diff --git a/apps/device-agent b/apps/device-agent
index 833c36e..651da0a 160000
--- a/apps/device-agent
+++ b/apps/device-agent
@@ -1 +1 @@
-Subproject commit 833c36e50b6e6be49d9d3115139dff2de86dfcf4
+Subproject commit 651da0ad33cbb98e137e253b25249ef9e034f167
diff --git a/docker-compose.yml b/docker-compose.yml
index b378077..d46b7cd 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -15,6 +15,11 @@ services:
       timeout: 5s
       retries: 5
     restart: unless-stopped
+    logging:
+      driver: json-file
+      options:
+        max-size: "10m"
+        max-file: "3"
     networks:
       - nexusnet
 
@@ -31,6 +36,11 @@ services:
       timeout: 5s
       retries: 5
     restart: unless-stopped
+    logging:
+      driver: json-file
+      options:
+        max-size: "10m"
+        max-file: "3"
     networks:
       - nexusnet
 
@@ -53,6 +63,11 @@ services:
       - NET_ADMIN
       - NET_RAW
     restart: unless-stopped
+    logging:
+      driver: json-file
+      options:
+        max-size: "10m"
+        max-file: "3"
 
   dashboard-ui:
     build:
@@ -67,6 +82,11 @@ services:
     depends_on:
       - server-core
     restart: unless-stopped
+    logging:
+      driver: json-file
+      options:
+        max-size: "10m"
+        max-file: "3"
     networks:
       - nexusnet
     extra_hosts:
diff --git a/docs/portfolio/README.md b/docs/portfolio/README.md
index 611ae85..479361c 100644
--- a/docs/portfolio/README.md
+++ b/docs/portfolio/README.md
@@ -29,6 +29,19 @@ NexusGuard is a production-grade, zero-trust SD-WAN solution built with Go, Vue
                          └─────────────────┘         └─────────┘
 ```
 
+## Submodule Knowledge Bases
+
+Each submodule has its own `AGENTS.md` with detailed architecture, conventions, and anti-patterns:
+
+| Submodule | AGENTS.md | Scope |
+|-----------|-----------|-------|
+| [Server Core](apps/server-core/) | [AGENTS.md](apps/server-core/AGENTS.md) | API handlers, database models, firewall rules, gRPC signaling, WireGuard management |
+| [Dashboard UI](apps/dashboard-ui/) | [AGENTS.md](apps/dashboard-ui/AGENTS.md) | Vue 3 components, Pinia stores, TailwindCSS styling, API client |
+| [Device Agent](apps/device-agent/) | [AGENTS.md](apps/device-agent/AGENTS.md) | Go daemon, system tray, memory-injected WireGuard, heartbeat, gRPC signaling |
+| [Android Agent](apps/android-agent/) | [AGENTS.md](apps/android-agent/AGENTS.md) | Kotlin VPNService, GoBackend tunnel, HTTP heartbeat, port forwarding |
+
+**Rule**: When working on a submodule, always read its `AGENTS.md` first.
+
 ## Documentation
 
 | Document | Description |
diff --git a/docs/portfolio/architecture.md b/docs/portfolio/architecture.md
index e7a2070..244b8c5 100644
--- a/docs/portfolio/architecture.md
+++ b/docs/portfolio/architecture.md
@@ -107,13 +107,17 @@ Stealth VPN daemon. Cross-platform Go binary.
 ```
 Every 30 seconds:
 1. Agent reads last_handshake_time from WireGuard IPC
-2. Agent computes config_hash = endpoint + internalIP + serverPub
-3. Agent POSTs {config_hash, last_handshake, tunnel_up} to server
-4. Server compares with stored config
-5. If config changed → server responds with new config
-6. Agent detects change → rebuilds tunnel
+2. Agent POSTs {device_id, tunnel_up, last_handshake} to server
+3. Server loads Device + WgServer fresh from DB (dynamic, not cached)
+4. Server computes config_hash = SHA256(tunnelFields) + ":" + SHA256(forwards)
+   - Tunnel fields: server_pub, endpoint, internal_ip, private_key, preshared_key, allowed_ips, dns
+   - Forwards: sorted protocol:publicPort->targetIP:targetPort:ID
+5. Server responds with full config + config_hash
+6. Agent compares config_hash with previous → if different → rebuild tunnel/reload forwards
 ```
 
+> **Design**: Peers (devices) store only their own data (keys, IP, settings). Node data (endpoint, public key) is loaded fresh from DB on every heartbeat. This ensures config always reflects the latest node state without requiring agent restart.
+
 ### Suspend/Resume Flow
 
 ```
diff --git a/docs/portfolio/features.md b/docs/portfolio/features.md
index 790c8b6..154695a 100644
--- a/docs/portfolio/features.md
+++ b/docs/portfolio/features.md
@@ -220,6 +220,15 @@ Device health polled every 10 seconds:
 └─────────────────────────────────────────┘
 ```
 
+### Server-Side Config Sync
+
+Config changes (firewall rules, AllowedIPs, DNS, endpoint) are detected via SHA256 hash comparison:
+
+- Server computes `config_hash = SHA256(tunnelFields) + ":" + SHA256(forwards)`
+- Agent compares with previous hash → if different → tunnel rebuilds automatically
+- Works over both HTTP heartbeat (30s) and gRPC (immediate)
+- Agent never caches config — server loads fresh from DB each heartbeat
+
 ### QR Code Setup
 
 Generate QR codes for mobile WireGuard clients: