@jinn-network/client 0.1.9 → 0.2.0-canary.344e61e2

package/dist/harnesses/engine/engine.js

@@ -11,9 +11,14 @@ import { createHash, randomUUID } from 'node:crypto';
 import { keccak256, toBytes } from 'viem';
 import { TaskRunPersistence } from './persistence.js';
 import { TaskRunState, MissingEvidenceHashError } from './state.js';
+import { syntheticClaimBlocked, } from '../../solver-types/_swe-rebench-v2-synthetic-claim.js';
 import { reapWorkDirs, DEFAULT_ORPHAN_MAX_AGE_MS, } from './work-dir-reaper.js';
 import { provisionWorkingDir, provisionImplStateDir, walkArtifacts, uploadArtifacts, } from './packaging.js';
 import { DONATION_ARTIFACT_ENCODING } from './artifact-scrub.js';
+import { loadCorpusKnowledge, buildCorpusKnowledgePayload } from './corpus-knowledge.js';
+import { harvestGeneratorModel } from './generator-model.js';
+import { projectEnvelope } from '../../corpus/envelope-projection.js';
+import { redactRpcUrls } from '../../util/redact-rpc-urls.js';
 import { assembleAndSignEnvelope, } from './envelope-assembly.js';
 import { deliverAndClaim, } from './delivery.js';
 import { SafeInnerRevertError, isNonRecoverableInnerRevert, formatDecodedRevert, } from '../../adapters/mech/safe-revert.js';
@@ -22,11 +27,14 @@ import { isRecoverableTransactionError } from '../../tx-retry.js';
 import { SkippableError } from '../types.js';
 import { submitEvaluatorFeedback, codeDigestSha256ToBytes32, encodeExecutionPayload, encodeExecutionPayloadV2, modeStringToFlag, } from '../../erc8004/index.js';
 import { TrajectoryCollector, emitTrajectory } from '../../trajectory/index.js';
+import { addTranscriptSpans } from '../../trajectory/transcript-to-spans/index.js';
+import { buildScrubPipeline, } from '@jinn-network/core/scrub';
 import { uploadToIpfs } from '../../adapters/mech/ipfs.js';
 import { VerdictCode } from '../../adapters/mech/verdict-code.js';
 import { buildInfo } from '../../build-info.js';
 import { getSolverNetContract } from '../../vendor/@jinn-network/sdk/dist/solvernets/index.js';
 import { runHarnessWithFreezeFence, } from '../../daemon/freeze-fence.js';
+import { recordLoopTick } from '../../daemon/loop-heartbeat.js';
 import { harnessStateDirName } from '../names.js';
 import { recordTaskCost } from '../../spend/record.js';
 // ── Sentinel error ────────────────────────────────────────────────────────────
@@ -38,6 +46,24 @@ export class NotImplementedError extends Error {
         this.transitionName = transitionName;
     }
 }
+/**
+ * A task cannot leave DISCOVERED until its canonical TaskCreated block has a
+ * valid timestamp. Exhausting the bounded lookup is recoverable: a later
+ * engine pass can query a healthy/caught-up RPC and continue the same row.
+ */
+export class TaskCreationTimestampUnavailableError extends Error {
+    requestId;
+    blockNumber;
+    cause;
+    constructor(requestId, blockNumber, cause) {
+        super(`authoritative task creation timestamp unavailable for ${requestId} `
+            + `(block ${blockNumber})`);
+        this.name = 'TaskCreationTimestampUnavailableError';
+        this.requestId = requestId;
+        this.blockNumber = blockNumber;
+        this.cause = cause;
+    }
+}
 /** Map task role to the operator role it requires in `joinedSolverNets`. */
 function joinedRoleForTaskRole(taskRole) {
     return taskRole === 'evaluation' ? 'evaluator' : 'solver';
@@ -62,8 +88,30 @@ export function joinedSolverNetsViewFromConfig(joined) {
     return {
         get: (cid) => map.get(cid),
         manifestCids: () => [...map.keys()],
+        set: (cid, entry) => { map.set(cid, entry); },
     };
 }
+/**
+ * Mutable `JoinedSolverNetsView` for the running daemon. Unlike
+ * `joinedSolverNetsViewFromConfig` (boot snapshot), the applier
+ * (`daemon/join-applier.ts`, #1037) keeps a handle and calls `set()` when a
+ * join is hot-applied, so the engine's per-task eligibility check sees the new
+ * cid on its next call without a restart.
