deadbyte-mcp 0.15.36 → 0.15.38

package/bridge/src/bridge-health-r59.mjs

@@ -6,8 +6,8 @@ function bounded(value,max=512){
     .replace(/(?:Bearer\s+\S+|token|secret|password|[A-Za-z]:\\[^ ]+)/gi,'<redacted>').slice(0,max);
 }
 
-export function createBridgeHealth({clock=Date.now,maxCapabilityAgeMs=15000}={}){
-  if(typeof clock!=='function'||!Number.isInteger(maxCapabilityAgeMs)||maxCapabilityAgeMs<5000||maxCapabilityAgeMs>60000) throw new Error('bridge health options invalid');
+export function createBridgeHealth({clock=Date.now,elapsedClock=clock===Date.now?()=>performance.now():clock,maxCapabilityAgeMs=15000}={}){
+  if(typeof clock!=='function'||typeof elapsedClock!=='function'||!Number.isInteger(maxCapabilityAgeMs)||maxCapabilityAgeMs<5000||maxCapabilityAgeMs>60000) throw new Error('bridge health options invalid');
   let phase='STARTING';
   let diagnostic='downstream initialization pending';
   let core=null;
@@ -24,6 +24,7 @@ export function createBridgeHealth({clock=Date.now,maxCapabilityAgeMs=15000}={})
     const observed=Date.parse(manifest.observed_at_utc),validUntil=Date.parse(manifest.valid_until_utc);
     if(!Number.isFinite(observed)||!Number.isFinite(validUntil)||validUntil<observed) throw new Error('bridge capability timestamps invalid');
     capability=Object.freeze({snapshot_id:manifest.snapshot_id,state_epoch:manifest.state_epoch,observed_at_ms:observed,
+      received_elapsed_ms:Number(elapsedClock()),age_at_receive_ms:Math.max(0,Number(clock())-observed),
       valid_until_ms:validUntil,release_manifest_sha256:HEX64.test(String(manifest.bindings?.release_manifest_sha256))?manifest.bindings.release_manifest_sha256:null,
       generation_manifest_sha256:HEX64.test(String(manifest.bindings?.generation_manifest_sha256))?manifest.bindings.generation_manifest_sha256:null});
     const unavailable=Object.entries(manifest.planes??{}).filter(([,value])=>value?.state==='DEGRADED'||value?.state==='UNAVAILABLE');
@@ -38,7 +39,7 @@ export function createBridgeHealth({clock=Date.now,maxCapabilityAgeMs=15000}={})
   function snapshot(){
     const now=Number(clock());
     let state=phase,reason=diagnostic;
-    const stale=capability&&(now-capability.observed_at_ms>maxCapabilityAgeMs||now>capability.valid_until_ms);
+    const stale=capability&&(capability.age_at_receive_ms+Math.max(0,Number(elapsedClock())-capability.received_elapsed_ms)>maxCapabilityAgeMs||now>capability.valid_until_ms);
     if(phase==='READY'&&(!core||!capability||stale)){state='DEGRADED';reason=stale?'capability snapshot stale':'downstream attestation incomplete';}
     if(!PHASES.has(state)) throw new Error('bridge health phase invalid');
     const ready=state==='READY'&&Boolean(core)&&Boolean(capability);

package/bridge/src/bridge.mjs

@@ -1,4 +1,5 @@
-import { createHash } from 'node:crypto';
+import { createHash, randomUUID } from 'node:crypto';
+import { AsyncLocalStorage } from 'node:async_hooks';
 import { createServer } from 'node:http';
 import { readFileSync } from 'node:fs';
 import os from 'node:os';
@@ -10,8 +11,23 @@ import {preparePublicToolDefinitions} from './public-tool-definitions.mjs';
 import {createDeadbyteNodeHandler} from './node-http-adapter.mjs';
 import { bridgeCatalogSha256, bridgeDeadlineForTool, createBridgeGovernor, enforceDesktopBridgeResult, verifyCompactCatalogAttestation } from './r40-governor.mjs';
 import { createBridgeHealth } from './bridge-health-r59.mjs';
+import { reconnectDelayMs, waitForReconnect, RECONNECT_ATTEMPT_BUDGET, classifyReconnectFailure } from './reconnect-delay-r60.mjs';
+import {openRemoteCallClaims} from './remote-call-claims-r60.mjs';
+import {dispatchBridgeCall,classifyRemoteOperation} from './remote-dispatch-r60.mjs';
+import {canonicalJson} from './canonical-json-r60.mjs';
 
