machine-bridge-mcp 3.0.0-beta.16 → 3.0.0-beta.17

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## 3.0.0-beta.17 - 2026-07-26
+
+### Fixed
+
+- Serve `/healthz`, `/`, and CORS preflight from the outer Worker so activation and doctor checks no longer consume Durable Object free-tier request volume. Durable Object free-tier exhaustion now returns a structured `503 durable_object_quota_exceeded` instead of Cloudflare error 1101.
+
+### Durable Object stream request amplification fix
+
+- Replace the outer Worker's time-proportional internal Durable Object poll loop with a fixed two-request terminal path: one authenticated descriptor `prepare`, then one hibernatable WebSocket `subscribe`.
+- Add `mcp-stream-channel.ts` so `BridgeRoom` accepts a single stream subscriber through `DurableObjectState.acceptWebSocket()`, replaces stale resume subscribers, rechecks storage after registration to close the completion race, and pushes exactly one terminal JSON-RPC message.
+- Persist-ready notifications are fire-and-forget from `McpResumptionStore`; if persistence fails, the current online subscriber can still receive the transient terminal result while recovery storage keeps failure semantics.
+- Keep daemon candidate cleanup from treating stream-subscriber sockets as daemon candidates, and reject client-to-DO data on receive-only stream subscribers.
+- Fix the outer subscription waiter so invalid terminal payloads reject instead of leaving the SSE completion Promise permanently unsettled.
+- Extend deterministic infrastructure coverage for the fixed two-request budget, obsolete poll-mode rejection, subscriber replacement, registration races, immediate-completion paths, protocol errors, and non-daemon socket isolation. Update architecture, engineering, testing, audit, and operations contracts to describe subscribe push delivery instead of short pending/terminal polls.
+
 ## 3.0.0-beta.16 - 2026-07-25
 
 ### Pending-call recovery and verified handover

package/browser-extension/manifest.json

@@ -30,6 +30,6 @@
   "action": {
     "default_title": "Machine Bridge Browser"
   },
-  "version_name": "3.0.0-beta.16",
+  "version_name": "3.0.0-beta.17",
   "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxryYkpZhq8+VAQLHcGS9BAHQcyKX8RHGIpIwvtIVRU/rcOcE0bNdnM0aZJ/h6xWQsGDHlhvjT2+1aJaAn/9k8473BRWajzVXld961CdHYVFVHoce2hHiSJ0xydWrHMMZhAm0mN0UzjEpgZ0tMw209efcZHIvSwuxhteZMRy4kyiVjwFlOf5oXFCxRuCJnPj3AK9CmCf4XgEBuPIJ0TZmjGHOOdBvJmbCNnAWXYEo5/mf7MfCGhV4IJ1hNuhpoNQfOFKMUcw9/v/IpT62XpfXdGYTfGYCmCjC+gntK1spbkr2P4/2+sYMQtLpse71mpSNGXfcf3abU55Vpn+gncSxRQIDAQAB"
 }

package/docs/ARCHITECTURE.md

@@ -106,7 +106,7 @@ The stdio server implements newline-delimited JSON-RPC over stdin/stdout. It neg
 
 ### Cloudflare Worker and Durable Object
 
-All requests for a deployed Worker route to one named Durable Object. It owns:
+Public `/healthz`, `/`, and CORS preflight are answered by the outer Worker without Durable Object requests, so activation and doctor checks do not consume free-tier DO volume. All other requests route to one named Durable Object. It owns:
 
 - OAuth clients, authorization codes, hashed access-token records, an independently versioned hashed refresh-token store, and throttling metadata;
 - one active end-to-end-verified daemon WebSocket plus bounded candidate and probing sockets;
@@ -114,9 +114,9 @@ All requests for a deployed Worker route to one named Durable Object. It owns:
 - a bounded in-memory map of pending daemon calls, with monotonic operation/reconnect deadlines projected onto Durable Object alarms and rechecked at every event boundary;
 - bounded resumable MCP delivery metadata and terminal responses for recently disconnected SSE clients.
 
-`BridgeRoom` owns Durable Object routing, MCP authorization/dispatch, daemon WebSocket lifecycle, pending relay-call composition, cancellation, and resumable state. `mcp-stream-proxy.ts` owns the outer-Worker transport adapter: it strips public internal-control headers, obtains a bounded authenticated descriptor, creates the client-facing SSE stream, and polls terminal state through short immediate service-binding requests. `mcp-access.ts` owns shared Bearer/DPoP authorization for POST and recovery GET. `mcp-resumption-http.ts` owns recovery routing and signed session/protocol binding and returns descriptors rather than a long-lived response. `mcp-resumption.ts` owns stream admission, transaction ordering, immediate pending/terminal polls, expiry, replay, and lifecycle state; `mcp-resumption-records.ts` owns the compact metadata index, terminal-message bounds, serialization, and SHA-256 integrity metadata. `mcp-stream.ts` owns SSE sequence-zero/sequence-one framing and heartbeats. `mcp-jsonrpc.ts` owns JSON-RPC shape validation, result/error framing, MCP tool-result projection, session-instruction bounds, and protocol-header validation. `websocket-protocol.ts` owns record validation plus best-effort send/close/rejection helpers. `OAuthController` owns OAuth-store pruning, registration throttling, authorization submission, account-admin routing, token exchange, access-token verification, and the serialization queue for OAuth mutations. Worker-internal TypeScript imports use explicit `.ts` specifiers and JSON import attributes, so the same modules are directly executable under the pinned Node runtime and bundled by Wrangler.
+`BridgeRoom` owns Durable Object routing, MCP authorization/dispatch, daemon WebSocket lifecycle, pending relay-call composition, cancellation, and resumable state. `mcp-stream-proxy.ts` owns the outer-Worker transport adapter: it strips public internal-control headers, obtains a bounded authenticated descriptor, creates the client-facing SSE stream, and waits for the terminal result through one authenticated internal WebSocket subscription. `mcp-stream-channel.ts` owns Durable Object subscriber registration, single-subscriber replacement, and hibernation-safe terminal push. `mcp-access.ts` owns shared Bearer/DPoP authorization for POST and recovery GET. `mcp-resumption-http.ts` owns recovery routing and signed session/protocol binding and returns descriptors rather than a long-lived response. `mcp-resumption.ts` owns stream admission, transaction ordering, immediate pending/terminal polls, expiry, replay, and lifecycle state; `mcp-resumption-records.ts` owns the compact metadata index, terminal-message bounds, serialization, and SHA-256 integrity metadata. `mcp-stream.ts` owns SSE sequence-zero/sequence-one framing and heartbeats. `mcp-jsonrpc.ts` owns JSON-RPC shape validation, result/error framing, MCP tool-result projection, session-instruction bounds, and protocol-header validation. `websocket-protocol.ts` owns record validation plus best-effort send/close/rejection helpers. `OAuthController` owns OAuth-store pruning, registration throttling, authorization submission, account-admin routing, token exchange, access-token verification, and the serialization queue for OAuth mutations. Worker-internal TypeScript imports use explicit `.ts` specifiers and JSON import attributes, so the same modules are directly executable under the pinned Node runtime and bundled by Wrangler.
 
