@jinn-network/client 0.1.8 → 0.1.9-canary.023faefb

package/dist/main.js

@@ -24,7 +24,7 @@ import { homedir, hostname, userInfo } from 'node:os';
 import { randomBytes as cryptoRandomBytes } from 'node:crypto';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { loadConfig, getConfigPathFromArgs, DEFAULT_CONFIG_PATH } from './config.js';
+import { loadConfig, getConfigPathFromArgs, DEFAULT_CONFIG_PATH, DEFAULT_TESTNET_RPC_URLS } from './config.js';
 import { Store } from './store/store.js';
 import { startApiServer, isEmbeddedAgentEnabled } from './api/server.js';
 import { setDefaultTxSubmissionLedger } from './tx-retry.js';
@@ -34,33 +34,37 @@ import { CapturePublishUnavailableError } from './api/captures.js';
 import { invalidatePredictionOperatorStatusCache } from './api/gather-status.js';
 import { ensureUiToken } from './api/ui-token.js';
 import { getFileLogger, closeFileLogger } from './observability/file-logger.js';
+import { emitProgress } from './observability/progress.js';
 import { hashImplStateDir } from './harnesses/freeze.js';
 import { readModeState } from './harnesses/mode-state.js';
 import { attachAgentWs, updateAgentClaudePath } from './agent/agent-ws.js';
 import { createSetupModeController } from './setup-mode.js';
 import { requestDaemonRestart } from './restart-daemon.js';
-import { buildEnvelope, emitEnvelope } from './errors/envelope.js';
-import { clearBootstrapError, persistBootstrapError, } from './errors/persisted-bootstrap-error.js';
+import { emitEnvelope } from './errors/envelope.js';
 import { emitStructured } from './events/emitter.js';
 import { applyPidfileLivenessGate } from './preflight/pidfile-liveness.js';
+import { applyDeploymentReadinessGate } from './preflight/deployment-readiness.js';
+import { ensureStableCwd } from './preflight/stable-cwd.js';
+import { detectAuthContext } from './preflight/claude-auth.js';
 import { FleetBootstrapper, recoverEvictedService as recoverEvictedServiceFn } from './earning/bootstrap.js';
-import { DEFAULT_TESTNET_ARTIFACTS, applyChainGasOverrides, getChainConfig, loadJinnMviConfig } from './earning/contracts.js';
-import { runLegacyAgentIdMigration } from './earning/migrate-agent-id.js';
+import { runFleetBootstrap, SetupBootstrapHalted } from './earning/bootstrap-run.js';
+import { applyChainGasOverrides, getChainConfig } from './earning/contracts.js';
+import { getJinnRouterAddress } from './contracts/addresses.js';
 import { FleetStateStore } from './earning/store.js';
-import { isOperationalServiceStep, } from './earning/types.js';
-import { decryptMnemonic, deriveMasterSigner, walletPrivateKeyAtIndex } from './earning/wallet.js';
+import { isOperationalServiceStep } from './earning/types.js';
+import { decryptMnemonic, deriveMasterSigner } from './earning/wallet.js';
 import { MechAdapter } from './adapters/mech/adapter.js';
 import { ClaudeRunner } from './runner/claude.js';
 import { Daemon } from './daemon/daemon.js';
 import { buildSpendCapConfig } from './spend/daemon-config.js';
 import { buildAiUnitsConfig } from './spend/ai-units-config.js';
 import { REFERENCE_CEILING } from './spend/ai-units.js';
-import { buildJinnClaimLoopConfig, shouldWireJinnClaimL1Signer, } from './daemon/jinn-claim-loop-wiring.js';
-import { createJinnPublicClient, createJinnWalletClient, createJinnL1PublicClient, createJinnL1WalletClient } from './earning/viem-clients.js';
+import { createJinnPublicClient, createJinnWalletClient } from './earning/viem-clients.js';
 import { privateKeyToAccount } from 'viem/accounts';
 import { getAddress } from 'viem';
 import { DEFAULT_DISABLED_HARNESSES, DEFAULT_HARNESS, HarnessRegistry, } from './harnesses/engine/registry.js';
-import { joinedSolverNetsViewFromConfig } from './harnesses/engine/engine.js';
+import { createMutableJoinedSolverNetsView } from './harnesses/engine/engine.js';
+import { createJoinApplier } from './daemon/join-applier.js';
 import { buildHarnesses } from './harnesses/impls/index.js';
 import { loadExternalImpl } from './harnesses/external-impls/index.js';
 import { CLAUDE_CODE_HARNESS, CODEX_HARNESS, HERMES_AGENT_HARNESS, harnessStateDirName } from './harnesses/names.js';
@@ -72,17 +76,16 @@ import { createCorpus } from './corpus/index.js';
 import { DEFAULT_EXECUTION_DISCOVERY_FROM_BLOCK } from './corpus/onchain-query.js';
 import { CapturesStore } from './store/captures.js';
 import { createLiveCapturePublisher } from './captures/live-publisher.js';
+import { EnsurePendingCaptureProcessor, ensurePendingCapture, ingestStopHookCapture } from './captures/ingest.js';
 import { startReceiver } from './trajectory/receiver.js';
 import { startSyntheticSpanProvider, emitSyntheticSpan } from './trajectory/synthetic-span-builder.js';
 import { CredentialScrubProcessor } from './trajectory/processors/credential-scrub.js';
 import { TranscriptContentScrubProcessor } from './trajectory/processors/transcript-content-scrub.js';
 import { IdentityScrubProcessor } from './trajectory/processors/identity-scrub.js';
 import { PathScrubProcessor } from './trajectory/processors/path-scrub.js';
+import { buildScrubPipeline } from './trajectory/scrub/build.js';
+import { maybeBuildPiiDetector } from './trajectory/scrub/pii-build.js';
 import { SqliteExporterProcessor } from './trajectory/processors/sqlite-exporter.js';
-import { ClaudeCodeJsonlParser } from './trajectory/transcript-parsers/claude-code-jsonl.js';
-import { CodexSessionParser } from './trajectory/transcript-parsers/codex-session.js';
-import { GeminiSessionParser } from './trajectory/transcript-parsers/gemini-session.js';
-import { CursorSqliteParser } from './trajectory/transcript-parsers/cursor-sqlite.js';
 import { startTranscriptWatcher, } from './trajectory/transcript-watcher.js';
 import { defaultTranscriptWatchDirectories } from './trajectory/transcript-session-dirs.js';
 import { buildInfo } from './build-info.js';
@@ -91,7 +94,6 @@ import { GeneratedTaskSource, StaticConfiguredTaskSource, filterBindableTasks }
 import { checkRpcNetwork, logRpcLocalDevToStderr, probeFallbackChain, rpcNetworkFailureHint, summarizeFallbackChain, } from './preflight/rpc-network.js';
 import { apiPortFailureMessage, checkApiPortAvailable } from './preflight/api-port.js';
 import { openBrowser } from './cli/open-browser.js';
-import { keepSetupUiOnBootstrapError } from './setup/halt-mode.js';
 if (process.env['JINN_LOAD_DEV_ENV'] === '1' || process.env['NODE_ENV'] === 'development') {
     dotenvConfig({ path: join(dirname(fileURLToPath(import.meta.url)), '..', '.env') });
 }
@@ -161,6 +163,11 @@ let activeClaudePath = config.claudePath ?? 'claude';
 const selectClaudePath = (claudePath) => {
     activeClaudePath = claudePath;
     config.claudePath = claudePath;
+    // Harmless no-op when the embedded agent is disabled
+    // (`embeddedAgentEnabled` is false at this point): the agent surface
+    // that consumes this path isn't mounted, so the update has nothing to
+    // propagate to. Called unconditionally to keep the path in sync
+    // whenever the agent IS enabled.
