a/apps/server-core b/apps/server-core
index b6dea53..b9cf1e8 160000
--- a/apps/server-core
+++ b/apps/server-core
@@ -1 +1 @@
-Subproject commit b6dea53f29732113a215751dfd577fab53cd7cd0
+Subproject commit b9cf1e8bae0ea15d4e0daa8905f7a4045d881ef0