@jinn-network/client 0.1.5 → 0.1.6-canary.107ea271

package/CHANGELOG.md

@@ -2,6 +2,137 @@
 
 ## Unreleased
 
+### Embedded agent surface hidden by default (issue #326)
+
+- **The embedded Claude agent chat surface no longer renders in the operator
+  app by default.** The right-rail agent panel (running mode) and the
+  "Ask Claude" panel (onboarding) are hidden. The 2026-05-19 v0.1.6 dogfood
+  found the surface isn't robust enough for first-time operators — it is the
+  only daemon-side surface that strictly requires Claude auth, and its
+  action-authority / plugin-scope shape is still in design (#177 / #178).
+- **Feature flag: `JINN_ENABLE_EMBEDDED_AGENT`.** Set
+  `JINN_ENABLE_EMBEDDED_AGENT=1` (also accepts `true`) to re-enable the
+  surface for development. Default is off. When off, the daemon does not
+  mount the `/api/agent/ws` bridge and the SPA renders no agent panel; when
+  on, the dev-time path works end-to-end as before. (Issue #367: the SPA now
+  reads this flag through the injected `window.__JINN_FEATURES__`, the same
+  channel as the plug-in builder UI flag — no behaviour change for operators.)
+- **Claude-Code-as-a-solver-harness is unaffected.** Operators can still pick
+  Claude Code as their SolverNet harness — that path is independent of the
+  embedded chat surface and its WebSocket bridge.
+
+### Operator app
+
+- **Plug-in builder UI surfaces hidden by default (issue #327).** The `/build`
+  route and the Build top-tab no longer appear in the operator app. Hitting
+  `/build` by direct URL redirects to `/overview`. The plug-in substrate stays
+  fully live — `jinn solver-plugins publish` / `revoke`, the Ponder indexer,
+  the Discovery API endpoints, and the `client/docs/build/` tree are
+  unchanged, so direct-CLI builders following the docs are not blocked. The
+  surfaces are gated to keep the operator-app first-run UX focused; they will
+  be re-promoted once that UX is solid and plug-in indexing is end-to-end
+  populated. Set `JINN_ENABLE_PLUGIN_BUILDER_UI=1` on the daemon to re-enable
+  the full builder surface for development and design work — the daemon injects
+  the flag into the SPA via `window.__JINN_FEATURES__`.
+
+### SWE-rebench v2 admission
+
+- **Admission semantics bumped from `'2'` → `'3'`.** Operators running the
+  public/launched generator MUST re-validate before posting resumes:
+
+  ```bash
+  jinn solver-nets validate-pool swe-rebench-v2 --seed-positive --known-bad
+  ```
+
+  Expected duration: ~1-2h (one gold-patch eval per seed instance).
+  Until re-validation runs, the launched generator posts no new tasks
+  (admission required; `jinn doctor` reports the pool as stale).
+  Note: the seed pool contains 20 instances from common Python repos; typical
+  admission rates are 25-40%, so expect 5-8 scorable entries after re-validation.
+  Operators can extend the seed list via PR over time.
+- **Required admission mode is now the default for launched generators.**
+  Local/dev users running `admissionMode: 'python-floor'` keep today's
+  behaviour. `jinn doctor` reports pool freshness and prints the exact
+  re-validation command when stale.
+- **Verdict-time substrate recheck** catches drift between admission and
+  grading. Any mismatch (rowHash, imageDigest, HF outage) skips the verdict
+  rather than emitting a misclassified FAIL.
+
+## v0.1.5 — Operator App
+
+_Released 2026-05-13_
+
+# v0.1.5 — "Operator App"
+2026-05-13 · Suggested bump: patch (first npm `@latest` cut that ships the app-first operator experience)
+
+## Highlights
+
+- Release plumbing fixed so the cut can actually ship. `npm-publish.yml` now installs `contracts/` before the operator gate, the Docker/GHCR workflow accepts the new `v<semver>` tag format alongside legacy `client-v*`, and the CHANGELOG mirror writes through a PR (no more failed direct push to protected `main`).
