hub: S1 wgsync (pinned-SSH push + declarative reconciler) + /admin/wg API + env wiring

internal/wgsync: x/crypto/ssh client with ssh.FixedHostKey pin (no insecure
fallback), forced-command exec, ok/applied response contract; Reconciler pushes
the FULL peer list on Trigger or 5-min tick (drift repair by construction).
internal/api/wg.go: PUT/GET /admin/wg/endpoint + POST/DELETE/GET /admin/wg/peers,
global-key-only, pubkey in body (base64 vs URL), sync ok|deferred|disabled.
main.go: WG_ENDPOINT_SSH_* env wiring, disabled-with-INFO when unconfigured.
Groups B/C/D tests incl. in-process SSH server; red-proofs b/c/d run + reverted.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

hub/internal/wgsync/client.go

@@ -0,0 +1,132 @@
+// Package wgsync pushes the hub's WG peer registry to the offsite endpoint (S1, doc 06 §5).
+// It is the structural sibling of internal/cloudflare: the hub holds the credential and drives
+// external infra; the endpoint stays a dumb, runbook-provisioned box. Transport is SSH with a
+// PINNED host key (the internal/pbs pin posture — exact-match or refuse; there is no insecure
+// fallback), to a forced-command reconcile script server-side, so even this credential's theft
+// bounds the attacker to "mutate the peer list" (doc 06 §3.1 blast radius).
+package wgsync
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"log"
+	"net"
+	"strings"
+	"time"
+
+	"golang.org/x/crypto/ssh"
+)
+
+// Config configures the SSH push client. All values come from the deployment env / mounted
+// Secret (operator infra — never from a customer record).
+type Config struct {
+	Addr        string        // "host:22"
+	User        string        // "felhom-peersync"
+	PrivateKey  []byte        // PEM private key (from the mounted Secret file)
+	HostKeyLine string        // single authorized_keys-format line of the endpoint's host pubkey
+	Timeout     time.Duration // default 30s
+}
+
+// Client is a pinned-host-key SSH pusher. Construct with New (parses keys up front).
+type Client struct {
+	addr    string
+	user    string
+	signer  ssh.Signer
+	hostKey ssh.PublicKey
+	timeout time.Duration
+	logger  *log.Logger
+}
+
+// New builds a Client, failing early on an unparsable private key or host-key line.
+func New(cfg Config, logger *log.Logger) (*Client, error) {
+	if cfg.Addr == "" || cfg.User == "" {
+		return nil, fmt.Errorf("wgsync: Addr and User are required")
+	}
+	signer, err := ssh.ParsePrivateKey(cfg.PrivateKey)
+	if err != nil {
+		return nil, fmt.Errorf("wgsync: parse private key: %w", err)
+	}
+	hostKey, _, _, _, err := ssh.ParseAuthorizedKey([]byte(cfg.HostKeyLine))
+	if err != nil {
+		return nil, fmt.Errorf("wgsync: parse host key line: %w", err)
+	}
+	timeout := cfg.Timeout
+	if timeout == 0 {
+		timeout = 30 * time.Second
+	}
+	if logger == nil {
+		logger = log.Default()
+	}
+	return &Client{
+		addr: cfg.Addr, user: cfg.User, signer: signer,
+		hostKey: hostKey, timeout: timeout, logger: logger,
+	}, nil
+}
+
+// pushResponse is the peersync script's stdout contract ({"status":"ok","applied":N}).
+type pushResponse struct {
+	Status  string `json:"status"`
+	Applied int    `json:"applied"`
+}
+
+// Push sends the payload to the endpoint's forced-command script over one SSH session and
+// verifies the script's ok-response. The host key is pinned (ssh.FixedHostKey) — a wrong key is
+// a refused connection, never a prompt or a fallback.
+func (c *Client) Push(ctx context.Context, payload []byte) error {
+	sshCfg := &ssh.ClientConfig{
+		User:            c.user,
+		Auth:            []ssh.AuthMethod{ssh.PublicKeys(c.signer)},
+		HostKeyCallback: ssh.FixedHostKey(c.hostKey),
+		Timeout:         c.timeout,
+	}
+	dialer := net.Dialer{Timeout: c.timeout}
+	conn, err := dialer.DialContext(ctx, "tcp", c.addr)
+	if err != nil {
+		return fmt.Errorf("wgsync: dial %s: %w", c.addr, err)
+	}
+	// Hand the ssh handshake a deadline too — DialContext's ctx stops applying after Dial.