 const coreRoot = path.resolve(process.env.DEADBYTE_CORE_ROOT ?? 'C:/Users/DEADBYTE/Downloads/deadbyte-mcp-v0.6.0');
+const configuredStateRoot=process.env.DEADBYTE_STATE_ROOT;
+if(configuredStateRoot&&(!path.isAbsolute(configuredStateRoot)||configuredStateRoot.trim()===''))throw new Error('bridge state root must be absolute');
+const stateRoot=path.resolve(configuredStateRoot||path.join(os.homedir(),'.deadbyte-mcp'));
+const remoteClaims=openRemoteCallClaims({root:path.join(stateRoot,'runtime','remote-call-claims')});
+let recoveryCursor=null,recoveredClaims=0;
+do{
+  const batch=await remoteClaims.recover({after:recoveryCursor,limit:100});
+  recoveredClaims+=batch.records.length;
+  if(recoveredClaims>100000)throw new Error('remote claim recovery exceeds bounded startup inventory');
+  recoveryCursor=batch.next_cursor;
+}while(recoveryCursor!==null);
 const coreServer = path.join(coreRoot, 'src', 'mcp-server.mjs');
 const workspaceRoot = path.resolve(process.env.DEADBYTE_WORKSPACE_ROOT ?? path.join(coreRoot, 'workspaces'));
 const port = Number(process.env.DEADBYTE_BRIDGE_PORT ?? '8787');
@@ -285,17 +301,23 @@ capabilityRefreshTimer.unref?.();
 let shuttingDown=false;
 let reconnecting=false;
 let downstreamGeneration=1;
-const reconnectDelays=[250,500,1000,2000,4000];
-const wait=ms=>new Promise(resolve=>setTimeout(resolve,ms));
+const reconnectAbort=new AbortController();
 
 async function attestReplacement(client){
-  if(client.getProtocolEra()!=='modern') throw new Error('replacement core protocol is not modern');
+  if(client.getProtocolEra()!=='modern') throw Object.assign(new Error('replacement core protocol is not modern'),{kind:'terminal',code:'DEADBYTE_SCHEMA_INVALID'});
   const replacement=(await client.listTools()).tools.map(tool=>tool.name).sort();
-  if(JSON.stringify(replacement)!==JSON.stringify(actualNames)) throw new Error('replacement core catalog drift');
+  if(JSON.stringify(replacement)!==JSON.stringify(actualNames)) throw Object.assign(new Error('replacement core catalog drift'),{kind:'terminal',code:'DEADBYTE_SCHEMA_INVALID'});
   const result=await client.callTool({name:'capability_manifest',arguments:{}},bridgeDeadlineForTool('capability_manifest'));
   verifyCompactCatalogAttestation(actualNames,result);
-  if(result?.structuredContent?.result?.schema!=='deadbyte.capability-manifest.v3') throw new Error('replacement core capability manifest v3 missing');
-  return result.structuredContent.result;
+  const manifest=result?.structuredContent?.result;
+  if(manifest?.schema!=='deadbyte.capability-manifest.v3') throw Object.assign(new Error('replacement core capability manifest v3 missing'),{kind:'terminal',code:'DEADBYTE_SCHEMA_INVALID'});
+  const status=(await client.callTool({name:'machine_status',arguments:{}},bridgeDeadlineForTool('machine_status')))?.structuredContent;
+  if(status?.status!=='ok'||!HEX64.test(String(status.machine_id??''))||!HEX64.test(String(status.online_epoch??'')))
+    throw Object.assign(new Error('replacement core execution probe failed'),{kind:'transient',code:'DEADBYTE_EXECUTION_PROBE_FAILED'});
+  if(status.release_manifest_sha256!==manifest.bindings?.release_manifest_sha256||
+    status.generation_manifest_sha256!==manifest.bindings?.generation_manifest_sha256)
+    throw Object.assign(new Error('replacement core execution binding mismatch'),{kind:'terminal',code:'DEADBYTE_GENERATION_MISMATCH'});
+  return manifest;
 }
 function bindDownstreamClose(transport){
   const sdkClose=transport.onclose;
@@ -311,8 +333,8 @@ async function reconcileDownstream(){
   if(reconnecting||shuttingDown)return;
   reconnecting=true;
   try{
-    for(let attempt=0;attempt<reconnectDelays.length&&!shuttingDown;attempt++){
-      await wait(reconnectDelays[attempt]);
+    for(let attempt=0;attempt<RECONNECT_ATTEMPT_BUDGET&&!shuttingDown;attempt++){
+      if(!(await waitForReconnect(reconnectDelayMs(attempt),reconnectAbort.signal))||shuttingDown)return;
       const nextClient=newDownstreamClient(),nextTransport=newDownstreamTransport();
       pipeCoreStderr(nextTransport);
       try{
@@ -326,7 +348,11 @@ async function reconcileDownstream(){
         return;
       }catch(error){
         await nextClient.close().catch(()=>{});
-        bridgeHealth.reconciling(`core reconnect ${attempt+1}/${reconnectDelays.length} failed: ${error?.message??String(error)}`);
+        bridgeHealth.reconciling(`core reconnect ${attempt+1}/${RECONNECT_ATTEMPT_BUDGET} failed: ${error?.message??String(error)}`);
+        if(classifyReconnectFailure(error)==='TERMINAL'){
+          bridgeHealth.degraded(`core reconnect terminal failure: ${error?.message??String(error)}`);
+          return;
+        }
       }
     }
     bridgeHealth.degraded('core restart budget exhausted; bridge quarantined');
@@ -345,6 +371,36 @@ function plannerTextFromInput(ctx) {
 
 const publicToolDefinitions=preparePublicToolDefinitions(listed.tools);
 
