@jinn-network/client 0.1.8 → 0.1.9-canary.144d87d2

package/dist/config.d.ts

@@ -13,7 +13,7 @@
  * Router claims: JINN_ROUTER_CLAIM_DELIVERY_VERSION=v1|v2 overrides chain default
  * (mainnet V1, testnet V2) for JinnRouter claimDelivery encoding.
  */
-import { z } from 'zod';
+import { z } from 'zod/v3';
 import type { Task } from './types/task.js';
 export declare const JinnConfigSchema: z.ZodEffects<z.ZodObject<{
     /**
@@ -43,6 +43,18 @@ export declare const JinnConfigSchema: z.ZodEffects<z.ZodObject<{
      * Accepts string or array form (see rpcUrl). Env: JINN_L2_PROOF_RPC_URL.
      */
     l2ProofRpcUrl: z.ZodOptional<z.ZodUnion<[z.ZodString, z.ZodArray<z.ZodString, "many">]>>;
+    /**
+     * Single volume-aware durable-state root. When set (env JINN_STATE_DIR or
+     * this file field), `earningDir`, `dbPath`, `engine.implStateDirRoot`, and
+     * the swe-rebench-v2 pool dir derive from it as `<stateDir>/<subdir>` —
+     * UNLESS each is individually overridden, in which case the per-key value
+     * wins (derive-don't-collapse). With `stateDir` unset, every default is
+     * byte-identical to the legacy `~/.jinn-client/<subdir>` paths. Hosted
+     * deploys collapse four ENV lines to one `JINN_STATE_DIR=/data`.
+     * `engine.workingDirRoot` is deliberately NOT derived — it stays ephemeral
+     * (reaped per-task).
+     */
+    stateDir: z.ZodOptional<z.ZodString>;
     /** Earning state directory */
     earningDir: z.ZodDefault<z.ZodString>;
     /** SQLite database path */
@@ -98,6 +110,8 @@ export declare const JinnConfigSchema: z.ZodEffects<z.ZodObject<{
     hermesModel: z.ZodOptional<z.ZodString>;
     /** Hermes provider (e.g. 'anthropic'). */
     hermesProvider: z.ZodOptional<z.ZodString>;
+    /** Local OpenAI-compatible Hermes base URL, e.g. http://127.0.0.1:11434/v1 for Ollama. */
+    hermesBaseUrl: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
     /**
      * Timeout in ms for `hermes doctor` health-check runs.
      * Default 30 000 ms. Env: JINN_HERMES_DOCTOR_TIMEOUT_MS.
@@ -157,16 +171,18 @@ export declare const JinnConfigSchema: z.ZodEffects<z.ZodObject<{
      * Narrow task discovery to specific on-chain task ids. This is primarily
      * for live acceptance gates that must avoid claiming unrelated public
      * backlog while proving one fresh task path.
+     * Env: JINN_TASK_DISCOVERY_ALLOWED_TASK_IDS (comma-separated).
      */
     taskDiscoveryAllowedTaskIds: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
     /**
-     * Opt-in lower bound (L2 block number) for the mech adapter's canonical
-     * on-chain TaskCreated backlog scan. Unset → the adapter's per-chain default
-     * (DEFAULT_TASK_DISCOVERY_FROM_BLOCK) flows through (see gh #300). Set this to
-     * a recent block to bound the scan to a small recent window so the indexer
-     * (DiscoveryAPI.findClaimableTasks) carries the bulk of discovery — the
-     * canonical getLogs scan over a large/bloated history parses huge responses
-     * on the main thread and can stall the event loop. Env: JINN_TASK_DISCOVERY_FROM_BLOCK.
+     * Explicit absolute lower bound (L2 block number) for the mech adapter's
+     * on-chain TaskCreated backlog scan. Unset → the scan defaults to a bounded
+     * rolling window (`head − DEFAULT_ONCHAIN_SCAN_WINDOW_BLOCKS`, ~28h on Base),
+     * so a restart no longer replays full chain history every boot (#801); the
+     * indexer (DiscoveryAPI.findClaimableTasks) is the primary discovery path and
+     * the on-chain scan is a bounded backstop. Set this to widen the backstop to a
+     * specific block (the value pins both the scan start and the gh #300 admission
+     * floor). Env: JINN_TASK_DISCOVERY_FROM_BLOCK.
      */
     taskDiscoveryOnchainFromBlock: z.ZodOptional<z.ZodNumber>;
     /** This node's public HTTP endpoint (for 8004 registration) */
@@ -1008,6 +1024,13 @@ export declare const JinnConfigSchema: z.ZodEffects<z.ZodObject<{
      * Env: JINN_CLAIM_LOOP_ENABLED=1|true|yes.