     updateAgentClaudePath(claudePath);
 };
 const NETWORK_CHAIN = config.network === 'testnet' ? 'base-sepolia' : 'base';
@@ -173,21 +180,18 @@ const CHAIN_CONFIG = applyChainGasOverrides(getChainConfig(NETWORK_CHAIN, {
     minEoaGasWei: config.minEoaGasWei,
     minSafeEthWei: config.minSafeEthWei,
 });
-const MESSENGER_MODE_EXPLICIT = process.env['JINN_MESSENGER_MODE'] !== undefined ||
-    configFileHasTopLevelKey(CONFIG_PATH, 'jinnMessengerMode');
-const JINN_MVI_CONFIG = loadJinnMviConfig({
-    l1ArtifactPath: config.jinnMviL1DeploymentPath ??
-        (config.network === 'testnet' ? DEFAULT_TESTNET_ARTIFACTS.jinnMviL1 : undefined),
-    l2ArtifactPath: config.jinnMviL2DeploymentPath ??
-        (config.network === 'testnet' ? DEFAULT_TESTNET_ARTIFACTS.jinnMviL2 : undefined),
-    distributorAddress: config.jinnDistributorAddress,
-    messengerAddress: config.jinnMessengerAddress,
-    claimEmitterAddress: config.jinnClaimEmitterAddress,
-    messengerMode: MESSENGER_MODE_EXPLICIT ? config.jinnMessengerMode : undefined,
-});
-const JINN_CLAIM_MESSENGER_MODE = JINN_MVI_CONFIG.messengerMode ?? config.jinnMessengerMode;
 const MARKETPLACE_ADDRESS = CHAIN_CONFIG.mechMarketplace;
-const ROUTER_ADDRESS = (CHAIN_CONFIG.jinnRouter ?? '0xfFa7118A3D820cd4E820010837D65FAfF463181B');
+const ROUTER_ADDRESS = (CHAIN_CONFIG.jinnRouter ?? getJinnRouterAddress(CHAIN_CONFIG.chainId));
+/** #913: the bundled public RPC fallback chain for the current network. The
+ *  setup/network endpoint persists `[primary, ...RPC_PUBLIC_DEFAULTS]` so the
+ *  operator keeps the public backup chain when they set a primary, and the
+ *  Settings → Network UI renders these as the trailing read-only slots. */
+const RPC_PUBLIC_DEFAULTS = NETWORK_CHAIN === 'base-sepolia' ? DEFAULT_TESTNET_RPC_URLS : [CHAIN_CONFIG.rpcUrl];
+/** #913: last L2 boot-probe result per RPC slot. Captured at boot, surfaced
+ *  via /v1/bootstrap so Settings → Network can render per-slot health. Hosts
+ *  are already masked by probeFallbackChain. The RPC chain is restart-required,
+ *  so this never drifts without a re-probing restart. */
+let lastL2Probe = [];
 function configFileHasTopLevelKey(configPath, key) {
     const filePath = configPath ?? join(process.env['HOME'] ?? '', '.jinn-client', 'config.json');
     if (!filePath || !existsSync(filePath))
@@ -200,455 +204,17 @@ function configFileHasTopLevelKey(configPath, key) {
         return false;
     }
 }
-class EnsurePendingCaptureProcessor {
-    captures;
-    constructor(captures) {
-        this.captures = captures;
-    }
-    forceFlush() { return Promise.resolve(); }
-    shutdown() { return Promise.resolve(); }
-    onStart() { }
-    onEnd(span) {
-        const sessionId = stringAttribute(span.attributes['jinn.session.id']);
-        if (!sessionId)
-            return;
-        ensurePendingCapture(this.captures, {
-            sessionId,
-            capturedAt: hrTimeToIso(span.startTime),
-            tool: inferCaptureTool(span),
-            capturePath: inferCapturePath(span),
-            ...repoMetadataFromSpan(span),
-        });
-    }
-}
-function stringAttribute(value) {
-    return typeof value === 'string' && value.trim() !== '' ? value : undefined;
-}
-function hrTimeToIso(time) {
-    const millis = (time[0] * 1000) + Math.floor(time[1] / 1_000_000);
-    return new Date(millis).toISOString();
-}
-function inferCaptureTool(span) {
-    return stringAttribute(span.attributes['transcript.tool'])
-        ?? stringAttribute(span.resource.attributes['service.name'])
-        ?? 'otel';
-}
-function inferCapturePath(span) {
-    if (stringAttribute(span.attributes['transcript.tool']))
-        return 'B';
-    return 'A';
-}
-function repoMetadataFromSpan(span) {
-    const attrs = span.attributes;
-    const repoRemoteUrl = stringAttribute(attrs['repo.remote_url'])
-        ?? stringAttribute(attrs['vcs.repository.url'])
-        ?? stringAttribute(attrs['git.remote_url']);
-    const repoCommitHash = stringAttribute(attrs['repo.commit_hash'])
-        ?? stringAttribute(attrs['vcs.ref.head.revision'])
-        ?? stringAttribute(attrs['git.commit']);
-    return {
-        ...(repoRemoteUrl ? { repoRemoteUrl } : {}),
-        ...(repoCommitHash ? { repoCommitHash } : {}),
-    };
-}
-function parserForStopHookTool(tool) {
-    switch (tool) {
-        case 'claude-code':
-            return new ClaudeCodeJsonlParser();
-        case 'codex':
-            return new CodexSessionParser();
-        case 'gemini-cli':
-            return new GeminiSessionParser();
-        case 'cursor':
-            return new CursorSqliteParser();
-        default: {
-            const exhaustive = tool;
-            throw new Error(`No transcript parser for stop-hook tool: ${String(exhaustive)}`);
-        }
-    }
-}
-function ensurePendingCapture(captures, params) {
-    if (captures.getBySession(params.sessionId))
-        return;
-    try {
-        captures.savePending({
-            sessionId: params.sessionId,
-            capturedAt: params.capturedAt,
-            originatingTool: { name: params.tool },
-            capturePath: params.capturePath,
-            status: 'pending',
-            spanCount: 0,
-            durationMs: 0,
-            redactedSpanCount: 0,
-            ...(params.repoRemoteUrl ? { repoRemoteUrl: params.repoRemoteUrl } : {}),
-            ...(params.repoCommitHash ? { repoCommitHash: params.repoCommitHash } : {}),
-        });
-    }
-    catch (err) {
-        if (!captures.getBySession(params.sessionId))
-            throw err;
-    }
-}
-async function ingestStopHookCapture(captures, receiver, payload) {
-    ensurePendingCapture(captures, {
-        sessionId: payload.sessionId,
-        capturedAt: payload.stoppedAt,
-        tool: payload.tool,
-        capturePath: 'D',
-    });