+const remoteDeviceId=createHash('sha256').update(endpointPath,'utf8').digest('hex');
+const ingressDelivery=new AsyncLocalStorage();
+const HEX64=/^[0-9a-f]{64}$/;
+async function dispatchDownstream(tool,args,ctx,budget){
+  if(ctx.mcpReq.signal?.aborted)throw new Error('remote request cancelled before claim');
+  const observed=(await downstream.callTool({name:'machine_status',arguments:{}},bridgeDeadlineForTool('machine_status')))?.structuredContent;
+  const capability=bridgeHealth.snapshot().capability;
+  if(observed?.status!=='ok'||!HEX64.test(String(observed.machine_id??''))||!HEX64.test(String(observed.online_epoch??''))||
+    !HEX64.test(String(observed.generation_manifest_sha256??''))||typeof observed.release_id!=='string'||
+    observed.generation_manifest_sha256!==capability?.generation_manifest_sha256||
+    observed.release_manifest_sha256!==capability?.release_manifest_sha256)
+    throw new Error('remote claim machine/release/generation observation invalid');
+  const requestId=createHash('sha256').update(canonicalJson(ctx.mcpReq.id),'utf8').digest('hex');
+  const metadata=ctx.mcpReq._meta;
+  const idempotencyKey=metadata?.idempotency_key;
+  if(idempotencyKey!==undefined&&typeof idempotencyKey!=='string')throw new Error('remote idempotency_key invalid');
+  const classification=classifyRemoteOperation(tool,args);
+  // A stateless HTTP delivery is not a durable logical session. Only an
+  // explicit idempotency key may identify a mutation across deliveries.
+  const deliveryId=ingressDelivery.getStore()?.delivery_id;
+  if(!deliveryId)throw new Error('remote ingress delivery identity missing');
+  const binding={device_id:remoteDeviceId,session_id:deliveryId,request_id:requestId,
+    ...(idempotencyKey===undefined?{}:{idempotency_key:idempotencyKey}),tool:tool.name,arguments:args,
+    expires_at_utc:new Date(Date.now()+budget.maxTotalTimeout).toISOString(),
+    machine_id:observed.machine_id,online_epoch:observed.online_epoch,release_id:observed.release_id,
+    generation_manifest_sha256:observed.generation_manifest_sha256,classification};
+  return dispatchBridgeCall({claims:remoteClaims,binding,classification,signal:ctx.mcpReq.signal,
+    invoke:()=>downstream.callTool({name:tool.name,arguments:args},budget)});
+}
+
 function buildFrontServer() {
   const front = new McpServer(
     { name: 'deadbyte-chatgpt-bridge', version: '0.2.0' },
@@ -363,16 +419,16 @@ function buildFrontServer() {
       if(!currentHealth.core||['STARTING','RECONCILING','STOPPING'].includes(currentHealth.state)) throw new Error(`bridge correlation generation=${downstreamGeneration}; downstream ${currentHealth.state.toLowerCase()}; request not dispatched`);
       if (tool.name !== 'autonomous_goal_run') {
         const audit = auditToolStart(tool.name, args);
-        const ticket = await bridgeGovernor.acquire(tool.name,{signal:ctx.mcpReq.signal});
+        const ticket = await bridgeGovernor.acquire(tool.name,{signal:ctx.mcpReq.signal,arguments:args});
         try {
-          const budget = bridgeDeadlineForTool(tool.name);
-          const result = await downstream.callTool({ name: tool.name, arguments: args }, budget);
+          const budget = bridgeDeadlineForTool(tool.name,args);
+          const result = await dispatchDownstream(tool,args,ctx,budget);
           enforceDesktopBridgeResult(tool.name, result);
           auditToolFinish(audit, result);
           return result;
         } catch (error) {
           auditToolFail(audit, error);
-          if(tool.annotations?.readOnlyHint!==true&&['RECONCILING','DEGRADED'].includes(bridgeHealth.snapshot().state)) throw new Error(`bridge correlation call=${audit.id} generation=${downstreamGeneration}; mutation outcome unknown; reconcile before retry`,{cause:error});
+          if(classifyRemoteOperation(tool,args)!=='read_only'&&['RECONCILING','DEGRADED'].includes(bridgeHealth.snapshot().state)) throw new Error(`bridge correlation call=${audit.id} generation=${downstreamGeneration}; mutation outcome unknown; reconcile before retry`,{cause:error});
           throw error;
         } finally {
           ticket.release();
@@ -386,11 +442,11 @@ function buildFrontServer() {
         callArgs.planner_response = { request_id: state.request_id, raw_text: planner.raw_text, model: planner.model };
       }
       const audit = auditToolStart(tool.name, callArgs);
-      const ticket = await bridgeGovernor.acquire(tool.name,{signal:ctx.mcpReq.signal});
+      const ticket = await bridgeGovernor.acquire(tool.name,{signal:ctx.mcpReq.signal,arguments:callArgs});
       let result;
       try {
-        const budget = bridgeDeadlineForTool(tool.name);
-        result = await downstream.callTool({ name: tool.name, arguments: callArgs }, budget);
+        const budget = bridgeDeadlineForTool(tool.name,callArgs);
+        result = await dispatchDownstream(tool,callArgs,ctx,budget);
         auditToolFinish(audit, result);
       } catch (error) {
         auditToolFail(audit, error);
@@ -451,7 +507,7 @@ const httpServer = createServer(async (req, res) => {
       res.writeHead(413, { 'content-type': 'text/plain; charset=utf-8' });
       return res.end('request too large');
     }
-    await nodeMcpHandler(req, res);
+    await ingressDelivery.run({delivery_id:randomUUID()},()=>nodeMcpHandler(req, res));
   } catch (error) {
     if (!res.headersSent) res.writeHead(500, { 'content-type': 'text/plain; charset=utf-8' });
     if (!res.writableEnded) res.end('bridge error');
@@ -474,6 +530,7 @@ console.log(`BRIDGE_AUTONOMOUS_RUNTIME ${autonomousConfigured ? 'ENABLED' : 'DIS
 