      */
     jinnClaimLoopEnabled: z.ZodDefault<z.ZodBoolean>;
+    /**
+     * Loop-watchdog auto-restart gate (#1043). Default OFF (the locked Option A
+     * decision): the watchdog always detects a stale loop and loud-logs + emits
+     * a `loop_watchdog_stale` event, but the non-zero process.exit recovery only
+     * fires when this is on. Env: JINN_WATCHDOG_AUTO_RESTART=1|true|yes.
+     */
+    watchdogAutoRestart: z.ZodDefault<z.ZodBoolean>;
     /**
      * How often the daemon ticks the cross-chain JINN claim loop (ms). Default
      * 3 600 000 (1 hour) — well below mainnet challenge windows while
@@ -1171,6 +1194,18 @@ export declare const JinnConfigSchema: z.ZodEffects<z.ZodObject<{
         plugins?: string[] | undefined;
         disabledDefaultPlugins?: string[] | undefined;
     }>>>;
+    /**
+     * Set true once the operator clicks "Enter dashboard" at the end of the
+     * #983 guided onboarding takeover. Distinct from `joinedSolverNets` being
+     * non-empty: a node can have a membership mid-onboarding (the first join
+     * populates the map) yet not have finished harness/model selection. The SPA
+     * gates the bootstrap→dashboard hand-off on this flag (see App.tsx), so the
+     * first join no longer ejects the operator before the harness step.
+     *
+     * Written by POST /v1/operator/onboarding-complete (persisted to disk AND
+     * mutated in-memory so GET /v1/bootstrap reflects it without a restart).
+     */
+    onboardingComplete: z.ZodOptional<z.ZodBoolean>;
     /**
      * Trusted ed25519 publishers for external harness impls. The daemon
      * refuses to load any external impl whose manifest signature is not
@@ -1445,6 +1480,7 @@ export declare const JinnConfigSchema: z.ZodEffects<z.ZodObject<{
     jinnMessengerMode: "canonical" | "mock";
     jinnClaimSubmissionMode: "emit-only" | "submit";
     jinnClaimLoopEnabled: boolean;
+    watchdogAutoRestart: boolean;
     jinnClaimLoopIntervalMs: number;
     stakingMode: "standard" | "self-bond";
     targetServices: number;
@@ -1466,10 +1502,12 @@ export declare const JinnConfigSchema: z.ZodEffects<z.ZodObject<{
     rpcUrl?: string | string[] | undefined;
     archiveRpcUrl?: string | string[] | undefined;
     l2ProofRpcUrl?: string | string[] | undefined;
+    stateDir?: string | undefined;
     apiBindHost?: string | undefined;
     hermesPath?: string | undefined;
     hermesModel?: string | undefined;
     hermesProvider?: string | undefined;
+    hermesBaseUrl?: string | undefined;
     codexPath?: string | undefined;
     runtimeMode?: "bare" | "docker-compose" | "container" | undefined;
     discovery?: {
@@ -1517,6 +1555,7 @@ export declare const JinnConfigSchema: z.ZodEffects<z.ZodObject<{
         } | undefined;
         model?: string | undefined;
     }> | undefined;
+    onboardingComplete?: boolean | undefined;
     trustedImplSigners?: {
         publicKey: string;
         alg: "ed25519";
@@ -1542,6 +1581,7 @@ export declare const JinnConfigSchema: z.ZodEffects<z.ZodObject<{
     rpcUrl?: string | string[] | undefined;
     archiveRpcUrl?: string | string[] | undefined;
     l2ProofRpcUrl?: string | string[] | undefined;
+    stateDir?: string | undefined;
     earningDir?: string | undefined;
     dbPath?: string | undefined;
     pollIntervalMs?: number | undefined;
@@ -1556,6 +1596,7 @@ export declare const JinnConfigSchema: z.ZodEffects<z.ZodObject<{
     hermesPath?: string | undefined;
     hermesModel?: string | undefined;
     hermesProvider?: string | undefined;
+    hermesBaseUrl?: string | undefined;
     hermesDoctorTimeoutMs?: number | undefined;
     codexPath?: string | undefined;
     codexDoctorTimeoutMs?: number | undefined;
@@ -1696,6 +1737,7 @@ export declare const JinnConfigSchema: z.ZodEffects<z.ZodObject<{
     jinnMessengerMode?: "canonical" | "mock" | undefined;
     jinnClaimSubmissionMode?: "emit-only" | "submit" | undefined;
     jinnClaimLoopEnabled?: boolean | undefined;
+    watchdogAutoRestart?: boolean | undefined;
