deadbyte-mcp 0.15.35 → 0.15.37

package/bridge/src/bridge.mjs

@@ -1,4 +1,5 @@
-import { createHash } from 'node:crypto';
+import { createHash, randomUUID } from 'node:crypto';
+import { AsyncLocalStorage } from 'node:async_hooks';
 import { createServer } from 'node:http';
 import { readFileSync } from 'node:fs';
 import os from 'node:os';
@@ -9,8 +10,24 @@ import { McpServer, createMcpHandler, createRequestStateCodec, inputRequired, in
 import {preparePublicToolDefinitions} from './public-tool-definitions.mjs';
 import {createDeadbyteNodeHandler} from './node-http-adapter.mjs';
 import { bridgeCatalogSha256, bridgeDeadlineForTool, createBridgeGovernor, enforceDesktopBridgeResult, verifyCompactCatalogAttestation } from './r40-governor.mjs';
+import { createBridgeHealth } from './bridge-health-r59.mjs';
+import { reconnectDelayMs, waitForReconnect, RECONNECT_ATTEMPT_BUDGET, classifyReconnectFailure } from './reconnect-delay-r60.mjs';
+import {openRemoteCallClaims} from './remote-call-claims-r60.mjs';
+import {dispatchBridgeCall,classifyRemoteOperation} from './remote-dispatch-r60.mjs';
+import {canonicalJson} from './canonical-json-r60.mjs';
 
 const coreRoot = path.resolve(process.env.DEADBYTE_CORE_ROOT ?? 'C:/Users/DEADBYTE/Downloads/deadbyte-mcp-v0.6.0');
+const configuredStateRoot=process.env.DEADBYTE_STATE_ROOT;
+if(configuredStateRoot&&(!path.isAbsolute(configuredStateRoot)||configuredStateRoot.trim()===''))throw new Error('bridge state root must be absolute');
+const stateRoot=path.resolve(configuredStateRoot||path.join(os.homedir(),'.deadbyte-mcp'));
+const remoteClaims=openRemoteCallClaims({root:path.join(stateRoot,'runtime','remote-call-claims')});
+let recoveryCursor=null,recoveredClaims=0;
+do{
+  const batch=await remoteClaims.recover({after:recoveryCursor,limit:100});
+  recoveredClaims+=batch.records.length;
+  if(recoveredClaims>100000)throw new Error('remote claim recovery exceeds bounded startup inventory');
+  recoveryCursor=batch.next_cursor;
+}while(recoveryCursor!==null);
 const coreServer = path.join(coreRoot, 'src', 'mcp-server.mjs');
 const workspaceRoot = path.resolve(process.env.DEADBYTE_WORKSPACE_ROOT ?? path.join(coreRoot, 'workspaces'));
 const port = Number(process.env.DEADBYTE_BRIDGE_PORT ?? '8787');
@@ -68,6 +85,7 @@ const SENSITIVE_AUDIT_KEY = /(token|secret|password|authorization|cookie|recover
 const PAYLOAD_AUDIT_KEY = /^(content|raw_text|text)$/i;
 let auditSequence = 0;
 const bridgeGovernor = createBridgeGovernor();
+const bridgeHealth=createBridgeHealth({maxCapabilityAgeMs:15000});
 
 function auditDigest(text) {
   return createHash('sha256').update(text, 'utf8').digest('hex');
@@ -220,23 +238,18 @@ process.on('exit', code => {
   console.error(`[bridge-exit] code=${code}`);
 });
 
-const downstream = new Client(
-  { name: 'deadbyte-chatgpt-bridge', version: '0.2.0' },
-  { versionNegotiation: { mode: { pin: '2026-07-28' } } }
-);
-const downstreamTransport = new StdioClientTransport({
-  command: process.execPath,
-  args: [coreServer],
-  cwd: coreRoot,
-  env: {
-    ...getDefaultEnvironment(),
-    ...process.env,
-    DEADBYTE_WORKSPACE_ROOT: workspaceRoot
-  },
-  stderr: 'pipe'
-});
+function newDownstreamClient(){return new Client(
+  {name:'deadbyte-chatgpt-bridge',version:'0.2.0'},
+  {versionNegotiation:{mode:{pin:'2026-07-28'}}}
+);}
+function newDownstreamTransport(){return new StdioClientTransport({command:process.execPath,args:[coreServer],cwd:coreRoot,
+  env:{...getDefaultEnvironment(),...process.env,DEADBYTE_WORKSPACE_ROOT:workspaceRoot},stderr:'pipe'});}
+function pipeCoreStderr(transport){transport.stderr?.on('data',chunk=>process.stderr.write(`[deadbyte-core] ${chunk}`));}
+
+let downstream=newDownstreamClient();
+let downstreamTransport=newDownstreamTransport();
 
-downstreamTransport.stderr?.on('data', chunk => process.stderr.write(`[deadbyte-core] ${chunk}`));
+pipeCoreStderr(downstreamTransport);
 await downstream.connect(downstreamTransport);
 if (downstream.getProtocolEra() !== 'modern') throw new Error('DEADBYTE downstream is not modern MCP');
 
