machine-bridge-mcp 3.0.0-beta.15 → 3.0.0-beta.16

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## 3.0.0-beta.16 - 2026-07-25
+
+### Pending-call recovery and verified handover
+
+- Separate the upstream MCP host/connector shard-mapper incident from Machine Bridge evidence. The exact temporary-keyspace error never appeared in Worker or daemon diagnostics and did not increment Worker server-error counters, so it is documented as an external boundary failure with unknown platform ownership rather than misclassified as a local daemon, OAuth, Git, or Cloudflare defect.
+- Close the Machine Bridge failure-amplification path discovered after recovery. Pending calls now retain monotonic operation and reconnect deadlines, schedule the earliest deadline through the Durable Object alarm, and run a compensating overdue sweep on every HTTP/WebSocket event. In-memory timers remain the fast path; a transient alarm-storage error is observable without converting already-dispatched work into a false terminal failure.
+- Make verified same-instance daemon handover atomic with respect to in-flight calls. Both attached and detached records move to the replacement before the incumbent closes, the complete `resume_calls` set is sent, remaining operation timeout is preserved, and failed replacement acknowledgement restores ownership to a still-open incumbent.
+- Add deterministic disabled-timer deadline tests, direct runtime-alarm scheduling/failure tests, and a real Wrangler/workerd race regression that connects a same-instance replacement while the incumbent still owns an active call. The call remains active rather than detached and completes through the verified replacement.
+- Use null-prototype dictionaries for managed-job `env` and `env_resources`, so valid variable names such as `__proto__`, `constructor`, `toString`, and `valueOf` remain ordinary own data instead of mutating JavaScript object prototypes. Add behavior coverage without weakening duplicate-variable rejection.
+- Correct architecture and operations documentation that still described Durable Object `waitUntil` ownership or direct rejection during socket replacement. Document the three deadline enforcement paths, stale-pending diagnosis, host/connector internal-storage error triage, and the exact test evidence.
+
 ## 3.0.0-beta.15 - 2026-07-25
 
 ### Event-driven streamed-call settlement

package/browser-extension/manifest.json

@@ -30,6 +30,6 @@
   "action": {
     "default_title": "Machine Bridge Browser"
   },
-  "version_name": "3.0.0-beta.15",
+  "version_name": "3.0.0-beta.16",
   "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxryYkpZhq8+VAQLHcGS9BAHQcyKX8RHGIpIwvtIVRU/rcOcE0bNdnM0aZJ/h6xWQsGDHlhvjT2+1aJaAn/9k8473BRWajzVXld961CdHYVFVHoce2hHiSJ0xydWrHMMZhAm0mN0UzjEpgZ0tMw209efcZHIvSwuxhteZMRy4kyiVjwFlOf5oXFCxRuCJnPj3AK9CmCf4XgEBuPIJ0TZmjGHOOdBvJmbCNnAWXYEo5/mf7MfCGhV4IJ1hNuhpoNQfOFKMUcw9/v/IpT62XpfXdGYTfGYCmCjC+gntK1spbkr2P4/2+sYMQtLpse71mpSNGXfcf3abU55Vpn+gncSxRQIDAQAB"
 }

package/docs/ARCHITECTURE.md

@@ -111,7 +111,7 @@ All requests for a deployed Worker route to one named Durable Object. It owns:
 - OAuth clients, authorization codes, hashed access-token records, an independently versioned hashed refresh-token store, and throttling metadata;
 - one active end-to-end-verified daemon WebSocket plus bounded candidate and probing sockets;
 - policy/tool metadata attached to the active socket;
-- a bounded in-memory map of pending daemon calls;
+- a bounded in-memory map of pending daemon calls, with monotonic operation/reconnect deadlines projected onto Durable Object alarms and rechecked at every event boundary;
 - bounded resumable MCP delivery metadata and terminal responses for recently disconnected SSE clients.
 
 `BridgeRoom` owns Durable Object routing, MCP authorization/dispatch, daemon WebSocket lifecycle, pending relay-call composition, cancellation, and resumable state. `mcp-stream-proxy.ts` owns the outer-Worker transport adapter: it strips public internal-control headers, obtains a bounded authenticated descriptor, creates the client-facing SSE stream, and polls terminal state through short immediate service-binding requests. `mcp-access.ts` owns shared Bearer/DPoP authorization for POST and recovery GET. `mcp-resumption-http.ts` owns recovery routing and signed session/protocol binding and returns descriptors rather than a long-lived response. `mcp-resumption.ts` owns stream admission, transaction ordering, immediate pending/terminal polls, expiry, replay, and lifecycle state; `mcp-resumption-records.ts` owns the compact metadata index, terminal-message bounds, serialization, and SHA-256 integrity metadata. `mcp-stream.ts` owns SSE sequence-zero/sequence-one framing and heartbeats. `mcp-jsonrpc.ts` owns JSON-RPC shape validation, result/error framing, MCP tool-result projection, session-instruction bounds, and protocol-header validation. `websocket-protocol.ts` owns record validation plus best-effort send/close/rejection helpers. `OAuthController` owns OAuth-store pruning, registration throttling, authorization submission, account-admin routing, token exchange, access-token verification, and the serialization queue for OAuth mutations. Worker-internal TypeScript imports use explicit `.ts` specifiers and JSON import attributes, so the same modules are directly executable under the pinned Node runtime and bundled by Wrangler.
@@ -172,7 +172,7 @@ Remote OAuth binds each code, access token, and refresh token to a named Machine
 7. The MCP client initializes against the sole current protocol version; an obsolete client must upgrade rather than enter a legacy execution path. The Worker returns a stateless HMAC-bound `MCP-Session-Id`, and later request/cancellation correlation is scoped by OAuth token, MCP session, JSON-RPC id type, and id value. Two clients may therefore reuse the same JSON-RPC id concurrently without collision. Sessionless POSTs remain independent and are not inserted into a token-global cancellation index. When the daemon advertises `session_bootstrap`, the Worker requests bounded local instructions and appends them to the initialization result; failure degrades to static instructions.
 8. A new daemon first authenticates as a bounded `probing` socket. The Worker sends a random `relay_probe`; the local runtime returns it through the normal session-bound result-delivery path; only the matching result produces `ready_ack`, promotion to the active daemon, and safe replacement of an incumbent connection.
 9. `tools/list` is derived only from the active end-to-end-verified daemon; without one, only `server_info` is advertised.
-10. `tools/call` receives a random relay call ID and is bound to the current daemon socket, that daemon process's ephemeral instance identifier, and the authenticated client request key. When the client accepts `text/event-stream`, the Worker immediately returns an SSE priming frame, emits bounded keepalive comments while the call runs, and retains the dispatch with Durable Object `waitUntil`; JSON-only clients retain the single terminal response.
+10. `tools/call` receives a random relay call ID and is bound to the current daemon socket, that daemon process's ephemeral instance identifier, and the authenticated client request key. When the client accepts `text/event-stream`, `BridgeRoom` commits recovery state, registers an event-settled pending call, sends the daemon envelope, and returns a bounded descriptor immediately; the outer Worker owns the SSE priming frame, keepalives, and terminal polling. No unresolved terminal Promise or Durable Object `waitUntil` owns the dispatch. JSON-only clients retain the single terminal response.
 11. The runtime validates policy and arguments, executes the tool, and returns a bounded result. Closing or losing the HTTP response stream only makes that stream unwritable; it is not an MCP cancellation and does not remove the pending request.
 12. If the socket remains ready, the Durable Object accepts the result only from that socket. If it drops, the Worker detaches the pending call for at most two minutes and accepts completion only after a replacement socket with the same daemon-process identifier has passed the end-to-end readiness probe. The local runtime preserves the operation and queues a completion over the same shared interval. The Worker pauses the record's remaining normal deadline while detached and resumes it after same-instance rebinding, so connected calls are not granted an unconditional recovery extension.
 13. Only a matching session-scoped `notifications/cancelled` request removes the pending indexes and sends best-effort cancellation to a connected daemon. Local completion that races with explicit cancellation is discarded. On every readiness handover, the Worker first sends an authoritative bounded `resume_calls` set; the runtime cancels active calls and queued results absent from that set before accepting `ready_ack`. A request explicitly cancelled while disconnected therefore cannot be revived by a fast reconnect.
@@ -255,7 +255,7 @@ Reconnect uses bounded exponential backoff with jitter. Brief self-healing inter
 