     jinnClaimLoopIntervalMs?: number | undefined;
     stakingMode?: "standard" | "self-bond" | undefined;
     targetServices?: number | undefined;
@@ -1729,6 +1771,7 @@ export declare const JinnConfigSchema: z.ZodEffects<z.ZodObject<{
         plugins?: string[] | undefined;
         disabledDefaultPlugins?: string[] | undefined;
     }> | undefined;
+    onboardingComplete?: boolean | undefined;
     trustedImplSigners?: {
         publicKey: string;
         alg: "ed25519";
@@ -1851,6 +1894,7 @@ export declare const JinnConfigSchema: z.ZodEffects<z.ZodObject<{
     jinnMessengerMode: "canonical" | "mock";
     jinnClaimSubmissionMode: "emit-only" | "submit";
     jinnClaimLoopEnabled: boolean;
+    watchdogAutoRestart: boolean;
     jinnClaimLoopIntervalMs: number;
     stakingMode: "standard" | "self-bond";
     targetServices: number;
@@ -1872,10 +1916,12 @@ export declare const JinnConfigSchema: z.ZodEffects<z.ZodObject<{
     rpcUrl?: string | string[] | undefined;
     archiveRpcUrl?: string | string[] | undefined;
     l2ProofRpcUrl?: string | string[] | undefined;
+    stateDir?: string | undefined;
     apiBindHost?: string | undefined;
     hermesPath?: string | undefined;
     hermesModel?: string | undefined;
     hermesProvider?: string | undefined;
+    hermesBaseUrl?: string | undefined;
     codexPath?: string | undefined;
     runtimeMode?: "bare" | "docker-compose" | "container" | undefined;
     discovery?: {
@@ -1923,6 +1969,7 @@ export declare const JinnConfigSchema: z.ZodEffects<z.ZodObject<{
         } | undefined;
         model?: string | undefined;
     }> | undefined;
+    onboardingComplete?: boolean | undefined;
     trustedImplSigners?: {
         publicKey: string;
         alg: "ed25519";
@@ -1948,6 +1995,7 @@ export declare const JinnConfigSchema: z.ZodEffects<z.ZodObject<{
     rpcUrl?: string | string[] | undefined;
     archiveRpcUrl?: string | string[] | undefined;
     l2ProofRpcUrl?: string | string[] | undefined;
+    stateDir?: string | undefined;
     earningDir?: string | undefined;
     dbPath?: string | undefined;
     pollIntervalMs?: number | undefined;
@@ -1962,6 +2010,7 @@ export declare const JinnConfigSchema: z.ZodEffects<z.ZodObject<{
     hermesPath?: string | undefined;
     hermesModel?: string | undefined;
     hermesProvider?: string | undefined;
+    hermesBaseUrl?: string | undefined;
     hermesDoctorTimeoutMs?: number | undefined;
     codexPath?: string | undefined;
     codexDoctorTimeoutMs?: number | undefined;
@@ -2102,6 +2151,7 @@ export declare const JinnConfigSchema: z.ZodEffects<z.ZodObject<{
     jinnMessengerMode?: "canonical" | "mock" | undefined;
     jinnClaimSubmissionMode?: "emit-only" | "submit" | undefined;
     jinnClaimLoopEnabled?: boolean | undefined;
+    watchdogAutoRestart?: boolean | undefined;
     jinnClaimLoopIntervalMs?: number | undefined;
     stakingMode?: "standard" | "self-bond" | undefined;
     targetServices?: number | undefined;
@@ -2135,6 +2185,7 @@ export declare const JinnConfigSchema: z.ZodEffects<z.ZodObject<{
         plugins?: string[] | undefined;
         disabledDefaultPlugins?: string[] | undefined;
     }> | undefined;
+    onboardingComplete?: boolean | undefined;
     trustedImplSigners?: {
         publicKey: string;
         alg: "ed25519";
@@ -2204,18 +2255,54 @@ export declare const DEFAULT_CONFIG_PATH: string;
  * historical sync — see ponder.config.ts).
  */
 export declare const DEFAULT_TESTNET_DISCOVERY_URL = "https://jinn-indexer-production.up.railway.app";
-export declare const DEFAULT_TESTNET_ETHEREUM_RPC_URL = "https://ethereum-sepolia-rpc.publicnode.com";
 /**
- * Default fallback chain for the L2 measurement chain (Base Sepolia) on
- * testnet. Per AC2 of issue #592:
- *   slot 0 — `https://base-sepolia.publicnode.com` (no-auth, 50k-block
- *     getLogs cap, no shared-quota cliff).
- *   slot 1 — `https://sepolia.base.org` (free public Coinbase endpoint,
- *     2k-block cap; last-resort backup).
