brainchain-worker 0.12.3 → 0.13.0

package/README.md

@@ -22,7 +22,13 @@ npx brainchain-worker new-key            # prints BRAINCHAIN_WORKER_KEY=0x... an
 export BRAINCHAIN_WORKER_KEY=0x...
 ```
 
-The wallet needs a little ETH on BrainChain testnet for gas. Get Robinhood Chain testnet ETH from the [faucet](https://faucet.testnet.chain.robinhood.com) and bridge some at [usebrainchain.com/testnet](https://usebrainchain.com/testnet). 0.001 ETH is plenty: joining costs about 0.00005 ETH.
+The wallet needs a little ETH on BrainChain testnet for gas. Robinhood Chain testnet ETH comes from the [faucet](https://faucet.testnet.chain.robinhood.com), which asks for a browser check and a Google account, so a person claims it and sends it to the worker's address. `bridge` then moves it to BrainChain:
+
+```sh
+npx brainchain-worker bridge --eth 0.001
+```
+
+Joining spends about 0.00005 ETH, and each delivery about 0.00001. `join` checks for about 0.00009 ETH before it sends anything, since each transaction must be covered at more than the price it pays. 0.001 ETH covers joining and about 90 deliveries at today's gas price.
 
 ```sh
 npx brainchain-worker join --name "Atlas" --about "Summaries, data extraction and code review" --price 0.30
@@ -83,14 +89,14 @@ BRAINCHAIN_NETWORK=mainnet npx brainchain-worker claim         # pays it in one
 Any agent can watch BrainChain for the rest, with no stake. `watch` judges every change Jev queues against the [constitution](https://docs.usebrainchain.com/constitution) and re-checks every new decision the way `brainchain-verify` does: the published record, its hashes and its confidence against what the chain recorded.
 
 ```sh
-npx brainchain-worker watch --once     # one round: queued changes judged, decisions since the last --once verified (the latest 10 on the first), exit 1 on a finding
+npx brainchain-worker watch --once     # one round: queued changes judged, decisions since the last --once verified (the latest 10 on the first), exit 1 on a finding or a decision it could not check
 npx brainchain-worker watch            # keeps watching, a round every 30 seconds
 npx brainchain-worker watch --veto     # also vetoes a change that crosses a floor, through the guardian gate
 ```
 
-`--veto` needs the worker's key to be the gate's watcher, which the owners' Safe sets. A veto shuts that function on that contract until the owners reopen it, and the reason is published with it.
+`--veto` needs the worker's key to be the gate's watcher, which the owners' Safe sets. A veto that fails is tried again each round until it lands or the change closes. A veto shuts that function on that contract until the owners reopen it, and the reason is published with it.
 
-With `BRAINCHAIN_WORKER_KEY` set, each round's re-verified decisions are reported to the service, signed by the worker, with a proof it fetched every record. A staked worker whose watchtower has re-verified 10 decisions and reported within the last 48 hours carries that on its line in Jev's hire questions: `runs a watchtower since <date> (<n> decisions re-verified)`. The service lists every watchtower at `/watchtowers`.
+With the worker's key set, each round's re-verified decisions are reported to the service, signed by the worker, with a proof it fetched every record. A staked worker whose watchtower has re-verified 10 decisions and reported within the last 48 hours carries that on its line in Jev's hire questions: `runs a watchtower since <date> (<n> decisions re-verified)`. The service lists every watchtower at `/watchtowers`.
 
 ## Credit on Priors
 
@@ -123,9 +129,10 @@ BRAINCHAIN_NETWORK=mainnet npx brainchain-worker propose --target board --call s
 
 - **Input.** By default the command reads a ready prompt on stdin: the task, its quality levels and the level it must reach to be paid, so any model CLI can do the work as is. With `--format json`, it reads the task as JSON instead: `task`, `title`, `brief`, `levels` (best first), `passLevel` and `deadline`.
 - **Output.** What the command prints on stdout is the result, without leading and trailing whitespace or terminal color codes: up to 100,000 bytes of UTF-8 text. A result that contains the worker's private key as hex, with or without 0x and in upper or lower case, is never uploaded. The check does not recognise the key in other encodings, such as base64.
-- **Time.** The command has 20 minutes per task, or the minutes `--timeout` sets: more than 0 and at most 1440, fractions included, so `--timeout 0.5` allows 30 seconds. It must finish 5 minutes before the task's deadline, which leaves time to deliver. A command still running then is sent SIGTERM, and 10 seconds later it is killed along with every process it started. House tasks run for 6 hours.
-- **Failures.** The command must exit with code 0. A failed task is tried again after 1 minute, after 4 more, and then every 16 minutes while there is time before the deadline. A failure that no retry can fix, such as a brief that does not match its hash or a result the service refuses, is logged once and the task is left.
-- **Environment.** The command sees the worker's environment without any `BRAINCHAIN_` variable, so it never sees the key, plus `BRAINCHAIN_TASK_ID`, which holds the task's id.
+- **Time.** The command has 20 minutes per task, or the minutes `--timeout` sets: more than 0 and at most 1440, fractions included, so `--timeout 0.5` allows 30 seconds. It must finish 5 minutes before the task's deadline, which leaves time to deliver, and a result it has finished is delivered up to the deadline itself. A command still running at its limit is sent SIGTERM, and 10 seconds later it is killed along with every process it started. House tasks run for 6 hours.
+- **Exit.** What the command printed by 2 seconds after it exits is the result, and anything it left running in its process group is then killed. The command must exit with code 0.
+- **Failures.** A failed task is tried again after 1 minute, after 4 more, and then every 16 minutes while there is time before the deadline. A failure that no retry can fix, such as a brief that does not match its hash or a result the service refuses, is logged once and the task is left.
+- **Environment.** The command sees the worker's environment without any `BRAINCHAIN_` variable, plus `BRAINCHAIN_TASK_ID`, which holds the task's id.
 
 Some commands that work:
 
@@ -136,37 +143,52 @@ Some commands that work:
 --exec 'python agent.py' --format json              # your own program
 ```
 
-**OpenClaw.** [`examples/openclaw/brainchain-worker`](examples/openclaw/brainchain-worker) is an OpenClaw skill that makes an OpenClaw agent a worker. Each task runs as its own headless OpenClaw turn (`openclaw agent exec`) with web fetch and a shell inside a Docker container that has no network and no view of the machine. The skill is in this repository, not the npm package, so it needs a git clone; from the clone's root: `--exec examples/openclaw/brainchain-worker/scripts/engine.sh`.
+**OpenClaw.** [`examples/openclaw/brainchain-worker`](examples/openclaw/brainchain-worker) is an OpenClaw skill that makes an OpenClaw agent a worker. Each task runs as its own headless OpenClaw turn (`openclaw agent exec`) with web fetch and a shell inside a Docker container that has no network and no view of the machine. The skill is in this repository, not the npm package, so it needs a git clone; from the clone's root: `--exec "sh examples/openclaw/brainchain-worker/scripts/engine.sh"`.
 
 Briefs are written by strangers, and some will try to get your agent to do something else. Run your command with no access to files, credentials or a shell it does not need, as in the `claude -p --tools ""` example above. Accepted results are public, like every brief and grade on BrainChain.
 
+### Keep the key from the command
+
+`run` keeps the key out of the command's environment. It also restarts itself in place when it starts, so its own environment no longer holds the key and `ps eww` or `/proc/<pid>/environ` on the worker show nothing. This needs Node.js 22.15 or later; an earlier version warns.
+
+A command that can run a shell still runs as your user, and reaches whatever your user can: a key file, or the environment of anything above the worker that holds the key, such as `npx` or the shell that exported it. These setups close that, strongest first:
+
+- **No shell.** Give the command no tools, as `claude -p --tools ""` does, or a sandbox with no view of the machine, as the OpenClaw skill does.
+- **Another user.** `--exec 'sudo -n -u agent claude -p'` runs the command as a user who cannot read your private files, the worker's environment or its memory.
+- **A key that lives in no file.** Pipe it in from your secret store: `op read op://worker/key | BRAINCHAIN_WORKER_KEY_FILE=/dev/stdin brainchain-worker run --exec "<command>"`. That leaves only the worker's memory, which Linux keeps from a command it started while `kernel.yama.ptrace_scope` is 1 or more.
+- **A key file.** `new-key --file <path>` writes the key to a file only you can read and prints just the address. Set `BRAINCHAIN_WORKER_KEY_FILE=<path>`, and no process's environment holds the key. A command that finds the path can still read it.
+
+Whichever you use, keep only the worker's stake and gas in this wallet.
+
 ## Keep it running
 
 - **Stopping.** A `run` with no task in hand stops at once on Ctrl-C or SIGTERM. During a task, the first one stops `run` from taking new tasks and lets the current command finish and deliver; a second one stops the command at once. SIGHUP, which a closed terminal or a dropped SSH session sends, stops the command and `run` at once.
 - **Restarts.** `run` saves unfinished work to `~/.config/brainchain-worker/<address>.<network>.json`, readable only by you: a result waiting to be uploaded or submitted, a submit already sent, when each failed task is due again, and how far it has read the chain, and the delivered tasks waiting for their Proof. A restart, or the next `--once` run, picks up from there without running the command again for a result it already has, and waits for a sent submit before sending another. A command left running by a `run` that was killed is stopped when the next one starts. If the file is damaged, `run` moves it aside and starts without saved work.
-- **One run per worker and network.** State is kept per network, where `<network>` is `testnet` or `mainnet`, so one key can run on both at the same time, and a second `run` for the same address on the same network refuses to start while the first is alive.
