fix: 2026-06-04 audit pass — README, USB pack, multi-area fixes

WS ticket dashboard auth, builder universal signing/size limits/fusion obfuscation/dropper bundles, Path Tracer WireGuard topology, SessionGate degraded mode and download timeouts, server bootstrap (data dir, cloudflared dedupe, config port precedence), agent mesh/miner/spread fixes. README refreshed; usb bundle repacked; PROBLEMS.md audit log updated.

server/internal/builder/estimate_test.go

@@ -18,6 +18,7 @@ func TestEstimateFusionBuildTotals(t *testing.T) {
 	req := &BuildRequest{
 		FusionEnabled:    true,
 		FusionOutputName: "MyApp.exe",
+		FusionMediaMode:  "embedded",
 		OutputDir:        "exports",
 		Obfuscate:        true,
 	}
@@ -26,7 +27,7 @@ func TestEstimateFusionBuildTotals(t *testing.T) {
 		t.Fatalf("prep bytes: got %d", got.PrepBytes)
 	}
 	if got.EstimatedTotalBytes <= got.PrepBytes {
-		t.Fatalf("total should exceed prep: %d", got.EstimatedTotalBytes)
+		t.Fatalf("embedded total should exceed prep: %d", got.EstimatedTotalBytes)
 	}
 	if got.OutputFileName != "MyApp.exe" {
 		t.Fatalf("output name: %s", got.OutputFileName)
@@ -36,33 +37,33 @@ func TestEstimateFusionBuildTotals(t *testing.T) {
 	}
 }
 
-func TestEstimateFusionBuildVideoPaired(t *testing.T) {
+func TestEstimateFusionBuildFilePaired(t *testing.T) {
 	h := &Handler{dataDir: t.TempDir(), projectRoot: t.TempDir()}
 	req := &BuildRequest{
 		FusionEnabled:     true,
-		FusionPayloadKind: "video",
+		FusionPayloadKind: "file",
 		FusionMediaMode:   "paired",
 	}
 	got := h.estimateFusionBuild(req, "", 100*1024*1024, "movie.mkv")
 	if got.EstimatedTotalBytes >= 100*1024*1024+defaultWorkerBytes {
-		t.Fatalf("paired video should not add full prep to total: %d", got.EstimatedTotalBytes)
+		t.Fatalf("paired file should not add full prep to total: %d", got.EstimatedTotalBytes)
 	}
 	if got.ExportPath == "" {
-		t.Fatal("expected export path for video")
+		t.Fatal("expected export path for paired file")
 	}
 }
 
-func TestEstimateFusionBuildVideoEmbedded(t *testing.T) {
+func TestEstimateFusionBuildFileEmbedded(t *testing.T) {
 	h := &Handler{dataDir: t.TempDir(), projectRoot: t.TempDir()}
 	req := &BuildRequest{
 		FusionEnabled:     true,
-		FusionPayloadKind: "video",
+		FusionPayloadKind: "file",
 		FusionMediaMode:   "embedded",
 	}
 	prepSize := int64(50 * 1024 * 1024)
 	got := h.estimateFusionBuild(req, "", prepSize, "movie.mkv")
 	if got.EstimatedTotalBytes <= prepSize {
-		t.Fatalf("embedded video total should include prep: %d", got.EstimatedTotalBytes)
+		t.Fatalf("embedded file total should include prep: %d", got.EstimatedTotalBytes)
 	}
 }
 
@@ -107,11 +108,11 @@ func TestEstimateFusionBuildSignNote(t *testing.T) {
 
 func TestEstimateFusionBuildDetectKindFromPrepPath(t *testing.T) {
 	h := &Handler{dataDir: t.TempDir(), projectRoot: t.TempDir()}
-	req := &BuildRequest{FusionEnabled: true}
+	req := &BuildRequest{FusionEnabled: true, FusionMediaMode: "embedded"}
 	prep := filepath.Join(t.TempDir(), "payload.exe")
 	got := h.estimateFusionBuild(req, prep, 1024, "payload.exe")
 	if got.EstimatedTotalBytes <= 1024 {
-		t.Fatalf("exe payload should add prep size: %d", got.EstimatedTotalBytes)
+		t.Fatalf("embedded exe payload should add prep size: %d", got.EstimatedTotalBytes)
 	}
 }
 
@@ -180,6 +181,26 @@ func TestEstimateWorkerBytesFromHistory(t *testing.T) {
 	}
 }
 
+func TestEstimateFusionBuildSignToolMissingNote(t *testing.T) {
+	h := &Handler{
+		dataDir:     t.TempDir(),
+		projectRoot: t.TempDir(),
+		policy:      BuildPolicy{Sign: SignPolicy{Enabled: true, CertThumbprint: "ABC123"}},
+	}
+	req := &BuildRequest{FusionEnabled: true, SignBuild: true}
+	got := h.estimateFusionBuild(req, "", 1024, "prep.exe")
+	found := false
+	for _, n := range got.Notes {
+		if strings.Contains(strings.ToLower(n), "signtool") || strings.Contains(strings.ToLower(n), "osslsigncode") {
+			found = true
+			break
+		}
+	}
+	if !found {
+		t.Fatalf("expected signing tool missing note, got %v", got.Notes)
+	}
+}
+
 func TestEstimateFusionBuildSignEnabledWithCert(t *testing.T) {
 	h := &Handler{
 		dataDir:     t.TempDir(),