-    if (!payload.transcriptPath)
-        return;
-    if (!receiver) {
-        console.warn('[main] stop-hook capture received but OTLP receiver is unavailable; pending capture has no transcript spans.');
-        return;
-    }
-    const parser = parserForStopHookTool(payload.tool);
-    let events;
-    try {
-        events = await parser.parseFull({ sessionId: payload.sessionId, path: payload.transcriptPath });
-    }
-    catch (err) {
-        console.warn(`[main] stop-hook transcript import failed for ${payload.transcriptPath}: ` +
-            `${err instanceof Error ? err.message : String(err)}`);
-        return;
-    }
-    if (events.length === 0)
-        return;
-    const provider = startSyntheticSpanProvider({
-        otlpHttpEndpoint: `http://127.0.0.1:${receiver.httpPort}/v1/traces`,
-    });
-    try {
-        for (const event of events) {
-            emitSyntheticSpan(provider, { tool: parser.tool, sessionId: payload.sessionId, event });
-        }
-        await provider.flush();
-    }
-    finally {
-        await provider.shutdown();
-    }
-}
-const STANDARD_SERVICE_PROGRESSION = [
-    'awaiting_stake',
-    'staked',
-    'mech_deployed',
-    'agent_registered',
-    'safe_binding_pending',
-    'complete',
-];
-const SELF_BOND_SERVICE_PROGRESSION = [
-    'awaiting_stake',
-    'service_created',
-    'service_activated',
-    'agents_registered',
-    'service_deployed',
-    'service_staked',
-    'mech_deployed',
-    'agent_registered',
-    'safe_binding_pending',
-    'complete',
-];
-/** §6.2 `bootstrap_incomplete` — `{ currentStep, nextStep }` from persisted fleet state. */
-function bootstrapIncompleteSteps(state) {
-    const progression = state.staking_mode === 'self-bond'
-        ? SELF_BOND_SERVICE_PROGRESSION
-        : STANDARD_SERVICE_PROGRESSION;
-    const byIndex = [...state.services].sort((a, b) => a.index - b.index);
-    const focus = byIndex.find(s => isOperationalServiceStep(s.step) && !s.safe_address) ??
-        byIndex.find(s => !isOperationalServiceStep(s.step)) ??
-        byIndex.find(s => s.step === 'safe_binding_pending') ??
-        byIndex[0];
-    if (!focus) {
-        return { currentStep: 'awaiting_service', nextStep: 'awaiting_stake' };
-    }
-    if (isOperationalServiceStep(focus.step) && !focus.safe_address) {
-        return { currentStep: 'complete', nextStep: 'bootstrap' };
-    }
-    const i = progression.indexOf(focus.step);
-    if (i === -1) {
-        return { currentStep: focus.step, nextStep: 'bootstrap' };
-    }
-    if (i < progression.length - 1) {
-        return { currentStep: focus.step, nextStep: progression[i + 1] };
-    }
-    return { currentStep: focus.step, nextStep: 'bootstrap' };
-}
-// ── Bootstrap ───────────────────────────────────────────────────────────────
-async function bootstrap() {
-    console.log('[main] Running fleet bootstrap...');
-    // A fresh bootstrap attempt clears any stale error breadcrumb. If this run
-    // hits the same failure, it'll be re-persisted below; if it succeeds (or
-    // proceeds past the previously-failed step), the panel returns to a clean
-    // state on the next /v1/bootstrap poll.
-    clearBootstrapError(config.earningDir);
-    // Persist the envelope to disk before emitEnvelope's process.exit fires,
-    // so /v1/bootstrap can surface it to the panel after the daemon has
-    // exited (operator restart → panel reload → error visible).
-    function failBootstrap(input) {
-        const envelope = buildEnvelope(input);
-        persistBootstrapError(envelope, config.earningDir);
-        if (keepSetupUiOnBootstrapError()) {
-            emitStructured({
-                kind: 'error',
-                message: envelope.message,
-                errorCode: envelope.code,
-                details: {
-                    phase: 'bootstrap',
-                    exitCode: envelope.exitCode,
-                    ...(envelope.details ?? {}),
-                },
-            });
-            console.error(`[main] Bootstrap halted (${envelope.code}); setup UI remains available. ` +
-                `Resolve the issue and run jinn run again.`);
-            throw new SetupBootstrapHalted(envelope);
-        }
-        emitEnvelope(input);
-        // Unreachable in production (emitEnvelope exits); satisfies `never`.
-        throw new Error('unreachable');
-    }
-    const bootstrapper = new FleetBootstrapper({
-        earningDir: config.earningDir,
-        chain: NETWORK_CHAIN,
-        rpcUrl: config.rpcUrl,
-        stakingMode: config.stakingMode,
-        targetServices: config.targetServices,
-        testnetL2DeploymentPath: config.testnetL2DeploymentPath,
-        testnetL2TokenDeploymentPath: config.testnetL2TokenDeploymentPath,
-        testnetMechDeploymentPath: config.testnetMechDeploymentPath,
-        testnetStolasDeploymentPath: config.testnetStolasDeploymentPath,
-        debug: config.debug,
-        masterEthDailyEstimateWei: config.masterEthDailyEstimateWei,
-        minEoaGasWei: config.minEoaGasWei,
-        minSafeEthWei: config.minSafeEthWei,
-        pollIntervalMs: config.pollIntervalMs,
-        autoTestnetFaucet: process.env['JINN_AUTO_TESTNET_FAUCET'] === '1',
-    });
-    // Funding poll: stay up while waiting for the operator to fund the wallet.
-    // The setup-mode API server is already running; the panel renders the
-    // funding card and auto-advances when funds land. Daemon-side, we poll
-    // bootstrap on a 15s tick and only escalate (exit) if a non-funding error
-    // occurs or the configured timeout elapses. Each tick re-runs the full
-    // bootstrap state machine — completed steps are no-ops, so this is safe.
-    // Testnet faucet funding is panel-driven: bootstrap reports the funding gate,
-    // and the operator clicks the funding action before this loop can advance.