 The Worker stores socket transitions in `DaemonSocketRegistry`: `candidate` before hello, `probing` after authentication, `daemon` only after the end-to-end result probe, and `expired` after terminal failure. Durable Object alarms enforce separate hello, readiness, and steady-state liveness deadlines across hibernation. A healthy incumbent remains active while a replacement is probed; a malformed, silent, incompatible, or identity-mismatched replacement is closed without displacing it. Only a verified candidate receives `ready_ack` and then replaces the old socket. Ready daemons stay live only while inbound traffic refreshes `lastSeenAt`; silent half-open or hibernation-restored sockets are reclaimed instead of advertising `daemon.connected` while tool calls time out.
 
-Each daemon process generates a random bounded `instance_id` at startup and includes it in every reconnect hello. Pending calls normally retain their assigned socket. On an unexpected socket loss, only those records are detached and the shared two-minute relay contract bounds recovery. A verified socket with the same instance ID rebinds them; another process or socket cannot resolve them. The local runtime mirrors that state machine by preserving active calls and completed-result envelopes until relay readiness returns. Before `ready_ack`, the Worker sends the exact IDs that still have remote waiters; the runtime cancels everything else and only then replays retained results through the verified socket. Grace expiry restores the terminal behavior: reject remote waiters, cancel local ordinary calls, terminate process trees, and discard undeliverable results. The shared execution envelope remains independent of reconnect grace. Worker operation countdown is paused while detached and resumed on same-instance rebinding, so a healthy unresponsive daemon still fails on the normal deadline while a recoverable disconnected call is not expired by two competing timers. This does not make calls durable across daemon restart or machine failure; managed jobs remain the separate durable mechanism.
+Each daemon process generates a random bounded `instance_id` at startup and includes it in every reconnect hello. Pending calls normally retain their assigned socket. On an unexpected socket loss, only those records are detached and the shared two-minute relay contract bounds recovery. During verified same-instance handover, the Worker transfers both already-detached calls and still-attached calls from the incumbent socket to the replacement before closing the incumbent; this prevents the asynchronous close event from creating a detached call after the only rebind pass. If replacement acknowledgement fails, ownership is restored to the still-open same-instance incumbent. Another process cannot inherit or resolve these calls. The local runtime mirrors that state machine by preserving active calls and completed-result envelopes until relay readiness returns. Before `ready_ack`, the Worker sends the exact IDs that still have remote waiters; the runtime cancels everything else and only then replays retained results through the verified socket. Grace expiry restores the terminal behavior: reject remote waiters, cancel local ordinary calls, terminate process trees, and discard undeliverable results. The shared execution envelope remains independent of reconnect grace. Worker operation countdown is paused while detached or transferred and resumed with its remaining budget, so handover cannot reset the normal timeout. In-memory timers are only the fast path: the earliest monotonic pending deadline is also scheduled as a Durable Object alarm, and every HTTP or WebSocket event performs a compensating overdue scan. A transient alarm-storage failure is observable but does not turn an already-dispatched operation into a false terminal failure; the next event scan remains the bounded recovery path. This does not make calls durable across daemon restart or machine failure; managed jobs remain the separate durable mechanism.
 