@@ -245,6 +258,7 @@ const actualNames = listed.tools.map(tool => tool.name).sort();
 const exactR36Compact = JSON.stringify(actualNames) === JSON.stringify(r36CompactTools);
 let compactCatalogAttestation = null;
 let compactCatalogLegacy = false;
+let currentCapabilityManifest = null;
 if (actualNames.includes('capability_manifest')) {
   const manifestResult = await downstream.callTool(
     { name:'capability_manifest', arguments:{} },
@@ -253,6 +267,7 @@ if (actualNames.includes('capability_manifest')) {
   const manifestSchema = manifestResult?.structuredContent?.result?.schema ?? null;
   if (manifestSchema === 'deadbyte.capability-manifest.v2' || manifestSchema === 'deadbyte.capability-manifest.v3') {
     compactCatalogAttestation = verifyCompactCatalogAttestation(actualNames, manifestResult);
+    if(manifestSchema==='deadbyte.capability-manifest.v3') currentCapabilityManifest=manifestResult.structuredContent.result;
   } else if (manifestSchema === 'deadbyte.capability-manifest.v1' && exactR36Compact) {
     compactCatalogLegacy = true;
   } else {
@@ -268,6 +283,82 @@ const agentConfigured = agentTools.every(name => actualNames.includes(name));
 const codingConfigured = codingTools.every(name => actualNames.includes(name));
 const autonomousConfigured = autonomousTools.every(name => actualNames.includes(name));
 const bridgeCatalogDigest = bridgeCatalogSha256(actualNames);
+const coreIdentity=createHash('sha256').update(readFileSync(coreServer)).digest('hex');
+bridgeHealth.coreConnected({childIdentity:coreIdentity,protocolEra:downstream.getProtocolEra(),catalogSha256:bridgeCatalogDigest});
+if(currentCapabilityManifest) bridgeHealth.capabilityObserved(currentCapabilityManifest);
+else bridgeHealth.degraded('capability manifest v3 is required for fresh readiness');
+
+async function refreshCapabilityAttestation(){
+  if(reconnecting||!bridgeHealth.snapshot().core)return;
+  try{
+    const result=await downstream.callTool({name:'capability_manifest',arguments:{}},bridgeDeadlineForTool('capability_manifest'));
+    verifyCompactCatalogAttestation(actualNames,result);
+    bridgeHealth.capabilityObserved(result.structuredContent.result);
+  }catch(error){bridgeHealth.degraded(`capability refresh failed: ${error?.message??String(error)}`);}
+}
+const capabilityRefreshTimer=setInterval(()=>{void refreshCapabilityAttestation();},4000);
+capabilityRefreshTimer.unref?.();
+let shuttingDown=false;
+let reconnecting=false;
+let downstreamGeneration=1;
+const reconnectAbort=new AbortController();
+
+async function attestReplacement(client){
+  if(client.getProtocolEra()!=='modern') throw Object.assign(new Error('replacement core protocol is not modern'),{kind:'terminal',code:'DEADBYTE_SCHEMA_INVALID'});
+  const replacement=(await client.listTools()).tools.map(tool=>tool.name).sort();
+  if(JSON.stringify(replacement)!==JSON.stringify(actualNames)) throw Object.assign(new Error('replacement core catalog drift'),{kind:'terminal',code:'DEADBYTE_SCHEMA_INVALID'});
+  const result=await client.callTool({name:'capability_manifest',arguments:{}},bridgeDeadlineForTool('capability_manifest'));
+  verifyCompactCatalogAttestation(actualNames,result);
+  const manifest=result?.structuredContent?.result;
+  if(manifest?.schema!=='deadbyte.capability-manifest.v3') throw Object.assign(new Error('replacement core capability manifest v3 missing'),{kind:'terminal',code:'DEADBYTE_SCHEMA_INVALID'});
+  const status=(await client.callTool({name:'machine_status',arguments:{}},bridgeDeadlineForTool('machine_status')))?.structuredContent;
+  if(status?.status!=='ok'||!HEX64.test(String(status.machine_id??''))||!HEX64.test(String(status.online_epoch??'')))
+    throw Object.assign(new Error('replacement core execution probe failed'),{kind:'transient',code:'DEADBYTE_EXECUTION_PROBE_FAILED'});
+  if(status.release_manifest_sha256!==manifest.bindings?.release_manifest_sha256||
+    status.generation_manifest_sha256!==manifest.bindings?.generation_manifest_sha256)
+    throw Object.assign(new Error('replacement core execution binding mismatch'),{kind:'terminal',code:'DEADBYTE_GENERATION_MISMATCH'});
+  return manifest;
+}
+function bindDownstreamClose(transport){
+  const sdkClose=transport.onclose;
+  transport.onclose=()=>{
+    sdkClose?.();
+    if(shuttingDown)return;
+    bridgeHealth.reconciling(`downstream core generation ${downstreamGeneration} closed`);
+    bridgeGovernor.reconcile('downstream core unavailable before dispatch');
+    void reconcileDownstream();
+  };
+}
+async function reconcileDownstream(){
+  if(reconnecting||shuttingDown)return;
+  reconnecting=true;
+  try{
+    for(let attempt=0;attempt<RECONNECT_ATTEMPT_BUDGET&&!shuttingDown;attempt++){
+      if(!(await waitForReconnect(reconnectDelayMs(attempt),reconnectAbort.signal))||shuttingDown)return;
+      const nextClient=newDownstreamClient(),nextTransport=newDownstreamTransport();
+      pipeCoreStderr(nextTransport);
+      try{
+        if(createHash('sha256').update(readFileSync(coreServer)).digest('hex')!==coreIdentity) throw new Error('core script identity drift');
+        await nextClient.connect(nextTransport);
+        const manifest=await attestReplacement(nextClient);
+        downstream=nextClient;downstreamTransport=nextTransport;downstreamGeneration++;
+        bindDownstreamClose(nextTransport);
+        bridgeHealth.coreConnected({childIdentity:coreIdentity,protocolEra:nextClient.getProtocolEra(),catalogSha256:bridgeCatalogDigest});
+        bridgeHealth.capabilityObserved(manifest);
+        return;
+      }catch(error){
+        await nextClient.close().catch(()=>{});
+        bridgeHealth.reconciling(`core reconnect ${attempt+1}/${RECONNECT_ATTEMPT_BUDGET} failed: ${error?.message??String(error)}`);
+        if(classifyReconnectFailure(error)==='TERMINAL'){
+          bridgeHealth.degraded(`core reconnect terminal failure: ${error?.message??String(error)}`);
+          return;
+        }
+      }
+    }
+    bridgeHealth.degraded('core restart budget exhausted; bridge quarantined');
+  }finally{reconnecting=false;}
+}
+bindDownstreamClose(downstreamTransport);
 
