@flop-labs/cli 0.4.3 → 0.5.0

package/dist/cli.js

@@ -402,12 +402,12 @@ var init_state = __esm({
         return computeChecksum(snapshotData);
       }
       /** Transition to a new lifecycle state. */
-      transitionTo(state, reason2) {
+      transitionTo(state, reason3) {
         this.data.lifecycle.state = state;
         this.data.lifecycle.stateChangedAt = Date.now();
         this.data.lifecycle.lastActiveAt = Date.now();
-        if (reason2) {
-          this.data.lifecycle.terminationReason = reason2;
+        if (reason3) {
+          this.data.lifecycle.terminationReason = reason3;
         }
         this.data.checksum = this.computeChecksumInternal();
       }
@@ -724,14 +724,14 @@ var init_task_runner = __esm({
         }
       }
       withTimeout(promise, timeoutMs) {
-        return new Promise((resolve10, reject) => {
+        return new Promise((resolve11, reject) => {
           const timer = setTimeout(
             () => reject(new AgentError("T002" /* TASK_TIMEOUT */, `Task timed out after ${timeoutMs}ms`, true)),
             timeoutMs
           );
           promise.then((result) => {
             clearTimeout(timer);
-            resolve10(result);
+            resolve11(result);
           }).catch((err) => {
             clearTimeout(timer);
             reject(err);
@@ -739,7 +739,7 @@ var init_task_runner = __esm({
         });
       }
       sleep(ms) {
-        return new Promise((resolve10) => setTimeout(resolve10, ms));
+        return new Promise((resolve11) => setTimeout(resolve11, ms));
       }
     };
   }
@@ -829,10 +829,10 @@ var init_worker = __esm({
         await this.processLoop(options.api, options.signer);
       }
       /** Request graceful shutdown. */
-      async stop(reason2) {
+      async stop(reason3) {
         this.stopRequested = true;
-        this.state.transitionTo("draining", reason2);
-        this.logger.info("Shutdown requested", { reason: reason2 });
+        this.state.transitionTo("draining", reason3);
+        this.logger.info("Shutdown requested", { reason: reason3 });
       }
       /** Main processing loop. */
       async processLoop(api, signer) {
@@ -904,7 +904,7 @@ var init_worker = __esm({
         return this.identity;
       }
       sleep(ms) {
-        return new Promise((resolve10) => setTimeout(resolve10, ms));
+        return new Promise((resolve11) => setTimeout(resolve11, ms));
       }
     };
   }
@@ -912,10 +912,10 @@ var init_worker = __esm({
 
 // ../agent/src/chain-apis.ts
 async function submitTx(tx, signer) {
-  return new Promise((resolve10, reject) => {
+  return new Promise((resolve11, reject) => {
     tx.signAndSend(signer, ({ status, dispatchError }) => {
       if (dispatchError) reject(new Error(`Tx failed: ${dispatchError.toString()}`));
-      else if (status.isInBlock || status.isFinalized) resolve10(status.asFinalized.toString());
+      else if (status.isInBlock || status.isFinalized) resolve11(status.asFinalized.toString());
     }).catch(reject);
   });
 }
@@ -1219,7 +1219,7 @@ async function waitForTaskCompletion(api, taskId, timeoutMs = DEFAULT_TIMEOUT, p
         return receipt;
       }
     }
-    await new Promise((resolve10) => setTimeout(resolve10, pollIntervalMs));
+    await new Promise((resolve11) => setTimeout(resolve11, pollIntervalMs));
   }
   throw new AgentError(
     "T002" /* TASK_TIMEOUT */,
@@ -1657,18 +1657,18 @@ var init_fee_estimation = __esm({
         const outOfBudget = candidates.filter((m) => !affordable.has(m.hash)).map((m) => ({ model: m, fee: feeMap.get(m.hash) }));
         const selectedModel = selected ?? candidates[0];
         const estimatedFee = feeMap.get(selectedModel.hash);
-        let reason2;
+        let reason3;
         if (selected) {
-          reason2 = preferBestValue ? `Best value model within ${maxBudget} FLOP budget` : `Highest quality model within ${maxBudget} FLOP budget`;
+          reason3 = preferBestValue ? `Best value model within ${maxBudget} FLOP budget` : `Highest quality model within ${maxBudget} FLOP budget`;
         } else {
-          reason2 = `Best available model (cheapest) \u2014 all options exceed ${maxBudget} FLOP budget`;
+          reason3 = `Best available model (cheapest) \u2014 all options exceed ${maxBudget} FLOP budget`;
         }
         return {
           selectedModel,
           estimatedFee,
           alternatives,
           outOfBudget,
-          reason: reason2
+          reason: reason3
         };
       }
       /**
@@ -1819,69 +1819,13 @@ import { Keyring as Keyring3 } from "@polkadot/keyring";
 import { cryptoWaitReady as cryptoWaitReady3, randomAsHex } from "@polkadot/util-crypto";
 import {
   FLOP_NETWORK_PROFILES,
-  DEFAULT_FAUCET_AMOUNT as SDK_DEFAULT_FAUCET_AMOUNT
+  DEFAULT_FAUCET_AMOUNT as SDK_DEFAULT_FAUCET_AMOUNT,
+  fundFromFaucetDetailed,
+  FaucetUnconfirmedError
 } from "@flop-labs/sdk";
 function isFaucetAvailable(network) {
   return FAUCET_ENDPOINTS[network] !== null;
 }
-async function requestFaucetFunding(address, network, timeout = 3e4, referral) {
-  const endpoint = FAUCET_ENDPOINTS[network];
-  if (!endpoint) {
-    return {
-      success: false,
-      error: `No faucet available for network: ${network}`
-    };
-  }
-  try {
-    const response = await fetch(`${endpoint}/fund`, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json"
-      },
-      body: JSON.stringify({
-        address,
-        amount: DEFAULT_FAUCET_AMOUNT,
-        ...referral === void 0 ? {} : { ref: referral, source: "sdk" }
-      }),
-      signal: AbortSignal.timeout(timeout)
-    });
-    if (!response.ok) {
-      const errorText = await response.text();
-      return {
-        success: false,
-        error: `Faucet request failed: ${response.status} - ${errorText}`
-      };
-    }
-    const data = await response.json();
-    return {
-      success: true,
-      amount: data.amount ?? DEFAULT_FAUCET_AMOUNT,
-      txHash: data.txHash
-    };
-  } catch (error) {
-    return {
-      success: false,
-      error: error instanceof Error ? error.message : String(error)
-    };
-  }
-}
-async function waitForBalance(api, address, minBalance, timeoutMs = 6e4) {
-  const deadline = Date.now() + timeoutMs;
-  const pollInterval = 2e3;
-  while (Date.now() < deadline) {
-    try {
-      const accountInfo = await api.query.system.account(address);
-      const data = accountInfo.data;
-      const freeBalance = BigInt(data.free.toString());
-      if (freeBalance >= minBalance) {
-        return true;
-      }
-    } catch {
-    }
-    await new Promise((resolve10) => setTimeout(resolve10, pollInterval));
-  }
-  return false;
-}
 async function getBalance(api, address) {
   const accountInfo = await api.query.system.account(address);
   const data = accountInfo.data;
@@ -2001,9 +1945,9 @@ var init_quickstart = __esm({
       /**
        * Stop the agent worker gracefully.
        */
-      async stop(reason2) {
-        await this.worker.stop(reason2);
-        this.logger.info("QuickStart agent stopped", { reason: reason2 });
+      async stop(reason3) {
+        await this.worker.stop(reason3);
+        this.logger.info("QuickStart agent stopped", { reason: reason3 });
       }
       /**
        * Shutdown agent and disconnect from network.
@@ -2376,6 +2320,10 @@ var init_quickstart = __esm({
        * @returns QuickStart agent result with agent wrapper and metadata
        */
       static async create(config = {}) {
+        const shouldFaucet = config.faucet ?? (config.network ?? "devnet") === "devnet";
+        if (shouldFaucet && isFaucetAvailable(config.network ?? "devnet") && !config.keypair && !config.signerUri?.trim()) {
+          throw new Error("Faucet funding requires a caller-owned signer or keypair");
+        }
         await cryptoWaitReady3();
         const network = config.network ?? "devnet";
         const endpoint = config.rpcEndpoint ?? NETWORK_ENDPOINTS[network];
@@ -2383,15 +2331,13 @@ var init_quickstart = __esm({
         const keypair = resolveOrCreateKeypair(config);
         const api = await connectToNetwork(endpoint, timeout);
         let initialBalance = await getBalance(api, keypair.address);
-        const shouldFaucet = config.faucet ?? network === "devnet";
         if (shouldFaucet && isFaucetAvailable(network) && initialBalance < DEFAULT_FAUCET_AMOUNT) {
-          const faucetResult = await requestFaucetFunding(keypair.address, network, timeout, config.referral);
-          if (faucetResult.success) {
-            const minBalance = BigInt(Math.round((faucetResult.amount ?? DEFAULT_FAUCET_AMOUNT) * 1e18));
-            const funded = await waitForBalance(api, keypair.address, minBalance, timeout * 2);
-            if (funded) {
-              initialBalance = await getBalance(api, keypair.address);
-            }
+          const funding = await fundFromFaucetDetailed(api, keypair.address, { network, timeout, referral: config.referral });
+          if (funding.status !== "refused") {
+            const error = new FaucetUnconfirmedError(funding);
+            const cleanup = await Promise.allSettled([api.disconnect()]);
+            error.cleanupErrors = cleanup.flatMap((result) => result.status === "rejected" ? [result.reason] : []);
+            throw error;
           }
         }
         const agentId = generateAgentId();
@@ -2456,7 +2402,7 @@ var init_quickstart = __esm({
        * ```ts
        * const result = await FlopAgent.inference('Write a Python function to sort a list', {
        *   network: 'devnet',
-       *   faucet: true,
+       *   signerUri: process.env.FLOP_SIGNER_URI!, // Pre-funded, caller-owned signer
        * });
        * console.log(result.output);
        * ```
@@ -4941,9 +4887,9 @@ var init_src = __esm({
 });
 
 // src/cli.ts
-import { Command as Command49, Option as Option8 } from "commander";
+import { Command as Command51, Option as Option8 } from "commander";
 import { readFileSync as readFileSync2 } from "node:fs";
-import { join as join11 } from "node:path";
+import { join as join12 } from "node:path";
 
 // src/output.ts
 var activeOutputMode = "human";
@@ -5512,8 +5458,8 @@ function sessionListCmd() {
 import { Command as Command10, Option } from "commander";
 function parseSessionMaxFlop(value) {
   if (!/^\d+(?:\.\d{1,18})?$/.test(value)) throw new Error("--max-flop must be a positive decimal with at most 18 fractional digits");
-  const [whole, fraction = ""] = value.split(".");
-  const raw = BigInt(whole) * 10n ** 18n + BigInt(fraction.padEnd(18, "0"));
+  const [whole, fraction2 = ""] = value.split(".");
+  const raw = BigInt(whole) * 10n ** 18n + BigInt(fraction2.padEnd(18, "0"));
   if (raw <= 0n || raw >= 1n << 128n) throw new Error("--max-flop must be positive and fit the chain balance type");
   return raw;
 }
@@ -5528,6 +5474,7 @@ function sessionRunCmd() {
   return new Command10("run").description("Run verified inference directly on a named miner and settle its channel").requiredOption("--miner <ss58>", "Serving miner account").requiredOption("--model <slug>", "Model slug").requiredOption("--prompt <text>", "Prompt").requiredOption("--max-flop <N>", "Maximum escrow in FLOP").option("--max-tokens <N>", "Maximum completion tokens (SDK default: 256)").addOption(new Option("--via <path>", "Open path").choices(["auto", "offer", "force"]).default("auto")).option("--endpoint <URL>", "Reachable miner session endpoint", "http://127.0.0.1:8645").option("--auth-token-env <VAR>", "Environment variable holding the miner bearer (legacy/broker auth)").option("--new-wallet", "Save a fresh owner-only devnet wallet and fund it from the devnet faucet").option("--json", "Output as JSON").action(async (opts, command) => {
     let client;
     let walletPath;
+    let funding;
     try {
       const maxFlop = parseSessionMaxFlop(opts.maxFlop);
       const maxTokens = opts.maxTokens === void 0 ? void 0 : parseSessionMaxTokens(opts.maxTokens);
@@ -5564,9 +5511,9 @@ function sessionRunCmd() {
         client = await sdk.FlopClient.createWithKeypair(resolved.rpc, pair);
         const faucet = await sdk.getFaucetChainInfo({ endpoint: resolved.profile.faucet });
         if (faucet.genesisHash.toLowerCase() !== client.api.genesisHash.toHex().toLowerCase()) throw new Error("faucet/RPC genesis mismatch");
-        const funded = await sdk.requestFaucetFunding(pair.address, { network: "devnet", endpoint: resolved.profile.faucet, maxRetries: 1 });
-        if (!funded.success) throw new Error(funded.error ?? "devnet faucet funding failed");
-        if (!await sdk.waitForFaucetFunding(client.api, pair.address, Number(opts.maxFlop))) {
+        funding = await sdk.requestFaucetFunding(pair.address, { network: "devnet", endpoint: resolved.profile.faucet, maxRetries: 1 });
+        if (!funding.success) throw new Error(funding.error ?? "devnet faucet funding failed");
+        if (!await sdk.waitForAvailableBalance(client.api, pair.address, Number(opts.maxFlop))) {
           throw new Error("faucet balance did not arrive before the funding deadline");
         }
       } else {
@@ -5598,11 +5545,18 @@ function sessionRunCmd() {
       }, getJson(command));
     } catch (error) {
       const channelId = error && typeof error === "object" && "channelId" in error && error.channelId instanceof Uint8Array ? `0x${Buffer.from(error.channelId).toString("hex")}` : null;
+      const fundingUnknown = funding && (funding.outcome === "unknown" || funding.success);
       printError({
         code: "SESSION_FAILED",
         message: error instanceof Error ? error.message : String(error),
         channel: channelId,
-        recovery: channelId ? "inspect finalized channel and terminal events before retrying" : "no channel reported",
+        recovery: channelId ? "inspect finalized channel and terminal events before retrying" : fundingUnknown ? "funding is unconfirmed; reconcile the original request before requesting again" : "no channel reported",
+        ...funding ? { funding: {
+          outcome: fundingUnknown ? "unknown" : funding.outcome,
+          ...funding.txHash ? { txHash: funding.txHash } : {},
+          ...funding.amount !== void 0 ? { amount: funding.amount } : {},
+          ...funding.status !== void 0 ? { status: funding.status } : {}
+        } } : {},
         ...walletPath ? { wallet: walletPath } : {}
       }, "json");
       process.exitCode = 1;
@@ -6127,12 +6081,12 @@ function pathCheck(id, target, required = true) {
   };
 }
 async function probeHttpUrl(id, url, required = true, timeoutMs = 3e3) {
-  return new Promise((resolve10) => {
+  return new Promise((resolve11) => {
     let parsed;
     try {
       parsed = new URL(url);
     } catch {
-      resolve10({
+      resolve11({
         id,
         status: "fail",
         required,
@@ -6145,7 +6099,7 @@ async function probeHttpUrl(id, url, required = true, timeoutMs = 3e3) {
     const request3 = transport.request(parsed, { method: "GET", timeout: timeoutMs }, (response) => {
       response.resume();
       const reachable = (response.statusCode ?? 500) < 500;
-      resolve10({
+      resolve11({
         id,
         status: reachable ? "pass" : required ? "fail" : "warn",
         required,
@@ -6155,7 +6109,7 @@ async function probeHttpUrl(id, url, required = true, timeoutMs = 3e3) {
     });
     request3.on("timeout", () => request3.destroy(new Error("timeout")));
     request3.on("error", (error) => {
-      resolve10({
+      resolve11({
         id,
         status: required ? "fail" : "warn",
         required,
@@ -6199,7 +6153,7 @@ function unwrapStorage(raw) {
 
 // src/commands/launch.ts
 function checkGateway(url) {
-  return new Promise((resolve10) => {
+  return new Promise((resolve11) => {
     try {
       const parsedUrl = new URL(url);
       const req = http2.request(
@@ -6211,17 +6165,17 @@ function checkGateway(url) {
           timeout: 1e3
         },
         (res) => {
-          resolve10(res.statusCode === 200);
+          resolve11(res.statusCode === 200);
         }
       );
-      req.on("error", () => resolve10(false));
+      req.on("error", () => resolve11(false));
       req.on("timeout", () => {
         req.destroy();
-        resolve10(false);
+        resolve11(false);
       });
       req.end();
     } catch {
-      resolve10(false);
+      resolve11(false);
     }
   });
 }
@@ -6462,15 +6416,15 @@ function ownerOnly(mode) {
 }
 async function privateDirectory(path5) {
   await mkdir5(path5, { recursive: true, mode: 448 });
-  const stat = await lstat(path5);
-  if (!stat.isDirectory() || !ownerOnly(stat.mode) || process.getuid && stat.uid !== process.getuid()) {
+  const stat2 = await lstat(path5);
+  if (!stat2.isDirectory() || !ownerOnly(stat2.mode) || process.getuid && stat2.uid !== process.getuid()) {
     throw new Error("FLOP credential directory must be owned by this user with mode 0700");
   }
 }
 async function cachedCredential(path5, gateway) {
   try {
-    const stat = await lstat(path5);
-    if (!stat.isFile() || !ownerOnly(stat.mode) || process.getuid && stat.uid !== process.getuid()) {
+    const stat2 = await lstat(path5);
+    if (!stat2.isFile() || !ownerOnly(stat2.mode) || process.getuid && stat2.uid !== process.getuid()) {
       throw new Error("FLOP credential cache must be an owner-only regular file (mode 0600)");
     }
     const cached = JSON.parse(await readFile3(path5, "utf8"));
@@ -6529,7 +6483,7 @@ async function withCredentialLock(path5, action) {
         continue;
       }
       if (Date.now() >= deadline) throw new Error(`FLOP credential lock is busy at ${lock}`);
-      await new Promise((resolve10) => setTimeout(resolve10, 100));
+      await new Promise((resolve11) => setTimeout(resolve11, 100));
     }
   }
   try {
@@ -6551,8 +6505,8 @@ async function enrollmentWallet(path5) {
   await cryptoWaitReady4();
   const keyring = new Keyring4({ type: "sr25519", ss58Format: 42 });
   try {
-    const stat = await lstat(path5);
-    if (!stat.isFile() || !ownerOnly(stat.mode) || process.getuid && stat.uid !== process.getuid()) {
+    const stat2 = await lstat(path5);
+    if (!stat2.isFile() || !ownerOnly(stat2.mode) || process.getuid && stat2.uid !== process.getuid()) {
       throw new Error("FLOP devnet wallet must be an owner-only regular file (mode 0600)");
     }
     const stored = JSON.parse(await readFile3(path5, "utf8"));
@@ -6597,17 +6551,35 @@ function walletEnrollment(options) {
     const pair = await enrollmentWallet(options.walletPath ?? devnetWalletPath());
     const minBalance = options.minBalance ?? DEFAULT_MIN_BALANCE;
     if (await options.balance(pair.address) < minBalance) {
-      const funded = await fetch(`${options.faucet}/fund`, {
-        method: "POST",
-        headers: { "content-type": "application/json" },
-        body: JSON.stringify({ address: pair.address }),
-        signal: AbortSignal.timeout(6e4)
-      });
-      if (!funded.ok) throw await failure(funded, "devnet faucet");
+      let funded;
+      try {
+        funded = await fetch(`${options.faucet}/fund`, {
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify({ address: pair.address }),
+          signal: AbortSignal.timeout(6e4)
+        });
+      } catch {
+        throw new Error("devnet faucet outcome unknown; reconcile the original request for the saved wallet before requesting again");
+      }
+      if (!funded.ok) {
+        if (funded.status >= 500 || funded.status === 408) throw new Error("devnet faucet outcome unknown; reconcile the original request for the saved wallet before requesting again");
+        throw await failure(funded, "devnet faucet");
+      }
+      const response = await funded.json().catch(() => null);
+      const hint = typeof response?.txHash === "string" && /^0x[0-9a-f]{64}$/i.test(response.txHash) ? ` (transaction ${response.txHash})` : "";
       const deadline = Date.now() + (options.fundTimeoutMs ?? 12e4);
-      while (await options.balance(pair.address) < minBalance) {
-        if (Date.now() >= deadline) throw new Error("devnet faucet grant did not finalize in time; retry later");
-        await new Promise((resolve10) => setTimeout(resolve10, options.pollMs ?? 3e3));
+      const unconfirmed = () => new Error(`devnet balance did not reach the required floor${hint}; the faucet request is unconfirmed, reconcile it before requesting again`);
+      while (true) {
+        let available;
+        try {
+          available = await options.balance(pair.address);
+        } catch {
+          throw unconfirmed();
+        }
+        if (available >= minBalance) break;
+        if (Date.now() >= deadline) throw unconfirmed();
+        await new Promise((resolve11) => setTimeout(resolve11, options.pollMs ?? 3e3));
       }
     }
     const challenge = await fetch(
@@ -6760,8 +6732,8 @@ async function savePublicProfile(model, key) {
   const path5 = publicHermesProfilePath(model, key);
   for (const directory of [join2(homedir2(), ".flop"), publicHermesProfileRoot(), path5]) {
     await mkdir6(directory, { recursive: true, mode: 448 });
-    const stat = await lstat2(directory);
-    if (!stat.isDirectory() || process.getuid && stat.uid !== process.getuid() || process.platform !== "win32" && (stat.mode & 63) !== 0) {
+    const stat2 = await lstat2(directory);
+    if (!stat2.isDirectory() || process.getuid && stat2.uid !== process.getuid() || process.platform !== "win32" && (stat2.mode & 63) !== 0) {
       throw new Error("FLOP Hermes profile and parent directories must be owner-only regular directories");
     }
   }
@@ -6882,8 +6854,8 @@ import http3 from "http";
 
 // src/proxy/openai.ts
 var GFLOPS_PER_TOKEN = 10;
-function estimateTokens2(text3) {
-  return Math.max(1, Math.ceil((text3?.length ?? 0) / 4));
+function estimateTokens2(text4) {
+  return Math.max(1, Math.ceil((text4?.length ?? 0) / 4));
 }
 function chatMessagesToPrompt(messages) {
   return messages.map((m) => `${m.role}: ${m.content}`).join("\n");
@@ -6944,8 +6916,8 @@ function modelsListResponse(models) {
 function streamMeta(outcome) {
   return { id: outcome.taskId, model: outcome.model, created: Math.floor(Date.now() / 1e3) };
 }
-function chunkText(text3) {
-  return text3 ? text3.match(/\s+|\S+/g) ?? [] : [];
+function chunkText(text4) {
+  return text4 ? text4.match(/\s+|\S+/g) ?? [] : [];
 }
 function buildChatChunk(meta, delta, finishReason) {
   return {
@@ -6956,13 +6928,13 @@ function buildChatChunk(meta, delta, finishReason) {
     choices: [{ index: 0, delta, finish_reason: finishReason }]
   };
 }
-function buildTextChunk(meta, text3, finishReason) {
+function buildTextChunk(meta, text4, finishReason) {
   return {
     id: meta.id,
     object: "text_completion",
     created: meta.created,
     model: meta.model,
-    choices: [{ index: 0, text: text3, finish_reason: finishReason }]
+    choices: [{ index: 0, text: text4, finish_reason: finishReason }]
   };
 }
 function buildUsageChunk(meta, outcome, promptTokens) {
@@ -7014,14 +6986,14 @@ var CORS_HEADERS = {
   "Access-Control-Allow-Headers": "Authorization, Content-Type"
 };
 function readBody(req) {
-  return new Promise((resolve10) => {
+  return new Promise((resolve11) => {
     let data = "";
     req.on("data", (c) => data += c);
     req.on("end", () => {
       try {
-        resolve10(data ? JSON.parse(data) : {});
+        resolve11(data ? JSON.parse(data) : {});
       } catch {
-        resolve10({});
+        resolve11({});
       }
     });
   });
@@ -7175,8 +7147,8 @@ function createLocalEmbedder(model) {
       extractor = await transformers.pipeline("feature-extraction", model);
     }
     const out = [];
-    for (const text3 of inputs) {
-      const t = await extractor(text3, { pooling: "mean", normalize: true });
+    for (const text4 of inputs) {
+      const t = await extractor(text4, { pooling: "mean", normalize: true });
       out.push(Array.from(t.data));
     }
     return out;
@@ -7258,7 +7230,7 @@ async function startProxyServer(o) {
     embeddingModel: o.embeddingModel,
     embed: createLocalEmbedder(o.embeddingModel)
   });
-  await new Promise((resolve10) => server.listen(o.port, o.host, () => resolve10()));
+  await new Promise((resolve11) => server.listen(o.port, o.host, () => resolve11()));
   const addr = server.address();
   const url = `http://${o.host}:${addr.port}`;
   const models = await listModels();
@@ -7395,9 +7367,9 @@ function launchExternal2(command, args, envOverrides) {
 function runHermesConfig(launcher, commands) {
   return commands.reduce(
     (p, args) => p.then(
-      () => new Promise((resolve10, reject) => {
+      () => new Promise((resolve11, reject) => {
         const c = spawnLauncher(launcher, args, { stdio: "inherit" });
-        c.on("exit", (code) => code === 0 ? resolve10() : reject(new Error(`hermes ${args.join(" ")} exited ${code}`)));
+        c.on("exit", (code) => code === 0 ? resolve11() : reject(new Error(`hermes ${args.join(" ")} exited ${code}`)));
         c.on("error", reject);
       })
     ),
@@ -7624,14 +7596,18 @@ function daWithdrawCmd() {
 
 // src/commands/model-upload.ts
 import { Command as Command30, Option as Option2 } from "commander";
-import { copyFile, lstat as lstat7, mkdir as mkdir11, mkdtemp, rm as rm3, writeFile as writeFile9 } from "node:fs/promises";
-import { tmpdir } from "node:os";
+import { createWriteStream } from "node:fs";
+import { copyFile, lstat as lstat7, mkdir as mkdir11, mkdtemp as mkdtemp2, rm as rm4, writeFile as writeFile9 } from "node:fs/promises";
+import { pipeline as pipeline2 } from "node:stream/promises";
+import { tmpdir as tmpdir2 } from "node:os";
 import { basename as basename2, join as join6, resolve as resolve8 } from "node:path";
 