 ## Persistence
 

package/docs/AUDIT.md

@@ -1,5 +1,19 @@
 # Security and privacy audit notes
 
+## 2026-07-25 version 3.0.0-beta.16 pending-call recovery and boundary audit
+
+The reported incident exposed two separate failure domains. The host/connector layer returned `No shard mapper found` for a temporary high-replication backfill keyspace and then rejected even minimal MCP calls. The exact text did not exist in Machine Bridge source, deployed Worker events, daemon logs, or local command output; Worker HTTP server-error counters remained unchanged. The original shard-routing failure therefore occurred before or outside the deployed Worker/daemon boundary. The evidence is insufficient to identify the owner of that upstream temporary store, so this audit does not misattribute it to Cloudflare, the local daemon, OAuth, or Git. The host path later recovered without credential rotation or state deletion.
+
+Independent inspection after recovery found a real Machine Bridge amplification defect: two calls remained active and detached beyond the shared two-minute reconnect grace. Pending operation and reconnect expiry used only in-memory `setTimeout` callbacks. Event-driven streamed calls intentionally return from the initiating Durable Object event, so a timer alone was not a valid cross-event lifecycle guarantee. The Worker now records monotonic operation/reconnect deadlines, exposes the earliest remaining duration to one combined Durable Object alarm, and performs an overdue scan at every HTTP and WebSocket event boundary. Timer callbacks remain the low-latency path. Alarm-storage failure emits only a bounded coarse event and does not falsely fail work that was already dispatched; the next event scan is the compensating path.
+
+A second race existed during verified daemon replacement. The previous implementation rebound only already-detached calls, then closed the incumbent socket. Calls still attached to that socket were detached later by its asynchronous close callback, after the only rebind pass, and could remain orphaned. Same-instance promotion now transfers both attached and detached calls to the candidate before closing the incumbent, sends the complete authoritative `resume_calls` set, preserves the remaining normal timeout, and restores ownership to a still-open incumbent if replacement acknowledgement fails. Different daemon instances remain unable to inherit calls.
+
+The broader review found a separate prototype-sensitive input defect in managed-job environment maps. POSIX/Windows-compatible variable validation permits names such as `__proto__`, `constructor`, `toString`, and `valueOf`, but validation accumulated them into ordinary JavaScript objects. Assigning `__proto__` invoked the legacy prototype setter rather than creating an own environment entry. Both plain and resource-backed environment maps now use null-prototype dictionaries, with stage/inspection regression coverage for all prototype-shaped keys and the existing duplicate-variable denial.
+
+Documentation had also drifted: the remote lifecycle still claimed streamed work used Durable Object `waitUntil`, despite beta.15 explicitly removing and architecture tests forbidding that design. Architecture, operations, testing, changelog, and this audit now describe event-settled dispatch, alarm-plus-sweep deadline enforcement, atomic same-instance handover, upstream-host diagnosis, and prototype-safe environment maps. Complete and production dependency audits report zero vulnerabilities; privacy history, critical-module coverage, Worker dry-run, deterministic lifecycle tests, managed-job integration, type checks, lint, and real Wrangler OAuth/MCP integration pass before candidate preparation.
+
+These source changes do not claim to repair the upstream shard mapper or prove its platform owner. They prevent a transient external failure or socket replacement from leaving permanent pending-call occupancy inside Machine Bridge. No Worker deployment, daemon/service replacement, global installation, credential rotation, push, tag, npm publication, or GitHub Release is performed by the source audit itself. Exact beta.16 candidate activation and owner-machine verification remain mandatory.
+
 ## 2026-07-25 version 3.0.0-beta.15 event-lifecycle audit
 
 The exact beta.14 candidate was activated by the repository owner. The Worker, launchd daemon, private runtime path, activation record, candidate checksum, `status`, and `doctor` all converged on `3.0.0-beta.14`; the globally installed beta.12 package remained the explicit rollback baseline. A random temporary owner account and OAuth client then exercised the production protocol and were removed after the run. Sequence zero, token/session isolation, disconnect recovery, terminal sequence one, and empty acknowledgement replay all passed.

package/docs/OPERATIONS.md

@@ -51,12 +51,18 @@ A successful diagnostic result applies only to that probe. An MCP host can still
 
 Machine Bridge supports concurrent calls: the Worker admits up to 32 pending daemon calls and the local runtime admits up to 16 active tool calls. These are capacity limits, not a single global execution queue. Each successful MCP initialization receives a signed `MCP-Session-Id`; JSON-RPC ids and cancellation are scoped to that session, so separate chat windows may reuse the same numeric ids safely even when they share one OAuth account and token.
 
-`server_info.worker.pending_calls` reports `active`, `detached`, `request_keys`, `maximum`, `oldest_ms`, and `by_tool`. `worker.sockets_live` separately reports `authenticated`, `probing`, `ready`, and `candidates`; only `ready` sockets contribute to `daemon.connected` and tool advertisement. A nonzero `active` count means work is in flight, not that the bridge is locked. `detached > 0` means a daemon socket was lost and those requests are inside the bounded two-minute same-instance reconnect window. Calls for simple reads and probes should continue while another independent process call runs. Only explicit session-scoped MCP cancellation, timeout, or reconnect-grace expiry removes the pending record and its request key; an HTTP response disconnect is not cancellation. A daemon-socket closure detaches only calls assigned to that socket; the same daemon process can reclaim them after completing readiness, while another process cannot. Grace expiry rejects the request and cancels the local ordinary operation. Refreshing a chat page is not the recovery mechanism and should not be required.
+`server_info.worker.pending_calls` reports `active`, `detached`, `request_keys`, `maximum`, `oldest_ms`, and `by_tool`. `worker.sockets_live` separately reports `authenticated`, `probing`, `ready`, and `candidates`; only `ready` sockets contribute to `daemon.connected` and tool advertisement. A nonzero `active` count means work is in flight, not that the bridge is locked. `detached > 0` means a daemon socket was lost and those requests are inside the bounded two-minute same-instance reconnect window. Calls for simple reads and probes should continue while another independent process call runs. Only explicit session-scoped MCP cancellation, timeout, or reconnect-grace expiry removes the pending record and its request key; an HTTP response disconnect is not cancellation. A daemon-socket closure detaches only calls assigned to that socket; the same daemon process can reclaim them after completing readiness, while another process cannot. A verified same-instance replacement transfers both detached and still-attached calls before the incumbent closes. Normal and reconnect deadlines have three enforcement paths: monotonic in-event timers, a Durable Object alarm, and an overdue sweep at the next HTTP/WebSocket event. Therefore `detached > 0` with `oldest_ms` materially beyond the two-minute grace is a lifecycle defect rather than normal recovery. Grace expiry rejects the request and cancels the local ordinary operation. Refreshing a chat page is not the recovery mechanism and should not be required.
 
 For Streamable HTTP clients such as ChatGPT that advertise `text/event-stream`, the outer Worker returns an immediate sequence-zero SSE event identifier and a keepalive comment every ten seconds until the terminal sequence-one JSON-RPC result. `BridgeRoom` never owns the long-lived public stream or an unresolved terminal Promise. Stream initiation commits recovery state, registers the daemon call, sends it, and returns a descriptor; a later WebSocket result, explicit cancellation, timeout, send failure, or reconnect-grace expiry writes the terminal result. Short pending/terminal polls therefore coexist with concurrent `server_info`, recovery, and session-scoped `notifications/cancelled` requests while SSE remains open. Caller-supplied internal stream headers are removed at the public boundary. If the client or an intermediary closes the stream, Machine Bridge keeps the bounded operation alive; only `notifications/cancelled` carries cancellation semantics. A compatible host resumes the original stream with authenticated `GET /mcp`, the original `MCP-Session-Id`, and `Last-Event-ID`; it must not repeat the POST. Recovery records are token/session-bound, retained for at most two minutes, limited to 64 streams, and persist at most 1.5 MiB of terminal JSON. Error `-32002` means the online result exceeded the replay budget; `-32003` means the Worker restarted before it could persist a terminal result and the operation may already have produced side effects; reconcile state before retrying. Error `-32005` means stored replay data failed integrity validation.
 