-    const FUNDING_POLL_INTERVAL_MS = 15_000;
-    const fundingTimeoutMs = (() => {
-        const raw = process.env['JINN_FUNDING_TIMEOUT_MS'];
-        if (!raw)
-            return Number.POSITIVE_INFINITY;
-        const n = Number.parseInt(raw, 10);
-        return Number.isFinite(n) && n > 0 ? n : Number.POSITIVE_INFINITY;
-    })();
-    emitProgress({
-        type: 'progress',
-        phase: 'bootstrap',
-        step: 'advance_state_machine',
-        estimatedWaitMs: 60_000,
-    });
-    const fundingStartedAt = Date.now();
-    let result;
-    let lastFundingMessage = '';
-    const fundingGatePath = join(config.earningDir, 'bootstrap-funding.json');
-    const persistFundingGate = (funding) => {
-        mkdirSync(config.earningDir, { recursive: true, mode: 0o700 });
-        writeFileSyncMain(fundingGatePath, `${JSON.stringify({
-            schemaVersion: 1,
-            generatedAt: new Date().toISOString(),
-            ...funding,
-        }, null, 2)}\n`, { mode: 0o600 });
-    };
-    const clearFundingGate = () => {
-        try {
-            unlinkSync(fundingGatePath);
-        }
-        catch {
-            // best-effort: absent/stale funding gate should not affect bootstrap
-        }
-    };
-    // eslint-disable-next-line no-constant-condition
-    while (true) {
-        result = await bootstrapper.ensureStage1And2(PASSWORD);
-        if (!result.funding) {
-            clearFundingGate();
-            break;
-        }
-        persistFundingGate(result.funding);
-        // Emit a structured event so the panel's Visibility region shows the gate.
-        // Dedupe by message to avoid spamming the ring buffer on each poll.
-        const fundingMsg = result.message ?? 'awaiting funding';
-        if (fundingMsg !== lastFundingMessage) {
-            emitStructured({
-                kind: 'fleet',
-                message: fundingMsg,
-                details: {
-                    phase: 'awaiting_funding',
-                    role: 'master',
-                    address: result.funding.master_address,
-                    asset: 'native',
-                    needWei: result.funding.eth_required,
-                    haveWei: result.funding.eth_balance,
-                },
-            });
-            // Mirror the structured event to NDJSON progress for --json-progress
-            // consumers (CI, agents). Same dedup gate so we don't spam stdout.
-            emitProgress({
-                type: 'progress',
-                phase: 'bootstrap',
-                step: 'awaiting_funding',
-                blocking: true,
-                nextAction: 'Fund the address shown in addresses.fundingAddress, then wait for automatic retry.',
-                addresses: { fundingAddress: result.funding.master_address },
-                estimatedWaitMs: 1_800_000,
-            });
-            lastFundingMessage = fundingMsg;
-        }
-        const elapsed = Date.now() - fundingStartedAt;
-        if (elapsed >= fundingTimeoutMs) {
-            failBootstrap({
-                code: 'funding_required',
-                message: `${result.message} (timeout after ${Math.round(elapsed / 1000)}s)`,
-                hint: 'Fund the listed address and re-run this command.',
-                exampleCli: 'jinn fund-requirements --json',
-                details: {
-                    // jinn-mono-hjex.6: structured envelope so SPA can render the
-                    // specific address + amount instead of a prose disjunction.
-                    category: 'insufficient_funds',
-                    step: 'awaiting_funding',
-                    address: result.funding.master_address,
-                    requiredWei: result.funding.eth_required,
-                    haveWei: result.funding.eth_balance,
-                    // Legacy aliases kept for any external consumers that read these.
-                    role: 'master',
-                    asset: 'native',
-                    needWei: result.funding.eth_required,
-                },
-            });
-        }
-        console.log(`[main] Awaiting funding... (${Math.round(elapsed / 1000)}s elapsed; ` +
-            `will retry in ${FUNDING_POLL_INTERVAL_MS / 1000}s)`);
-        await new Promise((r) => setTimeout(r, FUNDING_POLL_INTERVAL_MS));
-    }
-    if (!result.ok) {
-        failBootstrap({
-            code: 'fatal',
-            message: result.message,
-            hint: 'Bootstrap failed before the fleet reached a runnable state.',
-            details: {
-                cause: result.message,
-                // jinn-mono-hjex.6: propagate structured category from the bootstrapper
-                // so the SPA can render category-specific UI (e.g. funding shortfall).
-                ...(result.errorCategory !== undefined ? { category: result.errorCategory } : {}),
-                // Preserve the raw underlying error so a misclassified summary can
-                // be diagnosed without re-running with JINN_DEBUG. See jinn-mono-jz9f.
-                ...(result.rawErrorMessage && result.rawErrorMessage !== result.message
-                    ? { rawErrorMessage: result.rawErrorMessage }
-                    : {}),
-                // jinn-mono-hjex reviewer fix: propagate tx hash so the SPA can render
-                // a block-explorer link for failed on-chain revert transactions.
-                ...(result.txHash != null ? { txHash: result.txHash } : {}),
-            },
-        });
-    }
-    // Legacy migration (jinn-mono-jgp): backfill `agent_id` on `complete`
-    // services that pre-date j07. Idempotent + per-service failure-isolated;
-    // a failure here does not abort daemon startup, but we surface counts so
-    // operators notice. Disabled via `runLegacyMigrations: false` /
-    // JINN_RUN_LEGACY_MIGRATIONS=0 — operators can run `jinn migrate-agent-id`
-    // explicitly instead.
-    let state = result.fleet_state;
-    if (config.runLegacyMigrations) {
-        try {
-            const migration = await runLegacyAgentIdMigration({
-                earningDir: config.earningDir,
-                network: NETWORK_CHAIN,
-                rpcUrl: config.rpcUrl,
-                password: PASSWORD,
-                testnetL2DeploymentPath: config.testnetL2DeploymentPath,
-                testnetL2TokenDeploymentPath: config.testnetL2TokenDeploymentPath,
-                testnetMechDeploymentPath: config.testnetMechDeploymentPath,
-                testnetStolasDeploymentPath: config.testnetStolasDeploymentPath,
-            });
-            if (migration.migrated.length > 0 || migration.failed.length > 0) {
-                console.log(`[main] Legacy agent_id migration: migrated=${migration.migrated.length} ` +
-                    `skipped=${migration.skipped.length} failed=${migration.failed.length}`);
-                for (const f of migration.failed) {
-                    console.log(`[main]   service ${f.service.index} (agent ${f.service.agent_address}): ${f.error}`);
-                }
-                // Reload state so downstream wiring (agent_id, identityRegistry)
-                // sees the migrated rows.
-                state = await new FleetStateStore(config.earningDir).load(NETWORK_CHAIN);
-            }
-        }
-        catch (err) {
-            const message = err instanceof Error ? err.message : String(err);
-            console.error(`[main] Legacy agent_id migration failed (non-fatal): ${message}`);
-        }
-    }
-    // Use the first operational service for the daemon. `safe_binding_pending`
-    // means staking/mech are live; only the ERC-8004 Safe→agent metadata bind
-    // is still retrying.
