Integrator: AWS gate fixes and doc counts after cloud landing.

Apply SwarmMagnet, uiHelp, AccessDepthPanel, Seer, miningsurgery, and path-tracer test fixes; add agent cloud telemetry fields and main strings import; refresh tests/README and PROBLEMS AWS operator notes.

PROBLEMS.md

@@ -1,10 +1,10 @@
-# PROBLEMS.md
+# PROBLEMS.md
 
 Open issues only. Fixed items removed. Last sweep: 2026-06-07.
 
 ## No open code issues
 
-Automatable gaps are closed; remaining items below are by-design limits, architecture deferrals, or manual/live operator work. Regression tables and counts: Go server **797**, agent **612**, Vitest **791**, Playwright **25** — see `tests/README.md`.
+Automatable gaps are closed; remaining items below are by-design limits, architecture deferrals, or manual/live operator work. Regression tables and counts: Go server **912**, agent **644**, Vitest **835**, Playwright **26** — see `tests/README.md`.
 
 ## By design / safety
 
@@ -32,7 +32,7 @@ Automatable gaps are closed; remaining items below are by-design limits, archite
 
 | Topic | Notes |
 |-------|-------|
-| **Fallback chain** | `agent/miner/fallback_chain.go` orchestrates container → in-process → GPU (parallel) → Stratum overlay. Failures in `failed_methods[]` on stats WS (tested). 30s cooldown between full re-passes (`DefaultChainCooldown`, `RestartChain` clears). |
+| **Fallback chain** | `agent/miner/fallback_chain.go` orchestrates container → in-process → GPU (parallel) → Stratum overlay. Failures in `failed_methods[]` on stats WS (tested). 30s cooldown between full re-passes (`DefaultChainCooldown`, `RestartChain` clears). |
 | **Default execution** | Forge default is `auto` (full chain). `inprocess`/`container`/`subprocess` limit which steps run. Forge shows worker-image build hint when auto/container selected. |
 | **AV limits (honest)** | Containers are **not** invisible - AV still sees `docker.exe`, image pulls, and container filesystem scans. Legitimate benefit is **isolated workload** and fewer host subprocess spawns (GPU T-Rex/TRM). In-process RandomX has no external CPU miner exe. |
 | **GPU in container** | Linux `--gpus all` stub only; Windows Docker Desktop GPU passthrough is operator-dependent. Host subprocess GPU path remains fallback. |
@@ -64,13 +64,24 @@ Automatable gaps are closed; remaining items below are by-design limits, archite
 | **Terminal virtualization** | 400-line DOM cap only; full virtual scrollback deferred. |
 | **Vite chunk weight** | `three` + vendor warnings; FleetTopologyMap lazy but heavy first open. |
 
+
+## AWS cloud features (honest operator scope)
+
+| Area | Notes |
+|------|-------|
+| **S3 + CloudFront erasure swarm** | Deploy plans can upload RS 4+2 shards when `AF_AWS_*` / `AF_CLOUDFRONT_*` env creds and Calibrate bucket/domain are set. **Test connection** and IAM/bucket policy JSON are local-only (no AWS API from the server except optional S3 HeadBucket when creds present). |
+| **SSM `ssm_document` spread lane** | Emberwake SSM panel exports document + run-command CLI for owned EC2; agents execute curl against your deck. Requires operator AWS CLI + IAM on instances (managed instance profile). |
+| **Launch Template strain genesis** | Crucible/forge exports `launch-template.json`, `user-data.sh`, ASG example for horizontal EC2 genesis auth (`join_lane=launch_template`). Operator applies in their AWS account. |
+| **Cloud spread kits** | Emberwake Cloud Spread panel ZIPs templates (S3/CloudFront, MinIO, Cloud Map snippets). Connection test is HTTP reachability only. |
+| **Policy snapshot / EventBridge fan-out** | Public `policy-snapshot/{token}` + fan-out ZIP for degraded agents; relay URL is operator-deployed Lambda/EventBridge—server does not call AWS APIs. |
+| **Fargate burst campaign** | Optional burst seeder task definition export; **not** auto-provisioned—operator ECS/Fargate + creds required. |
+| **Live AWS validation** | Full gate needs operator IAM (`s3:PutObject`, CloudFront signing keys, SSM SendCommand on fleet). CI/automation covers mocks; no shared AWS account in repo. |
+
 ## Manual / live / honest partial
 
 | Item | Notes |
 |------|-------|
-| **Erasure-coded multi-lane propagation** | **Partial foundation** — server `internal/erasure/` RS 4+2 + shard API; deploy plans attach `erasure_plan` when Calibrate `server.erasure_lanes_enabled`; agent `deploy/erasure_staging.go` reassembles from parallel lane URLs as fallback when primary staging fails. **Fleet Torrent (partial):** `fleet_torrent_enabled` adds shard DHT gossip, primary seeder election, BGP swarm magnets, and C2 torrent manifest — **not shipped:** live peer HTTP shard serving on agents, UDP/magnet tracker, or erasure-first spread E2E. **AWS Erasure Swarm (partial):** operator `aws_s3_shard_bucket` + `aws_cloudfront_domain` + `AF_AWS_*` / `AF_CLOUDFRONT_*` env; deploy plans upload shards + signed `edge_url` / `xs=` magnets; agents prefer LAN → CloudFront → C2 — **not shipped:** live S3/CloudFront E2E without real operator creds or automated distribution provisioning. |
-| **Onion contingency miner (partial)** | **Partial** — when `ai_control_enabled`, auth pushes `contingency_policy`; agent `ContingencyTreeRunner` walks `inprocess`→`container`→`gpu_subprocess`→`idle_tune`→`self_surgery` with local persona ghost forks (no lateral spread); each hop ships `onion_miner_log` WS + Seer; server `ContingencyOrchestrator` freezes winners and pushes `contingency_branch_params` from graft **mining** genome (not spread tiers) on exhaustion; hospice retires strain after 12 cycles; operator `pause` stops tree. Crucible **ONION N** badge. **Not shipped:** live LLM court invoke on every exhaust tick (deterministic compose today). |
-| **P2 remaining (manual only)** | Live Docker/Podman container start on operator host; real WinRM/GPO/systemd/crontab on remote owned hosts; live BITS/curl against non-mock C2; live multi-hop discover→spread without Playwright stub; live TLS/mesh beacon; full `wg_setup` on real Windows hosts. |
+
 
 ## Do not commit