@jinn-network/client 0.1.6 → 0.1.7-canary.0a586ca9

package/dist/config.js

@@ -18,15 +18,9 @@ import { homedir } from 'node:os';
 import { dirname, join } from 'node:path';
 import { z } from 'zod';
 import { TaskSchema, parseTask } from './types/task.js';
-import { canonicalHarnessName, CLAUDE_CODE_HARNESS } from './harnesses/names.js';
-/**
- * Default `solverNets` is empty per Decision 5 of
- * spec/2026-05-05-solvernet-creation-and-launch.md — pre-release, no
- * migration burden. Fresh installs no longer seed the `prediction` entry;
- * the operator joins SolverNets through the registry (Task 21's
- * `joinedSolverNets` block).
- */
-export const DEFAULT_SOLVER_NETS = {};
+import { canonicalHarnessName } from './harnesses/names.js';
+import { parseRpcUrls } from './rpc/transport.js';
+// ── Schema ──────────────────────────────────────────────────────────────────
 const HarnessNameSchema = z.string().transform((name) => canonicalHarnessName(name));
 export const JinnConfigSchema = z.object({
     /**
@@ -38,19 +32,24 @@ export const JinnConfigSchema = z.object({
      */
     network: z.enum(['mainnet', 'testnet']).default('testnet'),
     /**
-     * Base RPC endpoint.
-     * Defaults to https://mainnet.base.org for 'mainnet' and
-     * https://sepolia.base.org for 'testnet'. Set explicitly to override.
+     * Base RPC endpoint(s). Accepts either a single URL string or an array of
+     * URLs. When an array (or a comma-separated env var) is supplied, the
+     * daemon builds a viem `fallback()` chain in slot order (primary first).
+     * See `client/src/rpc/transport.ts` for the wrapper. Defaults to the
+     * publicnode+sepolia.base.org two-provider chain on testnet and the public
+     * `mainnet.base.org` on mainnet. Set explicitly to override.
+     *
+     * Env: JINN_RPC_URL / BASE_SEPOLIA_RPC_URL / BASE_RPC_URL (comma-separated).
      */
-    rpcUrl: z.string().optional(),
-    archiveRpcUrl: z.string().optional(),
+    rpcUrl: z.union([z.string(), z.array(z.string()).min(1)]).optional(),
+    archiveRpcUrl: z.union([z.string(), z.array(z.string()).min(1)]).optional(),
     /**
-     * Optional L2 proof/archive RPC endpoint for canonical cross-chain canaries.
+     * Optional L2 proof/archive RPC endpoint(s) for canonical cross-chain canaries.
      * The daemon can use its normal rpcUrl for writes while proof construction
      * uses this endpoint for historical eth_getProof at OP dispute-game blocks.
-     * Env: JINN_L2_PROOF_RPC_URL.
+     * Accepts string or array form (see rpcUrl). Env: JINN_L2_PROOF_RPC_URL.
      */
-    l2ProofRpcUrl: z.string().url().optional(),
+    l2ProofRpcUrl: z.union([z.string(), z.array(z.string()).min(1)]).optional(),
     /** Earning state directory */
     earningDir: z.string().default(join(homedir(), '.jinn-client', 'earning')),
     /** SQLite database path */
@@ -70,6 +69,20 @@ export const JinnConfigSchema = z.object({
      * Set to 0 to disable. Env: JINN_BALANCE_TOPUP_INTERVAL_MS
      */
     balanceTopupIntervalMs: z.number().int().min(0).default(300_000),
+    /**
+     * Interval between eviction-state polls for the staking proxy (ms).
+     * Default 60000 (1 min). Set to 0 to disable. Env: JINN_EVICTION_CHECK_INTERVAL_MS
+     */
+    evictionCheckIntervalMs: z.number().int().min(0).default(60_000),
+    /**
+     * Interval between proactive `checkpoint()` tx calls to each staked
+     * proxy (ms). Keeps `tsCheckpoint` advancing so the activity-rate window
+     * stays narrow — without it operators silently fail liveness on realistic
+     * cadence (issue #505). Default 300_000 (5 min), matching the standard
+     * `livenessPeriod` on stOLAS staking proxies. Set to 0 to disable.
+     * Env: JINN_CHECKPOINT_INTERVAL_MS.