-    const firstComplete = state.services.find(s => isOperationalServiceStep(s.step));
-    if (!firstComplete || !firstComplete.safe_address) {
-        failBootstrap({
-            code: 'bootstrap_incomplete',
-            message: 'Bootstrap completed but no service is ready.',
-            hint: 'Re-run to continue the state machine toward a running fleet.',
-            exampleCli: 'jinn bootstrap --json',
-            details: bootstrapIncompleteSteps(state),
-        });
-    }
-    // Derive agent private key from mnemonic
-    const store = new FleetStateStore(config.earningDir);
-    const mnemonic = await decryptMnemonic(await store.loadMnemonicKeystore(), PASSWORD);
-    const agentPrivateKey = walletPrivateKeyAtIndex(mnemonic, firstComplete.index);
-    console.log(`[main] Fleet bootstrap complete.`);
-    console.log(`  Master:  ${state.master_address}`);
-    console.log(`  Services: ${state.services.filter(s => isOperationalServiceStep(s.step)).length}/${config.targetServices}`);
-    console.log(`  Active:  service ${firstComplete.service_id} (agent ${firstComplete.agent_address})`);
-    if (firstComplete.mech_address) {
-        console.log(`  Mech:    ${firstComplete.mech_address}`);
-    }
-    return {
-        masterAddress: state.master_address,
-        serviceIndex: firstComplete.index,
-        serviceId: firstComplete.service_id ?? null,
-        stakingAddress: firstComplete.staking_address ? firstComplete.staking_address : null,
-        agentPrivateKey: agentPrivateKey,
-        safeAddress: firstComplete.safe_address,
-        mechAddress: firstComplete.mech_address ? firstComplete.mech_address : undefined,
-        agentId: firstComplete.agent_id ?? null,
-        identityRegistryAddress: firstComplete.identity_registry_address
-            ? firstComplete.identity_registry_address
-            : null,
-    };
-}
-class SetupBootstrapHalted extends Error {
-    envelope;
-    constructor(envelope) {
-        super(envelope.message);
-        this.envelope = envelope;
-        this.name = 'SetupBootstrapHalted';
-    }
-}
 // hjex.6: gate for the halt-and-resume loop. Lives in ./setup/halt-mode.ts
 // so it can be unit-tested without dragging main.ts's top-level side
 // effects (password resolution, config load) into the test.
 // ── Main ────────────────────────────────────────────────────────────────────
-/**
- * --json-progress: emit NDJSON progress envelopes on stdout during long
- * phases (init, bootstrap, daemon startup). The `jinn run --json-progress`
- * flag flips JINN_JSON_PROGRESS=1 in run.ts before calling main(); when
- * unset this is a no-op so tests / non-flag invocations stay silent on
- * stdout.
- */
-function progressEnabled() {
-    return process.env['JINN_JSON_PROGRESS'] === '1';
-}
-function emitProgress(envelope) {
-    if (progressEnabled()) {
-        process.stdout.write(JSON.stringify(envelope) + '\n');
-    }
-}
 export async function main() {
+    // Issue #909: chdir to a stable directory before spawning any child process.
+    // `jinn run` inherits the launch shell's CWD; when daemonised from an
+    // ephemeral dir that is later deleted, the CWD becomes a dangling inode and
+    // child processes (the `claude` CLI harness probe) crash on getcwd() ENOENT.
+    // Must run first — before getFileLogger() and any subprocess spawn.
+    ensureStableCwd({ earningDir: config.earningDir });
     console.log(`[main] jinn-client starting on ${NETWORK_CHAIN}`);
     // Issue #420: initialise the rotating daemon file logger early so lifecycle
     // events (tapped in `observability/emit-event.ts`) accumulate durable,
@@ -698,12 +264,8 @@ export async function main() {
     // Boot-time RPC fallback-chain probe (issue #592, AC7 + AC9). Log-only —
     // per-slot 429s/5xx never gate startup. checkRpcNetwork above already
     // fail-loud on chain-id mismatch against the head provider.
-    await probeFallbackChain(config.rpcUrls, config.network, 'L2');
+    lastL2Probe = await probeFallbackChain(config.rpcUrls, config.network, 'L2');
     console.error(summarizeFallbackChain('L2', config.rpcUrls));
-    if (config.jinnClaimLoopEnabled && config.ethereumRpcUrls) {
-        await probeFallbackChain(config.ethereumRpcUrls, config.network, 'L1');
-        console.error(summarizeFallbackChain('L1', config.ethereumRpcUrls));
-    }
     const portPreflight = await checkApiPortAvailable(config.apiPort);
     if (!portPreflight.ok) {
         emitEnvelope({
@@ -858,6 +420,13 @@ export async function main() {
     // builder-artifacts. Holder ref lets the routes register eagerly and
     // start returning real data the moment main.ts assigns holder.current.
     const discoveryApiHolder = { current: undefined };
+    // #1037: same eager-register / late-populate pattern for the join applier.
+    // The join endpoint registers eagerly inside startApiServer; the applier is
+    // built only after the latest join-consuming subsystem (the engine view,
+    // wired in the Daemon ctor). The endpoint tolerates an empty holder in the
+    // gap between server-start and populate by falling back to
+    // restartRequired:true.
+    const joinApplierHolder = { current: undefined };
     // hjex.6: retry signal for the bootstrap halt-and-resume loop.
     // When a SetupBootstrapHalted is caught (fatal non-funding error or funding
     // timeout), main() waits on this promise instead of returning, so the setup
@@ -963,7 +532,27 @@ export async function main() {
                 configReader: () => ({
                     rpcUrl: config.rpcUrl,
                     defaultRpcUrl: CHAIN_CONFIG.rpcUrl,
+                    rpcUrls: config.rpcUrls,
+                    publicDefaults: RPC_PUBLIC_DEFAULTS,
+                    rpcSlotHealth: lastL2Probe.map((p) => p.ok
+                        ? {
+                            ok: true,
+                            host: p.host,
+                            latencyMs: p.latencyMs,
+                            expectedChainId: p.expectedChainId,
+                            actualChainId: p.actualChainId,
+                            ...(p.localDev ? { localDev: true } : {}),
+                        }
+                        : {
+                            ok: false,
+                            host: p.host,
+                            code: p.code,
+                            reason: p.reason,
+                            expectedChainId: p.expectedChainId,
+                            actualChainId: p.actualChainId,
+                        }),
                     joinedSolverNets: config.joinedSolverNets,
+                    onboardingComplete: config.onboardingComplete,
                 }),
             },
             // SolverNet catalog. Stubbed to the bundled `prediction` net for v1.
