Final sweep: Crucible fixes, Path Tracer polish, forge progress, tests green.

Align dashboard subtitle default and UpsertAgent tests with fleet label behavior; WebSocket coalesce and PathForge hardening; Crucible expanded ops and visual DV fixes; Vitest 610/610 and full test-suite pass; trim PROBLEMS.md to open items only.

agent/client/client.go

@@ -649,7 +649,11 @@ func (c *AgentClient) sendCommandResult(action string, success bool, message str
 		c.postBeaconResult(payload)
 		return
 	}
-	_ = c.write(Message{Type: "command_result", Payload: payload})
+	// If the WebSocket write fails (stalled connection, reconnecting, etc.) fall
+	// back to the beacon HTTP path so the result is not silently dropped.
+	if err := c.write(Message{Type: "command_result", Payload: payload}); err != nil {
+		c.postBeaconResult(payload)
+	}
 }
 
 func (c *AgentClient) wsDownSinceTime() time.Time {

agent/client/pathtracer_stub_test.go

@@ -0,0 +1,77 @@
+//go:build !windows
+
+package client
+
+import (
+	"encoding/json"
+	"testing"
+)
+
+// TestWGSetupJSONReturnsError verifies that the non-Windows stub returns a
+// JSON error payload indicating WireGuard is not available on this platform.
+func TestWGSetupJSONReturnsError(t *testing.T) {
+	raw := WGSetupJSON()
+	if raw == "" {
+		t.Fatal("WGSetupJSON returned empty string")
+	}
+
+	var result WGSetupResult
+	if err := json.Unmarshal([]byte(raw), &result); err != nil {
+		t.Fatalf("WGSetupJSON returned invalid JSON: %v", err)
+	}
+
+	if result.Error == "" {
+		t.Error("WGSetupJSON stub must return a non-empty error field on non-Windows")
+	}
+
+	// Sanity-check: no real public key or port should be populated.
+	if result.PublicKey != "" {
+		t.Errorf("expected empty PublicKey in stub, got %q", result.PublicKey)
+	}
+	if result.ExternalPort != 0 {
+		t.Errorf("expected ExternalPort=0 in stub, got %d", result.ExternalPort)
+	}
+}
+
+// TestWGConfigureNoOp verifies that WGConfigure is a no-op on non-Windows.
+func TestWGConfigureNoOp(t *testing.T) {
+	payload := WGConfigPayload{
+		SessionID:    "test-session",
+		PrivateKey:   "privkey",
+		LocalAddress: "10.0.0.1/32",
+		ListenPort:   51820,
+		Peers: []WGPeerEntry{
+			{
+				PublicKey:           "peerkey",
+				Endpoint:            "1.2.3.4:51820",
+				AllowedIPs:          "0.0.0.0/0",
+				PersistentKeepalive: 25,
+			},
+		},
+		EnableIPForwarding: false,
+	}
+	if err := WGConfigure(payload); err != nil {
+		t.Errorf("WGConfigure stub must return nil, got: %v", err)
+	}
+}
+
+// TestWGTeardownNoOp verifies WGTeardown does not panic or error on non-Windows.
+func TestWGTeardownNoOp(t *testing.T) {
+	// Should complete without panic.
+	WGTeardown()
+}
+
+// TestWGIsActiveReturnsFalse ensures the stub correctly reports inactive.
+func TestWGIsActiveReturnsFalse(t *testing.T) {
+	if WGIsActive() {
+		t.Error("WGIsActive stub must return false on non-Windows")
+	}
+}
+
+// TestWGStatusNotSupported verifies the stub reports an unsupported-platform message.
+func TestWGStatusNotSupported(t *testing.T) {
+	status := WGStatus()
+	if status == "" {
+		t.Error("WGStatus stub must return a non-empty string")
+	}
+}