+	if dl, ok := ctx.Deadline(); ok {
+		conn.SetDeadline(dl)
+	} else {
+		conn.SetDeadline(time.Now().Add(c.timeout))
+	}
+	sconn, chans, reqs, err := ssh.NewClientConn(conn, c.addr, sshCfg)
+	if err != nil {
+		conn.Close()
+		return fmt.Errorf("wgsync: ssh handshake %s: %w", c.addr, err)
+	}
+	client := ssh.NewClient(sconn, chans, reqs)
+	defer client.Close()
+	conn.SetDeadline(time.Time{}) // handshake done; session I/O below is bounded by the same conn
+	if dl, ok := ctx.Deadline(); ok {
+		conn.SetDeadline(dl)
+	}
+
+	session, err := client.NewSession()
+	if err != nil {
+		return fmt.Errorf("wgsync: session: %w", err)
+	}
+	defer session.Close()
+
+	var stdout, stderr bytes.Buffer
+	session.Stdin = bytes.NewReader(payload)
+	session.Stdout = &stdout
+	session.Stderr = &stderr
+
+	// The server's authorized_keys forced command overrides this string, but it MUST be set:
+	// some sshd configs log the requested command, and it documents intent on the wire.
+	if err := session.Run("felhom-peersync"); err != nil {
+		return fmt.Errorf("wgsync: remote peersync failed: %w (stderr: %s)",
+			err, strings.TrimSpace(stderr.String()))
+	}
+
+	var resp pushResponse
+	if err := json.Unmarshal(bytes.TrimSpace(stdout.Bytes()), &resp); err != nil || resp.Status != "ok" {
+		return fmt.Errorf("wgsync: malformed peersync response %q (parse err: %v, stderr: %s)",
+			strings.TrimSpace(stdout.String()), err, strings.TrimSpace(stderr.String()))
+	}
+	c.logger.Printf("[INFO] wgsync: pushed %d peers to %s", resp.Applied, c.addr)
+	return nil
+}

hub/internal/wgsync/client_test.go

@@ -0,0 +1,222 @@
+package wgsync
+
+// Group C — the SSH push client against an IN-PROCESS x/crypto/ssh server (Scenarios A/B/C-c4).
+// The server captures the exact stdin payload, so tests assert the pushed BYTES; the host-key
+// tests prove the pin both ways (correct key accepted, wrong key refused).
+
+import (
+	"bytes"
+	"context"
+	"crypto/ed25519"
+	"crypto/rand"
+	"encoding/pem"
+	"io"
+	"log"
+	"net"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"golang.org/x/crypto/ssh"
+)
+
+// testKeys generates an ed25519 keypair and returns (PEM private key, ssh.Signer).
+func testKeys(t *testing.T) ([]byte, ssh.Signer) {
+	t.Helper()
+	_, priv, err := ed25519.GenerateKey(rand.Reader)
+	if err != nil {
+		t.Fatalf("ed25519: %v", err)
+	}
+	block, err := ssh.MarshalPrivateKey(priv, "")
+	if err != nil {
+		t.Fatalf("MarshalPrivateKey: %v", err)
+	}
+	signer, err := ssh.NewSignerFromKey(priv)
+	if err != nil {
+		t.Fatalf("NewSignerFromKey: %v", err)
+	}
+	return pem.EncodeToMemory(block), signer
+}
+
+// testServer is a single-shot in-process SSH server handling one exec session.
+type testServer struct {
+	addr     string
+	mu       sync.Mutex
+	captured []byte // stdin the "script" received
+	cmd      string // the exec command string requested
+}
+
+// startTestServer runs an SSH server that accepts clientSigner's key, serves with hostSigner,
+// reads all stdin, replies stdoutResp/stderrResp and exitStatus.