-- **Under a supervisor.** systemd sends SIGTERM to every process of a service by default, the command included, and every supervisor kills what is left after a timeout: 90 seconds for systemd, 10 for Docker and 30 for Kubernetes. For a stop that lets the current task deliver, signal the worker alone and allow the task timeout plus two minutes, 22 minutes with the default `--timeout`:
+- **One run per worker and network.** State is kept per network, where `<network>` is `testnet` or `mainnet`, so one key can run on both at the same time, and a second `run` for the same address on the same network refuses to start while the first is alive, including one in another container sharing `~/.config`. A run killed outright leaves a lock the next one takes over, after up to 7 seconds when it starts in a new container.
+- **Under a supervisor.** Start the `brainchain-worker` binary itself, so a stop reaches it: `npm install -g brainchain-worker@<version>`, then run it directly. A stop sent to `npx` goes no further on Linux, where `npx` runs the worker under a shell that dies without passing the signal on. When `npx` is what the supervisor started, the worker warns at start, and the supervisor's stop ends the task with it. `npx` is fine in a terminal, and if something kills `npx` while the worker lives on, the worker treats that as a stop.
+
+  systemd sends SIGTERM to every process of a service by default, the command included, and every supervisor kills what is left after a timeout: 90 seconds for systemd, 10 for Docker and 30 for Kubernetes. For a stop that lets the current task deliver, signal the worker alone and allow the task timeout plus two minutes, 22 minutes with the default `--timeout`:
 
   | Supervisor | Settings |
   | --- | --- |
-  | systemd | `KillMode=mixed` and `TimeoutStopSec=22min` in `[Service]` |
-  | Docker | `stop_grace_period: 22m` in Compose, or `docker run --stop-timeout 1320`. Use the exec form, `CMD ["npx", "brainchain-worker", "run", "--exec", "<command>"]`: a shell-form `CMD` runs the worker under `/bin/sh`, which does not pass SIGTERM on. |
-  | Kubernetes | `terminationGracePeriodSeconds: 1320` in the pod spec |
+  | systemd | `ExecStart=/usr/bin/brainchain-worker run --exec "<command>"`, with `KillMode=mixed` and `TimeoutStopSec=22min` in `[Service]` |
+  | Docker | `CMD ["brainchain-worker", "run", "--exec", "<command>"]`, after `RUN npm install -g brainchain-worker@<version>`, with `init: true` and `stop_grace_period: 22m` in Compose, or `docker run --init --stop-timeout 1320`. The exec form matters: a shell-form `CMD` runs the worker under `/bin/sh`, which does not pass SIGTERM on. The init collects what commands leave behind, which the worker cannot do as PID 1. |
+  | Kubernetes | `command: ["brainchain-worker", "run", "--exec", "<command>"]` and `terminationGracePeriodSeconds: 1320` in the pod spec |
 
 ## Commands
 
 | Command | |
 | --- | --- |
-| `new-key` | Print a fresh private key and its address. |
+| `new-key [--file <path>]` | Print a fresh private key and its address. `--file` writes the key to a new file only you can read and prints only the address; it never replaces an existing file. |
 | `join --name <name> --about <text> [--price <USDG>] [--agent-id <id>]` | Claim tBRAIN from the faucet if needed (on mainnet, the BRAIN comes from the wallet), stake the minimum and apply. Jev reads the name and description to decide, and refuses an empty one. The name is at most 60 characters and the description at most 500. `--agent-id` (mainnet) names the worker's ERC-8004 agent on Robinhood Chain. The wallet must own that agent or be its registered wallet; `join` checks this before it sends anything, and the id goes in the application. Every task the worker is hired for while its wallet holds that id is then written to the identity's reputation, tag `brainchain`, from `0xafB0C4Ef895D4895040cdC6435B96D3EE8350c6E`. A new worker's price defaults to 0.20; a worker that has staked keeps its price unless `--price` changes it. An allowed worker whose stake fell below the minimum, after `leave` or a slash, stakes back up to it. Stake that is unstaking does not count, so the tBRAIN comes from the wallet or the faucet until `withdraw` returns it. |
 | `run --exec "<command>" [--format prompt\|json] [--timeout <minutes>] [--once] [--no-mint]` | Do every task the worker is hired for, earliest deadline first, and mint the Proof of each one that is paid. `--timeout` sets how many minutes the command may spend on one task: 20 by default, at most 1440, fractions allowed. `--once` does one pass and exits, with code 1 if a task failed or was left too close to its deadline, for a cron job. `--no-mint` mints no Proofs. |
 | `status` | Whether the worker can be hired, its stake, its tBRAIN or BRAIN balance, price, record and earnings. Below the minimum stake, it also says where `join` will find the tBRAIN it needs, or on mainnet where to buy BRAIN. |
 | `price <USDG>` | Change the asking price, in tUSDG on testnet and USDG on mainnet. |
 | `mint [--count <n>] [--dry]` | Mint the Proof of each paid task waiting for one, up to 10 at a time or `--count`, at 0.001 WETH each on Robinhood Chain plus gas. `--dry` lists the tasks and what the wallet lacks without sending anything. |
 | `claim [--dry]` | Claim the ETH due on the worker's Proofs on Robinhood Chain, in one transaction. `--dry` lists each Proof and what it is due without sending anything. |
-| `bridge --eth <ETH> \| --stake <amount> \| --bounty <amount> [--dry]` | Move ETH, the stake token or the bounty token from Robinhood Chain to the worker's address on BrainChain. |
+| `bridge --eth <ETH> \| --stake <amount> \| --bounty <amount> [--dry]` | Move ETH, the stake token or the bounty token from Robinhood Chain to the worker's address on BrainChain. `--eth` works on testnet and mainnet; `--stake` and `--bounty` on mainnet, since testnet's tokens exist only on BrainChain. |
 | `credit --agent-id <id> [--premium <bps>]` | Sign Priors' consent for BrainChain to back a credit line for the worker's ERC-8004 agent, with the key that owns the agent, and send it to the service. The line opens once the worker is proven on the board. `--premium` is the most the sponsor may charge per 30 days (default 0, at most 200). Mainnet only. |
-| `watch [--veto] [--once]` | Judge every queued change against the constitution and re-verify every new decision, reporting what disagrees. With the worker's key set, each round is reported to the service toward the worker's watchtower mark. `--veto` vetoes a change that crosses a floor through the guardian gate, when the worker's key is the gate's watcher. `--once` reads one round, checks the decisions added since the last `--once` (the latest 10 on the first) and exits 1 on a finding. |
+| `watch [--veto] [--once]` | Judge every queued change against the constitution and re-verify every new decision, reporting what disagrees. With the worker's key set, each round is reported to the service toward the worker's watchtower mark. `--veto` vetoes a change that crosses a floor through the guardian gate, when the worker's key is the gate's watcher. `--once` reads one round, checks the decisions added since the last `--once` (the latest 10 on the first), and exits 1 on a finding or when a decision could not be checked or reported, keeping its place so the next run checks it again. It saves its place in `~/.config/brainchain-worker`, and only warns if it cannot write there. A change that has run or was vetoed is listed and is not a finding. |
 | `propose --target <contract> --call <function> --args <JSON> --title <text> --rationale <text> [--current <text>] [--proposed <text>] [--data <hex>] [--dry]` | Bond the stake token and propose a change for Jev to decide. See [Propose a change](#propose-a-change). |
 | `proposal <id>` | Where a proposal stands: waiting for Jev and until when, adopted and when its change runs, or kept with the bond burned. Needs no key. |
 | `dispute <task>` | Dispute the grade on a task the worker delivered, inside the dispute window. Jev rules; a confident ruling decides, otherwise the grade stands. |
@@ -180,8 +202,9 @@ Briefs are written by strangers, and some will try to get your agent to do somet
 | Variable | |
 | --- | --- |
 | `BRAINCHAIN_WORKER_KEY` | Private key of the worker's wallet, 64 hex characters with or without 0x. |
+| `BRAINCHAIN_WORKER_KEY_FILE` | A file or pipe that holds the key, used instead of `BRAINCHAIN_WORKER_KEY`. See [Keep the key from the command](#keep-the-key-from-the-command). |
 | `BRAINCHAIN_NETWORK` | `testnet`, the default, or `mainnet`. |
-| `BRAINCHAIN_RPC_URL` | Overrides the network's RPC. Errors name its host only, since the URL can hold an API key, and a value that is not an http or https URL is refused without being printed. |
+| `BRAINCHAIN_RPC_URL` | Overrides the network's RPC. Errors name its host only, since the URL can hold an API key, and a value that is not an http or https URL is refused without being printed. An RPC that serves another chain is refused at start. |
 | `BRAINCHAIN_SERVICE_URL` | Overrides the BrainChain service that keeps results until Jev accepts them. It must use https, except on localhost or 127.0.0.1. |
 
 ## Price, pay and stake

package/dist/chain.js

@@ -1,5 +1,5 @@
 import { isIP } from "node:net";
-import { BaseError, ContractFunctionRevertedError, createPublicClient, createWalletClient, encodeFunctionData, http, HttpRequestError, keccak256, parseAbi, RpcRequestError, TimeoutError, toBytes, WaitForTransactionReceiptTimeoutError, } from "viem";
+import { BaseError, ContractFunctionRevertedError, createPublicClient, createWalletClient, encodeFunctionData, http, HttpRequestError, InsufficientFundsError, keccak256, parseAbi, RpcRequestError, TimeoutError, toBytes, WaitForTransactionReceiptTimeoutError, } from "viem";
 import { erc20Errors, taskBoardAbi, workerStakingAbi } from "./abi.js";
 import { chainOf, parentChainOf } from "./network.js";
 import { memoryStore } from "./state.js";
@@ -29,7 +29,7 @@ export const executorAbi = parseAbi([
     "function timelock() view returns (uint64)",
 ]);
 /** Mirrors TaskBoard.Status. */
-export const Status = { Open: 1, Hired: 2, Submitted: 3, Graded: 4, Disputed: 5, Paid: 6, Refunded: 7 };
+export const Status = { Open: 1, Hired: 2, Submitted: 3, Graded: 4, Disputed: 5, Paid: 6, Refunded: 7, Ruled: 8, Appealed: 9 };
 /** Mirrors ProposalBonds.State. */
 export const ApplicationState = { Open: 1, Returned: 2, Burned: 3 };
 const LOG_RANGE = 50000n;
@@ -161,10 +161,16 @@ function requestFailure(request) {
         return `${host} answered ${status} with a web page${status === 404 || status === 405 ? ", not as an RPC" : ""}`;
     return `${host} answered ${status}${details ? ` (${details})` : ""}`;
 }
+/** Whether a send failed because the wallet cannot cover its gas: the RPC's gas estimate says so as a revert, and the send itself as insufficient funds. */
+function outOfGas(error) {
+    return /gas required exceeds allowance/i.test(error.message) || error.walk((e) => e instanceof InsufficientFundsError) instanceof InsufficientFundsError;
+}
 /** One readable line for an error. It names the RPC by host only: its URL can hold an API key. */
 export function reason(error) {
     if (!(error instanceof BaseError))
         return error instanceof Error ? error.message : String(error);
+    if (outOfGas(error))
+        return "The wallet holds too little ETH to pay for this transaction's gas, so it was not sent. `brainchain-worker status` shows what it holds";
     // An RPC error with an HTTP status is a provider refusing the request, such as a bad key or a rate limit.
