@jinn-network/client 0.1.9 → 0.2.0

package/dist/main.js

@@ -24,45 +24,48 @@ import { homedir, hostname, userInfo } from 'node:os';
 import { randomBytes as cryptoRandomBytes } from 'node:crypto';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { loadConfig, getConfigPathFromArgs, DEFAULT_CONFIG_PATH } from './config.js';
+import { loadConfig, getConfigPathFromArgs, DEFAULT_CONFIG_PATH, DEFAULT_TESTNET_RPC_URLS } from './config.js';
 import { Store } from './store/store.js';
 import { startApiServer, isEmbeddedAgentEnabled } from './api/server.js';
-import { setDefaultTxSubmissionLedger } from './tx-retry.js';
+import { setDefaultTxSubmissionLedger, withEoaBroadcastLock } from './tx-retry.js';
 // addHarnessReadinessRoutes is wired through startApiServer's holder ref now
 // (jinn-mono-u34i). No direct import needed.
 import { CapturePublishUnavailableError } from './api/captures.js';
 import { invalidatePredictionOperatorStatusCache } from './api/gather-status.js';
 import { ensureUiToken } from './api/ui-token.js';
+import { decideUiAutoOpen } from './cli/ui-auto-open-gate.js';
 import { getFileLogger, closeFileLogger } from './observability/file-logger.js';
+import { emitProgress } from './observability/progress.js';
 import { hashImplStateDir } from './harnesses/freeze.js';
 import { readModeState } from './harnesses/mode-state.js';
 import { attachAgentWs, updateAgentClaudePath } from './agent/agent-ws.js';
 import { createSetupModeController } from './setup-mode.js';
 import { requestDaemonRestart } from './restart-daemon.js';
-import { buildEnvelope, emitEnvelope } from './errors/envelope.js';
-import { clearBootstrapError, persistBootstrapError, } from './errors/persisted-bootstrap-error.js';
+import { emitEnvelope } from './errors/envelope.js';
 import { emitStructured } from './events/emitter.js';
 import { applyPidfileLivenessGate } from './preflight/pidfile-liveness.js';
 import { applyDeploymentReadinessGate } from './preflight/deployment-readiness.js';
+import { ensureStableCwd } from './preflight/stable-cwd.js';
 import { detectAuthContext } from './preflight/claude-auth.js';
 import { FleetBootstrapper, recoverEvictedService as recoverEvictedServiceFn } from './earning/bootstrap.js';
-import { DEFAULT_TESTNET_ARTIFACTS, applyChainGasOverrides, getChainConfig, loadJinnMviConfig } from './earning/contracts.js';
-import { runLegacyAgentIdMigration } from './earning/migrate-agent-id.js';
+import { runFleetBootstrap, SetupBootstrapHalted } from './earning/bootstrap-run.js';
+import { applyChainGasOverrides, getChainConfig } from './earning/contracts.js';
+import { getJinnRouterAddress } from './contracts/addresses.js';
 import { FleetStateStore } from './earning/store.js';
-import { isOperationalServiceStep, } from './earning/types.js';
-import { decryptMnemonic, deriveMasterSigner, walletPrivateKeyAtIndex } from './earning/wallet.js';
+import { isOperationalServiceStep } from './earning/types.js';
+import { decryptMnemonic, deriveMasterSigner } from './earning/wallet.js';
 import { MechAdapter } from './adapters/mech/adapter.js';
 import { ClaudeRunner } from './runner/claude.js';
 import { Daemon } from './daemon/daemon.js';
 import { buildSpendCapConfig } from './spend/daemon-config.js';
 import { buildAiUnitsConfig } from './spend/ai-units-config.js';
 import { REFERENCE_CEILING } from './spend/ai-units.js';
-import { buildJinnClaimLoopConfig, shouldWireJinnClaimL1Signer, } from './daemon/jinn-claim-loop-wiring.js';
-import { createJinnPublicClient, createJinnWalletClient, createJinnL1PublicClient, createJinnL1WalletClient } from './earning/viem-clients.js';
+import { createJinnPublicClient, createJinnWalletClient } from './earning/viem-clients.js';
 import { privateKeyToAccount } from 'viem/accounts';
 import { getAddress } from 'viem';
 import { DEFAULT_DISABLED_HARNESSES, DEFAULT_HARNESS, HarnessRegistry, } from './harnesses/engine/registry.js';
-import { joinedSolverNetsViewFromConfig } from './harnesses/engine/engine.js';
+import { createMutableJoinedSolverNetsView } from './harnesses/engine/engine.js';
+import { createJoinApplier } from './daemon/join-applier.js';
 import { buildHarnesses } from './harnesses/impls/index.js';
 import { loadExternalImpl } from './harnesses/external-impls/index.js';
 import { CLAUDE_CODE_HARNESS, CODEX_HARNESS, HERMES_AGENT_HARNESS, harnessStateDirName } from './harnesses/names.js';
@@ -74,17 +77,15 @@ import { createCorpus } from './corpus/index.js';
 import { DEFAULT_EXECUTION_DISCOVERY_FROM_BLOCK } from './corpus/onchain-query.js';
 import { CapturesStore } from './store/captures.js';
 import { createLiveCapturePublisher } from './captures/live-publisher.js';
+import { EnsurePendingCaptureProcessor, ensurePendingCapture, ingestStopHookCapture } from './captures/ingest.js';
 import { startReceiver } from './trajectory/receiver.js';
 import { startSyntheticSpanProvider, emitSyntheticSpan } from './trajectory/synthetic-span-builder.js';
 import { CredentialScrubProcessor } from './trajectory/processors/credential-scrub.js';
 import { TranscriptContentScrubProcessor } from './trajectory/processors/transcript-content-scrub.js';
 import { IdentityScrubProcessor } from './trajectory/processors/identity-scrub.js';
 import { PathScrubProcessor } from './trajectory/processors/path-scrub.js';
+import { buildScrubPipeline, maybeBuildPiiDetector, } from '@jinn-network/core/scrub';
 import { SqliteExporterProcessor } from './trajectory/processors/sqlite-exporter.js';
-import { ClaudeCodeJsonlParser } from './trajectory/transcript-parsers/claude-code-jsonl.js';
-import { CodexSessionParser } from './trajectory/transcript-parsers/codex-session.js';
-import { GeminiSessionParser } from './trajectory/transcript-parsers/gemini-session.js';
-import { CursorSqliteParser } from './trajectory/transcript-parsers/cursor-sqlite.js';
 import { startTranscriptWatcher, } from './trajectory/transcript-watcher.js';
 import { defaultTranscriptWatchDirectories } from './trajectory/transcript-session-dirs.js';
 import { buildInfo } from './build-info.js';
@@ -92,8 +93,8 @@ import { BASE_FEEDS } from './venues/chainlink/feeds.js';
 import { GeneratedTaskSource, StaticConfiguredTaskSource, filterBindableTasks } from './tasks/sources.js';
 import { checkRpcNetwork, logRpcLocalDevToStderr, probeFallbackChain, rpcNetworkFailureHint, summarizeFallbackChain, } from './preflight/rpc-network.js';
 import { apiPortFailureMessage, checkApiPortAvailable } from './preflight/api-port.js';
+import { fetchLatestVersion, getRunningVersion, isNewerVersion, isVersionCheckEnabled, formatUpdateLogLine, VERSION_CHECK_INTERVAL_MS, } from './preflight/version-check.js';
 import { openBrowser } from './cli/open-browser.js';
-import { keepSetupUiOnBootstrapError } from './setup/halt-mode.js';
 if (process.env['JINN_LOAD_DEV_ENV'] === '1' || process.env['NODE_ENV'] === 'development') {
     dotenvConfig({ path: join(dirname(fileURLToPath(import.meta.url)), '..', '.env') });
 }
@@ -163,6 +164,11 @@ let activeClaudePath = config.claudePath ?? 'claude';
 const selectClaudePath = (claudePath) => {
     activeClaudePath = claudePath;
     config.claudePath = claudePath;
+    // Harmless no-op when the embedded agent is disabled
+    // (`embeddedAgentEnabled` is false at this point): the agent surface
+    // that consumes this path isn't mounted, so the update has nothing to
+    // propagate to. Called unconditionally to keep the path in sync
+    // whenever the agent IS enabled.
     updateAgentClaudePath(claudePath);
 };
 const NETWORK_CHAIN = config.network === 'testnet' ? 'base-sepolia' : 'base';
@@ -175,21 +181,18 @@ const CHAIN_CONFIG = applyChainGasOverrides(getChainConfig(NETWORK_CHAIN, {
     minEoaGasWei: config.minEoaGasWei,
     minSafeEthWei: config.minSafeEthWei,
 });
-const MESSENGER_MODE_EXPLICIT = process.env['JINN_MESSENGER_MODE'] !== undefined ||
-    configFileHasTopLevelKey(CONFIG_PATH, 'jinnMessengerMode');
-const JINN_MVI_CONFIG = loadJinnMviConfig({
-    l1ArtifactPath: config.jinnMviL1DeploymentPath ??
