machine-bridge-mcp 3.0.0-beta.165 → 3.0.0-beta.167

package/CHANGELOG.md

@@ -1,2437 +1,12 @@
 # Changelog
 
-## 3.0.0-beta.165 - 2026-09-06
+## 3.0.0-beta.167 - 2026-09-08
 
-- Supersede beta.164 before GitHub prerelease after exact-head Windows CI reproduced a hard-timeout settlement regression inherited from beta.163. The Windows `terminateProcessTreeAndWait()` barrier again treats `taskkill /T /F` terminal `close(0)` as the bounded whole-tree settlement proof documented and provider-tested in beta.138, instead of starting an additional CIM process-enumeration sweep after `taskkill` has already succeeded. The five-second confirmation window, fail-closed `termination_settled=false`/`EUNSETTLED` path, and unchanged resistant-descendant publication regression remain intact.
-- Keep the Worker-types rollback regression cross-platform without introducing a CodeQL file-system race. Tests compare restored bytes and mode bits from one opened file descriptor, so POSIX still enforces the requested `0640` mode while Windows verifies the mode actually exposed by that filesystem; content and mode are no longer read through separate pathname operations.
-- Advance package/runtime identity to `3.0.0-beta.165`. Hosted tool schema generation remains 26 because this repair changes no MCP tool name, schema, visibility, description, or result shape. The beta.164 candidate and acceptance are historical evidence for different packaged bytes and cannot authorize beta.165.
+- Retire executable compatibility paths that have a current versioned replacement: require the current browser atomic-observation capability, require the formal desktop visual-point capability interface, and make remote MCP HTTP initialization current-protocol-only while preserving explicit fail-closed upgrade guidance for obsolete protocol/session requests.
+- Reduce the default maintenance and installation surface: the changelog now keeps the active release plus a history pointer, the audit file keeps only current conclusions and residual-risk notes, and npm packaging uses explicit runtime/operational-document and release-tool whitelists. Repository-only architecture, engineering, testing, release-governance, and contributor-governance material remains in source control but no longer ships to consumers.
+- Replace the GitHub backlog closing-keyword parser's overlapping quantified regular expression with a deterministic separator/issue-number scanner, removing the CodeQL `js/polynomial-redos` release blocker without weakening the SARIF gate.
+- Advance package/runtime identity to `3.0.0-beta.167`. Hosted tool schema generation remains 26 because these changes do not alter any MCP tool name, input schema, visibility, description, or result shape. No publication or live activation is part of this source change.
 
-## 3.0.0-beta.164 - 2026-09-04
+## Historical releases
 
-- Move long-task continuity off the external assistant-turn lifetime without weakening beta.163 ordinary-job semantics. `start_job` now accepts the narrow optional `continuation_mode=task_supervisor` declaration only when the durable job's own reviewed plan already encapsulates all remaining noninteractive task work. Ordinary claimed Job Monitors still keep `host_turn_handoff_recommended=false`; only an active persisted task supervisor plus a proven current View claim may report `host_turn_handoff_recommended=true`, because the supervisor job already owns the remaining execution lifecycle. The Job Monitor remains status-only and gains no execution or capability authority. Machine Bridge can validate the persisted continuation declaration, active state, and current View claim, but it cannot infer conversation-level task completeness; the `task_supervisor` completeness declaration remains an owner/caller semantic assertion.
-- Make the 24-hour private recovery promise for relay-origin one-step helpers hard under capacity pressure rather than merely higher priority. A terminal helper with `transient_recovery_pending=true` and a valid 24-hour `finished_at` window is excluded from capacity eviction; if all 512 retained slots are non-evictable, new admission fails with the existing typed retryable `limit_exceeded` backpressure instead of deleting promised recovery evidence. Producing a terminal hosted response clears the private pending marker and returns the result to the existing thirty-minute/newest-16 delivery reserve; expiry beyond 24 hours also makes the pending terminal evictable.
-- Close the cross-principal availability boundary created by combining that hard recovery promise with delegated durable one-step process tools. `operator` accounts still cannot create explicit persistent plans, but their remote `exec_command` / `run_process` / `run_local_command` calls use `transient_process` managed-job carriers in the same profile-wide 512-state store. New relay non-owner carriers are therefore limited to 16 unresolved pending-recovery promises per account ID plus account version across all OAuth clients/refresh families, under the existing root capacity lock before status publication or runner launch. Existing valid same-key persisted replay remains recoverable at quota; a statusless deterministic directory is only incomplete publication and must re-enter quota admission. Delivery/24-hour expiry releases the account slot, owner/local work remains on the global capacity contract, already accepted 24-hour promises remain hard-protected, and no separate mutable quota ledger or host-visible account inventory is added.
-- Close an independent ResourceCoordinator generation race exposed by repeated frozen full verification. Lease ownership updates atomically replace the persisted resource-state file, so a concurrent secure reader can legitimately observe `MBM_IDENTITY_CHANGED` between descriptor open and path revalidation. One shared resource-state JSON reader now retries only that legal generation-change class for at most four observations, while permission, symlink, hard-link, malformed-content, and persistent identity failures remain fail-closed. Host-sample and coordinator reads reuse the same helper, and `resource-admission.mjs` stays below its existing architecture ceiling instead of raising the limit.
-- Advance package identity to `3.0.0-beta.164` and hosted tool schema generation to 26 because both the `start_job` input contract and managed-job continuation result semantics change. Generation-25/beta.163 audit observations remain historical evidence and are not rewritten.
-
-## 3.0.0-beta.163 - 2026-09-02
-
-- Correct the task-level continuation semantics of the MCP Apps Job Monitor. A claimed View owns only status polling for one durable job; it does not know whether the initiating assistant still has code changes, verification, release steps, or other work that depends on that job. Claimed active reads therefore keep `host_turn_handoff_recommended=false` while reporting `status_polling_mode=ui_monitor` and `follow_up_read_required=false`. Hosted tool guidance and repository automation standards now forbid mounting the monitor merely to shorten a response when remaining same-response work needs the job's terminal result; those cases must keep the original `job_id` + `recovery_key` and continue bounded server-paced `read_job` follow-up. This closes the failure mode where successful UI polling was incorrectly treated as ownership of the entire assistant task and caused premature conversational handoff. Because the result semantics and hosted tool descriptions change again within the still-unpublished beta.163 candidate, hosted tool schema generation advances from 24 to 25.
