Release validation: tests green, USB pack, fleet UX and API hardening.

Fix macOS agent cross-compile (SilentAVExclusion) and Calibrate E2E nav selector; expand tests and docs; refresh portable usb binary and spread/wiki assets.

server/internal/api/websocket.go

@@ -524,7 +524,9 @@ func (h *WSHub) HandleAgentWS(w http.ResponseWriter, r *http.Request) {
 				if h.aiHandler != nil {
 					h.aiHandler.RemoveEngine(agentID)
 				}
-				h.db.SetAgentOffline(agentID)
+				if err := h.db.SetAgentOffline(agentID); err != nil {
+					log.Printf("[hub] SetAgentOffline %s: %v", agentID, err)
+				}
 				h.broadcastDashboard(Message{
 					Type:    "agent_offline",
 					Payload: mustMarshal(map[string]string{"agent_id": agentID}),
@@ -753,36 +755,44 @@ func (h *WSHub) HandleAgentWS(w http.ResponseWriter, r *http.Request) {
 				log.Printf("[WS] Agent connected: id=%s name=%s ip=%s", agentID, displayName, clientIP)
 			}
 
-			// MaxAgents check + registration in a single Lock to prevent TOCTOU (M17):
-			// two concurrent new agents could both pass the count check under RLock, then
-			// both get registered, overshooting the limit.
-			h.mu.Lock()
-			_, alreadyConnected := h.agents[agentID]
-			if policy.MaxAgents > 0 {
-				if !alreadyConnected && len(h.agents) >= policy.MaxAgents {
-					h.mu.Unlock()
-					conn.WriteJSON(Message{Type: "auth_response", Payload: mustMarshal(map[string]interface{}{
-						"success": false, "error": "fleet agent limit reached",
-					})})
-					break
-				}
-			}
-			if old, ok := h.agents[agentID]; ok && old.Conn != conn {
-				oldConn := old.Conn
+		// MaxAgents check + registration in a single Lock to prevent TOCTOU (M17):
+		// two concurrent new agents could both pass the count check under RLock, then
+		// both get registered, overshooting the limit.
+		h.mu.Lock()
+		_, alreadyConnected := h.agents[agentID]
+		if policy.MaxAgents > 0 {
+			if !alreadyConnected && len(h.agents) >= policy.MaxAgents {
 				h.mu.Unlock()
-				oldConn.Close()
-				h.mu.Lock()
+				conn.WriteJSON(Message{Type: "auth_response", Payload: mustMarshal(map[string]interface{}{
+					"success": false, "error": "fleet agent limit reached",
+				})})
+				break
 			}
-			ac := &AgentConnection{AgentID: agentID, Conn: conn}
-			h.agents[agentID] = ac
+		}
+		// startPing tracks whether a new ping goroutine is needed.
+		// If the same connection is re-authing (rare but possible), the existing
+		// ping loop is still healthy — starting a second one would create two
+		// concurrent writers racing on conn.WriteControl.
+		startPing := !alreadyConnected
+		if old, ok := h.agents[agentID]; ok && old.Conn != conn {
+			oldConn := old.Conn
 			h.mu.Unlock()
+			oldConn.Close()
+			h.mu.Lock()
+			startPing = true // fresh connection after displacing old one
+		}
+		ac := &AgentConnection{AgentID: agentID, Conn: conn}
+		h.agents[agentID] = ac
+		h.mu.Unlock()
 
-			h.FlushBeaconPoliciesToWS(agentID)
-			h.FlushBeaconCommandsToWS(agentID)
-			h.ClearBeaconTransport(agentID)
+		h.FlushBeaconPoliciesToWS(agentID)
+		h.FlushBeaconCommandsToWS(agentID)
+		h.ClearBeaconTransport(agentID)
 
-			// Start the RTT-aware ping loop now that we have an AgentConnection.
+		// Only start a ping loop for genuinely new connections.
+		if startPing {
 			go h.runPingLoopAgent(ac)
+		}
 
 			conn.WriteJSON(Message{Type: "auth_response", Payload: mustMarshal(map[string]interface{}{
 				"success":  true,
@@ -1312,13 +1322,11 @@ func (h *WSHub) broadcastDashboard(msg Message) {
 	for id, dc := range h.dashboards {
 		if err := dc.WriteMessage(websocket.TextMessage, data); err != nil {
 			log.Printf("Failed to send to dashboard %s: %v", id, err)
+			// Only close the connection here. HandleDashboardWS owns all map
+			// cleanup via its existing defer — doing it here too would cause a
+			// double-delete that corrupts the remaining-count used for the
+			// presence_update broadcast (SRV-B4).
 			dc.Conn.Close()
-			id := id
-			go func() {
-				h.mu.Lock()
-				delete(h.dashboards, id)
-				h.mu.Unlock()
-			}()
 		}
 	}
 }