 // src/model.ts
 import { resolve as resolve5, relative, sep } from "node:path";
-import { mkdir as mkdir7, readFile as readFile4, readdir, lstat as lstat3, writeFile as writeFile7 } from "node:fs/promises";
+import { mkdir as mkdir7, mkdtemp, readFile as readFile4, readdir, lstat as lstat3, rm as rm2, writeFile as writeFile7 } from "node:fs/promises";
 import { execFile as execFile3, spawn as spawn4 } from "node:child_process";
+import { createHash as createHash2 } from "node:crypto";
+import { tmpdir } from "node:os";
 import { pipeline } from "node:stream/promises";
 import { promisify as promisify3 } from "node:util";
 function modelToOutput(model) {
@@ -7678,6 +7654,26 @@ function parseModelSource(raw) {
     `unsupported model source "${raw}"; use hf:<repo>, modelscope:<repo>, https://..., or da:<commitment>`
   );
 }
+function parseRevision(raw) {
+  if (raw !== void 0 && !/^[0-9a-f]{40}$/.test(raw)) throw new Error("--revision must be an immutable 40-hex commit");
+  return raw;
+}
+async function downloadPinnedHuggingFace(repo, dir, expectedRoot, opts) {
+  const sdk = await import("@flop-labs/sdk");
+  const hub = { revision: opts.revision, token: opts.token };
+  const preflight = await sdk.preflightHuggingFace(repo, hub);
+  if (sdk.normalizeRoot(preflight.contentRoot) !== sdk.normalizeRoot(expectedRoot)) {
+    const found = `${repo} at ${preflight.revision} has content_root 0x${sdk.normalizeRoot(preflight.contentRoot)}, not the registered root ${expectedRoot}`;
+    if (!opts.revision) {
+      throw new Error(
+        `${found}; nothing was downloaded. A repo whose main moved needs the registered --revision (the onboarding identity's sourceRevision), and a verity-v1 model's root cannot be checked from hub metadata, so it downloads only at an explicit --revision and is measured after transfer`
+      );
+    }
+    process.stderr.write(`${found}; a verity-v1 root is checkable only after download, so the bytes are measured once fetched
+`);
+  }
+  return sdk.fetchHuggingFaceToDir(repo, dir, { ...hub, revision: preflight.revision, files: preflight.files });
+}
 function daHttpSource(endpoint) {
   if (!endpoint) return void 0;
   const base = endpoint.replace(/\/+$/, "");
@@ -7707,12 +7703,12 @@ async function writeModelFiles(outputDir, files) {
 }
 async function readLocalModelFiles(path5) {
   const root = resolve5(path5);
-  const stat = await lstat3(root);
-  if (stat.isSymbolicLink()) throw new Error(`model source must not be a symlink: ${path5}`);
-  if (stat.isFile()) {
+  const stat2 = await lstat3(root);
+  if (stat2.isSymbolicLink()) throw new Error(`model source must not be a symlink: ${path5}`);
+  if (stat2.isFile()) {
     return [{ path: root.split(sep).pop() ?? "weights.bin", bytes: await readFile4(root) }];
   }
-  if (!stat.isDirectory()) throw new Error(`model source is not a file or directory: ${path5}`);
+  if (!stat2.isDirectory()) throw new Error(`model source is not a file or directory: ${path5}`);
   const files = [];
   async function walk(dir) {
     for (const entry of await readdir(dir, { withFileTypes: true })) {
@@ -7877,31 +7873,82 @@ async function submitDaBlob(executable, rpc, blobFile, publisherKey) {
   }
   return parseCustodyResult(stdout2);
 }
+async function daRetrieveChunk(executable, rpc, commitment, j) {
+  const dir = await mkdtemp(resolve5(tmpdir(), "flop-da-chunk-"));
+  const output = resolve5(dir, "chunk.bin");
+  try {
+    let stdout2;
+    try {
+      ({ stdout: stdout2 } = await promisify3(execFile3)(executable, [
+        "retrieve",
+        "--chain-rpc",
+        rpc,
+        "--commitment",
+        commitment,
+        "--output",
+        output,
+        "--chunk",
+        String(j),
+        "--json"
+      ], { maxBuffer: 1024 * 1024 }));
+    } catch (error) {
+      const stderr = String(error.stderr ?? "");
+      if (/unexpected argument '--chunk'/.test(stderr)) {
+        throw new Error("this da-validator has no `retrieve --chunk`; install one built from flop-core with it to spot-check the DA image");
+      }
+      throw new Error(`da-validator retrieve --chunk ${j} failed: ${stderr.trim() || error.message}`);
+    }
+    const line = lastJsonLine(stdout2);
+    if (!line) throw new Error("da-validator retrieve --chunk returned no JSON receipt");
+    const receipt = JSON.parse(line);
+    const bytes4 = new Uint8Array(await readFile4(output));
+    if (receipt.chunk !== j || receipt.length !== bytes4.length || receipt.sha256 !== createHash2("sha256").update(bytes4).digest("hex")) {
+      throw new Error(`da-validator chunk ${j} receipt does not match the retrieved bytes`);
+    }
+    return { chunk: j, offset: Number(receipt.offset), sizeBytes: Number(receipt.size_bytes), chunkSize: Number(receipt.chunk_size), bytes: bytes4 };
+  } finally {
+    await rm2(dir, { recursive: true, force: true });
+  }
+}
+async function readHuggingFaceRange(repo, revision, path5, start, end, size, token) {
+  const url = `https://huggingface.co/${repo}/resolve/${revision}/${path5.split("/").map(encodeURIComponent).join("/")}`;
+  const response = await fetch(url, {
+    headers: { Range: `bytes=${start}-${end}`, ...token ? { Authorization: `Bearer ${token}` } : {} },
+    signal: AbortSignal.timeout(12e4)
+  });
+  if (response.status !== 206 || response.headers.get("content-range") !== `bytes ${start}-${end}/${size}`) {
+    await response.body?.cancel();
+    throw new Error(`Hugging Face did not honor byte range ${start}-${end} of ${path5} at ${revision} (HTTP ${response.status})`);
+  }
+  const bytes4 = new Uint8Array(await response.arrayBuffer());
+  if (bytes4.length !== end - start + 1) throw new Error(`Hugging Face returned ${bytes4.length} bytes for range ${start}-${end} of ${path5}`);
+  return bytes4;
+}
 
 // src/commands/model-onboard.ts
 import { Command as Command29 } from "commander";
-import { createHash as createHash3 } from "node:crypto";
+import { createHash as createHash5 } from "node:crypto";
 import { execFile as execFile4 } from "node:child_process";
 import { access, lstat as lstat6, mkdir as mkdir10, readFile as readFile7, writeFile as writeFile8 } from "node:fs/promises";
 import { basename, isAbsolute, join as join5, resolve as resolve7 } from "node:path";
 import { promisify as promisify4 } from "node:util";
-import { computeChannel as computeChannel4 } from "@flop-labs/sdk";
+import { computeChannel as computeChannel5 } from "@flop-labs/sdk";
 
 // src/model-onboard-state.ts
-import { createHash as createHash2 } from "node:crypto";
+import { createHash as createHash3 } from "node:crypto";
 import { createReadStream } from "node:fs";
-import { chmod as chmod3, lstat as lstat4, mkdir as mkdir8, open, readFile as readFile5, rename as rename6, rm as rm2 } from "node:fs/promises";
+import { chmod as chmod3, lstat as lstat4, mkdir as mkdir8, open, readFile as readFile5, rename as rename6, rm as rm3 } from "node:fs/promises";
 import { homedir as homedir3, hostname as hostname2 } from "node:os";
 import { join as join3, resolve as resolve6 } from "node:path";
 import { collectModelFiles } from "@flop-labs/sdk";
-var digest = (value) => createHash2("sha256").update(value).digest("hex");
+var digest = (value) => createHash3("sha256").update(value).digest("hex");
 function onboardingDirectory(binding, override) {
   return override ? resolve6(override) : join3(process.env.XDG_STATE_HOME ?? join3(homedir3(), ".local/state"), "flop/model-onboarding", digest(JSON.stringify(binding)));
 }
 async function hashFile(path5) {
-  const stat = await lstat4(path5);
-  if (!stat.isFile() || stat.isSymbolicLink()) throw new Error("onboarding artifact must be a regular file");
-  const hash2 = createHash2("sha256");
+  const stat2 = await lstat4(path5);
+  if (!stat2.isFile() || stat2.isSymbolicLink()) throw new Error("onboarding artifact must be a regular file");
+  const hash2 = createHash3("sha256");
   for await (const chunk of createReadStream(path5)) hash2.update(chunk);
   return hash2.digest("hex");
 }
@@ -7925,7 +7972,7 @@ async function openOnboardingState(dir, binding) {
   const statePath = join3(dir, "state.json");
   const close = async () => {
     await lock.close();
-    await rm2(lockPath);
+    await rm3(lockPath);
   };
   try {
     await lock.writeFile(JSON.stringify({ pid: process.pid, host: hostname2() }));
@@ -8066,10 +8113,10 @@ import { computeChannel as computeChannel2, attestation } from "@flop-labs/sdk";
 import { randomUUID as randomUUID3 } from "node:crypto";
 import { chmod as chmod4, lstat as lstat5, mkdir as mkdir9, open as open2, readFile as readFile6, rename as rename7 } from "node:fs/promises";
 import { join as join4 } from "node:path";
-var bytes = (hex4) => {
-  if (!/^0x(?:[0-9a-f]{2})*$/.test(hex4))
+var bytes = (hex5) => {
+  if (!/^0x(?:[0-9a-f]{2})*$/.test(hex5))
     throw new Error("invalid private replay bytes");
-  return new Uint8Array(Buffer.from(hex4.slice(2), "hex"));
+  return new Uint8Array(Buffer.from(hex5.slice(2), "hex"));
 };
 var hex = (v) => `0x${Buffer.from(v).toString("hex")}`;
 var privateJson = (value) => JSON.stringify(
@@ -8077,8 +8124,8 @@ var privateJson = (value) => JSON.stringify(
   (_k, v) => typeof v === "bigint" ? v.toString() : v instanceof Uint8Array ? hex(v) : v
 );
 async function readPrivateJson(path5) {
-  const stat = await lstat5(path5);
-  if (!stat.isFile() || stat.isSymbolicLink() || (stat.mode & 63) !== 0)
+  const stat2 = await lstat5(path5);
+  if (!stat2.isFile() || stat2.isSymbolicLink() || (stat2.mode & 63) !== 0)
     throw new Error("replay files must be private regular files (0600)");
   return JSON.parse(await readFile6(path5, "utf8"));
 }
@@ -8406,8 +8453,8 @@ async function checkPaidAdmission(api, endpoint, identity, token, completion, pa
   await anonymous.body?.cancel();
   const info = await computeChannel3.fetchMinerSessionInfo(endpoint, { Authorization: `Bearer ${token}` }, AbortSignal.timeout(3e4));
   const actual = info.modelIdentity;
-  const hex4 = (v) => `0x${Buffer.from(v).toString("hex")}`;
-  if (!actual || actual.registryModel !== identity.registryModel || actual.registryVersion !== identity.registryVersion || actual.backendModelName !== identity.backendModelName || hex4(actual.modelHash) !== identity.modelHash || hex4(actual.measuredRoot) !== identity.measuredRoot || hex4(actual.decodePolicyHash) !== identity.decodePolicyHash || actual.precision !== identity.precision) throw new Error("paid admission authenticated model identity differs from prepared checkpoint");
+  const hex5 = (v) => `0x${Buffer.from(v).toString("hex")}`;
+  if (!actual || actual.registryModel !== identity.registryModel || actual.registryVersion !== identity.registryVersion || actual.backendModelName !== identity.backendModelName || hex5(actual.modelHash) !== identity.modelHash || hex5(actual.measuredRoot) !== identity.measuredRoot || hex5(actual.decodePolicyHash) !== identity.decodePolicyHash || actual.precision !== identity.precision) throw new Error("paid admission authenticated model identity differs from prepared checkpoint");
   if (!info.isReady || !info.calibration?.ready) throw new Error("paid admission miner is not calibrated and serving");
   const head = await api.rpc.chain.getFinalizedHead(), view = await api.at(head);
   const registration = await view.query.minerStaking.miners(info.minerAddress);
@@ -8416,7 +8463,7 @@ async function checkPaidAdmission(api, endpoint, identity, token, completion, pa
   if (key.length !== 32) throw new Error("paid admission requires the runtime AccountId32 encoding");
   const result = await api.rpc.state.call(
     "TrustRootApi_accepted_calibration_cap",
-    hex4(Uint8Array.from([128, ...key])),
+    hex5(Uint8Array.from([128, ...key])),
     head
   );
   const value = result.toU8a(true);
@@ -8432,7 +8479,7 @@ async function checkPaidAdmission(api, endpoint, identity, token, completion, pa
       hash: (await api.rpc.chain.getBlockHash((BigInt(anchor.receipt.number) + 1n).toString())).toHex()
     };
     const session = await rpc.session(anchor, seed, finalized);
-    if (!payer || session.agent !== hex4(api.createType("AccountId", payer).toU8a()) || session.miner !== hex4(key) || session.model.modelHash !== identity.modelHash || session.model.measuredRoot !== identity.measuredRoot || session.model.precision !== identity.precision || session.model.decodePolicyHash !== identity.decodePolicyHash) throw new Error("historical paid completion differs from onboarding model/payer/miner");
+    if (!payer || session.agent !== hex5(api.createType("AccountId", payer).toU8a()) || session.miner !== hex5(key) || session.model.modelHash !== identity.modelHash || session.model.measuredRoot !== identity.measuredRoot || session.model.precision !== identity.precision || session.model.decodePolicyHash !== identity.decodePolicyHash) throw new Error("historical paid completion differs from onboarding model/payer/miner");
     historicalCompletion = await verifyStoredReplay(api, completion);
   }
   return {
@@ -8444,6 +8491,215 @@ async function checkPaidAdmission(api, endpoint, identity, token, completion, pa
   };
 }
 