+ */
+export function createMutableJoinedSolverNetsView(initial) {
+    const map = new Map();
+    for (const [key, entry] of Object.entries(initial ?? {})) {
+        map.set(entry.manifestCid ?? key, { roles: entry.roles });
+    }
+    return {
+        get: (cid) => map.get(cid),
+        manifestCids: () => [...map.keys()],
+        set: (cid, entry) => { map.set(cid, entry); },
+    };
+}
+const TASK_CREATION_TIMESTAMP_LOOKUP_ATTEMPTS = 3;
+/** Min interval between transient-RPC tick_error emits per requestId (#934). */
+export const TRANSIENT_TICK_ERROR_HEARTBEAT_MS = 5 * 60_000;
 // ── TaskEngine ─────────────────────────────────────────────────────────
 export class TaskEngine {
     persistence;
@@ -73,8 +121,11 @@ export class TaskEngine {
     deliveryDeps;
     implRegistry;
     solverNetRegistry;
+    scrubPipeline;
     joinedSolverNets;
+    operatorSafeAddress;
     manifestResolver;
+    blockTimestamp;
     identityPublisher;
     reputationFeedback;
     operatorConfig;
@@ -107,6 +158,17 @@ export class TaskEngine {
     // Keyed by requestId; cleared after successful pack.
     trajectoryRefs = new Map();
     runtimePluginsByRequest = new Map();
+    // Corpus knowledge already resolved for this requestId's current run
+    // (#1393 review finding 3). A value (string) means knowledge was found and
+    // injected; `null` means the lookup ran and genuinely found nothing.
+    // Presence in the map (checked via .has) means "already resolved" either
+    // way, so a RUNNING retry/recovery re-drive (transient harness/RPC error,
+    // or crash-recovery via _recoverDispatch — neither transitions the task
+    // out of RUNNING) reuses this instead of re-querying the corpus and
+    // re-emitting the corpus_knowledge event. Cleared after successful pack.
+    consumedRefsByRequest = new Map();
+    /** requestId → epoch ms of last transient tick_error emit (#934) */
+    lastTransientTickErrorAt = new Map();
     processingRequestIds = new Set();
     /** Set by stop(); causes runTickLoop to exit at the next iteration. */
     stopped = false;
@@ -116,6 +178,8 @@ export class TaskEngine {
     });
     /** Working-dir reaper tuning (issue #320). */
     workDirReaperOpts;
+    /** Corpus knowledge autoload options (#1393). */
+    knowledge;
     constructor(opts) {
         this.persistence = new TaskRunPersistence(opts.store.db);
         this.store = opts.store;
@@ -125,12 +189,16 @@ export class TaskEngine {
         this.deliveryDeps = opts.deliveryDeps;
         this.implRegistry = opts.implRegistry;
         this.solverNetRegistry = opts.solverNetRegistry;
+        this.scrubPipeline = opts.scrubPipeline ?? buildScrubPipeline();
         this.joinedSolverNets = opts.joinedSolverNets;
+        this.operatorSafeAddress = opts.operatorSafeAddress;
         this.manifestResolver = opts.manifestResolver;
+        this.blockTimestamp = opts.blockTimestamp;
         this.identityPublisher = opts.identityPublisher;
         this.reputationFeedback = opts.reputationFeedback;
         this.operatorConfig = opts.operatorConfig;
         this.harnessMode = opts.harnessMode ?? 'train';
+        this.knowledge = opts.knowledge;
         this.workDirReaperOpts = {
             orphanMaxAgeMs: opts.workDirReaper?.orphanMaxAgeMs ?? DEFAULT_ORPHAN_MAX_AGE_MS,
             disabled: opts.workDirReaper?.disabled ?? false,
@@ -181,12 +249,25 @@ export class TaskEngine {
     }
     /**
      * Recover all in-flight tasks from persisted state.