 `server_info.worker.observability.calls.unmatched_results` counts results that reached the Worker after their pending record was already removed. A small increase can accompany cancellation or timeout races, especially during mixed-version upgrade convergence; sustained growth together with old pending calls indicates incompatible components or a lifecycle defect. The counter contains no tool arguments or result data.
 
+### MCP host or connector internal-storage errors
+
+An error naming an internal shard mapper, temporary keyspace, backfill store, or connector database is not automatically a Machine Bridge Worker or daemon error. During the beta.15 incident, the exact error text was absent from repository source, Worker events, daemon logs, and local process output; Worker HTTP `server_error` counters also did not increase, while the host temporarily failed even `server_info`. That evidence places the original failure before or outside the deployed Worker/daemon boundary, but it does not identify which upstream platform component owned the temporary store. Do not rotate OAuth/device credentials, delete local state, or restart a healthy daemon solely because of such a message.
+
+After the host path recovers, run `server_info`, `machine-mcp doctor`, and `machine-mcp service status`. Compare Worker `requests.server_error`, pending-call age, ready socket count, daemon PID/start time, and local logs. If the upstream text never appears locally and Worker server errors remain unchanged, report the host/connector incident separately. If pending calls remain older than their operation or reconnect deadline, that is a Machine Bridge lifecycle issue and should be investigated independently rather than attributed to the upstream shard error.
+
 ### Relay interruption messages
 
 A reconnect warning is evidence of a transport outage, not proof that the daemon process exited. Compare daemon PID/process start, `connected_at`, `last_seen_at`, `runtime.relay.last_disconnected_at`, close category/code, and outage count. A system VPN/TUN may remain shown as connected while its internal route is unavailable; Machine Bridge reports that route only as `system-network-stack` with application-proxy scope. The reconnect schedule now tops out at fifteen seconds.

package/docs/TESTING.md

@@ -159,4 +159,4 @@ The stdio integration test also sends an oversized line, verifies bounded reject
 
 `npm run mcp-resumption:test` directly exercises stream cursor parsing, OAuth-token/MCP-session isolation, immediate pending/terminal polls, active and completed replay, Worker-restart ambiguity, result-size fallback, SHA-256 tamper detection, transient persistence failure, expiry, capacity, and completed-record eviction.
 
-`npm run worker-runtime-infrastructure:test` verifies outer-Worker stream ownership, stripping of caller-supplied internal headers, bounded descriptor/poll adaptation, sequence-zero/sequence-one framing, poll-error closure, and the shared two-minute/64-stream/1.5-MiB contract. It also models the production event-lifecycle boundary: event-mode registration must return without a terminal Promise or early settlement, while later success, daemon rejection, explicit cancellation, timeout, send failure, result transformation, persistence failure, and same-instance reconnect each produce one terminal result and remove pending indexes. `npm run worker:integration-test` performs the real Wrangler path: keep SSE open while a concurrent `server_info` succeeds and explicit cancellation reaches the matching daemon call; disconnect after sequence zero; reject another session; recover with GET plus `Last-Event-ID`; and prove a sequence-one acknowledgement is not delivered twice. Static architecture checks forbid a stream-initiation `dispatchJsonRpc` Promise, `resumption.attach`, Durable Object `waitUntil`, or Promise-valued recovery state. The parser accumulates complete SSE events and does not assume network chunk boundaries. CORS coverage requires both `DPoP` and `Last-Event-ID`.
+`npm run worker-runtime-infrastructure:test` verifies outer-Worker stream ownership, stripping of caller-supplied internal headers, bounded descriptor/poll adaptation, sequence-zero/sequence-one framing, poll-error closure, and the shared two-minute/64-stream/1.5-MiB contract. It also models the production event-lifecycle boundary: event-mode registration must return without a terminal Promise or early settlement, while later success, daemon rejection, explicit cancellation, timeout, send failure, result transformation, persistence failure, and same-instance reconnect each produce one terminal result and remove pending indexes. Deadline tests deliberately use a scheduler that never fires callbacks, advance the monotonic clock, and prove that event-boundary sweeps expire both attached operation deadlines and detached reconnect deadlines without leaking request keys. A direct runtime-alarm coordinator test verifies earliest-pending scheduling, alarm removal when no deadline remains, event-entry expiry before rescheduling, and bounded reporting when Durable Object alarm storage fails. The same suite also proves that direct same-instance handover transfers an attached call and preserves its remaining timeout budget. `npm run worker:integration-test` performs the real Wrangler path: keep SSE open while a concurrent `server_info` succeeds and explicit cancellation reaches the matching daemon call; connect a verified same-instance replacement while the incumbent still owns an in-flight call and prove transfer occurs before incumbent close; disconnect after sequence zero; reject another session; recover with GET plus `Last-Event-ID`; and prove a sequence-one acknowledgement is not delivered twice. Managed-job integration treats `__proto__`, `constructor`, `toString`, and `valueOf` environment/resource-map keys as ordinary own data while retaining duplicate-key rejection. Static architecture checks forbid a stream-initiation `dispatchJsonRpc` Promise, `resumption.attach`, Durable Object `waitUntil`, or Promise-valued recovery state. The parser accumulates complete SSE events and does not assume network chunk boundaries. CORS coverage requires both `DPoP` and `Last-Event-ID`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "machine-bridge-mcp",
-  "version": "3.0.0-beta.15",
+  "version": "3.0.0-beta.16",
   "description": "Cross-client MCP bridge for local agent context, structured browser and application automation, files, Git, processes, resources, and durable jobs over stdio or OAuth relay.",
   "type": "module",
   "license": "MIT",