 function plannerTextFromInput(ctx) {
   const response = inputResponse(ctx.mcpReq.inputResponses, 'planner');
@@ -280,6 +371,36 @@ function plannerTextFromInput(ctx) {
 
 const publicToolDefinitions=preparePublicToolDefinitions(listed.tools);
 
+const remoteDeviceId=createHash('sha256').update(endpointPath,'utf8').digest('hex');
+const ingressDelivery=new AsyncLocalStorage();
+const HEX64=/^[0-9a-f]{64}$/;
+async function dispatchDownstream(tool,args,ctx,budget){
+  if(ctx.mcpReq.signal?.aborted)throw new Error('remote request cancelled before claim');
+  const observed=(await downstream.callTool({name:'machine_status',arguments:{}},bridgeDeadlineForTool('machine_status')))?.structuredContent;
+  const capability=bridgeHealth.snapshot().capability;
+  if(observed?.status!=='ok'||!HEX64.test(String(observed.machine_id??''))||!HEX64.test(String(observed.online_epoch??''))||
+    !HEX64.test(String(observed.generation_manifest_sha256??''))||typeof observed.release_id!=='string'||
+    observed.generation_manifest_sha256!==capability?.generation_manifest_sha256||
+    observed.release_manifest_sha256!==capability?.release_manifest_sha256)
+    throw new Error('remote claim machine/release/generation observation invalid');
+  const requestId=createHash('sha256').update(canonicalJson(ctx.mcpReq.id),'utf8').digest('hex');
+  const metadata=ctx.mcpReq._meta;
+  const idempotencyKey=metadata?.idempotency_key;
+  if(idempotencyKey!==undefined&&typeof idempotencyKey!=='string')throw new Error('remote idempotency_key invalid');
+  const classification=classifyRemoteOperation(tool,args);
+  // A stateless HTTP delivery is not a durable logical session. Only an
+  // explicit idempotency key may identify a mutation across deliveries.
+  const deliveryId=ingressDelivery.getStore()?.delivery_id;
+  if(!deliveryId)throw new Error('remote ingress delivery identity missing');
+  const binding={device_id:remoteDeviceId,session_id:deliveryId,request_id:requestId,
+    ...(idempotencyKey===undefined?{}:{idempotency_key:idempotencyKey}),tool:tool.name,arguments:args,
+    expires_at_utc:new Date(Date.now()+budget.maxTotalTimeout).toISOString(),
+    machine_id:observed.machine_id,online_epoch:observed.online_epoch,release_id:observed.release_id,
+    generation_manifest_sha256:observed.generation_manifest_sha256,classification};
+  return dispatchBridgeCall({claims:remoteClaims,binding,classification,signal:ctx.mcpReq.signal,
+    invoke:()=>downstream.callTool({name:tool.name,arguments:args},budget)});
+}
+
 function buildFrontServer() {
   const front = new McpServer(
     { name: 'deadbyte-chatgpt-bridge', version: '0.2.0' },
@@ -294,17 +415,20 @@ function buildFrontServer() {
       outputSchema,
       annotations: tool.annotations
     }, async (args, ctx) => {
+      const currentHealth=bridgeHealth.snapshot();
+      if(!currentHealth.core||['STARTING','RECONCILING','STOPPING'].includes(currentHealth.state)) throw new Error(`bridge correlation generation=${downstreamGeneration}; downstream ${currentHealth.state.toLowerCase()}; request not dispatched`);
       if (tool.name !== 'autonomous_goal_run') {
         const audit = auditToolStart(tool.name, args);
-        const ticket = await bridgeGovernor.acquire(tool.name);
+        const ticket = await bridgeGovernor.acquire(tool.name,{signal:ctx.mcpReq.signal});
         try {
           const budget = bridgeDeadlineForTool(tool.name);
-          const result = await downstream.callTool({ name: tool.name, arguments: args }, budget);
+          const result = await dispatchDownstream(tool,args,ctx,budget);
           enforceDesktopBridgeResult(tool.name, result);
           auditToolFinish(audit, result);
           return result;
         } catch (error) {
           auditToolFail(audit, error);
+          if(classifyRemoteOperation(tool,args)!=='read_only'&&['RECONCILING','DEGRADED'].includes(bridgeHealth.snapshot().state)) throw new Error(`bridge correlation call=${audit.id} generation=${downstreamGeneration}; mutation outcome unknown; reconcile before retry`,{cause:error});
           throw error;