-        (config.network === 'testnet' ? DEFAULT_TESTNET_ARTIFACTS.jinnMviL1 : undefined),
-    l2ArtifactPath: config.jinnMviL2DeploymentPath ??
-        (config.network === 'testnet' ? DEFAULT_TESTNET_ARTIFACTS.jinnMviL2 : undefined),
-    distributorAddress: config.jinnDistributorAddress,
-    messengerAddress: config.jinnMessengerAddress,
-    claimEmitterAddress: config.jinnClaimEmitterAddress,
-    messengerMode: MESSENGER_MODE_EXPLICIT ? config.jinnMessengerMode : undefined,
-});
-const JINN_CLAIM_MESSENGER_MODE = JINN_MVI_CONFIG.messengerMode ?? config.jinnMessengerMode;
 const MARKETPLACE_ADDRESS = CHAIN_CONFIG.mechMarketplace;
-const ROUTER_ADDRESS = (CHAIN_CONFIG.jinnRouter ?? '0xfFa7118A3D820cd4E820010837D65FAfF463181B');
+const ROUTER_ADDRESS = (CHAIN_CONFIG.jinnRouter ?? getJinnRouterAddress(CHAIN_CONFIG.chainId));
+/** #913: the bundled public RPC fallback chain for the current network. The
+ *  setup/network endpoint persists `[primary, ...RPC_PUBLIC_DEFAULTS]` so the
+ *  operator keeps the public backup chain when they set a primary, and the
+ *  Settings → Network UI renders these as the trailing read-only slots. */
+const RPC_PUBLIC_DEFAULTS = NETWORK_CHAIN === 'base-sepolia' ? DEFAULT_TESTNET_RPC_URLS : [CHAIN_CONFIG.rpcUrl];
+/** #913: last L2 boot-probe result per RPC slot. Captured at boot, surfaced
+ *  via /v1/bootstrap so Settings → Network can render per-slot health. Hosts
+ *  are already masked by probeFallbackChain. The RPC chain is restart-required,
+ *  so this never drifts without a re-probing restart. */
+let lastL2Probe = [];
 function configFileHasTopLevelKey(configPath, key) {
     const filePath = configPath ?? join(process.env['HOME'] ?? '', '.jinn-client', 'config.json');
     if (!filePath || !existsSync(filePath))
@@ -202,455 +205,17 @@ function configFileHasTopLevelKey(configPath, key) {
         return false;
     }
 }
-class EnsurePendingCaptureProcessor {
-    captures;
-    constructor(captures) {
-        this.captures = captures;
-    }
-    forceFlush() { return Promise.resolve(); }
-    shutdown() { return Promise.resolve(); }
-    onStart() { }
-    onEnd(span) {
-        const sessionId = stringAttribute(span.attributes['jinn.session.id']);
-        if (!sessionId)
-            return;
-        ensurePendingCapture(this.captures, {
-            sessionId,
-            capturedAt: hrTimeToIso(span.startTime),
-            tool: inferCaptureTool(span),
-            capturePath: inferCapturePath(span),
-            ...repoMetadataFromSpan(span),
-        });
-    }
-}
-function stringAttribute(value) {
-    return typeof value === 'string' && value.trim() !== '' ? value : undefined;
-}
-function hrTimeToIso(time) {
-    const millis = (time[0] * 1000) + Math.floor(time[1] / 1_000_000);
-    return new Date(millis).toISOString();
-}
-function inferCaptureTool(span) {
-    return stringAttribute(span.attributes['transcript.tool'])
-        ?? stringAttribute(span.resource.attributes['service.name'])
-        ?? 'otel';
-}
-function inferCapturePath(span) {
-    if (stringAttribute(span.attributes['transcript.tool']))
-        return 'B';
-    return 'A';
-}
-function repoMetadataFromSpan(span) {
-    const attrs = span.attributes;
-    const repoRemoteUrl = stringAttribute(attrs['repo.remote_url'])
-        ?? stringAttribute(attrs['vcs.repository.url'])
-        ?? stringAttribute(attrs['git.remote_url']);
-    const repoCommitHash = stringAttribute(attrs['repo.commit_hash'])
-        ?? stringAttribute(attrs['vcs.ref.head.revision'])
-        ?? stringAttribute(attrs['git.commit']);
-    return {
-        ...(repoRemoteUrl ? { repoRemoteUrl } : {}),
-        ...(repoCommitHash ? { repoCommitHash } : {}),
-    };
-}
-function parserForStopHookTool(tool) {
-    switch (tool) {
-        case 'claude-code':
-            return new ClaudeCodeJsonlParser();
-        case 'codex':
-            return new CodexSessionParser();
-        case 'gemini-cli':
-            return new GeminiSessionParser();
-        case 'cursor':
-            return new CursorSqliteParser();
-        default: {
-            const exhaustive = tool;
-            throw new Error(`No transcript parser for stop-hook tool: ${String(exhaustive)}`);
-        }
-    }
-}
-function ensurePendingCapture(captures, params) {
-    if (captures.getBySession(params.sessionId))
-        return;
-    try {
-        captures.savePending({
-            sessionId: params.sessionId,
-            capturedAt: params.capturedAt,
-            originatingTool: { name: params.tool },
-            capturePath: params.capturePath,
-            status: 'pending',
-            spanCount: 0,
-            durationMs: 0,
-            redactedSpanCount: 0,
-            ...(params.repoRemoteUrl ? { repoRemoteUrl: params.repoRemoteUrl } : {}),
-            ...(params.repoCommitHash ? { repoCommitHash: params.repoCommitHash } : {}),
-        });
-    }
-    catch (err) {
-        if (!captures.getBySession(params.sessionId))
-            throw err;
-    }
-}
-async function ingestStopHookCapture(captures, receiver, payload) {
-    ensurePendingCapture(captures, {
-        sessionId: payload.sessionId,
-        capturedAt: payload.stoppedAt,
-        tool: payload.tool,
-        capturePath: 'D',
-    });
-    if (!payload.transcriptPath)
-        return;
-    if (!receiver) {
-        console.warn('[main] stop-hook capture received but OTLP receiver is unavailable; pending capture has no transcript spans.');
-        return;
-    }
-    const parser = parserForStopHookTool(payload.tool);
-    let events;
-    try {
-        events = await parser.parseFull({ sessionId: payload.sessionId, path: payload.transcriptPath });
-    }
-    catch (err) {
-        console.warn(`[main] stop-hook transcript import failed for ${payload.transcriptPath}: ` +
-            `${err instanceof Error ? err.message : String(err)}`);
-        return;
-    }
-    if (events.length === 0)
-        return;
-    const provider = startSyntheticSpanProvider({
-        otlpHttpEndpoint: `http://127.0.0.1:${receiver.httpPort}/v1/traces`,
-    });
-    try {
-        for (const event of events) {
-            emitSyntheticSpan(provider, { tool: parser.tool, sessionId: payload.sessionId, event });
-        }
-        await provider.flush();
-    }
-    finally {
-        await provider.shutdown();
-    }
-}
-const STANDARD_SERVICE_PROGRESSION = [
-    'awaiting_stake',
-    'staked',
-    'mech_deployed',
-    'agent_registered',
-    'safe_binding_pending',
-    'complete',
-];
-const SELF_BOND_SERVICE_PROGRESSION = [
-    'awaiting_stake',
-    'service_created',
-    'service_activated',
-    'agents_registered',
-    'service_deployed',
-    'service_staked',
-    'mech_deployed',
-    'agent_registered',
-    'safe_binding_pending',
-    'complete',
-];
-/** §6.2 `bootstrap_incomplete` — `{ currentStep, nextStep }` from persisted fleet state. */
-function bootstrapIncompleteSteps(state) {
-    const progression = state.staking_mode === 'self-bond'
-        ? SELF_BOND_SERVICE_PROGRESSION
-        : STANDARD_SERVICE_PROGRESSION;
-    const byIndex = [...state.services].sort((a, b) => a.index - b.index);
-    const focus = byIndex.find(s => isOperationalServiceStep(s.step) && !s.safe_address) ??
-        byIndex.find(s => !isOperationalServiceStep(s.step)) ??