-     * Called at daemon startup before beginning normal event processing.
+     * Started at daemon startup; runs concurrently with the daemon loops
+     * (#1422 — startup must not block on a recovered impl re-execution).
      * Returns a per-task report for each task attempted.
      */
     async recoverInFlight() {
         const inflight = this.persistence.getInFlight();
-        const results = await Promise.allSettled(inflight.map((task) => this._recoverOne(task)));
+        const results = await Promise.allSettled(
+        // #1422: recovery runs concurrently with the tick/watcher loops, so
+        // each task must hold the same in-flight guard `scheduleProcess` uses —
+        // otherwise a tick fired mid-recovery double-drives the task's impl.
+        inflight.map((task) => {
+            if (this.processingRequestIds.has(task.requestId)) {
+                return Promise.resolve();
+            }
+            this.processingRequestIds.add(task.requestId);
+            return this._recoverOne(task).finally(() => {
+                this.processingRequestIds.delete(task.requestId);
+            });
+        }));
         const reports = results.map((result, i) => {
             const requestId = inflight[i].requestId;
             if (result.status === 'fulfilled') {
@@ -282,6 +363,7 @@ export class TaskEngine {
             catch (err) {
                 console.error('[harness-engine] tick loop error (continuing):', err instanceof Error ? err.message : err);
             }
+            recordLoopTick(this.store, 'engine-tick'); // #1043 loop watchdog
             if (this.stopped)
                 break;
             await Promise.race([
@@ -402,6 +484,8 @@ export class TaskEngine {
                 // Terminal — nothing to do.
                 break;
         }
+        // Successful progress: allow a future outage to emit a fresh first tick_error (#934).
+        this.lastTransientTickErrorAt.delete(requestId);
     }
     // ── Transition stubs ────────────────────────────────────────────────────────
     // Stubs throw NotImplementedError. claim() is implemented here; others are
@@ -420,6 +504,14 @@ export class TaskEngine {
             console.log(`[harness-engine] ${task.requestId}: skipping claimed task — ${reason}`);
             throw new Error(reason);
         }
+        // A new envelope must carry the authoritative TaskCreated block timestamp.
+        // Resolve it before leaving DISCOVERED; a transient RPC failure gets a
+        // bounded in-call retry and then remains in-flight through the engine's
+        // existing recoverable-error classifier. Never advance with a missing
+        // value and later fabricate or omit task.createdAt.
+        if (this.blockTimestamp && task.onchainCreationTimestamp == null) {
+            await this.resolveTaskCreationTimestamp(task);
+        }
         // The event path and tick loop can race on the same DISCOVERED row; if
         // another caller already advanced it, treat this as idempotent.
         const current = this.persistence.getByRequestId(task.requestId);
@@ -434,6 +526,31 @@ export class TaskEngine {
             console.log(`[harness-engine] ${task.requestId}: claim completed but state is already ${current.state}; skipping CLAIMED transition`);
         }
     }
+    async resolveTaskCreationTimestamp(task) {
+        if (!this.blockTimestamp) {
+            throw new Error(`authoritative task creation timestamp resolver is unavailable for ${task.requestId}`);
+        }
+        let lastError;
+        for (let attempt = 1; attempt <= TASK_CREATION_TIMESTAMP_LOOKUP_ATTEMPTS; attempt++) {
+            try {
+                const timestampSec = await this.blockTimestamp.getBlockTimestamp(task.onchainCreationBlock);
+                if (timestampSec !== undefined
+                    && Number.isSafeInteger(timestampSec)
+                    && timestampSec >= 0) {
+                    this.persistence.setOnchainCreationTimestamp(task.requestId, timestampSec);
+                    return timestampSec;
+                }
+                lastError = new Error(`RPC returned no valid timestamp for block ${task.onchainCreationBlock}`);
+            }
+            catch (err) {
+                lastError = err;
+            }
+        }
+        const safeError = redactRpcUrls(lastError, this.blockTimestamp.configuredRpcUrls ?? []);
+        console.warn(`[harness-engine] ${task.requestId}: authoritative task creation timestamp unavailable `
+            + `after ${TASK_CREATION_TIMESTAMP_LOOKUP_ATTEMPTS} attempts: ${safeError}`);
+        throw new TaskCreationTimestampUnavailableError(task.requestId, task.onchainCreationBlock, lastError);
+    }
     async releaseClaimedNotStarted() {
         // TaskCoordinator claims are made before observe(), so there is no
         // recoverable "claimed but not started" engine row to release here.