+ * Default fallback chain for the L1 settlement chain (Ethereum Sepolia,
+ * chain-id 11155111) on testnet. Per AC of issue #911 we ship ≥5 distinct
+ * free providers so a default-config daemon survives single-provider quota
+ * cliffs without an operator-supplied key:
+ *   slot 0 — `https://ethereum-sepolia-rpc.publicnode.com` (no-auth primary,
+ *     keeps the #835 no-shared-quota property symmetric with the L2 default).
+ *   slot 1 — `https://sepolia.drpc.org`
+ *   slot 2 — `https://1rpc.io/sepolia`
+ *   slot 3 — `https://sepolia.gateway.tenderly.co`
+ *   slot 4 — `https://rpc.sepolia.ethpandaops.io`
+ * Operators may prepend a paid primary via `ethereumRpcUrl` / `JINN_ETHEREUM_RPC_URL`.
+ * All five endpoints live-verified to return chain-id 11155111 (#911).
+ */
+export declare const DEFAULT_TESTNET_ETHEREUM_RPC_URLS: readonly string[];
+/**
+ * Default fallback chain for the L2 measurement chain (Base Sepolia, chain-id
+ * 84532) on testnet. Originally a two-provider chain (AC2 of issue #592);
+ * widened to ≥5 distinct free providers per issue #911 so a default-config
+ * daemon tolerates a single-provider quota cliff (the Tenderly shared-quota
+ * cliff of 2026-05-24) without an operator key.
+ *   slot 0 — `https://base-sepolia.publicnode.com` (#835 no-auth primary,
+ *     50k-block getLogs cap, no shared-quota cliff).
+ *   slot 1 — `https://base-sepolia-rpc.publicnode.com`
+ *   slot 2 — `https://base-sepolia.drpc.org`
+ *   slot 3 — `https://base-sepolia.gateway.tenderly.co`
+ *   slot 4 — `https://sepolia.base.org` (free public Coinbase endpoint,
+ *     2k-block cap; last-resort backup, stays last).
  * Operators are encouraged to prepend a paid primary key (Alchemy, Tenderly,
  * etc.) via `rpcUrl` config or `JINN_RPC_URL` / `BASE_SEPOLIA_RPC_URL` env.
+ * All five endpoints live-verified to return chain-id 84532 (#911).
  */
 export declare const DEFAULT_TESTNET_RPC_URLS: readonly string[];
+/**
+ * Default fallback chain for the L2 measurement chain (Base mainnet, chain-id
+ * 8453). ≥5 distinct free providers per issue #911.
+ *   slot 0 — `https://mainnet.base.org` (free public Coinbase endpoint).
+ */
+export declare const DEFAULT_MAINNET_RPC_URLS: readonly string[];
+/**
+ * Default fallback chain for the L1 settlement chain (Ethereum mainnet,
+ * chain-id 1). ≥5 distinct free providers per issue #911. NOTE: this is a
+ * named, addressable default only — it is intentionally NOT wired into
+ * `loadConfig`, because the daemon has no mainnet-L1 default path (Ethereum L1
+ * defaulting is testnet-only; see the consumer below). It exists so the chain-1
+ * AC is satisfied by an importable default operators / future code can adopt.
+ */
+export declare const DEFAULT_MAINNET_ETHEREUM_RPC_URLS: readonly string[];
 export type ConfigLoadErrorCode = 'config_file_not_found' | 'config_json_invalid' | 'tasks_file_not_found' | 'tasks_json_invalid' | 'config_invalid';
 export declare class ConfigLoadError extends Error {
     readonly code: ConfigLoadErrorCode;

package/dist/config.js

@@ -16,10 +16,11 @@
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { dirname, join } from 'node:path';
-import { z } from 'zod';
+import { z } from 'zod/v3';
 import { TaskSchema, parseTask } from './types/task.js';
 import { canonicalHarnessName } from './harnesses/names.js';
 import { parseRpcUrls } from './rpc/transport.js';
+import { canonicalLocalHttpBaseUrl } from './local-provider-url.js';
 // ── Schema ──────────────────────────────────────────────────────────────────
 const HarnessNameSchema = z.string().transform((name) => canonicalHarnessName(name));
 export const JinnConfigSchema = z.object({
@@ -50,6 +51,18 @@ export const JinnConfigSchema = z.object({
      * Accepts string or array form (see rpcUrl). Env: JINN_L2_PROOF_RPC_URL.