+// src/throughput-ceiling.ts
+import { computeChannel as computeChannel4 } from "@flop-labs/sdk";
+function parseMinTokensPerSecond(raw) {
+  const text4 = raw.trim();
+  if (!/^\d+(?:\.\d{1,6})?$/.test(text4) || !/[1-9]/.test(text4)) {
+    throw new Error("--min-tokens-per-second must be a positive decimal with at most 6 fractional digits");
+  }
+  return text4;
+}
+function fraction(minimum) {
+  const [whole, frac = ""] = minimum.split(".");
+  return [BigInt(whole + frac), 10n ** BigInt(frac.length)];
+}
+var FLOPS_PER_GN = 1000000000n;
+function perTokenWork(checkpoint) {
+  const hybrid = computeChannel4.isDenseGdnArch(checkpoint.arch);
+  return {
+    flopsPerToken: hybrid ? checkpoint.gnPerCompletionToken * FLOPS_PER_GN : 2n * checkpoint.activeParams,
+    gnPerToken: checkpoint.gnPerCompletionToken
+  };
+}
+function centiTokensPerSecond(capGnPerBlock, blockTimeMs, flopsPerToken) {
+  if (flopsPerToken <= 0n || blockTimeMs <= 0n) throw new RangeError("flopsPerToken and blockTimeMs must be positive");
+  return capGnPerBlock * FLOPS_PER_GN * 1000n * 100n / (blockTimeMs * flopsPerToken);
+}
+function exactGn(flops) {
+  const frac = (flops % FLOPS_PER_GN).toString().padStart(9, "0").replace(/0+$/, "");
+  return `${flops / FLOPS_PER_GN}${frac ? `.${frac}` : ""}`;
+}
+function decimal(centi) {
+  return `${centi / 100n}.${(centi % 100n).toString().padStart(2, "0")}`;
+}
+function unknown(work, minimum, reason3) {
+  return {
+    status: "unknown",
+    tokensPerSecond: `unknown (${reason3})`,
+    gnPerToken: work ? exactGn(work.flopsPerToken) : null,
+    flopsPerToken: work?.flopsPerToken.toString() ?? null,
+    capGnPerBlock: null,
+    capSource: null,
+    miner: null,
+    bestTokensPerSecond: null,
+    bestCapGnPerBlock: null,
+    blockTimeMs: null,
+    calibratedMiners: null,
+    finalizedBlock: null,
+    minTokensPerSecond: minimum === void 0 ? null : Number(minimum),
+    meetsMinimum: minimum === void 0 ? null : false,
+    reason: reason3
+  };
+}
+function throughputCeiling(work, chain, minimum) {
+  if (typeof work === "string") return unknown(null, minimum, work);
+  if (work.flopsPerToken <= 0n) return unknown(work, minimum, "metering reports no work per completion token");
+  if (chain === null) return unknown(work, minimum, "no chain connection");
+  if (typeof chain === "string") return unknown(work, minimum, chain);
+  if (chain.capGnPerBlock === null) {
+    return unknown(work, minimum, chain.miner === null ? "no miner holds an accepted calibration cap at finality" : `miner ${chain.miner} holds no accepted calibration cap at finality`);
+  }
+  const flops = work.flopsPerToken;
+  const centi = centiTokensPerSecond(chain.capGnPerBlock, chain.blockTimeMs, flops);
+  let meets = null;
+  if (minimum !== void 0) {
+    const [num, den] = fraction(minimum);
+    meets = chain.capGnPerBlock * FLOPS_PER_GN * 1000n * den >= num * chain.blockTimeMs * flops;
+  }
+  return {
+    status: "known",
+    tokensPerSecond: decimal(centi),
+    gnPerToken: exactGn(flops),
+    flopsPerToken: flops.toString(),
+    capGnPerBlock: chain.capGnPerBlock.toString(),
+    capSource: chain.capSource,
+    miner: chain.miner,
+    bestTokensPerSecond: chain.bestCapGnPerBlock === null ? null : decimal(centiTokensPerSecond(chain.bestCapGnPerBlock, chain.blockTimeMs, flops)),
+    bestCapGnPerBlock: chain.bestCapGnPerBlock?.toString() ?? null,
+    blockTimeMs: chain.blockTimeMs.toString(),
+    calibratedMiners: chain.calibratedMiners,
+    finalizedBlock: chain.finalizedBlock.toString(),
+    minTokensPerSecond: minimum === void 0 ? null : Number(minimum),
+    meetsMinimum: meets
+  };
+}
+async function readChainCapInputs(api, miner) {
+  const block = api.consts?.babe?.expectedBlockTime;
+  const lease = api.consts?.hwCalibration?.calibrationLeaseBlocks;
+  if (block == null) throw new Error("runtime constant babe.expectedBlockTime is missing");
+  if (lease == null) throw new Error("runtime constant hwCalibration.calibrationLeaseBlocks is missing");
+  const head = await api.rpc.chain.getFinalizedHead();
+  const [view, header] = await Promise.all([api.at(head), api.rpc.chain.getHeader(head)]);
+  const caps = view.query?.hwCalibration?.benchmarkBurstCaps;
+  if (!caps?.entries) throw new Error("runtime has no hwCalibration.benchmarkBurstCaps");
+  const now = BigInt(header.number.toString());
+  const leaseBlocks = BigInt(lease.toString());
+  const live = (raw) => {
+    if (!raw?.isSome) return null;
+    const cap = raw.unwrap();
+    const acceptedAt = BigInt((cap.acceptedAt ?? cap.accepted_at).toString());
+    const value = BigInt((cap.capGflopsPerSec ?? cap.cap_gflops_per_sec).toString());
+    return now - acceptedAt >= leaseBlocks || value <= 0n ? null : value;
+  };
+  const entries = await caps.entries();
+  const values = entries.map(([, raw]) => live(raw)).filter((value) => value !== null).sort((a, b) => a < b ? -1 : a > b ? 1 : 0);
+  const mid = Math.floor(values.length / 2);
+  const median = values.length === 0 ? null : values.length % 2 === 1 ? values[mid] : (values[mid - 1] + values[mid]) / 2n;
+  const capGnPerBlock = miner === void 0 ? median : live(await caps(miner));
+  return {
+    capGnPerBlock,
+    capSource: miner === void 0 ? "chain-median" : "miner",
+    miner: miner ?? null,
+    bestCapGnPerBlock: values[values.length - 1] ?? null,
+    blockTimeMs: BigInt(block.toString()),
+    calibratedMiners: values.length,
+    finalizedBlock: now
+  };
+}
+var CEILING_READ_TIMEOUT_MS = 15e3;
+async function chainCapInputsOrReason(api, miner, timeoutMs = CEILING_READ_TIMEOUT_MS) {
+  let timer;
+  try {
+    return await Promise.race([
+      readChainCapInputs(api, miner),
+      new Promise((_, reject) => {
+        timer = setTimeout(() => reject(new Error(`timed out after ${timeoutMs} ms`)), timeoutMs);
+      })
+    ]);
+  } catch (error) {
+    return `chain read failed: ${error.message}`;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+function ceilingWarning(ceiling) {
+  if (ceiling.status === "unknown") return `warning: paid throughput ceiling ${ceiling.tokensPerSecond}
+`;
+  const at = ceiling.capSource === "miner" ? `miner ${ceiling.miner}'s cap` : "the median live cap";
+  const detail = `${ceiling.gnPerToken} G_n/token at ${at} ${ceiling.capGnPerBlock} G_n/block; best of ${ceiling.calibratedMiners} calibrated miner(s) ${ceiling.bestTokensPerSecond ?? "n/a"} tok/s (not gated)`;
+  const tail = "per channel, completion tokens only; prompt and attention G_n lower it";
+  if (ceiling.meetsMinimum === false) {
+    return `warning: paid throughput ceiling ${ceiling.tokensPerSecond} tok/s (${detail}) is below --min-tokens-per-second ${ceiling.minTokensPerSecond}; ${tail}
+`;
+  }
+  return `paid throughput ceiling: ${ceiling.tokensPerSecond} tok/s (${detail}); ${tail}
+`;
+}
+function enforceCeiling(ceiling) {
+  if (ceiling.meetsMinimum !== false) return;
+  throw new Error(
+    ceiling.status === "unknown" ? `paid throughput ceiling is ${ceiling.tokensPerSecond}; --min-tokens-per-second ${ceiling.minTokensPerSecond} cannot be shown to hold` : `paid throughput ceiling ${ceiling.tokensPerSecond} tok/s is below --min-tokens-per-second ${ceiling.minTokensPerSecond}`
+  );
+}
+function snakeCeiling(ceiling) {
+  return Object.fromEntries(Object.entries(ceiling).map(([k, v]) => [k.replace(/[A-Z]/g, (c) => `_${c.toLowerCase()}`), v]));
+}
+
+// src/model-da-spot-check.ts
+import { createHash as createHash4, randomInt } from "node:crypto";
+var SPOT_CHECK_CHUNKS = 2;
+var BLOCK_SIZE = 4096;
+function randomChunks(n, k) {
+  const picked = /* @__PURE__ */ new Set();
+  while (picked.size < Math.min(n, k)) picked.add(randomInt(n));
+  return [...picked].sort((a, b) => a - b);
+}
+async function spotCheckImage(files, imageSize, io) {
+  const ordered = [...files].sort((a, b) => Buffer.from(a.path).compare(Buffer.from(b.path)));
+  let cursor = 0;
+  const layout = ordered.map((file) => {
+    const start = cursor;
+    cursor += Math.ceil(file.size / BLOCK_SIZE) * BLOCK_SIZE;
+    return { file, start, dataEnd: start + file.size, end: cursor };
+  });
+  if (cursor !== imageSize) throw new Error(`file table packs to ${cursor} bytes, not the bound image's ${imageSize}`);
+  const n = Math.max(1, Math.ceil(imageSize / io.chunkSize));
+  const chunks = (io.pick ?? randomChunks)(n, SPOT_CHECK_CHUNKS);
+  for (const j of chunks) {
+    const chunkStart = j * io.chunkSize;
+    const chunkEnd = Math.min(chunkStart + io.chunkSize, imageSize);
+    const got = await io.readChunk(j);
+    const expectedChunkSize = n === 1 ? imageSize : io.chunkSize;
+    if (got.chunkSize !== expectedChunkSize || got.sizeBytes !== imageSize || got.offset !== chunkStart || got.bytes.length !== chunkEnd - chunkStart) {
+      throw new Error(`DA chunk ${j} layout differs from the ${io.chunkSize}-byte chunking of a ${imageSize}-byte image`);
+    }
+    const at = (offset) => offset - chunkStart;
+    for (const { file, start, dataEnd, end } of layout) {
+      if (end <= chunkStart || start >= chunkEnd) continue;
+      const from = Math.max(start, chunkStart), to = Math.min(dataEnd, chunkEnd);
+      if (from < to) {
+        const slice = got.bytes.subarray(at(from), at(to));
+        if (start >= chunkStart && dataEnd <= chunkEnd) {
+          if (createHash4("sha256").update(slice).digest("hex") !== file.sha256.toLowerCase().replace(/^0x/, "")) {
+            throw new Error(`DA spot check: chunk ${j} of the bound image does not hold ${file.path} (sha256 differs)`);
+          }
+        } else {
+          const hub = await io.readHubRange(file.path, from - start, to - start - 1, file.size);
+          if (!Buffer.from(hub).equals(Buffer.from(slice))) {
+            throw new Error(`DA spot check: chunk ${j} of the bound image differs from ${file.path} at the hub revision`);
+          }
+        }
+      }
+      const padFrom = Math.max(dataEnd, chunkStart), padTo = Math.min(end, chunkEnd);
+      if (padFrom < padTo && got.bytes.subarray(at(padFrom), at(padTo)).some((b) => b !== 0)) {
+        throw new Error(`DA spot check: chunk ${j} of the bound image has nonzero padding after ${file.path}`);
+      }
+    }
+  }
+  return { chunks, of: n };
+}
+
 // src/commands/model-onboard.ts
 var run = promisify4(execFile4);
 var PRECISIONS = ["FP32", "FP16", "BF16", "INT8", "INT4", "Mixed"];
@@ -8455,7 +8711,7 @@ async function requireHybridApproval(api, arch) {
 async function requireHybridApprovalAt(view, arch) {
   const query = view.query.meteringVerifier?.hybridProfiles;
   if (!query) throw new Error("runtime has no hybrid proof profile approval; deploy the reviewed runtime first");
-  const hash2 = `0x${Buffer.from(computeChannel4.meteringArchHash(arch)).toString("hex")}`;
+  const hash2 = `0x${Buffer.from(computeChannel5.meteringArchHash(arch)).toString("hex")}`;
   const value = await query(hash2);
   if (!value || value.isNone) throw new Error(`hybrid proof profile ${hash2} is not approved`);
   const profile = value.unwrap();
@@ -8467,6 +8723,9 @@ function activeHybridProfile(profile) {
   const image = optionValue(profile.imageId);
   return image !== null && codecHash(image) !== `0x${"00".repeat(32)}` && profile.epoch.toString() !== "0";
 }
+function modelBackupHandoff(modelHash, precision, revision) {
+  return `flop model backup ${modelHash} --model-dir <path> --precision ${precision}${revision ? ` --revision ${revision}` : ""}`;
+}
 function normalizePrecision(raw) {
   const upper = raw.trim().toUpperCase();
   const precision = PRECISIONS.find((candidate) => candidate.toUpperCase() === upper);
@@ -8519,7 +8778,7 @@ function resolveParamsBillion(checkpoint, override) {
     throw new Error(`--params-billion must be a positive integer (got ${override})`);
   }
   if (override === registered) return override;
-  if (computeChannel4.isDenseGdnArch(checkpoint.arch)) throw new Error("--params-billion must match the complete checkpoint census");
+  if (computeChannel5.isDenseGdnArch(checkpoint.arch)) throw new Error("--params-billion must match the complete checkpoint census");
   if (Math.abs(override - derived) > 0.05 * derived) {
     throw new Error(
       `--params-billion ${override} disagrees with config.json's ${derived.toFixed(2)}B parameters by more than 5%`
@@ -8549,9 +8808,9 @@ function onboardTeePlatforms(soft, raw) {
   return normalizeTeePlatforms(raw);
 }
 function normalizeHash(raw, name) {
-  const hex4 = raw.trim().replace(/^0x/i, "").toLowerCase();
-  if (!/^[0-9a-f]{64}$/.test(hex4)) throw new Error(`${name} must be 32-byte hex`);
-  return `0x${hex4}`;
+  const hex5 = raw.trim().replace(/^0x/i, "").toLowerCase();
+  if (!/^[0-9a-f]{64}$/.test(hex5)) throw new Error(`${name} must be 32-byte hex`);
+  return `0x${hex5}`;
 }
 function identityFromPack(registryModel2, registryVersion, backendModelName, precision, decodePolicyHash, contentRoot, checkpoint, sourceRevision) {
   const measuredRoot = normalizeHash(contentRoot, "modelpack content_root");
@@ -8563,7 +8822,7 @@ function identityFromPack(registryModel2, registryVersion, backendModelName, pre
     decodePolicyHash: normalizeHash(decodePolicyHash, "decode policy hash"),
     measuredRoot,
     backendModelName,
-    archHash: `0x${Buffer.from(computeChannel4.meteringArchHash(checkpoint.arch)).toString("hex")}`,
+    archHash: `0x${Buffer.from(computeChannel5.meteringArchHash(checkpoint.arch)).toString("hex")}`,
     quantization: catalogQuantization(checkpoint),
     gnPerPromptToken: checkpoint.gnPerPromptToken.toString(),
     gnPerCompletionToken: checkpoint.gnPerCompletionToken.toString(),
@@ -8632,10 +8891,10 @@ async function exists(path5) {
 async function materializeSource(raw, outputDir, token, sourceRevision, resumeState, files) {
   const local = await exists(raw);
   if (local) {
-    const stat = await lstat6(raw);
-    if (stat.isSymbolicLink()) throw new Error(`model source must not be a symlink: ${raw}`);
-    const modelDir = stat.isDirectory() ? resolve7(raw) : outputDir;
-    if (!stat.isDirectory()) {
+    const stat2 = await lstat6(raw);
+    if (stat2.isSymbolicLink()) throw new Error(`model source must not be a symlink: ${raw}`);
+    const modelDir = stat2.isDirectory() ? resolve7(raw) : outputDir;
+    if (!stat2.isDirectory()) {
       await writeModelFiles(outputDir, await readLocalModelFiles(raw));
     }
     const name = basename(resolve7(raw));
@@ -8716,7 +8975,7 @@ function boundCensus(stdout2, configHash) {
   return { total: BigInt(result.total_params), sourceFiles: result.source_files };
 }
 async function validateCapture(endpoint, identity, checkpoint, modelDir) {
-  const hybrid = computeChannel4.isDenseGdnArch(checkpoint.arch);
+  const hybrid = computeChannel5.isDenseGdnArch(checkpoint.arch);
   const script = join5(repoRoot(), "infra/miner/vllm-toploc", hybrid ? "validate_hybrid_capture.py" : "validate_capture.py");
   try {
     await run("uv", ["run", "--no-project", "python", script], {
@@ -8744,8 +9003,8 @@ function optionValue(value) {
 }
 function codecText(value) {
   if (value?.toUtf8) return value.toUtf8();
-  const text3 = value?.toString?.() ?? String(value ?? "");
-  return /^0x(?:[0-9a-f]{2})+$/i.test(text3) ? Buffer.from(text3.slice(2), "hex").toString("utf8") : text3;
+  const text4 = value?.toString?.() ?? String(value ?? "");
+  return /^0x(?:[0-9a-f]{2})+$/i.test(text4) ? Buffer.from(text4.slice(2), "hex").toString("utf8") : text4;
 }
 function codecHash(value) {
   return normalizeHash(value?.toHex?.() ?? value?.toString?.() ?? String(value), "on-chain hash");
@@ -8794,7 +9053,7 @@ async function requireApprovalEvidence(api, modelHash, precision, signer, imageS
     if (!Array.from(members).some((member) => sameAccount(member, signer))) throw new Error("approval signer is not an active registrar");
     if (sameAccount(model.publisher, signer)) throw new Error("registrar cannot approve its own published model");
   }
-  const requiresHybrid = computeChannel4.isDenseGdnArch(arch);
+  const requiresHybrid = computeChannel5.isDenseGdnArch(arch);
   if (!root) {
     const requirements = optionValue(await registry.admissionRequirements(modelHash));
     if (!requirements) throw new Error("approval requires model admission requirements");
@@ -8808,7 +9067,7 @@ async function requireApprovalEvidence(api, modelHash, precision, signer, imageS
   }
   const archHash = optionValue(rawArch);
   if (!archHash) throw new Error("approval requires a model architecture hash");
-  const expectedArchHash = `0x${Buffer.from(computeChannel4.meteringArchHash(arch)).toString("hex")}`;
+  const expectedArchHash = `0x${Buffer.from(computeChannel5.meteringArchHash(arch)).toString("hex")}`;
   if (codecHash(archHash) !== expectedArchHash) throw new Error("approval architecture hash differs from the checkpoint");
   const policies = optionValue(rawPolicies);
   if (!policies || policies.length === 0) throw new Error("approval requires a nonempty decode-policy allowlist");
@@ -8826,6 +9085,7 @@ async function requireApprovalEvidence(api, modelHash, precision, signer, imageS
   const leaseEnd = metadata.leaseEnd ?? metadata.lease_end;
   const header = await api.rpc.chain.getHeader(head);
   if (leaseEnd === null || leaseEnd === void 0 || BigInt(leaseEnd) <= BigInt(header.number.toString())) throw new Error("approval requires a live DA lease");
+  let boundTable = null;
   if (files) {
     const sdk = await import("@flop-labs/sdk");
     const { blake2AsHex: blake2AsHex2 } = await import("@polkadot/util-crypto");
@@ -8834,7 +9094,15 @@ async function requireApprovalEvidence(api, modelHash, precision, signer, imageS
       throw new Error("approval file table does not hash to model_hash");
     }
     const tableCommitment = normalizeHash(blake2AsHex2(table2, 256), "file table commitment");
-    const mirrors = await sdk.readModelMirrors(view, modelHash);
+    boundTable = tableCommitment;
+    if (!registry.modelMirrors) throw new Error("cannot read ModelMirrors at finality: the runtime has no modelRegistry.modelMirrors");
+    let rawMirrors;
+    try {
+      rawMirrors = await registry.modelMirrors(modelHash);
+    } catch (error) {
+      throw new Error(`cannot read ModelMirrors at finality: ${error.message}`);
+    }
+    const mirrors = rawMirrors?.isSome ? sdk.decodeModelSources(rawMirrors.unwrap().toJSON()) : [];
     if (!mirrors.some((m) => m.kind === "da" && normalizeHash(String(m.commitment), "DA mirror commitment") === tableCommitment)) {
       throw new Error("approval requires the DA mirror to name the model's file table");
     }
@@ -8855,7 +9123,7 @@ async function requireApprovalEvidence(api, modelHash, precision, signer, imageS
   }
   const status = String(model.status);
   if (status !== "Pending" && status !== "Verified") throw new Error(`model cannot be approved in ${status} status`);
-  return { approved: status === "Verified" };
+  return { approved: status === "Verified", weights: ref.commitment, table: boundTable };
 }
 function decodeDataRef(value) {
   const ref = optionValue(value);
@@ -8920,12 +9188,19 @@ function missingMirrors(registered, desired) {
     return !registered.some((actual) => sourceMatches(actual, comparable));
   });
 }
-async function verifiedHuggingFaceMirror(repo, verityRoot, verify) {
+async function verifiedHuggingFaceMirror(repo, contentRoot, hub) {
   if (!/^[^/\s]+\/[^/\s]+$/.test(repo)) throw new Error(`--hf-repo must be <owner>/<model> (got ${repo})`);
-  const result = await verify({ kind: "huggingface", repo }, verityRoot);
+  const bare = (hex5) => hex5.toLowerCase().replace(/^0x/, "");
+  const table2 = await hub.preflight(repo);
+  if (bare(table2.contentRoot) !== bare(contentRoot)) {
+    throw new Error(
+      `Hugging Face ${repo} at ${table2.revision} has content_root 0x${bare(table2.contentRoot)}, not the measured root ${contentRoot}; nothing was downloaded. Pass the --revision the local checkpoint came from, onboard from hf:${repo} so the registered files are the repo's, or omit --hf-repo`
+    );
+  }
+  const result = await hub.verify({ kind: "huggingface", repo }, contentRoot, table2.revision);
   if (!result.ok) {
     throw new Error(
-      `Hugging Face ${repo} does not reproduce the measured root ${verityRoot} (${result.reason ?? "no match"}); onboard from hf:${repo} so the registered files are the repo's, or omit --hf-repo`
+      `Hugging Face ${repo} does not reproduce the measured root ${contentRoot} (${result.reason ?? "no match"}); onboard from hf:${repo} so the registered files are the repo's, or omit --hf-repo`
     );
   }
   return { mirror: { kind: "huggingface", repo }, revision: result.revision ?? null };
@@ -8969,7 +9244,14 @@ function modelOnboardCmd() {
   ).option("--registry-model <name>", "Registry model name").option("--registry-version <version>", "Registry version", "1").option("--backend-model-name <name>", "Exact model name returned by the serving backend").option("--da-validator <path>", "da-validator executable", "da-validator").option(
     "--hf-repo <owner/model>",
     "Hugging Face repo a local --source came from; registered as a mirror only if it reproduces the measured root"
-  ).option("--revision <sha>", "Immutable Hugging Face commit; first resolution is retained when omitted").option("--state-dir <path>", "Private resumable workspace (defaults to XDG_STATE_HOME/flop/model-onboarding)").option("--registrar-keystore <path>", "Independent registrar keystore for registration pins and approval").option("--registrar-password-env <name>", "Environment variable containing the registrar keystore password").option("--approve", "Approve after rechecking all admission evidence at one finalized head").option("--paid-admission", "Check paid devnet prerequisites after registration; fail closed at an unavailable independent audit gate").option("--session-endpoint <url>", "Authenticated provisioned miner session endpoint for paid admission").option("--token <token>", "Hugging Face bearer token (prefer HF_TOKEN)").option("--json", "Output the identity block as JSON").action(async (opts, command) => {
+  ).option(
+    "--revision <sha>",
+    "Immutable Hugging Face commit (of --source, or of --hf-repo for a local source); first resolution is retained when omitted"
+  ).option("--state-dir <path>", "Private resumable workspace (defaults to XDG_STATE_HOME/flop/model-onboarding)").option("--registrar-keystore <path>", "Independent registrar keystore for registration pins and approval").option("--registrar-password-env <name>", "Environment variable containing the registrar keystore password").option("--approve", "Approve after rechecking all admission evidence at one finalized head").option("--paid-admission", "Check paid devnet prerequisites after registration; fail closed at an unavailable independent audit gate").option("--session-endpoint <url>", "Authenticated provisioned miner session endpoint for paid admission").option("--token <token>", "Hugging Face bearer token (prefer HF_TOKEN)").option(
+    "--min-tokens-per-second <n>",
+    "Fail before any chain write unless the paid completion-token ceiling per channel at the median live calibration cap is at least n; an unknown ceiling fails",
+    parseMinTokensPerSecond
+  ).option("--miner <address>", "Compute the ceiling at this miner's accepted calibration cap instead of the median live one; the best is reported, never gated").option("--json", "Output the identity block as JSON").action(async (opts, command) => {
     let client;
     let registrar;
     let workDir;
@@ -8986,15 +9268,12 @@ function modelOnboardCmd() {
       const local = await exists(opts.source);
       if (local && opts.download) throw new Error("--download is for a Hugging Face source; a local source is always packed");
       const metadataOnly = !local && !opts.download;
-      if (metadataOnly && opts.approve) {
-        throw new Error("--approve needs the model's DA backup (packed image and file table); rerun with --download to upload it in the same run");
-      }
       const binding = {
         source: opts.source,
         revision: opts.revision ?? null,
         network,
-        rpcHash: createHash3("sha256").update(getRpc(command)).digest("hex"),
-        captureEndpointHash: createHash3("sha256").update(opts.captureEndpoint).digest("hex"),
+        rpcHash: createHash5("sha256").update(getRpc(command)).digest("hex"),
+        captureEndpointHash: createHash5("sha256").update(opts.captureEndpoint).digest("hex"),
         registryModel: opts.registryModel ?? null,
         registryVersion: opts.registryVersion,
         backendModelName: opts.backendModelName ?? null,
@@ -9005,7 +9284,7 @@ function modelOnboardCmd() {
         hfRepo: opts.hfRepo ?? null,
         packContract: metadataOnly ? "content-v1-metadata" : "modelpack-v1-strict",
         paidAdmission: opts.paidAdmission === true,
-        sessionEndpointHash: opts.sessionEndpoint ? createHash3("sha256").update(opts.sessionEndpoint).digest("hex") : null
+        sessionEndpointHash: opts.sessionEndpoint ? createHash5("sha256").update(opts.sessionEndpoint).digest("hex") : null
       };
       workDir = onboardingDirectory(binding, opts.stateDir);
       job = await openOnboardingState(workDir, binding);
@@ -9019,17 +9298,32 @@ function modelOnboardCmd() {
         preflight = await sdk2.preflightHuggingFace(hubRepo, { revision: job.state.sourceRevision ?? opts.revision, token: opts.token ?? process.env.HF_TOKEN });
         if (!preflight.configJson) throw new Error("checkpoint has no root config.json; a workload-specific ingestion contract is required");
         job.state.sourceRevision = preflight.revision;
-        job.state.configHash = createHash3("sha256").update(preflight.configJson).digest("hex");
+        job.state.configHash = createHash5("sha256").update(preflight.configJson).digest("hex");
         job.state.phase = "preflight";
         await job.save();
         process.stderr.write(`content_root ${preflight.contentRoot}: ${preflight.files.length} files, image ${preflight.imageSize} bytes, ${preflight.daChunks} DA chunk(s) at ${preflight.revision}
 `);
-        const candidate = computeChannel4.parseMeteringConfig(preflight.configJson, preflight.hfQuantConfigJson);
-        if (computeChannel4.isDenseGdnArch(candidate.arch)) {
+        const candidate = computeChannel5.parseMeteringConfig(preflight.configJson, preflight.hfQuantConfigJson);
+        if (computeChannel5.isDenseGdnArch(candidate.arch)) {
           client = await createClient(getRpc(command), getSigner(command));
           await requireHybridApproval(client.api, candidate.arch);
         }
-      } else if (opts.revision) throw new Error("--revision is only for a Hugging Face source");
+      } else if (opts.revision && !opts.hfRepo) throw new Error("--revision is only for a Hugging Face source or a local source's --hf-repo");
+      const checkCeiling = async (load) => {
+        let work;
+        try {
+          work = perTokenWork(computeChannel5.parseMeteringConfig(...await load()));
+        } catch (error) {
+          work = `no metering arch: ${error.message}`;
+        }
+        client ??= await createClient(getRpc(command), getSigner(command));
+        const result = throughputCeiling(work, await chainCapInputsOrReason(client.api, opts.miner), opts.minTokensPerSecond);
+        process.stderr.write(ceilingWarning(result));
+        enforceCeiling(result);
+        return result;
+      };
+      let ceiling;
+      if (preflight) ceiling = await checkCeiling(async () => [preflight.configJson, preflight.hfQuantConfigJson ?? null]);
       let source;
       if (metadataOnly) {
         const modelDir = join5(workDir, "metadata");
@@ -9047,14 +9341,15 @@ function modelOnboardCmd() {
       } else {
         source = await materializeSource(opts.source, sourceDir, opts.token, job.state.sourceRevision, join5(workDir, "download.json"), preflight?.files);
       }
+      ceiling ??= await checkCeiling(async () => [await readFile7(join5(source.modelDir, "config.json")), await readHfQuantConfig(source.modelDir)]);
       let checkpoint;
       let parameterFiles;
       try {
         const raw = await readFile7(join5(source.modelDir, "config.json"), "utf8");
-        if (job.state.configHash && createHash3("sha256").update(raw).digest("hex") !== job.state.configHash) throw new Error("downloaded config differs from preflight");
-        checkpoint = computeChannel4.parseMeteringConfig(Buffer.from(raw), await readHfQuantConfig(source.modelDir));
+        if (job.state.configHash && createHash5("sha256").update(raw).digest("hex") !== job.state.configHash) throw new Error("downloaded config differs from preflight");
+        checkpoint = computeChannel5.parseMeteringConfig(Buffer.from(raw), await readHfQuantConfig(source.modelDir));
         if (checkpoint.totalParams === null) {
-          const configHash = createHash3("sha256").update(raw).digest("hex");
+          const configHash = createHash5("sha256").update(raw).digest("hex");
           const census = metadataOnly ? await censusHeaders(workDir, preflight, await (await import("@flop-labs/sdk")).readSafetensorsHeaders(
             hubRepo,
             preflight.revision,
@@ -9101,11 +9396,11 @@ function modelOnboardCmd() {
       let { mirror, revision } = source;
       if (opts.hfRepo) {
         if (mirror) throw new Error("--hf-repo is for a local --source; a Hugging Face --source registers its own mirror");
-        ({ mirror, revision } = await verifiedHuggingFaceMirror(
-          opts.hfRepo,
-          measured.contentRoot,
-          (hf, root) => sdk.verifyMirror(hf, root, { token: opts.token ?? process.env.HF_TOKEN })
-        ));
+        const token = opts.token ?? process.env.HF_TOKEN;
+        ({ mirror, revision } = await verifiedHuggingFaceMirror(opts.hfRepo, measured.contentRoot, {
+          preflight: (repo) => sdk.preflightHuggingFace(repo, { revision: opts.revision, token }),
+          verify: (hf, root, at) => sdk.verifyMirror(hf, root, { revision: at, token })
+        }));
       }
       const identity = identityFromPack(
         opts.registryModel ?? source.registryModel,
@@ -9135,10 +9430,15 @@ function modelOnboardCmd() {
       if (job.state.chain && JSON.stringify(job.state.chain) !== JSON.stringify(chain)) throw new Error("onboarding chain/publisher resume conflict");
       job.state.chain = chain;
       await job.save();
-      if (computeChannel4.isDenseGdnArch(checkpoint.arch)) await requireHybridApproval(client.api, checkpoint.arch);
+      if (computeChannel5.isDenseGdnArch(checkpoint.arch)) await requireHybridApproval(client.api, checkpoint.arch);
       const submit = (tx) => submitOnboardingTx(client.api, tx, client.signer, job);
       let state = await readState(client.api, sdk, identity.modelHash, precision);
-      const checkedParams = computeChannel4.isDenseGdnArch(checkpoint.arch) ? paramsBillion : void 0;
+      if (metadataOnly && opts.approve && (!state.registered || !state.weightsRef)) {
+        throw new Error(
+          `--approve on a metadata run needs the bound DA backup of ${identity.modelHash}; register without --approve, run \`${modelBackupHandoff(identity.modelHash, precision, preflight?.revision)}\` on a box with room for the checkpoint, bind it with \`flop model upload --commitment\` and \`flop model mirrors set --append --source da:<table_ref>\`, then rerun with --approve (or rerun with --download --approve from a fresh --state-dir)`
+        );
+      }
+      const checkedParams = computeChannel5.isDenseGdnArch(checkpoint.arch) ? paramsBillion : void 0;
       planOnboard(state, identity, precision, teePlatforms, checkedParams);
       await validateCapture(opts.captureEndpoint, identity, checkpoint, source.modelDir);
       job.state.phase = "capture-verified";
@@ -9149,21 +9449,46 @@ function modelOnboardCmd() {
           throw new Error("pending registration parameter count differs from the checkpoint census; original transaction retained");
         }
       }
-      await recoverOnboardingTx(client.api, job, async (original) => {
-        if (!containsApproval(original.method)) return;
-        if (!opts.approve) throw new Error("pending approval requires --approve before rebroadcast; signed transaction retained");
-        const signer = original.signer.toString();
-        const mode = await registryAuthorityMode(client.api, signer, network);
-        await requireApprovalEvidence(
-          client.api,
+      let daSpotCheck;
+      const approvalEvidence = async (api, signer, root) => {
+        const evidence = await requireApprovalEvidence(
+          api,
           identity.modelHash,
           precision,
           signer,
           measured.imageSize,
           checkpoint.arch,
-          mode === "root",
+          root,
           measured.files
         );
+        if (!metadataOnly || evidence.approved) return evidence;
+        const token = opts.token ?? process.env.HF_TOKEN;
+        daSpotCheck = await spotCheckImage(measured.files, measured.imageSize, {
+          chunkSize: sdk.DA_CHUNK_SIZE,
+          readChunk: (j) => daRetrieveChunk(opts.daValidator, getRpc(command), evidence.weights, j),
+          readHubRange: (path5, start, end, size) => readHuggingFaceRange(hubRepo, preflight.revision, path5, start, end, size, token)
+        });
+        const again = await requireApprovalEvidence(
+          api,
+          identity.modelHash,
+          precision,
+          signer,
+          measured.imageSize,
+          checkpoint.arch,
+          root,
+          measured.files
+        );
+        if (again.weights !== evidence.weights || again.table !== evidence.table) {
+          throw new Error("the bound DA image or file table changed during the spot check; nothing was submitted");
+        }
+        return again;
+      };
+      await recoverOnboardingTx(client.api, job, async (original) => {
+        if (!containsApproval(original.method)) return;
+        if (!opts.approve) throw new Error("pending approval requires --approve before rebroadcast; signed transaction retained");
+        const signer = original.signer.toString();
+        const mode = await registryAuthorityMode(client.api, signer, network);
+        await approvalEvidence(client.api, signer, mode === "root");
       });
       state = await readState(client.api, sdk, identity.modelHash, precision);
       const plan = planOnboard(state, identity, precision, teePlatforms, checkedParams);
@@ -9295,7 +9620,7 @@ function modelOnboardCmd() {
           const view = await authority.api.at(await authority.api.rpc.chain.getFinalizedHead());
           const raw = await view.query.modelRegistry.admissionRequirements(identity.modelHash);
           const requirements = optionValue(raw);
-          const expectedHybrid = computeChannel4.isDenseGdnArch(checkpoint.arch);
+          const expectedHybrid = computeChannel5.isDenseGdnArch(checkpoint.arch);
           if (requirements) {
             const metadata = requirements.toJSON?.() ?? requirements;
             if (BigInt(metadata.weightsSizeBytes ?? metadata.weights_size_bytes) !== BigInt(measured.imageSize) || (metadata.requiresHybridProfile ?? metadata.requires_hybrid_profile) !== expectedHybrid) {
@@ -9310,16 +9635,7 @@ function modelOnboardCmd() {
           }
         }
         if (opts.approve) {
-          const evidence = await requireApprovalEvidence(
-            authority.api,
-            identity.modelHash,
-            precision,
-            authority.signer.address,
-            measured.imageSize,
-            checkpoint.arch,
-            mode === "root",
-            measured.files
-          );
+          const evidence = await approvalEvidence(authority.api, authority.signer.address, mode === "root");
           if (!evidence.approved) {
             const call = authority.api.tx.modelRegistry.approveModel(identity.modelHash, authority.signer.address);
             await submitOnboardingTx(authority.api, registryAuthorityCall(authority.api, call, mode), authority.signer, job);
@@ -9352,7 +9668,7 @@ function modelOnboardCmd() {
       if (metadataOnly && !state.weightsRef) {
         process.stderr.write(
           `next: approval needs the DA backup of ${identity.modelHash} (packed image + file table, ${measured.imageSize} bytes in ${Math.max(1, Math.ceil(measured.imageSize / sdk.DA_CHUNK_SIZE))} chunk(s)). On a box with room for the checkpoint, run
-  flop model backup ${identity.modelHash} --model-dir <path>${preflight ? ` --revision ${preflight.revision}` : ""}
+  ${modelBackupHandoff(identity.modelHash, precision, preflight?.revision)}
 then bind the DataRef it prints. Rerunning this command with --download packs the image from disk instead, which needs about twice the checkpoint's size.
 `
         );
@@ -9362,7 +9678,9 @@ then bind the DataRef it prints. Rerunning this command with --download packs th
           ...identity,
           registered: state.registered,
           approved: state.approved === true,
-          ...metadataOnly ? { contentRoot: measured.contentRoot, imageSize: measured.imageSize, daBackup: state.weightsRef ? "present" : "pending" } : {}
+          throughputCeiling: ceiling,
+          ...metadataOnly ? { contentRoot: measured.contentRoot, imageSize: measured.imageSize, daBackup: state.weightsRef ? "present" : "pending" } : {},
+          ...daSpotCheck ? { daSpotCheck } : {}
         },
         getJson(command)
       );
@@ -9381,7 +9699,10 @@ then bind the DataRef it prints. Rerunning this command with --download packs th
 // src/commands/model-upload.ts
 var PRECISIONS2 = ["FP32", "FP16", "BF16", "INT8", "INT4", "Mixed"];
 function modelUploadCmd() {
-  return new Command30("upload").description("Push verified weights to validator DA, register the lease, and bind the model").requiredOption("--model-hash <hex>", "Registered model hash").option("--path <path>", "Local weight file or directory (packed and streamed from disk)").option("--source <source>", "Remote source: hf:<repo>, modelscope:<repo>, https://..., da:<commitment>").addOption(new Option2("--precision <precision>", "Measured-root precision").choices(PRECISIONS2).default("FP16")).option("--da-endpoint <url>", "DA blob gateway for a da:<commitment> source").option("--da-validator <path>", "da-validator executable", "da-validator").option("--token <token>", "HF/ModelScope bearer token (prefer HF_TOKEN)").option("--commitment <hex>", "Existing DA commitment (commitment-only recovery mode)").option("--size <bytes>", "Existing DA blob size (required with --commitment)").option("--json", "Output as JSON").action(async (opts, command) => {
+  return new Command30("upload").description("Push verified weights to validator DA, register the lease, and bind the model").requiredOption("--model-hash <hex>", "Registered model hash").option("--path <path>", "Local weight file or directory (packed and streamed from disk)").option("--source <source>", "Remote source: hf:<repo>, modelscope:<repo>, https://..., da:<commitment>").option(
+    "--revision <sha>",
+    "Immutable 40-hex commit for an hf: --source; when omitted, main is used only if its sha256 table reproduces the registered content-v1 root"
+  ).addOption(new Option2("--precision <precision>", "Measured-root precision").choices(PRECISIONS2).default("FP16")).option("--da-endpoint <url>", "DA blob gateway for a da:<commitment> source").option("--da-validator <path>", "da-validator executable", "da-validator").option("--token <token>", "HF/ModelScope bearer token (prefer HF_TOKEN)").option("--commitment <hex>", "Existing DA commitment (commitment-only recovery mode)").option("--size <bytes>", "Existing DA blob size (required with --commitment)").option("--json", "Output as JSON").action(async (opts, command) => {
     let client;
     let tempDir;
     try {
@@ -9391,6 +9712,9 @@ function modelUploadCmd() {
       }
       if (opts.commitment && !opts.size) throw new Error("--size is required with --commitment");
       if (opts.size && !opts.commitment) throw new Error("--commitment is required with --size");
+      const revision = parseRevision(opts.revision);
+      const remote = opts.source ? parseModelSource(opts.source) : void 0;
+      if (revision && remote?.kind !== "huggingface") throw new Error("--revision is only for an hf: --source");
       const sdk = await import("@flop-labs/sdk");
       const rpc = getRpc(command);
       client = await createClient(rpc, getSigner(command));
@@ -9403,20 +9727,32 @@ function modelUploadCmd() {
       let imagePath;
       let custody;
       if (!commitment) {
-        tempDir = await mkdtemp(join6(tmpdir(), "flop-model-upload-"));
+        tempDir = await mkdtemp2(join6(tmpdir2(), "flop-model-upload-"));
         imagePath = join6(tempDir, "weights.img");
+        const expected = await sdk.readMeasuredRoot(client.api, opts.modelHash, opts.precision);
+        if (!expected) throw new Error(`no measured root for ${opts.modelHash} at ${opts.precision}`);
         if (opts.path) {
           let modelDir = resolve8(opts.path);
-          const stat = await lstat7(modelDir);
-          if (stat.isSymbolicLink()) throw new Error(`model source must not be a symlink: ${opts.path}`);
-          if (stat.isFile()) {
+          const stat2 = await lstat7(modelDir);
+          if (stat2.isSymbolicLink()) throw new Error(`model source must not be a symlink: ${opts.path}`);
+          if (stat2.isFile()) {
             modelDir = join6(tempDir, "model");
             await mkdir11(modelDir);
             await copyFile(resolve8(opts.path), join6(modelDir, basename2(opts.path)));
           }
           measured = await packModel(modelDir, imagePath, join6(tempDir, "manifest.json"));
+        } else if (remote.kind === "huggingface" && !remote.path) {
+          const modelDir = join6(tempDir, "model");
+          await mkdir11(modelDir);
+          await downloadPinnedHuggingFace(remote.repo, modelDir, expected, {
+            revision,
+            token: opts.token ?? process.env.HF_TOKEN
+          });
+          const roots = await sdk.measureModelDir(modelDir);
+          measured = { content_root: roots.contentRoot, verity_root: roots.verityRoot };
+          await pipeline2(sdk.packedImageStream(modelDir, roots.files), createWriteStream(imagePath));
         } else {
-          const files = (await sdk.fetchWeights(parseModelSource(opts.source), {
+          const files = (await sdk.fetchWeights(remote, {
             token: opts.token ?? process.env.HF_TOKEN,
             daSource: daHttpSource(opts.daEndpoint)
           })).files;
@@ -9424,8 +9760,6 @@ function modelUploadCmd() {
           measured = { content_root: roots.contentRoot, verity_root: roots.verityRoot };
           await writeFile9(imagePath, sdk.buildImage(files));
         }
-        const expected = await sdk.readMeasuredRoot(client.api, opts.modelHash, opts.precision);
-        if (!expected) throw new Error(`no measured root for ${opts.modelHash} at ${opts.precision}`);
         const scheme = sdk.rootScheme({ contentRoot: measured.content_root, verityRoot: measured.verity_root }, expected);
         if (!scheme) {
           throw new Error(`source content_root ${measured.content_root} and verity_root ${measured.verity_root} != registered ${expected}`);
@@ -9477,7 +9811,7 @@ function modelUploadCmd() {
         next: "rerun the same command to resume the DA push; to abandon a registered blob, run the printed `flop da withdraw` recovery"
       });
     } finally {
-      if (tempDir) await rm3(tempDir, { recursive: true, force: true });
+      if (tempDir) await rm4(tempDir, { recursive: true, force: true });
       await client?.disconnect();
     }
   });
@@ -9522,12 +9856,187 @@ function modelAuditCmd() {
   });
 }
 