@@ -674,6 +791,12 @@ export class TaskEngine {
             return `no Harness registered or enabled for solverType '${routingKey}'; run \`${setHarnessHint}\``;
         }
         if (task) {
+            if (this.operatorSafeAddress) {
+                const synthetic = task.eligibility?.['syntheticProvenance'];
+                const blocked = syntheticClaimBlocked(synthetic, this.operatorSafeAddress);
+                if (blocked)
+                    return blocked;
+            }
             if (impl.canAttempt) {
                 const attempt = await impl.canAttempt(task);
                 if (!attempt.ok) {
@@ -773,6 +896,95 @@ export class TaskEngine {
             ...(impl.attributionPlugins?.() ?? []),
         ];
         this.runtimePluginsByRequest.set(task.requestId, attributedPlugins);
+        // #1393: corpus knowledge autoload. Restoration runs only — never bias
+        // evaluators with prior solutions. The lookup is bounded (10 s) and
+        // never throws; failure or an empty result simply injects nothing.
+        // consumedRefsJson is ALSO persisted at the RUNNING → POST_SNAPSHOT
+        // transition below (harmless re-write of the same value — see
+        // resolveFreshKnowledge) so a crash-free run still gets a single,
+        // consistent column write; it stays null when nothing was injected.
+        let taskForCtx = task.task;
+        let consumedRefsJson = null;
+        // #1393 review finding 3 (fresh lookup + immediate persist) and finding
+        // 1/2 of the follow-up review (cross-restart durability + malformed-JSON
+        // guard). Runs the corpus query, injects the result, emits the
+        // corpus_knowledge event, and — critically — persists consumedRefsJson
+        // to the DB immediately (setConsumedRefsJson), BEFORE harness spawn.
+        // Without the immediate persist, a crash between the lookup and the
+        // RUNNING → POST_SNAPSHOT transition would leave consumed_refs_json
+        // null; a restarted process (empty in-memory cache) would then re-query
+        // the corpus and re-emit a duplicate corpus_knowledge event.
+        const resolveFreshKnowledge = async () => {
+            if (!taskForCtx)
+                return;
+            const knowledgePayload = await loadCorpusKnowledge({
+                corpus: this.knowledge?.corpus ?? null,
+                store: this.store,
+                solverType,
+            });
+            if (knowledgePayload) {
+                // Shallow clone: the injected context lives only in the runtime Task
+                // handed to the harness. Envelope integrity references taskCid, so
+                // nothing signed or hashed changes.
+                taskForCtx = {
+                    ...taskForCtx,
+                    context: { ...taskForCtx.context, corpusKnowledge: knowledgePayload },
+                };
+                consumedRefsJson = JSON.stringify(knowledgePayload.records);
+                emitEvent(this.store, {
+                    kind: 'corpus_knowledge',
+                    requestId: task.requestId,
+                    solverType,
+                    outcome: 'ok',
+                    detail: JSON.stringify(knowledgePayload.records.map((record) => ({
+                        envelopeCid: record.envelopeCid,
+                        artifacts: record.artifacts.map((artifact) => artifact.sha256),
+                    }))),
+                }, 'harness-engine');
+            }
+            this.consumedRefsByRequest.set(task.requestId, consumedRefsJson);
+            this.persistence.setConsumedRefsJson(task.requestId, consumedRefsJson);
+        };
+        if (role === 'restoration' && solverType && this.knowledge?.enabled !== false && taskForCtx) {
+            // A RUNNING retry/recovery re-drive (transient harness/RPC error left
+            // the row at RUNNING, or crash-recovery via _recoverDispatch) must not
+            // re-query the corpus or re-emit corpus_knowledge — reuse whatever
+            // this run already resolved, found or not. Prefer the in-memory map
+            // (same-process retries); fall back to the persisted column (the
+            // cross-restart case — a fresh TaskEngine instance has no in-memory
+            // record of a prior process's resolution).