+- SWE-rebench v2 verdict path is structurally correct end-to-end. The eval loop no longer emits verdicts on non-gradeable evals (uy6v.8), the daemon's `verdictCode` default is `Invalid`, not `Pass` (uy6v.7), evaluator-side gating now surfaces a real verdict so the reputation feedback hook fires (uy6v.10), and the `evaluation:<cid>` MetadataSet is published on verdict delivery (n93o).
+- Per-operator disks no longer fill in a couple of weeks. The SWE-rebench v2 eval-image cache is bounded by an in-process LRU (uy6v.11).
+- Operator app feedback on issue 188 addressed across overview / launcher / catalog / configuration / shell, with dashboard tests refreshed.
+- Daemon execution envelope now carries the executor model (`gbut`), giving downstream consumers the model that produced each Solution / Verdict.
+- Discovery API no longer 404s for just-launched manifests when no subgraph is configured (#170) — important for fresh launcher records.
+
+## Recovery context
+
+v0.1.4 published as a GitHub Release at `fa8da678` but the npm-publish workflow failed before publish in `release:operator-gate` because contracts dependencies were not installed in the clean Actions checkout. The fix landed as PR #187 *after* the v0.1.4 tag was created, so the v0.1.4 release commit could not retry publish. v0.1.5 cuts from current `main` (`56e84952`) which includes that fix; `@jinn-network/client@latest` becomes `0.1.5` (replacing the stale `0.1.2`). v0.1.4 remains as a Build Notes Release; no `0.1.4` npm artifact exists.
+
+## Changes
+
+### feat
+- (#189) feat(uy6v.11): bound swe-rebench-v2 eval-image cache with in-process LRU — @ritsuKai2000
+- (#194) feat(gbut): publish executor.model in jinn.execution.v1 envelope — @ritsuKai2000
+
+### fix
+- (#170) fix: /v1/solvernets/registry/:cid 404s for just-launched manifests when no subgraph is configured — @ritsuKai2000
+- (#183) fix(uy6v.8): SWE-rebench v2 eval loop — no verdicts on non-gradeable evals; source-only patches — @ritsuKai2000
+- (#185) fix(release): unblock v0.1.4 publish — @ritsuKai2000
+- (#187) fix(release): install contracts before operator gate — @ritsuKai2000
+- (#190) fix(uy6v.10): emit verdict in swe-rebench-v2 gating so reputation hook fires — @ritsuKai2000
+- (#193) fix(uy6v.7): daemon verdictCode default — Invalid not Pass — @ritsuKai2000
+- (#197) fix(n93o): publish evaluation:<cid> MetadataSet on verdict delivery — @ritsuKai2000
+
+### chore
+- (#208) chore(2cl.20): bump client/package.json to 0.1.5 — @ritsuKai2000
+
+### docs
+- (#165) docs: clarify terminal unresolved verdicts — @ritsuKai2000
+- (#195) docs(uy6v.6): DR — keep self-eval bypass on testnet; revert is a mainnet gate — @ritsuKai2000
+
+### test
+- (#168) test: Real-daemon Playwright e2e: lifecycle + operator catalog + empty states + crash recovery (scenarios 2-5) — scenarios 2-4 — @ritsuKai2000
+- (#207) test: align verdict code fallback expectation — @ritsuKai2000
+
+### other
+- (#192) [codex] address operator dashboard issue 188 feedback — @ritsuKai2000
+
+## Closed this week
+
+- jinn-mono-uy6v.8 (SWE-rebench v2 eval loop — verdicts on non-gradeable evals)
+- jinn-mono-uy6v.6 (DR — keep self-eval bypass on testnet)
+- jinn-mono-uy6v.9 (Unscorable instances in dataset — quantified)
+- jinn-mono-2cl.20.1 (Discovery-stack scope mismatch before release draft)
+
+## Stats
+
+- Window: v0.1.4 → HEAD (2026-05-13)
+- 14 commits · 72 files changed, 4444 insertions(+), 772 deletions(-) · 15 PRs · 1 contributor
+
+## Known issues
+
+- jinn-mono-uy6v.7 (Live verdict-success + JINN reward distribution): in_progress. Verdict path is now structurally correct and emitting, but live observation of JINN reward distribution to operator wallets is still gating the v1 public-testnet ship (separate from this Build Notes cut).