+     */
+    checkpointIntervalMs: z.number().int().min(0).default(300_000),
     /** HTTP API port */
     apiPort: z.number().int().positive().default(7331),
     /**
@@ -97,6 +110,13 @@ export const JinnConfigSchema = z.object({
      * Default 30 000 ms. Env: JINN_HERMES_DOCTOR_TIMEOUT_MS.
      */
     hermesDoctorTimeoutMs: z.number().int().positive().default(30_000),
+    /** Path to the `codex` executable. Defaults to `codex` when unset. */
+    codexPath: z.string().optional(),
+    /**
+     * Timeout in ms for `codex --version` health-check runs.
+     * Default 30 000 ms. Env: JINN_CODEX_DOCTOR_TIMEOUT_MS.
+     */
+    codexDoctorTimeoutMs: z.number().int().positive().default(30_000),
     /**
      * How the operator runs the daemon. Set once by app-guided setup or the
      * legacy `jinn auth` compatibility command, then read by every command that
@@ -143,6 +163,16 @@ export const JinnConfigSchema = z.object({
      * backlog while proving one fresh task path.
      */
     taskDiscoveryAllowedTaskIds: z.array(z.string()).optional(),
+    /**
+     * Opt-in lower bound (L2 block number) for the mech adapter's canonical
+     * on-chain TaskCreated backlog scan. Unset → the adapter's per-chain default
+     * (DEFAULT_TASK_DISCOVERY_FROM_BLOCK) flows through (see gh #300). Set this to
+     * a recent block to bound the scan to a small recent window so the indexer
+     * (DiscoveryAPI.findClaimableTasks) carries the bulk of discovery — the
+     * canonical getLogs scan over a large/bloated history parses huge responses
+     * on the main thread and can stall the event loop. Env: JINN_TASK_DISCOVERY_FROM_BLOCK.
+     */
+    taskDiscoveryOnchainFromBlock: z.number().int().min(0).optional(),
     /** This node's public HTTP endpoint (for 8004 registration) */
     nodeEndpoint: z.string().optional(),
     /** Tasks to create and solve. Empty by default; enabled SolverNet generators fill the loop. */
@@ -174,17 +204,19 @@ export const JinnConfigSchema = z.object({
     jinnMviL2DeploymentPath: z.string().optional(),
     // ── Cross-chain claim loop (Phase B / jinn-mono-7x5) ─────────────────────
     /**
-     * RPC endpoint for the L1 governance chain (Ethereum / Sepolia) where the
-     * JinnDistributor lives. Required when jinnDistributorAddress is set.
-     * Env: JINN_ETHEREUM_RPC_URL.
+     * RPC endpoint(s) for the L1 governance chain (Ethereum / Sepolia) where
+     * the JinnDistributor lives. Accepts string or array form (see rpcUrl) and
+     * supports comma-separated env values. Testnet defaults to a public Sepolia
+     * RPC; mainnet requires an operator override when L1 submit mode is
+     * configured. Env: JINN_ETHEREUM_RPC_URL.
      */
-    ethereumRpcUrl: z.string().url().optional(),
+    ethereumRpcUrl: z.union([z.string(), z.array(z.string()).min(1)]).optional(),
     /**
-     * Optional archive RPC endpoint for the L1 governance chain. Used for
-     * historical block lookups when constructing canonical-mode proofs.
-     * Env: JINN_ETHEREUM_ARCHIVE_RPC_URL.
+     * Optional archive RPC endpoint(s) for the L1 governance chain. Used for
+     * historical block lookups when constructing canonical-mode proofs. Accepts
+     * string or array form. Env: JINN_ETHEREUM_ARCHIVE_RPC_URL.
      */
-    ethereumArchiveRpcUrl: z.string().url().optional(),
+    ethereumArchiveRpcUrl: z.union([z.string(), z.array(z.string()).min(1)]).optional(),
     /**
      * L1 network used by the cross-chain claim loop. 'sepolia' tracks Base
      * Sepolia testnet; 'ethereum' tracks Base mainnet. Defaults to 'sepolia'
@@ -192,10 +224,10 @@ export const JinnConfigSchema = z.object({
      */
     jinnL1Network: z.enum(['sepolia', 'ethereum']).default('sepolia'),
     /**
-     * JinnDistributor address on the L1 governance chain. Setting this enables
-     * the cross-chain claim loop. When set, ethereumRpcUrl MUST also be set.
-     * Resolved from jinnMviL1DeploymentPath when omitted; otherwise a manual
-     * override. Env: JINN_DISTRIBUTOR_ADDRESS.