+            const alreadyResolved = this.consumedRefsByRequest.has(task.requestId)
+                ? this.consumedRefsByRequest.get(task.requestId)
+                : task.consumedRefsJson;
+            const seenBefore = this.consumedRefsByRequest.has(task.requestId) || task.consumedRefsJson !== null;
+            if (seenBefore) {
+                try {
+                    consumedRefsJson = alreadyResolved;
+                    if (consumedRefsJson) {
+                        const cachedRecords = JSON.parse(consumedRefsJson);
+                        taskForCtx = {
+                            ...taskForCtx,
+                            context: { ...taskForCtx.context, corpusKnowledge: buildCorpusKnowledgePayload(solverType, cachedRecords) },
+                        };
+                    }
+                }
+                catch (err) {
+                    // #1393 review finding 2 (follow-up): a malformed persisted value
+                    // must never wedge the run — corpus problems can never block the
+                    // solve path (AC3). Log and fall through to a fresh lookup, which
+                    // also overwrites the bad value so subsequent retries don't hit it
+                    // again.
+                    console.warn(`[harness-engine] ${task.requestId}: malformed persisted consumedRefsJson `
+                        + `(${err instanceof Error ? err.message : String(err)}) — treating as not-yet-resolved`);
+                    taskForCtx = task.task;
+                    consumedRefsJson = null;
+                    await resolveFreshKnowledge();
+                }
+            }
+            else {
+                await resolveFreshKnowledge();
+            }
+        }
         const workingDir = task.workingDir ?? join(this.paths.workingDirRoot, task.requestId);
         const kindSeg = solverType.replace(/[.:]/g, '_');
         const implStateDir = task.implStateDir ?? (kindSeg
@@ -789,7 +1001,7 @@ export class TaskEngine {
         });
         try {
             const ctx = {
-                task: (task.task ?? {
+                task: (taskForCtx ?? {
                     id: task.requestId,
                     description: '',
                     ...(task.solverType ? { solverType: task.solverType, spec: {} } : {}),
@@ -858,6 +1070,7 @@ export class TaskEngine {
                         solutionOutputsJson: JSON.stringify(skippedOutput),
                         implName: impl.name,
                         runtimePluginsJson: JSON.stringify(attributedPlugins),
+                        consumedRefsJson,
                     });
                     console.log(`[harness-engine] ${task.requestId} RUNNING → POST_SNAPSHOT via impl=${impl.name} (skipped)`);
                     return;
@@ -902,6 +1115,7 @@ export class TaskEngine {
                 solutionOutputsJson: JSON.stringify(output),
                 implName: impl.name,
                 runtimePluginsJson: JSON.stringify(attributedPlugins),
+                consumedRefsJson,
             });
         }
         finally {
@@ -969,6 +1183,23 @@ export class TaskEngine {
         // jinn.artifact.emit spans and attach producedBy back-refs (Task 16 forward
         // linkage). emitTrajectory is called AFTER upload so artifact spans are included.
         const collector = this.trajectoryCollectors.get(task.requestId);
+        // Parse the solve transcript into jinn.agent_turn / jinn.tool_call spans
+        // (DR-2026-07-14, #1473) BEFORE artifact-emit spans are added below, so the
+        // trajectory reads chronologically: the run's conversation, then its
+        // packaging. Degrade-never-fail: any resolution/parse error is caught and
+        // logged — a missing or unparseable transcript must never fail the solve.
+        // addTranscriptSpans is itself idempotent per collector (finding 3: pack()
+        // retries in place and the collector isn't cleared until DELIVERING, so a
+        // failure after this point would otherwise re-parse and duplicate spans
+        // on the next attempt).
