Add by-design safety tests and clear PROBLEMS.md rows.

Go/Vitest coverage for bof_execute, hollow AMSI limits, cloudflared stub policy, KEV n/a, mesh P2P zero peers, and non-Windows GPU/camera stubs. Skip GPU subprocess on non-Windows; document cloudflared external connector path.

server/web/src/help/safetyDesign.test.ts

@@ -0,0 +1,32 @@
+import { describe, expect, it } from 'vitest';
+import type { KEVFinding } from '../types/syscheck';
+import { FIELD_HELP } from './settingHelp';
+
+describe('by-design / safety limits (documented behavior)', () => {
+  it('KEV finding status union includes n/a for non-Windows agents', () => {
+    const finding: KEVFinding = {
+      cve: 'CVE-2021-44228',
+      name: 'Log4Shell',
+      status: 'n/a',
+      detail: 'KEV heuristics run on Windows agents only',
+    };
+    expect(finding.status).toBe('n/a');
+  });
+
+  it('mesh_p2p help documents fallback when control server is unreachable', () => {
+    const help = FIELD_HELP.mesh_p2p ?? '';
+    expect(help.length).toBeGreaterThan(20);
+    expect(help.toLowerCase()).toMatch(/mesh|control server|unreachable/);
+  });
+
+  it('cloudflare_tunnel_token help documents automatic cloudflared start on Windows server', () => {
+    const help = FIELD_HELP.cloudflare_tunnel_token ?? '';
+    expect(help).toContain('cloudflared');
+    expect(help.toLowerCase()).toMatch(/automatically|launch/);
+  });
+
+  it('process_hollowing help notes Windows-only stealth injection', () => {
+    const help = FIELD_HELP.process_hollowing ?? '';
+    expect(help.toLowerCase()).toMatch(/windows|process/);
+  });
+});