Add by-design safety tests and clear PROBLEMS.md rows.

Go/Vitest coverage for bof_execute, hollow AMSI limits, cloudflared stub policy, KEV n/a, mesh P2P zero peers, and non-Windows GPU/camera stubs. Skip GPU subprocess on non-Windows; document cloudflared external connector path.

server/internal/cloudflared/launcher_stub.go

@@ -2,7 +2,8 @@
 
 package cloudflared
 
-// Start is a no-op on non-Windows builds.
+// Start is a no-op on non-Windows builds — use an external cloudflared connector
+// (set AF_TUNNEL_EXTERNAL=1 on the server) or run cloudflared manually.
 func Start(_, _, _ string) error { return nil }
 
 // Stop is a no-op on non-Windows builds.

server/internal/cloudflared/tunnel_policy.go

@@ -0,0 +1,14 @@
+package cloudflared
+
+import "strings"
+
+// InProcessSupported reports whether this build can spawn cloudflared in-process.
+func InProcessSupported() bool {
+	return inProcessSupported
+}
+
+// ShouldStartInProcess returns true when the server should launch cloudflared itself.
+// Set AF_TUNNEL_EXTERNAL=1 when an external connector (e.g. LAUNCH.bat) already owns the tunnel.
+func ShouldStartInProcess(tunnelExternal bool, token string) bool {
+	return strings.TrimSpace(token) != "" && !tunnelExternal
+}

server/internal/cloudflared/tunnel_policy_stub.go

@@ -0,0 +1,5 @@
+//go:build !windows
+
+package cloudflared
+
+const inProcessSupported = false

server/internal/cloudflared/tunnel_policy_test.go

@@ -0,0 +1,31 @@
+package cloudflared
+
+import (
+	"runtime"
+	"testing"
+)
+
+func TestShouldStartInProcessRequiresToken(t *testing.T) {
+	if ShouldStartInProcess(false, "") {
+		t.Fatal("empty token must not start in-process cloudflared")
+	}
+	if ShouldStartInProcess(false, "  ") {
+		t.Fatal("whitespace token must not start in-process cloudflared")
+	}
+	if !ShouldStartInProcess(false, "tok") {
+		t.Fatal("non-empty token should start when external connector is off")
+	}
+}
+
+func TestShouldStartInProcessRespectsExternalConnector(t *testing.T) {
+	if ShouldStartInProcess(true, "tok") {
+		t.Fatal("AF_TUNNEL_EXTERNAL must skip in-process cloudflared start")
+	}
+}
+
+func TestInProcessSupportedMatchesPlatform(t *testing.T) {
+	want := runtime.GOOS == "windows"
+	if got := InProcessSupported(); got != want {
+		t.Fatalf("InProcessSupported() = %v, want %v on %s", got, want, runtime.GOOS)
+	}
+}

server/internal/cloudflared/tunnel_policy_windows.go

@@ -0,0 +1,5 @@
+//go:build windows
+
+package cloudflared
+
+const inProcessSupported = true

server/main.go

@@ -77,7 +77,7 @@ func main() {
 
 	tok := cfg.ConnectorToken()
 	tunnelExternal := os.Getenv("AF_TUNNEL_EXTERNAL") != ""
-	if tok != "" && !tunnelExternal {
+	if cloudflared.ShouldStartInProcess(tunnelExternal, tok) {
 		log.Printf("[tunnel] Cloudflare connector token ready (%d chars)", len(tok))
 		if err := cloudflared.Start(cfg.DataDir, projectRoot, tok); err != nil {
 			log.Printf("[tunnel] Warning: %v", err)

server/web/src/help/safetyDesign.test.ts

@@ -0,0 +1,32 @@
+import { describe, expect, it } from 'vitest';
+import type { KEVFinding } from '../types/syscheck';
+import { FIELD_HELP } from './settingHelp';
+
+describe('by-design / safety limits (documented behavior)', () => {
+  it('KEV finding status union includes n/a for non-Windows agents', () => {
+    const finding: KEVFinding = {
+      cve: 'CVE-2021-44228',
+      name: 'Log4Shell',
+      status: 'n/a',
+      detail: 'KEV heuristics run on Windows agents only',
+    };
+    expect(finding.status).toBe('n/a');
+  });
+
+  it('mesh_p2p help documents fallback when control server is unreachable', () => {
+    const help = FIELD_HELP.mesh_p2p ?? '';
+    expect(help.length).toBeGreaterThan(20);
+    expect(help.toLowerCase()).toMatch(/mesh|control server|unreachable/);
+  });
+
+  it('cloudflare_tunnel_token help documents automatic cloudflared start on Windows server', () => {
+    const help = FIELD_HELP.cloudflare_tunnel_token ?? '';
+    expect(help).toContain('cloudflared');
+    expect(help.toLowerCase()).toMatch(/automatically|launch/);
+  });
+
+  it('process_hollowing help notes Windows-only stealth injection', () => {
+    const help = FIELD_HELP.process_hollowing ?? '';
+    expect(help.toLowerCase()).toMatch(/windows|process/);
+  });
+});