Add Recon and SubnetRecon mega-test gates after parallel landings.

Wire focused Go/Vitest/E2E slices in test-suite.ps1 and refresh README/PROBLEMS counts for deploy and subnet recon.

PROBLEMS.md

@@ -4,7 +4,7 @@ Open issues only. Fixed items removed. Last sweep: 2026-06-07.
 
 ## No open code issues
 
-Automatable gaps are closed; remaining items below are by-design limits, architecture deferrals, or manual/live operator work. Regression tables and counts: Go server **901**, agent **657**, Vitest **849**, Playwright **26** — see `tests/README.md`.
+Automatable gaps are closed; remaining items below are by-design limits, architecture deferrals, or manual/live operator work. Regression tables and counts: Go server **1001**, agent **680**, Vitest **867**, Playwright **32** — see `tests/README.md`.
 
 ## By design / safety
 
@@ -89,6 +89,9 @@ Automatable gaps are closed; remaining items below are by-design limits, archite
 | **Cloud venue on live EC2** | IMDS tag inference tested with inject; real `g4dn`/spot/batch labels need AWS instances. |
 | **Onion contingency LLM invoke** | Deterministic persona branch compose in CI; live court LLM on every exhaust tick not automated. |
 | **P2 spread lanes (manual only)** | Live Docker/Podman start; real WinRM/GPO/systemd/crontab on remote hosts; live BITS/curl; live multi-hop discover→spread without Playwright stub. |
+| **Deploy Recon port scan / crawl** | TCP port dial and same-origin HTTP crawl execute on the **dashboard host** (Go server), not from fleet agents. Firewall path must allow the server to reach the owned target. |
+| **Deploy Recon SSRF** | UI copies SSRF probe URLs; **no automated form submit** — operator pastes probe URL into owned target fields manually to validate server-side fetch to install.sh. |
+
 ## Do not commit
 
 - `data/login-credentials.json`, `data/users.json`, and other local secrets.

scripts/test-suite.ps1

@@ -1,9 +1,11 @@
-# AetherForge - full test suite runner
+# AetherForge - full test suite runner
 param(
     [switch]$SkipE2E,
     [switch]$SkipBuild,
     [switch]$Verbose,
     [switch]$ReconOnly,
+    [switch]$Recon,
+    [switch]$SubnetRecon,
     [switch]$P2,
     [switch]$S3Swarm,
     [switch]$CloudMap,
@@ -248,6 +250,70 @@ if ($P2) {
     Write-Host "  P2-only run complete (run full suite phase 8 for Playwright E2E)" -ForegroundColor Green
     exit 0
 }
+
+if ($SubnetRecon) {
+    Invoke-Phase "Subnet recon (LAN sweep + fleet discoveries)" {
+        Push-Location (Join-Path $Root "agent")
+        go test ./client/... ./config/... -run SubnetRecon -count=1
+        go test ./deploy/... -run SubnetRecon -count=1
+        Pop-Location
+        Push-Location (Join-Path $Root "server\web")
+        if (-not (Test-Path "node_modules")) { npm install --silent }
+        npm run test -- --run src/help/fleetDiscoveries.test.ts
+        Pop-Location
+    }
+    Exit-FeatureRun "SubnetRecon"
+}
+if ($Recon) {
+    Invoke-Phase "Deploy recon (engine + API + UI)" {
+        Push-Location (Join-Path $Root "server")
+        go test ./internal/recon/... -count=1
+        go test ./internal/api/... -run "Recon|DeployKit|FleetSpread" -count=1
+        Pop-Location
+        Push-Location (Join-Path $Root "server\web")
+        if (-not (Test-Path "node_modules")) { npm install --silent }
+        npm run test -- --run src/help/deployRecon.test.ts src/help/fleetDiscoveries.test.ts src/pages/DeployReconPage.test.tsx src/help/reconRisk.test.ts src/components/Fleet/ReconBadges.test.tsx src/components/Fleet/CrucibleExpandedOps.test.tsx
+        Pop-Location
+    }
+    if (-not $SkipE2E) {
+        Invoke-Phase "Deploy recon E2E smoke (Playwright)" {
+            $DataDir = Join-Path $env:TEMP ("aether-recon-e2e-" + [guid]::NewGuid().ToString("n"))
+            New-Item -ItemType Directory -Force -Path $DataDir | Out-Null
+            $E2EUser = if ($env:AETHERFORGE_E2E_USER) { $env:AETHERFORGE_E2E_USER } else { "testuser" }
+            $E2EPass = if ($env:AETHERFORGE_E2E_PASS) { $env:AETHERFORGE_E2E_PASS } else { "testpass" }
+            [System.IO.File]::WriteAllText((Join-Path $DataDir "users.json"), (@{ $E2EUser = $E2EPass } | ConvertTo-Json -Compress))
+            $ServerExe = Join-Path $Root "bin\miner-server.exe"
+            if (-not (Test-Path $ServerExe)) {
+                Push-Location (Join-Path $Root "server")
+                go build -o $ServerExe .
+                Pop-Location
+            }
+            $env:AETHERFORGE_E2E = "1"
+            $proc = Start-Process -FilePath $ServerExe -ArgumentList "-port","18989","-data",$DataDir -WorkingDirectory $Root -PassThru -WindowStyle Hidden
+            try {
+                $ready = $false
+                for ($i = 0; $i -lt 30; $i++) {
+                    try {
+                        $r = Invoke-RestMethod "http://127.0.0.1:18989/api/v1/health" -TimeoutSec 2
+                        if ($r.status -eq "ok") { $ready = $true; break }
+                    } catch {}
+                    Start-Sleep -Seconds 1
+                }
+                if (-not $ready) { throw "recon E2E server not healthy on :18989" }
+                Push-Location (Join-Path $Root "server\web")
+                $env:AETHERFORGE_URL = "http://127.0.0.1:18989"
+                npx playwright test e2e/deploy-recon.spec.ts --config playwright.config.ts
+                if ($LASTEXITCODE -and $LASTEXITCODE -ne 0) { throw "deploy-recon E2E failed (exit $LASTEXITCODE)" }
+                Pop-Location
+            } finally {
+                if ($proc -and -not $proc.HasExited) { Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue }
+                Remove-Item $DataDir -Recurse -Force -ErrorAction SilentlyContinue
+            }
+        }
+    }
+    Exit-FeatureRun "Recon"
+}
+
 if ($ReconOnly) {
     Invoke-Phase "Fleet recon (focused)" {
         Push-Location (Join-Path $Root "server")
@@ -270,6 +336,22 @@ if ($ReconOnly) {
     exit 0
 }
 