-The Worker verifies OAuth, validates MCP envelopes and optional protocol headers, converts `tools/call` into WebSocket messages, correlates explicit cancellation by access-token hash, signed MCP session, and JSON-RPC ID, and formats text/structured/image results. An HTTP/SSE disconnect is transport disposal, not MCP cancellation. For streamed daemon tools, `BridgeRoom` commits a recovery record, registers an event-settled pending call, sends the daemon envelope, and immediately returns an internal descriptor without retaining a terminal Promise. The later WebSocket result, explicit cancellation, timeout, send failure, or reconnect-grace expiry persists the terminal JSON-RPC envelope. JSON-only calls retain the ordinary Promise path. The outer Worker sends `stream:0`, heartbeats, and `stream:1`; bounded short polls return pending or terminal state immediately. Authenticated `GET /mcp` with `Last-Event-ID` resumes only the original OAuth-token/MCP-session stream; POST always creates new work. Public requests cannot select internal descriptor/poll modes because the outer boundary removes those headers before forwarding. At most 64 records and 1.5 MiB of terminal JSON per record are retained for two minutes. The recovery store tracks active stream identifiers, not live Promises; a transient terminal map is used only when persistence fails. If the Durable Object restarts with a pending record but no active owner, recovery reports that side effects may have occurred and requires reconciliation before retry. It has no local filesystem or process API.
+The Worker verifies OAuth, validates MCP envelopes and optional protocol headers, converts `tools/call` into WebSocket messages, correlates explicit cancellation by access-token hash, signed MCP session, and JSON-RPC ID, and formats text/structured/image results. An HTTP/SSE disconnect is transport disposal, not MCP cancellation. For streamed daemon tools, `BridgeRoom` commits a recovery record, registers an event-settled pending call, sends the daemon envelope, and immediately returns an internal descriptor without retaining a terminal Promise. The later WebSocket result, explicit cancellation, timeout, send failure, or reconnect-grace expiry persists the terminal JSON-RPC envelope. JSON-only calls retain the ordinary Promise path. The outer Worker sends `stream:0`, heartbeats, and `stream:1`; the Durable Object accepts one hibernatable subscriber WebSocket per stream and pushes the terminal JSON-RPC envelope once. Authenticated `GET /mcp` with `Last-Event-ID` resumes only the original OAuth-token/MCP-session stream; POST always creates new work. Public requests cannot select internal descriptor/subscribe modes because the outer boundary removes those headers before forwarding. At most 64 records and 1.5 MiB of terminal JSON per record are retained for two minutes. The recovery store tracks active stream identifiers, not live Promises; a transient terminal map is used only when persistence fails. If the Durable Object restarts with a pending record but no active owner, recovery reports that side effects may have occurred and requires reconciliation before retry. It has no local filesystem or process API.
 
 
 ### Daemon device authentication
@@ -172,7 +172,7 @@ Remote OAuth binds each code, access token, and refresh token to a named Machine
 7. The MCP client initializes against the sole current protocol version; an obsolete client must upgrade rather than enter a legacy execution path. The Worker returns a stateless HMAC-bound `MCP-Session-Id`, and later request/cancellation correlation is scoped by OAuth token, MCP session, JSON-RPC id type, and id value. Two clients may therefore reuse the same JSON-RPC id concurrently without collision. Sessionless POSTs remain independent and are not inserted into a token-global cancellation index. When the daemon advertises `session_bootstrap`, the Worker requests bounded local instructions and appends them to the initialization result; failure degrades to static instructions.
 8. A new daemon first authenticates as a bounded `probing` socket. The Worker sends a random `relay_probe`; the local runtime returns it through the normal session-bound result-delivery path; only the matching result produces `ready_ack`, promotion to the active daemon, and safe replacement of an incumbent connection.
 9. `tools/list` is derived only from the active end-to-end-verified daemon; without one, only `server_info` is advertised.
-10. `tools/call` receives a random relay call ID and is bound to the current daemon socket, that daemon process's ephemeral instance identifier, and the authenticated client request key. When the client accepts `text/event-stream`, `BridgeRoom` commits recovery state, registers an event-settled pending call, sends the daemon envelope, and returns a bounded descriptor immediately; the outer Worker owns the SSE priming frame, keepalives, and terminal polling. No unresolved terminal Promise or Durable Object `waitUntil` owns the dispatch. JSON-only clients retain the single terminal response.
+10. `tools/call` receives a random relay call ID and is bound to the current daemon socket, that daemon process's ephemeral instance identifier, and the authenticated client request key. When the client accepts `text/event-stream`, `BridgeRoom` commits recovery state, registers an event-settled pending call, sends the daemon envelope, and returns a bounded descriptor immediately; the outer Worker owns the SSE priming frame, keepalives, and one internal terminal subscription. No unresolved terminal Promise or Durable Object `waitUntil` owns the dispatch. JSON-only clients retain the single terminal response.
 11. The runtime validates policy and arguments, executes the tool, and returns a bounded result. Closing or losing the HTTP response stream only makes that stream unwritable; it is not an MCP cancellation and does not remove the pending request.
 12. If the socket remains ready, the Durable Object accepts the result only from that socket. If it drops, the Worker detaches the pending call for at most two minutes and accepts completion only after a replacement socket with the same daemon-process identifier has passed the end-to-end readiness probe. The local runtime preserves the operation and queues a completion over the same shared interval. The Worker pauses the record's remaining normal deadline while detached and resumes it after same-instance rebinding, so connected calls are not granted an unconditional recovery extension.
 13. Only a matching session-scoped `notifications/cancelled` request removes the pending indexes and sends best-effort cancellation to a connected daemon. Local completion that races with explicit cancellation is discarded. On every readiness handover, the Worker first sends an authoritative bounded `resume_calls` set; the runtime cancels active calls and queued results absent from that set before accepting `ready_ack`. A request explicitly cancelled while disconnected therefore cannot be revived by a fast reconnect.

package/docs/AUDIT.md

@@ -32,7 +32,7 @@ The exact beta.13 tarball was activated through the owner command and converged
 
 The same live run exposed a release-blocking production scheduling defect that the local Wrangler integration had not represented. While `BridgeRoom` directly returned an open SSE response, later requests routed to the same Durable Object—including `server_info` and the authoritative session-scoped `notifications/cancelled` notification—did not enter until the stream ended. The daemon call eventually terminated through its own boundary, but Worker observability did not record a successful cancellation. Beta.13 therefore has no acceptance record, is not pushed or published, and is explicitly blocked.
 
-Beta.14 separates client transport ownership from durable state ownership. The outer stateless Worker creates the public SSE stream. `BridgeRoom` performs OAuth/DPoP authorization, signed MCP-session validation, stream admission, daemon dispatch, explicit cancellation, and terminal persistence, then returns a small internal descriptor. The outer Worker uses short service-binding polls: pending state returns immediately with HTTP 202; terminal state returns buffered JSON; missing or expired state fails closed. No internal poll or descriptor request remains open in the Durable Object. Publicly supplied internal-control headers are stripped before every service-binding forward, so callers cannot select the unauthenticated internal poll path.
+Beta.14 separates client transport ownership from durable state ownership. The outer stateless Worker creates the public SSE stream. `BridgeRoom` performs OAuth/DPoP authorization, signed MCP-session validation, stream admission, daemon dispatch, explicit cancellation, and terminal persistence, then returns a small internal descriptor. The outer Worker uses one service-binding WebSocket subscription after the authenticated descriptor: pending streams hibernate under `acceptWebSocket()`, terminal state is pushed once, and missing or expired state fails closed. No internal request remains open in the Durable Object for the life of a long tool call. Publicly supplied internal-control headers are stripped before every service-binding forward, so callers cannot select the unauthenticated internal subscribe path.
 