-// src/commands/model-preflight.ts
+// src/commands/model-mirrors.ts
 import { Command as Command32 } from "commander";
+var MIRROR_URI_MAX_BYTES = 512;
+var MAX_MODEL_MIRRORS = 8;
+var REPO = /^[^/\s]+\/[^/\s]+$/;
+function boundedUri(value, what) {
+  if (Buffer.byteLength(value, "utf8") > MIRROR_URI_MAX_BYTES) {
+    throw new Error(`${what} exceeds the registry's ${MIRROR_URI_MAX_BYTES}-byte bound`);
+  }
+  return value;
+}
+function parseMirrorSource(raw) {
+  if (raw.startsWith("https://")) {
+    let url;
+    try {
+      url = new URL(raw);
+    } catch {
+      throw new Error(`invalid https mirror URL: ${raw}`);
+    }
+    if (url.protocol !== "https:" || !url.hostname) throw new Error(`invalid https mirror URL: ${raw}`);
+    if (url.username || url.password) throw new Error("an https mirror URL must not carry credentials");
+    return { kind: "https", url: boundedUri(raw, "https mirror URL") };
+  }
+  for (const [prefix, kind] of [["hf:", "huggingface"], ["huggingface:", "huggingface"], ["modelscope:", "modelscope"]]) {
+    if (raw.startsWith(prefix)) {
+      const repo = raw.slice(prefix.length);
+      if (!REPO.test(repo)) throw new Error(`${kind} mirror must be ${prefix}<owner>/<model> (got ${raw})`);
+      return { kind, repo: boundedUri(repo, `${kind} repo id`) };
+    }
+  }
+  if (raw.startsWith("da:")) return { kind: "da", commitment: normalizeHash(raw.slice(3), "DA mirror commitment") };
+  throw new Error(`unsupported mirror "${raw}"; use https://..., hf:<owner>/<model>, modelscope:<owner>/<model> or da:<commitment>`);
+}
+function mirrorKey(entry) {
+  if (entry.kind === "https") return `https:${entry.url}`;
+  if (entry.kind === "da") return `da:${entry.commitment}@${entry.providerId ?? "?"}`;
+  return `${entry.kind}:${entry.repo}`;
+}
+function chainModelSource(entry) {
+  switch (entry.kind) {
+    case "https":
+      return { Https: entry.url };
+    case "huggingface":
+      return { HuggingFace: entry.repo };
+    case "modelscope":
+      return { ModelScope: entry.repo };
+    case "da":
+      if (entry.providerId === void 0 || entry.retention === void 0) {
+        throw new Error(`DA mirror ${entry.commitment} has no resolved provider or retention`);
+      }
+      return { DaLayer: { commitment: entry.commitment, provider_id: entry.providerId, retention: entry.retention } };
+  }
+}
+function decodeRegisteredMirror(json) {
+  const text4 = (hex5) => {
+    const value = String(hex5);
+    return /^0x([0-9a-f]{2})*$/i.test(value) ? Buffer.from(value.slice(2), "hex").toString("utf8") : value;
+  };
+  if (json?.https !== void 0) return { kind: "https", url: text4(json.https) };
+  if (json?.huggingFace !== void 0) return { kind: "huggingface", repo: text4(json.huggingFace) };
+  if (json?.modelScope !== void 0) return { kind: "modelscope", repo: text4(json.modelScope) };
+  if (json?.daLayer !== void 0) {
+    const ref = json.daLayer;
+    return {
+      kind: "da",
+      commitment: normalizeHash(String(ref.commitment), "registered DA mirror commitment"),
+      providerId: Number(ref.providerId ?? ref.provider_id),
+      retention: String(ref.retention)
+    };
+  }
+  throw new Error(`registered mirror has an unknown shape: ${JSON.stringify(json)}`);
+}
+function planMirrorList(requested, opts) {
+  if (opts.clear) {
+    if (requested.length > 0 || opts.append) throw new Error("--clear takes no --source and no --append");
+    return { sources: [], added: [] };
+  }
+  if (requested.length === 0) throw new Error("pass at least one --source, or --clear to remove every mirror");
+  const seen = /* @__PURE__ */ new Set();
+  for (const entry of requested) {
+    const key = mirrorKey(entry);
+    if (seen.has(key)) throw new Error(`duplicate mirror ${key}`);
+    seen.add(key);
+  }
+  const registered = opts.append ? opts.registered ?? [] : [];
+  const kept = new Set(registered.map(mirrorKey));
+  const added = requested.filter((entry) => !kept.has(mirrorKey(entry)));
+  const sources = [...registered, ...added];
+  if (sources.length > MAX_MODEL_MIRRORS) {
+    throw new Error(`${sources.length} mirrors exceed the registry's limit of ${MAX_MODEL_MIRRORS}`);
+  }
+  return { sources, added };
+}
+function display(entry) {
+  if (entry.kind === "da") return { kind: "da", commitment: entry.commitment, provider_id: entry.providerId, retention: entry.retention };
+  return entry.kind === "https" ? { kind: "https", url: entry.url } : { kind: entry.kind, repo: entry.repo };
+}
+var collect = (value, previous) => [...previous, value];
+function modelMirrorsSetCmd() {
+  return new Command32("set").description(
+    "Replace a registered model's mirror hint list (modelRegistry.setModelMirrors). Only the model's publisher may sign it: the call is signed-origin and checks publisher == signer, so neither a registrar nor Root (sudo) can set mirrors. Mirrors are hints: a miner serves the model only if the bytes it fetches reproduce the registered root"
+  ).requiredOption("--model-hash <hex>", "Registered model hash").option(
+    "--source <mirror>",
+    `Mirror, repeatable (at most ${MAX_MODEL_MIRRORS} in the final list): https://<url>, hf:<owner>/<model>, modelscope:<owner>/<model>, or da:<commitment> of a registered Leased DA blob (its provider is read from chain)`,
+    collect,
+    []
+  ).option(
+    "--append",
+    "Keep the finalized registered mirrors verbatim and add the new ones after them (a DA entry counts as present only at the same commitment and provider). The list is read at finality and then replaced, so a concurrent mirror change by the same publisher between the two is overwritten"
+  ).option("--clear", "Remove every mirror (an empty list)").option("--dry-run", "Validate and print the encoded call without signing or submitting it").option("--json", "Output as JSON").action(async (opts, command) => {
+    let client;
+    try {
+      const modelHash = normalizeHash(opts.modelHash, "--model-hash");
+      const requested = opts.source.map(parseMirrorSource);
+      planMirrorList(requested, { clear: opts.clear, append: opts.append, registered: [] });
+      client = await createClient(getRpc(command), getSigner(command));
+      const api = client.api;
+      const head = await api.rpc.chain.getFinalizedHead();
+      const [view, header] = await Promise.all([api.at(head), api.rpc.chain.getHeader(head)]);
+      const rawModel = await view.query.modelRegistry.models(modelHash);
+      if (!rawModel?.isSome) throw new Error(`model not registered at finality: ${modelHash}`);
+      const publisher = rawModel.unwrap().publisher;
+      if (!sameAccount(publisher, client.signer.address)) {
+        throw new Error(`only the model publisher ${publisher.toString()} may set its mirrors; the signer is ${client.signer.address}`);
+      }
+      const finalized = { query: view.query, rpc: { chain: { getHeader: async () => header } } };
+      for (const entry of requested) {
+        if (entry.kind !== "da") continue;
+        const blob = await view.query.daRegistry.blobs(entry.commitment);
+        if (!blob?.isSome) throw new Error(`DA mirror ${entry.commitment} is not a registered DA blob at finality`);
+        const size = blob.unwrap().toJSON().sizeBytes;
+        const ref = await existingLeasedRef(finalized, entry.commitment, Number(size));
+        if (!ref) throw new Error(`DA mirror ${entry.commitment} is not a registered DA blob at finality`);
+        entry.providerId = ref.providerId;
+        entry.retention = ref.retention;
+      }
+      const raw = await view.query.modelRegistry.modelMirrors(modelHash);
+      const registered = raw?.isSome ? raw.unwrap().toJSON().map(decodeRegisteredMirror) : [];
+      const { sources, added } = planMirrorList(requested, { clear: opts.clear, append: opts.append, registered });
+      const result = {
+        model_hash: modelHash,
+        publisher: publisher.toString(),
+        registered: registered.map(display),
+        sources: sources.map(display),
+        added: added.map(display),
+        finalized_block: header.number.toString()
+      };
+      if (opts.append && added.length === 0) {
+        print({ ...result, unchanged: true }, getJson(command));
+        return;
+      }
+      const tx = api.tx.modelRegistry.setModelMirrors(modelHash, sources.map(chainModelSource));
+      if (opts.dryRun) {
+        print({ ...result, dry_run: true, call: tx.method.toHex(), next: "rerun without --dry-run to sign and submit" }, getJson(command));
+        return;
+      }
+      const sdk = await import("@flop-labs/sdk");
+      const submitted = await sdk.watchTransaction(tx, client.signer, { api });
+      print({ ...result, tx_hash: (submitted.txHash ?? tx.hash).toHex() }, getJson(command));
+    } catch (error) {
+      commandError(error, { next: "fix the reported mirror or signer and rerun; after a submit timeout, rerun the same command with --dry-run and compare its `registered` (the finalized list) with `sources` before resubmitting" });
+    } finally {
+      await client?.disconnect();
+    }
+  });
+}
+function modelMirrorsCmd() {
+  return new Command32("mirrors").description("Model mirror hints (publisher-signed)").addCommand(modelMirrorsSetCmd());
+}
+
+// src/commands/model-preflight.ts
+import { Command as Command33 } from "commander";
 function modelPreflightCmd() {
-  return new Command32("preflight").description(
+  return new Command33("preflight").description(
     "Print a Hugging Face checkpoint's content_root (content-v1 model_hash), packed image size, DA chunk count and stored tensor elements from hub metadata and Range-read safetensors headers; no weights are downloaded"
-  ).requiredOption("--source <hf-id>", "Hugging Face id (owner/model or hf:owner/model)").option("--revision <sha>", "Immutable 40-hex commit; main is resolved to one when omitted").option("--token <token>", "Hugging Face bearer token (prefer HF_TOKEN)").option("--json", "Output as JSON").action(async (opts, command) => {
+  ).requiredOption("--source <hf-id>", "Hugging Face id (owner/model or hf:owner/model)").option("--revision <sha>", "Immutable 40-hex commit; main is resolved to one when omitted").option("--token <token>", "Hugging Face bearer token (prefer HF_TOKEN)").option(
+    "--min-tokens-per-second <n>",
+    "Fail unless the paid completion-token ceiling per channel at the median live calibration cap (or --miner's) is at least n; an unknown ceiling fails. The chain is read only with an explicit --rpc",
+    parseMinTokensPerSecond
+  ).option("--miner <address>", "Compute the ceiling at this miner's accepted calibration cap instead of the median live one; the best is reported, never gated").option("--json", "Output as JSON").action(async (opts, command) => {
+    let client;
     try {
       if (opts.revision && !/^[0-9a-f]{40}$/.test(opts.revision)) throw new Error("--revision must be an immutable 40-hex commit");
       const repo = opts.source.startsWith("hf:") ? opts.source.slice(3) : opts.source;
@@ -9535,6 +10044,25 @@ function modelPreflightCmd() {
       const hub = { revision: opts.revision, token: opts.token ?? process.env.HF_TOKEN };
       const preflight = await sdk.preflightHuggingFace(repo, hub);
       const headers = await sdk.readSafetensorsHeaders(repo, preflight.revision, preflight.files, hub);
+      let work = "no root config.json";
+      if (preflight.configJson) {
+        try {
+          work = perTokenWork(sdk.computeChannel.parseMeteringConfig(preflight.configJson, preflight.hfQuantConfigJson));
+        } catch (error) {
+          work = `no metering arch: ${error.message}`;
+        }
+      }
+      let chain = null;
+      if (resolveNetwork(command).rpcOverridden) {
+        try {
+          client = await createReadOnlyClient(getRpc(command));
+          chain = await chainCapInputsOrReason(client.api, opts.miner);
+        } catch (error) {
+          chain = `chain connection failed: ${error.message}`;
+        }
+      }
+      const ceiling = throughputCeiling(work, chain, opts.minTokensPerSecond);
+      process.stderr.write(ceilingWarning(ceiling));
       print({
         repo,
         revision: preflight.revision,
@@ -9545,18 +10073,23 @@ function modelPreflightCmd() {
         fetched_metadata_files: preflight.metadataFiles.length,
         safetensors_shards: headers.length,
         // Not a parameter count for packed sub-byte weights, and scale tensors are included.
-        stored_tensor_elements: sdk.storedTensorElements(headers).toString()
+        stored_tensor_elements: sdk.storedTensorElements(headers).toString(),
+        throughput_ceiling: snakeCeiling(ceiling)
       }, getJson(command));
+      enforceCeiling(ceiling);
     } catch (error) {
       commandError(error);
+    } finally {
+      await client?.disconnect();
     }
   });
 }
 
 // src/commands/model-backup.ts
-import { Command as Command33, Option as Option3 } from "commander";
-import { mkdir as mkdir12, rm as rm4, writeFile as writeFile10 } from "node:fs/promises";
-import { join as join8, resolve as resolve9 } from "node:path";
+import { Command as Command34, Option as Option3 } from "commander";
+import { createHash as createHash6 } from "node:crypto";
+import { mkdir as mkdir12, rm as rm5, stat, writeFile as writeFile10 } from "node:fs/promises";
+import { dirname as dirname6, join as join8, resolve as resolve9 } from "node:path";
 var PRECISIONS3 = ["FP32", "FP16", "BF16", "INT8", "INT4", "Mixed"];
 async function finalizedLeasedRef2(api, commitment, size) {
   const hash2 = await api.rpc.chain.getFinalizedHead();
@@ -9572,6 +10105,17 @@ async function awaitFinalizedLeasedRef(api, commitment, size) {
     await new Promise((wake) => setTimeout(wake, REGISTRATION_POLL_MS));
   }
 }
+function downloadStateDir(binding, override) {
+  if (override) return resolve9(override);
+  const key = createHash6("sha256").update(JSON.stringify(binding)).digest("hex");
+  return join8(dirname6(binding.modelDir), `.flop-backup-state-${key.slice(0, 16)}`);
+}
+async function assertSameFilesystem(stateDir, modelDir) {
+  if ((await stat(stateDir)).dev === (await stat(modelDir)).dev) return;
+  throw new Error(
+    `download state ${stateDir} is not on the same filesystem as ${modelDir}; pass a --state-dir on that filesystem outside the checkpoint tree (if --model-dir is a mount point, use a subdirectory of it)`
+  );
+}
 function registeredHubRepo(mirrors) {
   const repos = [...new Set(mirrors.filter((m) => m.kind === "huggingface").map((m) => m.repo))];
   if (repos.length > 1) {
@@ -9582,9 +10126,9 @@ function registeredHubRepo(mirrors) {
   return repos[0];
 }
 function modelBackupCmd() {
-  return new Command33("backup").description(
+  return new Command34("backup").description(
     "Stream a registered content-v1 checkpoint from Hugging Face into validator DA under this box's DA key, without ever writing the packed image out, and print the DataRefs its publisher then binds"
-  ).argument("<model_hash>", "Registered model hash (0x-hex)").requiredOption("--model-dir <path>", "Directory the checkpoint streams into (needs room for it)").option("--source <hf-id>", "Hugging Face id (owner/model or hf:owner/model); the model's registered mirror when omitted").option("--revision <sha>", "Immutable 40-hex commit; main is resolved to one when omitted").addOption(new Option3("--precision <precision>", "Measured-root precision").choices(PRECISIONS3).default("FP16")).option("--da-validator <path>", "da-validator executable", "da-validator").option("--token <token>", "Hugging Face bearer token (prefer HF_TOKEN)").option("--state-dir <path>", "Download resume receipts (outside the checkpoint tree)").option("--dry-run", "Print the plan and the DA deposit it would lock, and stop before any transfer").option("--json", "Output as JSON").action(async (modelHash, opts, command) => {
+  ).argument("<model_hash>", "Registered model hash (0x-hex)").requiredOption("--model-dir <path>", "Directory the checkpoint streams into (needs room for it)").option("--source <hf-id>", "Hugging Face id (owner/model or hf:owner/model); the model's registered mirror when omitted").option("--revision <sha>", "Immutable 40-hex commit; main is resolved to one when omitted").addOption(new Option3("--precision <precision>", "Measured-root precision").choices(PRECISIONS3).default("FP16")).option("--da-validator <path>", "da-validator executable", "da-validator").option("--token <token>", "Hugging Face bearer token (prefer HF_TOKEN)").option("--state-dir <path>", "Download resume receipts, on the checkpoint's filesystem but outside its tree (defaults to beside --model-dir)").option("--dry-run", "Print the plan and the DA deposit it would lock, and stop before any transfer").option("--json", "Output as JSON").action(async (modelHash, opts, command) => {
     let client;
     let workDir;
     try {
@@ -9637,10 +10181,12 @@ function modelBackupCmd() {
       workDir = join8(resolve9(modelDir, ".."), `.flop-backup-${modelHash.replace(/^0x/, "").slice(0, 16)}`);
       await mkdir12(workDir, { recursive: true, mode: 448 });
       await mkdir12(modelDir, { recursive: true });
-      const resumeState = opts.stateDir ? join8(resolve9(opts.stateDir), "download.json") : void 0;
-      if (resumeState) await mkdir12(resolve9(opts.stateDir), { recursive: true, mode: 448 });
+      const stateDir = downloadStateDir({ modelHash, modelDir, repo, revision: preflight.revision }, opts.stateDir);
+      await mkdir12(stateDir, { recursive: true, mode: 448 });
+      await assertSameFilesystem(stateDir, modelDir);
+      const resumeState = join8(stateDir, "download.json");
       process.stderr.write(
-        `backing up ${repo}@${preflight.revision} (${preflight.files.length} files, image ${imageSize} bytes, ${preflight.daChunks} DA chunk(s)) as ${modelHash}
+        `backing up ${repo}@${preflight.revision} (${preflight.files.length} files, image ${imageSize} bytes, ${preflight.daChunks} DA chunk(s)) as ${modelHash}; download receipts in ${stateDir}
 `
       );
       await sdk.fetchHuggingFaceToDir(repo, modelDir, {
@@ -9696,7 +10242,7 @@ function modelBackupCmd() {
         table_register_tx: table2.registerTx,
         // The binding is the model publisher's own transaction: this box holds no
         // model-registry authority, and `set_model_weights_ref` takes any Leased ref from it.
-        next: `the model publisher binds the backup with \`flop model upload --model-hash ${modelHash} --commitment ${weights.ref.commitment} --size ${imageSize}\`, then advertises the file table as a da:${table2.ref.commitment} mirror with \`modelRegistry.setModelMirrors\``,
+        next: `the model publisher binds the backup with \`flop model upload --model-hash ${modelHash} --commitment ${weights.ref.commitment} --size ${imageSize}\`, then advertises the file table with \`flop model mirrors set --model-hash ${modelHash} --append --source da:${table2.ref.commitment}\``,
         recovery: `flop da withdraw --commitment ${weights.ref.commitment} (and ${table2.ref.commitment}) refunds both deposits while nothing pins them`
       }, getJson(command));
     } catch (error) {
@@ -9704,16 +10250,16 @@ function modelBackupCmd() {
         next: "rerun the same command to resume the download and the DA push; to abandon a registered blob, run the printed `flop da withdraw` recovery"
       });
     } finally {
-      if (workDir) await rm4(workDir, { recursive: true, force: true });
+      if (workDir) await rm5(workDir, { recursive: true, force: true });
       await client?.disconnect();
     }
   });
 }
 
 // src/commands/model-list.ts
-import { Command as Command34 } from "commander";
+import { Command as Command35 } from "commander";
 function modelListCmd() {
-  return new Command34("list").description("List models registered on the selected FLOP chain").option("--name <text>", "Filter model names").option("--limit <n>", "Maximum rows returned", "100").option("--json", "Output as JSON").action(async (opts, command) => {
+  return new Command35("list").description("List models registered on the selected FLOP chain").option("--name <text>", "Filter model names").option("--limit <n>", "Maximum rows returned", "100").option("--json", "Output as JSON").action(async (opts, command) => {
     let client;
     try {
       const sdk = await import("@flop-labs/sdk");
@@ -9743,9 +10289,9 @@ function modelListCmd() {
 }
 
 // src/commands/model-get.ts
-import { Command as Command35 } from "commander";
+import { Command as Command36 } from "commander";
 function modelGetCmd() {
-  return new Command35("get").description("Get a registered model by hash or exact name").argument("<identifier>", "Model hash or name").option("--precision <precision>", "Measured-root precision", "FP16").option("--json", "Output as JSON").action(async (identifier, opts, command) => {
+  return new Command36("get").description("Get a registered model by hash or exact name").argument("<identifier>", "Model hash or name").option("--precision <precision>", "Measured-root precision", "FP16").option("--json", "Output as JSON").action(async (identifier, opts, command) => {
     let client;
     try {
       const sdk = await import("@flop-labs/sdk");
@@ -9776,12 +10322,25 @@ function modelGetCmd() {
 }
 
 // src/commands/model-fetch.ts
-import { Command as Command36, Option as Option4 } from "commander";
+import { Command as Command37, Option as Option4 } from "commander";
+import { mkdir as mkdir13, mkdtemp as mkdtemp3, readdir as readdir2, rename as rename8, rm as rm6, rmdir } from "node:fs/promises";
+import { basename as basename3, dirname as dirname7, join as join9, resolve as resolve10 } from "node:path";
 var PRECISIONS4 = ["FP32", "FP16", "BF16", "INT8", "INT4", "Mixed"];
+async function requireEmptyOrAbsent(dir) {
+  try {
+    if ((await readdir2(dir)).length > 0) throw new Error(`--output-dir ${dir} is not empty; a Hugging Face checkpoint is written only into an empty or new directory`);
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+  }
+}
 function modelFetchCmd() {
-  return new Command36("fetch").description("Fetch model weights and accept only a registered dm-verity root").argument("<identifier>", "Registered model hash or exact name").addOption(new Option4("--precision <precision>", "Weights precision").choices(PRECISIONS4).default("FP16")).option("--source <source...>", "Override mirrors: hf:<repo>, modelscope:<repo>, https://..., da:<commitment>").option("--da-endpoint <url>", "DA blob gateway exposing GET /blob/<commitment>").option("--output-dir <path>", "Destination directory", "./flop-model").option("--token <token>", "HF/ModelScope bearer token (prefer HF_TOKEN)").option("--json", "Output as JSON").action(async (identifier, opts, command) => {
+  return new Command37("fetch").description("Fetch model weights and accept only a registered dm-verity root").argument("<identifier>", "Registered model hash or exact name").addOption(new Option4("--precision <precision>", "Weights precision").choices(PRECISIONS4).default("FP16")).option("--source <source...>", "Override mirrors: hf:<repo>, modelscope:<repo>, https://..., da:<commitment>").option(
+    "--revision <sha>",
+    "Immutable 40-hex Hugging Face commit for hf: mirrors; when omitted, main is used only if its sha256 table reproduces the registered content-v1 root"
+  ).option("--da-endpoint <url>", "DA blob gateway exposing GET /blob/<commitment>").option("--output-dir <path>", "Destination directory", "./flop-model").option("--token <token>", "HF/ModelScope bearer token (prefer HF_TOKEN)").option("--json", "Output as JSON").action(async (identifier, opts, command) => {
     let client;
     try {
+      const revision = parseRevision(opts.revision);
       const sdk = await import("@flop-labs/sdk");
       client = await createClient(getRpc(command));
       const registry = new sdk.OnChainModelRegistry(client.api);
@@ -9793,30 +10352,56 @@ function modelFetchCmd() {
       }
       const sources = opts.source?.map(parseModelSource) ?? await sdk.readModelMirrors(client.api, model.hash);
       if (sources.length === 0) throw new Error(`no mirrors registered for model: ${model.hash}`);
+      const hub = sources.slice(0, 16).some((s) => s.kind === "huggingface");
+      if (revision && !hub) throw new Error("--revision is only for a Hugging Face source");
+      const outputDir = resolve10(opts.outputDir);
+      const token = opts.token ?? process.env.HF_TOKEN;
       const attempts = [];
       for (const source of sources.slice(0, 16)) {
+        let staged;
         try {
-          const fetched = await sdk.fetchWeights(source, {
-            token: opts.token ?? process.env.HF_TOKEN,
-            daSource: daHttpSource(opts.daEndpoint)
-          }, expected);
-          const result = sdk.verifyModelWeights(fetched.files, expected);
+          let result;
+          let write;
+          let at;
+          if (source.kind === "huggingface" && !source.path) {
+            await requireEmptyOrAbsent(outputDir);
+            await mkdir13(dirname7(outputDir), { recursive: true });
+            const dir = await mkdtemp3(join9(dirname7(outputDir), `.${basename3(outputDir)}.fetch-`));
+            staged = dir;
+            const download = await downloadPinnedHuggingFace(source.repo, dir, expected, { revision, token });
+            at = download.revision;
+            result = await sdk.verifyModelDir(dir, expected);
+            write = async () => {
+              await rmdir(outputDir).catch((error) => {
+                if (error.code !== "ENOENT") throw error;
+              });
+              await rename8(dir, outputDir);
+              staged = void 0;
+              return download.paths.map((p) => join9(outputDir, ...p.split("/")));
+            };
+          } else {
+            const fetched = await sdk.fetchWeights(source, { token, daSource: daHttpSource(opts.daEndpoint) }, expected);
+            result = sdk.verifyModelWeights(fetched.files, expected);
+            write = () => writeModelFiles(opts.outputDir, fetched.files);
+          }
           const verified = result.scheme === "content-v1" ? result.computedContentRoot : result.computedVerityRoot;
           attempts.push({
             source,
+            ...at ? { revision: at } : {},
             ok: result.ok,
             scheme: result.scheme,
             computed_content_root: result.computedContentRoot,
             computed_verity_root: result.computedVerityRoot
           });
           if (!result.ok) continue;
-          const files = await writeModelFiles(opts.outputDir, fetched.files);
+          const files = await write();
           print({
             model_hash: model.hash,
             precision: opts.precision,
             verified_root: verified,
             scheme: result.scheme,
             source,
+            ...at ? { revision: at } : {},
             output_dir: opts.outputDir,
             file_count: files.length,
             files: files.slice(0, 20),
@@ -9826,6 +10411,8 @@ function modelFetchCmd() {
           return;
         } catch (error) {
           attempts.push({ source, ok: false, error: error instanceof Error ? error.message : String(error) });
+        } finally {
+          if (staged) await rm6(staged, { recursive: true, force: true });
         }
       }
       throw new Error(`no mirror reproduced registered root ${expected}: ${JSON.stringify(attempts)}`);
@@ -9842,7 +10429,7 @@ function modelFetchCmd() {
 
