# gogo3 (10.172.21.3) AllowedIPs Evidence
# Public Key: F4M0nSSI7TkdOOb7IDNKLuhu++jvYxJUtF4gwqQAiHY=
#
# === STATE TIMELINE ===
# BASELINE (before fix):
#   allowed ips: (none)  <-- BUG: even though DB has 10.172.21.0/24
#
# AFTER IMMEDIATE FIX (wg set wg0 peer F4M0nSSI7TkdOOb7IDNKLuhu++jvYxJUtF4gwqQAiHY= allowed-ips 10.172.21.0/24):
#   allowed ips: 10.172.21.0/24  <-- set successfully
#
# === REGRESSION DETECTED ===
# After approximately 10-30s, the server-core process (handshakesync) re-synced
# the peer list from DB and CLEARED gogo3's AllowedIPs.
# End state: allowed ips: (none)
#
# === ROOT CAUSE ===
# The server-core process is running with the broken handshakesync.go (per
# the plan's investigation). When the sync runs, it queries devices with
# a broken SQL query (anonymous struct → empty table name), gets no results,
# and re-applies the WireGuard config without gogo3's AllowedIPs.
#
# === VERIFICATION COMMANDS ===
# ssh root@172.20.8.191 'wg show wg0 | grep -A 4 "F4M0nSSI7TkdOOb7IDNKLuhu++jvYxJUtF4gwqQAiHY="'
# Expected (transient):  allowed ips: 10.172.21.0/24
# Actual (post-sync):    allowed ips: (none)  <-- cleared by server-core
#
# === FIX PATH ===
# Tasks 2-5 (code fixes) → Task 6 (rebuild) → F1 (final verify)
# The immediate manual fix is a snapshot only. Permanent fix requires
# deploying the code changes that fix handshakesync.go SQL.