         } finally {
           ticket.release();
@@ -318,14 +442,15 @@ function buildFrontServer() {
         callArgs.planner_response = { request_id: state.request_id, raw_text: planner.raw_text, model: planner.model };
       }
       const audit = auditToolStart(tool.name, callArgs);
-      const ticket = await bridgeGovernor.acquire(tool.name);
+      const ticket = await bridgeGovernor.acquire(tool.name,{signal:ctx.mcpReq.signal});
       let result;
       try {
         const budget = bridgeDeadlineForTool(tool.name);
-        result = await downstream.callTool({ name: tool.name, arguments: callArgs }, budget);
+        result = await dispatchDownstream(tool,callArgs,ctx,budget);
         auditToolFinish(audit, result);
       } catch (error) {
         auditToolFail(audit, error);
+        if(['RECONCILING','DEGRADED'].includes(bridgeHealth.snapshot().state)) throw new Error(`bridge correlation call=${audit.id} generation=${downstreamGeneration}; autonomous outcome unknown; reconcile before retry`,{cause:error});
         throw error;
       } finally {
         ticket.release();
@@ -359,13 +484,15 @@ const httpServer = createServer(async (req, res) => {
   try {
     const pathname = new URL(req.url ?? '/', 'http://127.0.0.1').pathname;
     if (pathname === '/healthz') {
-      res.writeHead(200, { 'content-type': 'text/plain; charset=utf-8' });
-      return res.end('ok');
+      const health=bridgeHealth.snapshot();
+      res.writeHead(health.http_status, { 'content-type': 'application/json; charset=utf-8','cache-control':'no-store' });
+      return res.end(JSON.stringify(health));
     }
     if (pathname === '/healthz/r40') {
-      res.writeHead(200, { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store' });
+      const health=bridgeHealth.snapshot();
+      res.writeHead(health.http_status, { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store' });
       return res.end(JSON.stringify({
-        status:'ok',catalog_sha256:bridgeCatalogDigest,
+        status:health.ready?'ok':'degraded',runtime:health,catalog_sha256:bridgeCatalogDigest,
         catalog_attestation:compactCatalogAttestation?.ok===true?'verified':compactCatalogLegacy?'legacy-r39':'not-applicable',
         ledger_sha256:compactCatalogAttestation?.ledger_sha256??null,
         governor:bridgeGovernor.snapshot()
@@ -380,7 +507,7 @@ const httpServer = createServer(async (req, res) => {
       res.writeHead(413, { 'content-type': 'text/plain; charset=utf-8' });
       return res.end('request too large');
     }
-    await nodeMcpHandler(req, res);
+    await ingressDelivery.run({delivery_id:randomUUID()},()=>nodeMcpHandler(req, res));
   } catch (error) {
     if (!res.headersSent) res.writeHead(500, { 'content-type': 'text/plain; charset=utf-8' });
     if (!res.writableEnded) res.end('bridge error');
@@ -402,7 +529,12 @@ console.log(`BRIDGE_CODING_RUNTIME ${codingConfigured ? 'ENABLED' : 'DISABLED'}`
 console.log(`BRIDGE_AUTONOMOUS_RUNTIME ${autonomousConfigured ? 'ENABLED' : 'DISABLED'}`);
 
 async function shutdown() {
+  shuttingDown=true;
+  reconnectAbort.abort();
+  bridgeHealth.stopping();
+  clearInterval(capabilityRefreshTimer);
   httpServer.close();
+  await Promise.race([bridgeGovernor.close('bridge stopping'),new Promise(resolve=>setTimeout(resolve,5000))]);
   await mcpHandler.close().catch(() => {});
   await downstream.close().catch(() => {});
   process.exit(0);

package/bridge/src/canonical-json-r60.mjs

@@ -0,0 +1,13 @@
+// Keep byte-for-byte canonicalization compatible with src/canonical-json.mjs.
+// Bridge dependencies are pinned inside bridge/, so this local copy is tested
+// against the Core primitive rather than reaching outside the Bridge root.
+function canonicalize(value){
+  if(Array.isArray(value))return value.map(canonicalize);
+  if(value!==null&&typeof value==='object'){
+    const out={};
+    for(const key of Object.keys(value).sort())out[key]=canonicalize(value[key]);
+    return out;
+  }
+  return value;
+}
+export function canonicalJson(value){return JSON.stringify(canonicalize(value));}