 async function shutdown() {
   shuttingDown=true;
+  reconnectAbort.abort();
   bridgeHealth.stopping();
   clearInterval(capabilityRefreshTimer);
   httpServer.close();

package/bridge/src/canonical-json-r60.mjs

@@ -0,0 +1,13 @@
+// Keep byte-for-byte canonicalization compatible with src/canonical-json.mjs.
+// Bridge dependencies are pinned inside bridge/, so this local copy is tested
+// against the Core primitive rather than reaching outside the Bridge root.
+function canonicalize(value){
+  if(Array.isArray(value))return value.map(canonicalize);
+  if(value!==null&&typeof value==='object'){
+    const out={};
+    for(const key of Object.keys(value).sort())out[key]=canonicalize(value[key]);
+    return out;
+  }
+  return value;
+}
+export function canonicalJson(value){return JSON.stringify(canonicalize(value));}

package/bridge/src/r40-governor.mjs

@@ -4,24 +4,39 @@ const DESKTOP_RAW_KEYS=new Set([
   'pixels','pixel_bytes','frame_bytes','raw_bgra','raw_rgba','raw_image','screenshot_bytes','bitmap_bytes'
 ]);
 const DEFAULT_LIMITS=Object.freeze({
+  control:Object.freeze({max_active:8,max_queue:16,queue_timeout_ms:5000}),
   normal:Object.freeze({max_active:8,max_queue:32,queue_timeout_ms:30000}),
+  bulk:Object.freeze({max_active:8,max_queue:16,queue_timeout_ms:30000}),
   autonomous:Object.freeze({max_active:2,max_queue:8,queue_timeout_ms:60000}),
   desktop_observe:Object.freeze({max_active:2,max_queue:4,queue_timeout_ms:10000}),
   desktop_action:Object.freeze({max_active:1,max_queue:2,queue_timeout_ms:5000})
 });
+const DEFAULT_SHARED_LIMITS=Object.freeze({max_active:9,max_non_control_active:8});
 const DEADLINES=Object.freeze({
+  control:Object.freeze({timeout:10000,maxTotalTimeout:15000}),
   normal:Object.freeze({timeout:120000,maxTotalTimeout:180000}),
+  bulk:Object.freeze({timeout:120000,maxTotalTimeout:180000}),
   autonomous:Object.freeze({timeout:900000,maxTotalTimeout:1200000}),
   desktop_observe:Object.freeze({timeout:30000,maxTotalTimeout:60000}),
   desktop_action:Object.freeze({timeout:30000,maxTotalTimeout:45000})
 });
 
 function insist(condition,message){ if(!condition) throw new Error(message); }
-function toolClass(name){
+function toolClass(name,args={}){
   const value=String(name??'');
   if(value==='autonomous_goal_run') return 'autonomous';
-  if(value==='desktop_action') return 'desktop_action';
+  if(value==='desktop_action'||(value==='desktop_control'&&['action','target'].includes(args?.op))) return 'desktop_action';
   if(value.startsWith('desktop_')) return 'desktop_observe';
+  if(value==='desktop_control') return 'desktop_observe';
+  if(['machine_ping','machine_status','machine_revoke','machine_list','capability_manifest',
+    'autonomous_session_status','coding_session_status'].includes(value))return 'control';
+  if(value==='machine_observe'&&['machine_ping','machine_status','machine_list'].includes(args?.op))return 'control';
+  if(['coding_search','coding_command_run','coding_benchmark_run','coding_task_run',
+    'process_session_start','process_session_read','process_session_action',
+    'machine_search_start','machine_search_page'].includes(value))return 'bulk';
+  if(value==='coding_inspect'&&['search','symbol_references','symbol_implementations'].includes(args?.op))return 'bulk';
+  if(value==='process_session'&&['start','read','action'].includes(args?.op))return 'bulk';
+  if(value==='machine_observe'&&['search_start','search_page','process_list'].includes(args?.op))return 'bulk';
   return 'normal';
 }
 function estimateBase64Bytes(value){
@@ -57,8 +72,8 @@ function scanDesktopPayload(value,{maxPreviewBytes},path='result',seen=new Set()
   seen.delete(value);
 }
 
-export function bridgeToolClass(name){ return toolClass(name); }
-export function bridgeDeadlineForTool(name){ return DEADLINES[toolClass(name)]; }
+export function bridgeToolClass(name,args){ return toolClass(name,args); }
+export function bridgeDeadlineForTool(name,args){ return DEADLINES[toolClass(name,args)]; }
 export function bridgeCatalogSha256(toolNames){
   insist(Array.isArray(toolNames)&&toolNames.every(x=>typeof x==='string'),'bridge catalog names invalid');
   const sorted=[...new Set(toolNames)].sort();
@@ -95,8 +110,12 @@ export function enforceDesktopBridgeResult(toolName,result,{maxPreviewBytes=1024
   return result;
 }
 