 The real Wrangler regression keeps the original SSE response open, confirms a concurrent `server_info` sees the pending call, sends `notifications/cancelled`, observes the matching daemon `cancel_call`, and receives a cancelled terminal result on the original stream. Existing disconnect/recovery, wrong-session rejection, sequence-one acknowledgement, CORS, persistence faults, capacity, integrity, and oversized-message tests remain in force. This correction requires a new exact beta.14 candidate, owner activation, and repeated live verification; beta.13 activation evidence cannot be reused.
 

package/docs/ENGINEERING.md

@@ -21,7 +21,7 @@ This document records project-wide decisions that must survive individual fixes,
 15. **Ambiguous health is not permission to repeat a remote write.** A successful Wrangler deployment is recorded before secondary health verification. Timeout, proxy, TLS, network, and temporary service failures preserve the deployment fingerprint and fail for diagnosis; only bounded evidence of a stale identity/version permits automatic same-name redeployment. Changing the Worker name is an explicit remote-resource transition, not a retry strategy.
 16. **Execution continuity and delivery continuity are separate proof obligations.** Keeping work alive after a client transport closes is insufficient unless the same authenticated principal can recover a terminal result or a durable handle. Fresh requests and replay endpoints must remain separate so recovery cannot accidentally duplicate a non-idempotent operation.
 17. **Remote compound commands are not persistence evidence.** When a remote edit and a long test share one relay call, a transport interruption can obscure whether the edit completed. High-impact writes must be followed by an independent read of stable anchors or a Git diff before tests and conclusions rely on them.
-18. **Durable state owners do not retain cross-event terminal Promises.** A Durable Object that must accept cancellation, status, or recovery requests cannot retain the public SSE response, an internal request waiting for completion, or an unresolved Promise owned by the initiating fetch event. The outer Worker owns streaming; streamed daemon calls are registered and returned immediately, then settled by later WebSocket, cancellation, timeout, send-failure, or reconnect-expiry events. Descriptor and poll requests remain short, authenticated at admission, and unreachable through caller-supplied internal headers.
+18. **Durable state owners do not retain cross-event terminal Promises.** A Durable Object that must accept cancellation, status, or recovery requests cannot retain the public SSE response, an internal request waiting for completion, or an unresolved Promise owned by the initiating fetch event. The outer Worker owns streaming; streamed daemon calls are registered and returned immediately, then settled by later WebSocket, cancellation, timeout, send-failure, or reconnect-expiry events. Descriptor requests remain short; terminal delivery uses one authenticated hibernatable WebSocket subscription. Both are admitted only on the internal service-binding path and are unreachable through caller-supplied internal headers.
 
 A proposed change that conflicts with an invariant requires an explicit owner decision and corresponding documentation update. It must not be hidden inside an unrelated refactor.
 

package/docs/OPERATIONS.md

@@ -12,6 +12,8 @@ machine-mcp service status
 
 ### Worker deployment and health convergence
 
+`/healthz` and `/` are answered by the outer Worker and do not consume Durable Object request volume. If MCP or daemon routes return `503 durable_object_quota_exceeded` (or Cloudflare 1101 with Durable Objects free-tier exhaustion in Worker tails), wait for the daily UTC free-tier reset or move the account off the free DO plan; do not treat that as a failed script deploy when `/healthz` still reports the expected version.
+
 Wrangler upload and public health verification are two separate observations. Once Wrangler reports a successful deployment and supplies the `workers.dev` URL, Machine Bridge immediately records that URL together with the exact deployment fingerprint and package version. It then verifies `/healthz` through the standard `HTTPS_PROXY`/`HTTP_PROXY` and `NO_PROXY` environment route. If that secondary probe times out or encounters a proxy, TLS, network, or temporary HTTP 5xx failure, startup stops with an actionable error, but the successful deployment evidence remains. The next ordinary start verifies the same Worker and does not repeat the upload.
 
 Automatic redeployment is limited to bounded health evidence that the recorded endpoint is genuinely stale: a persistent package-version mismatch, an unexpected Machine Bridge identity, or a persistent `404`/`410`. Unreachability is not proof of absence. `--force-worker` remains the explicit override when an operator deliberately wants an upload despite matching state.
@@ -53,7 +55,7 @@ Machine Bridge supports concurrent calls: the Worker admits up to 32 pending dae
 
 `server_info.worker.pending_calls` reports `active`, `detached`, `request_keys`, `maximum`, `oldest_ms`, and `by_tool`. `worker.sockets_live` separately reports `authenticated`, `probing`, `ready`, and `candidates`; only `ready` sockets contribute to `daemon.connected` and tool advertisement. A nonzero `active` count means work is in flight, not that the bridge is locked. `detached > 0` means a daemon socket was lost and those requests are inside the bounded two-minute same-instance reconnect window. Calls for simple reads and probes should continue while another independent process call runs. Only explicit session-scoped MCP cancellation, timeout, or reconnect-grace expiry removes the pending record and its request key; an HTTP response disconnect is not cancellation. A daemon-socket closure detaches only calls assigned to that socket; the same daemon process can reclaim them after completing readiness, while another process cannot. A verified same-instance replacement transfers both detached and still-attached calls before the incumbent closes. Normal and reconnect deadlines have three enforcement paths: monotonic in-event timers, a Durable Object alarm, and an overdue sweep at the next HTTP/WebSocket event. Therefore `detached > 0` with `oldest_ms` materially beyond the two-minute grace is a lifecycle defect rather than normal recovery. Grace expiry rejects the request and cancels the local ordinary operation. Refreshing a chat page is not the recovery mechanism and should not be required.
 