+- jinn-mono-uy6v.10 (Reputation-feedback hook): PR #190 makes the feedback hook fire on swe-rebench v2 verdicts; live on-chain registry update observation still pending closure.
+- jinn-mono-uy6v.11 (Eval-image cache): PR #189 bounded the cache via in-process LRU; long-running operator disk validation still pending closure.
+
+<!-- jinn-release-evidence:v1
+release-tag=v0.1.5
+release-commit=56e849525ebdbc8efc5a99a8255cead613ef7d80
+release-client-prepare=passed
+donation-consumption=passed
+app-first-testnet-acceptance=passed
+-->
+
 ## v0.1.4 — Shipping Machine
 
 _Released 2026-05-12_

package/dist/adapters/mech/adapter.d.ts

@@ -4,6 +4,25 @@ import type { Task, RequestId, PostedTask, TaskAnnouncement, TaskRequest, TaskRe
 import { type MechAdapterConfig } from './types.js';
 import { VerdictCode } from './verdict-code.js';
 import type { Store } from '../../store/store.js';
+/**
+ * Floor block for the on-chain TaskCreated backlog scan, per chain.
+ *
+ * A daemon with no joined-SolverNet store cursor (fresh bootstrap) will scan
+ * from this block forward. Existing operators with a persisted cursor are
+ * unaffected — their cursor is used as long as it's already past this floor.
+ *
+ * Base Sepolia (84532): 41_510_000 lands at 2026-05-14T19:51Z, ~2h after the
+ * fufn validated-pool was rebuilt to `EVAL_SEMANTICS_VERSION='3'` (2026-05-14
+ * T17:28Z). Everything created before that rebuild is a "ghost" — admitted
+ * under a prior semantics regime that the current evaluators can't score —
+ * so a fresh operator should not waste compute claiming them.
+ * See gh #300 for the proper fix (symmetric solver-side admission filter and
+ * generalised scan-age window).
+ *
+ * Base mainnet (8453): unchanged at 25_000_000 — Phase 0 era, no v3-rebuild
+ * equivalent on mainnet.
+ */
+export declare const DEFAULT_TASK_DISCOVERY_FROM_BLOCK: Record<number, bigint>;
 export declare class MechAdapter implements ExecutionAdapter {
     readonly name = "mech";
     private publicClient;
@@ -32,6 +51,9 @@ export declare class MechAdapter implements ExecutionAdapter {
     private persistPendingEvaluationSolutions;
     private rememberPendingEvaluationSolution;
     private forgetPendingEvaluationSolution;
+    private clearPendingDeliveryRecoveryState;
+    private recoveryDeliveryExpirySeconds;
+    private shouldSkipExpiredRecoveryDelivery;
     postTask(state: Task): Promise<PostedTask>;
     private signTaskDocument;
     private contractPolicyForTask;
@@ -55,7 +77,7 @@ export declare class MechAdapter implements ExecutionAdapter {
     }>;
     submitSolutionDelivery(requestId: RequestId, solutionDigest: Hex): Promise<void>;
     submitVerdictDelivery(requestId: RequestId, verdictDigest: Hex, verdictCode: VerdictCode): Promise<void>;
-    private evidenceHashForDelivery;
+    private deliveryClaimForDelivery;
     private ensureDeliveryClaimed;
     watchForDeliveries(): AsyncIterable<DeliveredResult>;
     stop(): Promise<void>;

package/dist/adapters/mech/adapter.js

@@ -6,19 +6,59 @@ import { PermanentError, parseTask } from '../../types/index.js';