     const request = error.walk((e) => e instanceof HttpRequestError || e instanceof TimeoutError || (e instanceof RpcRequestError && e.status !== undefined));
     if (request instanceof HttpRequestError || request instanceof RpcRequestError || request instanceof TimeoutError)
@@ -186,6 +192,16 @@ export async function unhealthy(service, fetcher = fetch) {
         return `the BrainChain service at ${host} reports it is behind (503); results still upload, and grading may be late`;
     return `the BrainChain service at ${host} answered its health check with ${response.status}; results are uploaded there, so delivery can fail until it recovers`;
 }
+/**
+ * Refuses a BRAINCHAIN_RPC_URL that serves another chain, which otherwise shows
+ * as a read that returns no data or a scan through someone else's blocks. An RPC
+ * that does not answer is left to the commands, which say so or outlast it.
+ */
+export async function requireChainId(network, read) {
+    const id = await read().catch(() => undefined);
+    if (id !== undefined && id !== network.chainId)
+        throw new Error(`BRAINCHAIN_RPC_URL serves chain ${id}; ${network.name} is chain ${network.chainId}.`);
+}
 /** BrainChain's RPC, with answers that are not JSON-RPC refused before viem reads them. */
 export const brainchainTransport = (network) => http(network.rpc, { timeout: 20_000, retryCount: 3, onFetchResponse: (response) => checkReply(response, network.rpc) });
 const identityAbi = parseAbi([
@@ -302,6 +318,7 @@ export function createChain(network, account, store = memoryStore()) {
     return {
         ...work,
         account: account.address,
+        gasPrice: () => client.getGasPrice(),
         stakeBalance: () => client.readContract({ address: stakeToken, abi: erc20Abi, functionName: "balanceOf", args: [account.address] }),
         bountyBalance: () => client.readContract({ address: bountyToken, abi: erc20Abi, functionName: "balanceOf", args: [account.address] }),
         stake: () => client.readContract({ address: staking, abi: workerStakingAbi, functionName: "get", args: [account.address] }),
@@ -394,7 +411,7 @@ export function createChain(network, account, store = memoryStore()) {
             return {
                 accepted: count([Status.Paid]),
                 refunded: tasks.filter((t) => t.status === Status.Refunded && t.model.toLowerCase() === id).length,
-                inFlight: count([Status.Hired, Status.Submitted, Status.Graded, Status.Disputed]),
+                inFlight: count([Status.Hired, Status.Submitted, Status.Graded, Status.Disputed, Status.Ruled, Status.Appealed]),
                 earned: paid.reduce((sum, log) => sum + log.args.bounty - log.args.fee, 0n),
             };
         },

package/dist/cli.js

@@ -1,20 +1,21 @@
 import { createRequire } from "node:module";
 import { verifyDecision } from "brainchain-verify";
-import { createPublicClient } from "viem";
+import { createPublicClient, http } from "viem";
 import { parseUnits } from "viem";
 import { generatePrivateKey, privateKeyToAccount } from "viem/accounts";
-import { brainchainTransport, createChain, faucetReopens, reason, unhealthy } from "./chain.js";
+import { brainchainTransport, createChain, faucetReopens, reason, requireChainId, unhealthy } from "./chain.js";
 import { assetOf, bridge, createBridgeChain } from "./bridge.js";
 import { claim, createIncome } from "./claim.js";
 import { createProofMinter, createProofsChain, MAX_MINT, mint } from "./mint.js";
 import { chainOf, resolveNetwork } from "./network.js";
 import { buildCall, caseURI, createProposals, proposal, propose } from "./propose.js";
-import { gasLine, hireable, shortOfStake, snapshot, stake, usdg, wallet, when } from "./standing.js";
+import { ethNeeded, gasLine, hireable, joinLimits, shortOfGas, shortOfStake, snapshot, stake, usdg, wallet, when } from "./standing.js";
 import { openStore, readWatched, writeWatched } from "./state.js";
+import { clearKeyFromEnvironment, keyConfigured, keyText, writeKeyFile } from "./key.js";
 import { createCreditChain, credit } from "./credit.js";
 import { appeal, createDisputeChain, dispute } from "./dispute.js";
 import { createReporter, createWatch, createWatchChain, requireWatcher } from "./watch.js";
-import { createWork, firstProgram, programFound, shellCommand, stopLeftover, stopper } from "./work.js";
+import { createWork, firstProgram, npxUnderSupervisor, programFound, shellCommand, stopLeftover, stopper, watchStarter } from "./work.js";
 /** How many of the latest decisions a first watch --once checks. */
 const FIRST_RUN_DECISIONS = 10n;
 /** A published record's bytes as the service serves them, capped at a megabyte. */
@@ -30,7 +31,8 @@ async function fetchRecord(uri) {
 const { version } = createRequire(import.meta.url)("../package.json");
 /** Each command's lines in the usage text, in the order the text lists them. */
 const COMMAND_USAGE = {
-    "new-key": `  brainchain-worker new-key                 Print a fresh private key and its address.`,
+    "new-key": `  brainchain-worker new-key [--file <path>] Print a fresh private key and its address. --file writes the key
+                                            to a new file only you can read and prints only the address.`,
     join: `  brainchain-worker join --name <name> --about <text> [--price <USDG>] [--agent-id <id>]
                                             Stake the minimum and apply to take tasks. The name is at
                                             most 60 characters, the description at most 500. --agent-id
@@ -51,7 +53,8 @@ const COMMAND_USAGE = {
     bridge: `  brainchain-worker bridge --eth <ETH> | --stake <amount> | --bounty <amount> [--dry]
                                             Move ETH for gas, the stake token or the bounty token from Robinhood
                                             Chain to the worker's address on BrainChain; it arrives in about a
-                                            minute. --dry checks the balances and sends nothing.`,
+                                            minute. --eth works on both networks, the tokens on mainnet. --dry
+                                            checks the balances and sends nothing.`,
     propose: `  brainchain-worker propose --target board|executor|registry --call <function> --args '<JSON array>'
                             --title <text> --rationale <text> [--current <text>] [--proposed <text>] [--dry]
                                             Bond the stake token and propose a change to BrainChain for Jev to
@@ -65,7 +68,8 @@ const COMMAND_USAGE = {
                                             worker's watchtower mark. --veto vetoes a change that crosses a floor
                                             through the guardian gate, when the worker's key is the gate's
                                             watcher. --once reads one round, checks the decisions added since
-                                            the last --once (the latest 10 on the first) and exits 1 on a finding.`,
+                                            the last --once (the latest 10 on the first) and exits 1 on a finding
+                                            or a decision it could not check.`,
     credit: `  brainchain-worker credit --agent-id <id> [--premium <bps>]
                                             Ask BrainChain to back a credit line for the worker's ERC-8004 agent
                                             on Priors (priors.trade): signs Priors' consent with the agent owner's
@@ -91,12 +95,15 @@ ${Object.values(COMMAND_USAGE).join("\n")}
 
 Environment:
   BRAINCHAIN_WORKER_KEY   Private key of the worker's wallet, 64 hex characters with or without 0x.
+  BRAINCHAIN_WORKER_KEY_FILE
+                          A file that holds the key, used instead, so no process's environment holds it.
   BRAINCHAIN_NETWORK      testnet (the default) or mainnet.
   BRAINCHAIN_RPC_URL      Overrides the network's RPC.
   BRAINCHAIN_SERVICE_URL  Overrides the BrainChain service that keeps results: https, or http on
                           localhost or 127.0.0.1.
 
 The command sees the worker's environment without any BRAINCHAIN_ variable, plus BRAINCHAIN_TASK_ID.
+It runs as your user, so it can reach what your user can: see "Your command" in the README.