-For Streamable HTTP clients such as ChatGPT that advertise `text/event-stream`, the outer Worker returns an immediate sequence-zero SSE event identifier and a keepalive comment every ten seconds until the terminal sequence-one JSON-RPC result. `BridgeRoom` never owns the long-lived public stream or an unresolved terminal Promise. Stream initiation commits recovery state, registers the daemon call, sends it, and returns a descriptor; a later WebSocket result, explicit cancellation, timeout, send failure, or reconnect-grace expiry writes the terminal result. Short pending/terminal polls therefore coexist with concurrent `server_info`, recovery, and session-scoped `notifications/cancelled` requests while SSE remains open. Caller-supplied internal stream headers are removed at the public boundary. If the client or an intermediary closes the stream, Machine Bridge keeps the bounded operation alive; only `notifications/cancelled` carries cancellation semantics. A compatible host resumes the original stream with authenticated `GET /mcp`, the original `MCP-Session-Id`, and `Last-Event-ID`; it must not repeat the POST. Recovery records are token/session-bound, retained for at most two minutes, limited to 64 streams, and persist at most 1.5 MiB of terminal JSON. Error `-32002` means the online result exceeded the replay budget; `-32003` means the Worker restarted before it could persist a terminal result and the operation may already have produced side effects; reconcile state before retrying. Error `-32005` means stored replay data failed integrity validation.
+For Streamable HTTP clients such as ChatGPT that advertise `text/event-stream`, the outer Worker returns an immediate sequence-zero SSE event identifier and a keepalive comment every ten seconds until the terminal sequence-one JSON-RPC result. `BridgeRoom` never owns the long-lived public stream or an unresolved terminal Promise. Stream initiation commits recovery state, registers the daemon call, sends it, and returns a descriptor; a later WebSocket result, explicit cancellation, timeout, send failure, or reconnect-grace expiry writes the terminal result. One internal hibernatable WebSocket subscription therefore coexists with concurrent `server_info`, recovery, and session-scoped `notifications/cancelled` requests while SSE remains open, without creating a request per poll interval. Caller-supplied internal stream headers are removed at the public boundary. If the client or an intermediary closes the stream, Machine Bridge keeps the bounded operation alive; only `notifications/cancelled` carries cancellation semantics. A compatible host resumes the original stream with authenticated `GET /mcp`, the original `MCP-Session-Id`, and `Last-Event-ID`; it must not repeat the POST. Recovery records are token/session-bound, retained for at most two minutes, limited to 64 streams, and persist at most 1.5 MiB of terminal JSON. Error `-32002` means the online result exceeded the replay budget; `-32003` means the Worker restarted before it could persist a terminal result and the operation may already have produced side effects; reconcile state before retrying. Error `-32005` means stored replay data failed integrity validation.
 
 `server_info.worker.observability.calls.unmatched_results` counts results that reached the Worker after their pending record was already removed. A small increase can accompany cancellation or timeout races, especially during mixed-version upgrade convergence; sustained growth together with old pending calls indicates incompatible components or a lifecycle defect. The counter contains no tool arguments or result data.
 

package/docs/TESTING.md

@@ -159,4 +159,4 @@ The stdio integration test also sends an oversized line, verifies bounded reject
 
 `npm run mcp-resumption:test` directly exercises stream cursor parsing, OAuth-token/MCP-session isolation, immediate pending/terminal polls, active and completed replay, Worker-restart ambiguity, result-size fallback, SHA-256 tamper detection, transient persistence failure, expiry, capacity, and completed-record eviction.
 
-`npm run worker-runtime-infrastructure:test` verifies outer-Worker stream ownership, stripping of caller-supplied internal headers, bounded descriptor/poll adaptation, sequence-zero/sequence-one framing, poll-error closure, and the shared two-minute/64-stream/1.5-MiB contract. It also models the production event-lifecycle boundary: event-mode registration must return without a terminal Promise or early settlement, while later success, daemon rejection, explicit cancellation, timeout, send failure, result transformation, persistence failure, and same-instance reconnect each produce one terminal result and remove pending indexes. Deadline tests deliberately use a scheduler that never fires callbacks, advance the monotonic clock, and prove that event-boundary sweeps expire both attached operation deadlines and detached reconnect deadlines without leaking request keys. A direct runtime-alarm coordinator test verifies earliest-pending scheduling, alarm removal when no deadline remains, event-entry expiry before rescheduling, and bounded reporting when Durable Object alarm storage fails. The same suite also proves that direct same-instance handover transfers an attached call and preserves its remaining timeout budget. `npm run worker:integration-test` performs the real Wrangler path: keep SSE open while a concurrent `server_info` succeeds and explicit cancellation reaches the matching daemon call; connect a verified same-instance replacement while the incumbent still owns an in-flight call and prove transfer occurs before incumbent close; disconnect after sequence zero; reject another session; recover with GET plus `Last-Event-ID`; and prove a sequence-one acknowledgement is not delivered twice. Managed-job integration treats `__proto__`, `constructor`, `toString`, and `valueOf` environment/resource-map keys as ordinary own data while retaining duplicate-key rejection. Static architecture checks forbid a stream-initiation `dispatchJsonRpc` Promise, `resumption.attach`, Durable Object `waitUntil`, or Promise-valued recovery state. The parser accumulates complete SSE events and does not assume network chunk boundaries. CORS coverage requires both `DPoP` and `Last-Event-ID`.
+`npm run worker-runtime-infrastructure:test` verifies outer-Worker stream ownership, stripping of caller-supplied internal headers, bounded descriptor/subscribe adaptation, fixed two-request Durable Object budgets, sequence-zero/sequence-one framing, subscription-error closure, subscriber replacement, registration races, non-daemon socket isolation, and the shared two-minute/64-stream/1.5-MiB contract. It also models the production event-lifecycle boundary: event-mode registration must return without a terminal Promise or early settlement, while later success, daemon rejection, explicit cancellation, timeout, send failure, result transformation, persistence failure, and same-instance reconnect each produce one terminal result and remove pending indexes. Deadline tests deliberately use a scheduler that never fires callbacks, advance the monotonic clock, and prove that event-boundary sweeps expire both attached operation deadlines and detached reconnect deadlines without leaking request keys. A direct runtime-alarm coordinator test verifies earliest-pending scheduling, alarm removal when no deadline remains, event-entry expiry before rescheduling, and bounded reporting when Durable Object alarm storage fails. The same suite also proves that direct same-instance handover transfers an attached call and preserves its remaining timeout budget. `npm run worker:integration-test` performs the real Wrangler path: keep SSE open while a concurrent `server_info` succeeds and explicit cancellation reaches the matching daemon call; connect a verified same-instance replacement while the incumbent still owns an in-flight call and prove transfer occurs before incumbent close; disconnect after sequence zero; reject another session; recover with GET plus `Last-Event-ID`; and prove a sequence-one acknowledgement is not delivered twice. Managed-job integration treats `__proto__`, `constructor`, `toString`, and `valueOf` environment/resource-map keys as ordinary own data while retaining duplicate-key rejection. Static architecture checks forbid a stream-initiation `dispatchJsonRpc` Promise, `resumption.attach`, Durable Object `waitUntil`, or Promise-valued recovery state. The parser accumulates complete SSE events and does not assume network chunk boundaries. CORS coverage requires both `DPoP` and `Last-Event-ID`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "machine-bridge-mcp",
-  "version": "3.0.0-beta.16",
+  "version": "3.0.0-beta.17",
   "description": "Cross-client MCP bridge for local agent context, structured browser and application automation, files, Git, processes, resources, and durable jobs over stdio or OAuth relay.",
   "type": "module",
   "license": "MIT",

package/src/worker/daemon-sockets.ts

@@ -24,7 +24,8 @@ interface WebSocketContext {
 }
 
 export class DaemonSocketRegistry {
-  constructor(private readonly context: WebSocketContext) {}
+  private readonly context: WebSocketContext;
+  constructor(context: WebSocketContext) { this.context = context; }
 
   attachment(socket: WebSocket): DaemonAttachment | undefined {
     const raw = socket.deserializeAttachment();
@@ -57,7 +58,10 @@ export class DaemonSocketRegistry {
   }
 
   nonReadySockets(): WebSocket[] {
-    return this.context.getWebSockets().filter((socket) => this.attachment(socket)?.role !== "daemon" && socket.readyState === WebSocket.OPEN);
+    return this.context.getWebSockets().filter((socket) => {
+      const role = this.attachment(socket)?.role;
+      return Boolean(role && role !== "daemon" && socket.readyState === WebSocket.OPEN);
+    });
   }
 
   beginCandidate(
@@ -81,13 +85,8 @@ export class DaemonSocketRegistry {
 
   beginProbe(socket: WebSocket, values: { connectedAt: string; probeId: string; instanceId: string; policy: DaemonPolicy; tools: string[] }): void {
     socket.serializeAttachment({
-      role: "probing",
-      connectedAt: values.connectedAt,
-      lastSeenAt: values.connectedAt,
-      probeId: values.probeId,
-      instanceId: values.instanceId,
-      policy: values.policy,
-      tools: values.tools,
+      role: "probing", connectedAt: values.connectedAt, lastSeenAt: values.connectedAt,
+      probeId: values.probeId, instanceId: values.instanceId, policy: values.policy, tools: values.tools,
     } satisfies DaemonAttachment);
   }
 