+     * JinnDistributor address on the L1 governance chain. Required for
+     * jinnClaimSubmissionMode='submit'. When set for submit mode, ethereumRpcUrl
+     * MUST also be set. Resolved from jinnMviL1DeploymentPath when omitted;
+     * otherwise a manual override. Env: JINN_DISTRIBUTOR_ADDRESS.
      */
     jinnDistributorAddress: z
         .string()
@@ -229,6 +261,20 @@ export const JinnConfigSchema = z.object({
      * Env: JINN_MESSENGER_MODE.
      */
     jinnMessengerMode: z.enum(['canonical', 'mock']).default('canonical'),
+    /**
+     * Claim submission mode. `emit-only` only submits TaskClaimEmitter.emitClaim
+     * on L2 and records the resulting ticket. `submit` continues into the L1
+     * messenger/distributor path.
+     * Env: JINN_CLAIM_SUBMISSION_MODE.
+     */
+    jinnClaimSubmissionMode: z.enum(['emit-only', 'submit']).default('emit-only'),
+    /**
+     * Explicit operator gate for the cross-chain JINN claim loop. The schema
+     * default stays off for mainnet/unknown networks; loadConfig defaults this
+     * on for testnet now that the emitter and standing relayer are live.
+     * Env: JINN_CLAIM_LOOP_ENABLED=1|true|yes.
+     */
+    jinnClaimLoopEnabled: z.boolean().default(false),
     /**
      * How often the daemon ticks the cross-chain JINN claim loop (ms). Default
      * 3 600 000 (1 hour) — well below mainnet challenge windows while
@@ -318,69 +364,7 @@ export const JinnConfigSchema = z.object({
     })
         .default({ mode: 'train' }),
     /**
-     * SolverNet activation, Harness selection, and operator-configured runtime plugins.
-     *
-     * Each entry's `roles` is a non-empty subset of `['solving', 'evaluating']`.
-     * Multiple roles can run concurrently for the same SolverNet; the
-     * protocol-level `disallowSolverSelfEvaluation` flag prevents the operator
-     * from evaluating its own Solutions and the on-chain
-     * TaskActivityCheckerV3 tracks Solution and Verdict counters independently
-     * (additive into `eligibleActivityWeight`).
-     *
-     * Launcher ownership lives in the launched-record subsystem
-     * (spec/2026-05-05-solvernet-creation-and-launch.md §11), not in operator
-     * config — there is no `'launching'` operator role. Legacy entries that
-     * include `'launching'` in `roles` have it stripped by the preprocessor so
-     * older config files keep loading.
-     *
-     * Backwards-compat: a legacy `role: 'solving' | 'evaluating'` field is
-     * auto-promoted to `roles: [<role>]` by the zod preprocessor below so
-     * existing `~/.jinn-client/config.json` files keep loading without an
-     * operator migration step.
-     */
-    solverNets: z.record(z.preprocess((raw) => {
-        if (typeof raw !== 'object' || raw === null)
-            return raw;
-        const obj = raw;
-        // Promote legacy `role: X` → `roles: [X]` when only the singular form
-        // is provided. If both are present (mid-migration third-party config),
-        // `roles` wins and `role` is dropped.
-        if (Array.isArray(obj['roles']) && obj['roles'].length > 0) {
-            // Drop legacy `'launching'` entries — operator config no longer
-            // carries the launcher role; ownership is via launched records.
-            const filteredRoles = obj['roles'].filter((r) => r !== 'launching');
-            const { role: _legacyRole, ...rest } = obj;
-            return { ...rest, roles: filteredRoles };
-        }
-        if (typeof obj['role'] === 'string' && (obj['role'] === 'solving' || obj['role'] === 'evaluating')) {
-            const { role, ...rest } = obj;
-            return { ...rest, roles: [role] };
-        }
-        return obj;
-    }, z.object({
-        enabled: z.boolean().default(true),
-        solverType: z.string(),
-        roles: z.array(z.enum(['solving', 'evaluating']))
-            .min(1, 'each SolverNet must enable at least one role')
-            .default(['solving'])
-            // Deduplicate to keep downstream consumers simple.
-            .transform((arr) => Array.from(new Set(arr))),
-        harness: HarnessNameSchema.default(CLAUDE_CODE_HARNESS),
-        model: z.string().optional(),
-        plugins: z.array(z.union([
-            z.string(),
-            z.object({
-                name: z.string().optional(),
-                source: z.string(),
-                version: z.string().optional(),
-            }),
-        ])).default([]),
-        taskGenerator: z.object({
-            enabled: z.boolean().default(true),
-        }).default({ enabled: true }),
-    }))).default(DEFAULT_SOLVER_NETS),
-    /**
-     * Manifest-keyed joined SolverNets (Task 21).