-        byIndex.find(s => s.step === 'safe_binding_pending') ??
-        byIndex[0];
-    if (!focus) {
-        return { currentStep: 'awaiting_service', nextStep: 'awaiting_stake' };
-    }
-    if (isOperationalServiceStep(focus.step) && !focus.safe_address) {
-        return { currentStep: 'complete', nextStep: 'bootstrap' };
-    }
-    const i = progression.indexOf(focus.step);
-    if (i === -1) {
-        return { currentStep: focus.step, nextStep: 'bootstrap' };
-    }
-    if (i < progression.length - 1) {
-        return { currentStep: focus.step, nextStep: progression[i + 1] };
-    }
-    return { currentStep: focus.step, nextStep: 'bootstrap' };
-}
-// ── Bootstrap ───────────────────────────────────────────────────────────────
-async function bootstrap() {
-    console.log('[main] Running fleet bootstrap...');
-    // A fresh bootstrap attempt clears any stale error breadcrumb. If this run
-    // hits the same failure, it'll be re-persisted below; if it succeeds (or
-    // proceeds past the previously-failed step), the panel returns to a clean
-    // state on the next /v1/bootstrap poll.
-    clearBootstrapError(config.earningDir);
-    // Persist the envelope to disk before emitEnvelope's process.exit fires,
-    // so /v1/bootstrap can surface it to the panel after the daemon has
-    // exited (operator restart → panel reload → error visible).
-    function failBootstrap(input) {
-        const envelope = buildEnvelope(input);
-        persistBootstrapError(envelope, config.earningDir);
-        if (keepSetupUiOnBootstrapError()) {
-            emitStructured({
-                kind: 'error',
-                message: envelope.message,
-                errorCode: envelope.code,
-                details: {
-                    phase: 'bootstrap',
-                    exitCode: envelope.exitCode,
-                    ...(envelope.details ?? {}),
-                },
-            });
-            console.error(`[main] Bootstrap halted (${envelope.code}); setup UI remains available. ` +
-                `Resolve the issue and run jinn run again.`);
-            throw new SetupBootstrapHalted(envelope);
-        }
-        emitEnvelope(input);
-        // Unreachable in production (emitEnvelope exits); satisfies `never`.
-        throw new Error('unreachable');
-    }
-    const bootstrapper = new FleetBootstrapper({
-        earningDir: config.earningDir,
-        chain: NETWORK_CHAIN,
-        rpcUrl: config.rpcUrl,
-        stakingMode: config.stakingMode,
-        targetServices: config.targetServices,
-        testnetL2DeploymentPath: config.testnetL2DeploymentPath,
-        testnetL2TokenDeploymentPath: config.testnetL2TokenDeploymentPath,
-        testnetMechDeploymentPath: config.testnetMechDeploymentPath,
-        testnetStolasDeploymentPath: config.testnetStolasDeploymentPath,
-        debug: config.debug,
-        masterEthDailyEstimateWei: config.masterEthDailyEstimateWei,
-        minEoaGasWei: config.minEoaGasWei,
-        minSafeEthWei: config.minSafeEthWei,
-        pollIntervalMs: config.pollIntervalMs,
-        autoTestnetFaucet: process.env['JINN_AUTO_TESTNET_FAUCET'] === '1',
-    });
-    // Funding poll: stay up while waiting for the operator to fund the wallet.
-    // The setup-mode API server is already running; the panel renders the
-    // funding card and auto-advances when funds land. Daemon-side, we poll
-    // bootstrap on a 15s tick and only escalate (exit) if a non-funding error
-    // occurs or the configured timeout elapses. Each tick re-runs the full
-    // bootstrap state machine — completed steps are no-ops, so this is safe.
-    // Testnet faucet funding is panel-driven: bootstrap reports the funding gate,
-    // and the operator clicks the funding action before this loop can advance.
-    const FUNDING_POLL_INTERVAL_MS = 15_000;
-    const fundingTimeoutMs = (() => {
-        const raw = process.env['JINN_FUNDING_TIMEOUT_MS'];
-        if (!raw)
-            return Number.POSITIVE_INFINITY;
-        const n = Number.parseInt(raw, 10);
-        return Number.isFinite(n) && n > 0 ? n : Number.POSITIVE_INFINITY;
-    })();
-    emitProgress({
-        type: 'progress',
-        phase: 'bootstrap',
-        step: 'advance_state_machine',
-        estimatedWaitMs: 60_000,
-    });
-    const fundingStartedAt = Date.now();
-    let result;
-    let lastFundingMessage = '';
-    const fundingGatePath = join(config.earningDir, 'bootstrap-funding.json');
-    const persistFundingGate = (funding) => {
-        mkdirSync(config.earningDir, { recursive: true, mode: 0o700 });
-        writeFileSyncMain(fundingGatePath, `${JSON.stringify({
-            schemaVersion: 1,
-            generatedAt: new Date().toISOString(),
-            ...funding,
-        }, null, 2)}\n`, { mode: 0o600 });
-    };
-    const clearFundingGate = () => {
-        try {
-            unlinkSync(fundingGatePath);
-        }
-        catch {
-            // best-effort: absent/stale funding gate should not affect bootstrap
-        }
-    };
-    // eslint-disable-next-line no-constant-condition
-    while (true) {
-        result = await bootstrapper.ensureStage1And2(PASSWORD);
-        if (!result.funding) {
-            clearFundingGate();
-            break;
-        }
-        persistFundingGate(result.funding);
-        // Emit a structured event so the panel's Visibility region shows the gate.
-        // Dedupe by message to avoid spamming the ring buffer on each poll.
-        const fundingMsg = result.message ?? 'awaiting funding';
-        if (fundingMsg !== lastFundingMessage) {
-            emitStructured({
-                kind: 'fleet',
-                message: fundingMsg,
-                details: {
-                    phase: 'awaiting_funding',
-                    role: 'master',
-                    address: result.funding.master_address,
-                    asset: 'native',
-                    needWei: result.funding.eth_required,
-                    haveWei: result.funding.eth_balance,
-                },
-            });
-            // Mirror the structured event to NDJSON progress for --json-progress
-            // consumers (CI, agents). Same dedup gate so we don't spam stdout.
-            emitProgress({
-                type: 'progress',
-                phase: 'bootstrap',
-                step: 'awaiting_funding',
-                blocking: true,
-                nextAction: 'Fund the address shown in addresses.fundingAddress, then wait for automatic retry.',
-                addresses: { fundingAddress: result.funding.master_address },
-                estimatedWaitMs: 1_800_000,
-            });
-            lastFundingMessage = fundingMsg;
-        }
-        const elapsed = Date.now() - fundingStartedAt;
-        if (elapsed >= fundingTimeoutMs) {
-            failBootstrap({
-                code: 'funding_required',
-                message: `${result.message} (timeout after ${Math.round(elapsed / 1000)}s)`,
-                hint: 'Fund the listed address and re-run this command.',
-                exampleCli: 'jinn fund-requirements --json',
-                details: {
-                    // jinn-mono-hjex.6: structured envelope so SPA can render the
-                    // specific address + amount instead of a prose disjunction.
-                    category: 'insufficient_funds',
-                    step: 'awaiting_funding',
-                    address: result.funding.master_address,
-                    requiredWei: result.funding.eth_required,
-                    haveWei: result.funding.eth_balance,
-                    // Legacy aliases kept for any external consumers that read these.
-                    role: 'master',
-                    asset: 'native',
-                    needWei: result.funding.eth_required,
-                },
-            });
-        }
-        console.log(`[main] Awaiting funding... (${Math.round(elapsed / 1000)}s elapsed; ` +
-            `will retry in ${FUNDING_POLL_INTERVAL_MS / 1000}s)`);
-        await new Promise((r) => setTimeout(r, FUNDING_POLL_INTERVAL_MS));
-    }
-    if (!result.ok) {
-        failBootstrap({
-            code: 'fatal',
-            message: result.message,
-            hint: 'Bootstrap failed before the fleet reached a runnable state.',
-            details: {
-                cause: result.message,
-                // jinn-mono-hjex.6: propagate structured category from the bootstrapper
-                // so the SPA can render category-specific UI (e.g. funding shortfall).
-                ...(result.errorCategory !== undefined ? { category: result.errorCategory } : {}),
-                // Preserve the raw underlying error so a misclassified summary can
-                // be diagnosed without re-running with JINN_DEBUG. See jinn-mono-jz9f.