@@ -112,10 +111,7 @@ export class DaemonSocketRegistry {
     const attachment = this.attachment(socket);
     if (!attachment) return;
     socket.serializeAttachment({
-      role: "expired",
-      connectedAt: attachment.connectedAt,
-      lastSeenAt: attachment.lastSeenAt,
-      instanceId: attachment.instanceId,
+      role: "expired", connectedAt: attachment.connectedAt, lastSeenAt: attachment.lastSeenAt, instanceId: attachment.instanceId,
     } satisfies DaemonAttachment);
   }
 

package/src/worker/index.ts

@@ -17,10 +17,11 @@ import { acceptsEventStream } from "./mcp-stream.ts";
 import { authorizeMcpRequest } from "./mcp-access.ts";
 import { handleMcpResumptionRequest } from "./mcp-resumption-http.ts";
 import {
-  handleMcpStreamPollRequest, mcpStreamDescriptorResponse, mcpStreamProxyMode,
+  handleMcpStreamSubscribeRequest, mcpStreamDescriptorResponse, mcpStreamProxyMode,
   proxyMcpEventStream, sanitizeBridgeRequest,
 } from "./mcp-stream-proxy.ts";
 import { McpResumptionStore, McpStreamLimitError } from "./mcp-resumption.ts";
+import { McpStreamChannel } from "./mcp-stream-channel.ts";
 import { buildServerInfoResult, persistImmediateStreamOutcome, startEventDrivenStreamCall } from "./mcp-stream-dispatch.ts";
 import { daemonToolTimeoutMs } from "./tool-timeout.ts";
 import { WorkerObservability } from "./observability.ts";
@@ -35,6 +36,9 @@ import {
   HttpError, applyCors, baseUrl, corsPreflight, json, methodNotAllowed,
   parseJsonRequest, workerErrorClass,
 } from "./http.ts";
+import {
+  durableObjectQuotaResponse, isDurableObjectQuotaError, respondWithoutDurableObject,
+} from "./worker-static-routes.ts";
 import {
   asObject, isJsonRpcRequest, isJsonRpcResponse, requiredString, rpcError, rpcResult,
   sessionInstructionText, textToolResult, validateProtocolVersionHeader, type JsonRpcRequest,
@@ -44,7 +48,7 @@ import {
 } from "./websocket-protocol.ts";
 
 const SERVER_NAME = String(serverMetadata.name);
-const SERVER_VERSION = "3.0.0-beta.16";
+const SERVER_VERSION = "3.0.0-beta.17";
 const MCP_PROTOCOL_VERSION = String(serverMetadata.protocolVersion);
 const MCP_SUPPORTED_PROTOCOL_VERSIONS = serverMetadata.supportedProtocolVersions.map((value) => String(value));
 const DEFAULT_MAX_BODY_BYTES = 8 * 1024 * 1024;
@@ -68,13 +72,15 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
   private readonly observability = new WorkerObservability();
   private readonly oauth: OAuthController;
   private readonly daemonRegistry: DaemonSocketRegistry;
+  private readonly streamChannel: McpStreamChannel;
   private readonly resumption: McpResumptionStore;
 
   constructor(ctx: DurableObjectState, env: BridgeEnv) {
     super(ctx, env);
     this.oauth = new OAuthController(ctx, env, SERVER_NAME, SERVER_VERSION);
     this.daemonRegistry = new DaemonSocketRegistry(ctx);
-    this.resumption = new McpResumptionStore(ctx.storage);
+    this.streamChannel = new McpStreamChannel(ctx, this.observability);
+    this.resumption = new McpResumptionStore(ctx.storage, {}, (streamId, message) => this.streamChannel.publish(streamId, message));
   }
 
   async fetch(request: Request): Promise<Response> {
@@ -147,6 +153,10 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
 
   async webSocketMessage(ws: WebSocket, message: string | ArrayBuffer): Promise<void> {
     await this.pending.expireDue();
+    if (this.streamChannel.isSubscriber(ws)) {
+      this.streamChannel.rejectSubscriberMessage(ws);
+      return;
+    }
     const size = typeof message === "string" ? new TextEncoder().encode(message).byteLength : message.byteLength;
     if (size > MAX_DAEMON_MESSAGE_BYTES) {
       closeWebSocketQuietly(ws, 1009, "message too large");
@@ -321,10 +331,12 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
   }
 
   async webSocketClose(ws: WebSocket): Promise<void> {
+    if (this.streamChannel.isSubscriber(ws)) return;
     await this.cleanupDaemonSocket(ws, "daemon disconnected");
   }
 
   async webSocketError(ws: WebSocket, error: unknown): Promise<void> {
+    if (this.streamChannel.isSubscriber(ws)) return;
     this.observability.event("warn", "daemon.websocket.error", { error_class: workerErrorClass(error) });
     await this.cleanupDaemonSocket(ws, "daemon transport error");
   }
@@ -343,8 +355,8 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
     }
 
     const proxyMode = mcpStreamProxyMode(request);
-    const polled = await handleMcpStreamPollRequest(request, this.resumption);
-    if (polled) return polled;
+    const subscribed = await handleMcpStreamSubscribeRequest(request, this.streamChannel, this.resumption);
+    if (subscribed) return subscribed;
 
     const access = await authorizeMcpRequest({
       request,
@@ -793,14 +805,28 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
 
 export default {
   async fetch(request: Request, env: BridgeEnv, ctx: ExecutionContext): Promise<Response> {
-    const stub = env.BRIDGE.getByName("default");
-    const streamed = await proxyMcpEventStream({
+    const extraOrigins = env.MBM_ALLOWED_ORIGINS ?? "";
+    const staticResponse = respondWithoutDurableObject(
       request,
-      bridge: stub,
-      extraOrigins: env.MBM_ALLOWED_ORIGINS ?? "",
-      ctx,
-    });
-    return streamed ?? stub.fetch(sanitizeBridgeRequest(request));
+      { server: SERVER_NAME, version: SERVER_VERSION },
+      extraOrigins,
+    );
+    if (staticResponse) return staticResponse;
+
+    try {
+      const stub = env.BRIDGE.getByName("default");
+      const streamed = await proxyMcpEventStream({
+        request,
+        bridge: stub,
+        extraOrigins,
+        ctx,
+      });
+      return streamed ?? stub.fetch(sanitizeBridgeRequest(request));
+    } catch (error) {
+      // Free-tier DO request exhaustion must not look like an opaque Worker crash.
+      if (isDurableObjectQuotaError(error)) return durableObjectQuotaResponse(request, extraOrigins);
+      throw error;
+    }
   },
 } satisfies ExportedHandler<BridgeEnv>;
 