-export function createBridgeGovernor({limits=DEFAULT_LIMITS}={}){
-  const classes=['normal','autonomous','desktop_observe','desktop_action'];
+export function createBridgeGovernor({limits:overrides={},shared:sharedOverrides={}}={}){
+  const limits={...DEFAULT_LIMITS,...overrides};
+  const shared={...DEFAULT_SHARED_LIMITS,...sharedOverrides};
+  insist(Number.isInteger(shared.max_active)&&shared.max_active>=2&&shared.max_active<=64,'bridge shared max_active invalid');
+  insist(Number.isInteger(shared.max_non_control_active)&&shared.max_non_control_active>=1&&shared.max_non_control_active<shared.max_active,'bridge shared max_non_control_active invalid');
+  const classes=['control','normal','bulk','autonomous','desktop_observe','desktop_action'];
   for(const name of classes){
     const cfg=limits[name];
     insist(cfg&&Number.isInteger(cfg.max_active)&&cfg.max_active>=1&&cfg.max_active<=64,`bridge limit ${name}.max_active invalid`);
@@ -104,6 +123,7 @@ export function createBridgeGovernor({limits=DEFAULT_LIMITS}={}){
     insist(Number.isInteger(cfg.queue_timeout_ms)&&cfg.queue_timeout_ms>=100&&cfg.queue_timeout_ms<=120000,`bridge limit ${name}.queue_timeout_ms invalid`);
   }
   const state=new Map(classes.map(name=>[name,{active:0,queue:[],admitted:0,completed:0,rejected:0,timed_out:0,cancelled:0}]));
+  let sharedActive=0,sharedNonControlActive=0;
   let sequence=0;
   let closed=false;
   const drainWaiters=[];
@@ -113,13 +133,75 @@ export function createBridgeGovernor({limits=DEFAULT_LIMITS}={}){
     while(drainWaiters.length) drainWaiters.shift()();
   }
 
-  function dispatch(name){
+  function canAdmit(name){
     const cfg=limits[name],s=state.get(name);
-    while(s.active<cfg.max_active&&s.queue.length){
+    if(s.active>=cfg.max_active)return false;
+    if(sharedActive>=shared.max_active)return false;
+    if(name!=='control'&&sharedNonControlActive>=shared.max_non_control_active)return false;
+    return true;
+  }
+
+  function noteAdmit(name){
+    sharedActive++;
+    if(name!=='control')sharedNonControlActive++;
+  }
+
+  function noteRelease(name){
+    sharedActive=Math.max(0,sharedActive-1);
+    if(name!=='control')sharedNonControlActive=Math.max(0,sharedNonControlActive-1);
+  }
+
+  function dispatchOne(name){
+    const s=state.get(name);
+    if(!canAdmit(name))return false;
+
+    while(s.queue.length){
       const waiter=s.queue.shift();
-      if(waiter.done) continue;
-      waiter.done=true; clearTimeout(waiter.timer); waiter.cleanup(); s.active++; s.admitted++;
-      waiter.resolve(makeTicket(name,waiter.tool,waiter.id,waiter.queuedAt));
+      if(waiter.done)continue;
+
+      waiter.done=true;
+      clearTimeout(waiter.timer);
+      waiter.cleanup();
+
+      s.active++;
+      noteAdmit(name);
+      s.admitted++;
+
+      waiter.resolve(
+        makeTicket(name,waiter.tool,waiter.id,waiter.queuedAt)
+      );
+
+      return true;
+    }
+
+    return false;
+  }
+
+  function oldestAdmissibleQueuedClass(){
+    let selected=null;
+
+    for(const name of classes){
+      if(!canAdmit(name))continue;
+
+      const s=state.get(name);
+      const waiter=s.queue.find(item=>!item.done);
+
+      if(!waiter)continue;
+
+      if(selected===null||waiter.id<selected.id){
+        selected={name,id:waiter.id};
+      }
+    }
+
+    return selected?.name??null;
+  }
+
+  function dispatchAvailable(){
+    while(true){
+      const name=oldestAdmissibleQueuedClass();
+
+      if(name===null)break;
+      if(!dispatchOne(name))break;
     }
   }
   function makeTicket(name,tool,id,queuedAt){
@@ -130,19 +212,19 @@ export function createBridgeGovernor({limits=DEFAULT_LIMITS}={}){
         if(released) return false;
         released=true;
         const s=state.get(name);
-        s.active=Math.max(0,s.active-1);s.completed++;
-        dispatch(name);
+        s.active=Math.max(0,s.active-1);noteRelease(name);s.completed++;
+        dispatchAvailable();
         finishDrain();
         return true;
       }
     });
   }
-  async function acquire(tool,{signal}={}){
-    const name=toolClass(tool),cfg=limits[name],s=state.get(name),id=++sequence,queuedAt=Date.now();
+  async function acquire(tool,{signal,arguments:args}={}){
+    const name=toolClass(tool,args),cfg=limits[name],s=state.get(name),id=++sequence,queuedAt=Date.now();
     if(closed){s.rejected++;throw new Error('bridge governor closed');}
     if(signal?.aborted){s.cancelled++;throw signal.reason instanceof Error?signal.reason:new Error('bridge request aborted');}
-    if(s.active<cfg.max_active){
-      s.active++;s.admitted++;
+    if(canAdmit(name)){
+      s.active++;noteAdmit(name);s.admitted++;
       return makeTicket(name,String(tool),id,queuedAt);
     }
     if(s.queue.length>=cfg.max_queue){s.rejected++;throw new Error(`bridge backpressure queue full for ${name}`);}
@@ -193,14 +275,22 @@ export function createBridgeGovernor({limits=DEFAULT_LIMITS}={}){
     return removed;
   }
   function snapshot(){
-    return Object.freeze(Object.fromEntries(classes.map(name=>{
+    const lanes=Object.fromEntries(classes.map(name=>{
       const s=state.get(name),cfg=limits[name];
       return [name,Object.freeze({active:s.active,queued:s.queue.filter(x=>!x.done).length,max_active:cfg.max_active,max_queue:cfg.max_queue,
         admitted:s.admitted,completed:s.completed,rejected:s.rejected,timed_out:s.timed_out,cancelled:s.cancelled,saturated:s.active>=cfg.max_active})];
-    })));
+    }));
+    return Object.freeze({...lanes,shared:Object.freeze({
+      active:sharedActive,
+      non_control_active:sharedNonControlActive,
+      max_active:shared.max_active,
+      max_non_control_active:shared.max_non_control_active,
+      saturated:sharedActive>=shared.max_active
+    })});
   }
   return Object.freeze({acquire,reconcile,close,snapshot});
 }
 