-                ...(result.rawErrorMessage && result.rawErrorMessage !== result.message
-                    ? { rawErrorMessage: result.rawErrorMessage }
-                    : {}),
-                // jinn-mono-hjex reviewer fix: propagate tx hash so the SPA can render
-                // a block-explorer link for failed on-chain revert transactions.
-                ...(result.txHash != null ? { txHash: result.txHash } : {}),
-            },
-        });
-    }
-    // Legacy migration (jinn-mono-jgp): backfill `agent_id` on `complete`
-    // services that pre-date j07. Idempotent + per-service failure-isolated;
-    // a failure here does not abort daemon startup, but we surface counts so
-    // operators notice. Disabled via `runLegacyMigrations: false` /
-    // JINN_RUN_LEGACY_MIGRATIONS=0 — operators can run `jinn migrate-agent-id`
-    // explicitly instead.
-    let state = result.fleet_state;
-    if (config.runLegacyMigrations) {
-        try {
-            const migration = await runLegacyAgentIdMigration({
-                earningDir: config.earningDir,
-                network: NETWORK_CHAIN,
-                rpcUrl: config.rpcUrl,
-                password: PASSWORD,
-                testnetL2DeploymentPath: config.testnetL2DeploymentPath,
-                testnetL2TokenDeploymentPath: config.testnetL2TokenDeploymentPath,
-                testnetMechDeploymentPath: config.testnetMechDeploymentPath,
-                testnetStolasDeploymentPath: config.testnetStolasDeploymentPath,
-            });
-            if (migration.migrated.length > 0 || migration.failed.length > 0) {
-                console.log(`[main] Legacy agent_id migration: migrated=${migration.migrated.length} ` +
-                    `skipped=${migration.skipped.length} failed=${migration.failed.length}`);
-                for (const f of migration.failed) {
-                    console.log(`[main]   service ${f.service.index} (agent ${f.service.agent_address}): ${f.error}`);
-                }
-                // Reload state so downstream wiring (agent_id, identityRegistry)
-                // sees the migrated rows.
-                state = await new FleetStateStore(config.earningDir).load(NETWORK_CHAIN);
-            }
-        }
-        catch (err) {
-            const message = err instanceof Error ? err.message : String(err);
-            console.error(`[main] Legacy agent_id migration failed (non-fatal): ${message}`);
-        }
-    }
-    // Use the first operational service for the daemon. `safe_binding_pending`
-    // means staking/mech are live; only the ERC-8004 Safe→agent metadata bind
-    // is still retrying.
-    const firstComplete = state.services.find(s => isOperationalServiceStep(s.step));
-    if (!firstComplete || !firstComplete.safe_address) {
-        failBootstrap({
-            code: 'bootstrap_incomplete',
-            message: 'Bootstrap completed but no service is ready.',
-            hint: 'Re-run to continue the state machine toward a running fleet.',
-            exampleCli: 'jinn bootstrap --json',
-            details: bootstrapIncompleteSteps(state),
-        });
-    }
-    // Derive agent private key from mnemonic
-    const store = new FleetStateStore(config.earningDir);
-    const mnemonic = await decryptMnemonic(await store.loadMnemonicKeystore(), PASSWORD);
-    const agentPrivateKey = walletPrivateKeyAtIndex(mnemonic, firstComplete.index);
-    console.log(`[main] Fleet bootstrap complete.`);
-    console.log(`  Master:  ${state.master_address}`);
-    console.log(`  Services: ${state.services.filter(s => isOperationalServiceStep(s.step)).length}/${config.targetServices}`);
-    console.log(`  Active:  service ${firstComplete.service_id} (agent ${firstComplete.agent_address})`);
-    if (firstComplete.mech_address) {
-        console.log(`  Mech:    ${firstComplete.mech_address}`);
-    }
-    return {
-        masterAddress: state.master_address,
-        serviceIndex: firstComplete.index,
-        serviceId: firstComplete.service_id ?? null,
-        stakingAddress: firstComplete.staking_address ? firstComplete.staking_address : null,
-        agentPrivateKey: agentPrivateKey,
-        safeAddress: firstComplete.safe_address,
-        mechAddress: firstComplete.mech_address ? firstComplete.mech_address : undefined,
-        agentId: firstComplete.agent_id ?? null,
-        identityRegistryAddress: firstComplete.identity_registry_address
-            ? firstComplete.identity_registry_address
-            : null,
-    };
-}
-class SetupBootstrapHalted extends Error {
-    envelope;
-    constructor(envelope) {
-        super(envelope.message);
-        this.envelope = envelope;
-        this.name = 'SetupBootstrapHalted';
-    }
-}
 // hjex.6: gate for the halt-and-resume loop. Lives in ./setup/halt-mode.ts
 // so it can be unit-tested without dragging main.ts's top-level side
 // effects (password resolution, config load) into the test.
 // ── Main ────────────────────────────────────────────────────────────────────
-/**
- * --json-progress: emit NDJSON progress envelopes on stdout during long
- * phases (init, bootstrap, daemon startup). The `jinn run --json-progress`
- * flag flips JINN_JSON_PROGRESS=1 in run.ts before calling main(); when
- * unset this is a no-op so tests / non-flag invocations stay silent on
- * stdout.
- */
-function progressEnabled() {
-    return process.env['JINN_JSON_PROGRESS'] === '1';
-}
-function emitProgress(envelope) {
-    if (progressEnabled()) {
-        process.stdout.write(JSON.stringify(envelope) + '\n');
-    }
-}
 export async function main() {
+    // Issue #909: chdir to a stable directory before spawning any child process.
+    // `jinn run` inherits the launch shell's CWD; when daemonised from an
+    // ephemeral dir that is later deleted, the CWD becomes a dangling inode and
+    // child processes (the `claude` CLI harness probe) crash on getcwd() ENOENT.
+    // Must run first — before getFileLogger() and any subprocess spawn.
+    ensureStableCwd({ earningDir: config.earningDir });
     console.log(`[main] jinn-client starting on ${NETWORK_CHAIN}`);
     // Issue #420: initialise the rotating daemon file logger early so lifecycle
     // events (tapped in `observability/emit-event.ts`) accumulate durable,
@@ -700,12 +265,8 @@ export async function main() {
     // Boot-time RPC fallback-chain probe (issue #592, AC7 + AC9). Log-only —
     // per-slot 429s/5xx never gate startup. checkRpcNetwork above already
     // fail-loud on chain-id mismatch against the head provider.
-    await probeFallbackChain(config.rpcUrls, config.network, 'L2');
+    lastL2Probe = await probeFallbackChain(config.rpcUrls, config.network, 'L2');
     console.error(summarizeFallbackChain('L2', config.rpcUrls));
-    if (config.jinnClaimLoopEnabled && config.ethereumRpcUrls) {
-        await probeFallbackChain(config.ethereumRpcUrls, config.network, 'L1');
-        console.error(summarizeFallbackChain('L1', config.ethereumRpcUrls));
-    }
     const portPreflight = await checkApiPortAvailable(config.apiPort);
     if (!portPreflight.ok) {
         emitEnvelope({
@@ -860,6 +421,17 @@ export async function main() {
     // builder-artifacts. Holder ref lets the routes register eagerly and
     // start returning real data the moment main.ts assigns holder.current.
     const discoveryApiHolder = { current: undefined };
+    // #1037: same eager-register / late-populate pattern for the join applier.
+    // The join endpoint registers eagerly inside startApiServer; the applier is
+    // built only after the latest join-consuming subsystem (the engine view,
+    // wired in the Daemon ctor). The endpoint tolerates an empty holder in the
+    // gap between server-start and populate by falling back to
+    // restartRequired:true.
+    const joinApplierHolder = { current: undefined };
+    // #641: latest published `@jinn-network/client` version, back-filled by the
+    // start-time npm-registry check below. `/v1/status.latestVersion` reads this
+    // via the `latestVersion` getter threaded into the ApiServer status config.
+    const latestVersionHolder = { current: null };
     // hjex.6: retry signal for the bootstrap halt-and-resume loop.
     // When a SetupBootstrapHalted is caught (fatal non-funding error or funding
     // timeout), main() waits on this promise instead of returning, so the setup
@@ -965,7 +537,27 @@ export async function main() {
                 configReader: () => ({
                     rpcUrl: config.rpcUrl,
                     defaultRpcUrl: CHAIN_CONFIG.rpcUrl,
+                    rpcUrls: config.rpcUrls,
+                    publicDefaults: RPC_PUBLIC_DEFAULTS,
+                    rpcSlotHealth: lastL2Probe.map((p) => p.ok
+                        ? {
+                            ok: true,
+                            host: p.host,
+                            latencyMs: p.latencyMs,
+                            expectedChainId: p.expectedChainId,
+                            actualChainId: p.actualChainId,
+                            ...(p.localDev ? { localDev: true } : {}),
+                        }
+                        : {
+                            ok: false,
+                            host: p.host,
+                            code: p.code,
+                            reason: p.reason,
+                            expectedChainId: p.expectedChainId,
+                            actualChainId: p.actualChainId,
+                        }),
                     joinedSolverNets: config.joinedSolverNets,
+                    onboardingComplete: config.onboardingComplete,
                 }),
             },
             // SolverNet catalog. Stubbed to the bundled `prediction` net for v1.