+     * Manifest-keyed joined SolverNets.
      *
      * Spec: spec/2026-05-05-solvernet-creation-and-launch.md §12.
      *
@@ -389,10 +373,10 @@ export const JinnConfigSchema = z.object({
      * (CIDv0 / CIDv1) — the only stable identifier that maps back to a
      * launched-instance authority across launchers.
      *
-     * Kept structurally separate from legacy `solverNets` for now. The daemon
-     * narrows this block into runtime SolverNet registry entries on restart, and
-     * Task 22 collapses both branches into a single manifest-keyed shape once
-     * the legacy block is fully drained.
+     * The daemon narrows this block into runtime SolverNet registry entries on
+     * restart. Legacy short-name-keyed `solverNets` blocks on operator config
+     * files are auto-migrated into synthetic `legacy:<short-name>`-keyed
+     * entries at load time (see `migrateLegacySolverNets`).
      */
     joinedSolverNets: z
         .record(z.string(), z.object({
@@ -536,8 +520,37 @@ export const JinnConfigSchema = z.object({
      * Env: JINN_REPUTATION_ENABLED
      */
     reputationEnabled: z.boolean().default(false),
-}).refine((cfg) => !cfg.jinnDistributorAddress || !!cfg.ethereumRpcUrl, {
-    message: 'ethereumRpcUrl must be set when jinnDistributorAddress is configured ' +
+    /**
+     * Per-credential daily spend caps (USD). Keys are credential identifiers
+     * (e.g. `'anthropic:api-key'`); values are positive numbers representing
+     * the maximum USD spend per day for that credential.
+     *
+     * `JINN_SPEND_CAP_USD` (env-only, consumed directly by the spend-budget
+     * subsystem in Task 9) is tracked for provenance in TRACKED_ENV_VARS below
+     * but is NOT a config-file field and has no entry in this schema.
+     */
+    spendCaps: z.record(z.string(), z.number().positive()).optional(),
+    /**
+     * Operator-local SolverPlugin trust state.
+     *
+     * `blockedCids` is the list of plug-in CIDs the operator has chosen to
+     * refuse to load — populated by `jinn solver-plugins block <cid>` and read
+     * at daemon startup. The block list complements the on-chain
+     * `giveFeedback(score=0)` write (which is the public-trust signal); the
+     * local list is the operator's own refusal to execute, applied even when
+     * the network write fails. File-managed only — no env override.
+     *
+     * See spec/2026-05-26-117-design.md "Failure modes" and "Local-only effects".
+     */
+    solverPlugins: z
+        .object({
+        blockedCids: z.array(z.string()).default([]),
+    })
+        .default({ blockedCids: [] }),
+}).refine((cfg) => cfg.jinnClaimSubmissionMode !== 'submit' ||
+    !cfg.jinnDistributorAddress ||
+    !!cfg.ethereumRpcUrl, {
+    message: 'ethereumRpcUrl must be set when jinnDistributorAddress is configured in submit mode ' +
         '(env JINN_ETHEREUM_RPC_URL or config field). The cross-chain claim loop ' +
         'cannot reach the L1 governance chain without it.',
     path: ['ethereumRpcUrl'],
@@ -557,6 +570,21 @@ export const DEFAULT_CONFIG_PATH = join(DEFAULT_DIR, 'config.json');
  * historical sync — see ponder.config.ts).
  */
 export const DEFAULT_TESTNET_DISCOVERY_URL = 'https://jinn-indexer-production.up.railway.app';
+export const DEFAULT_TESTNET_ETHEREUM_RPC_URL = 'https://ethereum-sepolia-rpc.publicnode.com';
+/**
+ * Default fallback chain for the L2 measurement chain (Base Sepolia) on
+ * testnet. Per AC2 of issue #592:
+ *   slot 0 — `https://base-sepolia.publicnode.com` (no-auth, 50k-block
+ *     getLogs cap, no shared-quota cliff).
+ *   slot 1 — `https://sepolia.base.org` (free public Coinbase endpoint,
+ *     2k-block cap; last-resort backup).
+ * Operators are encouraged to prepend a paid primary key (Alchemy, Tenderly,
+ * etc.) via `rpcUrl` config or `JINN_RPC_URL` / `BASE_SEPOLIA_RPC_URL` env.