package/bridge/src/r40-governor.mjs

@@ -103,15 +103,22 @@ export function createBridgeGovernor({limits=DEFAULT_LIMITS}={}){
     insist(Number.isInteger(cfg.max_queue)&&cfg.max_queue>=0&&cfg.max_queue<=256,`bridge limit ${name}.max_queue invalid`);
     insist(Number.isInteger(cfg.queue_timeout_ms)&&cfg.queue_timeout_ms>=100&&cfg.queue_timeout_ms<=120000,`bridge limit ${name}.queue_timeout_ms invalid`);
   }
-  const state=new Map(classes.map(name=>[name,{active:0,queue:[]}]));
+  const state=new Map(classes.map(name=>[name,{active:0,queue:[],admitted:0,completed:0,rejected:0,timed_out:0,cancelled:0}]));
   let sequence=0;
+  let closed=false;
+  const drainWaiters=[];
+
+  function finishDrain(){
+    if(!closed||[...state.values()].some(item=>item.active>0||item.queue.some(waiter=>!waiter.done))) return;
+    while(drainWaiters.length) drainWaiters.shift()();
+  }
 
   function dispatch(name){
     const cfg=limits[name],s=state.get(name);
     while(s.active<cfg.max_active&&s.queue.length){
       const waiter=s.queue.shift();
       if(waiter.done) continue;
-      waiter.done=true; clearTimeout(waiter.timer); s.active++;
+      waiter.done=true; clearTimeout(waiter.timer); waiter.cleanup(); s.active++; s.admitted++;
       waiter.resolve(makeTicket(name,waiter.tool,waiter.id,waiter.queuedAt));
     }
   }
@@ -123,37 +130,76 @@ export function createBridgeGovernor({limits=DEFAULT_LIMITS}={}){
         if(released) return false;
         released=true;
         const s=state.get(name);
-        s.active=Math.max(0,s.active-1);
+        s.active=Math.max(0,s.active-1);s.completed++;
         dispatch(name);
+        finishDrain();
         return true;
       }
     });
   }
-  async function acquire(tool){
+  async function acquire(tool,{signal}={}){
     const name=toolClass(tool),cfg=limits[name],s=state.get(name),id=++sequence,queuedAt=Date.now();
+    if(closed){s.rejected++;throw new Error('bridge governor closed');}
+    if(signal?.aborted){s.cancelled++;throw signal.reason instanceof Error?signal.reason:new Error('bridge request aborted');}
     if(s.active<cfg.max_active){
-      s.active++;
+      s.active++;s.admitted++;
       return makeTicket(name,String(tool),id,queuedAt);
     }
-    if(s.queue.length>=cfg.max_queue) throw new Error(`bridge backpressure queue full for ${name}`);
+    if(s.queue.length>=cfg.max_queue){s.rejected++;throw new Error(`bridge backpressure queue full for ${name}`);}
     return await new Promise((resolve,reject)=>{
-      const waiter={id,tool:String(tool),queuedAt,resolve,reject,done:false,timer:null};
+      const waiter={id,tool:String(tool),queuedAt,resolve,reject,done:false,timer:null,cleanup:()=>{}};
+      const abort=()=>{
+        if(waiter.done)return;
+        waiter.done=true;clearTimeout(waiter.timer);waiter.cleanup();
+        const index=s.queue.indexOf(waiter);if(index>=0)s.queue.splice(index,1);
+        s.cancelled++;reject(signal?.reason instanceof Error?signal.reason:new Error('bridge request aborted'));finishDrain();
+      };
+      waiter.cleanup=()=>signal?.removeEventListener?.('abort',abort);
+      signal?.addEventListener?.('abort',abort,{once:true});
       waiter.timer=setTimeout(()=>{
         if(waiter.done)return;
-        waiter.done=true;
+        waiter.done=true;waiter.cleanup();s.timed_out++;
         const index=s.queue.indexOf(waiter); if(index>=0)s.queue.splice(index,1);
         reject(new Error(`bridge backpressure queue timeout for ${name}`));
+        finishDrain();
       },cfg.queue_timeout_ms);
       s.queue.push(waiter);
     });
   }
+  function close(reason='bridge governor closed'){
+    if(!closed){
+      closed=true;
+      for(const s of state.values()){
+        for(const waiter of s.queue.splice(0)){
+          if(waiter.done)continue;
+          waiter.done=true;clearTimeout(waiter.timer);waiter.cleanup();s.cancelled++;
+          waiter.reject(new Error(String(reason)));
+        }
+      }
+    }
+    if([...state.values()].every(item=>item.active===0)) return Promise.resolve();
+    return new Promise(resolve=>drainWaiters.push(resolve));
+  }
+  function reconcile(reason='bridge downstream reconciling'){
+    if(closed) return 0;
+    let removed=0;
+    for(const s of state.values()){
+      for(const waiter of s.queue.splice(0)){
+        if(waiter.done)continue;
+        waiter.done=true;clearTimeout(waiter.timer);waiter.cleanup();s.cancelled++;removed++;
+        waiter.reject(new Error(String(reason)));
+      }
+    }
+    return removed;
+  }
   function snapshot(){
     return Object.freeze(Object.fromEntries(classes.map(name=>{
       const s=state.get(name),cfg=limits[name];
-      return [name,Object.freeze({active:s.active,queued:s.queue.filter(x=>!x.done).length,max_active:cfg.max_active,max_queue:cfg.max_queue})];
+      return [name,Object.freeze({active:s.active,queued:s.queue.filter(x=>!x.done).length,max_active:cfg.max_active,max_queue:cfg.max_queue,
+        admitted:s.admitted,completed:s.completed,rejected:s.rejected,timed_out:s.timed_out,cancelled:s.cancelled,saturated:s.active>=cfg.max_active})];
     })));
   }
-  return Object.freeze({acquire,snapshot});
+  return Object.freeze({acquire,reconcile,close,snapshot});
 }
 