 // src/commands/agent.ts
 import path2 from "node:path";
-import { Command as Command37, Option as Option5 } from "commander";
+import { Command as Command38, Option as Option5 } from "commander";
 import { getFlopNetworkProfile as getFlopNetworkProfile3 } from "@flop-labs/sdk";
 var DEFAULT_MCP_URL = "https://mcp.flop.network/mcp";
 var DEVNET_MCP_URL = "https://mcp.flop.network/mcp";
@@ -9930,7 +10517,7 @@ function buildAgentInitPlan(client, mode, mcpUrl2 = DEFAULT_MCP_URL) {
   };
 }
 function agentInitCmd() {
-  return new Command37("init").description("Print a safe agent onboarding plan and MCP configuration").addOption(new Option5("--client <client>", "Agent client").choices([
+  return new Command38("init").description("Print a safe agent onboarding plan and MCP configuration").addOption(new Option5("--client <client>", "Agent client").choices([
     "claude-code",
     "codex",
     "cursor",
@@ -9948,7 +10535,7 @@ function agentInitCmd() {
   });
 }
 function agentDoctorCmd() {
-  return new Command37("doctor").description("Check agent MCP, gateway, and optional chain connectivity").addOption(new Option5("--mode <mode>", "MCP mode").choices(["remote", "local"]).default("remote")).option("--mcp-url <url>", "MCP URL").option("--gateway <url>", "Optional OpenAI-compatible gateway URL").option("--repo <path>", "flop-core checkout for local mode", process.cwd()).option("--check-rpc", "Also require the configured chain RPC").option("--json", "Output as JSON").action(async (opts, command) => {
+  return new Command38("doctor").description("Check agent MCP, gateway, and optional chain connectivity").addOption(new Option5("--mode <mode>", "MCP mode").choices(["remote", "local"]).default("remote")).option("--mcp-url <url>", "MCP URL").option("--gateway <url>", "Optional OpenAI-compatible gateway URL").option("--repo <path>", "flop-core checkout for local mode", process.cwd()).option("--check-rpc", "Also require the configured chain RPC").option("--json", "Output as JSON").action(async (opts, command) => {
     try {
       const checks = [executableCheck("node")];
       if (opts.mode === "remote") {
@@ -9975,7 +10562,7 @@ function agentDoctorCmd() {
   });
 }
 function agentCredentialCmd() {
-  return new Command37("credential").description("Provision or reuse a devnet gateway key for agent clients (wallet-signed by default)").option("--print-key", "Print only the bearer key for a local client auth helper").option("--tailnet", "Enroll through the private tailnet lane (approved Tailscale users only)").option("--json", "Output non-secret credential metadata as JSON").action(async (opts, command) => {
+  return new Command38("credential").description("Provision or reuse a devnet gateway key for agent clients (wallet-signed by default)").option("--print-key", "Print only the bearer key for a local client auth helper").option("--tailnet", "Enroll through the private tailnet lane (approved Tailscale users only)").option("--json", "Output non-secret credential metadata as JSON").action(async (opts, command) => {
     try {
       if (getNetwork(command) !== "devnet") {
         throw new Error("agent credential requires --network devnet");
@@ -10008,20 +10595,20 @@ function agentCredentialCmd() {
   });
 }
 function agentCmd() {
-  const command = new Command37("agent").description("Onboard and operate FLOP-backed agents");
+  const command = new Command38("agent").description("Onboard and operate FLOP-backed agents");
   command.addCommand(agentInitCmd());
   command.addCommand(agentDoctorCmd());
   command.addCommand(agentCredentialCmd());
   command.addCommand(launchCmd());
   command.addCommand(proxyCmd());
   command.addCommand(hermesCmd());
-  const keys = new Command37("keys").description("Manage agent keys");
+  const keys = new Command38("keys").description("Manage agent keys");
   keys.addCommand(keysGenerateCmd());
   command.addCommand(keys);
-  const wallet = new Command37("wallet").description("Manage agent wallets");
+  const wallet = new Command38("wallet").description("Manage agent wallets");
   wallet.addCommand(walletAgentCreateCmd());
   command.addCommand(wallet);
-  const session = new Command37("session").description("Manage agent session keys");
+  const session = new Command38("session").description("Manage agent session keys");
   session.addCommand(sessionCreateCmd());
   session.addCommand(sessionInfoCmd());
   session.addCommand(sessionRevokeCmd());
@@ -10033,7 +10620,7 @@ function agentCmd() {
 // src/commands/miner.ts
 import { readFileSync } from "node:fs";
 import path3 from "node:path";
-import { Command as Command38, Option as Option6 } from "commander";
+import { Command as Command40, Option as Option6 } from "commander";
 import { formatFlop as formatFlop2 } from "@flop-labs/sdk";
 
 // src/gpu-inventory-remark.ts
@@ -10110,6 +10697,85 @@ function gpusFromDetection(devices) {
   return aggregate(devices.map((device) => ({ name: device.deviceName.trim(), memoryMib: device.memoryTotal })));
 }
 
+// src/commands/miner-capacity-rate.ts
+import { Command as Command39 } from "commander";
+var U64_MAX = (1n << 64n) - 1n;
+function parseReservationRate(value) {
+  if (!/^\d+$/.test(value.trim())) throw new Error("rate must be a positive whole number of G_n/s");
+  const rate = BigInt(value.trim());
+  if (rate <= 0n) throw new Error("rate must be positive; use --whole-cap to restore the default");
+  if (rate > U64_MAX) throw new Error("rate exceeds u64");
+  return rate;
+}
+function capacityRateCall(api, rate) {
+  const call = api.tx.computeChannel?.setCapacityReservationRate;
+  if (typeof call !== "function") {
+    throw new Error(`runtime spec ${api.runtimeVersion?.specVersion?.toString() ?? "?"} has no computeChannel.setCapacityReservationRate`);
+  }
+  return call(rate);
+}
+var text = (value) => value === void 0 || value === null ? null : value.toString();
+function showCmd() {
+  return new Command39("show").description("Show the miner's reservation rate and free calibrated capacity at the finalized block").argument("[address]", "Miner SS58 address; defaults to the configured signer").option("--json", "Output as JSON").action(async (address, _opts, command) => {
+    let client;
+    try {
+      const rpc = getRpc(command);
+      client = address ? await createReadOnlyClient(rpc) : await createClient(rpc, getSigner(command));
+      const miner = address ?? client.address;
+      const { computeChannel: computeChannel9 } = await import("@flop-labs/sdk");
+      const state = await computeChannel9.readMinerCapacityState(client.api, miner);
+      if (!state) {
+        print({ address: miner, rpc, supported: false }, getJson(command));
+        return;
+      }
+      const capacity = computeChannel9.minerCapacity(state);
+      print({
+        address: miner,
+        rpc,
+        supported: true,
+        block: text(capacity.block),
+        rate_set: text(state.rate),
+        cap_gflops_per_sec: text(capacity.cap),
+        reserved_gn_per_sec: text(capacity.reserved),
+        free_gn_per_sec: text(capacity.free),
+        next_open_reserves: text(capacity.rate),
+        next_open_fits: capacity.fits,
+        ...capacity.reason ? { reason: capacity.reason } : {},
+        live_reservations: state.reservations.filter((r) => r.lapsesAt > state.block).length
+      }, getJson(command));
+    } catch (error) {
+      commandError(error);
+    } finally {
+      await client?.disconnect();
+    }
+  });
+}
+function setCmd() {
+  return new Command39("set").description("Set the G_n/s each new channel reserves from the signer's cap (miner call set_capacity_reservation_rate)").argument("[rate]", "Rate in G_n/s, a positive integer").option("--whole-cap", "Clear the rate: each new channel reserves the whole current cap").option("--dry-run", "Print the encoded call without signing").option("--json", "Output as JSON").action(async (value, opts, command) => {
+    let client;
+    try {
+      if (value === void 0 === !opts.wholeCap) throw new Error("pass a rate or --whole-cap, not both");
+      const rate = opts.wholeCap ? null : parseReservationRate(value);
+      const rpc = getRpc(command);
+      client = opts.dryRun ? await createReadOnlyClient(rpc) : await createClient(rpc, getSigner(command));
+      const call = capacityRateCall(client.api, rate);
+      if (opts.dryRun) {
+        print({ action: "capacity_rate_call", rate_gn_per_sec: text(rate), call_data: call.method.toHex() }, getJson(command));
+        return;
+      }
+      const txHash = await submitExtrinsic(client.api, client.signer, call);
+      print({ action: "capacity_rate_set", address: client.address, rate_gn_per_sec: text(rate), tx_hash: txHash }, getJson(command));
+    } catch (error) {
+      commandError(error);
+    } finally {
+      await client?.disconnect();
+    }
+  });
+}
+function minerCapacityRateCmd() {
+  return new Command39("capacity-rate").description("Show or set the capacity each channel opened against this miner reserves").addCommand(showCmd()).addCommand(setCmd());
+}
+
 // src/commands/miner-controller-info.ts
 async function probeMinerSessionInfo(url, token, required = true) {
   try {
@@ -10146,6 +10812,159 @@ async function probeMinerSessionInfo(url, token, required = true) {
   }
 }
 
+// src/commands/miner-running.ts
+import { decodeAddress } from "@polkadot/util-crypto";
+import { computeChannel as computeChannel6 } from "@flop-labs/sdk";
+var hex2 = (bytes4) => `0x${Buffer.from(bytes4).toString("hex")}`;
+var reason = (error) => error instanceof Error ? error.message : String(error);
+async function readLocalIdentity(sessionUrl, token, fetchImpl = fetch) {
+  const base = sessionUrl.replace(/\/session\/info\/?$/, "");
+  try {
+    const info = await computeChannel6.fetchMinerSessionInfo(
+      base,
+      token ? { Authorization: `Bearer ${token}` } : {},
+      AbortSignal.timeout(2e4),
+      fetchImpl
+    );
+    if (!info.modelIdentity) {
+      return { check: {
+        id: "session:identity",
+        status: "fail",
+        required: true,
+        detail: "worker reports no model identity",
+        next: "check the worker logs for the model gate"
+      } };
+    }
+    return { info, check: {
+      id: "session:identity",
+      status: "pass",
+      required: true,
+      detail: `${info.minerAddress} serves ${info.modelIdentity.registryModel} (${hex2(info.modelIdentity.modelHash)}), session key ${hex2(info.enclaveKey)}`
+    } };
+  } catch {
+    return { check: {
+      id: "session:identity",
+      status: "fail",
+      required: true,
+      detail: "authenticated session info unavailable",
+      next: "check --session-url and SESSION_AUTH_TOKEN"
+    } };
+  }
+}
+async function probeMinerChain(api, address) {
+  try {
+    const account = decodeAddress(address);
+    const head = await api.rpc.chain.getFinalizedHead();
+    const at = await api.at(head);
+    const registration = await at.query.minerStaking.miners(account);
+    const active = registration?.isSome ? registration.unwrap().isActive : void 0;
+    const block = (await api.rpc.chain.getHeader(head)).number.toString();
+    if (!(active?.isTrue ?? active === true)) {
+      return {
+        id: "chain:miner",
+        status: "fail",
+        required: true,
+        detail: `${address} is not registered and active at finalized #${block}`,
+        next: "flop miner register; flop miner status"
+      };
+    }
+    const cap = (await api.rpc.state.call(
+      "TrustRootApi_accepted_calibration_cap",
+      hex2(Uint8Array.from([128, ...account])),
+      head
+    )).toU8a(true);
+    if (cap.length === 1 && cap[0] === 0) {
+      return {
+        id: "chain:miner",
+        status: "fail",
+        required: true,
+        detail: `${address} has no accepted calibration at finalized #${block}`,
+        next: "check the worker's calibration logs"
+      };
+    }
+    if (cap.length !== 9 || cap[0] !== 1) throw new Error("TrustRootApi_accepted_calibration_cap did not return an Option<u64>");
+    const gflops = new DataView(cap.buffer, cap.byteOffset + 1, 8).getBigUint64(0, true);
+    if (gflops === 0n) {
+      return {
+        id: "chain:miner",
+        status: "fail",
+        required: true,
+        detail: `${address} has a zero calibration cap at finalized #${block}`,
+        next: "check the worker's calibration logs"
+      };
+    }
+    return {
+      id: "chain:miner",
+      status: "pass",
+      required: true,
+      detail: `registered, active, accepted calibration cap ${gflops} GFLOP/s at finalized #${block} (capacity bond not checked)`
+    };
+  } catch (error) {
+    return { id: "chain:miner", status: "fail", required: true, detail: reason(error), next: "check --address and --rpc" };
+  }
+}
+async function probePublicEndpoint(api, endpoint, address, local, fetchImpl = fetch) {
+  let url;
+  try {
+    url = new URL(endpoint);
+  } catch {
+  }
+  if (!url || url.protocol !== "https:" || url.pathname !== "/" || url.search || url.hash || url.username || url.password) {
+    return [{
+      id: "endpoint",
+      status: "fail",
+      required: true,
+      detail: `${endpoint} is not a bare https://host[:port] endpoint`,
+      next: "pass the endpoint the worker advertises"
+    }];
+  }
+  const base = url.origin;
+  const checks = [];
+  try {
+    const anonymous = await fetchImpl(`${base}/session/info`, { redirect: "error", signal: AbortSignal.timeout(1e4) });
+    await anonymous.body?.cancel();
+    checks.push(anonymous.status === 401 ? { id: "endpoint:auth", status: "pass", required: true, detail: `${base}/session/info refuses anonymous requests (401)` } : {
+      id: "endpoint:auth",
+      status: "fail",
+      required: true,
+      detail: anonymous.status === 200 ? `${base}/session/info answers without authentication` : `${base}/session/info answered ${anonymous.status}`,
+      next: "route the public name to the worker; it must require the session token"
+    });
+  } catch (error) {
+    checks.push({
+      id: "endpoint:auth",
+      status: "fail",
+      required: true,
+      detail: `${base} unreachable: ${reason(error)}`,
+      next: "check DNS, TLS and the firewall from outside this host"
+    });
+  }
+  try {
+    const proven = await computeChannel6.fetchProvenSessionInfo(base, {
+      genesisHash: api.genesisHash.toU8a(),
+      account: decodeAddress(address),
+      minerAddress: address,
+      enclaveKey: local.enclaveKey,
+      modelIdentity: local.modelIdentity
+    }, fetchImpl, AbortSignal.timeout(1e4));
+    checks.push({
+      id: "endpoint:info-proof",
+      status: "pass",
+      required: true,
+      detail: `fresh ready proof from the local session key for the local model (image ${proven.image?.version ?? "?"} ${proven.image?.revision ?? "?"})`
+    });
+  } catch (error) {
+    checks.push({
+      id: "endpoint:info-proof",
+      status: "fail",
+      required: true,
+      detail: reason(error),
+      next: "the public name must reach this worker, ready, on this chain; a probe from this host can differ from an outside one (hairpin NAT)"
+    });
+  }
+  return checks;
+}
+
 // src/commands/miner.ts
 function collectGpu(value, previous) {
   return [...previous, value];
@@ -10251,7 +11070,7 @@ function buildMinerInitPlan(options) {
   };
 }
 function minerInitCmd() {
-  return new Command38("init").description("Print a phased miner onboarding plan").addOption(new Option6("--mode <mode>", "Miner mode").choices(["sim", "tdx", "cloud"]).default("sim")).option("--instance <number>", "Local guest instance number", "0").option("--provider <name>", "Cloud provider", "runpod").option(
+  return new Command40("init").description("Print a phased miner onboarding plan").addOption(new Option6("--mode <mode>", "Miner mode").choices(["sim", "tdx", "cloud"]).default("sim")).option("--instance <number>", "Local guest instance number", "0").option("--provider <name>", "Cloud provider", "runpod").option(
     "--gpu <SKU[:COUNT]>",
     "Expected GPU inventory; repeat for mixed-SKU hosts",
     collectGpu,
@@ -10294,10 +11113,20 @@ async function gpuCheck(mode) {
   }
 }
 function minerDoctorCmd() {
-  return new Command38("doctor").description("Check miner runtime, hardware, chain, and serving prerequisites").addOption(new Option6("--mode <mode>", "Miner mode").choices(["sim", "tdx", "cloud"]).default("sim")).option("--repo <path>", "flop-core checkout", process.cwd()).option("--session-url <url>", "Optional miner session info URL").option("--offline", "Skip chain RPC check").option("--json", "Output as JSON").action(async (opts, command) => {
+  return new Command40("doctor").description("Check miner runtime, hardware, chain, and serving prerequisites").addOption(new Option6("--mode <mode>", "Miner mode").choices(["sim", "tdx", "cloud"]).default("sim")).option("--repo <path>", "flop-core checkout", process.cwd()).option("--session-url <url>", "Optional miner session info URL").option("--offline", "Skip chain RPC check").option("--running", "Check a running miner instead of setup prerequisites (needs --address or --session-url)").option("--address <ss58>", "Miner account: registered, active and calibrated at finality").option("--endpoint <url>", "Public https endpoint: refuses anonymous info and answers a fresh info-proof (needs --session-url)").addHelpText("after", [
+    "",
+    "--running skips the docker/just/checkout/GPU checks, so it runs from a release pack or another host.",
+    "The session token is read from SESSION_AUTH_TOKEN, never a flag. --endpoint compares the public",
+    "proof with the worker's own authenticated identity; the gateway listing itself is not visible here.",
+    "From the pack's CLI image use --network host to reach the worker on 127.0.0.1."
+  ].join("\n")).option("--json", "Output as JSON").action(async (opts, command) => {
     try {
+      if (opts.running && !opts.address && !opts.sessionUrl) throw new Error("--running needs --address or --session-url");
+      if (opts.endpoint && !opts.sessionUrl) throw new Error("--endpoint needs --session-url: the public proof is checked against the worker's own identity");
+      if (opts.offline && (opts.address || opts.endpoint || opts.running)) throw new Error("--offline cannot check chain state; drop --offline");
       const checks = [];
-      if (opts.mode === "cloud") {
+      if (opts.running) {
+      } else if (opts.mode === "cloud") {
         checks.push(executableCheck("mise"), executableCheck("uv"));
         checks.push(pathCheck(
           "gpu-providers",
@@ -10315,14 +11144,34 @@ function minerDoctorCmd() {
           checks.push(pathCheck("device:kvm", "/dev/kvm"));
         }
       }
+      if (opts.sessionUrl) checks.push(await probeMinerSessionInfo(opts.sessionUrl, process.env.SESSION_AUTH_TOKEN));
+      const local = opts.sessionUrl && (opts.running || opts.endpoint) ? await readLocalIdentity(opts.sessionUrl, process.env.SESSION_AUTH_TOKEN) : void 0;
+      if (local) checks.push(local.check);
+      const address = opts.address ?? local?.info?.minerAddress;
+      if (opts.address && local?.info && local.info.minerAddress !== opts.address) {
+        checks.push({
+          id: "session:account",
+          status: "fail",
+          required: true,
+          detail: `worker signs as ${local.info.minerAddress}, not ${opts.address}`,
+          next: "check the miner key in the pack configuration"
+        });
+      }
       if (!opts.offline) {
         const rpc = getRpc(command);
         const client = await createClient(rpc);
-        checks.push(await probeRpc(client.api, rpc));
-        await client.disconnect();
+        try {
+          const rpcCheck = await probeRpc(client.api, rpc);
+          checks.push(rpcCheck);
+          if (rpcCheck.status === "pass" && address) checks.push(await probeMinerChain(client.api, address));
+          if (rpcCheck.status === "pass" && opts.endpoint && address && local?.info?.modelIdentity) {
+            checks.push(...await probePublicEndpoint(client.api, opts.endpoint, address, local.info));
+          }
+        } finally {
+          await client.disconnect();
+        }
       }
-      if (opts.sessionUrl) checks.push(await probeMinerSessionInfo(opts.sessionUrl, process.env.SESSION_AUTH_TOKEN));
-      const report = finalizeDoctor("miner", opts.mode, checks);
+      const report = finalizeDoctor("miner", opts.running ? "running" : opts.mode, checks);
       printDoctor(report, getJson(command));
       if (!report.ready) process.exitCode = 1;
     } catch (error) {
@@ -10331,7 +11180,7 @@ function minerDoctorCmd() {
   });
 }
 function minerStatusCmd() {
-  return new Command38("status").description("Show miner registration, calibration, and optional session status").argument("[address]", "Miner SS58 address; defaults to the configured signer").option("--session-url <url>", "Optional miner session info URL").option(
+  return new Command40("status").description("Show miner registration, calibration, and optional session status").argument("[address]", "Miner SS58 address; defaults to the configured signer").option("--session-url <url>", "Optional miner session info URL").option(
     "--expect-gpu <SKU[:COUNT]>",
     "Expected inventory; repeat to check attested state",
     collectGpu,
@@ -10381,7 +11230,7 @@ function minerStatusCmd() {
   });
 }
 function minerSkusCmd() {
-  return new Command38("skus").description("List GPU SKUs with active governance calibration ceilings").option("--json", "Output as JSON").action(async (_opts, command) => {
+  return new Command40("skus").description("List GPU SKUs with active governance calibration ceilings").option("--json", "Output as JSON").action(async (_opts, command) => {
     let client;
     try {
       const rpc = getRpc(command);
@@ -10405,7 +11254,7 @@ function minerSkusCmd() {
   });
 }
 function minerRegisterCmd() {
-  return new Command38("register").description("Register the signer as a miner and lock the runtime-defined self-stake").option("--commission <percent>", "Commission percent (0-20)", "10").option("--json", "Output as JSON").action(async (opts, command) => {
+  return new Command40("register").description("Register the signer as a miner and lock the runtime-defined self-stake").option("--commission <percent>", "Commission percent (0-20)", "10").option("--json", "Output as JSON").action(async (opts, command) => {
     let client;
     try {
       const commission = Number(opts.commission);
@@ -10432,7 +11281,7 @@ function minerRegisterCmd() {
   });
 }
 function minerDeclareGpuCmd() {
-  return new Command38("declare-gpu").description("Publish the signer's self-reported GPU inventory as a flop.gpu-inventory.v1 remark (display-only)").option("--nvidia-smi <path>", "Output of `nvidia-smi --query-gpu=name,memory.total --format=csv,noheader,nounits` (- for stdin)").option("--detect", "Run nvidia-smi here (on the GPU host)").option("--retract", "Publish an empty inventory, withdrawing an earlier declaration").option("--dry-run", "Print the remark without signing").option("--json", "Output as JSON").action(async (opts, command) => {
+  return new Command40("declare-gpu").description("Publish the signer's self-reported GPU inventory as a flop.gpu-inventory.v1 remark (display-only)").option("--nvidia-smi <path>", "Output of `nvidia-smi --query-gpu=name,memory.total --format=csv,noheader,nounits` (- for stdin)").option("--detect", "Run nvidia-smi here (on the GPU host)").option("--retract", "Publish an empty inventory, withdrawing an earlier declaration").option("--dry-run", "Print the remark without signing").option("--json", "Output as JSON").action(async (opts, command) => {
     let client;
     try {
       if ([opts.nvidiaSmi, opts.detect, opts.retract].filter(Boolean).length !== 1) {
@@ -10468,20 +11317,21 @@ function minerDeclareGpuCmd() {
   });
 }
 function minerCmd() {
-  const command = new Command38("miner").description("Onboard and operate inference miners");
+  const command = new Command40("miner").description("Onboard and operate inference miners");
   command.addCommand(minerInitCmd());
   command.addCommand(minerDoctorCmd());
   command.addCommand(minerStatusCmd());
   command.addCommand(minerSkusCmd());
   command.addCommand(minerRegisterCmd());
   command.addCommand(minerDeclareGpuCmd());
+  command.addCommand(minerCapacityRateCmd());
   command.addCommand(stakeInfoCmd());
   return command;
 }
 
 // src/commands/validator.ts
 import path4 from "node:path";
-import { Command as Command39, Option as Option7 } from "commander";
+import { Command as Command41, Option as Option7 } from "commander";
 import { formatFlop as formatFlop3 } from "@flop-labs/sdk";
 function buildValidatorInitPlan(mode, minimumStake) {
   const bringUp = mode === "local" ? "just run-node" : "infra/vultr/create-vm.sh <args>; infra/vultr/deploy-core.sh --vm-ip <TAILSCALE-IP>";
@@ -10531,7 +11381,7 @@ function buildValidatorInitPlan(mode, minimumStake) {
   };
 }
 function validatorInitCmd() {
-  return new Command39("init").description("Print a validator onboarding plan with the live minimum stake").addOption(new Option7("--mode <mode>", "Validator deployment mode").choices(["local", "vultr"]).default("local")).option("--offline", "Do not query the configured chain").option("--json", "Output as JSON").action(async (opts, command) => {
+  return new Command41("init").description("Print a validator onboarding plan with the live minimum stake").addOption(new Option7("--mode <mode>", "Validator deployment mode").choices(["local", "vultr"]).default("local")).option("--offline", "Do not query the configured chain").option("--json", "Output as JSON").action(async (opts, command) => {
     let client;
     try {
       let minimumStake;
@@ -10550,7 +11400,7 @@ function validatorInitCmd() {
   });
 }
 function validatorDoctorCmd() {
-  return new Command39("doctor").description("Check validator node and on-chain eligibility prerequisites").addOption(new Option7("--mode <mode>", "Validator deployment mode").choices(["local", "vultr"]).default("local")).option("--repo <path>", "flop-core checkout", process.cwd()).option("--offline", "Skip chain and account checks").option("--json", "Output as JSON").action(async (opts, command) => {
+  return new Command41("doctor").description("Check validator node and on-chain eligibility prerequisites").addOption(new Option7("--mode <mode>", "Validator deployment mode").choices(["local", "vultr"]).default("local")).option("--repo <path>", "flop-core checkout", process.cwd()).option("--offline", "Skip chain and account checks").option("--json", "Output as JSON").action(async (opts, command) => {
     let client;
     try {
       const checks = [
@@ -10621,7 +11471,7 @@ function validatorDoctorCmd() {
   });
 }
 function validatorStatusCmd() {
-  return new Command39("status").description("Show validator stake, jail, performance, and verified-work state").argument("[address]", "Validator SS58 address; defaults to the configured signer").option("--json", "Output as JSON").action(async (address, opts, command) => {
+  return new Command41("status").description("Show validator stake, jail, performance, and verified-work state").argument("[address]", "Validator SS58 address; defaults to the configured signer").option("--json", "Output as JSON").action(async (address, opts, command) => {
     let client;
     try {
       const rpc = getRpc(command);
@@ -10666,7 +11516,7 @@ function validatorStatusCmd() {
   });
 }
 function validatorRegisterCmd() {
-  return new Command39("register").description("Register the signer as a validator, bonding the effective minimum").option("--json", "Output as JSON").action(async (opts, command) => {
+  return new Command41("register").description("Register the signer as a validator, bonding the effective minimum").option("--json", "Output as JSON").action(async (opts, command) => {
     let client;
     try {
       const rpc = getRpc(command);
@@ -10696,7 +11546,7 @@ function validatorRegisterCmd() {
   });
 }
 function validatorCommissionCmd() {
-  return new Command39("commission").description("Set validator commission").argument("<percent>", "Commission percent (0-100)").option("--json", "Output as JSON").action(async (percent, opts, command) => {
+  return new Command41("commission").description("Set validator commission").argument("<percent>", "Commission percent (0-100)").option("--json", "Output as JSON").action(async (percent, opts, command) => {
     let client;
     try {
       const value = Number(percent);
@@ -10716,7 +11566,7 @@ function validatorCommissionCmd() {
   });
 }
 function validatorLifecycleCmd(name, description, sdkMethod) {
-  return new Command39(name).description(description).option("--json", "Output as JSON").action(async (opts, command) => {
+  return new Command41(name).description(description).option("--json", "Output as JSON").action(async (opts, command) => {
     let client;
     try {
       const rpc = getRpc(command);
@@ -10732,7 +11582,7 @@ function validatorLifecycleCmd(name, description, sdkMethod) {
   });
 }
 function validatorCmd() {
-  const command = new Command39("validator").description("Onboard and operate validator nodes");
+  const command = new Command41("validator").description("Onboard and operate validator nodes");
   command.addCommand(validatorInitCmd());
   command.addCommand(validatorDoctorCmd());
   command.addCommand(validatorStatusCmd());
@@ -10745,7 +11595,7 @@ function validatorCmd() {
 }
 