 import { createClients } from './safe.js';
 import { buildResultPayload, uploadToIpfs, cidToDigestHex, fetchFromIpfs, fetchSignedTaskFromIpfs, fetchSignedEnvelopeFromIpfs, } from './ipfs.js';
 import { canonicalJson } from '../../harnesses/engine/canonical-json.js';
-import { SignedEnvelopeSchema } from '../../types/envelope.js';
+import { normalizeEnvelopeRole, SignedEnvelopeSchema } from '../../types/envelope.js';
 import { submitTask, claimTask as claimTaskOnchain, claimEvaluation as claimEvaluationOnchain, claimDelivery, getMechDeliveryRate, getTimeoutBounds, decodeTaskCreatedLogs, decodeSolutionDeliveryClaimedLogs, decodeDeliverLogs, findLatestDeliveryDataHexForRequest, getMarketplaceRequestDeliveryMech, getTaskCidDigest, callDeliverToMarketplace, canClaimTask, canClaimEvaluation, } from './contracts.js';
+import { isNonRecoverableInnerRevert } from './safe-revert.js';
+import { verdictCodeFromValue } from './verdict-code.js';
 import { manifestDigestForCid } from './digest.js';
 import { withRecoverableRetry } from '../../tx-retry.js';
 import { formatRpcError } from '../../rpc-error-context.js';
-import { RESTORATION_ENVELOPE_CID_CONTEXT_KEY, RESTORATION_TASK_CID_CONTEXT_KEY, } from '../../harnesses/impls/evaluation-context.js';
+import { SOLUTION_ENVELOPE_CID_CONTEXT_KEY, SOLUTION_TASK_CID_CONTEXT_KEY, RESTORATION_TASK_CID_CONTEXT_KEY, } from '../../harnesses/impls/evaluation-context.js';
 import { signTaskV1 } from '../../tasks/signing.js';
 const ROUTER_REQUEST_CURSOR_CONFIG_KEY = 'mech_router_request_block_cursor_v1';
 const PENDING_EVALUATION_SOLUTIONS_CONFIG_KEY = 'mech_pending_evaluation_solutions_v1';
 const DEFAULT_MECH_DELIVER_BACKFILL_LOOKBACK_BLOCKS = 100000n;
+/** Yield to the event loop every N evaluation opportunities so a large retry
+ *  backlog can't starve the HTTP API mid-cycle. */
+const EVALUATION_RETRY_YIELD_EVERY = 10;
+/**
+ * Decide whether a `canClaimEvaluation` failure reason means the opportunity
+ * can NEVER become claimable (terminal, prune it) versus one that could still
+ * clear later (transient, keep retrying).
+ *
+ * A false-keep (re-checking a dead opportunity) only costs one more RPC; a
+ * false-prune (dropping a still-claimable opportunity) loses real work — so
+ * when in doubt we keep. Anything that does not resolve to a known
+ * non-recoverable revert name is treated as transient.
+ */
+function isTerminalEvaluationReason(reason) {
+    if (!reason)
+        return false;
+    // Strip a decoded-argument suffix, e.g. `TCAttemptAlreadyFinalized(1, 0)`.
+    const bareName = reason.replace(/\(.*$/s, '').trim();
+    return isNonRecoverableInnerRevert(bareName);
+}
 const DEFAULT_ROUTER_LOG_CHUNK_BLOCKS = 9999n;
-const DEFAULT_TASK_DISCOVERY_FROM_BLOCK = {
-    84532: 41153291n,
+/**
+ * Floor block for the on-chain TaskCreated backlog scan, per chain.
+ *
+ * A daemon with no joined-SolverNet store cursor (fresh bootstrap) will scan
+ * from this block forward. Existing operators with a persisted cursor are
+ * unaffected — their cursor is used as long as it's already past this floor.