+func startTestServer(t *testing.T, hostSigner ssh.Signer, clientSigner ssh.Signer,
+	stdoutResp, stderrResp string, exitStatus uint32) *testServer {
+	t.Helper()
+	cfg := &ssh.ServerConfig{
+		PublicKeyCallback: func(conn ssh.ConnMetadata, key ssh.PublicKey) (*ssh.Permissions, error) {
+			if bytes.Equal(key.Marshal(), clientSigner.PublicKey().Marshal()) {
+				return &ssh.Permissions{}, nil
+			}
+			return nil, io.EOF
+		},
+	}
+	cfg.AddHostKey(hostSigner)
+
+	ln, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("listen: %v", err)
+	}
+	t.Cleanup(func() { ln.Close() })
+	srv := &testServer{addr: ln.Addr().String()}
+
+	go func() {
+		conn, err := ln.Accept()
+		if err != nil {
+			return
+		}
+		sconn, chans, reqs, err := ssh.NewServerConn(conn, cfg)
+		if err != nil {
+			return // e.g. the wrong-host-key client aborts the handshake
+		}
+		defer sconn.Close()
+		go ssh.DiscardRequests(reqs)
+		for newCh := range chans {
+			if newCh.ChannelType() != "session" {
+				newCh.Reject(ssh.UnknownChannelType, "unsupported")
+				continue
+			}
+			ch, chReqs, err := newCh.Accept()
+			if err != nil {
+				continue
+			}
+			go func() {
+				for req := range chReqs {
+					if req.Type == "exec" {
+						var p struct{ Command string }
+						ssh.Unmarshal(req.Payload, &p)
+						srv.mu.Lock()
+						srv.cmd = p.Command
+						srv.mu.Unlock()
+						req.Reply(true, nil)
+						data, _ := io.ReadAll(ch) // the pushed payload (client EOFs stdin)
+						srv.mu.Lock()
+						srv.captured = data
+						srv.mu.Unlock()
+						if stderrResp != "" {
+							ch.Stderr().Write([]byte(stderrResp))
+						}
+						if stdoutResp != "" {
+							ch.Write([]byte(stdoutResp))
+						}
+						ch.SendRequest("exit-status", false, ssh.Marshal(struct{ Status uint32 }{exitStatus}))
+						ch.Close()
+						return
+					}
+					req.Reply(false, nil)
+				}
+			}()
+		}
+	}()
+	return srv
+}
+
+func hostKeyLine(t *testing.T, s ssh.Signer) string {
+	t.Helper()
+	return strings.TrimSpace(string(ssh.MarshalAuthorizedKey(s.PublicKey())))
+}
+
+func newTestClient(t *testing.T, addr, hostKey string, clientPEM []byte) *Client {
+	t.Helper()
+	c, err := New(Config{
+		Addr: addr, User: "felhom-peersync", PrivateKey: clientPEM,
+		HostKeyLine: hostKey, Timeout: 5 * time.Second,
+	}, log.New(io.Discard, "", 0))
+	if err != nil {
+		t.Fatalf("wgsync.New: %v", err)
+	}
+	return c
+}
+
+func TestPush_PayloadDeliveredExactly(t *testing.T) {
+	clientPEM, clientSigner := testKeys(t)
+	_, hostSigner := testKeys(t)
+	srv := startTestServer(t, hostSigner, clientSigner, `{"status":"ok","applied":1}`, "", 0)
+	c := newTestClient(t, srv.addr, hostKeyLine(t, hostSigner), clientPEM)
+
+	payload := []byte(`{"version":1,"interface":"wg0","peers":[{"pubkey":"PK1","allowed_ip":"10.77.0.2/32"}]}`)
+	if err := c.Push(context.Background(), payload); err != nil {
+		t.Fatalf("Push: %v", err)
+	}
+	srv.mu.Lock()
+	defer srv.mu.Unlock()
+	if !bytes.Equal(srv.captured, payload) {
+		t.Errorf("server captured %q, want the exact payload %q", srv.captured, payload)
+	}
+	if srv.cmd != "felhom-peersync" {
+		t.Errorf("exec command = %q, want felhom-peersync (documents intent even under forced command)", srv.cmd)
+	}
+}
+
+func TestPush_RemoteFailureSurfacesStderr(t *testing.T) {
+	clientPEM, clientSigner := testKeys(t)
+	_, hostSigner := testKeys(t)
+	srv := startTestServer(t, hostSigner, clientSigner, "", "boom", 1)
+	c := newTestClient(t, srv.addr, hostKeyLine(t, hostSigner), clientPEM)
+
+	err := c.Push(context.Background(), []byte(`{}`))
+	if err == nil {
+		t.Fatal("Push succeeded against exit-1 server")
+	}
+	if !strings.Contains(err.Error(), "boom") {