package/src/worker/mcp-resumption.ts

@@ -20,6 +20,7 @@ import { resumptionLimits, type McpResumptionOptions } from "./mcp-resumption-co
 export type { JsonRpcMessage } from "./mcp-resumption-records.ts";
 type ResumptionStorage = Pick<DurableObjectStorage, "get" | "put" | "delete" | "transaction">;
 type TransactionStorage = Pick<DurableObjectTransaction, "get" | "put" | "delete">;
+type StreamReadyListener = (streamId: string, message: JsonRpcMessage) => void;
 export type StreamResumeResult =
   | { kind: "invalid" | "not_found" | "expired" }
   | { kind: "complete"; streamId: string }
@@ -40,12 +41,11 @@ export class McpResumptionStore {
   private readonly pendingRetentionMs: number;
   private readonly maximumStreams: number;
   private readonly maximumMessageBytes: number;
-  constructor(
-    storage: ResumptionStorage,
-    options: McpResumptionOptions = {},
-  ) {
+  private readonly onReady: StreamReadyListener;
+  constructor(storage: ResumptionStorage, options: McpResumptionOptions = {}, onReady: StreamReadyListener = () => {}) {
     this.storage = storage;
     this.now = options.now ?? Date.now;
+    this.onReady = onReady;
     const limits = resumptionLimits(options);
     this.retentionMs = limits.retentionMs;
     this.pendingRetentionMs = limits.pendingRetentionMs;
@@ -121,14 +121,12 @@ export class McpResumptionStore {
       throw error;
     } finally {
       this.active.delete(streamId);
+      // Persistent state remains authoritative if a disconnected subscriber misses this push.
+      try { this.onReady(streamId, message); } catch { /* resume/poll remains available */ }
     }
   }
 
-  async pollMessage(streamId: string): Promise<
-    | { kind: "pending" }
-    | { kind: "not_found" }
-    | { kind: "message"; message: JsonRpcMessage }
-  > {
+  async pollMessage(streamId: string): Promise<{ kind: "pending" } | { kind: "not_found" } | { kind: "message"; message: JsonRpcMessage }> {
     if (!isStreamId(streamId)) return { kind: "not_found" };
     const transient = this.transientReady.get(streamId);
     if (transient) return { kind: "message", message: transient };

package/src/worker/mcp-stream-channel.ts

@@ -0,0 +1,125 @@
+import { json } from "./http.ts";
+import type { JsonRpcMessage, McpResumptionStore } from "./mcp-resumption.ts";
+import { isStreamId } from "./mcp-resumption-records.ts";
+import { closeWebSocketQuietly, trySendWebSocket } from "./websocket-protocol.ts";
+
+const SUBSCRIBER_ROLE = "mcp_stream_subscriber";
+const SUBSCRIBER_TAG_PREFIX = "mcp-stream:";
+
+type StreamChannelContext = Pick<DurableObjectState, "acceptWebSocket" | "getWebSockets">;
+type StreamChannelObservability = {
+  streamSubscriberOpened(replaced: number): void;
+  streamTerminalDelivered(recipients: number): void;
+  streamSubscriberProtocolError(): void;
+};
+type WebSocketPairFactory = () => [WebSocket, WebSocket];
+type UpgradeResponseFactory = (client: WebSocket) => Response;
+type StreamSubscriberAttachment = { role: typeof SUBSCRIBER_ROLE; streamId: string };
+
+export class McpStreamChannel {
+  private readonly context: StreamChannelContext;
+  private readonly observability: StreamChannelObservability;
+  private readonly createPair: WebSocketPairFactory;
+  private readonly createUpgradeResponse: UpgradeResponseFactory;
+
+  constructor(
+    context: StreamChannelContext,
+    observability: StreamChannelObservability,
+    createPair: WebSocketPairFactory = defaultWebSocketPair,
+    createUpgradeResponse: UpgradeResponseFactory = defaultUpgradeResponse,
+  ) {
+    this.context = context;
+    this.observability = observability;
+    this.createPair = createPair;
+    this.createUpgradeResponse = createUpgradeResponse;
+  }
+
+  async subscribe(request: Request, streamId: string, resumption: McpResumptionStore): Promise<Response> {
+    if (request.headers.get("Upgrade")?.toLowerCase() !== "websocket") {
+      return new Response("Expected Upgrade: websocket", { status: 426 });
+    }
+
+    const initial = await resumption.pollMessage(streamId);
+    if (initial.kind === "message") return json(initial.message);
+    if (initial.kind === "not_found") return json({ error: "stream_not_found" }, 404);
+
+    const replaced = this.closeSubscribers(streamId, 1012, "replaced by resumed stream");
+    const [client, server] = this.createPair();
+    this.context.acceptWebSocket(server, [streamTag(streamId)]);
+    server.serializeAttachment({ role: SUBSCRIBER_ROLE, streamId } satisfies StreamSubscriberAttachment);
+    this.observability.streamSubscriberOpened(replaced);
+
+    try {
+      // Recheck after registration. Completion may race between the first storage
+      // read and acceptWebSocket(); either publish() or this read delivers it.
+      const current = await resumption.pollMessage(streamId);
+      if (current.kind === "message") this.sendTerminal(server, current.message);
+      else if (current.kind === "not_found") closeWebSocketQuietly(server, 1008, "stream unavailable");
+    } catch (error) {
+      closeWebSocketQuietly(server, 1011, "stream lookup failed");
+      throw error;
+    }
+
+    return this.createUpgradeResponse(client);
+  }
+
+  publish(streamId: string, message: JsonRpcMessage): void {
+    if (!isStreamId(streamId)) return;
+    const sockets = this.context.getWebSockets(streamTag(streamId));
+    let delivered = 0;
+    for (const socket of sockets) {
+      if (this.sendTerminal(socket, message)) delivered += 1;
+    }
+    this.observability.streamTerminalDelivered(delivered);
+  }
+
+  isSubscriber(socket: WebSocket): boolean {
+    const attachment = subscriberAttachment(socket);
+    return Boolean(attachment);
+  }
+
+  rejectSubscriberMessage(socket: WebSocket): void {
+    this.observability.streamSubscriberProtocolError();
+    closeWebSocketQuietly(socket, 1008, "stream subscribers are receive-only");
+  }
+
+  private sendTerminal(socket: WebSocket, message: JsonRpcMessage): boolean {
+    if (socket.readyState !== WebSocket.OPEN) return false;
+    const sent = trySendWebSocket(socket, message);
+    closeWebSocketQuietly(socket, sent ? 1000 : 1011, sent ? "stream complete" : "stream delivery failed");
+    return sent;
+  }
+
+  private closeSubscribers(streamId: string, code: number, reason: string): number {
+    let closed = 0;
+    for (const socket of this.context.getWebSockets(streamTag(streamId))) {
+      if (socket.readyState !== WebSocket.OPEN) continue;
+      closeWebSocketQuietly(socket, code, reason);
+      closed += 1;
+    }
+    return closed;
+  }
+}
+
+function subscriberAttachment(socket: WebSocket): StreamSubscriberAttachment | null {
+  const raw = socket.deserializeAttachment();
+  if (!raw || typeof raw !== "object") return null;
+  const candidate = raw as Partial<StreamSubscriberAttachment>;
+  const streamId = candidate.streamId;
+  if (candidate.role !== SUBSCRIBER_ROLE || typeof streamId !== "string" || !isStreamId(streamId)) return null;
+  return { role: SUBSCRIBER_ROLE, streamId };
+}
+
+function streamTag(streamId: string): string {
+  if (!isStreamId(streamId)) throw new Error("invalid MCP stream id");
+  return `${SUBSCRIBER_TAG_PREFIX}${streamId}`;
+}
+
+function defaultUpgradeResponse(client: WebSocket): Response {
+  return new Response(null, { status: 101, webSocket: client });
+}
+
+function defaultWebSocketPair(): [WebSocket, WebSocket] {
+  const pair = new WebSocketPair();
+  return Object.values(pair) as [WebSocket, WebSocket];
+}