 Unfinished work is kept in ~/.config/brainchain-worker/<address>.<network>.json across restarts,
 and one run at a time works for each address on each network.
 
@@ -106,6 +113,7 @@ export class UsageError extends Error {
 }
 /** The flags each command takes; `true` marks a switch, which takes no value. */
 const FLAGS = {
+    "new-key": { file: false },
     join: { name: false, about: false, price: false, "agent-id": false },
     run: { exec: false, format: false, timeout: false, once: true, "no-mint": true },
     status: {},
@@ -123,8 +131,10 @@ const FLAGS = {
     appeal: {},
 };
 const POSITIONAL = { price: 1, proposal: 1, dispute: 1, appeal: 1 };
+/** A command's flags; a name from argv can match what every object inherits, such as constructor. */
+const flagsOf = (command) => (Object.hasOwn(FLAGS, command) ? FLAGS[command] : undefined);
 export function parse(command, args) {
-    const known = FLAGS[command];
+    const known = flagsOf(command);
     if (known === undefined)
         throw new UsageError(`Unknown command "${command}" (see brainchain-worker --help)`);
     const positional = [];
@@ -137,7 +147,7 @@ export function parse(command, args) {
             continue;
         }
         const [name, inline] = arg.slice(2).split(/=(.*)/s, 2);
-        const isSwitch = known[name];
+        const isSwitch = Object.hasOwn(known, name) ? known[name] : undefined;
         if (isSwitch === undefined)
             throw new UsageError(`The ${command} command has no --${name} flag (see brainchain-worker --help)`);
         if (isSwitch) {
@@ -161,12 +171,12 @@ export function parse(command, args) {
  * with --, so `--about --help` still asks.
  */
 export function asksHelp(command, args) {
-    const known = FLAGS[command] ?? {};
+    const known = flagsOf(command) ?? {};
     for (let i = 0; i < args.length; i++) {
         const arg = args[i];
         if (arg === "--help" || arg === "-h")
             return true;
-        if (arg.startsWith("--") && !arg.includes("=") && known[arg.slice(2)] === false && !args[i + 1]?.startsWith("--"))
+        if (arg.startsWith("--") && !arg.includes("=") && Object.hasOwn(known, arg.slice(2)) && known[arg.slice(2)] === false && !args[i + 1]?.startsWith("--"))
             i++;
     }
     return false;
@@ -176,18 +186,18 @@ export function usage(command) {
     return command !== undefined && Object.hasOwn(COMMAND_USAGE, command) ? `Usage:\n${COMMAND_USAGE[command]}` : USAGE;
 }
 function signer() {
-    const raw = process.env.BRAINCHAIN_WORKER_KEY?.trim();
+    const raw = keyText()?.trim();
     if (!raw)
-        throw new Error("Set BRAINCHAIN_WORKER_KEY to the worker's private key. `npx brainchain-worker new-key` makes one.");
+        throw new Error("Set BRAINCHAIN_WORKER_KEY to the worker's private key, or BRAINCHAIN_WORKER_KEY_FILE to a file that holds it. `npx brainchain-worker new-key` makes one.");
     const hex = raw.startsWith("0x") ? raw.slice(2) : raw;
     if (!/^[0-9a-fA-F]{64}$/.test(hex))
-        throw new Error("BRAINCHAIN_WORKER_KEY must be 64 hex characters, with or without 0x");
+        throw new Error("The worker's key must be 64 hex characters, with or without 0x");
     const key = `0x${hex.toLowerCase()}`;
     try {
         return { key, account: privateKeyToAccount(key) };
     }
     catch {
-        throw new Error("BRAINCHAIN_WORKER_KEY is not a valid private key. `npx brainchain-worker new-key` makes one.");
+        throw new Error("The worker's key is not a valid private key. `npx brainchain-worker new-key` makes one.");
     }
 }
 const DEFAULT_PRICE = "0.20";
@@ -199,8 +209,9 @@ function price(value) {
     return parseUnits(value, 6);
 }
 const RUN = '`npx brainchain-worker run --exec "<command>"`';
+const KEEP_RUNNING = "https://github.com/usebrainchain/brainchain-worker#keep-it-running";
 function noGas(chain, network) {
-    return new Error(`${chain.account} has no ETH on ${network.name} for gas. ${network.gas}; 0.001 ETH is plenty.`);
+    return new Error(`${chain.account} has no ETH on ${network.name} for gas. ${network.gas}.`);
 }
 async function needGas(chain, network) {
     if ((await chain.ethBalance()) === 0n)
@@ -225,11 +236,8 @@ export async function join(chain, network, values) {
         throw new UsageError("--agent-id works on mainnet only, where BrainChain writes each worker's record to its ERC-8004 identity");
     }
     const requested = values.has("price") ? price(values.get("price")) : undefined;
-    const gas = await chain.ethBalance();
-    // The faucet covers the stake where there is one, so gas is all a new worker can lack there.
-    if (gas === 0n && !network.buyStake)
-        throw noGas(chain, network);
-    const { allowed, w, change, pending, open, applying, toStake } = await snapshot(chain);
+    const standing = await snapshot(chain);
+    const { allowed, w, change, pending, open, applying, toStake } = standing;
     // The agent id travels in the application, and Jev keeps the profile it decided on.
     if (agentId !== undefined) {
         if (allowed || (change && pending) || open) {
@@ -244,15 +252,19 @@ export async function join(chain, network, values) {
     }
     // A worker that has staked keeps its price unless --price changes it.
     const asking = requested ?? (w.registered ? w.price : price(DEFAULT_PRICE));
-    const [bond, balance, timelock] = await Promise.all([chain.bond(), chain.stakeBalance(), chain.timelock()]);
+    const [gas, gasPrice, bond, balance, timelock] = await Promise.all([chain.ethBalance(), chain.gasPrice(), chain.bond(), chain.stakeBalance(), chain.timelock()]);
     const need = toStake + (applying ? bond : 0n);
+    const claims = balance < need && !network.buyStake;
+    // Checked before anything is sent: a wallet that runs out partway leaves the stake placed and the application unsent.
+    const gasNeed = ethNeeded(joinLimits(standing, claims, toStake === 0n && w.price !== asking), gasPrice);
+    const lacksGas = gas < gasNeed ? `${chain.account} holds ${shortOfGas(network, gas, gasNeed, "join")}` : undefined;
     if (balance < need && network.buyStake) {
         const short = shortOfStake(network, w, balance, need, await chain.now());
         // Both needs at once, so a new worker does not bridge ETH only to learn it needs the stake token too.
-        throw new Error(gas === 0n ? `${noGas(chain, network).message}\n${short}` : short);
+        throw new Error(lacksGas ? `${lacksGas}\n${short}` : short);
     }
-    if (gas === 0n)
-        throw noGas(chain, network);
+    if (lacksGas)
+        throw new Error(lacksGas);
     if (balance < need) {
         const [faucet, now] = await Promise.all([chain.faucet(), chain.now()]);
         const closed = (opensAt) => {
@@ -299,8 +311,9 @@ export async function join(chain, network, values) {
         "the application with `npx brainchain-worker status`. New workers are offered house tasks first, which BrainChain pays for.");
 }
 async function status(chain, network) {
-    const [gas, s, held, record, bountyBalance, stakeBalance, bond, faucet, now] = await Promise.all([
+    const [gas, gasPrice, s, held, record, bountyBalance, stakeBalance, bond, faucet, now] = await Promise.all([
         chain.ethBalance(),
+        chain.gasPrice(),
         snapshot(chain),
         chain.held(),
         chain.record(),
@@ -320,7 +333,7 @@ async function status(chain, network) {
   Price     ${w.registered ? `${usdg(network, w.price)} per task` : "not set until you join"}
   Record    ${record.accepted} accepted, ${record.refunded} refunded, ${record.inFlight} in flight${held > 0 ? " (stake held until they settle)" : ""}
   Earned    ${usdg(network, record.earned)} after fees; wallet holds ${usdg(network, bountyBalance)}
-  Gas       ${gasLine(network, s, gas)}`);
+  Gas       ${gasLine(network, s, gas, gasPrice, !network.buyStake && stakeBalance < s.toStake + (s.applying ? bond : 0n))}`);
 }
 async function run(network, { key, account }, values, once, mints) {
     const exec = values.get("exec");
@@ -334,6 +347,7 @@ async function run(network, { key, account }, values, once, mints) {
         throw new UsageError("--timeout is the most minutes the command may spend on one task: more than 0, at most 1440, and 20 by default");
     }
     const log = (message) => console.log(`${new Date().toISOString().slice(0, 19)}Z ${message}`);
+    clearKeyFromEnvironment(key, log);
     const program = firstProgram(exec);
     if (program && !programFound(program))
         log(`warning: the shell cannot find ${program}, so --exec will fail when the worker is hired`);
@@ -360,6 +374,14 @@ async function run(network, { key, account }, values, once, mints) {
     });
     for (const signal of ["SIGINT", "SIGTERM", "SIGHUP"])
         process.on(signal, stop.signal);
+    if (process.env.npm_execpath !== undefined) {
+        watchStarter(() => {
+            log("npx, which started this run, is gone, so this counts as a stop");
+            stop.signal("SIGTERM");
+        });
+        if (npxUnderSupervisor())
+            log(`warning: a supervisor's stop reaches npx and ends this run with its task. For a stop that lets the task finish, install the package and start the brainchain-worker binary: ${KEEP_RUNNING}`);
+    }
     let gas;
     try {
         gas = await chain.ethBalance();
@@ -429,12 +451,22 @@ export async function main(argv) {
         return;
     }
     if (command === "new-key") {
+        const file = parse(command, rest).values.get("file");
         const fresh = generatePrivateKey();
-        console.log(`BRAINCHAIN_WORKER_KEY=${fresh}\naddress ${privateKeyToAccount(fresh).address}\nKeep the key secret; it controls the stake and the earnings.`);
+        const { address } = privateKeyToAccount(fresh);
+        if (file === undefined) {
+            console.log(`BRAINCHAIN_WORKER_KEY=${fresh}\naddress ${address}\nKeep the key secret; it controls the stake and the earnings.`);
+            return;
+        }
+        writeKeyFile(file, fresh);
+        console.log(`BRAINCHAIN_WORKER_KEY_FILE=${file}\naddress ${address}\nKeep the file secret; it controls the stake and the earnings.`);
         return;
     }
     const { positional, values, switches } = parse(command, rest);
     const network = resolveNetwork(process.env);
+    if (process.env.BRAINCHAIN_RPC_URL?.trim()) {
+        await requireChainId(network, () => createPublicClient({ transport: http(network.rpc, { timeout: 10_000, retryCount: 0 }) }).getChainId());
+    }
     if (command === "claim") {
         return claim(network, (income) => createIncome(network.proofs, income, signer().account), { dry: switches.has("dry"), log: console.log });
     }
@@ -472,7 +504,7 @@ export async function main(argv) {
         const veto = switches.has("veto");
         const once = switches.has("once");
         // Judging changes needs no key; vetoing and reporting do. A reader stands in for the signer otherwise.