      */
     l2ProofRpcUrl: z.union([z.string(), z.array(z.string()).min(1)]).optional(),
+    /**
+     * Single volume-aware durable-state root. When set (env JINN_STATE_DIR or
+     * this file field), `earningDir`, `dbPath`, `engine.implStateDirRoot`, and
+     * the swe-rebench-v2 pool dir derive from it as `<stateDir>/<subdir>` —
+     * UNLESS each is individually overridden, in which case the per-key value
+     * wins (derive-don't-collapse). With `stateDir` unset, every default is
+     * byte-identical to the legacy `~/.jinn-client/<subdir>` paths. Hosted
+     * deploys collapse four ENV lines to one `JINN_STATE_DIR=/data`.
+     * `engine.workingDirRoot` is deliberately NOT derived — it stays ephemeral
+     * (reaped per-task).
+     */
+    stateDir: z.string().optional(),
     /** Earning state directory */
     earningDir: z.string().default(join(homedir(), '.jinn-client', 'earning')),
     /** SQLite database path */
@@ -105,6 +118,22 @@ export const JinnConfigSchema = z.object({
     hermesModel: z.string().optional(),
     /** Hermes provider (e.g. 'anthropic'). */
     hermesProvider: z.string().optional(),
+    /** Local OpenAI-compatible Hermes base URL, e.g. http://127.0.0.1:11434/v1 for Ollama. */
+    hermesBaseUrl: z
+        .string()
+        .url()
+        .transform((value, ctx) => {
+        const canonical = canonicalLocalHttpBaseUrl(value);
+        if (!canonical) {
+            ctx.addIssue({
+                code: z.ZodIssueCode.custom,
+                message: 'hermesBaseUrl must be a local HTTP(S) URL',
+            });
+            return z.NEVER;
+        }
+        return canonical;
+    })
+        .optional(),
     /**
      * Timeout in ms for `hermes doctor` health-check runs.
      * Default 30 000 ms. Env: JINN_HERMES_DOCTOR_TIMEOUT_MS.
@@ -161,16 +190,18 @@ export const JinnConfigSchema = z.object({
      * Narrow task discovery to specific on-chain task ids. This is primarily
      * for live acceptance gates that must avoid claiming unrelated public
      * backlog while proving one fresh task path.
+     * Env: JINN_TASK_DISCOVERY_ALLOWED_TASK_IDS (comma-separated).
      */
     taskDiscoveryAllowedTaskIds: z.array(z.string()).optional(),
     /**
-     * Opt-in lower bound (L2 block number) for the mech adapter's canonical
-     * on-chain TaskCreated backlog scan. Unset → the adapter's per-chain default
-     * (DEFAULT_TASK_DISCOVERY_FROM_BLOCK) flows through (see gh #300). Set this to
-     * a recent block to bound the scan to a small recent window so the indexer
-     * (DiscoveryAPI.findClaimableTasks) carries the bulk of discovery — the
-     * canonical getLogs scan over a large/bloated history parses huge responses
-     * on the main thread and can stall the event loop. Env: JINN_TASK_DISCOVERY_FROM_BLOCK.
+     * Explicit absolute lower bound (L2 block number) for the mech adapter's
+     * on-chain TaskCreated backlog scan. Unset → the scan defaults to a bounded
+     * rolling window (`head − DEFAULT_ONCHAIN_SCAN_WINDOW_BLOCKS`, ~28h on Base),
+     * so a restart no longer replays full chain history every boot (#801); the
+     * indexer (DiscoveryAPI.findClaimableTasks) is the primary discovery path and
+     * the on-chain scan is a bounded backstop. Set this to widen the backstop to a
+     * specific block (the value pins both the scan start and the gh #300 admission
+     * floor). Env: JINN_TASK_DISCOVERY_FROM_BLOCK.
      */
     taskDiscoveryOnchainFromBlock: z.number().int().min(0).optional(),
     /** This node's public HTTP endpoint (for 8004 registration) */
@@ -275,6 +306,13 @@ export const JinnConfigSchema = z.object({
      * Env: JINN_CLAIM_LOOP_ENABLED=1|true|yes.
      */
     jinnClaimLoopEnabled: z.boolean().default(false),
+    /**
+     * Loop-watchdog auto-restart gate (#1043). Default OFF (the locked Option A
+     * decision): the watchdog always detects a stale loop and loud-logs + emits
+     * a `loop_watchdog_stale` event, but the non-zero process.exit recovery only
+     * fires when this is on. Env: JINN_WATCHDOG_AUTO_RESTART=1|true|yes.
+     */
+    watchdogAutoRestart: z.boolean().default(false),
     /**
      * How often the daemon ticks the cross-chain JINN claim loop (ms). Default
      * 3 600 000 (1 hour) — well below mainnet challenge windows while
@@ -397,6 +435,18 @@ export const JinnConfigSchema = z.object({
         disabledDefaultPlugins: z.array(z.string()).default([]),
     }))
         .optional(),
+    /**
+     * Set true once the operator clicks "Enter dashboard" at the end of the
+     * #983 guided onboarding takeover. Distinct from `joinedSolverNets` being
+     * non-empty: a node can have a membership mid-onboarding (the first join
+     * populates the map) yet not have finished harness/model selection. The SPA
+     * gates the bootstrap→dashboard hand-off on this flag (see App.tsx), so the
+     * first join no longer ejects the operator before the harness step.