 export const BRIDGE_R40_DEFAULT_LIMITS=DEFAULT_LIMITS;
+export const BRIDGE_R61_SHARED_LIMITS=DEFAULT_SHARED_LIMITS;
 

package/bridge/src/reconnect-delay-r60.mjs

@@ -0,0 +1,31 @@
+import { setTimeout as delay } from 'node:timers/promises';
+
+const BASE_DELAYS_MS=Object.freeze([250,500,1000,2000,4000]);
+
+export function reconnectDelayMs(attempt,random=Math.random){
+  if(!Number.isInteger(attempt)||attempt<0||attempt>=BASE_DELAYS_MS.length) throw new Error('reconnect attempt outside budget');
+  const sample=Number(random());
+  if(!Number.isFinite(sample)||sample<0||sample>1) throw new Error('reconnect jitter source invalid');
+  return Math.round(BASE_DELAYS_MS[attempt]*(0.75+sample*0.5));
+}
+
+export const RECONNECT_ATTEMPT_BUDGET=BASE_DELAYS_MS.length;
+
+export async function waitForReconnect(milliseconds,signal){
+  if(signal?.aborted)return false;
+  try{await delay(milliseconds,undefined,{signal});return !signal?.aborted;}
+  catch(error){if(error?.name==='AbortError')return false;throw error;}
+}
+
+export function classifyReconnectFailure(error){
+  const code=String(error?.code??'').toUpperCase();
+  if(error?.kind==='terminal')return 'TERMINAL';
+  if(error?.kind==='transient')return 'TRANSIENT';
+  if(new Set(['DEADBYTE_AUTHORITY_REVOKED','DEADBYTE_POLICY_DENIED','DEADBYTE_SCHEMA_INVALID',
+    'DEADBYTE_RELEASE_MISMATCH','DEADBYTE_GENERATION_MISMATCH','DEADBYTE_IDEMPOTENCY_CONFLICT',
+    'DEADBYTE_CLAIM_CORRUPT','DEADBYTE_CREDENTIAL_EXPIRED']).has(code))return 'TERMINAL';
+  const message=String(error?.message??error??'').toLowerCase();
+  if(['EACCES','EPERM','ENOENT'].includes(code)||/identity drift|catalog drift|protocol is not modern|attestation invalid|generation mismatch|policy mismatch/.test(message))return 'TERMINAL';
+  if(['ECONNRESET','ECONNREFUSED','EPIPE','ETIMEDOUT','EHOSTUNREACH'].includes(code)||/connection reset|transport closed|timed out|temporarily unavailable/.test(message))return 'TRANSIENT';
+  return 'TERMINAL';
+}