@@ -1080,10 +669,15 @@ export async function main() {
                 // targetServices DOES need to flow through so the faucet drips enough
                 // ETH to cover ALL services for the operator's chosen targetServices.
                 targetServices: config.targetServices,
+                // Issue #560: batched daily-cap top-up knobs — single source of truth
+                // in JinnConfig, surfaced to the SPA via GET /v1/setup/drip/quota.
+                faucetDailyTopupCap: config.faucetDailyTopupCap,
+                faucetTopupCooldownMs: config.faucetTopupCooldownMs,
                 claudePath: activeClaudePath,
                 getClaudePath: () => activeClaudePath,
                 configPath: CONFIG_PATH ?? DEFAULT_CONFIG_PATH,
                 defaultRpcUrlForChain: () => CHAIN_CONFIG.rpcUrl,
+                defaultRpcUrlsForChain: () => RPC_PUBLIC_DEFAULTS,
                 onClaudePathSelected: selectClaudePath,
                 // Issue #421 retired the legacy `solverNets` write target. Setup
                 // endpoints no longer call back into the daemon to mutate operator
@@ -1111,16 +705,21 @@ export async function main() {
                         resolve();
                     });
                 },
+                // #1037: hot-apply a join to the running daemon. Populated after the
+                // join-consuming subsystems are built (see joinApplierHolder). Empty
+                // until then → the endpoint returns restartRequired:true.
+                joinApplier: joinApplierHolder,
+                // #983: mutate the in-memory config so GET /v1/bootstrap reflects the
+                // completion flag live (the endpoint persists to disk; this keeps the
+                // configReader's in-memory read consistent — same pattern as the
+                // join-applier's config write). Cast: JinnConfig has the optional field.
+                markOnboardingComplete: () => {
+                    config.onboardingComplete = true;
+                },
             },
             status: {
                 earningDir: config.earningDir,
                 rpcUrl: config.rpcUrl,
-                // tJINN identity comes from the bundled JINN MVI L1 artifact
-                // (`JINN_MVI_CONFIG`) — one source of truth. The Sepolia RPC endpoint
-                // is read from `config.ethereumRpcUrl` via the threaded `config`.
-                tjinnTokenAddress: JINN_MVI_CONFIG.jinn,
-                tjinnChainId: JINN_MVI_CONFIG.l1ChainId,
-                tjinnDistributorAddress: JINN_MVI_CONFIG.distributor,
                 network: config.network,
                 pollIntervalMs: config.pollIntervalMs,
                 masterEthDailyEstimateWei: config.masterEthDailyEstimateWei,
@@ -1132,6 +731,10 @@ export async function main() {
                 engine: config.engine,
                 config,
                 configPath: CONFIG_PATH ?? DEFAULT_CONFIG_PATH,
+                passwordRotation: {
+                    source: passwordResolution.source,
+                    filePath: passwordResolution.filePath,
+                },
             },
             // Launcher mode (Tasks 6 + 7). Deps are resolved lazily because the
             // generator and Safe address are constructed after bootstrap, after
@@ -1224,6 +827,11 @@ export async function main() {
                         const rows = sharedStore.listPostedTasksByCreator(opts);
                         return rows.map((r) => ({
                             taskId: r.taskId,
+                            // On-chain decimal id (#579) — the launcher status chip keys its
+                            // indexer lookup on this, not the off-chain display taskId. Empty
+                            // string (no on-chain id recorded) maps to undefined so the
+                            // gatherer falls back to taskId.
+                            ...(r.protocolTaskId ? { protocolTaskId: r.protocolTaskId } : {}),
                             taskCid: r.taskCid,
                             solverType: r.solverType ?? undefined,
                             postedAt: r.postedAt,
@@ -1231,6 +839,16 @@ export async function main() {
                             ...(r.claims ? { claims: r.claims } : {}),
                         }));
                     },
+                    // #579: on-chain finalized/open/expired status for the Recent posted
+                    // Tasks chip. discoveryApiHolder is populated post-bootstrap; before
+                    // that (or with no discovery API) we return an empty Map → all chips
+                    // render 'unknown', the safe degraded default.
+                    fetchTaskStatuses: async (manifestCid) => {
+                        const api = discoveryApiHolder.current;
+                        if (!api)
+                            return new Map();
+                        return api.getTaskStatuses({ manifestCid });
+                    },
                 },
             },
         });
@@ -1354,7 +972,7 @@ export async function main() {
     // eslint-disable-next-line no-constant-condition
     while (true) {
         try {
-            bootstrapResult = await bootstrap();
+            bootstrapResult = await runFleetBootstrap({ config, password: PASSWORD, network: NETWORK_CHAIN, emitProgress });
             break; // success — exit the retry loop
         }
         catch (err) {
@@ -1547,6 +1165,28 @@ export async function main() {
     // the panel's next refetch. Before this, the routes 404'd forever and
     // the /build page rendered "Discovery unavailable" permanently.
     discoveryApiHolder.current = sharedDiscoveryApi;
+    // #1037: the live task-discovery descriptor. Always present with a mutable
+    // `solverNetManifestCids` array (`taskDiscoveryManifestCids` is a fresh
+    // `.map` result, safe to push onto). The join applier holds this same object
+    // reference and pushes a newly-joined cid onto it live.
+    const taskDiscovery = {
+        discoveryApi: sharedDiscoveryApi,
+        solverNetManifestCids: taskDiscoveryManifestCids,
+        // No explicit `onchainFromBlock` by default — let `MechAdapter`'s
+        // `DEFAULT_TASK_DISCOVERY_FROM_BLOCK` per-chain default flow through.
+        // Hardcoding here shadowed the adapter's default and re-introduced the
+        // ghost-task floor every release; removing the shadow makes `adapter.ts`
+        // the single source of truth. See gh #300. An operator MAY opt in to a
+        // recent floor via `taskDiscoveryOnchainFromBlock` to bound the canonical
+        // getLogs scan (which otherwise parses a large history on the main thread
+        // and can stall the loop) and lean on the indexer DiscoveryAPI.
+        ...(config.taskDiscoveryOnchainFromBlock !== undefined
+            ? { onchainFromBlock: config.taskDiscoveryOnchainFromBlock }
+            : {}),
+        ...(config.taskDiscoveryAllowedTaskIds?.length
+            ? { allowedTaskIds: config.taskDiscoveryAllowedTaskIds }
+            : {}),
+    };
     const adapter = new MechAdapter({
         rpcUrl: config.rpcUrls,
         mechMarketplaceAddress: MARKETPLACE_ADDRESS,
@@ -1560,27 +1200,7 @@ export async function main() {
         chainId: config.network === 'testnet' ? 84532 : 8453,
         routerClaimDeliveryVariant: CHAIN_CONFIG.routerClaimDeliveryVersion,
         evictionRecovery,
-        taskDiscovery: taskDiscoveryManifestCids.length > 0
-            ? {
-                discoveryApi: sharedDiscoveryApi,
-                solverNetManifestCids: taskDiscoveryManifestCids,
-                // No explicit `onchainFromBlock` by default — let `MechAdapter`'s
-                // `DEFAULT_TASK_DISCOVERY_FROM_BLOCK` per-chain default flow
-                // through. Hardcoding here shadowed the adapter's default and
-                // re-introduced the ghost-task floor every release; removing the
-                // shadow makes `adapter.ts` the single source of truth. See gh
-                // #300. An operator MAY opt in to a recent floor via
-                // `taskDiscoveryOnchainFromBlock` to bound the canonical getLogs
-                // scan (which otherwise parses a large history on the main thread
-                // and can stall the loop) and lean on the indexer DiscoveryAPI.