 // src/commands/network-status.ts
-import { Command as Command40 } from "commander";
+import { Command as Command42 } from "commander";
 
 // src/network.ts
 async function probeRpcChain(network, rpc) {
@@ -10779,7 +11629,7 @@ function networkStatusCmd(probeRpc2 = probeRpcChain, probeFaucet = async (endpoi
     return { ...identity, ready: null, readinessError: error instanceof Error ? error.message : String(error) };
   }
 }) {
-  return new Command40("status").description("Show resolved network endpoints and live chain identity").option("--offline", "Resolve configured endpoints without connecting").option("--json", "Output as JSON").action(async (opts, command) => {
+  return new Command42("status").description("Show resolved network endpoints and live chain identity").option("--offline", "Resolve configured endpoints without connecting").option("--json", "Output as JSON").action(async (opts, command) => {
     const resolved = resolveNetwork(command);
     let rpcInfo = null;
     let rpcError;
@@ -10833,9 +11683,9 @@ function networkStatusCmd(probeRpc2 = probeRpcChain, probeFaucet = async (endpoi
 }
 
 // src/commands/faucet-request.ts
-import { Command as Command41 } from "commander";
+import { Command as Command43 } from "commander";
 function faucetRequestCmd(probeRpc2 = probeRpcChain) {
-  return new Command41("request").description("Request dev/test FLOP after verifying faucet and RPC chain identity").argument("<address>", "SS58 address to fund").option("--amount <flop>", "Requested FLOP amount; server policy may cap it").option("--endpoint <url>", "Explicit faucet endpoint override").option("--json", "Output as JSON").action(async (address, opts, command) => {
+  return new Command43("request").description("Request dev/test FLOP after verifying faucet and RPC chain identity").argument("<address>", "SS58 address to fund").option("--amount <flop>", "Requested FLOP amount; server policy may cap it").option("--endpoint <url>", "Explicit faucet endpoint override").option("--json", "Output as JSON").action(async (address, opts, command) => {
     try {
       const resolved = resolveNetwork(command);
       const endpoint = opts.endpoint ?? resolved.profile.faucet;
@@ -10862,6 +11712,25 @@ function faucetRequestCmd(probeRpc2 = probeRpcChain) {
         amount,
         maxRetries: 1
       });
+      if (!result.success && result.outcome === "unknown") {
+        printError({
+          code: "FAUCET_OUTCOME_UNKNOWN",
+          message: `${result.error ?? "Faucet outcome unknown"}; reconcile the original request before requesting again`,
+          retryable: false,
+          next: "reconcile the original request before requesting again",
+          network: resolved.network,
+          address,
+          faucet: endpoint,
+          genesis_hash: rpcChain.genesisHash,
+          ...result.status !== void 0 ? { status: result.status } : {},
+          ...result.reason ? { reason: result.reason } : {},
+          ...result.retryAfterSeconds !== void 0 ? { retry_after_seconds: result.retryAfterSeconds } : {},
+          ...result.txHash ? { tx_hash: result.txHash } : {},
+          ...result.amount !== void 0 ? { amount: result.amount } : {}
+        }, getJson(command));
+        process.exitCode = 1;
+        return;
+      }
       if (!result.success) {
         commandError(new Error(result.error ?? "Faucet request failed"), {
           code: result.status === 429 ? "RATE_LIMITED" : "FAUCET_REQUEST_FAILED",
@@ -10876,7 +11745,9 @@ function faucetRequestCmd(probeRpc2 = probeRpcChain) {
         amount: result.amount,
         tx_hash: result.txHash,
         faucet: endpoint,
-        genesis_hash: rpcChain.genesisHash
+        genesis_hash: rpcChain.genesisHash,
+        status: "unconfirmed",
+        recovery: "reconcile the original request before requesting again"
       }, getJson(command));
     } catch (error) {
       commandError(error, {
@@ -10888,16 +11759,16 @@ function faucetRequestCmd(probeRpc2 = probeRpcChain) {
 }
 
 // src/commands/chat.ts
-import { Command as Command42 } from "commander";
+import { Command as Command44 } from "commander";
 import { randomUUID as randomUUID4 } from "node:crypto";
 import { homedir as homedir4 } from "node:os";
-import { join as join9 } from "node:path";
+import { join as join10 } from "node:path";
 import { createInterface } from "node:readline/promises";
 import { stdin, stdout } from "node:process";
 
 // src/conversations.ts
-import { mkdir as mkdir13, readFile as readFile8, rename as rename8, writeFile as writeFile11 } from "node:fs/promises";
-import { dirname as dirname6 } from "node:path";
+import { mkdir as mkdir14, readFile as readFile8, rename as rename9, writeFile as writeFile11 } from "node:fs/promises";
+import { dirname as dirname8 } from "node:path";
 var MAX_CONVERSATIONS = 100;
 var MAX_CONVERSATION_MESSAGES = 100;
 var MAX_MESSAGE_CHARS = 16384;
@@ -10916,11 +11787,11 @@ var ConversationStore = class {
     }
   }
   async write(data) {
-    await mkdir13(dirname6(this.path), { recursive: true, mode: 448 });
+    await mkdir14(dirname8(this.path), { recursive: true, mode: 448 });
     const temp = `${this.path}.${process.pid}.tmp`;
     await writeFile11(temp, `${JSON.stringify(data, null, 2)}
 `, { mode: 384 });
-    await rename8(temp, this.path);
+    await rename9(temp, this.path);
   }
   async list() {
     return Object.values((await this.read()).conversations).sort((a, b) => b.updatedAt.localeCompare(a.updatedAt));
@@ -10955,7 +11826,7 @@ function conversationPrompt(messages) {
 
 // src/commands/chat.ts
 function chatCmd() {
-  return new Command42("chat").description("Start or resume a persistent FLOP chat, optionally through a bounded session").argument("[prompt]", "One-shot prompt; omit for interactive chat").option("--conversation <id>", "Resume a conversation ID").option("--model <id>", "32-byte model hash or exact registered name from flop model list").option("--session-owner <address>", "Use --signer as this owner's session delegate").option("--max-flop <n>", "Per-turn FLOP cap", "5").option("--tee-requirements <hex>", "Registered HTLC appraisal commitments (100-byte SCALE hex)", process.env.FLOP_HTLC_TEE_REQUIREMENTS).option("--skip-model-check", "Allow an unregistered model (local development only)").option("--history", "List stored conversations without connecting").option("--delete <id>", "Delete a stored conversation without connecting").option("--store <path>", "Conversation store path", join9(homedir4(), ".flop", "conversations.json")).option("--json", "Output as JSON").action(async (prompt, opts, command) => {
+  return new Command44("chat").description("Start or resume a persistent FLOP chat, optionally through a bounded session").argument("[prompt]", "One-shot prompt; omit for interactive chat").option("--conversation <id>", "Resume a conversation ID").option("--model <id>", "32-byte model hash or exact registered name from flop model list").option("--session-owner <address>", "Use --signer as this owner's session delegate").option("--max-flop <n>", "Per-turn FLOP cap", "5").option("--tee-requirements <hex>", "Registered HTLC appraisal commitments (100-byte SCALE hex)", process.env.FLOP_HTLC_TEE_REQUIREMENTS).option("--skip-model-check", "Allow an unregistered model (local development only)").option("--history", "List stored conversations without connecting").option("--delete <id>", "Delete a stored conversation without connecting").option("--store <path>", "Conversation store path", join10(homedir4(), ".flop", "conversations.json")).option("--json", "Output as JSON").action(async (prompt, opts, command) => {
     const store = new ConversationStore(opts.store);
     let agent;
     try {
@@ -11080,7 +11951,7 @@ function chatCmd() {
 }
 
 // src/commands/tx-build.ts
-import { Command as Command43 } from "commander";
+import { Command as Command45 } from "commander";
 import { writeFile as writeFile12 } from "node:fs/promises";
 import { execFile as execFile5 } from "node:child_process";
 import { promisify as promisify5 } from "node:util";
@@ -11147,7 +12018,7 @@ function assertEnvelopeChain(api, envelope) {
 
 // src/commands/tx-build.ts
 function txBuildCmd() {
-  return new Command43("build").description("Build an immortal unsigned transaction envelope for air-gapped signing").requiredOption("--address <address>", "Signing account").requiredOption("--call <hex>", "SCALE call hex").option("--out <path>", "Write envelope JSON").option("--qr", "Render the signing payload using installed qrencode").option("--json", "Output as JSON").action(async (opts, command) => {
+  return new Command45("build").description("Build an immortal unsigned transaction envelope for air-gapped signing").requiredOption("--address <address>", "Signing account").requiredOption("--call <hex>", "SCALE call hex").option("--out <path>", "Write envelope JSON").option("--qr", "Render the signing payload using installed qrencode").option("--json", "Output as JSON").action(async (opts, command) => {
     let client;
     try {
       const resolved = resolveNetwork(command);
@@ -11192,10 +12063,10 @@ function txBuildCmd() {
 }
 
 // src/commands/tx-broadcast.ts
-import { Command as Command44 } from "commander";
+import { Command as Command46 } from "commander";
 import { readFile as readFile9 } from "node:fs/promises";
 function txBroadcastCmd() {
-  return new Command44("broadcast").description("Import an offline signature, reject chain drift, and broadcast").argument("<envelope>", "Unsigned envelope JSON").requiredOption("--signature <hex>", "SCALE MultiSignature from the offline signer").option("--allow-nonce-drift", "Broadcast even if account nonce has changed").option("--json", "Output as JSON").action(async (path5, opts, command) => {
+  return new Command46("broadcast").description("Import an offline signature, reject chain drift, and broadcast").argument("<envelope>", "Unsigned envelope JSON").requiredOption("--signature <hex>", "SCALE MultiSignature from the offline signer").option("--allow-nonce-drift", "Broadcast even if account nonce has changed").option("--json", "Output as JSON").action(async (path5, opts, command) => {
     let client;
     try {
       if (!/^0x[0-9a-f]+$/i.test(opts.signature)) throw new Error("--signature must be 0x hex");
@@ -11231,7 +12102,7 @@ function txBroadcastCmd() {
 }
 
 // src/commands/multisig.ts
-import { Command as Command45 } from "commander";
+import { Command as Command47 } from "commander";
 import { createKeyMulti, encodeAddress, sortAddresses } from "@polkadot/util-crypto";
 import { blake2AsHex } from "@polkadot/util-crypto";
 function otherSignatories(signer, values) {
@@ -11252,8 +12123,8 @@ function timepoint(opts) {
   return { height: parsePositiveInt(opts.height, "--height"), index };
 }
 function multisigCmd() {
-  const command = new Command45("multisig").description("Participate in Substrate multisig transactions");
-  command.addCommand(new Command45("address").description("Derive the deterministic multisig address").requiredOption("--threshold <n>", "Approval threshold").requiredOption("--signatory <address...>", "All signatory addresses").option("--json", "Output as JSON").action(async (opts, cmd) => {
+  const command = new Command47("multisig").description("Participate in Substrate multisig transactions");
+  command.addCommand(new Command47("address").description("Derive the deterministic multisig address").requiredOption("--threshold <n>", "Approval threshold").requiredOption("--signatory <address...>", "All signatory addresses").option("--json", "Output as JSON").action(async (opts, cmd) => {
     try {
       const threshold = parsePositiveInt(opts.threshold, "--threshold");
       const sorted = sortAddresses(opts.signatory, 42);
@@ -11268,7 +12139,7 @@ function multisigCmd() {
       commandError(error);
     }
   }));
-  command.addCommand(new Command45("propose").description("Create or execute a multisig call").requiredOption("--threshold <n>", "Approval threshold").requiredOption("--other <address...>", "Other signatories (exclude configured signer)").requiredOption("--call <hex>", "SCALE call hex").option("--max-ref-time <n>", "Maximum call refTime").option("--max-proof-size <n>", "Maximum call proofSize").option("--json", "Output as JSON").action(async (opts, cmd) => {
+  command.addCommand(new Command47("propose").description("Create or execute a multisig call").requiredOption("--threshold <n>", "Approval threshold").requiredOption("--other <address...>", "Other signatories (exclude configured signer)").requiredOption("--call <hex>", "SCALE call hex").option("--max-ref-time <n>", "Maximum call refTime").option("--max-proof-size <n>", "Maximum call proofSize").option("--json", "Output as JSON").action(async (opts, cmd) => {
     let client;
     try {
       client = await createClient(getRpc(cmd), getSigner(cmd));
@@ -11291,7 +12162,7 @@ function multisigCmd() {
       await client?.disconnect();
     }
   }));
-  command.addCommand(new Command45("approve").description("Approve a pending multisig call hash").requiredOption("--threshold <n>", "Approval threshold").requiredOption("--other <address...>", "Other signatories").requiredOption("--call-hash <hex>", "Pending call hash").requiredOption("--height <n>", "Timepoint block height").requiredOption("--index <n>", "Timepoint extrinsic index").option("--max-ref-time <n>", "Maximum call refTime").option("--max-proof-size <n>", "Maximum call proofSize").option("--json", "Output as JSON").action(async (opts, cmd) => {
+  command.addCommand(new Command47("approve").description("Approve a pending multisig call hash").requiredOption("--threshold <n>", "Approval threshold").requiredOption("--other <address...>", "Other signatories").requiredOption("--call-hash <hex>", "Pending call hash").requiredOption("--height <n>", "Timepoint block height").requiredOption("--index <n>", "Timepoint extrinsic index").option("--max-ref-time <n>", "Maximum call refTime").option("--max-proof-size <n>", "Maximum call proofSize").option("--json", "Output as JSON").action(async (opts, cmd) => {
     let client;
     try {
       client = await createClient(getRpc(cmd), getSigner(cmd));
@@ -11310,7 +12181,7 @@ function multisigCmd() {
       await client?.disconnect();
     }
   }));
-  command.addCommand(new Command45("cancel").description("Cancel a pending multisig as its depositor").requiredOption("--threshold <n>", "Approval threshold").requiredOption("--other <address...>", "Other signatories").requiredOption("--call-hash <hex>", "Pending call hash").requiredOption("--height <n>", "Timepoint block height").requiredOption("--index <n>", "Timepoint extrinsic index").option("--json", "Output as JSON").action(async (opts, cmd) => {
+  command.addCommand(new Command47("cancel").description("Cancel a pending multisig as its depositor").requiredOption("--threshold <n>", "Approval threshold").requiredOption("--other <address...>", "Other signatories").requiredOption("--call-hash <hex>", "Pending call hash").requiredOption("--height <n>", "Timepoint block height").requiredOption("--index <n>", "Timepoint extrinsic index").option("--json", "Output as JSON").action(async (opts, cmd) => {
     let client;
     try {
       client = await createClient(getRpc(cmd), getSigner(cmd));
@@ -11327,7 +12198,7 @@ function multisigCmd() {
       await client?.disconnect();
     }
   }));
-  command.addCommand(new Command45("list").alias("status").description("List pending calls for a multisig account").requiredOption("--account <address>", "Multisig account").option("--json", "Output as JSON").action(async (opts, cmd) => {
+  command.addCommand(new Command47("list").alias("status").description("List pending calls for a multisig account").requiredOption("--account <address>", "Multisig account").option("--json", "Output as JSON").action(async (opts, cmd) => {
     let client;
     try {
       client = await createClient(getRpc(cmd));
@@ -11347,10 +12218,10 @@ function multisigCmd() {
 }
 
 // src/commands/channel.ts
-import { Command as Command46 } from "commander";
+import { Command as Command48 } from "commander";
 function channelCmd() {
-  const command = new Command46("channel").description("Inspect and finalize compute channels");
-  command.addCommand(new Command46("list").description("List on-chain compute channels").option("--agent <address>", "Filter by paying agent").option("--miner <address>", "Filter by serving miner").option("--include-closed", "Include terminal channels").option("--json", "Output as JSON").action(async (opts, cmd) => {
+  const command = new Command48("channel").description("Inspect and finalize compute channels");
+  command.addCommand(new Command48("list").description("List on-chain compute channels").option("--agent <address>", "Filter by paying agent").option("--miner <address>", "Filter by serving miner").option("--include-closed", "Include terminal channels").option("--json", "Output as JSON").action(async (opts, cmd) => {
     let client;
     try {
       client = await createClient(getRpc(cmd));
@@ -11378,7 +12249,7 @@ function channelCmd() {
       await client?.disconnect();
     }
   }));
-  command.addCommand(new Command46("finalize").description("Finalize a force-settled channel after its challenge window").argument("<channel-id>", "0x channel ID").option("--json", "Output as JSON").action(async (channelId, _opts, cmd) => {
+  command.addCommand(new Command48("finalize").description("Finalize a force-settled channel after its challenge window").argument("<channel-id>", "0x channel ID").option("--json", "Output as JSON").action(async (channelId, _opts, cmd) => {
     let client;
     try {
       client = await createClient(getRpc(cmd), getSigner(cmd));
@@ -11420,7 +12291,7 @@ function timestamp(value, label) {
   if (!Number.isFinite(parsed)) throw new Error(`${label} must be an ISO-8601 timestamp`);
   return parsed;
 }
-function decimal(value, label) {
+function decimal2(value, label) {
   if (!DECIMAL.test(value)) throw new Error(`${label} must be a non-negative decimal string`);
 }
 function positiveInt(value, label) {
@@ -11448,6 +12319,12 @@ function parseCanonicalCatalog(value, options = {}) {
     if (!HASH.test(record.decode_policy_hash)) throw new Error(`${label}.decode_policy_hash must be lowercase 32-byte hex`);
     if (!Number.isSafeInteger(record.precision) || record.precision < 0 || record.precision > 5) throw new Error(`${label}.precision is invalid`);
     if (!QUANTIZATIONS.has(record.quantization)) throw new Error(`${label}.quantization is invalid`);
+    if (record.precision_detail !== void 0) {
+      if (!record.precision_detail || typeof record.precision_detail !== "object" || Array.isArray(record.precision_detail)) throw new Error(`${label}.precision_detail is invalid`);
+      for (const field2 of ["activations", "kv_cache"]) {
+        if (record.precision_detail[field2] !== void 0 && !QUANTIZATIONS.has(record.precision_detail[field2])) throw new Error(`${label}.precision_detail.${field2} is invalid`);
+      }
+    }
     if (!Array.isArray(record.input_modalities) || record.input_modalities.length < 1 || record.input_modalities.some((v) => !INPUT_MODALITIES.has(v))) throw new Error(`${label}.input_modalities is invalid`);
     if (!Array.isArray(record.output_modalities) || record.output_modalities.length < 1 || record.output_modalities.some((v) => !OUTPUT_MODALITIES.has(v))) throw new Error(`${label}.output_modalities is invalid`);
     if (!Array.isArray(record.supported_sampling_parameters) || record.supported_sampling_parameters.some((v) => !SAMPLING.has(v))) throw new Error(`${label}.supported_sampling_parameters is invalid`);
@@ -11478,9 +12355,9 @@ function parseCanonicalCatalog(value, options = {}) {
       if (!price.version || !price.miner_address || !price.flop_usd_source) throw new Error(`${priceLabel} provenance is incomplete`);
       if (pricedMiners.has(price.miner_address)) throw new Error(`${priceLabel} duplicates a miner price`);
       pricedMiners.add(price.miner_address);
-      for (const field2 of ["flop_per_gn", "gn_per_prompt_token", "gn_per_completion_token", "flop_usd"]) decimal(price[field2], `${priceLabel}.${field2}`);
-      if (price.request_usd !== void 0) decimal(price.request_usd, `${priceLabel}.request_usd`);
-      if (price.image_usd !== void 0) decimal(price.image_usd, `${priceLabel}.image_usd`);
+      for (const field2 of ["flop_per_gn", "gn_per_prompt_token", "gn_per_completion_token", "flop_usd"]) decimal2(price[field2], `${priceLabel}.${field2}`);
+      if (price.request_usd !== void 0) decimal2(price.request_usd, `${priceLabel}.request_usd`);
+      if (price.image_usd !== void 0) decimal2(price.image_usd, `${priceLabel}.image_usd`);
       timestamp(price.ratified_at, `${priceLabel}.ratified_at`);
       if (timestamp(price.effective_at, `${priceLabel}.effective_at`) >= timestamp(price.expires_at, `${priceLabel}.expires_at`)) throw new Error(`${priceLabel} has an empty validity window`);
       if (price.rounding?.mode !== "ceil" || !Number.isSafeInteger(price.rounding.decimal_places) || price.rounding.decimal_places < 0 || price.rounding.decimal_places > 18) throw new Error(`${priceLabel}.rounding is invalid`);
@@ -11494,7 +12371,7 @@ function parseCanonicalCatalog(value, options = {}) {
           const timed = Number.isSafeInteger(override.utc_start) && Number.isSafeInteger(override.utc_end) && Number(override.utc_start) >= 0 && Number(override.utc_start) <= 2359 && Number(override.utc_end) >= 0 && Number(override.utc_end) <= 2359;
           if (longContext === timed) throw new Error(`${overrideLabel} must have exactly one supported condition kind`);
           for (const field2 of ["prompt", "completion", "request", "image", "input_cache_read", "internal_reasoning"]) {
-            if (override[field2] !== void 0) decimal(String(override[field2]), `${overrideLabel}.${field2}`);
+            if (override[field2] !== void 0) decimal2(String(override[field2]), `${overrideLabel}.${field2}`);
           }
         }
       }
@@ -11505,8 +12382,8 @@ function parseCanonicalCatalog(value, options = {}) {
   });
 }
 function parts(value) {
-  const [whole, fraction = ""] = value.split(".");
-  return { value: BigInt(whole + fraction), scale: fraction.length };
+  const [whole, fraction2 = ""] = value.split(".");
+  return { value: BigInt(whole + fraction2), scale: fraction2.length };
 }
 function multiply(values, places) {
   const product = values.map(parts).reduce((acc, item) => ({ value: acc.value * item.value, scale: acc.scale + item.scale }), { value: 1n, scale: 0 });
@@ -11573,13 +12450,20 @@ function buildLiveCatalog(records, sessions, now = Date.now(), policy) {
       for (const field2 of ["prompt", "completion", "request", "image", "input_cache_read", "internal_reasoning"]) if (compareDecimal(candidate[field2], current[field2]) > 0) next[field2] = candidate[field2];
       return next;
     }, void 0);
+    const ready = is_ready && capacity_tpm > 0;
     return {
       record,
-      is_ready: is_ready && capacity_tpm > 0,
-      capacity_tpm: is_ready && capacity_tpm > 0 ? capacity_tpm : null,
+      is_ready: ready,
+      capacity_tpm: ready ? capacity_tpm : null,
+      // Report the oldest contributing observation and earliest evidence expiry.
+      // These describe evidence freshness, not a guarantee of continued availability.
+      ...ready ? {
+        capacity_observed_at: priced.reduce((oldest, item) => timestamp(item.session.capacity_observed_at, "capacity_observed_at") < timestamp(oldest, "capacity_observed_at") ? item.session.capacity_observed_at : oldest, priced[0].session.capacity_observed_at),
+        capacity_expires_at: priced.reduce((earliest, item) => timestamp(item.session.capacity_expires_at, "capacity_expires_at") < timestamp(earliest, "capacity_expires_at") ? item.session.capacity_expires_at : earliest, priced[0].session.capacity_expires_at)
+      } : {},
       datacenters: is_ready ? [...new Set(priced.map((item) => item.session.datacenter.country_code))].sort().map((country_code) => ({ country_code })) : [],
       ...is_ready && conservative ? { pricing: conservative } : {},
-      price_sources: is_ready ? priced.map(({ session, price }) => ({ miner_address: session.miner_address, version: price.version, source: price.flop_usd_source, effective_at: price.effective_at, expires_at: price.expires_at })).sort((a, b) => a.miner_address.localeCompare(b.miner_address)) : [],
+      price_sources: is_ready ? priced.map(({ session, price }) => ({ miner_address: session.miner_address, version: price.version, source: price.flop_usd_source, effective_at: price.effective_at, expires_at: price.expires_at, ratified_at: price.ratified_at, flop_per_gn: price.flop_per_gn, gn_per_prompt_token: price.gn_per_prompt_token, gn_per_completion_token: price.gn_per_completion_token, flop_usd: price.flop_usd, rounding: price.rounding })).sort((a, b) => a.miner_address.localeCompare(b.miner_address)) : [],
       admitted_sessions: is_ready ? priced.map((item) => item.session.session_id).sort() : []
     };
   });
@@ -11824,12 +12708,12 @@ function generateGatewayConfig(input) {
 }
 