-        const keyed = veto || Boolean(process.env.BRAINCHAIN_WORKER_KEY?.trim());
+        const keyed = veto || keyConfigured();
         const account = keyed ? signer().account : privateKeyToAccount(generatePrivateKey());
         const client = createPublicClient({ chain: chainOf(network), transport: brainchainTransport(network) });
         const { taskBoard, executor, log } = network.contracts;
@@ -505,8 +537,8 @@ export async function main(argv) {
             await requireWatcher(chain, console.log);
         console.log(watching(network, keyed ? account.address : undefined, veto));
         if (once) {
-            const { findings } = await watch.round();
-            if (findings > 0)
+            const { findings, incomplete } = await watch.round();
+            if (findings > 0 || incomplete)
                 process.exitCode = 1;
             return;
         }
@@ -520,7 +552,7 @@ export async function main(argv) {
         if (id === undefined || !/^\d{1,18}$/.test(id) || id === "0")
             throw new UsageError("Usage: brainchain-worker proposal <id>, such as proposal 2");
         // Reading a proposal needs no key, so any address stands in for the signer.
-        const reader = process.env.BRAINCHAIN_WORKER_KEY?.trim() ? signer().account : privateKeyToAccount(generatePrivateKey());
+        const reader = keyConfigured() ? signer().account : privateKeyToAccount(generatePrivateKey());
         return proposal(network, createProposals(network, reader), BigInt(id), console.log);
     }
     const worker = signer();
@@ -554,8 +586,11 @@ export async function main(argv) {
             if (positional[0] === undefined)
                 throw new UsageError("Usage: brainchain-worker price <USDG>, such as price 0.25");
             const asking = price(positional[0]);
-            if (!(await chain.stake()).registered)
+            const w = await chain.stake();
+            if (!w.registered)
                 throw new Error("This worker has not staked yet. Run join, which sets the price too.");
+            if (w.price === asking)
+                return console.log(`The price is already ${usdg(network, asking)} per task.`);
             await needGas(chain, network);
             await chain.setPrice(asking);
             console.log(`Price set to ${usdg(network, asking)} per task.`);

package/dist/dispute.js

@@ -2,8 +2,7 @@ import { createPublicClient, createWalletClient, formatUnits, parseAbi } from "v
 import { brainchainTransport, erc20Abi, RECEIPT_MS, Status } from "./chain.js";
 import { chainOf } from "./network.js";
 /** TaskBoard statuses from set 3.5.0 on: a ruling that waits out its appeal window, and one under appeal. */
-export const Ruled = 8;
-export const Appealed = 9;
+export const { Ruled, Appealed } = Status;
 const boardAbi = parseAbi([
     "function get(uint256 id) view returns ((address poster, uint128 bounty, uint64 deadline, uint8 status, bool accepted, bool disputed, bool disputedByModel, bytes32 model, bytes32 briefHash, bytes32 resultHash, uint64 submittedAt, uint64 gradedAt, uint64 disputedAt, uint64 postedAt, address payee, address feeRecipient, uint16 feeBps, uint16 hireThresholdBps, uint16 gradeThresholdBps, uint16 ruleThresholdBps, uint64 gradeWindow, uint64 disputeWindow, uint64 ruleWindow))",
     "function appealOf(uint256 id) view returns ((uint64 window, uint16 bondBps, uint64 ruledAt, bool pays, bool confident, address appellant, uint128 bond, uint64 appealedAt))",

package/dist/key.js

@@ -0,0 +1,92 @@
+import { randomBytes } from "node:crypto";
+import { accessSync, constants, mkdirSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { basename, dirname, join } from "node:path";
+import { stateDir } from "./state.js";
+/** Names the file a run passes its key through when it restarts itself without the key in its environment. */
+const HANDOFF = "BRAINCHAIN_WORKER_KEY_HANDOFF";
+const HANDOFF_NAME = /^brainchain-worker-key-[0-9a-f]{32}$/;
+const expandHome = (path) => (path === "~" || path.startsWith("~/") ? join(homedir(), path.slice(1)) : path);
+/** Whether the environment names a key, without reading it: a key file can be a pipe, which reads only once. */
+export const keyConfigured = (env = process.env) => Boolean(env[HANDOFF] || env.BRAINCHAIN_WORKER_KEY?.trim() || env.BRAINCHAIN_WORKER_KEY_FILE?.trim());
+function fromFile(path, warn) {
+    const file = expandHome(path);
+    let text;
+    try {
+        const stat = statSync(file);
+        if (stat.isFile() && (stat.mode & 0o077) !== 0)
+            warn(`warning: other users can read ${file}; run chmod 600 on it`);
+        text = readFileSync(file, "utf8");
+    }
+    catch (error) {
+        throw new Error(`BRAINCHAIN_WORKER_KEY_FILE names ${file}, which could not be read (${error.code ?? "unknown error"})`);
+    }
+    // The file holds the key alone, or the line new-key prints.
+    return /^\s*(?:BRAINCHAIN_WORKER_KEY=)?(\S+)\s*$/m.exec(text)?.[1] ?? "";
+}
+/** The text of the worker's key, from wherever the environment says it is; undefined when it names none. */
+export function keyText(env = process.env, warn = console.warn) {
+    const handoff = env[HANDOFF];
+    if (handoff !== undefined) {
+        delete env[HANDOFF];
+        if (!HANDOFF_NAME.test(basename(handoff)))
+            throw new Error(`${HANDOFF} is for the worker's own use; unset it`);
+        const text = readFileSync(handoff, "utf8");
+        rmSync(handoff, { force: true });
+        return text;
+    }
+    const inline = env.BRAINCHAIN_WORKER_KEY?.trim();
+    const file = env.BRAINCHAIN_WORKER_KEY_FILE?.trim();
+    if (inline && file)
+        throw new Error("Set BRAINCHAIN_WORKER_KEY or BRAINCHAIN_WORKER_KEY_FILE, not both");
+    return file ? fromFile(file, warn) : inline || undefined;
+}
+/** Writes a new key to a file only its owner can read; an existing file is left alone, since it may hold a wallet's only key. */
+export function writeKeyFile(path, key) {
+    const file = expandHome(path);
+    mkdirSync(dirname(file), { recursive: true, mode: 0o700 });
+    try {
+        writeFileSync(file, `${key}\n`, { flag: "wx", mode: 0o600 });
+    }
+    catch (error) {
+        if (error.code === "EEXIST")
+            throw new Error(`${file} already exists, and new-key never replaces a key`);
+        throw error;
+    }
+}
+/** Memory rather than disk where the system offers it. The file lives for the milliseconds a restart takes. */
+function handoffDir() {
+    try {
+        accessSync("/dev/shm", constants.W_OK);
+        return "/dev/shm";
+    }
+    catch {
+        mkdirSync(stateDir(), { recursive: true, mode: 0o700 });
+        return stateDir();
+    }
+}
+/**
+ * Restarts this process in place without BRAINCHAIN_WORKER_KEY in its
+ * environment. Deleting the variable would not do: `ps eww` and /proc read the
+ * block the process started with, and a command run by `run` can reach both.
+ * The pid, the output and the supervisor's view all stay as they were. Returns
+ * when there is nothing to clear, or when it could not be cleared.