package/src/local/managed-job-plan.mjs

@@ -125,7 +125,7 @@ function validateEnv(value, label) {
   if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error(`${label} must be an object`);
   const entries = Object.entries(value);
   if (entries.length > 64) throw new Error(`${label} has too many entries`);
-  const out = {};
+  const out = Object.create(null);
   for (const [key, raw] of entries) {
     if (!/^[A-Za-z_][A-Za-z0-9_]{0,127}$/.test(key)) throw new Error(`${label} contains invalid variable name: ${key}`);
     out[key] = boundedString(raw, 16 * 1024, `${label}.${key}`);
@@ -138,7 +138,7 @@ function validateEnvResources(value, label) {
   if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error(`${label} must be an object`);
   const entries = Object.entries(value);
   if (entries.length > 32) throw new Error(`${label} has too many entries`);
-  const out = {};
+  const out = Object.create(null);
   for (const [key, raw] of entries) {
     if (!/^[A-Za-z_][A-Za-z0-9_]{0,127}$/.test(key)) throw new Error(`${label} contains invalid variable name: ${key}`);
     out[key] = validateResourceName(raw);

package/src/worker/index.ts

@@ -3,15 +3,14 @@ import serverMetadata from "../shared/server-metadata.json" with { type: "json"
 import relayContract from "../shared/relay-contract.json" with { type: "json" };
 import { PendingCallRegistrationError, PendingCallRegistry } from "./pending-calls.ts";
 import {
-  DAEMON_HELLO_TIMEOUT_MS,
   DAEMON_LIVENESS_TIMEOUT_MS,
   DAEMON_READY_TIMEOUT_MS,
   daemonLastSeenMs,
   daemonLivenessDeadlineMs,
-  daemonReadyDeadlineMs,
   isFreshDaemonCandidate,
 } from "./daemon-liveness.ts";
 import { DaemonSocketRegistry } from "./daemon-sockets.ts";
+import { processRuntimeAlarm, scheduleRuntimeAlarm } from "./runtime-alarm.ts";
 import { consumeDaemonPreflightNonce, createDaemonChallenge, verifyDaemonAuthentication, verifyDaemonPreflight } from "./daemon-auth.ts";
 import { mcpClientRequestKey, resolveMcpSession } from "./mcp-session.ts";
 import { acceptsEventStream } from "./mcp-stream.ts";
@@ -45,7 +44,7 @@ import {
 } from "./websocket-protocol.ts";
 
 const SERVER_NAME = String(serverMetadata.name);
-const SERVER_VERSION = "3.0.0-beta.15";
+const SERVER_VERSION = "3.0.0-beta.16";
 const MCP_PROTOCOL_VERSION = String(serverMetadata.protocolVersion);
 const MCP_SUPPORTED_PROTOCOL_VERSIONS = serverMetadata.supportedProtocolVersions.map((value) => String(value));
 const DEFAULT_MAX_BODY_BYTES = 8 * 1024 * 1024;
@@ -79,6 +78,7 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
   }
 
   async fetch(request: Request): Promise<Response> {
+    await this.pending.expireDue();
     const base = baseUrl(request);
     const extraOrigins = this.env.MBM_ALLOWED_ORIGINS ?? "";
     let response: Response;
@@ -146,6 +146,7 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
   }
 
   async webSocketMessage(ws: WebSocket, message: string | ArrayBuffer): Promise<void> {
+    await this.pending.expireDue();
     const size = typeof message === "string" ? new TextEncoder().encode(message).byteLength : message.byteLength;
     if (size > MAX_DAEMON_MESSAGE_BYTES) {
       closeWebSocketQuietly(ws, 1009, "message too large");
@@ -189,7 +190,7 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
       }
       if (!isFreshDaemonCandidate(socketAttachment.connectedAt)) {
         closeWebSocketQuietly(ws, 1008, "stale daemon candidate");
-        await this.scheduleSocketAlarms();
+        await this.scheduleRuntimeAlarm();
         return;
       }
       const instanceId = daemonInstanceId(body.instance_id);
@@ -245,10 +246,10 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
       } catch {
         this.daemonRegistry.expire(ws);
         closeWebSocketQuietly(ws, 1011, "daemon readiness probe failed");
-        await this.scheduleSocketAlarms();
+        await this.scheduleRuntimeAlarm();
         return;
       }
-      await this.scheduleSocketAlarms();
+      await this.scheduleRuntimeAlarm();
       return;
     }
 
@@ -276,7 +277,10 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
         rejectDaemonMessage(ws, "invalid_relay_readiness_state", 1002, "invalid daemon readiness state");
         return;
       }
-      const reboundCallIds = this.pending.rebindInstance(readyAttachment.instanceId ?? "", ws);
+      const daemonInstanceId = readyAttachment.instanceId ?? "";
+      const previousSockets = this.daemonRegistry.readyRoleSockets().filter((socket) => socket !== ws);
+      const fallbackSocket = previousSockets.find((socket) => this.daemonRegistry.readyAttachment(socket)?.instanceId === daemonInstanceId);
+      const reboundCallIds = this.pending.rebindInstance(daemonInstanceId, ws);
       if (reboundCallIds.length > 0) {
         this.observability.event("info", "daemon.calls.rebound", { rebound_calls: reboundCallIds.length });
       }
@@ -285,12 +289,17 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
         ws.send(JSON.stringify({ type: "ready_ack", server: SERVER_NAME, version: SERVER_VERSION }));
       } catch {
         await this.invalidateDaemonSocket(ws, "daemon readiness acknowledgement failed", "daemon ready timeout", "daemon_ready_timeout");
+        if (fallbackSocket?.readyState === WebSocket.OPEN) this.pending.rebindInstance(daemonInstanceId, fallbackSocket);
+        await this.scheduleRuntimeAlarm();
         return;
       }
       this.observability.socketReady();
-      for (const previous of this.daemonRegistry.readyRoleSockets().filter((socket) => socket !== ws)) {
+      for (const previous of previousSockets) {
+        await this.detachDaemonSocketCalls(previous, "daemon connection replaced after verified handover");
+        this.daemonRegistry.expire(previous);
         closeWebSocketQuietly(previous, 1012, "replaced by verified daemon");
       }
+      await this.scheduleRuntimeAlarm();
       return;
     }
 