+if ($Recon) {
+    Invoke-Phase "Deploy Recon (browser spread)" {
+        Push-Location (Join-Path $Root "server")
+        Invoke-GoTest "./internal/recon/..."
+        go test ./internal/api/... -run "^(TestReconScan|TestGetDeployKit|TestResolveRecon)" -count=1
+        if ($LASTEXITCODE -and $LASTEXITCODE -ne 0) { throw "api deploy-recon tests failed (exit $LASTEXITCODE)" }
+        Pop-Location
+        Push-Location (Join-Path $Root "server\web")
+        if (-not (Test-Path "node_modules")) { Invoke-Npm @("install", "--silent") }
+        Invoke-Npm @("run", "test", "--", "--run", "src/help/deployRecon.test.ts", "src/pages/DeployReconPage.test.tsx")
+        Pop-Location
+    }
+    Exit-FeatureRun "Deploy Recon"
+}
+
+
 Invoke-Phase "1/8 Go server tests" {
     Push-Location (Join-Path $Root "server")
     go test ./... -count=1

tests/README.md

@@ -1,6 +1,6 @@
 # AetherForge Test Suite
 
-**Current counts (2026-06-07):** Go server **960** `Test*` · Go agent **670** `Test*` · Vitest **849** tests in **109** files · Playwright **26** tests in **9** spec files. Refresh: `go test ./... -list .` (server/agent), `npm run test -- --run` (Vitest), `npx playwright test --list` (E2E). Full suite: `test.bat` → `scripts/test-suite.ps1`.
+**Current counts (2026-06-07):** Go server **1001** `Test*` · Go agent **680** `Test*` · Vitest **867** tests in **113** files · Playwright **32** tests in **10** spec files. Refresh: `go test ./... -list .` (server/agent), `npm run test -- --run` (Vitest), `npx playwright test --list` (E2E). Full suite: `test.bat` → `scripts/test-suite.ps1`.
 
 ## Master validation (operator commands)
 
@@ -16,6 +16,8 @@ After parallel agent landings, run from repo root:
 | **Fast slice** | `.\scripts\test-suite.ps1 -SkipE2E -SkipBuild` | 1–4 only (Go + Vitest) |
 | **P2 focused** | `.\scripts\test-suite.ps1 -P2` | Mining/spread/path-forge/WS subset + Vitest; add phase 8 manually for onion + discover E2E |
 | **Fleet recon** | `.\scripts\test-suite.ps1 -ReconOnly` | Vuln/CVE, cred graph, triple-onion gates, Path Tracer discover, recon Vitest |
+| **Deploy Recon** | `.\scripts\test-suite.ps1 -Recon` | `internal/recon`, recon API + deploy-kit, Deploy Recon Vitest + `deploy-recon.spec.ts` E2E (unless `-SkipE2E`) |
+| **Subnet recon** | `.\scripts\test-suite.ps1 -SubnetRecon` | Agent subnet_recon packages + `fleetDiscoveries` Vitest |
 
 Feature slices (single-feature regression after parallel agent landings; each exits after its phase):