+		t.Errorf("error %q does not carry the remote stderr", err)
+	}
+}
+
+func TestPush_MalformedResponseIsError(t *testing.T) {
+	clientPEM, clientSigner := testKeys(t)
+	_, hostSigner := testKeys(t)
+	srv := startTestServer(t, hostSigner, clientSigner, "garbage-not-json", "", 0)
+	c := newTestClient(t, srv.addr, hostKeyLine(t, hostSigner), clientPEM)
+
+	if err := c.Push(context.Background(), []byte(`{}`)); err == nil {
+		t.Fatal("Push accepted a malformed script response — it must not guess")
+	}
+}
+
+func TestPush_WrongHostKeyRefused(t *testing.T) {
+	clientPEM, clientSigner := testKeys(t)
+	_, hostSigner := testKeys(t)
+	_, otherSigner := testKeys(t) // NOT the server's key
+	srv := startTestServer(t, hostSigner, clientSigner, `{"status":"ok","applied":0}`, "", 0)
+	c := newTestClient(t, srv.addr, hostKeyLine(t, otherSigner), clientPEM)
+
+	err := c.Push(context.Background(), []byte(`{}`))
+	if err == nil {
+		t.Fatal("Push succeeded against a server with the WRONG host key — the pin is dead")
+	}
+	if !strings.Contains(err.Error(), "host key") && !strings.Contains(err.Error(), "handshake") {
+		t.Errorf("error %q is not a host-key refusal", err)
+	}
+	srv.mu.Lock()
+	defer srv.mu.Unlock()
+	if len(srv.captured) != 0 {
+		t.Errorf("payload leaked to a mis-keyed server: %q", srv.captured)
+	}
+}
+
+func TestNew_BadInputsFailEarly(t *testing.T) {
+	clientPEM, _ := testKeys(t)
+	_, hostSigner := testKeys(t)
+	hk := hostKeyLine(t, hostSigner)
+	logger := log.New(io.Discard, "", 0)
+
+	if _, err := New(Config{Addr: "x:22", User: "u", PrivateKey: []byte("not-a-key"), HostKeyLine: hk}, logger); err == nil {
+		t.Error("bad private key accepted")
+	}
+	if _, err := New(Config{Addr: "x:22", User: "u", PrivateKey: clientPEM, HostKeyLine: "not a key line"}, logger); err == nil {
+		t.Error("bad host key line accepted")
+	}
+	if _, err := New(Config{User: "u", PrivateKey: clientPEM, HostKeyLine: hk}, logger); err == nil {
+		t.Error("missing addr accepted")
+	}
+}

hub/internal/wgsync/reconciler.go

@@ -0,0 +1,106 @@
+package wgsync
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"log"
+	"time"
+
+	"gitea.dooplex.hu/admin/felhom-hub/internal/store"
+)
+
+// syncer is the push seam — satisfied by *Client; tests inject a fake to count calls and
+// capture payloads without SSH.
+type syncer interface {
+	Push(ctx context.Context, payload []byte) error
+}
+
+// Reconciler keeps the endpoint's WG peer list converged on the hub DB (the source of truth).
+// DECLARATIVE: every push carries the FULL desired list — never deltas — so endpoint drift
+// (a manually-added peer, a missed earlier push) is erased on the next push, and a failed push
+// self-heals on the next tick. This full-list property is load-bearing (Scenario D drift
+// repair) — do not "optimize" it into deltas.
+type Reconciler struct {
+	store    *store.Store
+	sync     syncer
+	trigger  chan struct{}
+	interval time.Duration // tick period; tests shrink it
+	logger   *log.Logger
+}
+
+// NewReconciler builds a Reconciler over the store and a syncer (the SSH client in production).
+func NewReconciler(st *store.Store, sync syncer, logger *log.Logger) *Reconciler {
+	if logger == nil {
+		logger = log.Default()
+	}
+	return &Reconciler{
+		store:    st,
+		sync:     sync,
+		trigger:  make(chan struct{}, 1),
+		interval: 5 * time.Minute,
+		logger:   logger,
+	}
+}
+
+// Trigger requests an immediate sync from Run's loop. Non-blocking: a pending trigger already
+// covers this request (the full list is pushed either way).
+func (r *Reconciler) Trigger() {
+	select {
+	case r.trigger <- struct{}{}:
+	default:
+	}
+}
+
+// payload builds the versioned, deterministic sync document from the store.