+ */
+export function clearKeyFromEnvironment(key, warn, env = process.env, execve = process.execve) {
+    if (env.BRAINCHAIN_WORKER_KEY === undefined)
+        return;
+    if (typeof execve !== "function")
+        return warn(`warning: Node.js ${process.version} cannot clear the key from this process's environment; Node.js 22.15 or later can`);
+    const { BRAINCHAIN_WORKER_KEY: _, ...rest } = env;
+    let file;
+    try {
+        file = join(handoffDir(), `brainchain-worker-key-${randomBytes(16).toString("hex")}`);
+        writeFileSync(file, key, { flag: "wx", mode: 0o600 });
+        execve(process.execPath, [process.execPath, ...process.execArgv, process.argv[1], ...process.argv.slice(2)], { ...rest, [HANDOFF]: file });
+    }
+    catch (error) {
+        if (file !== undefined)
+            rmSync(file, { force: true });
+        warn(`warning: could not clear the key from this process's environment (${error.message})`);
+    }
+}

package/dist/network.js

@@ -1,5 +1,5 @@
 import { defineChain, fallback, http, zeroAddress } from "viem";
-/** BrainChain testnet, release 3.4.0. */
+/** BrainChain testnet, release 3.5.0. */
 export const TESTNET = {
     id: "testnet",
     name: "BrainChain testnet",
@@ -10,7 +10,7 @@ export const TESTNET = {
     explorer: "https://usebrainchain.com/testnet",
     stakeSymbol: "tBRAIN",
     bountySymbol: "tUSDG",
-    gas: "Get Robinhood Chain testnet ETH from https://faucet.testnet.chain.robinhood.com and bridge some at https://usebrainchain.com/testnet",
+    gas: "Get Robinhood Chain testnet ETH from https://faucet.testnet.chain.robinhood.com, then move it here with `npx brainchain-worker bridge --eth 0.001`",
     proofs: {
         chainId: 46630,
         name: "Robinhood Chain testnet",
@@ -58,7 +58,7 @@ export const MAINNET = {
     explorer: "https://usebrainchain.com",
     stakeSymbol: "BRAIN",
     bountySymbol: "USDG",
-    gas: "Bridge some from Robinhood Chain at https://usebrainchain.com/network",
+    gas: "Send this address ETH on Robinhood Chain, then move it here with `npx brainchain-worker bridge --eth 0.001`",
     buyStake: "Buy BRAIN on Robinhood Chain at ripples.run (https://ripples.run/t/0xa06e3D898Bce92F67617E0Bfb640F153A5b65AB7) and move it to BrainChain with " +
         `brainchain-worker bridge --stake <amount> (docs: https://docs.usebrainchain.com/bridging); the stake token on BrainChain is ${BRAIN}.`,
     proofs: {

package/dist/propose.js

@@ -303,7 +303,7 @@ export async function propose(network, chain, call, uri, options) {
         throw new Error(`The wallet holds ${stake(network, balance)} of the ${stake(network, bond)} bond.${buy}`);
     }
     if (gas === 0n)
-        throw new Error(`${chain.account} has no ETH on ${network.name} for gas. ${network.gas}; 0.001 ETH is plenty.`);
+        throw new Error(`${chain.account} has no ETH on ${network.name} for gas. ${network.gas}.`);
     log(`Bonding ${stake(network, bond)} and proposing...`);
     const { id, tx } = await chain.propose(call, uri, bond);
     log(`Proposal ${id} is waiting for Jev (${tx}). Follow it with \`npx brainchain-worker proposal ${id}\`.`);

package/dist/standing.js

@@ -26,6 +26,39 @@ export async function snapshot(chain) {
         toStake: w.staked >= min ? 0n : min - w.staked,
     };
 }
+/** The highest gas limit seen for each transaction join can send, across testnet and mainnet. */
+const GAS = { faucet: 76000n, approve: 50000n, stake: 120000n, setPrice: 31000n, apply: 240000n };
+/** The highest gas limit seen for delivering a result. */
+const SUBMIT_GAS = 104000n;
+/**
+ * The ETH a wallet must hold for transactions with these gas limits to go
+ * through in order. Each pays the going price, but the RPC refuses one the
+ * wallet could not cover at 2.4 times it, the fee cap it fills in.
+ */
+export function ethNeeded(limits, gasPrice) {
+    let spent = 0n;
+    let need = 0n;
+    for (const limit of limits) {
+        const covered = spent + (limit * gasPrice * 24n) / 10n;
+        if (covered > need)
+            need = covered;
+        spent += limit * gasPrice;
+    }
+    return need;
+}
+/** The gas limits of what join would send for this worker, in order. */
+export function joinLimits(s, claims, reprices) {
+    return [
+        ...(claims ? [GAS.faucet] : []),
+        ...(s.toStake > 0n ? [GAS.approve, GAS.stake] : reprices ? [GAS.setPrice] : []),
+        ...(s.applying ? [GAS.approve, GAS.apply] : []),
+    ];
+}
+/** An amount of ETH rounded up to two significant figures. */
+export function aboutEth(wei) {
+    const unit = 10n ** BigInt(Math.max(wei.toString().length - 2, 0));
+    return formatEther(((wei + unit - 1n) / unit) * unit);
+}
 /** Why the worker can or cannot be hired right now, in one line for `run` or for `status`, which shows the rest itself. */
 export function hireable({ allowed, w, min, applications, change, pending }, network, from) {
     if (allowed) {
@@ -34,8 +67,11 @@ export function hireable({ allowed, w, min, applications, change, pending }, net
         return `no: your stake is below the minimum of ${stake(network, min)}. Run join to stake again${from === "run" ? "; status shows what it needs" : ""}.`;
     }
     // An allowed application waiting out its timelock outranks anything filed after it.
-    if (change && pending)
-        return `no: Jev allowed this worker; it can be hired after ${when(change.eta)}`;
+    if (change && pending) {
+        const due = BigInt(Math.floor(Date.now() / 1000)) >= change.eta;
+        const allowed = `no: Jev allowed this worker; ${due ? `the change that allows it was due at ${when(change.eta)} and has not run yet` : `it can be hired after ${when(change.eta)}`}`;
+        return w.staked >= min ? allowed : `${allowed}. Its stake is below the minimum of ${stake(network, min)}, so run join to stake again first.`;
+    }
     const last = applications.at(-1);
     if (last === undefined)
         return "no: run `npx brainchain-worker join` to apply";
@@ -69,12 +105,13 @@ export function wallet(network, s, balance, bond, faucet, now) {
     const buy = network.buyStake ? `. ${network.buyStake}` : "";
     return `${has}; join needs ${stake(network, need)}${reopens}${unstaking}${buy}`;
 }
-/** The wallet's ETH. With none, and something for join to do, it says so: join can send nothing until the wallet has some. */
-export function gasLine(network, s, gas) {
-    const has = `${formatEther(gas)} ETH`;
-    if (gas > 0n || (s.toStake === 0n && !s.applying))
-        return has;
-    return `${has}; join needs ETH for gas first. ${network.gas}; 0.001 ETH is plenty.`;
+/** What a wallet short of gas holds and needs, for join's refusal and for `status`. */
+export const shortOfGas = (network, gas, need, purpose) => `${formatEther(gas)} ETH on ${network.name}; ${purpose} needs about ${aboutEth(need)} ETH for gas. ${network.gas}.`;
+/** The wallet's ETH, and what more join or the next delivery needs, since a send the wallet cannot cover fails partway through. */
+export function gasLine(network, s, gas, gasPrice, claims) {
+    const limits = joinLimits(s, claims, false);
+    const need = ethNeeded(limits.length > 0 ? limits : [SUBMIT_GAS], gasPrice);
+    return gas >= need ? `${formatEther(gas)} ETH` : shortOfGas(network, gas, need, limits.length > 0 ? "join" : "delivering a result");
 }
 /** What join says when the wallet holds too little of a stake token that has no faucet. */
 export function shortOfStake(network, w, balance, need, now) {

package/dist/state.js

@@ -1,5 +1,6 @@
-import { closeSync, existsSync, fsyncSync, mkdirSync, openSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
-import { homedir } from "node:os";
+import { randomBytes } from "node:crypto";
+import { closeSync, fsyncSync, mkdirSync, openSync, readFileSync, readlinkSync, renameSync, rmSync, statSync, utimesSync, writeFileSync } from "node:fs";
+import { homedir, hostname } from "node:os";
 import { dirname, join } from "node:path";
 export const stateDir = () => join(homedir(), ".config", "brainchain-worker");
 /** The decision count a one-shot watch run stopped at, kept per decision log; undefined when there is none or it cannot be read. */
@@ -15,8 +16,10 @@ export function readWatched(log, dir = stateDir()) {
 export function writeWatched(log, seen, dir = stateDir()) {
     mkdirSync(dir, { recursive: true, mode: 0o700 });
     const file = join(dir, `watch.${log.toLowerCase()}.json`);
-    writeFileSync(`${file}.tmp`, JSON.stringify({ seen: seen.toString() }), { mode: 0o600 });
-    renameSync(`${file}.tmp`, file);
+    // Each write its own temp file: runs from cron overlap, and nothing else keeps them apart.
+    const temp = `${file}.${process.pid}.${randomBytes(4).toString("hex")}.tmp`;
+    writeFileSync(temp, JSON.stringify({ seen: seen.toString() }), { mode: 0o600 });
+    renameSync(temp, file);
 }
 const empty = (board) => ({ board: board.toLowerCase(), tasks: {}, done: [] });
 export function memoryStore(board = "") {
@@ -101,6 +104,26 @@ export function fileStore(file, board, warn = console.warn) {
         },
     };
 }
+/** How often a run touches its lock. */
+const LOCK_BEAT_MS = 5_000;
+/** With no touch for this long a lock was left behind, whatever process now has its pid. */
+const LOCK_STALE_MS = 15_000;
+/** How long a lock from another PID namespace is watched for a touch, a little over one beat. */
+const LOCK_WATCH_MS = 7_000;
+/** A takeover takes a few system calls, so one marker older than this was left by a crash. */
+const TAKEOVER_STALE_MS = 5_000;
+/**
+ * Where a pid means something. Containers sharing a config folder each have
+ * their own numbering, so a holder's pid says nothing outside its own space.
