[KodeStar]

Bridge Phase 2c-2b: on-demand podcast play, Bridge side. Builds on 2c-2a (#8). No migration. Pairs with KodeStar/audiosilo-server#164 and KodeStar/audiosilo-docs#158.

What

• Interactive pool: a generic pool with capacity 1 that a job kind opts into; podcast.fetch is the first. It claims only jobs at priority 100 or higher, via GET /bridge/jobs/next?...&min_priority=100, and only after the heartbeat reply's accepts names claim_min_priority.
• Lane capacities: with a server that negotiates, the ordinary download lane drops to 1, so total enclosure concurrency stays at 2. Light (2) and pipeline (25) are unchanged. An older server keeps download at 2 and gets no reserved claim.
• Claim refresh: a change in free kinds, reserve eligibility, pairing or capacity cancels and joins the outstanding long-poll claim, then reissues at once. Unchanged heartbeats leave it alone. A job returned during the cancel is owned and run; release, recovered and parked jobs wake the dispatchers.
• Rollback safety: if a server ignores the filter (rolled back before the next heartbeat), the job it returns is never failed. It keeps its lease and runs in its ordinary lane, and negotiation is withdrawn until a heartbeat advertises it again. A misbehaving server holds at most one stray waiter per dispatcher, and an ordinary claim answered outside the requested kinds backs off.

Why
Plan .bridge-2c2/plan/plan.md sections 2.12 and 4.3 (D13, D14), plus section 11. Shapes come from internal/podcast/testdata/phase2c2/wire-2b.json, byte-identical in the server repo.

Tests and review

• Fake-server tests driven by channels, with no sleeps: negotiation in both directions, reserve-first under saturation, prompt reissue, the cancel race, re-pair, recovery, rollback before a heartbeat, concurrency of at most 2.
• Gate: go build, go vet, go test -race ./... and golangci-lint all green.
• Review: one xhigh pass (/simplify and /code-review --fix), then one high pass on the fix round.

Live verification (one harness, a real server, the 2c-2a binaries for the fallbacks, one fixture server)

• Reserve-first held: background work stayed queued, and the interactive download started 5 ms after the request.
• A claim was reissued 1 ms after a lane freed. Enclosure concurrency stayed at 2.
• With a 2c-2a server: download lane 2 and no min_priority claims.
• With a 2c-2a Bridge against the new server: it keeps working, without claim refresh (22 s until a free lane takes the interactive job).
• The rollback-before-heartbeat failure found live is fixed in this PR (1c6fd2f and its review); the live re-run result is in the comments.

[KodeStar]

Live re-run of the rollback check at a8ab6e8 (server e4768eb, 2c-2a server binary): PASS. Three admin fetches queued after swapping to the 2c-2a server before the next heartbeat all finished done, none failed and no cooldown started. The one min_priority claim the old server answered ran its priority-20 job in an ordinary lane; no further min_priority claims; after the old heartbeat download lane 2. Swapping back re-advertised claim_min_priority and the reserve claimed an interactive fetch at 100 (download 7 ms after the request). Peak enclosures 2.