+ *
+ * Base Sepolia (84532): 41_510_000 lands at 2026-05-14T19:51Z, ~2h after the
+ * fufn validated-pool was rebuilt to `EVAL_SEMANTICS_VERSION='3'` (2026-05-14
+ * T17:28Z). Everything created before that rebuild is a "ghost" — admitted
+ * under a prior semantics regime that the current evaluators can't score —
+ * so a fresh operator should not waste compute claiming them.
+ * See gh #300 for the proper fix (symmetric solver-side admission filter and
+ * generalised scan-age window).
+ *
+ * Base mainnet (8453): unchanged at 25_000_000 — Phase 0 era, no v3-rebuild
+ * equivalent on mainnet.
+ */
+export const DEFAULT_TASK_DISCOVERY_FROM_BLOCK = {
+    84532: 41510000n,
     8453: 25000000n,
 };
 const DEFAULT_MECH_CLAIM_POLICY = {
@@ -218,6 +258,35 @@ export class MechAdapter {
             return;
         this.persistPendingEvaluationSolutions();
     }
+    clearPendingDeliveryRecoveryState(requestId) {
+        this.originalStates.delete(requestId);
+        this.pendingEvaluations.delete(requestId);
+        this.requestKinds.delete(requestId);
+    }
+    recoveryDeliveryExpirySeconds(requestId) {
+        const task = this.originalStates.get(requestId) ?? this.pendingEvaluations.get(requestId);
+        const claimPolicy = task?.claimPolicy ?? DEFAULT_MECH_CLAIM_POLICY;
+        const normalizeTsToSeconds = (value) => {
+            if (value == null)
+                return undefined;
+            return value > 10_000_000_000 ? Math.floor(value / 1000) : value;
+        };
+        const submissionDeadlineSeconds = normalizeTsToSeconds(claimPolicy.submissionDeadlineTs);
+        if (submissionDeadlineSeconds != null)
+            return submissionDeadlineSeconds;
+        const claimWindowEndSeconds = normalizeTsToSeconds(claimPolicy.claimWindowEndTs ?? task?.window?.endTs);
+        if (claimWindowEndSeconds == null)
+            return undefined;
+        return claimWindowEndSeconds + claimPolicy.claimLeaseTtlSeconds;
+    }
+    shouldSkipExpiredRecoveryDelivery(requestId, currentChainTimestampSeconds, recoveryExpirySeconds) {
+        if (currentChainTimestampSeconds <= recoveryExpirySeconds)
+            return false;
+        console.error(`[mech] skipping recovery delivery for ${requestId}: ` +
+            `submission deadline expired at ${new Date(recoveryExpirySeconds * 1000).toISOString()}`);
+        this.clearPendingDeliveryRecoveryState(requestId);
+        return true;
+    }
     async postTask(state) {
         const restorationState = {
             ...state,
@@ -251,7 +320,7 @@ export class MechAdapter {
             task: {
                 ...restorationState,
                 signedTask,
-                context: { ...(restorationState.context ?? {}), [RESTORATION_TASK_CID_CONTEXT_KEY]: restorationTaskCid },
+                context: { ...(restorationState.context ?? {}), [SOLUTION_TASK_CID_CONTEXT_KEY]: restorationTaskCid },
             },
             taskCid: restorationTaskCid,
             onchainCreationTx: taskSubmission.txHash,
@@ -357,8 +426,8 @@ export class MechAdapter {
             context: {
                 ...(params.task.context ?? {}),
                 restorationResult: params.resultData,
-                [RESTORATION_TASK_CID_CONTEXT_KEY]: params.task.context?.[RESTORATION_TASK_CID_CONTEXT_KEY] ?? params.taskCid,
-                [RESTORATION_ENVELOPE_CID_CONTEXT_KEY]: params.restorationEnvelopeCid,
+                [SOLUTION_TASK_CID_CONTEXT_KEY]: params.task.context?.[SOLUTION_TASK_CID_CONTEXT_KEY] ?? params.task.context?.[RESTORATION_TASK_CID_CONTEXT_KEY] ?? params.taskCid,
+                [SOLUTION_ENVELOPE_CID_CONTEXT_KEY]: params.solutionEnvelopeCid,
             },
         };
     }
@@ -418,11 +487,25 @@ export class MechAdapter {
             console.error('[mech] task discovery (DiscoveryAPI) failed:', err instanceof Error ? err.message : err);
             return;
         }
+        const discoveryFloorBlock = this.onchainTaskDiscoveryFromBlock();
         for (const candidate of candidates) {
             if (!this.isDiscoveryTaskAllowed(candidate.taskId))
                 continue;
             if (this.claimedRestorationTaskIds.has(candidate.taskId))
                 continue;
+            // gh #300 ghost-task floor — same floor as the on-chain TaskCreated
+            // backlog scan, applied to the DiscoveryAPI path too. Without this,
+            // the Ponder indexer (or onchain floor's listClaimableTasks) returns
+            // pre-floor tasks that are still claimable on-chain but unscorable
+            // under the current admission regime, defeating the floor's
+            // intent. Candidates without `createdAtBlock` are passed through
+            // (DiscoveryAPI is allowed to omit that field; we can't filter
+            // without it).