@@ -1082,10 +674,15 @@ export async function main() {
                 // targetServices DOES need to flow through so the faucet drips enough
                 // ETH to cover ALL services for the operator's chosen targetServices.
                 targetServices: config.targetServices,
+                // Issue #560: batched daily-cap top-up knobs — single source of truth
+                // in JinnConfig, surfaced to the SPA via GET /v1/setup/drip/quota.
+                faucetDailyTopupCap: config.faucetDailyTopupCap,
+                faucetTopupCooldownMs: config.faucetTopupCooldownMs,
                 claudePath: activeClaudePath,
                 getClaudePath: () => activeClaudePath,
                 configPath: CONFIG_PATH ?? DEFAULT_CONFIG_PATH,
                 defaultRpcUrlForChain: () => CHAIN_CONFIG.rpcUrl,
+                defaultRpcUrlsForChain: () => RPC_PUBLIC_DEFAULTS,
                 onClaudePathSelected: selectClaudePath,
                 // Issue #421 retired the legacy `solverNets` write target. Setup
                 // endpoints no longer call back into the daemon to mutate operator
@@ -1113,16 +710,21 @@ export async function main() {
                         resolve();
                     });
                 },
+                // #1037: hot-apply a join to the running daemon. Populated after the
+                // join-consuming subsystems are built (see joinApplierHolder). Empty
+                // until then → the endpoint returns restartRequired:true.
+                joinApplier: joinApplierHolder,
+                // #983: mutate the in-memory config so GET /v1/bootstrap reflects the
+                // completion flag live (the endpoint persists to disk; this keeps the
+                // configReader's in-memory read consistent — same pattern as the
+                // join-applier's config write). Cast: JinnConfig has the optional field.
+                markOnboardingComplete: () => {
+                    config.onboardingComplete = true;
+                },
             },
             status: {
                 earningDir: config.earningDir,
                 rpcUrl: config.rpcUrl,
-                // tJINN identity comes from the bundled JINN MVI L1 artifact
-                // (`JINN_MVI_CONFIG`) — one source of truth. The Sepolia RPC endpoint
-                // is read from `config.ethereumRpcUrl` via the threaded `config`.
-                tjinnTokenAddress: JINN_MVI_CONFIG.jinn,
-                tjinnChainId: JINN_MVI_CONFIG.l1ChainId,
-                tjinnDistributorAddress: JINN_MVI_CONFIG.distributor,
                 network: config.network,
                 pollIntervalMs: config.pollIntervalMs,
                 masterEthDailyEstimateWei: config.masterEthDailyEstimateWei,
@@ -1134,6 +736,10 @@ export async function main() {
                 engine: config.engine,
                 config,
                 configPath: CONFIG_PATH ?? DEFAULT_CONFIG_PATH,
+                passwordRotation: {
+                    source: passwordResolution.source,
+                    filePath: passwordResolution.filePath,
+                },
             },
             // Launcher mode (Tasks 6 + 7). Deps are resolved lazily because the
             // generator and Safe address are constructed after bootstrap, after
@@ -1226,6 +832,11 @@ export async function main() {
                         const rows = sharedStore.listPostedTasksByCreator(opts);
                         return rows.map((r) => ({
                             taskId: r.taskId,
+                            // On-chain decimal id (#579) — the launcher status chip keys its
+                            // indexer lookup on this, not the off-chain display taskId. Empty
+                            // string (no on-chain id recorded) maps to undefined so the
+                            // gatherer falls back to taskId.
+                            ...(r.protocolTaskId ? { protocolTaskId: r.protocolTaskId } : {}),
                             taskCid: r.taskCid,
                             solverType: r.solverType ?? undefined,
                             postedAt: r.postedAt,
@@ -1233,6 +844,16 @@ export async function main() {
                             ...(r.claims ? { claims: r.claims } : {}),
                         }));
                     },
+                    // #579: on-chain finalized/open/expired status for the Recent posted
+                    // Tasks chip. discoveryApiHolder is populated post-bootstrap; before
+                    // that (or with no discovery API) we return an empty Map → all chips
+                    // render 'unknown', the safe degraded default.
+                    fetchTaskStatuses: async (manifestCid) => {
+                        const api = discoveryApiHolder.current;
+                        if (!api)
+                            return new Map();
+                        return api.getTaskStatuses({ manifestCid });
+                    },
                 },
             },
         });
@@ -1260,11 +881,36 @@ export async function main() {
         `http://127.0.0.1:${setupApiServer.port}/?k=${handshakeKey}`;
     // Auto-open the operator panel as soon as the setup-mode API is up so the
     // operator can watch bootstrap progress (including the funding wait, which
-    // is the whole point of starting the API early). Suppressed by setting
-    // JINN_NO_UI=1 — `jinn run --no-ui` translates the flag into this env var.
-    if (process.env['JINN_NO_UI'] !== '1') {
+    // is the whole point of starting the API early). Only on the first-ever
+    // launch (tracked by a marker file) — otherwise every restart during a
+    // dogfooding session opens a fresh browser tab and stale tabs accumulate
+    // (issue #804). `jinn run --no-ui` / JINN_NO_UI=1 always suppresses;
+    // `jinn run --ui` / JINN_FORCE_UI=1 forces a reopen even past first launch.
+    const uiOpenedMarkerPath = join(config.earningDir, '.ui-opened');
+    const noUi = process.env['JINN_NO_UI'] === '1';
+    const forceUi = process.env['JINN_FORCE_UI'] === '1';
+    const uiAutoOpenDecision = decideUiAutoOpen({
+        noUi,
+        forceUi,
+        markerExists: existsSync(uiOpenedMarkerPath),
+    });
+    if (uiAutoOpenDecision.shouldOpen) {
         openBrowser(process.env['JINN_UI_HANDSHAKE_URL']);
     }
+    else if (!noUi) {
+        console.log(`[main] Dashboard ready at http://127.0.0.1:${setupApiServer.port} — ` +
+            `run 'jinn ui' to open it (auto-open suppressed after first launch; use --ui to force)`);
+    }
+    if (uiAutoOpenDecision.shouldWriteMarker) {
+        try {
+            mkdirSync(dirname(uiOpenedMarkerPath), { recursive: true });
+            writeFileSyncMain(uiOpenedMarkerPath, new Date().toISOString() + '\n');
+        }
+        catch (err) {
+            console.warn(`[main] Failed to write UI-opened marker at ${uiOpenedMarkerPath}: ` +
+                (err instanceof Error ? err.message : String(err)));
+        }
+    }
     console.log(`[main] Setup-mode API up (mode=${setupController.mode()}). ` +
         `Dashboard: http://127.0.0.1:${setupApiServer.port}`);
     // ── Operator agent WebSocket bridge ──────────────────────────────────────
@@ -1356,7 +1002,7 @@ export async function main() {
     // eslint-disable-next-line no-constant-condition
     while (true) {
         try {
-            bootstrapResult = await bootstrap();
+            bootstrapResult = await runFleetBootstrap({ config, password: PASSWORD, network: NETWORK_CHAIN, emitProgress });
             break; // success — exit the retry loop
         }
         catch (err) {
@@ -1506,6 +1152,11 @@ export async function main() {
     const taskDiscoveryManifestCids = Object.values(config.joinedSolverNets ?? {})
         .filter((entry) => entry.roles.includes('solver'))
         .map((entry) => entry.manifestCid);
+    // #547: only scan/ingest evaluation opportunities when this operator holds the
+    // evaluator role in at least one joined SolverNet. The join applier flips this
+    // on live via adapter.setEvaluatorEnabled(true).