+     *
+     * Written by POST /v1/operator/onboarding-complete (persisted to disk AND
+     * mutated in-memory so GET /v1/bootstrap reflects it without a restart).
+     */
+    onboardingComplete: z.boolean().optional(),
     /**
      * Trusted ed25519 publishers for external harness impls. The daemon
      * refuses to load any external impl whose manifest signature is not
@@ -570,21 +620,78 @@ export const DEFAULT_CONFIG_PATH = join(DEFAULT_DIR, 'config.json');
  * historical sync — see ponder.config.ts).
  */
 export const DEFAULT_TESTNET_DISCOVERY_URL = 'https://jinn-indexer-production.up.railway.app';
-export const DEFAULT_TESTNET_ETHEREUM_RPC_URL = 'https://ethereum-sepolia-rpc.publicnode.com';
 /**
- * Default fallback chain for the L2 measurement chain (Base Sepolia) on
- * testnet. Per AC2 of issue #592:
- *   slot 0 — `https://base-sepolia.publicnode.com` (no-auth, 50k-block
- *     getLogs cap, no shared-quota cliff).
- *   slot 1 — `https://sepolia.base.org` (free public Coinbase endpoint,
- *     2k-block cap; last-resort backup).
+ * Default fallback chain for the L1 settlement chain (Ethereum Sepolia,
+ * chain-id 11155111) on testnet. Per AC of issue #911 we ship ≥5 distinct
+ * free providers so a default-config daemon survives single-provider quota
+ * cliffs without an operator-supplied key:
+ *   slot 0 — `https://ethereum-sepolia-rpc.publicnode.com` (no-auth primary,
+ *     keeps the #835 no-shared-quota property symmetric with the L2 default).
+ *   slot 1 — `https://sepolia.drpc.org`
+ *   slot 2 — `https://1rpc.io/sepolia`
+ *   slot 3 — `https://sepolia.gateway.tenderly.co`
+ *   slot 4 — `https://rpc.sepolia.ethpandaops.io`
+ * Operators may prepend a paid primary via `ethereumRpcUrl` / `JINN_ETHEREUM_RPC_URL`.
+ * All five endpoints live-verified to return chain-id 11155111 (#911).
+ */
+export const DEFAULT_TESTNET_ETHEREUM_RPC_URLS = [
+    'https://ethereum-sepolia-rpc.publicnode.com',
+    'https://sepolia.drpc.org',
+    'https://1rpc.io/sepolia',
+    'https://sepolia.gateway.tenderly.co',
+    'https://rpc.sepolia.ethpandaops.io',
+];
+/**
+ * Default fallback chain for the L2 measurement chain (Base Sepolia, chain-id
+ * 84532) on testnet. Originally a two-provider chain (AC2 of issue #592);
+ * widened to ≥5 distinct free providers per issue #911 so a default-config
+ * daemon tolerates a single-provider quota cliff (the Tenderly shared-quota
+ * cliff of 2026-05-24) without an operator key.
+ *   slot 0 — `https://base-sepolia.publicnode.com` (#835 no-auth primary,
+ *     50k-block getLogs cap, no shared-quota cliff).
+ *   slot 1 — `https://base-sepolia-rpc.publicnode.com`
+ *   slot 2 — `https://base-sepolia.drpc.org`
+ *   slot 3 — `https://base-sepolia.gateway.tenderly.co`
+ *   slot 4 — `https://sepolia.base.org` (free public Coinbase endpoint,
+ *     2k-block cap; last-resort backup, stays last).
  * Operators are encouraged to prepend a paid primary key (Alchemy, Tenderly,
  * etc.) via `rpcUrl` config or `JINN_RPC_URL` / `BASE_SEPOLIA_RPC_URL` env.
+ * All five endpoints live-verified to return chain-id 84532 (#911).
  */
 export const DEFAULT_TESTNET_RPC_URLS = [
     'https://base-sepolia.publicnode.com',
+    'https://base-sepolia-rpc.publicnode.com',
+    'https://base-sepolia.drpc.org',
+    'https://base-sepolia.gateway.tenderly.co',
     'https://sepolia.base.org',
 ];
+/**
+ * Default fallback chain for the L2 measurement chain (Base mainnet, chain-id
+ * 8453). ≥5 distinct free providers per issue #911.