-- Separate MCP Apps monitor presentation and background status traffic from the model-visible tool stream after live ChatGPT evidence exposed both as user-visible noise. The exact `Durable job monitor opened.` text shown in the host's tool-status area was traced to Machine Bridge's own `openai/toolInvocation/invoked` metadata rather than an unexplained host message, and a live render probe showed the mounted View could begin a `read_job` before the model's confirmation read. `render_job_monitor` no longer publishes custom invoking/invoked status labels and returns an empty ordinary text projection; model-visible `read_job` is again model-only. The existing one model-side render/claim confirmation remains because live beta.162 also proved that a current View can successfully claim MCP Apps continuation.
-- Move post-claim View polling onto app-only `read_job_monitor`. The Worker verifies the original principal-bound `recovery_key`, treats `ui_monitor_id` only as correlation, strips both values before delegating to one fixed 40-second daemon `read_job`, and exposes no new job inventory or direct network path. App polling is additionally bound to the latest claimed monitor instance: issuing a replacement monitor for the same job/principal retires older instances, while each accepted app read refreshes the current monitor's five-minute handoff-freshness lease. Issued/active/claimed monitor metadata is now transactionally persisted in the BridgeRoom Durable Object rather than an isolate-local `WeakMap`, so a Worker isolate replacement between `render_job_monitor` and the View's `claim_job_monitor` no longer erases the activated render instance and produces `managed-job monitor render instance is not active`; the bounded store contains only job/principal/monitor/state/expiry metadata and never the recovery capability or job result. Expiry of the freshness lease stops it from serving as model-side handoff proof, but does not strand a still-latest View after host suspension or machine sleep; the same View may resume app polling with the original recovery capability unless a newer monitor replaced it. The recovery capability remains the data-read authority; the monitor ID only gates which View may continue automatic polling. A replacement may race with one already-dispatched old read, but no subsequent old-View read is admitted. The View gives `ui/initialize` and `claim_job_monitor` separate 30-second response watchdogs and automatically retries a missing/transport-failed or explicitly retryable claim response at most five times with 1/2/4/8/15-second backoff; claim replay is safe because an already-claimed exact monitor remains claimable and refreshes its bounded handoff freshness. Each app-origin status call separately has a 60-second response watchdog and automatically retries missing/transport-failed or explicitly retryable status responses for at most six attempts using 1/2/4/8/15/30-second backoff. Exhausted or non-retryable failures pause instead of looping; no retry can resubmit the managed job. This targets the separately reproduced client/connector-to-Worker request-failure layer where `mcp_network_error` occurred while daemon-to-Worker relay continuity remained healthy; it does not claim to make an externally terminated ChatGPT assistant turn or final-message delivery observable. Package/runtime identity advances to beta.163 and hosted tool schema generation advances to 24 because tool visibility and the new app-only tool are host-visible schema changes.
-- Harden the monitor as an optional continuation layer rather than a second result channel. `read_job_monitor` now returns only a bounded lifecycle-status projection and discards step output, command text, paths, nested job results, and recovery/control capabilities before the View sees them. The View binds only its initial complete render input, ignores ambient tool-result notifications as state, uses fixed user-facing failure text, and clears the in-memory recovery capability plus pending response watchdogs on teardown. Durable Object monitor-storage failures after a managed job has already been accepted or read no longer reclassify that core result: issuance degrades to an ordinary non-UI continuation, claim probing degrades to “no proven handoff”, and authority-revocation cleanup remains auxiliary with bounded error-class telemetry only. Persisted monitor state also rejects duplicate monitor IDs/sequences and impossible sequence generations.
-- Keep the language-neutral resource coordinator live across the Workflow Bundle staging-name transition discovered during beta.163 verification. Current lease/wait publication still accepts only Machine Bridge's strict `.<target>.<pid>.<16hex>.tmp` grammar. A separate migration reader recognizes the retired Workflow Bundle lease-only `.lease_<id>.json.<8char>.tmp` replacement artifact only when the corresponding published lease is a valid provisional record and PID/process-start evidence proves its publisher reclaimable; live, missing, malformed, mismatched, or extra-link state remains fail-closed. This prevents a killed older Workflow Bundle validator from leaving one zero-byte staging file that makes all later local resource admission unavailable, without broadening the current staging grammar.
-
-## 3.0.0-beta.162 - 2026-09-02
-
-- Treat the continuing relay interruptions as two evidenced transport classes instead of another host-schema or heartbeat-only failure. One observed outage followed an approximately eighteen-second local event-loop stall and correctly rebuilt a stale WebSocket, while separate abrupt `1006` episodes occurred after recent inbound traffic and correlated with macOS network-extension/SystemConfiguration path re-election. That correlation is evidence of a local network-epoch change, not proof that a particular tunnel, proxy, edge, or upstream provider is faulty. The existing relay already starts exact-generation signed HTTPS takeover immediately on real WebSocket loss, so beta.162 does not add another watchdog or weaken the WebSocket liveness policy.
-- Bound only the pre-ready exact-generation HTTPS takeover request to three seconds while retaining the ordinary seven-second signed-HTTP request deadline, twelve-second liveness window, one-second ready cadence, five-second standby cadence, bounded one/two/four/five-second failure backoff, and 750 ms minimum request-start interval. A stale network epoch can therefore consume at most three seconds on the first takeover request before retry, leaving enough of the Worker's existing fifteen-second new-call recovery window for the first failure backoff plus the two request exchanges required to reach verified readiness. A deterministic regression holds the first takeover request until its full deadline, then requires the replacement channel to become verified-ready inside that same fifteen-second budget. Package/runtime identity advances to beta.162; hosted tool schema generation remains 23 because no MCP tool name, schema, visibility, or result shape changes.
-
-## 3.0.0-beta.161 - 2026-09-02
-
-- Replace beta.160's render-result fallback with a planner-independent MCP Apps handoff. A prior fresh Work canary had already proved the normal MCP App render/claim path can mount and hand off when the render result is exposed. A separate fresh Work canary then explicitly forbade `structuredContent`, required parsing `ui_monitor_id` only from `render_job_monitor` ordinary text, and ended `TEXT_ID_NOT_AVAILABLE`; that narrower test proves ordinary render-tool text is not a reliable planner-visible fallback, without assuming whether that particular View mount completed. An active MCP Apps-capable `start_job` now pre-issues the fresh non-secret `ui_monitor_id` in its ordinary data result, where the model already receives `job_id` and recovery capabilities. The model passes that exact ID into `render_job_monitor(job_id,recovery_key,ui_monitor_id)` and immediately reuses the same start-result ID for the single confirmation `read_job`; no planner decision depends on any render-tool result projection.