-                ...(config.taskDiscoveryOnchainFromBlock !== undefined
-                    ? { onchainFromBlock: config.taskDiscoveryOnchainFromBlock }
-                    : {}),
-                ...(config.taskDiscoveryAllowedTaskIds?.length
-                    ? { allowedTaskIds: config.taskDiscoveryAllowedTaskIds }
-                    : {}),
-            }
-            : undefined,
+        taskDiscovery,
     }, sharedStore);
     // ── TaskEngine wiring ─────────────────────────────────────────────────
     // Build agent viem clients (same creds as MechAdapter uses internally).
@@ -1588,57 +1208,7 @@ export async function main() {
     const agentChain = config.network === 'testnet'
         ? viemChains.baseSepolia
         : viemChains.base;
-    const l1Chain = config.jinnL1Network === 'sepolia' ? viemChains.sepolia : viemChains.mainnet;
-    const agentChainContracts = agentChain.contracts;
-    const optimismPortalAddress = agentChainContracts?.portal?.[l1Chain.id]?.address;
-    const disputeGameFactoryAddress = agentChainContracts?.disputeGameFactory?.[l1Chain.id]?.address;
-    const l2ProofClient = config.l2ProofRpcUrls
-        ? createJinnPublicClient(config.l2ProofRpcUrls, NETWORK_CHAIN)
-        : undefined;
     const agentClients = createClients(config.rpcUrls, agentPrivateKey, agentChain);
-    // ── L1 (Sepolia / Ethereum mainnet) clients for cross-chain JINN claim loop ──
-    // Uses the agent EOA because MockMessenger.owner is the agent on testnet.
-    // Same key as L2; only the chain differs.
-    const shouldWireJinnClaimL1 = shouldWireJinnClaimL1Signer({
-        enabled: config.jinnClaimLoopEnabled,
-        intervalMs: config.jinnClaimLoopIntervalMs,
-        submissionMode: config.jinnClaimSubmissionMode,
-        distributorAddress: JINN_MVI_CONFIG.distributor,
-        ethereumRpcUrl: config.ethereumRpcUrl,
-    });
-    const l1ClientsForJinnClaim = shouldWireJinnClaimL1 && config.ethereumRpcUrls
-        ? {
-            public: createJinnL1PublicClient(config.ethereumRpcUrls, config.jinnL1Network),
-            wallet: createJinnL1WalletClient(config.ethereumRpcUrls, config.jinnL1Network, privateKeyToAccount(agentPrivateKey)),
-        }
-        : undefined;
-    const jinnClaimLoopConfig = buildJinnClaimLoopConfig({
-        enabled: config.jinnClaimLoopEnabled,
-        intervalMs: config.jinnClaimLoopIntervalMs,
-        submissionMode: config.jinnClaimSubmissionMode,
-        messengerMode: JINN_CLAIM_MESSENGER_MODE,
-        mvi: JINN_MVI_CONFIG,
-        l2Client: agentClients.publicClient,
-        l2ProofClient,
-        l2Wallet: agentClients.walletClient,
-        l1Clients: l1ClientsForJinnClaim,
-        store: earningStore,
-        chain: NETWORK_CHAIN,
-        optimismPortalAddress,
-        disputeGameFactoryAddress,
-    });
-    if (jinnClaimLoopConfig) {
-        console.log(`[main] JinnClaimLoop: enabled (submission=${config.jinnClaimSubmissionMode}, ` +
-            `mode=${JINN_CLAIM_MESSENGER_MODE}, ` +
-            `interval=${config.jinnClaimLoopIntervalMs}ms, distributor=${JINN_MVI_CONFIG.distributor}, ` +
-            `emitter=${JINN_MVI_CONFIG.claimEmitter})`);
-    }
-    else if (!config.jinnClaimLoopEnabled) {
-        console.log('[main] JinnClaimLoop: disabled (jinnClaimLoopEnabled=false)');
-    }
-    else {
-        console.log(`[main] JinnClaimLoop: disabled (missing claim-loop artifacts, interval disabled, or L1 submit wiring)`);
-    }
     // ── Harness registry ─────────────────────────────────────────────────────────
     const solverNetRegistry = await loadSolverNets(config);
     for (const net of solverNetRegistry.list()) {
@@ -1729,6 +1299,7 @@ export async function main() {
         hermesPath: config.hermesPath,
         hermesModel: config.hermesModel,
         hermesProvider: config.hermesProvider,
+        hermesBaseUrl: config.hermesBaseUrl,
         hermesDoctorTimeoutMs: config.hermesDoctorTimeoutMs,
         codexPath: config.codexPath,
         codexDoctorTimeoutMs: config.codexDoctorTimeoutMs,
@@ -1762,6 +1333,13 @@ export async function main() {
     // is no longer needed and would throw on Hono's locked matcher.
     harnessReadinessRegistryHolder.current = harnessReadinessRegistry;
     console.log('[main] HarnessReadinessRegistry started; /v1/harnesses/readiness routes active.');
+    // #1037: always construct the engine eligibility view (mutable) so a
+    // hot-applied join can inject its cid live. Previously this was wired only
+    // when config.joinedSolverNets was truthy; a zero-join daemon then ran the
+    // legacy solverType gate. With an always-present empty view, a zero-join
+    // daemon rejects cid-bearing tasks (its discovery cid set is empty so it
+    // discovers none) and still passes legacy no-cid tasks. See plan §behaviour-change.
+    const joinedSolverNetsView = createMutableJoinedSolverNetsView(config.joinedSolverNets);
     // ── Engine deps ───────────────────────────────────────────────────────────────
     // Packaging deps: artifacts are always written to served_artifacts
     // (operator-local SQLite). In public-testnet donation mode, scrubbed artifact
@@ -1848,6 +1426,14 @@ export async function main() {
     else {
         console.log('[main] IdentityPublisher: disabled (no agent_id on active service — re-run bootstrap to mint the operator agent NFT)');
     }
+    // ── Seller-side scrub pipeline (publish-time) ─────────────────────────────
+    // One pipeline shared by the task engine and the live capture publisher so
+    // every published trajectory passes through the same maintained scrub stack
+    // (structural key policy → openredaction → secretlint/entropy → optional ML
+    // PII). The OTLP receiver above runs best-effort ingest-time scrubbers; this
+    // is the authoritative final gate before a trajectory becomes public/sellable.