+    const evaluatorEnabled = Object.values(config.joinedSolverNets ?? {})
+        .some((entry) => entry.roles.includes('evaluator'));
     // ── DiscoveryAPI construction ─────────────────────────────────────────────
     // Build the shared DiscoveryAPI used by MechAdapter (task discovery),
     // the SolverNet registry client (lifecycle status), and the corpus library
@@ -1549,6 +1200,28 @@ export async function main() {
     // the panel's next refetch. Before this, the routes 404'd forever and
     // the /build page rendered "Discovery unavailable" permanently.
     discoveryApiHolder.current = sharedDiscoveryApi;
+    // #1037: the live task-discovery descriptor. Always present with a mutable
+    // `solverNetManifestCids` array (`taskDiscoveryManifestCids` is a fresh
+    // `.map` result, safe to push onto). The join applier holds this same object
+    // reference and pushes a newly-joined cid onto it live.
+    const taskDiscovery = {
+        discoveryApi: sharedDiscoveryApi,
+        solverNetManifestCids: taskDiscoveryManifestCids,
+        // No explicit `onchainFromBlock` by default — let `MechAdapter`'s
+        // `DEFAULT_TASK_DISCOVERY_FROM_BLOCK` per-chain default flow through.
+        // Hardcoding here shadowed the adapter's default and re-introduced the
+        // ghost-task floor every release; removing the shadow makes `adapter.ts`
+        // the single source of truth. See gh #300. An operator MAY opt in to a
+        // recent floor via `taskDiscoveryOnchainFromBlock` to bound the canonical
+        // getLogs scan (which otherwise parses a large history on the main thread
+        // and can stall the loop) and lean on the indexer DiscoveryAPI.
+        ...(config.taskDiscoveryOnchainFromBlock !== undefined
+            ? { onchainFromBlock: config.taskDiscoveryOnchainFromBlock }
+            : {}),
+        ...(config.taskDiscoveryAllowedTaskIds?.length
+            ? { allowedTaskIds: config.taskDiscoveryAllowedTaskIds }
+            : {}),
+    };
     const adapter = new MechAdapter({
         rpcUrl: config.rpcUrls,
         mechMarketplaceAddress: MARKETPLACE_ADDRESS,
@@ -1562,27 +1235,8 @@ export async function main() {
         chainId: config.network === 'testnet' ? 84532 : 8453,
         routerClaimDeliveryVariant: CHAIN_CONFIG.routerClaimDeliveryVersion,
         evictionRecovery,
-        taskDiscovery: taskDiscoveryManifestCids.length > 0
-            ? {
-                discoveryApi: sharedDiscoveryApi,
-                solverNetManifestCids: taskDiscoveryManifestCids,
-                // No explicit `onchainFromBlock` by default — let `MechAdapter`'s
-                // `DEFAULT_TASK_DISCOVERY_FROM_BLOCK` per-chain default flow
-                // through. Hardcoding here shadowed the adapter's default and
-                // re-introduced the ghost-task floor every release; removing the
-                // shadow makes `adapter.ts` the single source of truth. See gh
-                // #300. An operator MAY opt in to a recent floor via
-                // `taskDiscoveryOnchainFromBlock` to bound the canonical getLogs
-                // scan (which otherwise parses a large history on the main thread
-                // and can stall the loop) and lean on the indexer DiscoveryAPI.
-                ...(config.taskDiscoveryOnchainFromBlock !== undefined
-                    ? { onchainFromBlock: config.taskDiscoveryOnchainFromBlock }
-                    : {}),
-                ...(config.taskDiscoveryAllowedTaskIds?.length
-                    ? { allowedTaskIds: config.taskDiscoveryAllowedTaskIds }
-                    : {}),
-            }
-            : undefined,
+        taskDiscovery,
+        evaluatorEnabled,
     }, sharedStore);
     // ── TaskEngine wiring ─────────────────────────────────────────────────
     // Build agent viem clients (same creds as MechAdapter uses internally).
@@ -1590,57 +1244,7 @@ export async function main() {
     const agentChain = config.network === 'testnet'
         ? viemChains.baseSepolia
         : viemChains.base;
-    const l1Chain = config.jinnL1Network === 'sepolia' ? viemChains.sepolia : viemChains.mainnet;
-    const agentChainContracts = agentChain.contracts;
-    const optimismPortalAddress = agentChainContracts?.portal?.[l1Chain.id]?.address;
-    const disputeGameFactoryAddress = agentChainContracts?.disputeGameFactory?.[l1Chain.id]?.address;
-    const l2ProofClient = config.l2ProofRpcUrls
-        ? createJinnPublicClient(config.l2ProofRpcUrls, NETWORK_CHAIN)
-        : undefined;
     const agentClients = createClients(config.rpcUrls, agentPrivateKey, agentChain);
-    // ── L1 (Sepolia / Ethereum mainnet) clients for cross-chain JINN claim loop ──
-    // Uses the agent EOA because MockMessenger.owner is the agent on testnet.
-    // Same key as L2; only the chain differs.
-    const shouldWireJinnClaimL1 = shouldWireJinnClaimL1Signer({
-        enabled: config.jinnClaimLoopEnabled,
-        intervalMs: config.jinnClaimLoopIntervalMs,
-        submissionMode: config.jinnClaimSubmissionMode,
-        distributorAddress: JINN_MVI_CONFIG.distributor,
-        ethereumRpcUrl: config.ethereumRpcUrl,
-    });
-    const l1ClientsForJinnClaim = shouldWireJinnClaimL1 && config.ethereumRpcUrls
-        ? {
-            public: createJinnL1PublicClient(config.ethereumRpcUrls, config.jinnL1Network),
-            wallet: createJinnL1WalletClient(config.ethereumRpcUrls, config.jinnL1Network, privateKeyToAccount(agentPrivateKey)),
-        }
-        : undefined;
-    const jinnClaimLoopConfig = buildJinnClaimLoopConfig({
-        enabled: config.jinnClaimLoopEnabled,
-        intervalMs: config.jinnClaimLoopIntervalMs,
-        submissionMode: config.jinnClaimSubmissionMode,
-        messengerMode: JINN_CLAIM_MESSENGER_MODE,
-        mvi: JINN_MVI_CONFIG,
-        l2Client: agentClients.publicClient,
-        l2ProofClient,
-        l2Wallet: agentClients.walletClient,
-        l1Clients: l1ClientsForJinnClaim,
-        store: earningStore,
-        chain: NETWORK_CHAIN,
-        optimismPortalAddress,
-        disputeGameFactoryAddress,
-    });
-    if (jinnClaimLoopConfig) {
-        console.log(`[main] JinnClaimLoop: enabled (submission=${config.jinnClaimSubmissionMode}, ` +
-            `mode=${JINN_CLAIM_MESSENGER_MODE}, ` +
-            `interval=${config.jinnClaimLoopIntervalMs}ms, distributor=${JINN_MVI_CONFIG.distributor}, ` +
-            `emitter=${JINN_MVI_CONFIG.claimEmitter})`);
-    }
-    else if (!config.jinnClaimLoopEnabled) {
-        console.log('[main] JinnClaimLoop: disabled (jinnClaimLoopEnabled=false)');
-    }
-    else {
-        console.log(`[main] JinnClaimLoop: disabled (missing claim-loop artifacts, interval disabled, or L1 submit wiring)`);
-    }
     // ── Harness registry ─────────────────────────────────────────────────────────
     const solverNetRegistry = await loadSolverNets(config);
     for (const net of solverNetRegistry.list()) {
@@ -1765,6 +1369,13 @@ export async function main() {
     // is no longer needed and would throw on Hono's locked matcher.
     harnessReadinessRegistryHolder.current = harnessReadinessRegistry;
     console.log('[main] HarnessReadinessRegistry started; /v1/harnesses/readiness routes active.');
+    // #1037: always construct the engine eligibility view (mutable) so a
+    // hot-applied join can inject its cid live. Previously this was wired only
+    // when config.joinedSolverNets was truthy; a zero-join daemon then ran the
+    // legacy solverType gate. With an always-present empty view, a zero-join
+    // daemon rejects cid-bearing tasks (its discovery cid set is empty so it
+    // discovers none) and still passes legacy no-cid tasks. See plan §behaviour-change.
+    const joinedSolverNetsView = createMutableJoinedSolverNetsView(config.joinedSolverNets);
     // ── Engine deps ───────────────────────────────────────────────────────────────
     // Packaging deps: artifacts are always written to served_artifacts
     // (operator-local SQLite). In public-testnet donation mode, scrubbed artifact
@@ -1830,6 +1441,17 @@ export async function main() {
         claimDeliveryVariant: CHAIN_CONFIG.routerClaimDeliveryVersion,
         evictionRecovery,
     };
+    // ── Contribution reference queue (task-creator spec §10) ─────────────────
+    //
+    // ALWAYS constructed so legacy v1/v2 files migrate once to the reference-only
+    // v3 schema. Stage 2 keeps every unpublished reference explicitly disabled;
+    // canonical Episode persistence is owned by the harness layer.