package/bridge/src/remote-call-claims-r60.mjs

@@ -0,0 +1,157 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { link, lstat, mkdir, open, readFile, readdir, rm } from 'node:fs/promises';
+import path from 'node:path';
+import { canonicalJson } from './canonical-json-r60.mjs';
+
+const HEX64=/^[0-9a-f]{64}$/;
+const ID=/^[A-Za-z0-9._:-]{1,160}$/;
+const sha=value=>createHash('sha256').update(canonicalJson(value),'utf8').digest('hex');
+
+async function publishOnce(target,value){
+  const temp=`${target}.${process.pid}.${randomBytes(8).toString('hex')}.tmp`;
+  const handle=await open(temp,'wx');
+  const record={...value,record_sha256:sha(value)};
+  try{await handle.writeFile(`${canonicalJson(record)}\n`,'utf8');await handle.sync();}
+  finally{await handle.close();}
+  try{await link(temp,target);return true;}
+  catch(error){if(error?.code==='EEXIST')return false;throw error;}
+  finally{await rm(temp,{force:true});}
+}
+async function readExact(file){
+  try{
+    const info=await lstat(file);
+    if(!info.isFile()||info.isSymbolicLink()||info.size>2*1024*1024)throw new Error('remote claim record type or size corrupt');
+    const record=JSON.parse(await readFile(file,'utf8'));
+    if(!record||typeof record!=='object'||Array.isArray(record))throw new Error('remote claim record corrupt');
+    const {record_sha256,...body}=record;
+    if(!HEX64.test(String(record_sha256??''))||record_sha256!==sha(body))throw new Error('remote claim record hash corrupt');
+    return body;
+  }
+  catch(error){if(error?.code==='ENOENT')return null;throw new Error(`remote claim state unreadable: ${String(error?.message||error)}`);}
+}
+function validate(binding,now){
+  if(!binding||typeof binding!=='object'||Array.isArray(binding))throw new Error('remote claim binding invalid');
+  for(const key of ['device_id','session_id','request_id','tool','release_id'])if(!ID.test(String(binding[key]??'')))throw new Error(`remote claim ${key} invalid`);
+  if(binding.idempotency_key!==undefined&&!ID.test(String(binding.idempotency_key)))throw new Error('remote claim idempotency_key invalid');
+  if(!HEX64.test(String(binding.machine_id??'')))throw new Error('remote claim machine_id invalid');
+  if(!HEX64.test(String(binding.generation_manifest_sha256??'')))throw new Error('remote claim generation binding invalid');
+  if(!HEX64.test(String(binding.online_epoch??'')))throw new Error('remote claim online epoch invalid');
+  if(!['read_only','mutating','unknown'].includes(binding.classification))throw new Error('remote claim classification invalid');
+  if(!binding.arguments||typeof binding.arguments!=='object'||Array.isArray(binding.arguments))throw new Error('remote claim arguments invalid');
+  const expires=Date.parse(binding.expires_at_utc);
+  if(!Number.isFinite(expires))throw new Error('remote claim deadline invalid');
+  if(expires<=now)throw new Error('remote request expired');
+  return Object.freeze({schema:'deadbyte.remote-call-claim.v1',device_id:binding.device_id,session_id:binding.session_id,
+    idempotency_key:binding.idempotency_key??null,
+    request_id:String(binding.request_id),tool:binding.tool,payload_sha256:sha(binding.arguments),
+    received_at_utc:new Date(now).toISOString(),expires_at_utc:new Date(expires).toISOString(),
+    release_id:binding.release_id,generation_manifest_sha256:binding.generation_manifest_sha256,
+    machine_id:binding.machine_id,online_epoch:binding.online_epoch,classification:binding.classification});
+}
+
+export function openRemoteCallClaims({root,clock=Date.now}={}){
+  if(typeof root!=='string'||!path.isAbsolute(root)||typeof clock!=='function')throw new Error('remote claim store options invalid');
+  const directory=path.resolve(root);
+  function files(id){
+    if(!HEX64.test(String(id)))throw new Error('remote claim identity invalid');
+    const base=path.join(directory,id.slice(0,2),id);
+    return {base,claim:`${base}.claim.json`,claimed:`${base}.claimed.json`,dispatch:`${base}.dispatch.json`,interrupted:`${base}.interrupted.json`,terminal:`${base}.terminal.json`};
+  }
+  async function state(claimId){
+    const f=files(claimId);
+    const claim=await readExact(f.claim);
+    if(!claim||claim.schema!=='deadbyte.remote-call-claim.v1')throw new Error('remote claim missing or invalid');
+    const terminal=await readExact(f.terminal);
+    if(terminal){
+      if(terminal.schema!=='deadbyte.remote-call-terminal.v1'||terminal.claim_id!==claimId||
+        !HEX64.test(String(terminal.result_sha256??''))||terminal.result_sha256!==sha(terminal.result))
+        throw new Error('remote claim terminal hash corrupt');
+      return Object.freeze({claim_id:claimId,owner:false,state:'TERMINAL',side_effect_state:claim.classification==='read_only'?'none':'unknown',result:terminal.result});
+    }
+    const interrupted=await readExact(f.interrupted);
+    if(interrupted){
+      if(interrupted.schema!=='deadbyte.remote-call-interrupted.v1'||interrupted.claim_id!==claimId)throw new Error('remote claim interruption corrupt');
+      return Object.freeze({claim_id:claimId,owner:false,state:'INTERRUPTED',side_effect_state:claim.classification==='read_only'?'none':'unknown'});
+    }
+    const dispatched=await readExact(f.dispatch);
+    if(dispatched)return Object.freeze({claim_id:claimId,owner:false,state:'EXECUTING',side_effect_state:claim.classification==='read_only'?'none':'may_have_started'});
+    const claimed=await readExact(f.claimed);