+ */
+export const DEFAULT_TESTNET_RPC_URLS = [
+    'https://base-sepolia.publicnode.com',
+    'https://sepolia.base.org',
+];
 export class ConfigLoadError extends Error {
     code;
     details;
@@ -567,7 +595,93 @@ export class ConfigLoadError extends Error {
         this.details = details;
     }
 }
-// ── Loader ──────────────────────────────────────────────────────────────────
+/**
+ * Parse a legacy `<id>.<version>` solverType string into `{id, version}`.
+ * Falls back to `{ id: fallbackId, version: 'v1' }` when the string lacks a
+ * dot or terminates in one — this happens only on hand-edited operator
+ * configs and keeps the migration loud-but-non-fatal.
+ */
+function parseSolverTypeRef(solverType, fallbackId) {
+    if (typeof solverType !== 'string') {
+        return { id: fallbackId, version: 'v1' };
+    }
+    const dot = solverType.lastIndexOf('.');
+    if (dot <= 0 || dot === solverType.length - 1) {
+        return { id: fallbackId, version: 'v1' };
+    }
+    return { id: solverType.slice(0, dot), version: solverType.slice(dot + 1) };
+}
+/**
+ * Translate any legacy short-name-keyed `solverNets` block on the raw parsed
+ * config into manifest-keyed `joinedSolverNets` entries with synthetic
+ * `legacy:<short-name>` keys.
+ *
+ * This is the auto-migration path for operators upgrading past issue #421.
+ * The runtime claim filter remains manifest-digest gated, so synthetic-keyed
+ * entries don't change task eligibility — they exist purely so the diagnostic
+ * surfaces (Overview SOLVING-ON eyebrow, prediction-operator-status) keep
+ * showing the operator's previous SolverNets until they re-join via the SPA.
+ *
+ * Returns the number of legacy entries migrated. Idempotent — calling on an
+ * already-migrated raw config is a no-op.
+ *
+ * @param raw — the JSON-parsed config file contents (mutated in place).
+ */
+export function migrateLegacySolverNets(raw) {
+    const legacy = raw['solverNets'];
+    if (!legacy || typeof legacy !== 'object' || Array.isArray(legacy)) {
+        return 0;
+    }
+    const entries = Object.entries(legacy);
+    if (entries.length === 0) {
+        delete raw['solverNets'];
+        return 0;
+    }
+    const joined = (typeof raw['joinedSolverNets'] === 'object' && raw['joinedSolverNets'] !== null && !Array.isArray(raw['joinedSolverNets']))
+        ? raw['joinedSolverNets']
+        : {};
+    let migrated = 0;
+    for (const [name, entryRaw] of entries) {
+        if (!entryRaw || typeof entryRaw !== 'object')
+            continue;
+        const entry = entryRaw;
+        const syntheticKey = `legacy:${name}`;
+        // Do not overwrite a pre-existing joinedSolverNets entry under the same key.
+        if (joined[syntheticKey] !== undefined)
+            continue;
+        const contract = parseSolverTypeRef(entry.solverType, name);
+        const rolesIn = Array.isArray(entry.roles) && entry.roles.length > 0
+            ? entry.roles
+            : ['solving'];
+        const roles = [];
+        for (const r of rolesIn) {
+            if (r === 'solving')
+                roles.push('solver');
+            else if (r === 'evaluating')
+                roles.push('evaluator');
+            // 'launching' (and any other unknown role) is dropped — operator config
+            // no longer carries the launcher role per spec §11.
+        }
+        if (roles.length === 0)
+            roles.push('solver');
+        joined[syntheticKey] = {
+            manifestCid: syntheticKey,
+            name,
+            contract,
+            roles: Array.from(new Set(roles)),
+            ...(typeof entry.harness === 'string' ? { harness: entry.harness } : {}),
+            ...(typeof entry.model === 'string' ? { model: entry.model } : {}),
+            plugins: Array.isArray(entry.plugins) ? entry.plugins : [],
+            disabledDefaultPlugins: [],
+        };
+        migrated += 1;
+    }
+    if (Object.keys(joined).length > 0) {
+        raw['joinedSolverNets'] = joined;
+    }
+    delete raw['solverNets'];
+    return migrated;
+}
 /**
  * Load config with resolution: env > config file > defaults.