@@ -323,7 +332,7 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
   private async cleanupDaemonSocket(ws: WebSocket, message: string): Promise<void> {
     this.observability.socketDisconnected();
     await this.detachDaemonSocketCalls(ws, message);
-    await this.scheduleSocketAlarms();
+    await this.scheduleRuntimeAlarm();
   }
   private async handleMcp(request: Request, base: string): Promise<Response> {
     if (request.method !== "GET" && request.method !== "POST") {
@@ -418,6 +427,7 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
                 accountVersion: access.authorized.accountVersion, role: access.authorized.role })
               : undefined,
           });
+          await this.scheduleRuntimeAlarm();
         }
       } catch (error) {
         await persistImmediateStreamOutcome({
@@ -544,6 +554,7 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
       }
       throw error;
     }
+    await this.scheduleRuntimeAlarm();
     this.observability.callStarted(name);
     try {
       socket.send(JSON.stringify({
@@ -610,7 +621,7 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
     this.ctx.acceptWebSocket(server);
     this.observability.socketCandidate();
     this.daemonRegistry.beginCandidate(server, challenge, preflight);
-    await this.scheduleSocketAlarms();
+    await this.scheduleRuntimeAlarm();
     const welcomed = trySendWebSocket(server, {
       type: "welcome",
       server: SERVER_NAME,
@@ -626,7 +637,7 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
     if (!welcomed) {
       this.daemonRegistry.expire(server);
       closeWebSocketQuietly(server, 1011, "daemon welcome failed");
-      await this.scheduleSocketAlarms();
+      await this.scheduleRuntimeAlarm();
     }
     return new Response(null, { status: 101, webSocket: client });
   }
@@ -657,7 +668,7 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
 
   private async touchDaemonSocket(ws: WebSocket): Promise<void> {
     if (!this.daemonRegistry.touch(ws)) return;
-    await this.scheduleSocketAlarms();
+    await this.scheduleRuntimeAlarm();
   }
 
   private async invalidateDaemonSocket(
@@ -694,73 +705,24 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
   }
 
   async alarm(): Promise<void> {
-    const now = Date.now();
-    let nextDeadline = Number.POSITIVE_INFINITY;
-    for (const socket of this.daemonRegistry.candidateSockets()) {
-      const attachment = this.daemonRegistry.attachment(socket);
-      const connectedAt = Date.parse(attachment?.connectedAt ?? "");
-      const deadline = connectedAt + DAEMON_HELLO_TIMEOUT_MS;
-      if (!Number.isFinite(connectedAt) || deadline <= now) {
-        this.daemonRegistry.expire(socket);
-        sendWebSocketQuietly(socket, { type: "error", error: "daemon_hello_timeout" });
-        closeWebSocketQuietly(socket, 1008, "daemon hello timeout");
-        continue;
-      }
-      nextDeadline = Math.min(nextDeadline, deadline);
-    }
-    for (const socket of this.daemonRegistry.probingSockets()) {
-      const attachment = this.daemonRegistry.attachment(socket);
-      const readyDeadline = daemonReadyDeadlineMs(attachment);
-      const liveDeadline = daemonLivenessDeadlineMs(attachment);
-      if (!Number.isFinite(readyDeadline) || !Number.isFinite(liveDeadline) || Math.min(readyDeadline, liveDeadline) <= now) {
-        await this.invalidateDaemonSocket(socket, "daemon did not complete end-to-end readiness verification", "daemon ready timeout", "daemon_ready_timeout");
-        continue;
-      }
-      nextDeadline = Math.min(nextDeadline, readyDeadline, liveDeadline);
-    }
-    for (const socket of this.daemonRegistry.readyRoleSockets()) {
-      const deadline = daemonLivenessDeadlineMs(this.daemonRegistry.readyAttachment(socket));
-      if (!Number.isFinite(deadline) || deadline <= now) {
-        await this.invalidateDaemonSocket(socket, "daemon became unresponsive", "daemon liveness timeout");
-        continue;
-      }
-      nextDeadline = Math.min(nextDeadline, deadline);
-    }
-    if (Number.isFinite(nextDeadline)) await this.ctx.storage.setAlarm(nextDeadline);
-    else await this.ctx.storage.deleteAlarm();
+    await processRuntimeAlarm(this.runtimeAlarmContext());
   }
 
-  private async scheduleSocketAlarms(): Promise<void> {
-    let nextDeadline = Number.POSITIVE_INFINITY;
-    for (const socket of this.daemonRegistry.candidateSockets()) {
-      const attachment = this.daemonRegistry.attachment(socket);
-      const connectedAt = Date.parse(attachment?.connectedAt ?? "");
-      if (!Number.isFinite(connectedAt)) {
-        closeWebSocketQuietly(socket, 1008, "invalid daemon candidate timestamp");
-        continue;
-      }
-      nextDeadline = Math.min(nextDeadline, connectedAt + DAEMON_HELLO_TIMEOUT_MS);
-    }
-    for (const socket of this.daemonRegistry.probingSockets()) {
-      const attachment = this.daemonRegistry.attachment(socket);
-      const readyDeadline = daemonReadyDeadlineMs(attachment);
-      const liveDeadline = daemonLivenessDeadlineMs(attachment);
-      if (!Number.isFinite(readyDeadline) || !Number.isFinite(liveDeadline)) {
-        await this.invalidateDaemonSocket(socket, "daemon readiness state is invalid", "daemon ready timeout", "daemon_ready_timeout");
-        continue;
-      }
-      nextDeadline = Math.min(nextDeadline, readyDeadline, liveDeadline);
-    }
-    for (const socket of this.daemonRegistry.readyRoleSockets()) {
-      const deadline = daemonLivenessDeadlineMs(this.daemonRegistry.readyAttachment(socket));
-      if (!Number.isFinite(deadline)) {
-        await this.invalidateDaemonSocket(socket, "daemon became unresponsive", "invalid daemon liveness timestamp");
-        continue;
-      }
-      nextDeadline = Math.min(nextDeadline, deadline);
-    }
-    if (Number.isFinite(nextDeadline)) await this.ctx.storage.setAlarm(Math.max(Date.now(), nextDeadline));
-    else await this.ctx.storage.deleteAlarm();
+  private async scheduleRuntimeAlarm(): Promise<void> {
+    await scheduleRuntimeAlarm(this.runtimeAlarmContext());
+  }
+
+  private runtimeAlarmContext() {
+    return {
+      storage: this.ctx.storage,
+      pending: this.pending,
+      daemonRegistry: this.daemonRegistry,
+      invalidateDaemonSocket: (socket: WebSocket, message: string, closeReason: string, errorCode?: string) =>
+        this.invalidateDaemonSocket(socket, message, closeReason, errorCode),
+      onScheduleError: (error: unknown) => this.observability.event(
+        "error", "runtime.alarm.schedule.failed", { error_class: workerErrorClass(error) },
+      ),
+    };
   }
 
   private daemonStatus(detail: boolean): Record<string, unknown> {

package/src/worker/pending-call-contract.ts

@@ -11,6 +11,8 @@ export interface PendingCallRecord {
   socket?: WebSocket;
   daemonInstanceId?: string;
   reconnectTimeout?: ReturnType<typeof setTimeout>;
+  reconnectDeadlineAt?: number;
+  onReconnectTimeout?: (record: PendingCallRecord) => Error;
   clientRequestKey?: string;
   tool: string;
   startedAt: number;

package/src/worker/pending-call-deadlines.ts

@@ -22,6 +22,16 @@ export class PendingCallDeadlines {
     return this.clock();
   }
 