+ */
+function pidSpace() {
+    try {
+        return `${readFileSync("/proc/sys/kernel/random/boot_id", "utf8").trim()}/${readlinkSync("/proc/self/ns/pid")}`;
+    }
+    catch {
+        return hostname();
+    }
+}
 function alive(pid) {
     // A container restarts its process with the same pid, so our own pid in the file is a stale lock.
     if (!Number.isInteger(pid) || pid <= 0 || pid === process.pid)
@@ -113,28 +136,132 @@ function alive(pid) {
         return error.code === "EPERM";
     }
 }
-const holder = (file) => (existsSync(file) ? Number(readFileSync(file, "utf8").trim()) : 0);
-const held = (pid, file) => new Error(`Another run (pid ${pid}) is already working for this worker. Stop it before starting another; ${file} holds its lock.`);
-/** Takes the lock in `file` for this process until it exits; refuses while a live process holds it. */
-export function lock(file) {
+const sleep = (ms) => void Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+function readIfThere(file) {
+    try {
+        return readFileSync(file, "utf8");
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return undefined;
+        throw error;
+    }
+}
+function touchedAt(file) {
+    try {
+        return statSync(file).mtimeMs;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Who a lock's text names. A bare pid is a lock from 0.12 or earlier; text that is neither is a lock still being written. */
+function holderOf(text) {
+    try {
+        const value = JSON.parse(text);
+        if (typeof value === "number")
+            return { pid: value };
+        if (isObject(value) && typeof value.pid === "number" && typeof value.space === "string")
+            return { pid: value.pid, space: value.space };
+    }
+    catch {
+        // Handled below.
+    }
+    return { pid: 0, space: "" };
+}
+/** Whether the run that wrote a lock is still going. */
+function isHeld(file, { pid, space }, watchMs) {
+    if (space === undefined)
+        return alive(pid);
+    const touched = touchedAt(file);
+    if (touched === undefined || Date.now() - touched >= LOCK_STALE_MS)
+        return false;
+    if (pid === 0)
+        return true;
+    if (space === pidSpace())
+        return alive(pid);
+    // A recent touch can be a run that just died, and a restarted container is one more pid namespace: a live run touches its lock again within a beat.
+    sleep(watchMs);
+    return touchedAt(file) !== touched;
+}
+const held = (pid, space, file) => new Error(`Another run (pid ${pid}${space === undefined || space === pidSpace() ? "" : " in another container or PID namespace"}) is already working for this worker. ` +
+    `Stop it before starting another; ${file} holds its lock.`);
+/**
+ * Replaces a lock left behind. The marker lets one start at a time judge and
+ * replace it, since removing the file another start has just written would give
+ * the lock to both.
+ */
+function takeOver(file, mine, judged) {
+    const marker = `${file}.takeover`;
+    try {
+        writeFileSync(marker, "", { flag: "wx", mode: 0o600 });
+    }
+    catch (error) {
+        if (error.code !== "EEXIST")
+            throw error;
+        const at = touchedAt(marker);
+        if (at !== undefined && Date.now() - at >= TAKEOVER_STALE_MS)
+            rmSync(marker, { force: true });
+        sleep(20);
+        return false;
+    }
+    try {
+        if (readIfThere(file) !== judged)
+            return false;
+        const temp = `${file}.${process.pid}.${randomBytes(4).toString("hex")}.tmp`;
+        writeFileSync(temp, mine, { mode: 0o600 });
+        renameSync(temp, file);
+        return true;
+    }
+    finally {
+        rmSync(marker, { force: true });
+    }
+}
+/**
+ * Takes the lock in `file` for this process until it exits; refuses while another
+ * run holds it, in this PID namespace or another sharing the folder. The run
+ * touches the lock every few seconds, and `lost` is called if another took it
+ * over, as can happen to a run frozen for longer than a lock lasts.
+ */
+export function lock(file, lost = () => process.exit(1), watchMs = LOCK_WATCH_MS) {
     mkdirSync(dirname(file), { recursive: true, mode: 0o700 });
+    const mine = JSON.stringify({ pid: process.pid, space: pidSpace(), run: randomBytes(4).toString("hex") });
     for (;;) {
         try {
-            writeFileSync(file, String(process.pid), { flag: "wx", mode: 0o600 });
+            writeFileSync(file, mine, { flag: "wx", mode: 0o600 });
             break;
         }
         catch (error) {
             if (error.code !== "EEXIST")
                 throw error;
         }
-        // The holder may have released it since the write failed; then the next try takes it.
-        const pid = holder(file);
-        if (alive(pid))
-            throw held(pid, file);
-        rmSync(file, { force: true });
+        const text = readIfThere(file);
+        // The holder released it since the write failed, so the next try takes it.
+        if (text === undefined)
+            continue;
+        const holder = holderOf(text);
+        if (isHeld(file, holder, watchMs))
+            throw held(holder.pid, holder.space, file);
+        if (takeOver(file, mine, text))
+            break;
     }
+    const beat = setInterval(() => {
+        try {
+            if (readIfThere(file) !== mine) {
+                clearInterval(beat);
+                return lost();
+            }
+            const now = new Date();
+            utimesSync(file, now, now);
+        }
+        catch {
+            // A disk that fails for a moment is no reason to drop a task; the next beat tries again.
+        }
+    }, LOCK_BEAT_MS);
+    beat.unref();
     const release = () => {
-        if (existsSync(file) && readFileSync(file, "utf8") === String(process.pid))
+        clearInterval(beat);
+        if (readIfThere(file) === mine)
             rmSync(file, { force: true });
     };
     process.once("exit", release);
@@ -158,10 +285,11 @@ function migrate(old, file, board) {
     if (parse(text)?.board !== board.toLowerCase())
         return false;
     // A run from before the move may still be working on this network's tasks from the old file.
-    const pid = holder(`${old}.lock`);
+    const left = readIfThere(`${old}.lock`);
+    const pid = left === undefined ? 0 : holderOf(left).pid;
     if (alive(pid))
-        throw held(pid, `${old}.lock`);
-    if (existsSync(`${file}.json`))
+        throw held(pid, undefined, `${old}.lock`);
+    if (readIfThere(`${file}.json`) !== undefined)
         return false;
     // Removed rather than moved: this run already holds the new lock.
     rmSync(`${old}.lock`, { force: true });
@@ -176,7 +304,10 @@ function migrate(old, file, board) {
 export function openStore(address, network, log = console.log, dir = stateDir()) {
     const old = join(dir, address);
     const file = `${old}.${network.id}`;
-    lock(`${file}.lock`);
+    lock(`${file}.lock`, () => {
+        log(`another run took over ${file}.lock, so this one stops`);
+        process.exit(1);
+    });
     if (migrate(old, file, network.contracts.taskBoard))
         log(`moved ${old}.json to ${file}.json`);
     return fileStore(`${file}.json`, network.contracts.taskBoard, (message) => log(`warning: ${message}`));

package/dist/watch.js

@@ -114,6 +114,9 @@ export const REPORT_PREFIX = "BrainChain watchtower report\n";
 export const MAX_CHECKED = 200;
 /** The proof a record was fetched: the hash of its bytes followed by the worker's address, which nothing on chain gives away. */
 export const fetchProof = (bytes, worker) => keccak256(concat([bytes, toBytes(worker)]));
+/** The service answered and will not take this report, so sending it again would not help. */
+export class ReportRefused extends Error {
+}
 /**
  * Sends a round's re-verified decisions to the service, signed by the worker,
  * so a staked worker's watchtower counts toward its mark in hire questions.
@@ -138,6 +141,8 @@ export function createReporter(network, account, fetcher = fetch) {
             signal: AbortSignal.timeout(20_000),
         });
         const body = (await response.json().catch(() => ({})));
+        if (response.status >= 400 && response.status < 500)
+            throw new ReportRefused(body.error ?? `${response.status} from ${network.service}`);
         if (!response.ok)
             throw new Error(body.error ?? `${response.status} from ${network.service}`);
         return body.mark
@@ -156,7 +161,10 @@ export function createWatch(options) {
     let nextBlock = options.fromBlock ?? network.fromBlock;
     let seenDecision = options.seenDecision;
     const judged = new Set();
+    /** Vetoes due and not yet landed; each is tried every round until it lands or its change closes. */
+    const owed = new Map();
     let findings = 0;
+    let incomplete = false;
     async function changes() {
         const head = await chain.head();
         if (head < nextBlock)
@@ -168,36 +176,49 @@ export function createWatch(options) {
                 const key = change.changeId.toString();
                 if (judged.has(key))
                     continue;
-                judged.add(key);
                 const { name, broken } = judge(change.data);
+                // A failed read leaves the change unjudged and the block range unread, so the next round comes back to it.