package/src/worker/mcp-stream-proxy.ts

@@ -1,14 +1,16 @@
+import relayContract from "../shared/relay-contract.json" with { type: "json" };
 import { applyCors, baseUrl, json } from "./http.ts";
 import { acceptsEventStream, resumeJsonRpcResponse, streamJsonRpcResponse } from "./mcp-stream.ts";
-import type { JsonRpcMessage, McpResumptionStore } from "./mcp-resumption.ts";
+import type { McpStreamChannel } from "./mcp-stream-channel.ts";
+import type { JsonRpcMessage } from "./mcp-resumption.ts";
 
 export const MCP_STREAM_PROXY_MODE_HEADER = "x-machine-bridge-internal-mcp-stream-mode";
 export const MCP_STREAM_PROXY_ID_HEADER = "x-machine-bridge-internal-mcp-stream-id";
 const MCP_STREAM_DESCRIPTOR_HEADER = "x-machine-bridge-mcp-stream-descriptor";
 const STREAM_ID_PATTERN = /^stream_[A-Za-z0-9_-]{43}$/;
-const DEFAULT_POLL_INTERVAL_MS = 250;
+const MAX_TERMINAL_MESSAGE_BYTES = relayContract.maximumResumableMessageBytes + 1024;
 
-type StreamProxyMode = "prepare" | "poll" | "";
+type StreamProxyMode = "prepare" | "subscribe" | "";
 type StreamDescriptorKind = "initial" | "resume" | "complete";
 type StreamDescriptor = { kind: StreamDescriptorKind; stream_id: string };
 type BridgeFetcher = { fetch(request: Request): Promise<Response> };
@@ -19,7 +21,6 @@ export async function proxyMcpEventStream(input: {
   bridge: BridgeFetcher;
   extraOrigins: string;
   ctx: StreamExecutionContext;
-  pollIntervalMs?: number;
 }): Promise<Response | null> {
   const url = new URL(input.request.url);
   const eligible = input.request.method === "GET"
@@ -38,12 +39,7 @@ export async function proxyMcpEventStream(input: {
     );
   }
 
-  const terminal = pollTerminalMessage(
-    input.bridge,
-    input.request.url,
-    descriptor.stream_id,
-    positiveInteger(input.pollIntervalMs, DEFAULT_POLL_INTERVAL_MS),
-  );
+  const terminal = subscribeTerminalMessage(input.bridge, input.request.url, descriptor.stream_id);
   input.ctx.waitUntil(terminal.then(() => undefined, () => undefined));
   const options = {
     streamId: descriptor.stream_id,
@@ -55,30 +51,28 @@ export async function proxyMcpEventStream(input: {
   return applyCors(response, input.request, baseUrl(input.request), input.extraOrigins);
 }
 
-export function sanitizeBridgeRequest(request: Request): Request {
-  const headers = new Headers(request.headers);
-  headers.delete(MCP_STREAM_PROXY_MODE_HEADER);
-  headers.delete(MCP_STREAM_PROXY_ID_HEADER);
-  return new Request(request, { headers });
-}
-
-export async function handleMcpStreamPollRequest(
+export async function handleMcpStreamSubscribeRequest(
   request: Request,
-  resumption: McpResumptionStore,
+  channel: McpStreamChannel,
+  resumption: Parameters<McpStreamChannel["subscribe"]>[2],
 ): Promise<Response | null> {
-  if (mcpStreamProxyMode(request) !== "poll") return null;
+  if (mcpStreamProxyMode(request) !== "subscribe") return null;
   if (request.method !== "GET") return new Response(null, { status: 405, headers: { allow: "GET" } });
   const streamId = mcpStreamProxyId(request);
   if (!streamId) return json({ error: "invalid_internal_stream_id" }, 400);
-  const outcome = await resumption.pollMessage(streamId);
-  if (outcome.kind === "pending") return new Response(null, { status: 202, headers: { "cache-control": "no-store" } });
-  if (outcome.kind === "not_found") return json({ error: "stream_not_found" }, 404);
-  return json(outcome.message);
+  return await channel.subscribe(request, streamId, resumption);
+}
+
+export function sanitizeBridgeRequest(request: Request): Request {
+  const headers = new Headers(request.headers);
+  headers.delete(MCP_STREAM_PROXY_MODE_HEADER);
+  headers.delete(MCP_STREAM_PROXY_ID_HEADER);
+  return new Request(request, { headers });
 }
 
 export function mcpStreamProxyMode(request: Request): StreamProxyMode {
   const value = request.headers.get(MCP_STREAM_PROXY_MODE_HEADER)?.trim().toLowerCase() ?? "";
-  return value === "prepare" || value === "poll" ? value : "";
+  return value === "prepare" || value === "subscribe" ? value : "";
 }
 
 export function mcpStreamProxyId(request: Request): string {
@@ -96,29 +90,72 @@ function withProxyHeaders(request: Request, mode: Exclude<StreamProxyMode, "">,
   const headers = new Headers(sanitized.headers);
   headers.set(MCP_STREAM_PROXY_MODE_HEADER, mode);
   if (streamId) headers.set(MCP_STREAM_PROXY_ID_HEADER, streamId);
-  return new Request(sanitized, { headers });
+  if (mode === "subscribe") headers.set("Upgrade", "websocket");
+  return new Request(sanitized, { method: mode === "subscribe" ? "GET" : sanitized.method, headers });
 }
 