+    const { ContributionStore, resolveContributionStateDir } = await import('./vendor/@jinn-network/core/dist/index.js');
+    const contributionStore = new ContributionStore({
+        stateDir: resolveContributionStateDir(),
+    });
+    await contributionStore.disableUnpublished();
+    console.log('[main] contribution references: local eligibility queue — publication=parked');
     // ── IdentityPublisher (jinn-mono-3zk) ───────────────────────────────────────
     //
     // When the bootstrap has minted an ERC-8004 IdentityRegistry NFT for the
@@ -1851,6 +1473,14 @@ export async function main() {
     else {
         console.log('[main] IdentityPublisher: disabled (no agent_id on active service — re-run bootstrap to mint the operator agent NFT)');
     }
+    // ── Seller-side scrub pipeline (publish-time) ─────────────────────────────
+    // One pipeline shared by the task engine and the live capture publisher so
+    // every published trajectory passes through the same maintained scrub stack
+    // (structural key policy → openredaction → secretlint/entropy → optional ML
+    // PII). The OTLP receiver above runs best-effort ingest-time scrubbers; this
+    // is the authoritative final gate before a trajectory becomes public/sellable.
+    const sellerPiiDetector = await maybeBuildPiiDetector(config.captures.piiDetection);
+    const sellerScrubPipeline = buildScrubPipeline(sellerPiiDetector ? { piiDetector: sellerPiiDetector } : {});
     const liveCapturePublisher = createLiveCapturePublisher({
         store: sharedStore,
         captures: capturesStore,
@@ -1863,6 +1493,7 @@ export async function main() {
         clientGitSha: buildInfo.clientGitSha,
         identityPublisher,
         harnessMode: config.harness.mode,
+        scrubPipeline: sellerScrubPipeline,
     });
     capturePublishRef.current = liveCapturePublisher.publishCapture;
     // ── Reputation feedback hook (jinn-mono-yg4) ──────────────────────────────
@@ -2101,13 +1732,27 @@ export async function main() {
         new StaticConfiguredTaskSource(bindableConfigTasks),
         ...launchedRecordGenerators.map(({ solverType, generator }, idx) => new GeneratedTaskSource(`launched:${solverType}:${idx}`, generator, {
             bucketKeyForTask: (task) => {
-                if (task.solverType !== 'swe-rebench-v2.v1')
-                    return undefined;
-                const instanceId = task.spec?.['instance_id'];
-                const postedCount = task.eligibility?.['posted_count_after_record'];
-                if (typeof instanceId !== 'string' || typeof postedCount !== 'number')
-                    return undefined;
-                return `swe-rebench-v2:${instanceId}:${postedCount}`;
+                if (task.solverType === 'swe-rebench-v2.v1') {
+                    const instanceId = task.spec?.['instance_id'];
+                    const postedCount = task.eligibility?.['posted_count_after_record'];
+                    if (typeof instanceId !== 'string' || typeof postedCount !== 'number')
+                        return undefined;
+                    return `swe-rebench-v2:${instanceId}:${postedCount}`;
+                }
+                // Issue #1893: jinn-repo.v1 live-issue tasks bucket on
+                // <issueNumber>:<snapshotHash> (carried on `eligibility` by
+                // `jinn-repo-live-auto.ts`) rather than the default window-based
+                // key — the window's startTs/endTs changes every tick, which would
+                // defeat once-per-bucket dedup for a generator whose own re-post
+                // signal is a material issue edit, not the passage of time.
+                if (task.solverType === 'jinn-repo.v1' && task.spec?.['source'] === 'live-issue') {
+                    const issueNumber = task.eligibility?.['issue_number'];
+                    const snapshotHash = task.eligibility?.['snapshot_hash'];
+                    if (typeof issueNumber !== 'number' || typeof snapshotHash !== 'string')
+                        return undefined;
+                    return `jinn-repo-live:${issueNumber}:${snapshotHash}`;
+                }
+                return undefined;
             },
         })),
     ];
@@ -2157,6 +1802,66 @@ export async function main() {
         const source = overrideSet && !matchesDefault ? 'env' : 'default';
         console.log(`[ai-units] cap=${aiUnits.capPerBlock}/${aiUnits.capPerWeek} per (block, week) source=${source}`);
     }
+    let harvestLoopConfig;
+    const harvestMinesSessions = config.harvest.sources.includes('sessions');
+    if (config.harvest.enabled &&
+        config.harvest.intervalMs > 0 &&
+        (config.harvest.repos.length > 0 || harvestMinesSessions)) {
+        const { resolveHarvestRepoConfigs } = await import('./daemon/harvest-loop.js');
+        const harvestRepos = await resolveHarvestRepoConfigs(config.harvest.repos);
+        // A sessions-only operator legitimately has zero repos. The loop remains
+        // schedulable so it can report the explicit Stage 2 parked marker.
+        if (harvestRepos.length > 0 || harvestMinesSessions) {
+            const { defaultStateDir } = await import('./solver-types/swe-rebench-v2.js');
+            const harvestStateDir = defaultStateDir();
+            const baseHarvestLoopConfig = {
+                intervalMs: config.harvest.intervalMs,
+                stateDir: harvestStateDir,
+                repos: harvestRepos,
+                limitPerRepo: config.harvest.limitPerRepo,
+                publish: config.harvest.publish,
+                minterSafe: safeAddress,
+                sources: config.harvest.sources,
+            };
+            const hasCommitWork = config.harvest.sources.includes('commits') && harvestRepos.length > 0;
+            if (!hasCommitWork) {
+                harvestLoopConfig = baseHarvestLoopConfig;
+                console.log(`[main] harvest loop enabled: 0 repo(s), sources=${config.harvest.sources.join(',')}, interval=${config.harvest.intervalMs}ms (sessions parked)`);
+            }
+            else {
+                const { readEnabledState, defaultSweRebenchV2EvaluatorImplStateDir } = await import('./harnesses/impls/swe-rebench-v2-evaluator/harness.js');
+                const { existsSync } = await import('node:fs');
+                const enabled = readEnabledState(defaultSweRebenchV2EvaluatorImplStateDir());
+                if (!enabled || !existsSync(enabled.upstreamRepoDir)) {
+                    console.warn('[main] harvest enabled but swe-rebench-v2 evaluator is not set up — run `jinn harnesses enable swe-rebench-v2-evaluator`');
+                }
+                else {
+                    const { getSweRebenchV2ValidatedPoolStore } = await import('./solver-types/swe-rebench-v2.js');
+                    const { getDefaultMintedPoolStore } = await import('./solver-types/_swe-rebench-v2-minted-pool.js');
+                    const { HttpHfFetcher } = await import('./harnesses/impls/swe-rebench-v2-evaluator/hf-fetcher.js');
+                    const { PythonEvalRunner } = await import('./harnesses/impls/swe-rebench-v2-evaluator/eval-runner.js');
+                    const { createGitHubPublicRepoChecker } = await import('./solver-types/_swe-rebench-v2-guards.js');
+                    harvestLoopConfig = {
+                        ...baseHarvestLoopConfig,
+                        mintDeps: {
+                            stateDir: harvestStateDir,
+                            ipfsRegistryUrl: config.ipfsRegistryUrl,
+                            ipfsGatewayUrl: config.ipfsGatewayUrl,
+                            validatedStore: getSweRebenchV2ValidatedPoolStore(harvestStateDir),
+                            mintedStore: getDefaultMintedPoolStore(harvestStateDir),
+                            hfFetcher: new HttpHfFetcher(),
+                            runner: new PythonEvalRunner({ upstreamRepoDir: enabled.upstreamRepoDir }),
+                            upstreamRepoDir: enabled.upstreamRepoDir,
+                            publicRepoChecker: createGitHubPublicRepoChecker({
+                                token: process.env.GITHUB_TOKEN,
+                            }),
+                        },
+                    };
+                    console.log(`[main] harvest loop enabled: ${harvestRepos.length} repo(s), sources=${config.harvest.sources.join(',')}, interval=${config.harvest.intervalMs}ms`);
+                }
+            }
+        }
+    }
     const daemon = new Daemon({
         adapter,
         runner,
@@ -2178,12 +1883,6 @@ export async function main() {
         status: {
             earningDir: config.earningDir,
             rpcUrl: config.rpcUrl,
-            // tJINN identity comes from the bundled JINN MVI L1 artifact
-            // (`JINN_MVI_CONFIG`) — one source of truth. The Sepolia RPC endpoint
-            // is read from `config.ethereumRpcUrl` via the threaded `config`.