+        if (collector) {
+            try {
+                await addTranscriptSpans(collector, task.implName, workingDir);
+            }
+            catch (err) {
+                console.warn(`[harness-engine] ${task.requestId}: transcript-to-spans parse failed (non-fatal):`, err instanceof Error ? err.message : err);
+            }
+        }
         const packagingDepsWithReq = {
             ...this.packagingDeps,
             requestId: task.requestId,
@@ -992,6 +1223,7 @@ export class TaskEngine {
                     signerAddress: account.address,
                     ipfsRegistryUrl: this.envelopeDeps.ipfsRegistryUrl,
                     scrub: packagingDepsWithReq.donation?.scrub,
+                    scrubPipeline: this.scrubPipeline,
                 });
                 const sources = [];
                 if (packagingDepsWithReq.donation?.enabled) {
@@ -1119,6 +1351,15 @@ export class TaskEngine {
                 ...(implOutput?.rationale != null ? { rationale: implOutput.rationale } : {}),
             };
         }
+        // Task-doc repo identity (#1827), read once for the envelope's task
+        // provenance fields. Contribution refs are produced only from canonical
+        // Episodes by the plugin boundary, never from this requestId-based engine.
+        // Correctly absent for solver types without repo identity (e.g.
+        // prediction.*) — not a fabricated default.
+        const taskSpec = task.task?.spec;
+        const specRepo = typeof taskSpec?.['repo'] === 'string' ? taskSpec['repo'] : undefined;
+        const specBaseCommit = typeof taskSpec?.['base_commit'] === 'string' ? taskSpec['base_commit'] : undefined;
+        const specInstanceId = typeof taskSpec?.['instance_id'] === 'string' ? taskSpec['instance_id'] : undefined;
         // 4. Persist generatedAt once (first pack); reuse on retry for CID determinism.
         const generatedAt = task.manifestGeneratedAt ?? Date.now();
         if (!task.manifestGeneratedAt) {
@@ -1183,6 +1424,18 @@ export class TaskEngine {
         // crash-recovery from solutionOutputsJson without a fresh runImpl).
         const executorMode = this.modesByRequest.get(task.requestId) ?? 'train';
         const fenceCodeDigest = this.codeDigestsByRequest.get(task.requestId) ?? buildInfo.codeDigest;
+        // #1827: generatorModel — harvested from the harness's own transcript
+        // when possible (source: 'stream'), else falls back to the same
+        // SolverNet/daemon-config model string used for executor.model below
+        // (source: 'config'). Never throws.
+        const generatorModelForEnvelope = harvestGeneratorModel(implNameForEnvelope, workingDir, solverNet?.model ?? this.operatorConfig?.claudeModel);
+        let taskCreationTimestamp = task.onchainCreationTimestamp ?? undefined;
+        if (taskCreationTimestamp === undefined && this.blockTimestamp) {
+            // Recovery can resume an older CLAIMED/PACKAGING row that never passed
+            // through today's claim-time resolver. Re-resolve before signing so the
+            // new writer still cannot emit a provenance tuple without createdAt.
+            taskCreationTimestamp = await this.resolveTaskCreationTimestamp(task);
+        }
         const envelopeInputs = {
             solverType,
             role,
@@ -1191,6 +1444,13 @@ export class TaskEngine {
                 onchainCreationTx: task.onchainCreationTx,
                 onchainCreationBlock: task.onchainCreationBlock,
                 requestId: task.requestId,
+                // #1827: authoritative TaskCreated block timestamp. Production
+                // resolves or parks/fails before this new envelope is signed; it is
+                // absent only for historical/test callers without the resolver.
+                ...(taskCreationTimestamp !== undefined ? { createdAt: taskCreationTimestamp } : {}),
+                ...(specInstanceId ? { instanceId: specInstanceId } : {}),
+                ...(specRepo ? { repo: specRepo } : {}),
+                ...(specBaseCommit ? { baseCommit: specBaseCommit } : {}),
             },
             participant: { safeAddress, agentEoa },
             window: { startTs: task.windowStartTs, endTs: task.windowEndTs },
@@ -1212,6 +1472,10 @@ export class TaskEngine {
                 // default from operatorConfig.claudeModel (jinn-mono-gbut, gh#191).