+            if (discoveryFloorBlock != null &&
+                candidate.createdAtBlock != null &&
+                BigInt(candidate.createdAtBlock) < discoveryFloorBlock) {
+                continue;
+            }
             // Verify claimability per backend: HttpSubgraphDiscoveryAPI cannot run
             // canClaimTask (no on-chain simulation), so this check is load-bearing
             // for that path. OnchainDiscoveryAPI already filters internally; this
@@ -468,22 +551,32 @@ export class MechAdapter {
             this.forgetPendingEvaluationSolution(solution.requestId);
             return undefined;
         }
-        const restoration = await this.restorationAnnouncementForTaskId(solution.taskId);
+        // Cheap claimability gate FIRST — before the restoration lookup + IPFS
+        // fetch. A backlog of terminal opportunities (finalized / evaluation
+        // deadline passed / max verdicts reached) must not pay the expensive
+        // restoration-announcement cost on every poll cycle. Terminal reasons are
+        // pruned from the working set so the loop never re-scans on-chain history;
+        // transient reasons are left in place to be retried next cycle.
         const claimable = await canClaimEvaluation(this.publicClient, this.config.safeAddress, this.config.routerAddress, solution.taskId, solution.attemptIndex, this.config.mechContractAddress);
         if (!claimable.ok) {
-            console.log(`[mech] skipping evaluation opportunity ${solution.requestId} for task ${solution.taskId}/${solution.attemptIndex}: ${claimable.reason}`);
-            this.forgetPendingEvaluationSolution(solution.requestId);
+            const terminal = isTerminalEvaluationReason(claimable.reason);
+            console.log(`[mech] skipping evaluation opportunity ${solution.requestId} for task ${solution.taskId}/${solution.attemptIndex}: ${claimable.reason}` +
+                (terminal ? ' (terminal — pruned)' : ' (transient — will retry)'));
+            if (terminal) {
+                this.forgetPendingEvaluationSolution(solution.requestId);
+            }
             return undefined;
         }
-        const restorationEnvelopeCid = await this.deliveryEnvelopeCidForSolution(solution);
-        const resultPayload = await fetchFromIpfs(this.config.ipfsGatewayUrl, restorationEnvelopeCid);
+        const restoration = await this.restorationAnnouncementForTaskId(solution.taskId);
+        const solutionEnvelopeCid = await this.deliveryEnvelopeCidForSolution(solution);
+        const resultPayload = await fetchFromIpfs(this.config.ipfsGatewayUrl, solutionEnvelopeCid);
         const resultData = resultPayload.data ?? JSON.stringify(resultPayload);
         const evaluationTask = this.buildEvaluationTask({
             task: restoration.task,
             solutionRequestId: solution.requestId,
             attemptIndex: solution.attemptIndex,
             resultData,
-            restorationEnvelopeCid,
+            solutionEnvelopeCid,
             taskCid: restoration.taskCid,
         });
         const opportunityId = `evaluation:${solution.taskId}:${solution.attemptIndex}:${solution.requestId}`;
@@ -503,15 +596,21 @@ export class MechAdapter {
         return announcement;
     }
     async *retryPendingEvaluationSolutions() {
+        let processed = 0;
         for (const [requestId, solution] of Array.from(this.pendingEvaluationSolutions)) {
+            // Yield to the event loop periodically so a large backlog of pending
+            // evaluation solutions can't starve the HTTP API mid-cycle.