+// {"version":1,"interface":"wg0","peers":[{"pubkey":"...","allowed_ip":"<ip>/32"}]}
+func (r *Reconciler) payload() ([]byte, error) {
+	peers, err := r.store.ListWGPeers()
+	if err != nil {
+		return nil, fmt.Errorf("list peers: %w", err)
+	}
+	type wirePeer struct {
+		Pubkey    string `json:"pubkey"`
+		AllowedIP string `json:"allowed_ip"`
+	}
+	doc := struct {
+		Version   int        `json:"version"`
+		Interface string     `json:"interface"`
+		Peers     []wirePeer `json:"peers"`
+	}{Version: 1, Interface: "wg0", Peers: make([]wirePeer, 0, len(peers))}
+	for _, p := range peers {
+		doc.Peers = append(doc.Peers, wirePeer{Pubkey: p.Pubkey, AllowedIP: p.AssignedIP + "/32"})
+	}
+	return json.Marshal(doc)
+}
+
+// SyncNow builds the current full-list payload and pushes it. Called inline by the mutation
+// handlers (short ctx) and by Run's loop.
+func (r *Reconciler) SyncNow(ctx context.Context) error {
+	payload, err := r.payload()
+	if err != nil {
+		return err
+	}
+	return r.sync.Push(ctx, payload)
+}
+
+// Run loops until ctx is done: an explicit Trigger OR the periodic tick pushes the full list.
+// The periodic push happens even with zero mutations — that is the drift repair. Errors are
+// logged and retried on the next signal; Run never exits early.
+func (r *Reconciler) Run(ctx context.Context) {
+	ticker := time.NewTicker(r.interval)
+	defer ticker.Stop()
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-r.trigger:
+		case <-ticker.C:
+		}
+		syncCtx, cancel := context.WithTimeout(ctx, 60*time.Second)
+		if err := r.SyncNow(syncCtx); err != nil {
+			r.logger.Printf("[ERROR] wgsync reconcile: %v (will retry on next tick)", err)
+		}
+		cancel()
+	}
+}

hub/internal/wgsync/reconciler_test.go

@@ -0,0 +1,206 @@
+package wgsync
+
+// Group D — reconciler (Scenario D). Non-hollow: asserts the exact pushed payloads (full list,
+// deterministic order, absent-after-remove), retry-after-failure, and the no-mutation drift-
+// repair tick.
+
+import (
+	"context"
+	"encoding/json"
+	"io"
+	"log"
+	"path/filepath"
+	"sync"
+	"testing"
+	"time"
+
+	"gitea.dooplex.hu/admin/felhom-hub/internal/store"
+)
+
+type fakeSyncer struct {
+	mu       sync.Mutex
+	payloads [][]byte
+	err      error
+	notify   chan struct{}
+}
+
+func newFakeSyncer() *fakeSyncer { return &fakeSyncer{notify: make(chan struct{}, 16)} }
+
+func (f *fakeSyncer) Push(ctx context.Context, payload []byte) error {
+	f.mu.Lock()
+	cp := append([]byte(nil), payload...)
+	f.payloads = append(f.payloads, cp)
+	err := f.err
+	f.mu.Unlock()
+	select {
+	case f.notify <- struct{}{}:
+	default:
+	}
+	return err
+}
+
+func (f *fakeSyncer) count() int {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	return len(f.payloads)
+}
+
+func (f *fakeSyncer) last() []byte {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	if len(f.payloads) == 0 {
+		return nil
+	}
+	return f.payloads[len(f.payloads)-1]
+}
+
+func waitPush(t *testing.T, f *fakeSyncer) {
+	t.Helper()
+	select {
+	case <-f.notify:
+	case <-time.After(5 * time.Second):
+		t.Fatal("timed out waiting for a push")
+	}
+}
+
+func newWGStore(t *testing.T) *store.Store {
+	t.Helper()
+	s, err := store.New(filepath.Join(t.TempDir(), "test.db"), log.New(io.Discard, "", 0))
+	if err != nil {
+		t.Fatalf("store.New: %v", err)
+	}
+	t.Cleanup(func() { s.Close() })
+	if err := s.SetWGEndpoint(&store.WGEndpoint{
+		DNSName: "ep0.example", WGPort: 443, ServerPubkey: "SPK",
+		TunnelSubnet: "10.77.0.0/24", PBSTunnelIP: "10.77.0.1",
+	}); err != nil {
+		t.Fatalf("SetWGEndpoint: %v", err)
+	}
+	return s
+}
+
+func TestReconciler_TriggerPushesFullList(t *testing.T) {
+	st := newWGStore(t)
+	st.AddWGPeer("PKA", "", "")