-- Preserve the render-instance safety boundary with an explicit Worker-only lifecycle instead of making pre-issued IDs immediately claimable. A start result creates a principal/job-bound monitor record in `issued` state; `claim_job_monitor` rejects it until `render_job_monitor` verifies the original recovery capability and activates that exact ID. The View receives `job_id`, `recovery_key`, and `ui_monitor_id` from render tool input, then its app-only claim advances the active record to `claimed`. Exact principal/job/ID matching, five-minute bounded retention, authority revocation, capability stripping before daemon dispatch, and the rule that `recovery_key` is the sole read authority are unchanged. Because the render input schema and active start-result contract change, package/runtime identity advances to beta.161 and hosted tool schema generation advances from 22 to 23. beta.160 is superseded before acceptance; it remains useful evidence that neither structured nor text render-result projection is reliable planner input.
-
-## 3.0.0-beta.160 - 2026-09-01
-
-- Fix the live ChatGPT MCP Apps handoff blocker found after beta.159 activation. Workspace Action refresh successfully published `render_job_monitor`/`claim_job_monitor`, fresh chats mounted the Job Monitor iframe, and the View independently updated to terminal state, but the initiating model did not reliably receive the render tool's `structuredContent.ui_monitor_id`. A controlled 180-second canary therefore reported no `ui_monitor_claimed`, stayed in `bounded_followup`, and ended `CLAIM_NOT_CONFIRMED` even though the View itself was mounted. `render_job_monitor` now mirrors the same fresh non-secret `ui_monitor_id` into its ordinary text content as a planner-compatibility fallback while retaining `structuredContent` as the canonical result. The principal-bound `recovery_key` remains the sole read authority and is never copied into text; claim issuance, View permissions, TTL, and daemon boundaries are unchanged. Regression coverage binds the same ID across structured/text projections at both the Worker domain and real MCP `tools/call` boundary and rejects recovery/control capability leakage. beta.159 had already received a local acceptance record after the first successful fresh-chat canary; the stricter repeat later invalidated that reliability conclusion before any public promotion. This is packaged behavior, so beta.160 supersedes beta.159 for further promotion and package/runtime identity advances to beta.160; hosted tool schema generation remains 22 because tool names, inputs, outputs, visibility, and descriptions are unchanged.
-
-## 3.0.0-beta.159 - 2026-09-01
-
-- Treat the newly reproduced ChatGPT `message reply timed out` incident as an outer host-turn delivery failure with a Machine Bridge-controlled amplification path, not as another relay outage. Contemporaneous beta.158 evidence kept the same launchd daemon alive with no restart, no matching relay outage, no system sleep, Green resource admission, and zero Worker tool failure/cancellation/timeout for the incident window. At the same time, the active durable workflow was still being followed through successive individually successful 40-second hosted `read_job` long-polls. That composition can keep one assistant response attached to already-durable work until the external host ends the response, even though every MCP call succeeds. Machine Bridge still cannot observe the host's aggregate turn deadline or final-message receipt, so beta.159 does not guess a fixed number of reads/minutes or lengthen the already host-tested per-call wait.
-- Add an MCP Apps managed-job monitor as a capability-gated continuation path for hosted `start_job`, while following the host-recommended data-tool/render-tool split. `start_job` remains the execution/data tool and carries no UI template. On an MCP Apps-capable request, an active result reports `ui_monitor_candidate=true` plus `ui_monitor_render_tool=render_job_monitor` but keeps model-side `follow_up_read_required=true`. The model calls `render_job_monitor(job_id,recovery_key)` once; that Worker-only read-authority check mounts the static `text/html;profile=mcp-app` resource and returns a fresh 128-bit `ui_monitor_id`. The sandboxed View receives the render input/result, completes `ui/initialize`, requires `hostCapabilities.serverTools`, and calls the app-only `claim_job_monitor(job_id,recovery_key,ui_monitor_id)`. The model's next `read_job` passes the same `ui_monitor_id`; only an exact current claim then projects `ui_monitor_claimed=true`, `status_polling_mode=ui_monitor`, `host_turn_handoff_recommended=true`, and `follow_up_read_required=false`. The View thereafter owns the existing capability-bound `read_job(...,wait_ms=40000)` continuation. The random render-instance ID is not read authority, but it prevents a short-lived claim from an older widget instance from transferring a later turn. Unsupported hosts, unmounted Views, Views without app-origin server-tool proxying, and already-terminal jobs retain the beta.158 bounded same-response behavior.
-- Preserve the existing hosted authorization boundary while adding UI delivery. `start_job` stays model-visible without a UI template, `render_job_monitor` is model-visible and is the only tool that mounts the Job Monitor resource, `read_job` is model+app visible, and `claim_job_monitor` is app-only. Render, claim, and read all rely on the accepted principal-bound recovery capability; render/claim verify it entirely in the Worker, while `read_job` still verifies and strips both `recovery_key` and the Worker-only `ui_monitor_id` before daemon dispatch. The View receives no bare-ID inventory or direct network path, renders a redacted result, and does not automatically emit a follow-up chat message. Hosted resources/capabilities, the two Worker-only monitor tools, the optional `read_job.ui_monitor_id`, and active managed-job result semantics are public schema changes, so package/runtime identity advances to beta.159 and hosted tool schema generation advances from 21 to 22. beta.158 remains the immutable published/activated artifact and its existing soak evidence cannot authorize beta.159 promotion.
-- Keep process-tree cleanup safety and coverage evidence separate after the first beta.159 full-verification attempt exposed a test-harness coupling. The standalone `managed-jobs:test` passed, while the nested coverage rerun inherited `NODE_V8_COVERAGE` into the detached managed-job runner; under the resulting scheduler pressure, the intentionally fail-closed POSIX ownership probe could not prove the anti-`SIGTERM` descendant still belonged to the original process group, correctly skipped unsafe `SIGKILL`, and the integration fixture then timed out waiting for that descendant to exit. Production ownership proof, the three-second bounded process snapshot contract, and fail-closed PID/PGID-reuse protection remain unchanged. The real process-tree timeout fixture now uses its own manager/job root with nested runner coverage disabled, while the parent test and all other managed-job runners remain instrumented; standalone managed-job integration and the complete critical coverage gate both pass with `managed-job-runner.mjs` still above its required coverage threshold.