 // src/commands/gateway-allowlist.ts
-import { Command as Command47 } from "commander";
+import { Command as Command49 } from "commander";
 var PRECISIONS5 = ["FP32", "FP16", "BF16", "INT8", "INT4", "Mixed"];
 function field(value, camel, snake) {
   return value?.[camel] ?? value?.[snake];
 }
-function text(value, label) {
+function text2(value, label) {
   const json = value?.toJSON?.() ?? value;
   if (typeof json === "string") {
     return json.startsWith("0x") ? Buffer.from(json.slice(2), "hex").toString("utf8") : json;
@@ -11837,7 +12721,7 @@ function text(value, label) {
   if (Array.isArray(json)) return Buffer.from(json).toString("utf8");
   throw new Error(`on-chain ${label} is invalid`);
 }
-function hex2(value, label) {
+function hex3(value, label) {
   const rendered = value?.toHex?.() ?? value?.toJSON?.() ?? value;
   if (typeof rendered !== "string" || !/^0x[0-9a-fA-F]{64}$/.test(rendered)) {
     throw new Error(`on-chain ${label} is not a 32-byte hash`);
@@ -11857,8 +12741,8 @@ async function fetchMinerSessionInfo(endpoint, authToken, signal) {
   if (anonymous.status !== 401) throw new Error("miner /session/info does not enforce bearer authentication");
   const response = await fetch(infoUrl, { redirect: "error", headers: { Authorization: `Bearer ${authToken}` }, signal });
   if (!response.ok) throw new Error(`miner /session/info returned HTTP ${response.status}`);
-  const { computeChannel: computeChannel7 } = await import("@flop-labs/sdk");
-  return JSON.parse(await computeChannel7.readMinerResponse(response, 16 * 1024));
+  const { computeChannel: computeChannel9 } = await import("@flop-labs/sdk");
+  return JSON.parse(await computeChannel9.readMinerResponse(response, 16 * 1024));
 }
 async function readChainSnapshot(api, miner, pinnedHead) {
   const identity = miner.modelIdentity;
@@ -11890,16 +12774,16 @@ async function readChainSnapshot(api, miner, pinnedHead) {
       `model ${identity.modelHash} is ${status}, not Verified; refusing to generate a gateway catalog`
     );
   }
-  const measuredRoot = rootRaw?.isSome ? hex2(rootRaw.unwrap(), "measuredRoot") : null;
-  const allowedDecodePolicyHashes = policiesRaw?.isSome ? Array.from(policiesRaw.unwrap(), (item) => hex2(item, "allowedDecodePolicies")) : [];
+  const measuredRoot = rootRaw?.isSome ? hex3(rootRaw.unwrap(), "measuredRoot") : null;
+  const allowedDecodePolicyHashes = policiesRaw?.isSome ? Array.from(policiesRaw.unwrap(), (item) => hex3(item, "allowedDecodePolicies")) : [];
   const lease = BigInt(at.consts.hwCalibration.calibrationLeaseBlocks.toString());
   const calibration = calibrationRaw?.isSome ? calibrationRaw.unwrap() : null;
   const acceptedAt = calibration ? BigInt(field(calibration, "acceptedAt", "accepted_at").toString()) : 0n;
   return {
     model: {
-      modelHash: hex2(field(modelJson, "modelHash", "model_hash"), "modelHash"),
-      registryModel: text(field(modelJson, "modelName", "model_name"), "modelName"),
-      registryVersion: text(field(modelJson, "version", "version"), "version")
+      modelHash: hex3(field(modelJson, "modelHash", "model_hash"), "modelHash"),
+      registryModel: text2(field(modelJson, "modelName", "model_name"), "modelName"),
+      registryVersion: text2(field(modelJson, "version", "version"), "version")
     },
     measuredRoot,
     allowedDecodePolicyHashes,
@@ -11913,7 +12797,7 @@ async function readChainSnapshot(api, miner, pinnedHead) {
   };
 }
 function gatewayAllowlistCmd() {
-  return new Command47("allowlist").description("Generate gateway allowlist and model catalog from a live miner and chain").requiredOption("--miner <url>", "Authenticated miner base URL").requiredOption("--auth-token-env <name>", "Environment variable containing the miner bearer token").requiredOption("--attestation <path>", "Operator/provider deployment, catalog, and price evidence JSON").option("--json", "Output as JSON").action(async (opts, command) => {
+  return new Command49("allowlist").description("Generate gateway allowlist and model catalog from a live miner and chain").requiredOption("--miner <url>", "Authenticated miner base URL").requiredOption("--auth-token-env <name>", "Environment variable containing the miner bearer token").requiredOption("--attestation <path>", "Operator/provider deployment, catalog, and price evidence JSON").option("--json", "Output as JSON").action(async (opts, command) => {
     let client;
     try {
       const authToken = process.env[opts.authTokenEnv];
@@ -11939,13 +12823,13 @@ function gatewayAllowlistCmd() {
 }
 
 // src/commands/gateway-renew.ts
-import { open as open3, readFile as readFile11, rename as rename9, rm as rm5, writeFile as writeFile13 } from "node:fs/promises";
-import { createHash as createHash6 } from "node:crypto";
+import { open as open3, readFile as readFile11, rename as rename10, rm as rm7, writeFile as writeFile13 } from "node:fs/promises";
+import { createHash as createHash9 } from "node:crypto";
 import { request as request2 } from "node:http";
 import { setTimeout as delay } from "node:timers/promises";
 import { Keyring as Keyring5 } from "@polkadot/keyring";
-import { decodeAddress as decodeAddress2, randomAsU8a } from "@polkadot/util-crypto";
-import { computeChannel as computeChannel6 } from "@flop-labs/sdk";
+import { decodeAddress as decodeAddress3, randomAsU8a } from "@polkadot/util-crypto";
+import { computeChannel as computeChannel8 } from "@flop-labs/sdk";
 
 // ../gateway-core/src/gateway-evidence.ts
 var GATEWAY_EVIDENCE_VERSION = "flop.gateway-evidence.v1";
@@ -11965,7 +12849,7 @@ function instant(value, label) {
   if (!Number.isFinite(parsed)) throw new Error(`${label} must be an ISO-8601 timestamp`);
   return parsed;
 }
-function text2(value, label) {
+function text3(value, label) {
   if (typeof value !== "string" || !value) throw new Error(`${label} is required`);
 }
 function parseGatewayEvidence(value) {
@@ -11977,15 +12861,15 @@ function parseGatewayEvidence(value) {
   }
   for (const [index, entry] of evidence.deployments.entries()) {
     const label = `deployments[${index}]`;
-    text2(entry?.miner_address, `${label}.miner_address`);
-    text2(entry.endpoint, `${label}.endpoint`);
+    text3(entry?.miner_address, `${label}.miner_address`);
+    text3(entry.endpoint, `${label}.endpoint`);
     if (!HASH3.test(entry.enclave_key)) throw new Error(`${label}.enclave_key is invalid`);
     const identity = entry.model_identity;
     if (!identity || IDENTITY_FIELDS.some((field2) => field2 === "precision" ? !Number.isSafeInteger(identity.precision) : typeof identity[field2] !== "string" || !identity[field2])) {
       throw new Error(`${label}.model_identity is incomplete`);
     }
-    text2(entry.source, `${label}.source`);
-    text2(entry.observer, `${label}.observer`);
+    text3(entry.source, `${label}.source`);
+    text3(entry.observer, `${label}.observer`);
     if (!/^[A-Z]{2}$/.test(entry.country_code)) throw new Error(`${label}.country_code is invalid`);
     if (instant(entry.observed_at, `${label}.observed_at`) >= instant(entry.expires_at, `${label}.expires_at`)) {
       throw new Error(`${label} has an empty validity window`);
@@ -11993,10 +12877,10 @@ function parseGatewayEvidence(value) {
   }
   for (const [index, entry] of evidence.conformance.entries()) {
     const label = `conformance[${index}]`;
-    text2(entry?.openrouter_slug, `${label}.openrouter_slug`);
-    text2(entry.feature, `${label}.feature`);
-    text2(entry.registry_version, `${label}.registry_version`);
-    text2(entry.observer, `${label}.observer`);
+    text3(entry?.openrouter_slug, `${label}.openrouter_slug`);
+    text3(entry.feature, `${label}.feature`);
+    text3(entry.registry_version, `${label}.registry_version`);
+    text3(entry.observer, `${label}.observer`);
     if (!HASH3.test(entry.model_hash) || !HASH3.test(entry.decode_policy_hash)) throw new Error(`${label} identity hashes are invalid`);
     if (entry.passed !== true) throw new Error(`${label} must record a pass`);
     if (instant(entry.tested_at, `${label}.tested_at`) >= instant(entry.expires_at, `${label}.expires_at`)) {
@@ -12037,11 +12921,11 @@ function renewConformance(record, evidence, now = Date.now()) {
 }
 
 // ../gateway-core/src/tools-qualification.ts
-import { createHash as createHash4 } from "node:crypto";
+import { createHash as createHash7 } from "node:crypto";
 import { isDeepStrictEqual } from "node:util";
 var OWNER_TOOLS_QUALIFICATION = "flop.owner-tools-qualification.v1";
 function qualificationHash(value) {
-  return createHash4("sha256").update(JSON.stringify(value)).digest("hex");
+  return createHash7("sha256").update(JSON.stringify(value)).digest("hex");
 }
 function toolsQualificationEnvelope(model, version, scope) {
   return {
@@ -12139,12 +13023,13 @@ function qualificationSignedToolCalls(frames) {
 
 // ../gateway-core/src/miner-admissions.ts
 import { closeSync, fstatSync, openSync, readSync, statSync } from "node:fs";
-import { createHash as createHash5 } from "node:crypto";
+import { createHash as createHash8 } from "node:crypto";
 var MAX_ADMITTED_MINERS = 256;
+var ADMISSION_CONCURRENCY = 4;
 var MAX_FILE_BYTES = 512 * 1024;
 var HASH4 = /^0x[0-9a-f]{64}$/;
 var minerSlot = (miner) => `${miner.minerAddress}:${miner.modelIdentity.requestedSlug}`;
-var staticMinerSha256 = (miner) => createHash5("sha256").update(JSON.stringify(miner)).digest("hex");
+var staticMinerSha256 = (miner) => createHash8("sha256").update(JSON.stringify(miner)).digest("hex");
 var sameModel = (a, b) => Object.keys(a.modelIdentity).every((key) => a.modelIdentity[key] === b.modelIdentity[key]);
 var MinerRouting = class {
   constructor(statics, path5) {
@@ -12161,8 +13046,8 @@ var MinerRouting = class {
     if (this.path) {
       let stamp;
       try {
-        const stat = statSync(this.path);
-        stamp = `${stat.dev}:${stat.ino}:${stat.size}:${stat.mtimeMs}`;
+        const stat2 = statSync(this.path);
+        stamp = `${stat2.dev}:${stat2.ino}:${stat2.size}:${stat2.mtimeMs}`;
       } catch {
         stamp = "missing";
       }
@@ -12174,8 +13059,8 @@ var MinerRouting = class {
         let fd;
         try {
           fd = openSync(this.path, "r");
-          const stat = fstatSync(fd);
-          if (!stat.isFile() || stat.size > MAX_FILE_BYTES) throw new Error();
+          const stat2 = fstatSync(fd);
+          if (!stat2.isFile() || stat2.size > MAX_FILE_BYTES) throw new Error();
           const buffer = Buffer.alloc(MAX_FILE_BYTES + 1);
           const size = readSync(fd, buffer, 0, buffer.length, 0);
           if (size > MAX_FILE_BYTES) throw new Error();
@@ -12237,8 +13122,8 @@ var MinerAdmissions = class {
   read(now = Date.now()) {
     let stamp;
     try {
-      const stat = statSync(this.path);
-      stamp = `${stat.dev}:${stat.ino}:${stat.size}:${stat.mtimeMs}`;
+      const stat2 = statSync(this.path);
+      stamp = `${stat2.dev}:${stat2.ino}:${stat2.size}:${stat2.mtimeMs}`;
     } catch {
       stamp = "missing";
     }
@@ -12249,24 +13134,29 @@ var MinerAdmissions = class {
       let fd;
       try {
         fd = openSync(this.path, "r");
-        const stat = fstatSync(fd);
-        if (!stat.isFile() || stat.size > MAX_FILE_BYTES) throw new Error("admissions file too large");
+        const stat2 = fstatSync(fd);
+        if (!stat2.isFile() || stat2.size > MAX_FILE_BYTES) throw new Error("admissions file too large");
         const buffer = Buffer.alloc(MAX_FILE_BYTES + 1);
         const size = readSync(fd, buffer, 0, buffer.length, 0);
         if (size > MAX_FILE_BYTES) throw new Error("admissions file too large");
         const file = JSON.parse(buffer.subarray(0, size).toString("utf8"));
         if (file.schema !== "flop-miner-admissions/v1" || !Number.isFinite(Date.parse(file.generatedAt)) || !Array.isArray(file.entries) || file.entries.length > MAX_ADMITTED_MINERS) throw new Error("invalid admissions snapshot");
         const slots = /* @__PURE__ */ new Set();
-        const entries = file.entries.map((entry) => {
+        const entries = file.entries.flatMap((entry) => {
           const id = entry.modelIdentity;
           const url = new URL(entry.endpoint);
           const accepted = Date.parse(entry.adAcceptedAt), expiry = Date.parse(entry.admissionExpiresAt);
           if (url.protocol !== "https:" || url.username || url.password || url.pathname !== "/" || url.search || url.hash || typeof entry.minerAddress !== "string" || !entry.minerAddress || !HASH4.test(entry.enclaveKey) || !id || ![id.modelHash, id.decodePolicyHash, id.measuredRoot].every((h) => HASH4.test(h)) || ![id.requestedSlug, id.registryModel, id.registryVersion, id.backendModelName].every((s) => typeof s === "string" && s.length > 0) || !Number.isInteger(id.precision) || id.precision < 0 || id.precision > 5 || !/^[1-9]\d*$/.test(entry.calibrationCapGflopsPerSec) || !Number.isFinite(accepted) || !Number.isFinite(expiry) || accepted > now || expiry <= accepted || expiry > accepted + 36e5 || entry.observation?.countryCode !== null && !/^[A-Z]{2}$/.test(entry.observation?.countryCode) || entry.observation?.regional !== false || entry.observation.observedAt !== entry.adAcceptedAt) throw new Error("invalid admission entry");
-          requireWorkerMinimum(entry.worker?.version, entry.worker?.revision);
+          try {
+            requireWorkerMinimum(entry.worker?.version, entry.worker?.revision);
+          } catch (error) {
+            if (error instanceof WorkerUpgradeRequired) return [];
+            throw error;
+          }
           const slot = minerSlot(entry);
           if (slots.has(slot)) throw new Error("duplicate admission slot");
           slots.add(slot);
-          return {
+          return [{
             endpoint: entry.endpoint,
             authToken: "",
             channelSigned: true,
@@ -12281,7 +13171,7 @@ var MinerAdmissions = class {
               observedAt: entry.adAcceptedAt,
               expiresAt: entry.admissionExpiresAt
             }
-          };
+          }];
         });
         this.entries = entries;
       } catch {
@@ -12292,6 +13182,17 @@ var MinerAdmissions = class {
     return this.entries.filter((entry) => Date.parse(entry.admissionExpiresAt) > now);
   }
 };
+async function mapAdmissions(items, run2, limit = ADMISSION_CONCURRENCY) {
+  const results = new Array(items.length);
+  let next = 0;
+  await Promise.all(Array.from({ length: Math.min(limit, items.length) }, async () => {
+    while (next < items.length) {
+      const index = next++;
+      results[index] = await run2(items[index]);
+    }
+  }));
+  return results;
+}
 
 // ../gateway-core/src/miner-peer.ts
 import { BlockList, isIP } from "node:net";
@@ -12358,16 +13259,16 @@ async function resolveDnsAddresses(host, v4 = resolve42, v6 = resolve62) {
   }
 }
 var systemResolve = resolveDnsAddresses;
-async function resolvePublic(host, resolve10 = systemResolve) {
+async function resolvePublic(host, resolve11 = systemResolve) {
   const family = isIP(host);
-  const addresses = family ? [{ address: host, family }] : await resolve10(host);
+  const addresses = family ? [{ address: host, family }] : await resolve11(host);
   if (addresses.length === 0 || !addresses.every((a) => isPublicAddress(a.address))) {
     throw new EndpointRefusal(`${host} does not resolve to public addresses only`);
   }
   return addresses[0];
 }
 function minerPeerFetch(endpoint, dynamic, before = () => {
-}, resolve10 = systemResolve, send2 = request) {
+}, resolve11 = systemResolve, send2 = request) {
   return async (input, init = {}) => {
     before();
     const url = new URL(String(input));
@@ -12378,7 +13279,7 @@ function minerPeerFetch(endpoint, dynamic, before = () => {
     const pinned = await new Promise((accept, reject) => {
       const abort = () => reject(signal.reason);
       signal.addEventListener("abort", abort, { once: true });
-      resolvePublic(url.hostname.replace(/^\[|\]$/g, ""), resolve10).then(accept, reject).finally(() => signal.removeEventListener("abort", abort));
+      resolvePublic(url.hostname.replace(/^\[|\]$/g, ""), resolve11).then(accept, reject).finally(() => signal.removeEventListener("abort", abort));
       if (signal.aborted) abort();
     });
     before();
@@ -12414,11 +13315,11 @@ function minerPeerFetch(endpoint, dynamic, before = () => {
 }
 
 // src/commands/gateway-renew.ts
-import { Command as Command48 } from "commander";
+import { Command as Command50 } from "commander";
 