-            tjinnTokenAddress: JINN_MVI_CONFIG.jinn,
-            tjinnChainId: JINN_MVI_CONFIG.l1ChainId,
-            tjinnDistributorAddress: JINN_MVI_CONFIG.distributor,
             // stOLAS L2 distributor — mirrors `CHAIN_CONFIG.distributorAddress`
             // used to gate the EvictionLoop (issue #651). Threaded through so the
             // SPA's autoRestake predicate keys off the same on-chain artifact as
@@ -2200,6 +1899,13 @@ export async function main() {
             engine: config.engine,
             config,
             configPath: CONFIG_PATH ?? DEFAULT_CONFIG_PATH,
+            passwordRotation: {
+                source: passwordResolution.source,
+                filePath: passwordResolution.filePath,
+            },
+            // #641: back-fills /v1/status.latestVersion from the start-time
+            // npm-registry check (populated after the daemon-running line below).
+            latestVersion: () => latestVersionHolder.current,
             spendCaps: spendCap?.caps,
             aiUnits,
         },
@@ -2213,7 +1919,6 @@ export async function main() {
                 distributorAddress: CHAIN_CONFIG.distributorAddress,
             }
             : undefined,
-        jinnClaim: jinnClaimLoopConfig,
         restorationEngine: {
             paths: {
                 workingDirRoot: config.engine.workingDirRoot,
@@ -2224,15 +1929,25 @@ export async function main() {
             deliveryDeps,
             implRegistry,
             solverNetRegistry,
+            // #1827: resolves envelope.task.createdAt at claim() time. getBlock
+            // errors propagate deliberately — engine.ts retries a bounded number of
+            // times and keeps/fails the task before signing rather than emitting a
+            // provenance tuple without its authoritative creation timestamp.
+            blockTimestamp: {
+                getBlockTimestamp: async (blockNumber) => {
+                    const block = await publicClient.getBlock({ blockNumber: BigInt(blockNumber) });
+                    return Number(block.timestamp);
+                },
+                configuredRpcUrls: config.rpcUrls,
+            },
             // Spec §14, Task 28: per-launch claim eligibility filter. Operators
             // populate `joinedSolverNets[<manifestCid>]` via the SPA's join flow;
             // the engine refuses tasks whose `manifestDigest = keccak256(cid)`
             // doesn't match a joined entry (plus a role gate). Absent when the
             // operator hasn't joined any nets yet — the engine then falls back to
             // the legacy solverType-keyed gate.
-            ...(config.joinedSolverNets
-                ? { joinedSolverNets: joinedSolverNetsViewFromConfig(config.joinedSolverNets) }
-                : {}),
+            // #1037: always wire the (mutable) view so a hot-applied join is live.
+            joinedSolverNets: joinedSolverNetsView,
             // Spec §14: task validation resolves manifest → contract → schemas.
             // Threaded only when the SolverNet registry client was constructed
             // (testnet branch above). The engine treats absence as "schema
@@ -2243,7 +1958,14 @@ export async function main() {
             identityPublisher,
             reputationFeedback,
             operatorConfig,
+            operatorSafeAddress: safeAddress,
             harnessMode: config.harness.mode,
+            // #1393: corpus knowledge autoload — operator opt-out flag. The corpus
+            // instance itself is injected by the Daemon (built from corpusFactory).
+            knowledge: { enabled: config.engine.knowledgeAutoload },
+            // Share the one maintained scrub pipeline (incl. optional ML PII) so task
+            // trajectories and captures are scrubbed by the same stack before publish.
+            scrubPipeline: sellerScrubPipeline,
         },
         balanceTopup: config.balanceTopupIntervalMs > 0
             ? {
@@ -2295,7 +2017,7 @@ export async function main() {
                 store: earningStore,
                 chain: NETWORK_CHAIN,
                 writeCheckpoint: async ({ stakingProxy }) => {
-                    const txHash = await masterWallet.writeContract({
+                    const txHash = await withEoaBroadcastLock(masterAccount.address, () => masterWallet.writeContract({
                         address: stakingProxy,
                         abi: [
                             {
@@ -2309,12 +2031,33 @@ export async function main() {
                         functionName: 'checkpoint',
                         account: masterAccount,
                         chain: null,
-                    });
+                    }));
                     return { txHash };
                 },
             }
             : undefined,
+        harvest: harvestLoopConfig,
+        // #1043 loop watchdog. Always constructed in production so a stale loop is
+        // detected + surfaced; the process-exit recovery is flag-gated (default
+        // OFF) by config.watchdogAutoRestart.
+        watchdog: { autoRestart: config.watchdogAutoRestart },
     });
+    // #1037: populate the join applier now that all four join-consuming
+    // subsystems exist — the live task-discovery descriptor (`taskDiscovery`),
+    // the mutable engine view (`joinedSolverNetsView`), the readiness registry,
+    // and the SolverNet registry. The join endpoint registered eagerly at
+    // server-start; before this point it returns restartRequired:true.
+    joinApplierHolder.current = createJoinApplier({
+        taskDiscovery,
+        view: joinedSolverNetsView,
+        readiness: harnessReadinessRegistry,
+        registry: solverNetRegistry,
+        config,
+        enableEvaluator: () => adapter.setEvaluatorEnabled(true),
+    });
+    if (config.watchdogAutoRestart) {
+        console.log('[watchdog] auto-restart ENABLED (stale loop → non-zero exit)');
+    }
     // Write pidfile so `jinn stop` can find us. First, refuse the run if another
     // daemon already owns this earning directory — see issue #649. The gate
     // handles all three branches (refuse-and-exit, unlink-stale-and-continue,
@@ -2330,13 +2073,11 @@ export async function main() {
     await applyDeploymentReadinessGate({
         stateDir: config.stateDir,
         earningDir: config.earningDir,
-        relayerUrl: undefined,
         runtimeMode: config.runtimeMode,
     }, {
         env: process.env,
         getuid: typeof process.getuid === 'function' ? process.getuid.bind(process) : undefined,
         detectAuthContext,
-        fetch,
     });
     const pidPath = join(config.earningDir, 'daemon.pid');
     applyPidfileLivenessGate(pidPath);
@@ -2354,6 +2095,8 @@ export async function main() {
     // flow (they were created in setup-mode before bootstrap), so we close
     // them explicitly after Daemon.stop() completes.
     let shutdownPromise = null;
+    // #641: recurring npm-registry version check; cleared on shutdown.
+    let versionCheckTimer = null;
     const shutdown = async (signal) => {
         if (shutdownPromise)
             return shutdownPromise;
@@ -2361,6 +2104,8 @@ export async function main() {
             let exitCode = 0;
             console.log(`\n[main] Received ${signal}, shutting down...`);
             try {
+                if (versionCheckTimer)
+                    clearInterval(versionCheckTimer);
                 harnessReadinessRegistry.stop();
                 await daemon.stop();
                 await setupApiServer.close().catch(() => undefined);
@@ -2415,6 +2160,38 @@ export async function main() {
         throw error;
     }
     console.log(`[main] Daemon running. Dashboard: http://127.0.0.1:${config.apiPort}`);
+    // #641: start-time (and recurring) npm-registry version check. Fire-and-forget
+    // — never awaited, never rejects into boot. When a newer client is published
+    // it logs one line and back-fills the dashboard's update_available banner via
+    // `latestVersionHolder`. Opt out with JINN_VERSION_CHECK=0.
+    if (isVersionCheckEnabled(process.env)) {
+        const refreshVersionCheck = async () => {
+            try {
+                const latest = await fetchLatestVersion();
+                if (latest && isNewerVersion(getRunningVersion(), latest)) {
+                    // Only surface a value when the published latest is genuinely newer
+                    // than the running build. The dashboard banner derives directly from
+                    // a non-null `latestVersion`, so this keeps the log and the banner on
+                    // the same semver strictly-greater check.
+                    latestVersionHolder.current = latest;
+                    console.log(formatUpdateLogLine(latest));
+                }
+                else {
+                    // Not newer (equal, older, or unfetchable) — clear any prior value so
+                    // a stale tick can't linger as a false upgrade signal.
+                    latestVersionHolder.current = null;
+                }
+            }
+            catch {
+                // Advisory only — a registry hiccup must never disturb the daemon.
+            }
+        };
+        void refreshVersionCheck();
+        versionCheckTimer = setInterval(() => {
+            void refreshVersionCheck();
+        }, VERSION_CHECK_INTERVAL_MS);
+        versionCheckTimer.unref();
+    }
     return {
         schemaVersion: 1,
         generatedAt: new Date().toISOString(),