-
-## 3.0.0-beta.158 - 2026-08-31
-
-- Fix a resource-coordinator self-identity race exposed by the exact-main beta.157 source-release gate. Waiter/lease stale-pruning and staging-publisher recovery now treat the running coordinator's own `process.pid` as authoritative through `currentProcessStartTimeMs()` instead of allowing an asynchronous all-process snapshot to override that identity. A generation-skewed external snapshot can therefore no longer delete the acquire call's own waiter and turn an otherwise admitted Green-state request into `fairness_wait`, reclaim a provisional lease owned by the still-running coordinator, or delete a still-live atomic waiter/lease staging file. Foreign PIDs continue to use sampled process-start evidence, so proven PID reuse remains reclaimable and fail-closed liveness semantics are unchanged.
-- Add focused regressions that deliberately supply a mismatched external start generation for the current PID and require the current waiter, provisional lease, and live atomic staging publisher to survive, while a mismatched foreign PID and a same-PID staging artifact from an older process generation are still reclaimed. Direct A/B probes against the accepted beta.157 tree reproduce both failures: the skewed self waiter becomes Green-state `fairness_wait`, and a future-generation snapshot silently deletes a live staging file; the beta.158 implementation admits/preserves both. The beta.157 source-release attempt had passed the first 122/131 frozen tasks before `full-access:test` failed on its first direct process; the wrapper stopped before tag/GitHub/npm mutation, so no published beta.157 artifact is being replaced. A separate cancellation/fairness fixture now injects its known current-process generation so its short observer window measures waiter wakeup semantics rather than a real all-process scan. beta.158 supersedes that accepted but unpublished candidate, and hosted MCP tool schema generation remains 21.
-
-## 3.0.0-beta.157 - 2026-08-31
-
-- Make release verification hermetic with respect to owner runtime configuration. Fast/full verification and the standalone critical-coverage runner now share one case-insensitive child-environment boundary that removes `MBM_RELAY_PROXY`, `MBM_DEBUG`, `MBM_MACOS_BACKGROUND_VISUAL_BACKEND`, and `MBM_MACOS_TRUST_BROKER`; dedicated fixtures opt into those behaviors explicitly. Ordinary `HTTP_PROXY`/`HTTPS_PROXY`/`NO_PROXY`, execution-surface provenance, explicit verification controls such as `MBM_CHECK_CONCURRENCY`, and unrelated environment state remain available. This closes both the second-order case where `coverage:test` could reintroduce a service-only relay route and the broader class where an owner's optional runtime configuration silently changes generic release evidence.
-- Remove host-scheduler timing from release-critical assertions. Resource process-parent coverage now verifies the exact bounded platform probe and conservative `null` fallback through injection instead of requiring the developer/CI machine's real process table to answer inside the production deadline; the elastic admission retry/re-expansion fixture also injects the process-start snapshot it needs instead of spending its one-second synthetic retry budget on a real system-wide process-generation scan under coverage. Remote process-read cooldown/output/exit behavior is exercised with synthetic session state and explicit waiter notifications; the remaining real-child clamp fixtures clear inherited `NODE_V8_COVERAGE` only from their spawned `node -e` children, so parent production modules remain covered without turning child instrumentation overhead into timing evidence. They retain only the hosted one-second wait-clamp lower bound and no longer treat sub-second output/exit timers or scheduler-dependent upper bounds as correctness evidence. The full-only stdio integration likewise separates its fast five-second protocol-response budget from a 20-second real-process observer budget, so `run_process`/`exec_command`/`start_process` can consume their documented pre-spawn admission window plus execution/settlement time without the test harness timing out first; production process deadlines are unchanged. The managed-job resource-replacement recovery fixture keeps its private coordinator and production recovery semantics but clears nested V8 coverage from that dedicated runner, preventing instrumentation latency in an unrelated all-process generation probe from consuming the fixture's ready window; the parent managed-job suite and the rest of the runner coverage remain instrumented.
-- Tighten release/privacy and execution-policy hygiene found during an independent architecture, module, branch, boundary, logging, test, documentation, history, and supply-chain review. The hardened-npm CI bootstrap no longer prints its temporary absolute bin path, and top-level `MBM_DEBUG=1` CLI exceptions now pass stack text through the shared log-redaction boundary so home paths and credential-shaped values are not emitted. Current threat/testing documentation no longer labels live contracts as historical Beta.61/Beta.58 behavior, and the undocumented initial-release `MBM_PASS_ENV=true` escape hatch is removed so a narrow/minimal execution environment can be widened only by the effective policy or accepted managed-job plan—not by ambient daemon/shell state. Behavioral and architecture regressions prevent these privacy/authority bypasses from returning. Reachable-history privacy scanning, full/production npm audit, registry signatures/attestations, architecture, lint, type checking, targeted regressions, and critical coverage remain clean. Several orchestration modules are intentionally left behaviorally unchanged despite low remaining line-budget headroom; future functional work should extract a coherent lifecycle/policy domain before raising those caps or adding more responsibilities.
-- Advance package/runtime identity to beta.157 because verification/CI scripts and the execution-environment hardening are packaged bytes. Hosted MCP tool schema generation remains 21: no tool input/result shape or owner-visible diagnostic schema changes, while narrow-profile environment semantics are tightened to match the already documented policy contract. The already published/activated beta.156 artifact and its soak evidence remain immutable; beta.157 requires its own frozen verification and candidate evidence before any activation/publication, and activating a published beta.157 would restart the major-version soak clock.
-
-## 3.0.0-beta.156 - 2026-08-31
-
-- Add a relay-only `MBM_RELAY_PROXY` application egress override for deployments where relay continuity must not follow ordinary `NO_PROXY` or shared environment-proxy selection. A non-empty value fixes both the preferred WebSocket and signed HTTP fallback to the same HTTP(S) CONNECT proxy; proxy failure keeps normal relay recovery but never authorizes a direct retry. Empty/unset values preserve the existing `HTTPS_PROXY`/`HTTP_PROXY`/`NO_PROXY` behavior, and Worker deployment health remains on that standard model.
-- Persist `MBM_RELAY_PROXY` in the existing owner-only service network-environment snapshot so launchd/systemd/Windows logon startup does not lose a session-only dedicated relay route. Diagnostics continue to expose only the coarse `application-http-proxy` route and never reveal the dedicated endpoint or credentials. Documentation makes the trust boundary explicit: Machine Bridge does not bind the proxy's upstream socket or bypass an operating-system VPN/TUN by itself; true route isolation uses a loopback-only sidecar whose upstream socket and DNS path are independently routed outside the unstable tunnel.
