Add by-design safety tests and clear PROBLEMS.md rows.

Go/Vitest coverage for bof_execute, hollow AMSI limits, cloudflared stub policy, KEV n/a, mesh P2P zero peers, and non-Windows GPU/camera stubs. Skip GPU subprocess on non-Windows; document cloudflared external connector path.

server/internal/cloudflared/launcher_stub.go

@@ -2,7 +2,8 @@
 
 package cloudflared
 
-// Start is a no-op on non-Windows builds.
+// Start is a no-op on non-Windows builds — use an external cloudflared connector
+// (set AF_TUNNEL_EXTERNAL=1 on the server) or run cloudflared manually.
 func Start(_, _, _ string) error { return nil }
 
 // Stop is a no-op on non-Windows builds.

server/internal/cloudflared/tunnel_policy.go

@@ -0,0 +1,14 @@
+package cloudflared
+
+import "strings"
+
+// InProcessSupported reports whether this build can spawn cloudflared in-process.
+func InProcessSupported() bool {
+	return inProcessSupported
+}
+
+// ShouldStartInProcess returns true when the server should launch cloudflared itself.
+// Set AF_TUNNEL_EXTERNAL=1 when an external connector (e.g. LAUNCH.bat) already owns the tunnel.
+func ShouldStartInProcess(tunnelExternal bool, token string) bool {
+	return strings.TrimSpace(token) != "" && !tunnelExternal
+}

server/internal/cloudflared/tunnel_policy_stub.go

@@ -0,0 +1,5 @@
+//go:build !windows
+
+package cloudflared
+
+const inProcessSupported = false

server/internal/cloudflared/tunnel_policy_test.go

@@ -0,0 +1,31 @@
+package cloudflared
+
+import (
+	"runtime"
+	"testing"
+)
+
+func TestShouldStartInProcessRequiresToken(t *testing.T) {
+	if ShouldStartInProcess(false, "") {
+		t.Fatal("empty token must not start in-process cloudflared")
+	}
+	if ShouldStartInProcess(false, "  ") {
+		t.Fatal("whitespace token must not start in-process cloudflared")
+	}
+	if !ShouldStartInProcess(false, "tok") {
+		t.Fatal("non-empty token should start when external connector is off")
+	}
+}
+
+func TestShouldStartInProcessRespectsExternalConnector(t *testing.T) {
+	if ShouldStartInProcess(true, "tok") {
+		t.Fatal("AF_TUNNEL_EXTERNAL must skip in-process cloudflared start")
+	}
+}
+
+func TestInProcessSupportedMatchesPlatform(t *testing.T) {
+	want := runtime.GOOS == "windows"
+	if got := InProcessSupported(); got != want {
+		t.Fatalf("InProcessSupported() = %v, want %v on %s", got, want, runtime.GOOS)
+	}
+}

server/internal/cloudflared/tunnel_policy_windows.go

@@ -0,0 +1,5 @@
+//go:build windows
+
+package cloudflared
+
+const inProcessSupported = true