+ *   slot 0 — `https://mainnet.base.org` (free public Coinbase endpoint).
+ */
+export const DEFAULT_MAINNET_RPC_URLS = [
+    'https://mainnet.base.org',
+    'https://base.publicnode.com',
+    'https://base.drpc.org',
+    'https://1rpc.io/base',
+    'https://base.meowrpc.com',
+];
+/**
+ * Default fallback chain for the L1 settlement chain (Ethereum mainnet,
+ * chain-id 1). ≥5 distinct free providers per issue #911. NOTE: this is a
+ * named, addressable default only — it is intentionally NOT wired into
+ * `loadConfig`, because the daemon has no mainnet-L1 default path (Ethereum L1
+ * defaulting is testnet-only; see the consumer below). It exists so the chain-1
+ * AC is satisfied by an importable default operators / future code can adopt.
+ */
+export const DEFAULT_MAINNET_ETHEREUM_RPC_URLS = [
+    'https://ethereum-rpc.publicnode.com',
+    'https://cloudflare-eth.com',
+    'https://eth.merkle.io',
+    'https://eth.drpc.org',
+    'https://1rpc.io/eth',
+];
 export class ConfigLoadError extends Error {
     code;
     details;
@@ -736,6 +843,12 @@ export function loadConfig(configPath) {
     if (env['JINN_TASK_DISCOVERY_FROM_BLOCK'] !== undefined) {
         merged.taskDiscoveryOnchainFromBlock = Number.parseInt(env['JINN_TASK_DISCOVERY_FROM_BLOCK'], 10);
     }
+    if (env['JINN_TASK_DISCOVERY_ALLOWED_TASK_IDS'] !== undefined) {
+        merged.taskDiscoveryAllowedTaskIds = env['JINN_TASK_DISCOVERY_ALLOWED_TASK_IDS']
+            .split(',')
+            .map((id) => id.trim())
+            .filter(Boolean);
+    }
     if (env['JINN_API_PORT'])
         merged.apiPort = parseInt(env['JINN_API_PORT'], 10);
     if (env['JINN_API_BIND_HOST'])
@@ -750,6 +863,8 @@ export function loadConfig(configPath) {
         merged.hermesModel = env['JINN_HERMES_MODEL'];
     if (env['JINN_HERMES_PROVIDER'])
         merged.hermesProvider = env['JINN_HERMES_PROVIDER'];
+    if (env['JINN_HERMES_BASE_URL'])
+        merged.hermesBaseUrl = env['JINN_HERMES_BASE_URL'];
     if (env['JINN_HERMES_DOCTOR_TIMEOUT_MS']) {
         merged.hermesDoctorTimeoutMs = parseInt(env['JINN_HERMES_DOCTOR_TIMEOUT_MS'], 10);
     }
@@ -826,6 +941,10 @@ export function loadConfig(configPath) {
         const v = env['JINN_CLAIM_LOOP_ENABLED'].trim().toLowerCase();
         merged.jinnClaimLoopEnabled = v === '1' || v === 'true' || v === 'yes';
     }
+    if (env['JINN_WATCHDOG_AUTO_RESTART'] !== undefined) {
+        const v = env['JINN_WATCHDOG_AUTO_RESTART'].trim().toLowerCase();
+        merged.watchdogAutoRestart = v === '1' || v === 'true' || v === 'yes';
+    }
     if (env['JINN_CLAIM_LOOP_INTERVAL_MS'] !== undefined) {
         merged.jinnClaimLoopIntervalMs = parseInt(env['JINN_CLAIM_LOOP_INTERVAL_MS'], 10);
     }
@@ -920,6 +1039,28 @@ export function loadConfig(configPath) {
             ...(env['JINN_ENGINE_IMPL_STATE_DIR_ROOT'] ? { implStateDirRoot: env['JINN_ENGINE_IMPL_STATE_DIR_ROOT'] } : {}),
         };
     }
+    // JINN_STATE_DIR: single volume-aware root. Runs AFTER all per-key env
+    // overrides above are applied into `merged` and BEFORE safeParse — so a
+    // still-`undefined` per-key value means neither file nor env set it. Per-key
+    // precedence: explicit (file or env, already in `merged`) > <stateDir>/<subdir>
+    // > legacy default (filled by the schema / engine assembly when still absent).
+    // workingDirRoot is deliberately NOT derived — it stays ephemeral.