+    return Object.freeze({claim_id:claimId,owner:false,state:claimed?'CLAIMED':'RECEIVED',side_effect_state:'not_started'});
+  }
+  async function claim(binding){
+    const record=validate(binding,Number(clock()));
+    const claimId=record.idempotency_key===null
+      ?sha({device_id:record.device_id,session_id:record.session_id,request_id:record.request_id})
+      :sha({device_id:record.device_id,idempotency_key:record.idempotency_key});
+    const f=files(claimId);
+    await mkdir(path.dirname(f.base),{recursive:true});
+    if(await publishOnce(f.claim,record)){
+      const owner=await publishOnce(f.claimed,{schema:'deadbyte.remote-call-claimed.v1',claim_id:claimId,execution_state:'CLAIMED',side_effect_state:'not_started'});
+      return owner?Object.freeze({claim_id:claimId,owner:true,state:'CLAIMED',side_effect_state:'not_started'}):state(claimId);
+    }
+    const prior=await readExact(f.claim);
+    if(!prior||prior.schema!==record.schema)throw new Error('remote claim identity corrupt');
+    if(Date.parse(prior.expires_at_utc)<=Number(clock()))throw new Error('remote request expired');
+    if(prior.tool!==record.tool||prior.payload_sha256!==record.payload_sha256)throw new Error(record.idempotency_key===null?'request_id_conflict':'idempotency_key_conflict');
+    if(prior.device_id!==record.device_id||prior.idempotency_key!==record.idempotency_key||
+      (record.idempotency_key===null&&(prior.session_id!==record.session_id||prior.request_id!==record.request_id)))throw new Error('remote claim identity drift');
+    if(prior.release_id!==record.release_id||prior.generation_manifest_sha256!==record.generation_manifest_sha256)throw new Error('remote claim release identity drift');
+    if(prior.machine_id!==record.machine_id||prior.online_epoch!==record.online_epoch||prior.classification!==record.classification)throw new Error('remote claim machine/epoch/classification drift');
+    const current=await state(claimId);
+    if(current.state==='RECEIVED'&&await publishOnce(f.claimed,{schema:'deadbyte.remote-call-claimed.v1',claim_id:claimId,execution_state:'CLAIMED',side_effect_state:'not_started'}))
+      return Object.freeze({claim_id:claimId,owner:true,state:'CLAIMED',side_effect_state:'not_started'});
+    return state(claimId);
+  }
+  async function dispatch(claimId){
+    const f=files(claimId);
+    if(!(await readExact(f.claimed)))throw new Error('remote claim not claimed before dispatch');
+    if(!(await publishOnce(f.dispatch,{schema:'deadbyte.remote-call-dispatch.v1',claim_id:claimId,at_utc:new Date(Number(clock())).toISOString(),execution_state:'EXECUTING',side_effect_state:'may_have_started'})))
+      throw new Error('remote claim already dispatched; outcome unknown');
+    return Object.freeze({claim_id:claimId,state:'EXECUTING',side_effect_state:'may_have_started'});
+  }
+  async function terminal(claimId,result){
+    const f=files(claimId);
+    if(!(await readExact(f.dispatch)))throw new Error('remote claim not dispatched');
+    const bytes=Buffer.byteLength(canonicalJson(result),'utf8');
+    if(bytes>1048576)throw new Error('remote claim terminal result exceeds bound');
+    if(!(await publishOnce(f.terminal,{schema:'deadbyte.remote-call-terminal.v1',claim_id:claimId,
+      at_utc:new Date(Number(clock())).toISOString(),result_sha256:sha(result),result})))throw new Error('remote claim already terminal');
+    return state(claimId);
+  }
+  async function recover({after=null,limit=100}={}){
+    if(after!==null&&!HEX64.test(String(after)))throw new Error('remote recovery cursor invalid');
+    if(!Number.isInteger(limit)||limit<1||limit>100)throw new Error('remote recovery batch limit invalid');
+    const records=[];let more=false;
+    for(let shard=0;shard<256;shard++){
+      const prefix=shard.toString(16).padStart(2,'0');
+      if(after&&prefix<after.slice(0,2))continue;
+      const folder=path.join(directory,prefix);
+      let names;
+      try{
+        const info=await lstat(folder);
+        if(!info.isDirectory()||info.isSymbolicLink())throw new Error('remote recovery shard corrupt');
+        names=await readdir(folder);
+      }catch(error){if(error?.code==='ENOENT')continue;throw error;}
+      if(names.length>4096)throw new Error('remote recovery shard exceeds bounded inventory');
+      for(const name of names.filter(item=>/^[0-9a-f]{64}\.claim\.json$/.test(item)).sort()){
+        const id=name.slice(0,64);
+        if(after&&id<=after)continue;
+        if(records.length>=limit){more=true;break;}
+        const claimRecord=await readExact(files(id).claim);
+        if(!claimRecord||claimRecord.schema!=='deadbyte.remote-call-claim.v1')throw new Error('remote recovery claim corrupt');
+        if(Date.parse(claimRecord.expires_at_utc)<=Number(clock()))continue;
+        let current=await state(id);
+        if(current.state==='TERMINAL')continue;
+        if(current.state==='EXECUTING'){
+          await publishOnce(files(id).interrupted,{schema:'deadbyte.remote-call-interrupted.v1',claim_id:id,
+            at_utc:new Date(Number(clock())).toISOString(),execution_state:'INTERRUPTED',side_effect_state:current.side_effect_state==='none'?'none':'unknown'});
+          current=await state(id);
+        }
+        records.push(current);
+      }
+      if(more)break;
+    }
+    return Object.freeze({records,next_cursor:more?records.at(-1)?.claim_id??after:null});
+  }
+  return Object.freeze({claim,dispatch,terminal,state,recover});
+}