                 // Left undefined when neither is set — the field is optional in the schema.
                 model: solverNet?.model ?? this.operatorConfig?.claudeModel,
+                // #1827: structured, honesty-flagged model provenance alongside the
+                // existing plain `model` string (which stays untouched for the
+                // indexer's composition.byModel facet).
+                generatorModel: generatorModelForEnvelope,
             },
             evidenceTier,
             trajectory: envelopeTrajectory,
@@ -1219,9 +1483,37 @@ export class TaskEngine {
             payload: envelopePayload,
             generatedAt,
         };
-        const { envelopeCid, envelopeHash } = await assembleAndSignEnvelope(envelopeInputs, this.envelopeDeps);
+        const { envelope, envelopeCid, envelopeHash } = await assembleAndSignEnvelope(envelopeInputs, this.envelopeDeps);
         const manifestCid = envelopeCid;
         const signatureHash = envelopeHash;
+        // #1393: project the just-published envelope into the local corpus index
+        // so the operator's own work is discoverable as knowledge on the next
+        // run (and by MCP search_records). Upsert keyed on envelope_id — a
+        // pack() retry overwrites idempotently. Never fatal: a projection
+        // failure must not fail packaging.
+        // NOTE: taskCid is deliberately NOT passed — projectEnvelope resolves it
+        // from options.task.context.solutionTaskCid (verdicts) or
+        // envelope.task.cid (solutions), both already correct here.
+        //
+        // #1393 review finding 1: the envelope's own evidenceTier (above) is
+        // aspirational for v2/v3 flows — 'committed' is stamped at sign time,
+        // before deliver() has actually landed evidenceHash on chain. Saving
+        // that optimistic tier straight into the corpus-ranking projection means
+        // a race-lost or failed delivery would leave a 'committed' projection
+        // outranking genuinely delivered 'self-signed' work. Save 'self-signed'
+        // here unconditionally; deliver() upgrades it to the real tier only once
+        // on-chain evidence is confirmed (mirrors the ERC-8004 setMetadata move
+        // below — 'committed' must mean observable evidence exists, not intent).
+        try {
+            this.store.saveEnvelopeProjection({
+                ...projectEnvelope(envelope, { envelopeCid, task: task.task }),
+                evidenceTier: 'self-signed',
+            });
+        }
+        catch (err) {
+            console.warn(`[harness-engine] ${task.requestId}: envelope projection failed (non-fatal): `
+                + `${err instanceof Error ? err.message : String(err)}`);
+        }
         // 6. ERC-8004 IdentityRegistry per-execution `setMetadata` fires in
         //    deliver() AFTER claimDelivery succeeds. 'committed' must mean
         //    "observable on-chain evidenceHash exists" — publishing before claim
@@ -1263,6 +1555,7 @@ export class TaskEngine {
         this.trajectoryRefs.delete(task.requestId);
         this.modesByRequest.delete(task.requestId);
         this.codeDigestsByRequest.delete(task.requestId);
+        this.consumedRefsByRequest.delete(task.requestId);
     }
     /**
      * DELIVERING transition: call mech.deliverToMarketplace + JinnRouter.claimDelivery.
@@ -1304,6 +1597,23 @@ export class TaskEngine {
             deliveryTxHash,
         });
         console.log(`[harness-engine] ${requestId} DELIVERING → COMPLETE deliveryTx=${deliveryTxHash} claimTx=${claimTxHash}`);
+        // #1393 review finding 1: now that claimDelivery has actually succeeded
+        // (on-chain evidenceHash confirmed), upgrade the local corpus projection
+        // — saved as 'self-signed' by pack() regardless of intent — to the tier
+        // the v2/v3 envelope was really entitled to. A race-lost or failed
+        // delivery never reaches this line, so the projection simply stays
+        // 'self-signed', which is the whole point of the downgrade in pack().
+        // Non-fatal: a projection-tier upgrade failure must not fail an already-
+        // successful delivery.