 export const BRIDGE_R40_DEFAULT_LIMITS=DEFAULT_LIMITS;

package/bridge/src/reconnect-delay-r60.mjs

@@ -0,0 +1,31 @@
+import { setTimeout as delay } from 'node:timers/promises';
+
+const BASE_DELAYS_MS=Object.freeze([250,500,1000,2000,4000]);
+
+export function reconnectDelayMs(attempt,random=Math.random){
+  if(!Number.isInteger(attempt)||attempt<0||attempt>=BASE_DELAYS_MS.length) throw new Error('reconnect attempt outside budget');
+  const sample=Number(random());
+  if(!Number.isFinite(sample)||sample<0||sample>1) throw new Error('reconnect jitter source invalid');
+  return Math.round(BASE_DELAYS_MS[attempt]*(0.75+sample*0.5));
+}
+
+export const RECONNECT_ATTEMPT_BUDGET=BASE_DELAYS_MS.length;
+
+export async function waitForReconnect(milliseconds,signal){
+  if(signal?.aborted)return false;
+  try{await delay(milliseconds,undefined,{signal});return !signal?.aborted;}
+  catch(error){if(error?.name==='AbortError')return false;throw error;}
+}
+
+export function classifyReconnectFailure(error){
+  const code=String(error?.code??'').toUpperCase();
+  if(error?.kind==='terminal')return 'TERMINAL';
+  if(error?.kind==='transient')return 'TRANSIENT';
+  if(new Set(['DEADBYTE_AUTHORITY_REVOKED','DEADBYTE_POLICY_DENIED','DEADBYTE_SCHEMA_INVALID',
+    'DEADBYTE_RELEASE_MISMATCH','DEADBYTE_GENERATION_MISMATCH','DEADBYTE_IDEMPOTENCY_CONFLICT',
+    'DEADBYTE_CLAIM_CORRUPT','DEADBYTE_CREDENTIAL_EXPIRED']).has(code))return 'TERMINAL';
+  const message=String(error?.message??error??'').toLowerCase();
+  if(['EACCES','EPERM','ENOENT'].includes(code)||/identity drift|catalog drift|protocol is not modern|attestation invalid|generation mismatch|policy mismatch/.test(message))return 'TERMINAL';
+  if(['ECONNRESET','ECONNREFUSED','EPIPE','ETIMEDOUT','EHOSTUNREACH'].includes(code)||/connection reset|transport closed|timed out|temporarily unavailable/.test(message))return 'TRANSIENT';
+  return 'TERMINAL';
+}