-- Add regressions for dedicated WSS routing despite matching `NO_PROXY`, real signed HTTP-fallback traversal through the same CONNECT proxy, invalid dedicated proxy schemes, and service-environment persistence. This packaged reliability fix blocks beta.155 soak promotion, advances package/runtime identity to beta.156, and leaves hosted tool schema generation at 21 because no MCP tool or owner-visible diagnostic contract changes.
-
-## 3.0.0-beta.155 - 2026-08-30
-
-- Close the hosted managed-job cross-conversation discovery boundary found during an independent beta.154 review. Hosted acceptance now returns deterministic HMAC-SHA256 `recovery_key` and `control_key` capabilities bound to account version, OAuth client, refresh family, role, job ID, and purpose. Hosted `read_job` requires the read capability, `cancel_job` requires the control capability, and every `depends_on` reference requires an exact `dependency_recovery` mapping. The Worker verifies these capabilities before daemon dispatch and strips them from daemon arguments; they are not persisted in managed-job state or mirrored into MCP parameter headers. Hosted `list_jobs` is now aggregate-only and omits job IDs, names, and `recent_process_recovery` handles, while local CLI/stdio retains global owner administration. This prevents Machine Bridge's own shared owner inventory from becoming cross-conversation recovery authority; it cannot distinguish conversations if a host itself forwards another conversation's valid capability.
-- Stop hosted browser content/action tools from implicitly following the shared Chromium active tab. Hosted source/inspection/wait/action/form/screenshot/upload calls now require an explicit `tab_id` obtained from `browser_list_tabs`, and hosted `computer_observe(surface="browser")` requires the same explicit target before snapshot creation. Snapshot-bound `computer_act` remains unchanged. This removes a concurrent-conversation retargeting path without changing local browser behavior.
-- Repair credential/log privacy defense in depth. Runtime free-form sanitization and repository publication scanning now import one shared sensitive-value pattern catalog, cover current Machine Bridge password/OAuth/managed-job capability formats, and use token-alphabet-aware negative lookaheads instead of terminal `\\b` for credentials whose alphabets include hyphen/underscore/equal. Regression fixtures prove complete redaction/detection at delimiter-edge values rather than merely checking that the original full string disappeared.
-- Improve stale hosted-schema recovery. A cached `read_job.wait_ms` above the current 60-second hosted maximum now receives explicit `tools/list` refresh and same-job server-paced continuation guidance; cached schemas missing the new managed-job `recovery_key`/`control_key` receive no-side-effect refresh guidance rather than a generic business-argument error. Tool schema generation advances from 20 to 21.
-- Align managed-job contention and module boundaries. Transition-lock contention now returns typed retryable `conflict` with `job_transition_pending=true` instead of human retry text wrapped in a generic execution failure, and managed-job state/directory validation moves to a focused module rather than consuming the remaining `managed-jobs.mjs` growth budget. Current architecture/testing documentation is corrected from the obsolete five-minute hosted `read_job` maximum to the actual 60-second maximum and 70/75-second execution/settlement budget at that maximum. Multi-account documentation now states the intentional local owner global-administrator exception explicitly.
-- Package/runtime identity advances to beta.155 because these are host-visible schema, authorization, and browser-targeting changes. Beta.154 release evidence remains historical evidence for the published beta.154 bytes and is not reused or rewritten; beta.155 requires fresh verification, candidate evidence, live generation-21 host refresh/argument probes, acceptance, and provider gates before any publication.
-
-## 3.0.0-beta.154 - 2026-08-29
-
-- Supersede the locally accepted beta.153 candidate after exact-head PR #114 failed the required JavaScript/TypeScript CodeQL gate with `js/file-system-race` in `exclusive-publication-recovery.mjs`. The finding was actionable: beta.153 recognized a committed two-link exclusive-publication crash residue by inspecting target/alias paths and then deleted the reserved staging pathname. Rechecking identity before `unlink` could not make a pathname-based destructive operation race-free under Node's path APIs, so no CodeQL suppression or accepted-SARIF exception is added.
-- Replace destructive staging-alias cleanup with a non-destructive, descriptor-verified residue token. The verifier opens the canonical target first with the shared no-follow/path-identity boundary, requires exactly two links, opens only candidates in the reserved `.<target>.<pid>.<16hex>.tmp` namespace, accepts exactly one same-generation/same-inode two-link alias, rechecks the held target descriptor, and returns only that exact filesystem identity. Explicitly coupled readers may use the token for one bounded read of the same two-link generation; arbitrary hard links, extra/mismatched aliases, symlinks, changed generations, and ordinary readers remain fail-closed. The verifier itself contains no `unlink`/`rm` path.
-- Stale owner reclamation may remove only the canonical target after the usual owner/token and full generation checks, with a verified two-link token when required. It never deletes the staging alias by pathname. A process killed in the tiny post-link/pre-cleanup window can therefore leave an owner-only internal alias until its containing job/state generation is retired; this is an explicit availability/privacy tradeoff rather than hidden cleanup. Browser-pairing residue remains owner-private and is never returned through MCP or logs. Deterministic process-lock coverage proves live residue is readable without alias mutation, stale canonical ownership can be reclaimed, and arbitrary external hard links are still rejected.
-- Keep dependency freshness closed in the superseding candidate: Wrangler advances from 4.127.0 to 4.127.1 and its exact private control-plane dependency/allowlist advances from workerd 1.20260826.1 to 1.20260828.1. Root and isolated lockfiles, exact install-script policy, private toolchain validation, consumer package security, Worker type generation, package contract, `npm outdated`, and audit all pass after the update.
-- These packaged security/toolchain changes invalidate beta.153 acceptance. Package/runtime identity advances to beta.154; hosted tool schema generation remains 20 because no MCP tool input, result, or owner-visible diagnostic semantics change. Beta.154 requires fresh frozen verification, exact candidate/install-only proof, detached activation, candidate-bound canaries/live checks, acceptance, and new exact-head provider gates before GitHub prerelease creation. npm publication remains a separate exact-version owner authorization boundary.
-
-## 3.0.0-beta.153 - 2026-08-29
-
-- Supersede the prepared but unaccepted beta.152 candidate after review of the recovered-outage timeline found that one completed multi-attempt outage mixed two different causal timestamps. `recent_outages[].duration_ms` already measured from the first outage transition through final readiness, but `disconnected_at` was populated from `lastDisconnectedAt`, which advances again on every failed reconnect attempt. A three-attempt outage could therefore report a late final-disconnect timestamp next to a duration that began at the first disconnect, causing downstream sleep/wake correlation to evaluate the wrong interval. Beta.153 keeps `disconnected_at` as the first outage start, adds bounded `last_disconnect_at` for the final failed reconnect transition, and makes active-outage correlation prefer the existing `outage_started_at` field.
