Add tiered LOTL mining onion and fleet recon so agents can fallback across execution tiers while operators see spread and vuln posture in Crucible. Includes triple-onion chain, spread cred graph, and full Go/TS/E2E test validation.

scripts/test-suite.ps1

@@ -2,7 +2,8 @@
 param(
     [switch]$SkipE2E,
     [switch]$SkipBuild,
-    [switch]$Verbose
+    [switch]$Verbose,
+    [switch]$ReconOnly
 )
 
 $ErrorActionPreference = "Stop"
@@ -24,6 +25,25 @@ function Write-Phase([string]$Name) {
     Write-Host "==============================================================" -ForegroundColor Cyan
 }
 
+function Invoke-GoTest([string]$Package) {
+    $prevEAP = $ErrorActionPreference
+    $ErrorActionPreference = 'Continue'
+    try {
+        $out = go test $Package -count=1 2>&1 | ForEach-Object { "$_" }
+        $text = ($out -join "`n").Trim()
+        if ($text) { Write-Host $text }
+        if (-not $LASTEXITCODE -or $LASTEXITCODE -eq 0) { return }
+        # Windows AV occasionally locks *.test.exe after an otherwise passing run.
+        if ($text -match 'unlinkat.*\.test\.exe') {
+            Write-Host "  >> (ignored test binary cleanup flake on Windows for $Package)" -ForegroundColor Yellow
+            return
+        }
+        throw "go test $Package failed (exit $LASTEXITCODE)"
+    } finally {
+        $ErrorActionPreference = $prevEAP
+    }
+}
+
 function Invoke-Phase([string]$Name, [scriptblock]$Block) {
     Write-Phase $Name
     try {
@@ -44,6 +64,28 @@ Write-Host ""
 Write-Host "  AetherForge Full Test Suite" -ForegroundColor Yellow
 Write-Host "  Root: $Root"
 
+if ($ReconOnly) {
+    Invoke-Phase "Fleet recon (focused)" {
+        Push-Location (Join-Path $Root "server")
+        go test ./internal/api/... -run "PathTracer|SpreadCred|MergeService|DeployPlan" -count=1
+        go test ./internal/db/... -run CredEdge -count=1
+        go test . -run "OrderDeploymentCred|LoadDeploymentCred" -count=1
+        Pop-Location
+        Push-Location (Join-Path $Root "agent")
+        go test ./vulnprobe/... ./miner/... -run "TripleOnion|Correlate|VulnProbe|Risk" -count=1
+        go test ./deploy/... -run "NetworkHints|ServiceDiscovery|CredSpread|Discover" -count=1
+        go test ./client/... -run "Vuln|SpreadCred|ChainOrder" -count=1
+        Pop-Location
+        Push-Location (Join-Path $Root "server\web")
+        if (-not (Test-Path "node_modules")) { npm install --silent }
+        npm run test -- --run src/help/reconRisk.test.ts src/components/Fleet/ReconBadges.test.tsx src/components/Fleet/CrucibleExpandedOps.test.tsx
+        Pop-Location
+    }
+    Write-Host ""
+    Write-Host "  Recon-only run complete" -ForegroundColor Green
+    exit 0
+}
+
 Invoke-Phase "1/8 Go server tests" {
     Push-Location (Join-Path $Root "server")
     go test ./... -count=1
@@ -52,10 +94,21 @@ Invoke-Phase "1/8 Go server tests" {
 
 Invoke-Phase "2/8 Go agent tests" {
     Push-Location (Join-Path $Root "agent")
-    go test ./... -count=1
+    # Package-by-package avoids Windows unlinkat flakes on deploy.test.exe after `go test ./...`.
+    $pkgs = @(go list ./... 2>$null)
+    foreach ($pkg in $pkgs) {
+        Invoke-GoTest $pkg
+    }
     Pop-Location
 }
 
+# LOTL/tiered mining quick-run (subset of phase 2):
+#   cd agent && go test ./miner/... ./client/... ./deploy/... -run "Lotl|LOTL|Tier|Staging|Fallback|Mining" -count=1
+# Server LOTL relay (subset of phase 1):
+#   cd server && go test ./internal/api/... ./internal/builder/... ./internal/models/... -run "Lotl|LOTL|Tier|StatsBatch|Mining" -count=1
+# Frontend LOTL (subset of phase 4):
+#   cd server/web && npm test -- --run src/help/lotlOnionTiers.test.ts src/components/Fleet/LotlTierBadge.test.tsx src/help/applyStatsUpdate.test.ts src/context/WebSocketProvider.test.tsx
+
 Invoke-Phase "3/8 Fusion module tests" {
     Push-Location (Join-Path $Root "fusion")
     go test . -count=1