Fix bugs found in full security and stability audit.

Harden artifact paths and fusion uploads, repair pool reconnect and login ID tracking, fix agent/fusion/frontend regressions, and refresh PROBLEMS.md with the full findings list.

agent/client/ai.go

@@ -475,20 +475,28 @@ func (a *AIRunner) isProcessRunning(name string) bool {
 	if name == "" {
 		return false
 	}
-	// Use tasklist on Windows to check if process is running
-	cmd := exec.Command("tasklist", "/FI", fmt.Sprintf("IMAGENAME eq %s", name))
+	imName := name
+	if !strings.HasSuffix(strings.ToLower(imName), ".exe") {
+		imName += ".exe"
+	}
+	cmd := exec.Command("tasklist", "/FI", fmt.Sprintf("IMAGENAME eq %s", imName))
 	output, err := cmd.Output()
 	if err != nil {
 		return false
 	}
-	return strings.Contains(string(output), name)
+	return strings.Contains(string(output), imName)
 }
 
 func (a *AIRunner) restartMiner(processName string) (string, error) {
 	log.Printf("[AI] Restarting miner: %s", processName)
 
+	imName := processName
+	if !strings.HasSuffix(strings.ToLower(imName), ".exe") {
+		imName += ".exe"
+	}
+
 	// Kill existing process
-	killCmd := exec.Command("taskkill", "/F", "/IM", processName)
+	killCmd := exec.Command("taskkill", "/F", "/IM", imName)
 	killOutput, _ := killCmd.CombinedOutput()
 
 	// Start new process from install directory
@@ -497,7 +505,7 @@ func (a *AIRunner) restartMiner(processName string) (string, error) {
 		return string(killOutput), fmt.Errorf("cannot get install directory: %w", err)
 	}
 
-	exePath := filepath.Join(installDir, processName)
+	exePath := filepath.Join(installDir, imName)
 	if _, err := os.Stat(exePath); os.IsNotExist(err) {
 		return string(killOutput), fmt.Errorf("executable not found: %s", exePath)
 	}
@@ -524,7 +532,7 @@ func (a *AIRunner) reinstallMiner(serverURL, buildID string) (string, error) {
 	exePath := filepath.Join(installDir, a.cfg.EffectiveProcessName()+".exe")
 
 	// Download the new binary
-	resp, err := http.Get(downloadURL)
+	resp, err := a.httpClient.Get(downloadURL)
 	if err != nil {
 		return "", fmt.Errorf("download failed: %w", err)
 	}

agent/client/client.go

@@ -112,6 +112,10 @@ func (c *AgentClient) connectLoop() error {
 	c.conn = conn
 	defer conn.Close()
 
+	conn.SetPongHandler(func(string) error {
+		return conn.SetReadDeadline(time.Now().Add(90 * time.Second))
+	})
+
 	if err := c.authenticate(); err != nil {
 		return err
 	}
@@ -183,12 +187,24 @@ func (c *AgentClient) authenticate() error {
 func (c *AgentClient) handleMessage(msg Message) {
 	switch msg.Type {
 	case "new_job":
+		var raw map[string]json.RawMessage
+		if err := json.Unmarshal(msg.Payload, &raw); err != nil {
+			log.Printf("[agent] bad job payload: %v", err)
+			return
+		}
+		if errMsg, ok := raw["error"]; ok {
+			log.Printf("[agent] job error from server: %s", string(errMsg))
+			c.write(Message{Type: "get_job", Payload: json.RawMessage("{}")})
+			return
+		}
 		var j job.Job
 		if err := json.Unmarshal(msg.Payload, &j); err != nil {
 			log.Printf("[agent] bad job payload: %v", err)
 			return
 		}
 		if j.Blob == "" {
+			log.Printf("[agent] empty job blob — requesting job again")
+			c.write(Message{Type: "get_job", Payload: json.RawMessage("{}")})
 			return
 		}
 		log.Printf("[agent] new job %s height=%d", j.ID, j.Height)