+            if (processed > 0 && processed % EVALUATION_RETRY_YIELD_EVERY === 0) {
+                await new Promise((resolve) => setImmediate(resolve));
+            }
+            processed++;
             try {
                 const announcement = await this.evaluationAnnouncementForSolution(solution);
                 if (announcement) {
                     yield announcement;
                 }
-                else {
-                    this.forgetPendingEvaluationSolution(requestId);
-                }
+                // No announcement does NOT mean "forget" — pruning is owned by
+                // evaluationAnnouncementForSolution, which only removes terminal cases.
             }
             catch (err) {
                 console.error(`[mech] evaluation opportunity retry failed for ${requestId}:`, err);
@@ -644,9 +743,13 @@ export class MechAdapter {
     async submitVerdictDelivery(requestId, verdictDigest, verdictCode) {
         await claimDelivery(this.publicClient, this.walletClient, this.config.safeAddress, this.config.routerAddress, requestId, { variant: 'v3', kind: 'verdict', evidenceHash: verdictDigest, verdictCode }, this.config.evictionRecovery);
     }
-    async evidenceHashForDelivery(requestId, deliveryDataHex) {
+    async deliveryClaimForDelivery(requestId, deliveryDataHex) {
+        const fallbackKind = this.requestKinds.get(requestId) ?? 'solution';
         if (this.config.routerClaimDeliveryVariant !== 'v2' && this.config.routerClaimDeliveryVariant !== 'v3') {
-            return undefined;
+            return {
+                evidenceHash: undefined,
+                kind: fallbackKind,
+            };
         }
         const deliveryDigest = deliveryDataHex.startsWith('0x')
             ? deliveryDataHex.slice(2)
@@ -654,11 +757,6 @@ export class MechAdapter {
         const envelopeCid = `f01551220${deliveryDigest}`;
         const rawEnvelope = await fetchSignedEnvelopeFromIpfs(this.config.ipfsGatewayUrl, envelopeCid);
         const parsed = SignedEnvelopeSchema.parse(rawEnvelope);
-        // Strip signature to recompute the hash over the unsigned body.
-        //
-        // Important: compute over the fetched wire object, not over the parsed
-        // schema result. The schema normalizes some nested objects and may strip
-        // extension metadata that was present when the envelope was signed.