+	st.AddWGPeer("PKB", "", "")
+	fake := newFakeSyncer()
+	r := NewReconciler(st, fake, log.New(io.Discard, "", 0))
+	r.interval = time.Hour // tick out of the picture
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	go r.Run(ctx)
+
+	r.Trigger()
+	waitPush(t, fake)
+	if fake.count() != 1 {
+		t.Fatalf("push count = %d, want exactly 1", fake.count())
+	}
+	var doc struct {
+		Version   int    `json:"version"`
+		Interface string `json:"interface"`
+		Peers     []struct {
+			Pubkey    string `json:"pubkey"`
+			AllowedIP string `json:"allowed_ip"`
+		} `json:"peers"`
+	}
+	if err := json.Unmarshal(fake.last(), &doc); err != nil {
+		t.Fatalf("payload not JSON: %v", err)
+	}
+	if doc.Version != 1 || doc.Interface != "wg0" || len(doc.Peers) != 2 {
+		t.Fatalf("payload = %s", fake.last())
+	}
+	if doc.Peers[0].Pubkey != "PKA" || doc.Peers[0].AllowedIP != "10.77.0.2/32" ||
+		doc.Peers[1].Pubkey != "PKB" || doc.Peers[1].AllowedIP != "10.77.0.3/32" {
+		t.Errorf("peers = %+v (order/content)", doc.Peers)
+	}
+}
+
+func TestReconciler_FailureRetriedOnTick(t *testing.T) {
+	st := newWGStore(t)
+	st.AddWGPeer("PKA", "", "")
+	fake := newFakeSyncer()
+	fake.err = context.DeadlineExceeded // every push fails
+	r := NewReconciler(st, fake, log.New(io.Discard, "", 0))
+	r.interval = 30 * time.Millisecond
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	go r.Run(ctx)
+
+	r.Trigger()
+	waitPush(t, fake) // the failing triggered push
+	waitPush(t, fake) // the tick retry — Run must not have exited on the error
+	if fake.count() < 2 {
+		t.Fatalf("push count = %d, want >=2 (retry after failure)", fake.count())
+	}
+}
+
+func TestReconciler_TickPushesWithoutMutations(t *testing.T) {
+	st := newWGStore(t) // zero peers, zero mutations
+	fake := newFakeSyncer()
+	r := NewReconciler(st, fake, log.New(io.Discard, "", 0))
+	r.interval = 30 * time.Millisecond
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	go r.Run(ctx)
+
+	waitPush(t, fake) // pure tick — this IS the drift repair
+	var doc struct {
+		Peers []interface{} `json:"peers"`
+	}
+	if err := json.Unmarshal(fake.last(), &doc); err != nil {
+		t.Fatalf("payload not JSON: %v", err)
+	}
+	if len(doc.Peers) != 0 {
+		t.Errorf("empty registry must push an empty (not absent) peer list: %s", fake.last())
+	}
+}
+
+func TestReconciler_RemovedPeerAbsentFromNextPayload(t *testing.T) {
+	st := newWGStore(t)
+	st.AddWGPeer("PKA", "", "")
+	st.AddWGPeer("PKB", "", "")
+	fake := newFakeSyncer()
+	r := NewReconciler(st, fake, log.New(io.Discard, "", 0))
+
+	if err := r.SyncNow(context.Background()); err != nil {
+		t.Fatalf("SyncNow: %v", err)
+	}
+	if err := st.RemoveWGPeer("PKA"); err != nil {
+		t.Fatalf("RemoveWGPeer: %v", err)
+	}
+	if err := r.SyncNow(context.Background()); err != nil {
+		t.Fatalf("SyncNow 2: %v", err)
+	}
+	last := string(fake.last())
+	// Assert the NEGATIVE: the removed pubkey is gone from the pushed bytes.
+	if json.Valid([]byte(last)) == false {
+		t.Fatalf("payload not JSON: %s", last)
+	}
+	if contains := jsonContainsPubkey(t, []byte(last), "PKA"); contains {
+		t.Errorf("removed peer PKA still in payload: %s", last)
+	}
+	if contains := jsonContainsPubkey(t, []byte(last), "PKB"); !contains {
+		t.Errorf("surviving peer PKB missing from payload: %s", last)
+	}
+}
+
+func jsonContainsPubkey(t *testing.T, payload []byte, pk string) bool {
+	t.Helper()
+	var doc struct {
+		Peers []struct {
+			Pubkey string `json:"pubkey"`
+		} `json:"peers"`
+	}
+	if err := json.Unmarshal(payload, &doc); err != nil {
+		t.Fatalf("payload parse: %v", err)
+	}
+	for _, p := range doc.Peers {
+		if p.Pubkey == pk {
+			return true
+		}
+	}
+	return false
+}