  *
@@ -614,6 +728,14 @@ export function loadConfig(configPath) {
     }
     if (env['JINN_BALANCE_TOPUP_INTERVAL_MS'])
         merged.balanceTopupIntervalMs = Number.parseInt(env['JINN_BALANCE_TOPUP_INTERVAL_MS'], 10);
+    if (env['JINN_EVICTION_CHECK_INTERVAL_MS'])
+        merged.evictionCheckIntervalMs = Number.parseInt(env['JINN_EVICTION_CHECK_INTERVAL_MS'], 10);
+    if (env['JINN_CHECKPOINT_INTERVAL_MS'] !== undefined) {
+        merged.checkpointIntervalMs = Number.parseInt(env['JINN_CHECKPOINT_INTERVAL_MS'], 10);
+    }
+    if (env['JINN_TASK_DISCOVERY_FROM_BLOCK'] !== undefined) {
+        merged.taskDiscoveryOnchainFromBlock = Number.parseInt(env['JINN_TASK_DISCOVERY_FROM_BLOCK'], 10);
+    }
     if (env['JINN_API_PORT'])
         merged.apiPort = parseInt(env['JINN_API_PORT'], 10);
     if (env['JINN_API_BIND_HOST'])
@@ -631,6 +753,11 @@ export function loadConfig(configPath) {
     if (env['JINN_HERMES_DOCTOR_TIMEOUT_MS']) {
         merged.hermesDoctorTimeoutMs = parseInt(env['JINN_HERMES_DOCTOR_TIMEOUT_MS'], 10);
     }
+    if (env['JINN_CODEX_PATH'])
+        merged.codexPath = env['JINN_CODEX_PATH'];
+    if (env['JINN_CODEX_DOCTOR_TIMEOUT_MS']) {
+        merged.codexDoctorTimeoutMs = parseInt(env['JINN_CODEX_DOCTOR_TIMEOUT_MS'], 10);
+    }
     if (env['JINN_RUNTIME_MODE'])
         merged.runtimeMode = env['JINN_RUNTIME_MODE'];
     if (env['JINN_PEERS'])
@@ -647,12 +774,14 @@ export function loadConfig(configPath) {
         // A URL only makes sense in http mode — when the operator points
         // JINN_DISCOVERY_URL at a host but doesn't say JINN_DISCOVERY_MODE,
         // default mode to 'http' so the URL is actually consulted (and isn't
-        // silently dropped by the on-chain default in createDiscoveryAPI). In that
-        // inferred-http case, also default fallbackToOnchain on (http without a
-        // floor is a footgun) unless JINN_DISCOVERY_FALLBACK overrides.
+        // silently dropped by the on-chain default in createDiscoveryAPI).
+        // `fallbackToOnchain` is NOT defaulted on here (since the 2026-05-23
+        // substrate incident): silent fall-through hides indexer outages and
+        // storms shared RPC. Operators opt in via JINN_DISCOVERY_FALLBACK=1 or
+        // the config file when they want it.
         const inferredHttp = !!env['JINN_DISCOVERY_URL'] && !env['JINN_DISCOVERY_MODE'] && !prevDiscovery['mode'];
         const mode = env['JINN_DISCOVERY_MODE'] ?? (inferredHttp ? 'http' : undefined);
-        const resolvedFallback = fallbackToOnchain ?? (inferredHttp ? true : undefined);
+        const resolvedFallback = fallbackToOnchain;
         merged['discovery'] = {
             ...prevDiscovery,
             ...(mode ? { mode } : {}),
@@ -690,6 +819,13 @@ export function loadConfig(configPath) {
         merged.jinnMessengerAddress = env['JINN_MESSENGER_ADDRESS'];
     if (env['JINN_MESSENGER_MODE'])
         merged.jinnMessengerMode = env['JINN_MESSENGER_MODE'];
+    if (env['JINN_CLAIM_SUBMISSION_MODE']) {
+        merged.jinnClaimSubmissionMode = env['JINN_CLAIM_SUBMISSION_MODE'];
+    }
+    if (env['JINN_CLAIM_LOOP_ENABLED'] !== undefined) {
+        const v = env['JINN_CLAIM_LOOP_ENABLED'].trim().toLowerCase();
+        merged.jinnClaimLoopEnabled = v === '1' || v === 'true' || v === 'yes';
+    }
     if (env['JINN_CLAIM_LOOP_INTERVAL_MS'] !== undefined) {
         merged.jinnClaimLoopIntervalMs = parseInt(env['JINN_CLAIM_LOOP_INTERVAL_MS'], 10);
     }
@@ -787,7 +923,13 @@ export function loadConfig(configPath) {
     const resolvedNetwork = merged.network === 'testnet' ? 'testnet' : 'mainnet';
     // Testnet default: point discovery at the privately-operated Ponder indexer
     // (jinn-mono-280n.4), unless the operator has set their own `discovery` block.
