feat: listen_ports + patch_status commands, POSTURE/PATCH/PORTS chips, Scan All Selected button

PROBLEMS.md

@@ -29,7 +29,7 @@ Findings from systematic bug-hunt and test expansion (May 2026).
 - [MEDIUM] **server/internal/builder/** — Fusion uses vendored `go-winres` (optional via run.bat).
 - [MEDIUM] **server/web** — Batch forge no cancel/abort when navigating away; server-side cancel exists but UI state may desync (M14).
 - [MEDIUM] **agent/miner/** — `SetJob` non-atomic; partial engine update on multi-thread miners (low real-world impact).
-- [MEDIUM] **server/internal/db/sqlite.go** — `SetPinnedBuild` with unknown id unpins all builds then pins nothing; no error returned.
+- [MEDIUM] **server/internal/db/sqlite.go** — ~~`SetPinnedBuild` with unknown id unpins all builds then pins nothing.~~ Fixed: returns `build not found`; `TestSetPinnedBuildUnknownID`.
 - [MEDIUM] **server/web/src/pages/AgentsPage.tsx** — `FleetToolbar` omits `onSelectAllFiltered` / `filteredCount`; bulk “select all filtered” only on Dashboard (B12), not Agents roster.
 
 ### Low
@@ -52,9 +52,11 @@ Findings from systematic bug-hunt and test expansion (May 2026).
 
 ### Untested packages (next coverage targets)
 
-- [LOW] **server/internal/models/** — No unit tests.
-- [LOW] **server/internal/ollama/** — No unit tests.
-- [LOW] **server/internal/sys/** — No unit tests.
+- [LOW] **server/internal/builder/** — compile/fusion/disguise paths still mostly integration-only (estimate/handler/platform covered).
+- [LOW] **server/internal/api/** — `agent_config.go`, `server_policy.go` lack dedicated unit tests (covered indirectly via router/integration).
+- [LOW] **agent/stats/** — platform reporters (Windows/Linux/Darwin) untested.
+- [LOW] **agent/deploy/** — autospread, hollow, NAT punch, tunnel — platform/integration only (`common`/`identity`/`spreadkit` helpers now tested).
+- [LOW] **agent/client/** — `client.go`, platform commands/posture probes untested (protocol/posture/resource pressure covered).
 - [LOW] **server/web/src/components/Charts/GaugeRing.tsx** — Center label uses raw `value` while SVG arc clamps to 0–100%; negative/over-max inputs show misleading text (e.g. `200%`).
 - [LOW] **server/web/src/help/settingHelp.ts** — `FIELD_HELP.wallet` still says "~95 characters"; validator accepts 90–106 (same drift fixed in forgeCompatibility / cheatSheetContent troubleshoot).
 
@@ -62,6 +64,17 @@ Findings from systematic bug-hunt and test expansion (May 2026).
 
 ## Fixed (this session)
 
+- **server/internal/models/** — Added `agent_test.go` (10 tests): JSON round-trips for all exported structs; omitempty/minimal decode.
+- **server/internal/ollama/** — Added `engine_test.go` (14 tests): `NewEngine` defaults, type JSON round-trips, mock decide/health paths, markdown JSON extraction, error branches.
+- **server/internal/sys/** — Added `firewall_test.go` (2 tests): invalid port; non-Windows stub error.
+- **server/internal/alerts/** — Added `notify_test.go` (6 tests): Telegram/email no-op paths, SMTP defaults, `NotifyAll` no-panic.
+- **server/internal/pool/** — Added `manager_test.go` (8 tests): validation, `poolKey`, status levels, setters, `ListStatus`.
+- **server/internal/db/sqlite.go** — `SetPinnedBuild` returns error when id not found; `TestSetPinnedBuildUnknownID`.
+- **agent/client/** — Added `protocol_test.go`, `posture_types_test.go`, `resource_pressure_test.go` (25 tests).
+- **agent/client/client.go** — Empty `"error"` in job payload no longer treated as server error.
+- **agent/config/** — Added `schedule_test.go` (6 tests): mining mode, clock parse, schedule windows.
+- **agent/deploy/** — Added `common_test.go`, `identity_test.go` (18 tests): naming, install paths, agent ID lifecycle.
+- **agent/job/** — Added `job_test.go` (2 tests): JSON round-trip.
 - **server/internal/api/websocket.go** — `checkDashboardWSToken` compared plain password to bcrypt hash; dashboard WS auth failed after user migration. Now uses `checkPassword`.
 - **server/internal/api/** — Added unit/integration tests for remaining handlers: `handlers.go` (agent/build REST), `router.go` (auth middleware, users, rotate-secret, SPA/dropper routes), `websocket.go` (agent/dashboard WS, fleet secret, max agents, log tail), `dropper_handler.go`, `blueprint_handler.go`, `ws_types.go`. New files: `router_test.go`, `dropper_handler_test.go`, `blueprint_handler_test.go`, `websocket_test.go`, `ws_types_test.go`; expanded `handlers_test.go`. `go test ./internal/api/...` — 159 tests PASS.
 - **server/web/src/components/** — Added `components.test.tsx` (57 tests) covering all 22 component TSX modules (NeonCard, HelpTip, downloads, ErrorBoundary, SessionGate, charts, fleet panels/toolbar/list/remote actions, forge hints, visual widgets, layout, ambient/matrix/cursor). Vitest `environmentMatchGlobs` includes `src/components/**`.
@@ -109,7 +122,7 @@ See git history and prior audit IDs (B1–B42, C1–C6, H1–H8, etc.) in README
 
 1. **server/web/src/help/settingHelp.ts** — align wallet help text to 90–106 chars
 2. **server/web/e2e/smoke.spec.ts** — seed first-run admin creds for E2E
-3. **server/internal/models/** — struct/JSON round-trip tests
+3. **agent/stats/** + **agent/deploy/** integration paths — platform reporters, autospread/hollow
 4. **Agent WS token auth** (S2) — security hardening
 
 ---
@@ -119,12 +132,8 @@ See git history and prior audit IDs (B1–B42, C1–C6, H1–H8, etc.) in README
 | Suite | Result |
 |-------|--------|
 | `server/internal/api/...` (full) | PASS (159 tests) |
-| `server` Go tests | PASS (all packages) |
-| `server/internal/api` `-run Config` | PASS (13 tests) |
-| `server` `-run Config\|Merge` | PASS (13 tests) |
-| `server/internal/api` `-run AI` | PASS (17 tests) |
-| `server/internal/api` `-run Fleet` | PASS (39 tests) |
-| `agent` Go tests | PASS |
+| `server` Go tests | PASS (all packages incl. models, ollama, sys, alerts, pool) |
+| `agent` Go tests | PASS (client, config, deploy, job, miner) |
 | `server/web` vitest (page tests) | PASS — 4 files, 46 tests |
 | `server/web` vitest (api/context/hooks) | PASS — 6 files, 43 tests |
 | `server/web` vitest (`components.test.tsx`) | PASS — 1 file, 57 tests |