+  nextDelayMs(record: PendingCallRecord): number {
+    const deadline = record.socket ? record.deadlineAt : record.reconnectDeadlineAt;
+    return Number.isFinite(deadline) ? Math.max(0, Number(deadline) - this.clock()) : Number.POSITIVE_INFINITY;
+  }
+
+  isDue(record: PendingCallRecord, now = this.clock()): boolean {
+    const deadline = record.socket ? record.deadlineAt : record.reconnectDeadlineAt;
+    return Number.isFinite(deadline) && Number(deadline) <= now;
+  }
+
   armOperation(record: PendingCallRecord, delayMs: number, expire: (id: string) => void): void {
     if (record.timeout) this.scheduler.clearTimeout(record.timeout);
     const delay = positiveDelay(delayMs);
@@ -38,17 +48,21 @@ export class PendingCallDeadlines {
 
   armReconnect(record: PendingCallRecord, delayMs: number, expire: (id: string) => void): void {
     if (record.reconnectTimeout) this.scheduler.clearTimeout(record.reconnectTimeout);
-    record.reconnectTimeout = this.scheduler.setTimeout(() => expire(record.id), positiveDelay(delayMs));
+    const delay = positiveDelay(delayMs);
+    record.reconnectDeadlineAt = this.clock() + delay;
+    record.reconnectTimeout = this.scheduler.setTimeout(() => expire(record.id), delay);
   }
 
   clearReconnect(record: PendingCallRecord): void {
     if (record.reconnectTimeout) this.scheduler.clearTimeout(record.reconnectTimeout);
     record.reconnectTimeout = undefined;
+    record.reconnectDeadlineAt = undefined;
   }
 
   clear(record: PendingCallRecord): void {
     if (record.timeout) this.scheduler.clearTimeout(record.timeout);
     if (record.reconnectTimeout) this.scheduler.clearTimeout(record.reconnectTimeout);
+    record.reconnectDeadlineAt = undefined;
   }
 }
 

package/src/worker/pending-calls.ts

@@ -25,6 +25,17 @@ export class PendingCallRegistry {
   get size(): number { return this.byId.size; }
   hasRequestKey(requestKey?: string): boolean { return Boolean(requestKey && this.byRequestKey.has(requestKey)); }
 
+  nextDeadlineDelayMs(): number {
+    return Math.min(Number.POSITIVE_INFINITY, ...[...this.byId.values()].map((record) => this.deadlines.nextDelayMs(record)));
+  }
+
+  async expireDue(now = this.deadlines.now()): Promise<number> {
+    const due = [...this.byId.values()].filter((record) => this.deadlines.isDue(record, now));
+    let expired = 0;
+    for (const record of due) expired += Number(await this.expireRecord(record));
+    return expired;
+  }
+
   register(input: RegisterPendingCall): Promise<unknown> {
     this.assertCanRegister(input);
     let resolveResult!: (value: unknown) => void;
@@ -66,8 +77,9 @@ export class PendingCallRegistry {
     const delay = Math.max(1, Math.floor(Number(graceMs) || 1));
     for (const record of records) {
       record.socket = undefined;
+      record.onReconnectTimeout = createError;
       this.deadlines.pauseOperation(record);
-      this.deadlines.armReconnect(record, delay, (id) => { void this.expire(id, createError, "pending daemon reconnect expired"); });
+      this.deadlines.armReconnect(record, delay, (id) => { void this.expireReconnect(id); });
     }
     return records.length;
   }
@@ -76,8 +88,10 @@ export class PendingCallRegistry {
     if (!daemonInstanceId) return [];
     const rebound: string[] = [];
     for (const record of this.byId.values()) {
-      if (record.socket || record.daemonInstanceId !== daemonInstanceId) continue;
-      this.deadlines.clearReconnect(record);
+      if (record.daemonInstanceId !== daemonInstanceId || record.socket === socket) continue;
+      if (record.socket) this.deadlines.pauseOperation(record);
+      else this.deadlines.clearReconnect(record);
+      record.onReconnectTimeout = undefined;
       record.socket = socket;
       this.deadlines.armOperation(record, record.remainingTimeoutMs, (id) => { void this.expireOperation(id); });
       rebound.push(record.id);
@@ -122,17 +136,21 @@ export class PendingCallRegistry {
     else if (input.signal && abortHandler) input.signal.addEventListener("abort", abortHandler, { once: true });
   }
 
-  private expireOperation(id: string): Promise<boolean> {
-    const record = this.byId.get(id);
-    return record ? this.fail(id, record.onTimeout, "pending daemon call timed out") : Promise.resolve(false);
+  private expireOperation(id: string): Promise<boolean> { return this.expireRecord(this.byId.get(id)); }
+  private expireReconnect(id: string): Promise<boolean> {
+    const record = this.byId.get(id); return record && !record.socket ? this.expireRecord(record) : Promise.resolve(false);
+  }
+  private expireRecord(record?: PendingCallRecord): Promise<boolean> {
+    if (!record) return Promise.resolve(false);
+    return record.socket
+      ? this.fail(record.id, record.onTimeout, "pending daemon call timed out")
+      : this.fail(record.id, record.onReconnectTimeout, "pending daemon reconnect expired");
   }
-
   private expire(id: string, createError: ((record: PendingCallRecord) => Error) | undefined, fallback: string): Promise<boolean> {
     const record = this.byId.get(id);
-    return record && !record.socket && fallback.includes("reconnect") ? this.fail(id, createError, fallback)
-      : record && !fallback.includes("reconnect") ? this.fail(id, createError, fallback) : Promise.resolve(false);
+    const applicable = record && (fallback.includes("reconnect") ? !record.socket : true);
+    return applicable ? this.fail(id, createError, fallback) : Promise.resolve(false);
   }
-
   private async fail(id: string, createError: ((record: PendingCallRecord) => Error) | undefined, fallback: string): Promise<boolean> {
     const record = this.byId.get(id);
     if (!record) return false;
@@ -140,7 +158,6 @@ export class PendingCallRegistry {
     try { error = createError?.(record) ?? new Error(fallback); } catch { error = new Error(fallback); }
     return this.finish(id, { ok: false, error });
   }
-
   private async finish(id: string, outcome: PendingCallOutcome): Promise<boolean> {
     const record = this.take(id);
     if (!record) return false;