-    // The on-chain RPC floor stays as the fallback.
+    //
+    // `fallbackToOnchain` is NOT defaulted on (since the 2026-05-23 substrate
+    // incident): silent fall-through to direct eth_getLogs hides indexer outages
+    // and turns every daemon into its own indexer, which storms shared RPC
+    // quota and can take the indexer down. Operators opt in explicitly when
+    // they need it (typically only when self-hosting an RPC with generous
+    // getLogs quotas).
     //
     // Only fill fields the operator left absent — never overwrite an
     // operator-set `url` / `mode` / `fallbackToOnchain`. A bare
@@ -804,9 +946,17 @@ export function loadConfig(configPath) {
             ...(existing ?? {}),
             mode: existing?.mode ?? 'http',
             url: existing?.url ?? DEFAULT_TESTNET_DISCOVERY_URL,
-            fallbackToOnchain: existing?.fallbackToOnchain ?? true,
+            ...(existing?.fallbackToOnchain !== undefined
+                ? { fallbackToOnchain: existing.fallbackToOnchain }
+                : {}),
         };
     }
+    if (resolvedNetwork === 'testnet' && !merged.ethereumRpcUrl) {
+        merged.ethereumRpcUrl = DEFAULT_TESTNET_ETHEREUM_RPC_URL;
+    }
+    if (resolvedNetwork === 'testnet' && merged.jinnClaimLoopEnabled === undefined) {
+        merged.jinnClaimLoopEnabled = true;
+    }
     // Keep the legacy BASE_RPC_URL override for Base mainnet only. Testnet must
     // not silently inherit a mainnet RPC from client/.env during bootstrap.
     if (env['JINN_RPC_URL']) {
@@ -839,6 +989,17 @@ export function loadConfig(configPath) {
             });
         }
     }
+    // Auto-migrate any legacy short-name-keyed `solverNets` block into
+    // `joinedSolverNets` with synthetic `legacy:<name>` keys. Operators upgrade
+    // without an explicit action; the warning surfaces the migration so they
+    // know to re-join via the SPA when they want a real manifest CID. See
+    // spec/2026-05-25-retire-legacy-solvernets-config.md and issue #421.
+    const migratedCount = migrateLegacySolverNets(merged);
+    if (migratedCount > 0) {
+        console.warn(`[config] Migrated ${migratedCount} legacy solverNets ${migratedCount === 1 ? 'entry' : 'entries'} to joinedSolverNets. ` +
+            'Open Operator > SolverNets in the dashboard to re-join via the registry ' +
+            '(replaces the synthetic legacy:* keys with real manifest CIDs).');
+    }
     // 3. Validate
     const result = JinnConfigSchema.safeParse(merged);
     if (!result.success) {
@@ -850,17 +1011,56 @@ export function loadConfig(configPath) {
         });
     }
     // 4. Resolve rpcUrl default based on network (if not explicitly set).
-    // Testnet default is a Tenderly gateway (free public key) — much higher
-    // rate limits than `https://sepolia.base.org`. See contracts.ts comment +
-    // the panel's "shared RPC" warning in NetworkSection.tsx for the operator-
-    // facing pitch to bring their own key.
+    // Testnet default per AC2 (issue #592) is a two-provider fallback chain:
+    //   slot 0 — base-sepolia.publicnode.com (50k-block getLogs cap, no quota)
+    //   slot 1 — sepolia.base.org (free, 2k-block cap; last-resort backup)
+    // Publicnode is no-auth, no shared-key quota cliff (avoids the Tenderly
+    // shared-quota cliff of 2026-05-24 that took out every default-config
+    // daemon at once). See #554 + the NetworkSection.tsx "shared RPC" panel for
+    // the operator-facing pitch to bring their own key. The sibling Ethereum L1
+    // default (DEFAULT_TESTNET_ETHEREUM_RPC_URL above) is already publicnode —
+    // this keeps the two L1/L2 defaults symmetric.