 // src/commands/gateway-tools-qualification.ts
-import { decodeAddress } from "@polkadot/util-crypto";
-import { computeChannel as computeChannel5 } from "@flop-labs/sdk";
+import { decodeAddress as decodeAddress2 } from "@polkadot/util-crypto";
+import { computeChannel as computeChannel7 } from "@flop-labs/sdk";
 function require2(value, message) {
   if (!value) throw new Error(message);
 }
@@ -12447,36 +13348,36 @@ async function verifyOwnedToolsQualification(value, record, terminal, now = Date
   require2(wire, "qualification wire policy is unsupported");
   const envelope = toolsQualificationEnvelope(record.openrouter_slug, wire, q);
   assertQualificationEnvelope(envelope, q);
-  const input = computeChannel5.encodeChatTurnEnvelope(envelope);
-  const receipt = computeChannel5.decodeTurnReceipt(evidence.receipt);
+  const input = computeChannel7.encodeChatTurnEnvelope(envelope);
+  const receipt = computeChannel7.decodeTurnReceipt(evidence.receipt);
   require2(
     receipt.modelIdentity && receipt.modelIdentity.requestedSlug === record.openrouter_slug && receipt.modelIdentity.registryModel === record.registry_model && receipt.modelIdentity.registryVersion === record.registry_version && u8aToHex(receipt.modelIdentity.modelHash) === record.model_hash && receipt.modelIdentity.precision === record.precision && u8aToHex(receipt.modelIdentity.decodePolicyHash) === record.decode_policy_hash && receipt.modelIdentity.backendModelName === record.backend_model_name && receipt.decodePolicyHash && u8aToHex(receipt.decodePolicyHash) === record.decode_policy_hash,
     "qualification receipt model identity differs"
   );
-  require2(equal(computeChannel5.blake2_256(input), receipt.hIn), "qualification purpose/envelope preimage differs");
+  require2(equal(computeChannel7.blake2_256(input), receipt.hIn), "qualification purpose/envelope preimage differs");
   require2(
     receipt.promptTokens !== void 0 && receipt.completionTokens !== void 0 && receipt.finishReason,
     "qualification authoritative provider usage is missing"
   );
-  require2(equal(computeChannel5.turnEvidenceHash(
+  require2(equal(computeChannel7.turnEvidenceHash(
     receipt.output,
     receipt.promptTokens,
     receipt.completionTokens,
     receipt.finishReason,
     receipt.modelIdentity
   ), receipt.hOut), "qualification output evidence hash differs");
-  computeChannel5.validateRenderedChatReceipt(input, receipt);
+  computeChannel7.validateRenderedChatReceipt(input, receipt);
   require2(Array.isArray(evidence.frames) && evidence.frames.length > 0, "qualification signed frames are missing");
   const frames = evidence.frames.map((frame) => ({ kind: frame.kind, data: bytes2(frame.data) }));
-  computeChannel5.reconstructSignedTurnOutput(frames, receipt);
+  computeChannel7.reconstructSignedTurnOutput(frames, receipt);
   assertQualificationToolCalls(qualificationSignedToolCalls(frames), receipt.finishReason);
   require2(
     Array.isArray(evidence.prefix) && evidence.prefix.length === receipt.turnIndex + 1 && evidence.prefix.length <= 1024,
     "qualification signed prefix is incomplete"
   );
-  const accumulator = new computeChannel5.MerkleAccumulator();
+  const accumulator = new computeChannel7.MerkleAccumulator();
   let aggregate2 = 0n;
-  const selectedLeaf = computeChannel5.reconstructLeafVersioned(
+  const selectedLeaf = computeChannel7.reconstructLeafVersioned(
     receipt.leafVersion,
     bytes2(evidence.channel_id),
     receipt.turnIndex,
@@ -12494,7 +13395,7 @@ async function verifyOwnedToolsQualification(value, record, terminal, now = Date
     const t = row, gn = BigInt(t.gN), timing = [BigInt(t.minerRecvMs), BigInt(t.minerDoneMs), BigInt(t.latencyMs)];
     require2(t.turnIndex === index && gn > 0n && gn < 1n << 64n && t.decodePolicyHash === record.decode_policy_hash, "qualification prefix sequence/work differs");
     require2(
-      computeChannel5.verifyEnclaveLeaf(
+      computeChannel7.verifyEnclaveLeaf(
         bytes2(evidence.enclave_key),
         t.leafVersion,
         bytes2(evidence.channel_id),
@@ -12510,7 +13411,7 @@ async function verifyOwnedToolsQualification(value, record, terminal, now = Date
       ),
       "qualification prefix signature is invalid"
     );
-    const leaf = computeChannel5.reconstructLeafVersioned(
+    const leaf = computeChannel7.reconstructLeafVersioned(
       t.leafVersion,
       bytes2(evidence.channel_id),
       index,
@@ -12529,7 +13430,7 @@ async function verifyOwnedToolsQualification(value, record, terminal, now = Date
     }
   }
   const ack = evidence.ack;
-  require2(ack && ack.turnIndex === receipt.turnIndex && ack.leafHash === u8aToHex(selectedLeaf) && computeChannel5.verifyTurnAck(
+  require2(ack && ack.turnIndex === receipt.turnIndex && ack.leafHash === u8aToHex(selectedLeaf) && computeChannel7.verifyTurnAck(
     bytes2(evidence.agent_key),
     bytes2(evidence.channel_id),
     receipt.turnIndex,
@@ -12539,7 +13440,7 @@ async function verifyOwnedToolsQualification(value, record, terminal, now = Date
     bytes2(ack.agentSig)
   ), "qualification turn ACK is invalid");
   const checkpoint = evidence.checkpoint;
-  require2(equal(accumulator.root(), receipt.runningRoot) && u8aToHex(accumulator.root()) === checkpoint.finalRoot && aggregate2.toString() === checkpoint.aggregateGn && computeChannel5.verifyReceipt(
+  require2(equal(accumulator.root(), receipt.runningRoot) && u8aToHex(accumulator.root()) === checkpoint.finalRoot && aggregate2.toString() === checkpoint.aggregateGn && computeChannel7.verifyReceipt(
     bytes2(evidence.agent_key),
     bytes2(evidence.channel_id),
     bytes2(checkpoint.finalRoot),
@@ -12610,10 +13511,10 @@ async function readQualificationTerminal(api, eventId, channelId) {
     aggregateGn: data[3].toString(),
     enclaveKey: channel.enclaveKey.toHex(),
     agentKey: channel.agentKey.toHex(),
-    minerAccountId: u8aToHex(decodeAddress(channel.miner.toString())),
+    minerAccountId: u8aToHex(decodeAddress2(channel.miner.toString())),
     modelHash: channel.modelHash.toHex(),
     measuredRoot: channel.measuredRoot.toHex(),
-    precision: computeChannel5.modelPrecisionCode(channel.precision.toString()),
+    precision: computeChannel7.modelPrecisionCode(channel.precision.toString()),
     timestampMs: Number(stamp.toString()),
     grossRaw: gross.toString(),
     debitRaw: debit.toString()
@@ -12678,7 +13579,7 @@ function tailnetNodeRef(source) {
   return match ? { host: match[1], egress: match[2], asn: match[3] } : null;
 }
 function readTailscaleStatus(socketPath) {
-  return new Promise((resolve10, reject) => {
+  return new Promise((resolve11, reject) => {
     const req = request2({
       socketPath,
       path: "/localapi/v0/status",
@@ -12693,7 +13594,7 @@ function readTailscaleStatus(socketPath) {
       res.on("end", () => {
         if (res.statusCode !== 200) return reject(new Error(`tailscaled status returned HTTP ${res.statusCode}`));
         try {
-          resolve10(JSON.parse(body));
+          resolve11(JSON.parse(body));
         } catch {
           reject(new Error("tailscaled status is not JSON"));
         }
@@ -12763,7 +13664,7 @@ function conformanceWindows(record) {
 }
 var ProbeSignerUnderfunded = class extends Error {
 };
-function reason(error) {
+function reason2(error) {
   return error instanceof Error ? error.message : String(error);
 }
 async function renewGatewayEvidence(miners, records, observe) {
@@ -12772,7 +13673,7 @@ async function renewGatewayEvidence(miners, records, observe) {
   const withdrawn = [];
   const observed = [];
   let underfunded;
-  for (const miner of miners) {
+  const observations = await mapAdmissions(miners, async (miner) => {
     const subject = `${miner.minerAddress}:${miner.modelIdentity.requestedSlug}`;
     try {
       const declared = miner.deployment;
@@ -12784,8 +13685,7 @@ async function renewGatewayEvidence(miners, records, observe) {
       if (miner.admissionExpiresAt) {
         await observe.miner(miner);
         if (Date.parse(miner.admissionExpiresAt) <= observe.now()) throw new Error("miner admission expired");
-        observed.push(miner);
-        continue;
+        return { miner };
       }
       if (node) {
         session = await observe.miner(miner);
@@ -12795,7 +13695,7 @@ async function renewGatewayEvidence(miners, records, observe) {
         session = await observe.miner(miner);
       }
       const observedAt = observe.now();
-      deployments.push({
+      const deployment = {
         miner_address: miner.minerAddress,
         endpoint: miner.endpoint,
         enclave_key: miner.enclaveKey,
@@ -12805,11 +13705,16 @@ async function renewGatewayEvidence(miners, records, observe) {
         observed_at: new Date(observedAt).toISOString(),
         expires_at: new Date(observedAt + ttl).toISOString(),
         observer: `${provider}; ${session}`
-      });
-      observed.push(miner);
+      };
+      return { miner, deployment };
     } catch (error) {
-      withdrawn.push({ subject, reason: `deployment not renewed: ${reason(error)}` });
+      return { failure: { subject, reason: `deployment not renewed: ${reason2(error)}` } };
     }
+  });
+  for (const { miner, deployment, failure: failure2 } of observations) {
+    if (failure2) withdrawn.push(failure2);
+    if (miner) observed.push(miner);
+    if (deployment) deployments.push(deployment);
   }
   for (const record of records) {
     for (const [feature, ttl] of conformanceWindows(record)) {
@@ -12848,7 +13753,7 @@ async function renewGatewayEvidence(miners, records, observe) {
           break;
         } catch (error) {
           if (error instanceof ProbeSignerUnderfunded) underfunded = error.message;
-          else failures.push(`${miner.minerAddress}: ${reason(error)}`);
+          else failures.push(`${miner.minerAddress}: ${reason2(error)}`);
         }
       }
       if (underfunded) withdrawn.push({ subject, reason: `probe not run: ${underfunded}` });
@@ -12868,8 +13773,8 @@ async function renewGatewayEvidence(miners, records, observe) {
 }
 function planckToFlop(planck) {
   const scale = 10n ** BigInt(FLOP_DECIMALS);
-  const fraction = (planck % scale).toString().padStart(FLOP_DECIMALS, "0").replace(/0+$/, "");
-  return fraction ? `${planck / scale}.${fraction}` : `${planck / scale}`;
+  const fraction2 = (planck % scale).toString().padStart(FLOP_DECIMALS, "0").replace(/0+$/, "");
+  return fraction2 ? `${planck / scale}.${fraction2}` : `${planck / scale}`;
 }
 async function assertProbeSignerFunded(api, address, escrow) {
   const head = await api.rpc.chain.getFinalizedHead();
@@ -12909,10 +13814,10 @@ async function writeEvidenceFile(path5, evidence, appendQualification = false) {
     parseGatewayEvidence(evidence);
     await writeFile13(temporary, `${JSON.stringify(evidence, null, 2)}
 `, { mode: 420 });
-    await rename9(temporary, path5);
+    await rename10(temporary, path5);
   } finally {
     await lock.close();
-    await rm5(`${path5}.lock`);
+    await rm7(`${path5}.lock`);
   }
 }
 async function finishRenewal(report, out, output) {
@@ -12961,7 +13866,7 @@ function assertToolsConformance(calls, finishReason) {
   }
   return `signed ${PROBE_TOOL.function.name} tool call`;
 }
-function hex3(bytes4) {
+function hex4(bytes4) {
   return `0x${Buffer.from(bytes4).toString("hex")}`;
 }
 function bytes3(value) {
@@ -12987,7 +13892,7 @@ async function waitForSettlementAllowance(api, channelId, aggregateGn, deadline)
       const snapshot = await query.computeChannel.channelCalibrationSnapshots.at(head, channelId);
       const current = (await api.rpc.state.call(
         "TrustRootApi_accepted_calibration_cap",
-        hex3(Uint8Array.from([128, ...decodeAddress2(opened.miner.toString())])),
+        hex4(Uint8Array.from([128, ...decodeAddress3(opened.miner.toString())])),
         head
       )).toU8a(true);
       if (!snapshot?.isSome || current.length !== 9 || current[0] !== 1) throw new Error("settlement calibration is unavailable");
@@ -13001,13 +13906,80 @@ async function waitForSettlementAllowance(api, channelId, aggregateGn, deadline)
   }
   throw new Error("settlement allowance did not arrive before the probe deadline");
 }
+async function reconcileProbeClose(api, channelId, aggregateGn, deadline, submit) {
+  const bounded = async (operation) => {
+    const remaining = deadline - Date.now();
+    if (remaining <= 0) throw new Error("probe deadline elapsed");
+    let timer;
+    try {
+      return await Promise.race([operation, new Promise((_, reject) => {
+        timer = setTimeout(() => reject(new Error("probe deadline elapsed")), remaining);
+      })]);
+    } finally {
+      if (timer) clearTimeout(timer);
+    }
+  };
+  let next;
+  try {
+    const head = await bounded(api.rpc.chain.getFinalizedHead());
+    next = BigInt((await bounded(api.rpc.chain.getHeader(head))).number.toString());
+  } catch {
+    return "settlement unknown (finalized start unavailable; do not resubmit)";
+  }
+  if (Date.now() >= deadline) return "settlement not submitted (probe deadline elapsed)";
+  try {
+    await bounded(submit());
+  } catch {
+  }
+  try {
+    while (Date.now() < deadline) {
+      const head = await bounded(api.rpc.chain.getFinalizedHead());
+      const height = BigInt((await bounded(api.rpc.chain.getHeader(head))).number.toString());
+      while (next <= height) {
+        const blockHash = await bounded(api.rpc.chain.getBlockHash(next.toString()));
+        const at = await bounded(api.at(blockHash));
+        const events = [...await bounded(at.query.system.events())];
+        for (const row of events) {
+          const event = row.event;
+          if (event.section !== "computeChannel" || !["Settled", "TimedOutRefunded"].includes(event.method) || event.data[0].toHex() !== hex4(channelId) || !row.phase.isApplyExtrinsic) continue;
+          const index = row.phase.asApplyExtrinsic.toNumber();
+          if (!events.some((other) => other.phase.isApplyExtrinsic && other.phase.asApplyExtrinsic.toNumber() === index && other.event.section === "system" && other.event.method === "ExtrinsicSuccess")) continue;
+          if (event.method === "TimedOutRefunded") return `refunded at finalized ${blockHash.toHex()}`;
+          if (BigInt(event.data[3].toString()) !== aggregateGn || !event.data[4].isTrue) {
+            return `settlement mismatch at finalized ${blockHash.toHex()}`;
+          }
+          const paid = BigInt(event.data[1].toString());
+          if (paid <= 0n) return `settlement has zero miner payment at finalized ${blockHash.toHex()}`;
+          const block = await bounded(api.rpc.chain.getBlock(blockHash));
+          return `settled ${block.block.extrinsics[index].hash.toHex()} minerPaid=${paid} at finalized ${blockHash.toHex()}`;
+        }
+        next++;
+      }
+      await bounded(delay(Math.min(1e3, Math.max(1, deadline - Date.now()))));
+    }
+  } catch {
+  }
+  return "settlement unknown (no finalized outcome before probe deadline; do not resubmit)";
+}
+async function settleProbe(api, channelId, aggregateGn, deadline, allowance2, submit, forceClose) {
+  try {
+    await allowance2();
+  } catch (error) {
+    try {
+      await forceClose();
+    } catch {
+    }
+    return `cooperative settlement not submitted; force close attempted (${reason2(error)})`;
+  }
+  return reconcileProbeClose(api, channelId, aggregateGn, deadline, submit);
+}
 async function renewalMinerInfo(api, miner, fetchImpl = fetch) {
   const head = await api.rpc.chain.getFinalizedHead();
   const at = await api.at(head);
   const registered = await at.query.minerStaking.miners(miner.minerAddress);
   const active = registered?.isSome && registered.unwrap().isActive;
   if (!(active?.isTrue ?? active === true)) throw new Error("miner is not registered and active at finality");
-  const encoded = await api.rpc.state.call("TrustRootApi_accepted_calibration_cap", `0x80${hex3(decodeAddress2(miner.minerAddress)).slice(2)}`, head);
+  const encoded = await api.rpc.state.call("TrustRootApi_accepted_calibration_cap", `0x80${hex4(decodeAddress3(miner.minerAddress)).slice(2)}`, head);
   const cap = encoded.toU8a(true);
   if (cap.length !== 9 || cap[0] !== 1 || new DataView(cap.buffer, cap.byteOffset + 1, 8).getBigUint64(0, true) <= 0n) throw new Error("miner has no finalized calibrated capacity");
   const identity = {
@@ -13021,13 +13993,13 @@ async function renewalMinerInfo(api, miner, fetchImpl = fetch) {
     await anonymous.body?.cancel();
     if (anonymous.status !== 401) throw new Error("miner /session/info does not enforce authentication");
   }
-  const info = miner.channelSigned ? await computeChannel6.fetchProvenSessionInfo(miner.endpoint, {
+  const info = miner.channelSigned ? await computeChannel8.fetchProvenSessionInfo(miner.endpoint, {
     genesisHash: api.genesisHash.toU8a(),
-    account: decodeAddress2(miner.minerAddress),
+    account: decodeAddress3(miner.minerAddress),
     minerAddress: miner.minerAddress,
     enclaveKey: bytes3(miner.enclaveKey),
     modelIdentity: identity
-  }, fetchImpl, AbortSignal.timeout(3e4)) : await computeChannel6.fetchMinerSessionInfo(
+  }, fetchImpl, AbortSignal.timeout(3e4)) : await computeChannel8.fetchMinerSessionInfo(
     miner.endpoint,
     { Authorization: `Bearer ${miner.authToken}` },
     AbortSignal.timeout(3e4),
@@ -13037,13 +14009,13 @@ async function renewalMinerInfo(api, miner, fetchImpl = fetch) {
   const wire = {
     ...info,
     is_ready: info.isReady,
-    enclaveKey: hex3(info.enclaveKey),
-    modelHash: hex3(info.modelHash),
+    enclaveKey: hex4(info.enclaveKey),
+    modelHash: hex4(info.modelHash),
     modelIdentity: {
       ...info.modelIdentity,
-      modelHash: hex3(info.modelIdentity.modelHash),
-      decodePolicyHash: hex3(info.modelIdentity.decodePolicyHash),
-      measuredRoot: hex3(info.modelIdentity.measuredRoot)
+      modelHash: hex4(info.modelIdentity.modelHash),
+      decodePolicyHash: hex4(info.modelIdentity.decodePolicyHash),
+      measuredRoot: hex4(info.modelIdentity.measuredRoot)
     }
   };
   const snapshot = await readChainSnapshot(api, wire, head.toHex());
@@ -13072,7 +14044,7 @@ async function probeToolsConformance(input) {
   let requestHeaders;
   const pinned = miner.modelIdentity;
   const advertised = info.modelIdentity;
-  if (info.minerAddress !== miner.minerAddress || hex3(info.enclaveKey) !== miner.enclaveKey.toLowerCase() || !advertised || advertised.requestedSlug !== pinned.requestedSlug || advertised.registryModel !== pinned.registryModel || advertised.registryVersion !== pinned.registryVersion || hex3(advertised.modelHash) !== pinned.modelHash || advertised.precision !== pinned.precision || hex3(advertised.decodePolicyHash) !== pinned.decodePolicyHash || hex3(advertised.measuredRoot) !== pinned.measuredRoot || advertised.backendModelName !== pinned.backendModelName) {
+  if (info.minerAddress !== miner.minerAddress || hex4(info.enclaveKey) !== miner.enclaveKey.toLowerCase() || !advertised || advertised.requestedSlug !== pinned.requestedSlug || advertised.registryModel !== pinned.registryModel || advertised.registryVersion !== pinned.registryVersion || hex4(advertised.modelHash) !== pinned.modelHash || advertised.precision !== pinned.precision || hex4(advertised.decodePolicyHash) !== pinned.decodePolicyHash || hex4(advertised.measuredRoot) !== pinned.measuredRoot || advertised.backendModelName !== pinned.backendModelName) {
     throw new Error("miner no longer advertises its allowlisted identity");
   }
   let version;
@@ -13089,7 +14061,7 @@ async function probeToolsConformance(input) {
   const maxSettlementTurns = Number(api.consts.computeChannel.maxSettlementTurns.toString());
   const frames = [];
   let sequence = 0;
-  const transport = new computeChannel6.HttpSessionTransport(miner.endpoint, PROBE_TIMEOUT_MS, {
+  const transport = new computeChannel8.HttpSessionTransport(miner.endpoint, PROBE_TIMEOUT_MS, {
     headers,
     fetchImpl,
     requestHeaders: (method, path5, body) => requestHeaders?.(method, path5, body) ?? {},
@@ -13098,10 +14070,10 @@ async function probeToolsConformance(input) {
       if (frame.type === "chunk") frames.push({ kind: frame.kind, data: bytes3(frame.data) });
     }
   });
-  const agentKey = computeChannel6.SessionKey.generate();
+  const agentKey = computeChannel8.SessionKey.generate();
   const identity = { ...pinned, modelHash: bytes3(pinned.modelHash), decodePolicyHash: bytes3(pinned.decodePolicyHash), measuredRoot: bytes3(pinned.measuredRoot) };
   input.assertAdmission?.();
-  const session = await computeChannel6.ChannelSession.open({
+  const session = await computeChannel8.ChannelSession.open({
     chain,
     transport,
     enclaveKey: info.enclaveKey,
@@ -13121,13 +14093,13 @@ async function probeToolsConformance(input) {
     maxDuration: BigInt(miner.maxDurationBlocks),
     reattestEvery: 1,
     escrow: input.escrow,
-    nonce: BigInt(hex3(randomAsU8a(8)))
+    nonce: BigInt(hex4(randomAsU8a(8)))
   });
   transport.bind(session.channelId);
   let verdict;
   let receipt;
   try {
-    if (miner.channelSigned) requestHeaders = await computeChannel6.channelSessionAuth(
+    if (miner.channelSigned) requestHeaders = await computeChannel8.channelSessionAuth(
       miner.endpoint,
       session.channelId,
       agentKey,
@@ -13135,7 +14107,7 @@ async function probeToolsConformance(input) {
       fetchImpl,
       AbortSignal.timeout(3e4)
     );
-    await computeChannel6.notifyMinerOpen(miner.endpoint, session.channelId, agentKey.publicKey, headers, AbortSignal.timeout(3e4), requestHeaders, fetchImpl);
+    await computeChannel8.notifyMinerOpen(miner.endpoint, session.channelId, agentKey.publicKey, headers, AbortSignal.timeout(3e4), requestHeaders, fetchImpl);
     receipt = await session.chatTurn({
       version,
       model: record.openrouter_slug,
@@ -13144,7 +14116,7 @@ async function probeToolsConformance(input) {
       tool_choice: "auto",
       max_tokens: 192
     }, (candidate) => {
-      computeChannel6.reconstructSignedTurnOutput(frames, candidate);
+      computeChannel8.reconstructSignedTurnOutput(frames, candidate);
       verdict = assertToolsConformance(signedToolCalls(frames), candidate.finishReason);
     });
   } catch (error) {
@@ -13154,29 +14126,27 @@ async function probeToolsConformance(input) {
     }
     throw error;
   }
-  let settlement = "force-settlement posted; finalize it with `flop channel finalize`";
-  try {
-    await waitForSettlementAllowance(api, session.channelId, receipt.gN, deadline);
-    const settled = await session.closeCooperative(async (claim) => {
-      const wire = await computeChannel6.notifyMinerClose(miner.endpoint, claim, headers, AbortSignal.timeout(3e4), requestHeaders, fetchImpl);
-      return wire ? {
+  const settlement = await settleProbe(
+    api,
+    session.channelId,
+    receipt.gN,
+    deadline,
+    () => waitForSettlementAllowance(api, session.channelId, receipt.gN, deadline),
+    () => session.closeCooperative(async (claim) => {
+      const wire = await computeChannel8.notifyMinerClose(miner.endpoint, claim, headers, AbortSignal.timeout(3e4), requestHeaders, fetchImpl);
+      if (!wire) throw new Error("miner did not report a settlement");
+      return {
         channelId: bytes3(wire.channelId),
         minerPaid: BigInt(wire.minerPaid),
         burned: BigInt(wire.burned),
         aggregateGn: BigInt(wire.aggregateGn),
         cooperative: wire.cooperative,
         txHash: wire.txHash
-      } : null;
-    });
-    if ("minerPaid" in settled && settled.cooperative) settlement = `settled ${settled.txHash}`;
-  } catch (error) {
-    try {
-      await session.close();
-    } catch {
-    }
-    settlement = `settlement failed (${reason(error)})`;
-  }
-  return `${verdict} in channel ${hex3(session.channelId)}; ${settlement}`;
+      };
+    }),
+    () => session.close()
+  );
+  return `${verdict} in channel ${hex4(session.channelId)}; ${settlement}`;
 }
 function envJson(name) {
   const value = process.env[name];
@@ -13193,7 +14163,7 @@ function envSecret(name) {
   return value;
 }
 function gatewayRenewCmd() {
-  return new Command48("renew").description("Re-observe allowlisted miners, re-run feature conformance, and write the gateway evidence file").option("--allowlist-env <name>", "Direct probe mode: environment variable holding GATEWAY_SESSION_ALLOWLIST (never printed)").requiredOption("--catalog-env <name>", "Environment variable holding GATEWAY_MODEL_CATALOG").option("--catalog-pricing <mode>", "The gateway's GATEWAY_CATALOG_PRICING: operator, or chain when the catalog omits prices", "operator").option("--provider-key-env <name>", "Direct probe mode: environment variable holding the GPU.ai API key").option("--tailscale-socket <path>", "tailscaled LocalAPI socket for tailnet-hosted miners", "/var/run/tailscale/tailscaled.sock").option("--probe-signer-env <name>", "Direct probe mode: environment variable holding the dedicated funded probe signer URI").option("--probe-escrow <flop>", "Direct probe mode: FLOP escrowed for each conformance probe channel").option("--qualification-receipt <path>", "Receipt-only mode: settled owner tools-qualification evidence; never runs another probe").option("--qualification-receipt-sha256 <hash>", "SHA-256 of the immutable owner qualification receipt").requiredOption("--out <path>", "Evidence file the gateway reads as GATEWAY_EVIDENCE_FILE").option("--json", "Output as JSON").action(async (opts, command) => {
+  return new Command50("renew").description("Re-observe allowlisted miners, re-run feature conformance, and write the gateway evidence file").option("--allowlist-env <name>", "Direct probe mode: environment variable holding GATEWAY_SESSION_ALLOWLIST (never printed)").requiredOption("--catalog-env <name>", "Environment variable holding GATEWAY_MODEL_CATALOG").option("--catalog-pricing <mode>", "The gateway's GATEWAY_CATALOG_PRICING: operator, or chain when the catalog omits prices", "operator").option("--provider-key-env <name>", "Direct probe mode: environment variable holding the GPU.ai API key").option("--tailscale-socket <path>", "tailscaled LocalAPI socket for tailnet-hosted miners", "/var/run/tailscale/tailscaled.sock").option("--probe-signer-env <name>", "Direct probe mode: environment variable holding the dedicated funded probe signer URI").option("--probe-escrow <flop>", "Direct probe mode: FLOP escrowed for each conformance probe channel").option("--qualification-receipt <path>", "Receipt-only mode: settled owner tools-qualification evidence; never runs another probe").option("--qualification-receipt-sha256 <hash>", "SHA-256 of the immutable owner qualification receipt").requiredOption("--out <path>", "Evidence file the gateway reads as GATEWAY_EVIDENCE_FILE").option("--json", "Output as JSON").action(async (opts, command) => {
     let client;
     try {
       if (opts.catalogPricing !== "operator" && opts.catalogPricing !== "chain") {
@@ -13204,7 +14174,7 @@ function gatewayRenewCmd() {
           throw new Error("receipt-only mode requires the receipt/hash and cannot run direct probes");
         }
         const raw = await readFile11(opts.qualificationReceipt);
-        if (raw.length > 8e6 || createHash6("sha256").update(raw).digest("hex") !== opts.qualificationReceiptSha256) throw new Error("qualification receipt bytes differ");
+        if (raw.length > 8e6 || createHash9("sha256").update(raw).digest("hex") !== opts.qualificationReceiptSha256) throw new Error("qualification receipt bytes differ");
         const value = JSON.parse(raw.toString("utf8"));
         const records2 = parseCanonicalCatalog(envJson(opts.catalogEnv), { chainPriced: opts.catalogPricing === "chain" });
         const record = records2.find((item) => item.openrouter_slug === value.model);
@@ -13214,7 +14184,7 @@ function gatewayRenewCmd() {
         const evidence = parseGatewayEvidence(JSON.parse(await readFile11(opts.out, "utf8")));
         const renewed = renewConformance(record, evidence, tested);
         client = await createClient(getRpc(command));
-        await computeChannel6.ready();
+        await computeChannel8.ready();
         const pass = await verifyOwnedToolsQualification(value, renewed, (id, channel) => readQualificationTerminal(client.api, id, channel));
         await writeEvidenceFile(opts.out, { schema_version: GATEWAY_EVIDENCE_VERSION, generated_at: (/* @__PURE__ */ new Date()).toISOString(), deployments: [], conformance: [pass] }, true);
         print({ out: opts.out, conformance: [pass], receipt_only: true, paid_probe_count: 0 }, getJson(command));
@@ -13237,9 +14207,9 @@ function gatewayRenewCmd() {
       const escrow = flopToPlanck(opts.probeEscrow);
       client = await createClient(getRpc(command));
       const api = client.api;
-      await computeChannel6.ready();
+      await computeChannel8.ready();
       const signer = new Keyring5({ type: "sr25519" }).addFromUri(signerUri);
-      const chain = new computeChannel6.ComputeChannelChainClient(new computeChannel6.FlopChainSubmitter(api, signer, true));
+      const chain = new computeChannel8.ComputeChannelChainClient(new computeChannel8.FlopChainSubmitter(api, signer, true));
       const assertAdmission = (miner) => {
         if (!miner.admissionExpiresAt) return;
         const dynamic = admissions?.read() ?? [];
@@ -13255,13 +14225,13 @@ function gatewayRenewCmd() {
           const info = {
             ...proven,
             is_ready: proven.isReady,
-            enclaveKey: hex3(proven.enclaveKey),
-            modelHash: hex3(proven.modelHash),
+            enclaveKey: hex4(proven.enclaveKey),
+            modelHash: hex4(proven.modelHash),
             modelIdentity: {
               ...proven.modelIdentity,
-              modelHash: hex3(proven.modelIdentity.modelHash),
-              decodePolicyHash: hex3(proven.modelIdentity.decodePolicyHash),
-              measuredRoot: hex3(proven.modelIdentity.measuredRoot)
+              modelHash: hex4(proven.modelIdentity.modelHash),
+              decodePolicyHash: hex4(proven.modelIdentity.decodePolicyHash),
+              measuredRoot: hex4(proven.modelIdentity.measuredRoot)
             }
           };
           const pinned = miner.modelIdentity;
@@ -13287,9 +14257,9 @@ function gatewayRenewCmd() {
 }
 
 // src/release-check.ts
-import { mkdir as mkdir14, readFile as readFile12, rename as rename10, writeFile as writeFile14 } from "node:fs/promises";
+import { mkdir as mkdir15, readFile as readFile12, rename as rename11, writeFile as writeFile14 } from "node:fs/promises";
 import { homedir as homedir5 } from "node:os";
-import { dirname as dirname7, join as join10 } from "node:path";
+import { dirname as dirname9, join as join11 } from "node:path";
 var DAY_MS = 24 * 60 * 60 * 1e3;
 var READ_ONLY = /* @__PURE__ */ new Set([
   "health",
@@ -13333,7 +14303,7 @@ async function checkRelease(options) {
   if (options.offline || (options.testing ?? (process.env.NODE_ENV === "test" || !!process.env.VITEST))) return;
   const warn = options.warn ?? ((message) => console.error(message));
   const now = options.now ?? Date.now();
-  const cacheFile = options.cacheFile ?? join10(process.env.XDG_CACHE_HOME || join10(homedir5(), ".cache"), "flop", "releases.json");
+  const cacheFile = options.cacheFile ?? join11(process.env.XDG_CACHE_HOME || join11(homedir5(), ".cache"), "flop", "releases.json");
   let releases;
   try {
     const cached = JSON.parse(await readFile12(cacheFile, "utf8"));
@@ -13348,10 +14318,10 @@ async function checkRelease(options) {
       if (!response.ok) throw new Error(`HTTP ${response.status}`);
       releases = parseOperatorReleases(await response.json());
       try {
-        await mkdir14(dirname7(cacheFile), { recursive: true });
+        await mkdir15(dirname9(cacheFile), { recursive: true });
         const temporary = `${cacheFile}.${process.pid}.tmp`;
         await writeFile14(temporary, JSON.stringify({ fetchedAt: now, releases }), { mode: 384 });
-        await rename10(temporary, cacheFile);
+        await rename11(temporary, cacheFile);
       } catch {
         warn("warning: could not cache operator releases");
       }
@@ -13375,10 +14345,10 @@ async function checkRelease(options) {
 }
 
 // src/cli.ts
-var program = new Command49();
+var program = new Command51();
 var outputMode = outputModeFromArgv(process.argv.slice(2));
 setOutputMode(outputMode);
-program.name("flop").description("FLOP Network CLI").version(operatorVersion(JSON.parse(readFileSync2(join11(packageRoot, "package.json"), "utf8")).version)).option("--offline", "Skip the operator release check").addOption(new Option8("--network <network>", "Network profile").choices(["local", "devnet", "testnet", "mainnet"]).default("local")).option("--rpc <url>", "RPC endpoint override").option("--signer <uri>", "Signer URI (local/dev only; required outside local unless --keystore)").option("--keystore <path>", "Encrypted Polkadot JSON keystore").option("--password-env <name>", "Environment variable containing the keystore password").addOption(new Option8("--output <mode>", "Output mode").choices(["human", "json", "agent"]).default("human")).option("--json", "Output as JSON");
+program.name("flop").description("FLOP Network CLI").version(operatorVersion(JSON.parse(readFileSync2(join12(packageRoot, "package.json"), "utf8")).version)).option("--offline", "Skip the operator release check").addOption(new Option8("--network <network>", "Network profile").choices(["local", "devnet", "testnet", "mainnet"]).default("local")).option("--rpc <url>", "RPC endpoint override").option("--signer <uri>", "Signer URI (local/dev only; required outside local unless --keystore)").option("--keystore <path>", "Encrypted Polkadot JSON keystore").option("--password-env <name>", "Environment variable containing the keystore password").addOption(new Option8("--output <mode>", "Output mode").choices(["human", "json", "agent"]).default("human")).option("--json", "Output as JSON");
 program.addCommand(healthCmd());
 program.addCommand(balanceCmd());
 program.addCommand(gpuCmd());
@@ -13390,13 +14360,13 @@ program.addCommand(chatCmd());
 program.addCommand(agentCmd());
 program.addCommand(minerCmd());
 program.addCommand(validatorCmd());
-var networkCmd = new Command49("network").description("Resolve and inspect network profiles");
+var networkCmd = new Command51("network").description("Resolve and inspect network profiles");
 networkCmd.addCommand(networkStatusCmd());
 program.addCommand(networkCmd);
-var faucetCmd = new Command49("faucet").description("Request dev/test FLOP");
+var faucetCmd = new Command51("faucet").description("Request dev/test FLOP");
 faucetCmd.addCommand(faucetRequestCmd());
 program.addCommand(faucetCmd);
-var sessionCmd = new Command49("session").description("Manage session keys");
+var sessionCmd = new Command51("session").description("Manage session keys");
 sessionCmd.addCommand(sessionRunCmd());
 sessionCmd.addCommand(sessionListCmd());
 sessionCmd.addCommand(sessionCreateCmd());
@@ -13404,7 +14374,7 @@ sessionCmd.addCommand(sessionInfoCmd());
 sessionCmd.addCommand(sessionRevokeCmd());
 sessionCmd.addCommand(sessionLimitsCmd());
 program.addCommand(sessionCmd);
-var keysCmd = new Command49("keys").description("Manage keys");
+var keysCmd = new Command51("keys").description("Manage keys");
 keysCmd.addCommand(keysGenerateCmd());
 keysCmd.addCommand(keysInspectCmd());
 keysCmd.addCommand(keysHardwareCmd());
@@ -13412,35 +14382,36 @@ keysCmd.addCommand(keysImportCmd());
 keysCmd.addCommand(keysExportCmd());
 keysCmd.addCommand(keysClaudeProfileCmd());
 program.addCommand(keysCmd);
-var walletCmd = new Command49("wallet").description("Manage wallets");
-var agentWalletCmd = new Command49("agent").description("Agent wallet operations");
+var walletCmd = new Command51("wallet").description("Manage wallets");
+var agentWalletCmd = new Command51("agent").description("Agent wallet operations");
 agentWalletCmd.addCommand(walletAgentCreateCmd());
 walletCmd.addCommand(agentWalletCmd);
 program.addCommand(walletCmd);
-var txCmd = new Command49("tx").description("Build, sign, and broadcast transactions");
+var txCmd = new Command51("tx").description("Build, sign, and broadcast transactions");
 txCmd.addCommand(txBuildCmd());
 txCmd.addCommand(txBroadcastCmd());
 program.addCommand(txCmd);
 program.addCommand(multisigCmd());
 program.addCommand(channelCmd());
-var gatewayCmd = new Command49("gateway").description("Generate verified gateway configuration");
+var gatewayCmd = new Command51("gateway").description("Generate verified gateway configuration");
 gatewayCmd.addCommand(gatewayAllowlistCmd());
 gatewayCmd.addCommand(gatewayRenewCmd());
 program.addCommand(gatewayCmd);
-var x402Cmd = new Command49("x402").description("x402 payment gateway operations");
+var x402Cmd = new Command51("x402").description("x402 payment gateway operations");
 x402Cmd.addCommand(x402SettleCmd());
 program.addCommand(x402Cmd);
-var daCmd = new Command49("da").description("Sovereign DA registry (leases, deposits)");
+var daCmd = new Command51("da").description("Sovereign DA registry (leases, deposits)");
 daCmd.addCommand(daDepositCmd());
 daCmd.addCommand(daRegisterCmd());
 daCmd.addCommand(daTopupCmd());
 daCmd.addCommand(daWithdrawCmd());
 program.addCommand(daCmd);
-var modelCmd = new Command49("model").description("Model registry operations");
+var modelCmd = new Command51("model").description("Model registry operations");
 modelCmd.addCommand(modelListCmd());
 modelCmd.addCommand(modelGetCmd());
 modelCmd.addCommand(modelFetchCmd());
 modelCmd.addCommand(modelUploadCmd());
+modelCmd.addCommand(modelMirrorsCmd());
 modelCmd.addCommand(modelPreflightCmd());
 modelCmd.addCommand(modelOnboardCmd());
 modelCmd.addCommand(modelBackupCmd());
@@ -13450,7 +14421,7 @@ program.hook("preAction", async (_root, action) => {
   const path5 = [];
   for (let command = action; command && command !== program; command = command.parent) path5.unshift(command.name());
   await checkRelease({
-    version: operatorVersion(JSON.parse(readFileSync2(join11(packageRoot, "package.json"), "utf8")).version),
+    version: operatorVersion(JSON.parse(readFileSync2(join12(packageRoot, "package.json"), "utf8")).version),
     readOnly: isReadOnlyCommand(path5),
     offline: program.opts().offline,
     image: !!process.env.FLOP_IMAGE_VERSION