package/bridge/src/remote-call-claims-r60.mjs

@@ -0,0 +1,157 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { link, lstat, mkdir, open, readFile, readdir, rm } from 'node:fs/promises';
+import path from 'node:path';
+import { canonicalJson } from './canonical-json-r60.mjs';
+
+const HEX64=/^[0-9a-f]{64}$/;
+const ID=/^[A-Za-z0-9._:-]{1,160}$/;
+const sha=value=>createHash('sha256').update(canonicalJson(value),'utf8').digest('hex');
+
+async function publishOnce(target,value){
+  const temp=`${target}.${process.pid}.${randomBytes(8).toString('hex')}.tmp`;
+  const handle=await open(temp,'wx');
+  const record={...value,record_sha256:sha(value)};
+  try{await handle.writeFile(`${canonicalJson(record)}\n`,'utf8');await handle.sync();}
+  finally{await handle.close();}
+  try{await link(temp,target);return true;}
+  catch(error){if(error?.code==='EEXIST')return false;throw error;}
+  finally{await rm(temp,{force:true});}
+}
+async function readExact(file){
+  try{
+    const info=await lstat(file);
+    if(!info.isFile()||info.isSymbolicLink()||info.size>2*1024*1024)throw new Error('remote claim record type or size corrupt');
+    const record=JSON.parse(await readFile(file,'utf8'));
+    if(!record||typeof record!=='object'||Array.isArray(record))throw new Error('remote claim record corrupt');
+    const {record_sha256,...body}=record;
+    if(!HEX64.test(String(record_sha256??''))||record_sha256!==sha(body))throw new Error('remote claim record hash corrupt');
+    return body;
+  }
+  catch(error){if(error?.code==='ENOENT')return null;throw new Error(`remote claim state unreadable: ${String(error?.message||error)}`);}
+}
+function validate(binding,now){
+  if(!binding||typeof binding!=='object'||Array.isArray(binding))throw new Error('remote claim binding invalid');
+  for(const key of ['device_id','session_id','request_id','tool','release_id'])if(!ID.test(String(binding[key]??'')))throw new Error(`remote claim ${key} invalid`);
+  if(binding.idempotency_key!==undefined&&!ID.test(String(binding.idempotency_key)))throw new Error('remote claim idempotency_key invalid');
+  if(!HEX64.test(String(binding.machine_id??'')))throw new Error('remote claim machine_id invalid');
+  if(!HEX64.test(String(binding.generation_manifest_sha256??'')))throw new Error('remote claim generation binding invalid');
+  if(!HEX64.test(String(binding.online_epoch??'')))throw new Error('remote claim online epoch invalid');
+  if(!['read_only','mutating','unknown'].includes(binding.classification))throw new Error('remote claim classification invalid');
+  if(!binding.arguments||typeof binding.arguments!=='object'||Array.isArray(binding.arguments))throw new Error('remote claim arguments invalid');
+  const expires=Date.parse(binding.expires_at_utc);
+  if(!Number.isFinite(expires))throw new Error('remote claim deadline invalid');
+  if(expires<=now)throw new Error('remote request expired');
+  return Object.freeze({schema:'deadbyte.remote-call-claim.v1',device_id:binding.device_id,session_id:binding.session_id,
+    idempotency_key:binding.idempotency_key??null,
+    request_id:String(binding.request_id),tool:binding.tool,payload_sha256:sha(binding.arguments),
+    received_at_utc:new Date(now).toISOString(),expires_at_utc:new Date(expires).toISOString(),
+    release_id:binding.release_id,generation_manifest_sha256:binding.generation_manifest_sha256,
+    machine_id:binding.machine_id,online_epoch:binding.online_epoch,classification:binding.classification});
+}
+
+export function openRemoteCallClaims({root,clock=Date.now}={}){
+  if(typeof root!=='string'||!path.isAbsolute(root)||typeof clock!=='function')throw new Error('remote claim store options invalid');
+  const directory=path.resolve(root);
+  function files(id){
+    if(!HEX64.test(String(id)))throw new Error('remote claim identity invalid');
+    const base=path.join(directory,id.slice(0,2),id);
+    return {base,claim:`${base}.claim.json`,claimed:`${base}.claimed.json`,dispatch:`${base}.dispatch.json`,interrupted:`${base}.interrupted.json`,terminal:`${base}.terminal.json`};
+  }
+  async function state(claimId){
+    const f=files(claimId);
+    const claim=await readExact(f.claim);
+    if(!claim||claim.schema!=='deadbyte.remote-call-claim.v1')throw new Error('remote claim missing or invalid');
+    const terminal=await readExact(f.terminal);
+    if(terminal){
+      if(terminal.schema!=='deadbyte.remote-call-terminal.v1'||terminal.claim_id!==claimId||
+        !HEX64.test(String(terminal.result_sha256??''))||terminal.result_sha256!==sha(terminal.result))
+        throw new Error('remote claim terminal hash corrupt');
+      return Object.freeze({claim_id:claimId,owner:false,state:'TERMINAL',side_effect_state:claim.classification==='read_only'?'none':'unknown',result:terminal.result});
+    }
+    const interrupted=await readExact(f.interrupted);
+    if(interrupted){
+      if(interrupted.schema!=='deadbyte.remote-call-interrupted.v1'||interrupted.claim_id!==claimId)throw new Error('remote claim interruption corrupt');
+      return Object.freeze({claim_id:claimId,owner:false,state:'INTERRUPTED',side_effect_state:claim.classification==='read_only'?'none':'unknown'});
+    }
+    const dispatched=await readExact(f.dispatch);
+    if(dispatched)return Object.freeze({claim_id:claimId,owner:false,state:'EXECUTING',side_effect_state:claim.classification==='read_only'?'none':'may_have_started'});
+    const claimed=await readExact(f.claimed);