     const parsed = result.data;
-    const defaultRpcUrl = parsed.network === 'testnet'
-        ? 'https://base-sepolia.gateway.tenderly.co/75tyLMQuD8EHpXxMwINIKu'
-        : 'https://mainnet.base.org';
+    const defaultRpcUrls = parsed.network === 'testnet'
+        ? DEFAULT_TESTNET_RPC_URLS
+        : ['https://mainnet.base.org'];
+    const rpcUrlsResolved = parsed.rpcUrl !== undefined
+        ? parseRpcUrls(parsed.rpcUrl)
+        : [...defaultRpcUrls];
+    const archiveRpcUrlsResolved = parsed.archiveRpcUrl !== undefined
+        ? parseRpcUrls(parsed.archiveRpcUrl)
+        : undefined;
+    const l2ProofRpcUrlsResolved = parsed.l2ProofRpcUrl !== undefined
+        ? parseRpcUrls(parsed.l2ProofRpcUrl)
+        : undefined;
+    const ethereumRpcUrlsResolved = parsed.ethereumRpcUrl !== undefined
+        ? parseRpcUrls(parsed.ethereumRpcUrl)
+        : undefined;
+    const ethereumArchiveRpcUrlsResolved = parsed.ethereumArchiveRpcUrl !== undefined
+        ? parseRpcUrls(parsed.ethereumArchiveRpcUrl)
+        : undefined;
+    // Strip the union-typed (string | string[]) RPC fields from `parsed` — the
+    // returned shape carries the resolved head URL plus a `*Urls` array instead.
+    const { rpcUrl: _rpcUrl, archiveRpcUrl: _archiveRpcUrl, l2ProofRpcUrl: _l2ProofRpcUrl, ethereumRpcUrl: _ethereumRpcUrl, ethereumArchiveRpcUrl: _ethereumArchiveRpcUrl, ...rest } = parsed;
     return {
-        ...parsed,
-        rpcUrl: parsed.rpcUrl ?? defaultRpcUrl,
+        ...rest,
+        rpcUrl: rpcUrlsResolved[0],
+        rpcUrls: rpcUrlsResolved,
+        ...(archiveRpcUrlsResolved
+            ? { archiveRpcUrl: archiveRpcUrlsResolved[0], archiveRpcUrls: archiveRpcUrlsResolved }
+            : {}),
+        ...(l2ProofRpcUrlsResolved
+            ? { l2ProofRpcUrl: l2ProofRpcUrlsResolved[0], l2ProofRpcUrls: l2ProofRpcUrlsResolved }
+            : {}),
+        ...(ethereumRpcUrlsResolved
+            ? { ethereumRpcUrl: ethereumRpcUrlsResolved[0], ethereumRpcUrls: ethereumRpcUrlsResolved }
+            : {}),
+        ...(ethereumArchiveRpcUrlsResolved
+            ? {
+                ethereumArchiveRpcUrl: ethereumArchiveRpcUrlsResolved[0],
+                ethereumArchiveRpcUrls: ethereumArchiveRpcUrlsResolved,
+            }
+            : {}),
         // parseTask assigns a UUID to any entry missing an id
         tasks: parsed.tasks.map(parseTask),
         engine: {
@@ -907,6 +1107,7 @@ const TRACKED_ENV_VARS = [
     'JINN_DB_PATH',
     'JINN_POLL_INTERVAL_MS',
     'JINN_REWARD_CLAIM_INTERVAL_MS',
+    'JINN_CHECKPOINT_INTERVAL_MS',
     'JINN_BALANCE_TOPUP_INTERVAL_MS',
     'JINN_API_PORT',
     'JINN_API_BIND_HOST',
@@ -937,6 +1138,8 @@ const TRACKED_ENV_VARS = [
     'JINN_CLAIM_EMITTER_ADDRESS',
     'JINN_MESSENGER_ADDRESS',
     'JINN_MESSENGER_MODE',
+    'JINN_CLAIM_SUBMISSION_MODE',
+    'JINN_CLAIM_LOOP_ENABLED',
     'JINN_CLAIM_LOOP_INTERVAL_MS',
     'JINN_STAKING_MODE',
     'JINN_TARGET_SERVICES',
@@ -961,6 +1164,7 @@ const TRACKED_ENV_VARS = [
     'JINN_CAPTURES_LLM_PROXY_ENABLED',
     'JINN_CAPTURES_LLM_PROXY_PORT',
     'JINN_BUILD_COMMIT',
+    'JINN_SPEND_CAP_USD',
 ];
 /**
  * Build a structured provenance block describing how the config was resolved.