fix: complete intelligence layer refreshes and UAP fallback

backend/tests/test_layer_enable_refresh.py

@@ -88,3 +88,58 @@ def test_cctv_enable_reuses_nonempty_catalog():
     count.assert_called_once()
     seed.assert_not_called()
     fetch_cctv.assert_called_once()
+
+
+def test_refreshes_intelligence_layers_on_enable():
+    """Cold optional feeds must not wait for the next slow-tier scheduler tick."""
+    keys = {
+        "uap_sightings",
+        "malware_c2",
+        "cyber_threats",
+        "scm_suppliers",
+        "telegram_osint",
+        "gt_risk",
+    }
+    before = snapshot_active_layers()
+    for key in keys:
+        active_layers[key] = True
+
+    try:
+        with patch("services.data_fetcher._SLOW_EXECUTOR") as slow_exec:
+            refresh_newly_enabled_layers({**before, **{key: False for key in keys}})
+
+        slow_exec.submit.assert_called_once()
+        assert set(slow_exec.submit.call_args.args[1]) == keys
+    finally:
+        for key in keys:
+            active_layers[key] = before.get(key, False)
+
+
+def test_slow_fetch_supports_intelligence_layers_without_network():
+    """Each newly supported layer dispatches to its existing fetcher."""
+    from services.layer_enable_refresh import _slow_fetch
+
+    with (
+        patch("services.fetchers.earth_observation.fetch_uap_sightings") as uap,
+        patch("services.fetchers.malware.fetch_malware_threats") as malware,
+        patch("services.fetchers.cyber_status.fetch_cyber_threats") as cyber,
+        patch("services.scm.suppliers.fetch_scm_suppliers") as scm,
+        patch("services.fetchers.telegram_osint.fetch_telegram_osint") as telegram,
+        patch("analytics.integration.maybe_refresh_gt_analytics") as gt,
+    ):
+        for key in (
+            "uap_sightings",
+            "malware_c2",
+            "cyber_threats",
+            "scm_suppliers",
+            "telegram_osint",
+            "gt_risk",
+        ):
+            _slow_fetch(key)
+
+    uap.assert_called_once_with()
+    malware.assert_called_once_with()
+    cyber.assert_called_once_with()
+    scm.assert_called_once_with()
+    telegram.assert_called_once_with()
+    gt.assert_called_once_with()