-- Preserve bounded first-failure liveness context instead of letting later reconnect attempts overwrite the only evidence about how the outage began. The local relay freezes the initial protocol-Ping dispatch/outstanding state, transport-confirmation state, and application-inbound silence when the first outage transition is recorded, retains those fixed boolean/millisecond fields in the newest-first eight-entry outage ring, and sanitizes the same fields for peer diagnostics. Tests cover a multi-attempt timestamp split and a synthetic protocol-Ping dispatch failure so the first-disconnect evidence cannot silently collapse back to final-attempt state. No endpoint, interface, address, DNS answer, close reason, account/client identity, call ID, tool argument, or result is added.
-- Beta.152 had completed frozen verification and candidate packaging but remained `pending` and had no tracked acceptance record. Because beta.153 changes packaged runtime bytes and owner-visible diagnostics after that freeze, the beta.152 tarball cannot authorize activation or release. Package/runtime identity advances to beta.153 and hosted tool schema generation advances from 19 to 20 because the owner-visible relay diagnostic contract now adds first/final disconnect and first-failure liveness fields. Beta.153 requires fresh frozen verification, candidate/install-only proof, detached activation, activated-package canaries, live generation-20/default-40s/explicit-60s continuation verification, diagnostic verification, new acceptance, and exact-head provider gates. npm publication remains a separate exact-version owner authorization boundary.
-
-## 3.0.0-beta.152 - 2026-08-29
-
-- Reject beta.151 as a release candidate after the owner-visible interruption class reproduced during the PR-check phase on a second explicit `read_job(wait_ms=180000)` call. The host returned `mcp_network_error: Connection failed` for the deployed Worker `/mcp` endpoint. Generation-18 continuity evidence after recovery showed the same daemon WebSocket had remained ready since 15:44:20Z, `outage_count=0`, no recorded relay disconnect, and `unplanned_ready_socket_disconnects=0`; local runtime diagnostics also showed no event-loop stall, resource pressure, or system-sleep correlation. This narrows the reproduced failure to the outer hosted HTTP/tool-settlement path rather than Worker-to-daemon WSS.
-- Remove the contradictory five-minute hosted-read allowance. Remote `read_job` still defaults to a 40-second server-side long-poll, but its public `wait_ms` maximum is now 60 seconds, matching the longest explicit per-call duration already carried to a structured result by the target host. Values above 60 seconds are rejected at the hosted Worker schema/daemon relay extension instead of letting callers enter an unverified long HTTP request. Long jobs keep durable ownership and autonomous same-response progress by issuing another paced `read_job` for the same `job_id`; local/stdio inspection retains its existing 40-second maximum. The independent 315-second relay result-retention/acknowledgement ceiling is unchanged because it protects settlement ownership rather than authorizing one host request to stay open that long.
-- These host-visible schema and orchestration semantics supersede beta.151 acceptance. Package/runtime identity advances to beta.152 and hosted tool schema generation advances from 18 to 19. Beta.152 requires fresh frozen verification, exact candidate/install-only proof, detached activation, activated-package OAuth and freshness canaries, live default-40s plus explicit-60s continuation probes, new acceptance, and exact-head provider gates. npm publication remains a separate exact-version owner authorization boundary.
-
-## 3.0.0-beta.151 - 2026-08-28
-
-- Treat the owner's continuing severe interruption report as release-blocking and correct Worker continuity evidence before drawing another transport conclusion. Durable continuity schema 1 could over-count stale close/error callbacks because the per-isolate cleanup `WeakMap` disappears across Durable Object isolate replacement; a socket already serialized as `expired` could later deliver another close in a new isolate and increment the durable counters again. Planned-drain intent also lived only in an isolate-local `WeakSet`, so a planned shutdown crossing isolate replacement could be mislabeled unplanned. Schema 2 records a socket disconnect only for the first cleanup transition, persists WebSocket draining intent in the socket attachment, classifies the bounded pre-cleanup role/`was_ready`/`connected_at`, and adds `ready_socket_disconnects`, `unplanned_ready_socket_disconnects`, and `last_ready_socket_disconnect` so candidate/probing churn cannot be read as an authoritative ready-channel outage. Legacy schema-1 disconnect counters are deliberately reset instead of inheriting unqualified history. No account/client identity, daemon/connection ID, call ID, endpoint, close reason, argument, or result is added.
-- Repair a separate crash-consistency blocker exposed by the beta.149 canonical release verification. Exclusive owner-state publication commits with `link(staging,target)` before unlinking the private staging name; SIGKILL in that narrow window can leave the valid committed target at `nlink=2`, after which secure readers correctly reject it but previously had no bounded recovery path. Owner-state readers now retry the normal transient window and may remove exactly one same-inode alias inside the reserved internal `.<target>.<pid>.<random>.tmp` publication namespace. Recovery holds the target open with `O_NOFOLLOW`, revalidates the alias, unlinks only that reserved staging name, and proves the target path still references the held `dev+ino` with one link. Hard links outside that exact internal namespace, symlinks, multiple aliases, and identity changes remain fail-closed. Process-lock regression reproduces the post-link crash window while retaining the existing hostile-hardlink rejection.
-- These packaged runtime and owner-visible diagnostic changes supersede beta.150 release evidence. Package/runtime identity advances to beta.151 and hosted tool schema generation advances from 17 to 18. Beta.151 requires fresh frozen verification, exact candidate/install-only proof, detached activation, activated-package canary, generation-18 live `server_info` verification, new acceptance, and exact-head provider gates before GitHub prerelease creation. npm registry publication remains separately owner-authorized for the exact beta.151 version.
-
-## 3.0.0-beta.150 - 2026-08-28
-
-- Supersede the accepted but unpublished beta.149 candidate after the canonical GitHub prerelease command exposed another ignored-worktree coupling. The merged `main` exact head passed its provider gates and `prerelease:release` then passed the complete 131-task frozen plan plus acceptance/CI revalidation, but publication stopped before tag creation because the canonical main worktree still held an ignored beta.146 `.release-candidate/manifest.json`. The documented workflow moves an accepted candidate through review/squash-merge and then runs `prerelease:release` from fast-forwarded `main`; an ignored candidate directory does not follow that Git transition and therefore cannot be release authority. Read-only reconciliation confirmed beta.149 never created a remote tag or GitHub Release and remains absent from npm.