package/src/worker/runtime-alarm.ts

@@ -0,0 +1,119 @@
+import {
+  DAEMON_HELLO_TIMEOUT_MS,
+  daemonLivenessDeadlineMs,
+  daemonReadyDeadlineMs,
+} from "./daemon-liveness.ts";
+import type { DaemonSocketRegistry } from "./daemon-sockets.ts";
+import type { PendingCallRegistry } from "./pending-calls.ts";
+import { closeWebSocketQuietly, sendWebSocketQuietly } from "./websocket-protocol.ts";
+
+interface AlarmStorage {
+  setAlarm(scheduledTime: number | Date): Promise<void>;
+  deleteAlarm(): Promise<void>;
+}
+
+type InvalidateDaemonSocket = (
+  socket: WebSocket,
+  message: string,
+  closeReason: string,
+  errorCode?: string,
+) => Promise<void>;
+
+interface RuntimeAlarmContext {
+  storage: AlarmStorage;
+  pending: PendingCallRegistry;
+  daemonRegistry: DaemonSocketRegistry;
+  invalidateDaemonSocket: InvalidateDaemonSocket;
+  onScheduleError: (error: unknown) => void;
+}
+
+export async function processRuntimeAlarm(context: RuntimeAlarmContext, now = Date.now()): Promise<void> {
+  await context.pending.expireDue();
+  let nextDeadline = pendingAlarmDeadline(context.pending, now);
+  for (const socket of context.daemonRegistry.candidateSockets()) {
+    const attachment = context.daemonRegistry.attachment(socket);
+    const connectedAt = Date.parse(attachment?.connectedAt ?? "");
+    const deadline = connectedAt + DAEMON_HELLO_TIMEOUT_MS;
+    if (!Number.isFinite(connectedAt) || deadline <= now) {
+      context.daemonRegistry.expire(socket);
+      sendWebSocketQuietly(socket, { type: "error", error: "daemon_hello_timeout" });
+      closeWebSocketQuietly(socket, 1008, "daemon hello timeout");
+      continue;
+    }
+    nextDeadline = Math.min(nextDeadline, deadline);
+  }
+  for (const socket of context.daemonRegistry.probingSockets()) {
+    const attachment = context.daemonRegistry.attachment(socket);
+    const readyDeadline = daemonReadyDeadlineMs(attachment);
+    const liveDeadline = daemonLivenessDeadlineMs(attachment);
+    if (!Number.isFinite(readyDeadline) || !Number.isFinite(liveDeadline) || Math.min(readyDeadline, liveDeadline) <= now) {
+      await context.invalidateDaemonSocket(
+        socket,
+        "daemon did not complete end-to-end readiness verification",
+        "daemon ready timeout",
+        "daemon_ready_timeout",
+      );
+      continue;
+    }
+    nextDeadline = Math.min(nextDeadline, readyDeadline, liveDeadline);
+  }
+  for (const socket of context.daemonRegistry.readyRoleSockets()) {
+    const deadline = daemonLivenessDeadlineMs(context.daemonRegistry.readyAttachment(socket));
+    if (!Number.isFinite(deadline) || deadline <= now) {
+      await context.invalidateDaemonSocket(socket, "daemon became unresponsive", "daemon liveness timeout");
+      continue;
+    }
+    nextDeadline = Math.min(nextDeadline, deadline);
+  }
+  await writeRuntimeAlarm(context, nextDeadline, now);
+}
+
+export async function scheduleRuntimeAlarm(context: RuntimeAlarmContext, now = Date.now()): Promise<void> {
+  let nextDeadline = pendingAlarmDeadline(context.pending, now);
+  for (const socket of context.daemonRegistry.candidateSockets()) {
+    const connectedAt = Date.parse(context.daemonRegistry.attachment(socket)?.connectedAt ?? "");
+    if (!Number.isFinite(connectedAt)) {
+      closeWebSocketQuietly(socket, 1008, "invalid daemon candidate timestamp");
+      continue;
+    }
+    nextDeadline = Math.min(nextDeadline, connectedAt + DAEMON_HELLO_TIMEOUT_MS);
+  }
+  for (const socket of context.daemonRegistry.probingSockets()) {
+    const attachment = context.daemonRegistry.attachment(socket);
+    const readyDeadline = daemonReadyDeadlineMs(attachment);
+    const liveDeadline = daemonLivenessDeadlineMs(attachment);
+    if (!Number.isFinite(readyDeadline) || !Number.isFinite(liveDeadline)) {
+      await context.invalidateDaemonSocket(
+        socket,
+        "daemon readiness state is invalid",
+        "daemon ready timeout",
+        "daemon_ready_timeout",
+      );
+      continue;
+    }
+    nextDeadline = Math.min(nextDeadline, readyDeadline, liveDeadline);
+  }
+  for (const socket of context.daemonRegistry.readyRoleSockets()) {
+    const deadline = daemonLivenessDeadlineMs(context.daemonRegistry.readyAttachment(socket));
+    if (!Number.isFinite(deadline)) {
+      await context.invalidateDaemonSocket(socket, "daemon became unresponsive", "invalid daemon liveness timestamp");
+      continue;
+    }
+    nextDeadline = Math.min(nextDeadline, deadline);
+  }
+  await writeRuntimeAlarm(context, nextDeadline, now);
+}
+
+function pendingAlarmDeadline(pending: PendingCallRegistry, now: number): number {
+  const delay = pending.nextDeadlineDelayMs();
+  return Number.isFinite(delay) ? now + Math.max(1, Math.ceil(delay)) : Number.POSITIVE_INFINITY;
+}
+
+async function writeRuntimeAlarm(context: RuntimeAlarmContext, nextDeadline: number, now: number): Promise<void> {
+  try {
+    if (Number.isFinite(nextDeadline)) await context.storage.setAlarm(Math.max(now, nextDeadline));
+    else await context.storage.deleteAlarm();
+  } catch (error) {
+    context.onScheduleError(error);
+  }
+}