+    const sellerPiiDetector = await maybeBuildPiiDetector(config.captures.piiDetection);
+    const sellerScrubPipeline = buildScrubPipeline(sellerPiiDetector ? { piiDetector: sellerPiiDetector } : {});
     const liveCapturePublisher = createLiveCapturePublisher({
         store: sharedStore,
         captures: capturesStore,
@@ -1860,6 +1446,7 @@ export async function main() {
         clientGitSha: buildInfo.clientGitSha,
         identityPublisher,
         harnessMode: config.harness.mode,
+        scrubPipeline: sellerScrubPipeline,
     });
     capturePublishRef.current = liveCapturePublisher.publishCapture;
     // ── Reputation feedback hook (jinn-mono-yg4) ──────────────────────────────
@@ -2070,6 +1657,7 @@ export async function main() {
                 agentEoa: agentEoaAddress,
                 safeAddress,
                 agentPrivateKey,
+                ipfsGatewayUrl: config.ipfsGatewayUrl,
                 ...(sharedDiscoveryApi ? { discoveryApi: sharedDiscoveryApi } : {}),
             },
             logger: {
@@ -2174,12 +1762,6 @@ export async function main() {
         status: {
             earningDir: config.earningDir,
             rpcUrl: config.rpcUrl,
-            // tJINN identity comes from the bundled JINN MVI L1 artifact
-            // (`JINN_MVI_CONFIG`) — one source of truth. The Sepolia RPC endpoint
-            // is read from `config.ethereumRpcUrl` via the threaded `config`.
-            tjinnTokenAddress: JINN_MVI_CONFIG.jinn,
-            tjinnChainId: JINN_MVI_CONFIG.l1ChainId,
-            tjinnDistributorAddress: JINN_MVI_CONFIG.distributor,
             // stOLAS L2 distributor — mirrors `CHAIN_CONFIG.distributorAddress`
             // used to gate the EvictionLoop (issue #651). Threaded through so the
             // SPA's autoRestake predicate keys off the same on-chain artifact as
@@ -2196,6 +1778,10 @@ export async function main() {
             engine: config.engine,
             config,
             configPath: CONFIG_PATH ?? DEFAULT_CONFIG_PATH,
+            passwordRotation: {
+                source: passwordResolution.source,
+                filePath: passwordResolution.filePath,
+            },
             spendCaps: spendCap?.caps,
             aiUnits,
         },
@@ -2209,7 +1795,6 @@ export async function main() {
                 distributorAddress: CHAIN_CONFIG.distributorAddress,
             }
             : undefined,
-        jinnClaim: jinnClaimLoopConfig,
         restorationEngine: {
             paths: {
                 workingDirRoot: config.engine.workingDirRoot,
@@ -2226,9 +1811,8 @@ export async function main() {
             // doesn't match a joined entry (plus a role gate). Absent when the
             // operator hasn't joined any nets yet — the engine then falls back to
             // the legacy solverType-keyed gate.
-            ...(config.joinedSolverNets
-                ? { joinedSolverNets: joinedSolverNetsViewFromConfig(config.joinedSolverNets) }
-                : {}),
+            // #1037: always wire the (mutable) view so a hot-applied join is live.
+            joinedSolverNets: joinedSolverNetsView,
             // Spec §14: task validation resolves manifest → contract → schemas.
             // Threaded only when the SolverNet registry client was constructed
             // (testnet branch above). The engine treats absence as "schema
@@ -2240,6 +1824,9 @@ export async function main() {
             reputationFeedback,
             operatorConfig,
             harnessMode: config.harness.mode,
+            // Share the one maintained scrub pipeline (incl. optional ML PII) so task
+            // trajectories and captures are scrubbed by the same stack before publish.
+            scrubPipeline: sellerScrubPipeline,
         },
         balanceTopup: config.balanceTopupIntervalMs > 0
             ? {
@@ -2262,6 +1849,7 @@ export async function main() {
             CHAIN_CONFIG.distributorAddress
             ? {
                 intervalMs: config.evictionCheckIntervalMs,
+                reStakeThrottleMs: config.checkpointIntervalMs,
                 store: earningStore,
                 chain: NETWORK_CHAIN,
                 readContract: (opts) => publicClient.readContract(opts),
@@ -2309,13 +1897,47 @@ export async function main() {
                 },
             }
             : undefined,
+        // #1043 loop watchdog. Always constructed in production so a stale loop is
+        // detected + surfaced; the process-exit recovery is flag-gated (default
+        // OFF) by config.watchdogAutoRestart.
+        watchdog: { autoRestart: config.watchdogAutoRestart },
+    });
+    // #1037: populate the join applier now that all four join-consuming
+    // subsystems exist — the live task-discovery descriptor (`taskDiscovery`),
+    // the mutable engine view (`joinedSolverNetsView`), the readiness registry,
+    // and the SolverNet registry. The join endpoint registered eagerly at
+    // server-start; before this point it returns restartRequired:true.
+    joinApplierHolder.current = createJoinApplier({
+        taskDiscovery,
+        view: joinedSolverNetsView,
+        readiness: harnessReadinessRegistry,
+        registry: solverNetRegistry,
+        config,
     });
+    if (config.watchdogAutoRestart) {
+        console.log('[watchdog] auto-restart ENABLED (stale loop → non-zero exit)');
+    }
     // Write pidfile so `jinn stop` can find us. First, refuse the run if another
     // daemon already owns this earning directory — see issue #649. The gate
     // handles all three branches (refuse-and-exit, unlink-stale-and-continue,
     // proceed); the writeFileSync below MUST stay outside the helper so the
     // "// DO NOT add store mutations above this line — see #649" invariant is
     // visible right here at the call site.
+    // Deployment-readiness gate (#958). In a deployment context (JINN_STATE_DIR
+    // set or a container/compose auth context) this fails loud and exits when a
+    // hard check fails (writable-volume, state-on-volume, agent-cli-non-root).
+    // Outside a deployment context it only logs advisories — a plain local
+    // `jinn run` is NEVER newly gated here. Runs before the pidfile gate so an
+    // unfit environment refuses before we touch the pidfile.
+    await applyDeploymentReadinessGate({
+        stateDir: config.stateDir,
+        earningDir: config.earningDir,
+        runtimeMode: config.runtimeMode,
+    }, {
+        env: process.env,
+        getuid: typeof process.getuid === 'function' ? process.getuid.bind(process) : undefined,
+        detectAuthContext,
+    });
     const pidPath = join(config.earningDir, 'daemon.pid');
     applyPidfileLivenessGate(pidPath);
     writeFileSyncMain(pidPath, String(process.pid) + '\n', 'utf-8');