-- Make accepted-candidate staging independent of stale or missing checkout-local candidate caches without weakening exact-byte guarantees. When GitHub or npm publication supplies its integrity-pinned hardened npm CLI, the shared staging layer deterministically rematerializes the current package in a private temporary directory, requires package name/version/filename/SHA-1/SRI and the promotion-content digest to equal the tracked acceptance record, verifies the resulting tarball again, and writes the publication copy as an owner-private `0600` file. Low-level candidate resolution without an explicit npm CLI still validates the existing `.release-candidate` manifest/tarball and fails closed, so activation/developer workflows do not silently repair stale local evidence. GitHub and npm publication now pass their already-established hardened npm CLI into this shared boundary. Package/runtime identity advances to beta.150; hosted tool schema generation remains 17 because no MCP catalog/result semantics change.
-
-## 3.0.0-beta.149 - 2026-08-28
-
-- Supersede the locally accepted beta.148 candidate after a third independent live review found a sleep/wake causality error in `diagnose_runtime`. Four recovered WebSocket outages were first recorded exactly when macOS sleep intervals ended, including a latest 299.5-second daemon event-loop stall independently matching a 305-second maintenance sleep, yet `relay_outage_analysis` reported `no_matching_recent_system_sleep` because the existing algorithm considered only overlap between `last_disconnected_at` and `last_ready_at`. JavaScript cannot observe a socket close while the process is suspended, so a failure discovered on the first post-wake timer/probe can legitimately have zero close-to-ready sleep overlap. The diagnostic now classifies that narrow case as `wake_boundary_system_sleep_aftermath` only when the disconnect is within the fixed thirty-second wake tolerance and the same sleep independently matches the runtime event-loop stall in both end time and duration. A coincidental near-wake reset without matching stall evidence remains `no_matching_recent_system_sleep`; ordinary overlap classifications are unchanged.
-- Update owner diagnostic guidance and hosted metadata for the new causal distinction. Tool schema generation advances to 17 because `diagnose_runtime.runtime.relay_outage_analysis.classification` has a new observable value and the host-visible interpretation changes. Beta.148 acceptance is removed because packaged local runtime, shared metadata, tests, and documentation change; package/runtime identity advances to beta.149 and requires fresh frozen verification, candidate/install-only proof, guarded activation, activated-package OAuth canary, live wake-boundary diagnostic verification, acceptance, and exact-head provider checks before publication. npm registry publication remains separately owner-authorized.
-
-## 3.0.0-beta.148 - 2026-08-28
-
-- Supersede the accepted but unpublished beta.147 candidate after a second independent review found a release-control defect during the first canonical GitHub prerelease attempt. That attempt passed 126 full-plan tasks and then failed at the real `npm sbom` gate because the checkout's ignored `node_modules` still contained the pre-upgrade direct dependency versions even though `package.json` and the lockfile were current. No beta.147 local/remote tag, GitHub Release, or npm package exists. GitHub and npm publication paths now create hardened npm first, rebuild the source dependency tree from the committed lockfile with explicit `npm ci`, and only then run full verification / acceptance revalidation; npm publication no longer uses the ambient lifecycle npm to regenerate acceptance bytes. Long GitHub-release npm stages now reuse the shared process-tree hard-timeout settlement instead of direct-child-only `spawnSync`, and the full plan runs the real SBOM check first so an invalid dependency tree fails before expensive platform/coverage work. Standalone GitHub backlog probes also gain a fixed two-minute hard timeout and bounded output.
-- Close a free-form operational-log privacy gap: shared redaction now recognizes `mcp_rt_*` refresh tokens plus stable account/client/refresh-family identifiers both by field name and when embedded in ordinary diagnostic text. Local logger, Worker observability, Worker edge logger, and release-diagnostic regressions cover those forms without changing the intentional raw owner-terminal provisioning boundary. Architecture growth budgets now also cover the previously unbounded `state.mjs` and `service.mjs` composition modules so further growth requires an explicit responsibility decision rather than silent accumulation. A package-mode regression also caught the new dependency helper at `0600`; it is normalized to ordinary packaged-file mode `0644`.
-- Invalidate and remove beta.147 candidate acceptance because these shipped script/shared-runtime/documentation changes alter the accepted package bytes after live verification. Package/runtime identity advances to beta.148 while hosted tool schema generation remains 16; beta.148 requires a fresh frozen full verification, candidate/install-only proof, guarded activation, activated-package OAuth canary, live verification, acceptance, and exact-head provider gates before any GitHub prerelease. npm registry publication remains separately owner-authorized.
-
-## 3.0.0-beta.147 - 2026-08-28
-
-- Reject beta.146 as a GA-soak candidate after an independent live continuity review reproduced loss of a one-step durable helper's recovery record under shared managed-job churn. A hosted helper that still requires `read_job` follow-up now carries a private `transient_recovery_pending` marker and receives stronger retention priority for the existing thirty-minute grace; once Machine Bridge produces a terminal hosted response, that marker is cleared under the transition lock and the result returns to the bounded newest-16 transient delivery reserve. `recent_process_recovery` remains capped at 16 public handles, prioritizes retained follow-up-required helpers, and still exposes no step output or internal retention metadata. Hosted tool schema generation advances to 16 because recovery inventory semantics changed.
-- Keep WebSocket reconnect failure history across short verified-ready flaps. `ready_ack` still restores business traffic immediately, but reconnect backoff is no longer reset at that instant; a generation-fenced five-second stable-ready window clears the prior attempt history, while a socket that drops sooner keeps its exponential backoff position. This follows the minimum-uptime pattern found during a 30-project source review without delaying relay readiness or changing the existing Ping/Pong/application-heartbeat liveness proof.
-- Upgrade all outdated direct dependencies to current exact releases: `ws` 8.21.3, `@types/node` 26.4.0, ESLint 10.9.1, `globals` 17.11.0, and Wrangler 4.127.0. Advance the repository/package-manager and hardened publication/install bootstrap from npm 12.0.1 to current npm 12.0.2 using its exact registry SHA-512 identity while retaining the reviewed undici 6.28.0 and brace-expansion 5.0.9 replacements; a real temporary hardened 12.0.2 construction passes the existing package/tree verifier. Synchronize the isolated Wrangler control-plane toolchain to 4.127.0 / workerd 1.20260826.1, review the exact install-script allowlist, regenerate Worker types, and keep the Worker dry-run green. Workspace supply-chain verification reports zero audit vulnerabilities, no unreviewed install scripts, 109 verified registry signatures, and 35 verified attestations.