-async function pollTerminalMessage(
+async function subscribeTerminalMessage(
   bridge: BridgeFetcher,
   requestUrl: string,
   streamId: string,
-  intervalMs: number,
 ): Promise<JsonRpcMessage> {
-  for (;;) {
-    const internal = withProxyHeaders(new Request(requestUrl, { method: "GET" }), "poll", streamId);
-    const response = await bridge.fetch(internal);
-    if (response.status === 202) {
-      await delay(intervalMs);
-      continue;
-    }
-    if (!response.ok) throw new Error(`internal MCP stream poll failed (${response.status})`);
-    const value: unknown = await response.json();
-    if (!value || typeof value !== "object" || Array.isArray(value) || (value as { jsonrpc?: unknown }).jsonrpc !== "2.0") {
-      throw new Error("internal MCP stream poll returned an invalid JSON-RPC message");
-    }
-    return value as JsonRpcMessage;
+  const internal = withProxyHeaders(new Request(requestUrl, { method: "GET" }), "subscribe", streamId);
+  const response = await bridge.fetch(internal);
+  if (response.status === 200) return await readJsonRpcResponse(response);
+  if (response.status !== 101 || !response.webSocket) {
+    throw new Error(`internal MCP stream subscription failed (${response.status})`);
   }
+  const socket = response.webSocket;
+  socket.accept();
+  return await terminalMessageFromSocket(socket);
+}
+
+function terminalMessageFromSocket(socket: WebSocket): Promise<JsonRpcMessage> {
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    const fail = (message: string) => {
+      if (settled) return;
+      settled = true;
+      reject(new Error(message));
+    };
+    const succeed = (message: JsonRpcMessage) => {
+      if (settled) return;
+      settled = true;
+      resolve(message);
+      try { socket.close(1000, "terminal received"); } catch { /* Peer may have already completed the close handshake. */ }
+    };
+    socket.addEventListener("message", (event) => {
+      if (settled) return;
+      try {
+        const text = webSocketText(event.data);
+        if (new TextEncoder().encode(text).byteLength > MAX_TERMINAL_MESSAGE_BYTES) throw new Error("terminal message is too large");
+        succeed(jsonRpcMessage(JSON.parse(text)));
+      } catch (error) {
+        fail(error instanceof Error ? error.message : "invalid terminal message");
+        try { socket.close(1008, "invalid terminal message"); } catch { /* socket may already be closing */ }
+      }
+    });
+    socket.addEventListener("close", () => fail("internal MCP stream subscription closed before terminal result"));
+    socket.addEventListener("error", () => fail("internal MCP stream subscription failed"));
+  });
+}
+
+async function readJsonRpcResponse(response: Response): Promise<JsonRpcMessage> {
+  return jsonRpcMessage(await response.json());
+}
+
+function jsonRpcMessage(value: unknown): JsonRpcMessage {
+  if (!value || typeof value !== "object" || Array.isArray(value) || (value as { jsonrpc?: unknown }).jsonrpc !== "2.0") {
+    throw new Error("internal MCP stream subscription returned an invalid JSON-RPC message");
+  }
+  return value as JsonRpcMessage;
+}
+
+function webSocketText(value: unknown): string {
+  if (typeof value === "string") return value;
+  if (value instanceof ArrayBuffer) return new TextDecoder("utf-8", { fatal: true }).decode(value);
+  if (ArrayBuffer.isView(value)) return new TextDecoder("utf-8", { fatal: true }).decode(value);
+  throw new Error("terminal message must be text or binary UTF-8");
 }
 
 async function readDescriptor(response: Response): Promise<StreamDescriptor> {
@@ -137,12 +174,3 @@ function stripInternalResponseHeaders(response: Response): Response {
   headers.delete(MCP_STREAM_DESCRIPTOR_HEADER);
   return new Response(response.body, { status: response.status, statusText: response.statusText, headers });
 }
-
-function positiveInteger(value: unknown, fallback: number): number {
-  const parsed = Number(value);
-  return Number.isFinite(parsed) && parsed > 0 ? Math.floor(parsed) : fallback;
-}
-
-function delay(ms: number): Promise<void> {
-  return new Promise((resolve) => setTimeout(resolve, ms));
-}

package/src/worker/observability.ts

@@ -9,6 +9,7 @@ export class WorkerObservability {
   private readonly requests = { total: 0, successful: 0, client_error: 0, server_error: 0 };
   private readonly calls = { started: 0, completed: 0, failed: 0, cancelled: 0, timed_out: 0, unmatched_results: 0 };
   private readonly sockets = { candidates: 0, authenticated: 0, ready: 0, disconnected: 0, protocol_errors: 0 };
+  private readonly streamTransport = { subscribers_opened: 0, subscribers_replaced: 0, terminal_pushes: 0, terminal_recipients: 0, protocol_errors: 0 };
   private readonly errors = new Map<string, number>();
   private readonly tools = new Map<string, { started: number; completed: number; failed: number; active: number }>();
 
@@ -52,12 +53,28 @@ export class WorkerObservability {
     this.incrementError(code || "protocol_error");
   }
 
+  streamSubscriberOpened(replaced: number): void {
+    this.streamTransport.subscribers_opened += 1;
+    this.streamTransport.subscribers_replaced += Math.max(0, Math.floor(replaced));
+  }
+
+  streamTerminalDelivered(recipients: number): void {
+    this.streamTransport.terminal_pushes += 1;
+    this.streamTransport.terminal_recipients += Math.max(0, Math.floor(recipients));
+  }
+
+  streamSubscriberProtocolError(): void {
+    this.streamTransport.protocol_errors += 1;
+    this.incrementError("stream_subscriber_protocol_error");
+  }
+
   snapshot(): Record<string, unknown> {
     return {
       uptime_ms: Math.max(0, performance.now() - this.startedAt),
       requests: { ...this.requests },
       calls: { ...this.calls },
       sockets: { ...this.sockets },
+      stream_transport: { ...this.streamTransport },
       errors: Object.fromEntries([...this.errors.entries()].sort(([left], [right]) => left.localeCompare(right))),
       tools: Object.fromEntries([...this.tools.entries()].sort(([left], [right]) => left.localeCompare(right)).map(([name, metric]) => [name, { ...metric }])),
     };

package/src/worker/worker-static-routes.ts

@@ -0,0 +1,60 @@
+import {
+  applyCors,
+  baseUrl,
+  corsPreflight,
+  json,
+  methodNotAllowed,
+} from "./http.ts";
+
+export function respondWithoutDurableObject(
+  request: Request,
+  identity: { server: string; version: string },
+  extraOrigins = "",
+): Response | null {
+  const url = new URL(request.url);
+  const base = baseUrl(request);
+  const path = url.pathname;
+  const serverName = identity.server;
+  const serverVersion = identity.version;
+
+  if (request.method === "OPTIONS" && request.headers.has("Origin")) {
+    // CORS preflight does not need Durable Object state and must not consume DO quota.
+    return corsPreflight(request, base, extraOrigins);
+  }
+
+  if (path === "/healthz") {
+    if (request.method !== "GET") return applyCors(methodNotAllowed("GET"), request, base, extraOrigins);
+    return applyCors(json({ ok: true, server: serverName, version: serverVersion }), request, base, extraOrigins);
+  }
+
+  if (path === "/") {
+    if (request.method !== "GET") return applyCors(methodNotAllowed("GET"), request, base, extraOrigins);
+    return applyCors(
+      json({ ok: true, server: serverName, version: serverVersion, mcp: `${base}/mcp` }),
+      request,
+      base,
+      extraOrigins,
+    );
+  }
+
+  return null;
+}
+
+export function isDurableObjectQuotaError(error: unknown): boolean {
+  const message = error instanceof Error ? error.message : String(error ?? "");
+  return /Exceeded allowed volume of requests in Durable Objects free tier/i.test(message)
+    || /Durable Objects free tier/i.test(message);
+}
+
+export function durableObjectQuotaResponse(request: Request, extraOrigins = ""): Response {
+  return applyCors(
+    json({
+      error: "durable_object_quota_exceeded",
+      message: "Durable Objects free-tier request volume is exhausted until the daily UTC reset.",
+      retryable: true,
+    }, 503),
+    request,
+    baseUrl(request),
+    extraOrigins,
+  );
+}