+        if (this.deliveryDeps.claimDeliveryVariant === 'v2' || this.deliveryDeps.claimDeliveryVariant === 'v3') {
+            try {
+                this.store.upgradeEnvelopeProjectionEvidenceTier(manifestCid, 'committed');
+            }
+            catch (err) {
+                console.warn(`[harness-engine] ${requestId}: envelope projection tier upgrade failed (non-fatal): `
+                    + `${err instanceof Error ? err.message : String(err)}`);
+            }
+        }
         // Emit a SQLite artifact row so consumers (release acceptance gate, search
         // API) see this cycle alongside legacy-claude / MCP-emitted rows. The
         // legacy claude path writes via the MCP `submit_restoration_result` tool;
@@ -1642,11 +1952,13 @@ export class TaskEngine {
      *   in the L2 fallback chain failed at once) on a task whose delivery window
      *   is still open: leave the row in its current in-flight state so the next
      *   tick re-drives it once the RPCs recover, and emit a `tick_error` (warn)
-     *   event instead of inflating the FAILED counter. Without this the daemon
-     *   stamped the row FAILED, dropping it from `getInFlight()` permanently, so
-     *   L2 work went silent until a manual restart (#912). Past-window transient
-     *   errors still terminalize to avoid churning on work that can no longer
-     *   settle.
+     *   on first occurrence plus every `TRANSIENT_TICK_ERROR_HEARTBEAT_MS`
+     *   thereafter for that requestId (#934) — not once per failing tick —
+     *   instead of inflating the FAILED counter. Without the leave-in-flight
+     *   path the daemon stamped the row FAILED, dropping it from
+     *   `getInFlight()` permanently, so L2 work went silent until a manual
+     *   restart (#912). Past-window transient errors still terminalize to avoid
+     *   churning on work that can no longer settle.
      * - Everything else: existing markFailed behaviour. When invoked from
      *   recovery, `contextLabel === 'recovery'` so the failure_reason
      *   carries the `recovery:` prefix the original code path used.
@@ -1666,6 +1978,7 @@ export class TaskEngine {
                 outcome: 'ok',
                 detail,
             }, 'harness-engine');
+            this.lastTransientTickErrorAt.delete(task.requestId);
             return 'race_lost';
         }
         const reason = err instanceof Error ? err.message : String(err);
@@ -1677,18 +1990,28 @@ export class TaskEngine {
         // IS the retry; there is no per-task attempt counter. Skip this only once
         // the delivery window has closed, so we never churn on work that can no
         // longer settle on-chain.
-        if (task.windowEndTs > Date.now() && isRecoverableTransactionError(err)) {
-            emitEvent(this.store, {
-                kind: 'tick_error',
-                requestId: task.requestId,
-                solverType: task.solverType ?? undefined,
-                outcome: 'warn',
-                detail: `transient RPC failure in ${contextLabel}; left ${task.state} for retry: ${reason}`,
-            }, 'harness-engine');
+        const recoverablePrerequisite = err instanceof TaskCreationTimestampUnavailableError;
+        if (task.windowEndTs > Date.now()
+            && (recoverablePrerequisite || isRecoverableTransactionError(err))) {
+            const now = Date.now();
+            const last = this.lastTransientTickErrorAt.get(task.requestId);
+            if (last === undefined
+                || now - last >= TRANSIENT_TICK_ERROR_HEARTBEAT_MS) {
+                emitEvent(this.store, {
+                    kind: 'tick_error',
+                    requestId: task.requestId,
+                    solverType: task.solverType ?? undefined,
+                    outcome: 'warn',
+                    detail: `${recoverablePrerequisite ? 'recoverable prerequisite failure' : 'transient RPC failure'} `
+                        + `in ${contextLabel}; left ${task.state} for retry: ${reason}`,
+                }, 'harness-engine');
+                this.lastTransientTickErrorAt.set(task.requestId, now);
+            }
             return 'transient';
         }
         const stamped = contextLabel === 'recovery' ? `recovery: ${reason}` : reason;
         this.persistence.markFailed(task.requestId, stamped);
+        this.lastTransientTickErrorAt.delete(task.requestId);
         return 'failed';
     }
     /**