Fix bugs found in full security and stability audit.

Harden artifact paths and fusion uploads, repair pool reconnect and login ID tracking, fix agent/fusion/frontend regressions, and refresh PROBLEMS.md with the full findings list.

server/internal/pool/proxy.go

@@ -63,7 +63,8 @@ type Proxy struct {
 	conn          net.Conn
 	reader        *bufio.Reader
 	connected     bool
-	requestID     int
+	requestID      int
+	loginRequestID int
 	currentJob    *Job
 	jobSubscribed bool
 	stopCh         chan struct{}
@@ -260,7 +261,11 @@ func (p *Proxy) SubmitShare(agentID, wallet, jobID, nonce, hash string, onResult
 }
 
 func (p *Proxy) authenticate() error {
+	p.mu.Lock()
 	p.requestID++
+	loginID := p.requestID
+	p.loginRequestID = loginID
+	p.mu.Unlock()
 
 	// Login request
 	loginParams := []interface{}{
@@ -271,7 +276,7 @@ func (p *Proxy) authenticate() error {
 
 	paramsData, _ := json.Marshal(loginParams)
 	loginReq := StratumRequest{
-		ID:     p.requestID,
+		ID:     loginID,
 		Method: "login",
 		Params: paramsData,
 	}
@@ -317,7 +322,22 @@ func (p *Proxy) readLoop() {
 			}
 
 			p.scheduleReconnect()
-			return
+			// Wait for reconnect before resuming reads (readLoop stays alive).
+			for i := 0; i < 600; i++ {
+				select {
+				case <-p.stopCh:
+					return
+				default:
+				}
+				p.mu.RLock()
+				ok := p.connected && p.reader != nil
+				p.mu.RUnlock()
+				if ok {
+					break
+				}
+				time.Sleep(100 * time.Millisecond)
+			}
+			continue
 		}
 
 		line = strings.TrimSpace(line)
@@ -367,7 +387,11 @@ func (p *Proxy) handleResponse(resp StratumResponse) {
 		return
 	}
 
-	if resp.ID == 1 {
+	p.mu.RLock()
+	loginID := p.loginRequestID
+	p.mu.RUnlock()
+
+	if resp.ID == loginID {
 		// Login response
 		var loginResult struct {
 			ID     string          `json:"id"`