Harness enhancements

The desktop harness (apps/harness/harness.mjs, 99-line zero-dep watcher) is the "credentials stay on your machine" local capture path: watch a folder → POST images to /api/harness/ingest → review queue. It's the cheapest high-volume on-ramp for a seller's existing photo workflow. Enhancements, prioritized.

Tier 1 — make it trustworthy at volume (pain #4 photo throughput)

• Device + tenant identity. Replace the static token with a real device/tenant registration through the P9 gateway (D33) — the current h-auth gap. Per-device keys, revocable.
• Idempotent + dedup ingest. Content-hash each image; idempotent replay so re-runs / re-copies don't create duplicate candidates (P5 source idempotency).
• Reliable watch + retry queue. Survive restarts, network drops, and large dumps: a durable local queue with backoff retry; resume where it left off.
• HEIC/RAW support. Sellers shoot on phones (HEIC) and cameras (RAW) — convert/normalize before upload.

Tier 2 — privacy & safety (the whole point of "stays on your machine")

• Path + EXIF redaction. Hash/strip local paths and sensitive EXIF (GPS) before sending; metadata-only candidates, no canonical writes (the P5 guard).
• Per-sale routing. --sale + multi-folder watch so one machine handles several concurrent estates; auto-tag candidates by source folder.
• Durable media handoff. Copy originals to durable candidate storage before any canonical/public use (don't depend on the local file persisting).

Tier 3 — operator experience

• Status UI / system tray. A small desktop status (queued / uploaded / failed / review-ready) instead of console-only; one-glance "is it working."
• Mobile pairing / handoff. Pair the harness with the mobile app so on-site phone captures and desktop folder captures land in the same review queue.
• Throughput stats. Images/min, pending, errors — mirrors the web throughput dashboard.
• Packaging. A signed installer + auto-update so non-technical sellers can run it (today it's node harness.mjs …).

Tier 4 — reach

• Local cloud-connector mode. Optionally let the harness pull from a local Drive/Photos sync folder so cloud creds never leave the machine (complements the web connectors, D34).

Sequencing

Identity + idempotency (Tier 1) align with Wave 4 (P5 connectors / P9 API). Privacy guards are the P5 quarantine condition for /api/harness/ingest (already tracked). Operator experience + packaging are independent and can ship anytime once the contract path is live.