Validate and integrate fleet intelligence features

Fix atlas skip merge under lock, tolerate post-auth WS frames in tests,
and harden test-suite npm invocation on Windows.

agent/client/atlas_policy.go

@@ -14,8 +14,8 @@ type AtlasSkip struct {
 func (c *AgentClient) applyAtlasSkips(skips []AtlasSkip) {
 	c.mu.Lock()
 	c.atlasSkips = append([]AtlasSkip(nil), skips...)
+	c.mergeAtlasSkipsIntoPolicyLocked()
 	c.mu.Unlock()
-	c.mergeAtlasSkipsIntoPolicy()
 }
 
 func (c *AgentClient) atlasSkipsSnapshot() []AtlasSkip {
@@ -27,6 +27,10 @@ func (c *AgentClient) atlasSkipsSnapshot() []AtlasSkip {
 func (c *AgentClient) mergeAtlasSkipsIntoPolicy() {
 	c.mu.Lock()
 	defer c.mu.Unlock()
+	c.mergeAtlasSkipsIntoPolicyLocked()
+}
+
+func (c *AgentClient) mergeAtlasSkipsIntoPolicyLocked() {
 	if len(c.atlasSkips) == 0 {
 		return
 	}

agent/client/strategy_policy.go

@@ -47,8 +47,8 @@ func (c *AgentClient) applyAdaptiveStrategyJSON(raw json.RawMessage) {
 		policy.SkipTiers = skip
 	}
 	c.tierPolicy = policy
+	c.mergeAtlasSkipsIntoPolicyLocked()
 	c.mu.Unlock()
-	c.mergeAtlasSkipsIntoPolicy()
 	log.Printf("[agent] adaptive strategy applied (%d tiers, confidence=%.2f)", len(s.TierOrder), s.Confidence)
 }
 

scripts/test-suite.ps1

@@ -25,6 +25,20 @@ function Write-Phase([string]$Name) {
     Write-Host "==============================================================" -ForegroundColor Cyan
 }
 
+function Invoke-Npm([string[]]$Args) {
+    $prevEAP = $ErrorActionPreference
+    $ErrorActionPreference = 'Continue'
+    try {
+        $out = & npm @Args 2>&1 | ForEach-Object { "$_" }
+        $text = ($out -join "`n").Trim()
+        if ($text) { Write-Host $text }
+        if (-not $LASTEXITCODE -or $LASTEXITCODE -eq 0) { return }
+        throw "npm $($Args -join ' ') failed (exit $LASTEXITCODE)"
+    } finally {
+        $ErrorActionPreference = $prevEAP
+    }
+}
+
 function Invoke-GoTest([string]$Package) {
     $prevEAP = $ErrorActionPreference
     $ErrorActionPreference = 'Continue'
@@ -118,15 +132,15 @@ Invoke-Phase "3/8 Fusion module tests" {
 
 Invoke-Phase "4/8 Frontend unit tests (Vitest)" {
     Push-Location (Join-Path $Root "server\web")
-    if (-not (Test-Path "node_modules")) { npm install --silent }
+    if (-not (Test-Path "node_modules")) { Invoke-Npm @("install", "--silent") }
-    npm test
+    Invoke-Npm @("test")
     Pop-Location
 }
 
 if (-not $SkipBuild) {
     Invoke-Phase "5/8 Frontend production build" {
         Push-Location (Join-Path $Root "server\web")
-        npm run build
+        Invoke-Npm @("run", "build")
         Pop-Location
     }
 

server/internal/api/websocket_test.go

@@ -80,8 +80,11 @@ func authAgentConn(t *testing.T, conn *websocket.Conn, payload map[string]interf
 		if err := conn.ReadJSON(&resp); err != nil {
 			t.Fatalf("read auth_response: %v", err)
 		}
-		if resp.Type == "auth_response" {
+		switch resp.Type {
+		case "auth_response":
 			return resp
+		case "clearance_update", "command", "policy_update", "new_job", "adaptive_strategy_update":
+			continue
 		}
 	}
 	t.Fatal("timed out waiting for auth_response")