         const rawSigned = rawEnvelope;
         const { signature: _rawSignature, ...unsignedBody } = rawSigned;
         const signature = parsed.signature;
@@ -667,22 +765,36 @@ export class MechAdapter {
         if (recomputed !== signature.hash) {
             throw new Error(`recomputed hash ${recomputed} !== envelope.signature.hash ${signature.hash}`);
         }
-        return recomputed;
+        const role = normalizeEnvelopeRole(parsed.role);
+        if (role === 'capture') {
+            throw new Error(`unsupported delivery envelope role=capture for requestId ${requestId}`);
+        }
+        const kind = role === 'verdict' ? 'verdict' : 'solution';
+        const payload = rawSigned['payload'];
+        const rawVerdict = payload != null && typeof payload === 'object'
+            ? payload['verdict']
+            : undefined;
+        return {
+            evidenceHash: recomputed,
+            kind,
+            verdictCode: kind === 'verdict' ? verdictCodeFromValue(rawVerdict) : undefined,
+        };
     }
     async ensureDeliveryClaimed(requestId, deliveryDataHex) {
-        let evidenceHash;
+        let claimOptions;
         try {
-            evidenceHash = await this.evidenceHashForDelivery(requestId, deliveryDataHex);
+            claimOptions = await this.deliveryClaimForDelivery(requestId, deliveryDataHex);
         }
         catch (err) {
-            console.error(`[mech] evidenceHash derivation failed for ${requestId} — skipping claim, will retry on next loop:`, err);
+            console.error(`[mech] delivery claim metadata derivation failed for ${requestId} — skipping claim, will retry on next loop:`, err);
             return 'retry';
         }
         try {
             await claimDelivery(this.publicClient, this.walletClient, this.config.safeAddress, this.config.routerAddress, requestId, {
                 variant: this.config.routerClaimDeliveryVariant,
-                kind: this.requestKinds.get(requestId) ?? 'solution',
-                evidenceHash,
+                kind: claimOptions.kind,
+                evidenceHash: claimOptions.evidenceHash,
+                verdictCode: claimOptions.verdictCode,
             }, this.config.evictionRecovery);
             return 'claimed';
         }
@@ -711,7 +823,9 @@ export class MechAdapter {
                     });
                     this.deliveryBlockCursor = currentBlock;
                     const decoded = decodeDeliverLogs(logs);
-                    for (const { requestId, deliveryDataHex, mechAddress } of decoded) {
+                    const blockTimestampSecondsByNumber = new Map();
+                    let currentBlockTimestampSeconds;
+                    for (const { requestId, deliveryDataHex, mechAddress, blockNumber } of decoded) {
                         // Two concerns, independent:
                         //   (a) Did this Safe DELIVER this? → claim it (counter credit goes to msg.sender)
                         //       The Deliver event's mechAddress is mechServiceMultisig (the Safe that owns
@@ -721,6 +835,30 @@ export class MechAdapter {
                         const iCreatedRestoration = this.pendingEvaluations.has(requestId);
                         if (!iDelivered && !iCreatedRestoration)
                             continue;
+                        if (iCreatedRestoration) {
+                            const recoveryExpirySeconds = this.recoveryDeliveryExpirySeconds(requestId);
+                            if (recoveryExpirySeconds != null) {
+                                let deliveryTimestampSeconds;
+                                if (blockNumber != null) {
+                                    deliveryTimestampSeconds = blockTimestampSecondsByNumber.get(blockNumber);
+                                    if (deliveryTimestampSeconds == null) {
+                                        const deliveryBlockData = await this.publicClient.getBlock({ blockNumber });
+                                        deliveryTimestampSeconds = Number(deliveryBlockData.timestamp);
+                                        blockTimestampSecondsByNumber.set(blockNumber, deliveryTimestampSeconds);
+                                    }
+                                }
+                                else {
+                                    if (currentBlockTimestampSeconds == null) {
+                                        const currentBlockData = await this.publicClient.getBlock({ blockNumber: currentBlock });
+                                        currentBlockTimestampSeconds = Number(currentBlockData.timestamp);
+                                    }
+                                    deliveryTimestampSeconds = currentBlockTimestampSeconds;
+                                }
+                                if (this.shouldSkipExpiredRecoveryDelivery(requestId, deliveryTimestampSeconds, recoveryExpirySeconds)) {
+                                    continue;
+                                }
+                            }
+                        }
                         // (a) Deliverer-side claim path: if this Safe delivered the request,
                         //     claim it first so router counters credit the deliverer.
                         let deliveryClaimStatus;
@@ -756,9 +894,7 @@ export class MechAdapter {
                                 deliveryMechAddress: mechAddress,
                             };
                             // Clean up after yielding
-                            this.originalStates.delete(requestId);
-                            this.pendingEvaluations.delete(requestId);
-                            this.requestKinds.delete(requestId);
+                            this.clearPendingDeliveryRecoveryState(requestId);
                         }
                         catch (err) {
                             console.error(`[mech] Failed to parse delivery ${requestId}:`, err);