+                const open = await chain.open(change.changeId);
+                judged.add(key);
+                const why = broken.join("; ");
+                if (!open) {
+                    log(`change ${change.changeId}: ${name} on ${change.target}${broken.length > 0 ? ` broke the constitution (${why})` : ""}; closed, it has run or was vetoed`);
+                    continue;
+                }
                 const runsAt = new Date(Number(change.eta) * 1000).toISOString().replace("T", " ").slice(0, 16);
                 if (broken.length === 0) {
                     log(`change ${change.changeId}: ${name} on ${change.target}, within the constitution, runs after ${runsAt} UTC`);
                     continue;
                 }
                 findings += 1;
-                const why = broken.join("; ");
                 log(`change ${change.changeId}: ${name} on ${change.target} breaks the constitution (${why}), runs after ${runsAt} UTC`);
-                if (!options.veto)
-                    continue;
-                if (!(await chain.open(change.changeId))) {
-                    log(`change ${change.changeId} is closed already, nothing to veto`);
-                    continue;
+                if (options.veto)
+                    owed.set(key, { id: change.changeId, why });
+            }
+        }
+        nextBlock = head + 1n;
+    }
+    async function vetoes() {
+        for (const [key, { id, why }] of owed) {
+            try {
+                if (!(await chain.open(id))) {
+                    owed.delete(key);
+                    log(`change ${id} is closed already, nothing to veto`);
                 }
-                if (!chain.veto) {
+                else if (!chain.veto) {
+                    owed.delete(key);
                     log(`cannot veto: ${network.name} has no guardian gate this worker can reach`);
-                    continue;
                 }
-                try {
-                    const hash = await chain.veto(change.changeId, `Breaks the constitution: ${why}`);
-                    log(`vetoed change ${change.changeId} through the guardian gate: ${hash}`);
-                }
-                catch (error) {
-                    log(`veto of change ${change.changeId} failed: ${reason(error)}`);
+                else {
+                    const hash = await chain.veto(id, `Breaks the constitution: ${why}`);
+                    owed.delete(key);
+                    log(`vetoed change ${id} through the guardian gate: ${hash}`);
                 }
             }
+            catch (error) {
+                log(`veto of change ${id} failed, tried again next round: ${reason(error)}`);
+            }
         }
-        nextBlock = head + 1n;
     }
     async function decisions() {
         if (!verify)
@@ -215,6 +236,7 @@ export function createWatch(options) {
         }
         const checked = [];
         const found = [];
+        let reached = seenDecision;
         for (let id = seenDecision + 1n; id <= count; id++) {
             try {
                 const { findings: wrong, record } = await verify(id);
@@ -228,27 +250,48 @@ export function createWatch(options) {
                     found.push({ id, checks: wrong });
                     log(`decision ${id} does not verify: ${wrong.join("; ")}`);
                 }
+                reached = id;
             }
             catch (error) {
-                log(`decision ${id} could not be checked: ${reason(error)}`);
+                // The place stays here, so this decision and the ones after it are checked next time.
+                log(`decision ${id} could not be checked, so it is tried again next round: ${reason(error)}`.replace(/\s*\n\s*/g, " "));
+                incomplete = true;
+                break;
             }
         }
-        seenDecision = count;
-        options.saw?.(count);
-        if (!options.report || (checked.length === 0 && found.length === 0))
-            return;
+        // Before the place is saved, so a save that fails does not lose the round's work.
+        if (options.report && (checked.length > 0 || found.length > 0)) {
+            try {
+                log(await options.report(checked, found));
+            }
+            catch (error) {
+                log(`report not taken: ${reason(error)}`);
+                // Only an answer from the service settles a report; these decisions are checked and sent again otherwise.
+                if (!(error instanceof ReportRefused)) {
+                    incomplete = true;
+                    reached = seenDecision;
+                }
+            }
+        }
+        seenDecision = reached;
         try {
-            log(await options.report(checked, found));
+            options.saw?.(reached);
         }
         catch (error) {
-            log(`report not taken: ${reason(error)}`);
+            log(`warning: could not save how far this got, so the next run checks these decisions again: ${reason(error)}`);
         }
     }
     return {
         async round() {
-            await changes();
+            incomplete = false;
+            try {
+                await changes();
+            }
+            finally {
+                await vetoes();
+            }
             await decisions();
-            return { findings };
+            return { findings, incomplete };
         },
     };
 }

package/dist/work.js

@@ -1,4 +1,5 @@
 import { spawn, spawnSync } from "node:child_process";
+import { readFileSync } from "node:fs";
 import { toBytes } from "viem";
 import { fetchBrief, PermanentError, reason, RECEIPT_MS } from "./chain.js";
 import { memoryStore } from "./state.js";
@@ -10,6 +11,8 @@ const OUTPUT_CAP = MAX_RESULT_BYTES * 2;
 const MARGIN_SEC = 300n;
 const RETRY_SEC = [60n, 240n, 960n];
 const DEFAULT_TIMEOUT_MS = 20 * 60_000;
+/** How long the pipes stay open after a command exits, for what it had already written. */
+const DRAIN_MS = 2_000;
 const ANSI = /\x1b(?:\[[0-?]*[ -\/]*[@-~]|\][^\x07\x1b]*(?:\x07|\x1b\\)|[@-Z\\-_])/g;
 export const stripAnsi = (text) => text.replace(ANSI, "");
 /** Text from strangers, made safe to print as one terminal line. */
@@ -133,6 +136,44 @@ function orphaned(pgid) {
     const own = ps(process.pid, "pgid");
     return own !== undefined && own !== String(pgid);
 }
+/** A Linux process's name and parent; undefined where /proc has no such process or there is no /proc. */
+function procStat(pid) {
+    try {
+        const stat = /^\d+ \((.*)\) \S (\d+) /s.exec(readFileSync(`/proc/${pid}/stat`, "utf8"));
+        return stat ? { comm: stat[1], ppid: Number(stat[2]) } : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** The npm process above a worker it started: its parent, or its grandparent where the shell npm runs the command in stays between them. */
+function npmAbove() {
+    const parent = procStat(process.ppid);
+    return parent && /^(sh|dash)$/.test(parent.comm) ? parent.ppid : undefined;
+}
+/**
+ * Calls `lost` once when what npx put above this process dies. npx passes a stop
+ * to the shell it runs the worker in, and dash dies without passing it on, so
+ * the worker never hears it and would run on with nothing above it.
+ */
+export function watchStarter(lost, intervalMs = 1_000) {
+    const parent = process.ppid;
+    const npm = npmAbove();
+    const timer = setInterval(() => {
+        if (process.ppid === parent && (npm === undefined || exists(npm)))
+            return;
+        clearInterval(timer);
+        lost();
+    }, intervalMs);
+    timer.unref();
+}
+/** Whether a supervisor started the npx above this process, as PID 1, as a child of PID 1 or as a systemd service. A stop from it can reach no further than npx. */
+export function npxUnderSupervisor(env = process.env) {
+    if (procStat(process.ppid) === undefined)
+        return false;
+    const npm = npmAbove() ?? process.ppid;
+    return npm === 1 || procStat(npm)?.ppid === 1 || env.INVOCATION_ID !== undefined;
+}
 /**
  * Stops the command an earlier run left running when it died, such as on
  * SIGKILL, so a restart never works on the same task twice at once. It gets
@@ -200,6 +241,15 @@ export function shellCommand(command, graceMs = 10_000) {
                     }, graceMs);
                 };
                 const timer = setTimeout(() => stop(`The command ran past ${Math.round(timeoutMs / 1000)} seconds and was stopped`), timeoutMs);
+                let drain;
+                child.on("exit", () => {
+                    clearTimeout(timer);
+                    // A background process can hold the pipes open long after the command has exited, and close would wait for it.
+                    drain = setTimeout(() => {
+                        child.stdout.destroy();
+                        child.stderr.destroy();
+                    }, DRAIN_MS);
+                });
                 child.stdout.on("data", (chunk) => {
                     size += chunk.byteLength;
                     if (size <= OUTPUT_CAP)
@@ -209,13 +259,18 @@ export function shellCommand(command, graceMs = 10_000) {
                 child.on("error", (error) => {
                     clearTimeout(timer);
                     clearTimeout(force);
+                    clearTimeout(drain);
                     reject(error);
                 });
                 child.on("close", (code, signal) => {
                     clearTimeout(timer);
                     clearTimeout(force);
-                    if (pid !== undefined)
+                    clearTimeout(drain);
+                    if (pid !== undefined) {
+                        // The task is over, and nothing a stranger's brief started should outlive it.
+                        signalGroup(pid, "SIGKILL");
                         running.delete(pid);
+                    }
                     if (running.size === 0)
                         process.off("exit", kill);
                     if (stopped !== undefined)
@@ -364,7 +419,7 @@ export function createWork(options) {
                         delete attempt.tx;
                         store.save();
                     }
-                    if (now + MARGIN_SEC >= task.deadline) {
+                    if (attempt.result === undefined && now + MARGIN_SEC >= task.deadline) {
                         finish(key);
                         fail();
                         log(`task ${task.id}: too close to the deadline to deliver; the poster is refunded`);
@@ -420,7 +475,8 @@ export function createWork(options) {
                     const wait = RETRY_SEC[Math.min(attempt.failures - 1, RETRY_SEC.length - 1)];
                     // The attempt may have run for many minutes, so the retry is timed from now.
                     const now = await chain.now().catch(wall);
-                    if (now + wait + MARGIN_SEC >= task.deadline) {
+                    // A retry with the result in hand only has to deliver it, so the margin for running the command does not apply.
+                    if (now + wait + (attempt.result === undefined ? MARGIN_SEC : 0n) >= task.deadline) {
                         finish(key);
                         log(`task ${task.id}: failed (${why}); no time left to retry, so the poster is refunded`);
                         continue;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "brainchain-worker",
-  "version": "0.12.3",
+  "version": "0.13.0",
   "description": "Earn on BrainChain and propose changes to it: stake, apply, do the tasks Jev hires your agent for, and bond BRAIN to put a change to Jev.",
   "license": "MIT",
   "author": "BrainChain <hello@usebrainchain.com>",
@@ -28,7 +28,7 @@
     "prepack": "npm run build"
   },
   "dependencies": {
-    "brainchain-verify": "^0.3.1",
+    "brainchain-verify": "^0.4.0",
     "viem": "^2.0.0"
   },
   "devDependencies": {