+    return Object.freeze({claim_id:claimId,owner:false,state:claimed?'CLAIMED':'RECEIVED',side_effect_state:'not_started'});
+  }
+  async function claim(binding){
+    const record=validate(binding,Number(clock()));
+    const claimId=record.idempotency_key===null
+      ?sha({device_id:record.device_id,session_id:record.session_id,request_id:record.request_id})
+      :sha({device_id:record.device_id,idempotency_key:record.idempotency_key});
+    const f=files(claimId);
+    await mkdir(path.dirname(f.base),{recursive:true});
+    if(await publishOnce(f.claim,record)){
+      const owner=await publishOnce(f.claimed,{schema:'deadbyte.remote-call-claimed.v1',claim_id:claimId,execution_state:'CLAIMED',side_effect_state:'not_started'});
+      return owner?Object.freeze({claim_id:claimId,owner:true,state:'CLAIMED',side_effect_state:'not_started'}):state(claimId);
+    }
+    const prior=await readExact(f.claim);
+    if(!prior||prior.schema!==record.schema)throw new Error('remote claim identity corrupt');
+    if(Date.parse(prior.expires_at_utc)<=Number(clock()))throw new Error('remote request expired');
+    if(prior.tool!==record.tool||prior.payload_sha256!==record.payload_sha256)throw new Error(record.idempotency_key===null?'request_id_conflict':'idempotency_key_conflict');
+    if(prior.device_id!==record.device_id||prior.idempotency_key!==record.idempotency_key||
+      (record.idempotency_key===null&&(prior.session_id!==record.session_id||prior.request_id!==record.request_id)))throw new Error('remote claim identity drift');
+    if(prior.release_id!==record.release_id||prior.generation_manifest_sha256!==record.generation_manifest_sha256)throw new Error('remote claim release identity drift');
+    if(prior.machine_id!==record.machine_id||prior.online_epoch!==record.online_epoch||prior.classification!==record.classification)throw new Error('remote claim machine/epoch/classification drift');
+    const current=await state(claimId);
+    if(current.state==='RECEIVED'&&await publishOnce(f.claimed,{schema:'deadbyte.remote-call-claimed.v1',claim_id:claimId,execution_state:'CLAIMED',side_effect_state:'not_started'}))
+      return Object.freeze({claim_id:claimId,owner:true,state:'CLAIMED',side_effect_state:'not_started'});
+    return state(claimId);
+  }
+  async function dispatch(claimId){
+    const f=files(claimId);
+    if(!(await readExact(f.claimed)))throw new Error('remote claim not claimed before dispatch');
+    if(!(await publishOnce(f.dispatch,{schema:'deadbyte.remote-call-dispatch.v1',claim_id:claimId,at_utc:new Date(Number(clock())).toISOString(),execution_state:'EXECUTING',side_effect_state:'may_have_started'})))
+      throw new Error('remote claim already dispatched; outcome unknown');
+    return Object.freeze({claim_id:claimId,state:'EXECUTING',side_effect_state:'may_have_started'});
+  }
+  async function terminal(claimId,result){
+    const f=files(claimId);
+    if(!(await readExact(f.dispatch)))throw new Error('remote claim not dispatched');
+    const bytes=Buffer.byteLength(canonicalJson(result),'utf8');
+    if(bytes>1048576)throw new Error('remote claim terminal result exceeds bound');
+    if(!(await publishOnce(f.terminal,{schema:'deadbyte.remote-call-terminal.v1',claim_id:claimId,
+      at_utc:new Date(Number(clock())).toISOString(),result_sha256:sha(result),result})))throw new Error('remote claim already terminal');
+    return state(claimId);
+  }
+  async function recover({after=null,limit=100}={}){
+    if(after!==null&&!HEX64.test(String(after)))throw new Error('remote recovery cursor invalid');
+    if(!Number.isInteger(limit)||limit<1||limit>100)throw new Error('remote recovery batch limit invalid');
+    const records=[];let more=false;
+    for(let shard=0;shard<256;shard++){
+      const prefix=shard.toString(16).padStart(2,'0');
+      if(after&&prefix<after.slice(0,2))continue;
+      const folder=path.join(directory,prefix);
+      let names;
+      try{
+        const info=await lstat(folder);
+        if(!info.isDirectory()||info.isSymbolicLink())throw new Error('remote recovery shard corrupt');
+        names=await readdir(folder);
+      }catch(error){if(error?.code==='ENOENT')continue;throw error;}
+      if(names.length>4096)throw new Error('remote recovery shard exceeds bounded inventory');
+      for(const name of names.filter(item=>/^[0-9a-f]{64}\.claim\.json$/.test(item)).sort()){
+        const id=name.slice(0,64);
+        if(after&&id<=after)continue;
+        if(records.length>=limit){more=true;break;}
+        const claimRecord=await readExact(files(id).claim);
+        if(!claimRecord||claimRecord.schema!=='deadbyte.remote-call-claim.v1')throw new Error('remote recovery claim corrupt');
+        if(Date.parse(claimRecord.expires_at_utc)<=Number(clock()))continue;
+        let current=await state(id);
+        if(current.state==='TERMINAL')continue;
+        if(current.state==='EXECUTING'){
+          await publishOnce(files(id).interrupted,{schema:'deadbyte.remote-call-interrupted.v1',claim_id:id,
+            at_utc:new Date(Number(clock())).toISOString(),execution_state:'INTERRUPTED',side_effect_state:current.side_effect_state==='none'?'none':'unknown'});
+          current=await state(id);
+        }
+        records.push(current);
+      }
+      if(more)break;
+    }
+    return Object.freeze({records,next_cursor:more?records.at(-1)?.claim_id??after:null});
+  }
+  return Object.freeze({claim,dispatch,terminal,state,recover});
+}