+    const stateDir = env['JINN_STATE_DIR']
+        ?? (typeof merged['stateDir'] === 'string' ? merged['stateDir'] : undefined);
+    if (stateDir) {
+        merged['stateDir'] = stateDir;
+        if (merged['earningDir'] === undefined)
+            merged['earningDir'] = join(stateDir, 'earning');
+        if (merged['dbPath'] === undefined)
+            merged['dbPath'] = join(stateDir, 'jinn.db');
+        const engineObj = (typeof merged['engine'] === 'object' && merged['engine'] !== null)
+            ? merged['engine']
+            : {};
+        if (engineObj['implStateDirRoot'] === undefined) {
+            engineObj['implStateDirRoot'] = join(stateDir, 'engine', 'impl-state');
+            merged['engine'] = engineObj;
+        }
+    }
     const resolvedNetwork = merged.network === 'testnet' ? 'testnet' : 'mainnet';
     // Testnet default: point discovery at the privately-operated Ponder indexer
     // (jinn-mono-280n.4), unless the operator has set their own `discovery` block.
@@ -952,7 +1093,7 @@ export function loadConfig(configPath) {
         };
     }
     if (resolvedNetwork === 'testnet' && !merged.ethereumRpcUrl) {
-        merged.ethereumRpcUrl = DEFAULT_TESTNET_ETHEREUM_RPC_URL;
+        merged.ethereumRpcUrl = [...DEFAULT_TESTNET_ETHEREUM_RPC_URLS];
     }
     if (resolvedNetwork === 'testnet' && merged.jinnClaimLoopEnabled === undefined) {
         merged.jinnClaimLoopEnabled = true;
@@ -1018,12 +1159,13 @@ export function loadConfig(configPath) {
     // shared-quota cliff of 2026-05-24 that took out every default-config
     // daemon at once). See #554 + the NetworkSection.tsx "shared RPC" panel for
     // the operator-facing pitch to bring their own key. The sibling Ethereum L1
-    // default (DEFAULT_TESTNET_ETHEREUM_RPC_URL above) is already publicnode —
-    // this keeps the two L1/L2 defaults symmetric.
+    // default (DEFAULT_TESTNET_ETHEREUM_RPC_URLS above) is publicnode-headed —
+    // this keeps the two L1/L2 defaults symmetric. Both chains ship ≥5 free
+    // providers per issue #911.
     const parsed = result.data;
     const defaultRpcUrls = parsed.network === 'testnet'
         ? DEFAULT_TESTNET_RPC_URLS
-        : ['https://mainnet.base.org'];
+        : DEFAULT_MAINNET_RPC_URLS;
     const rpcUrlsResolved = parsed.rpcUrl !== undefined
         ? parseRpcUrls(parsed.rpcUrl)
         : [...defaultRpcUrls];
@@ -1103,6 +1245,7 @@ export function persistTopLevelConfigValue(key, value, configPath) {
  */
 const TRACKED_ENV_VARS = [
     'JINN_NETWORK',
+    'JINN_STATE_DIR',
     'JINN_EARNING_DIR',
     'JINN_DB_PATH',
     'JINN_POLL_INTERVAL_MS',
@@ -1116,12 +1259,14 @@ const TRACKED_ENV_VARS = [
     'JINN_HERMES_PATH',
     'JINN_HERMES_MODEL',
     'JINN_HERMES_PROVIDER',
+    'JINN_HERMES_BASE_URL',
     'JINN_HERMES_DOCTOR_TIMEOUT_MS',
     'JINN_RUNTIME_MODE',
     'JINN_PEERS',
     'JINN_DISCOVERY_MODE',
     'JINN_DISCOVERY_URL',
     'JINN_DISCOVERY_FALLBACK',
+    'JINN_TASK_DISCOVERY_ALLOWED_TASK_IDS',
     'JINN_NODE_ENDPOINT',
     'JINN_IPFS_REGISTRY_URL',
     'JINN_IPFS_GATEWAY_URL',
@@ -1141,6 +1286,7 @@ const TRACKED_ENV_VARS = [
     'JINN_CLAIM_SUBMISSION_MODE',
     'JINN_CLAIM_LOOP_ENABLED',
     'JINN_CLAIM_LOOP_INTERVAL_MS',
+    'JINN_WATCHDOG_AUTO_RESTART',
     'JINN_STAKING_MODE',
     'JINN_TARGET_SERVICES',
     'JINN_DEBUG',
@@ -1158,6 +1304,7 @@ const TRACKED_ENV_VARS = [
     'JINN_TASKS',
     'JINN_ENGINE_WORKING_DIR_ROOT',
     'JINN_ENGINE_IMPL_STATE_DIR_ROOT',
+    'JINN_SWE_REBENCH_V2_STATE_DIR',
     'JINN_OPERATOR_PUBLIC_ENDPOINT',
     'JINN_OPERATOR_DEFAULT_PRICE_USDC',
     'JINN_OPERATOR_DONATION_ENABLED',