-- Harden the npm publication authentication boundary exposed by the real beta.146 EOTP attempt. Non-TTY automation captures npm upload output instead of inheriting one-time browser-auth challenge URLs; real owner terminals still inherit stdio so npm can complete Web OTP in the same process. EOTP plus registry-confirmed absence is reported as authentication-required rather than ambiguous, challenge URLs are redacted by release diagnostics, and all publication npm stages use `--logs-max=0` so those one-time URLs are not persisted in npm cache debug logs. Published-prerelease activation now also reminds operators to reload the unpacked Chromium extension before treating browser behavior as soak evidence.
-- Expand independent security/test review rather than relying on the existing green suite. Device root/session identity tests now exercise malformed JWK, origin, transcript, certificate, timestamp, and challenge branches that the previous critical-module coverage gate could execute only sparsely. The review also read implementation source from 30 pinned related GitHub projects across official MCP SDKs/servers, MCP frameworks, browser/local bridges, durable job systems, credential stores, and reconnect libraries; the strongest recurring invariants were compared against Machine Bridge and recorded in `docs/AUDIT.md`.
-
-## 3.0.0-beta.146 - 2026-08-27
-
-- Fix the hosted `start_job` initial-settlement result boundary exposed by the live beta.145 candidate. The shared settlement helper had explicitly copied process-carrier-only acceptance fields onto ordinary managed-job results; those properties were absent on `start_job` and therefore became JavaScript `undefined`. Machine Bridge's real tool-result normalization intentionally rejects `undefined` as non-JSON, so the job was durably accepted and could complete while the initiating hosted call returned a non-retryable `internal_error`. The helper now relies on the original accepted-object spread to preserve only fields that actually exist instead of manufacturing absent properties.
-- Extend the regression through `normalizeToolResult()` rather than testing the bound handler result alone. This reproduces the exact boundary missed by beta.145: a short hosted `start_job` must coalesce terminal state, preserve its recovery envelope, and remain valid JSON with no unsupported value. Existing process-carrier initial settlement remains unchanged and still returns its defined `execution_mode`, `source_tool`, execution-timeout, and retry-safety fields.
-- Reject beta.145 after live activation even though its exact candidate passed 131/131 frozen verification, install-only validation, service/Worker activation, and the activated-package OAuth canary. Two independent live hosted `start_job` probes returned `internal_error`; idempotency evidence and `read_job` proved the underlying canary job had actually executed successfully. No beta.145 candidate acceptance is recorded. Package/runtime identity advances to beta.146; hosted tool schema generation remains 15 because the public gen15 contract is unchanged and beta.146 repairs its implementation. Fresh frozen verification, candidate/install-only proof, guarded activation, activated-package canary, live short-`start_job` verification, acceptance, and exact-head provider gates are required. npm publication remains separately owner-authorized.
-
-## 3.0.0-beta.145 - 2026-08-27
-
-- Preserve the causal evidence for repeated awake WebSocket rebuilds instead of retaining only the latest reconnect. The local relay now keeps a newest-first `recent_outages` ring capped at eight completed reconnect episodes with bounded timestamps/durations, close/error classes, prior-ready duration/silence, coarse application-route class, and connection-stage timings. The daemon hello sanitizes that history, and Worker ready promotion synthesizes the just-completed current episode that could not yet have appeared in the pre-ready hello. Pong/application-confirmation near misses that recover without replacing WSS remain heartbeat diagnostics and are deliberately excluded from the completed-outage ring.
-- Reduce another reproduced host-event-density amplifier without shortening durable work. Hosted `start_job` now shares the existing two-second optional managed-job initial-settlement path already used by one-step durable process carriers. A short job that reaches terminal state inside the original response returns its result with `follow_up_read_required=false`; an active job keeps the same `job_id`/recovery envelope with `follow_up_read_required=true`. Dependency waiting, thirty-minute resource admission, six-hour step ceilings, reconnect/replay safety, and local/stdio behavior remain unchanged.
-- Supersede beta.144 because the owner-reported interruption class remains blocking and these changes alter packaged relay diagnostics, hosted `start_job` delivery semantics, tool descriptions, and shipped documentation. Package/runtime identity advances to beta.145 and hosted tool schema generation advances to 15. Fresh frozen verification, candidate/install-only proof, guarded activation, activated-package OAuth canary, live observation, acceptance, and exact-head provider gates are required before GitHub prerelease publication; any later npm publication still requires separate owner authorization, and a published beta.145 activation would restart the major-prerelease soak interval.
-
-## 3.0.0-beta.144 - 2026-08-27
-
-- Fix a real Windows managed-job dependency recovery defect exposed by exact-main provider CI after beta.143 acceptance. Runner-exit reconciliation already treats transient `permission_denied`/conflict/timeout/resource-unavailable failures as retryable, but a concurrently waiting downstream previously treated any secure upstream status-read error as permanent `dependency_unavailable`. Dependency polling now gives only `permission_denied`, `identity_changed`, and generic `resource_unavailable` reads a fixed 45-second monotonic recovery grace; a successful secure read clears that grace immediately, persistent unavailability still fails closed, and missing/integrity/witness-invalid evidence remains non-retryable.
-- Correct the Worker integration fixture race that obscured the first exact-main diagnosis. Eight tests started an MCP HTTP request before registering the WebSocket `tool_call` listener, so a fast relay dispatch could arrive before the harness was listening and be lost permanently; increasing the waiter from five to ten seconds could not fix that ordering bug. The fixture now registers the waiter before triggering the request. Three local Worker integration runs and hosted Ubuntu/full passed with the listener-first ordering.
-- Supersede beta.143 release evidence because the dependency-recovery repair changes packaged runtime bytes and hosted orchestration semantics. The beta.143 acceptance record is removed, package/runtime identity advances to beta.144, and tool schema generation advances to 14. Fresh frozen verification, exact candidate preparation/install-only proof, guarded activation, activated-package OAuth canary, live observation, acceptance, and exact-head provider gates are required before GitHub prerelease publication. npm publication remains separately owner-authorized for the exact beta.144 version.
-
-## 3.0.0-beta.143 - 2026-08-27
-
-- Correct interruption diagnosis after live beta.142 evidence separated host suspension from awake transport resets. A programmatic correlation of fifteen recovered August 23 relay outages with bounded macOS `pmset` sleep intervals found thirteen sleep-dominated episodes: 32,980 of 33,390 outage seconds (98.8%) occurred while the host was suspended. `diagnose_runtime.runtime.relay_outage_analysis` now intersects the most recently completed close-to-ready relay interval with the same bounded sleep history and reports only coarse timing/overlap fields. `majority_system_sleep_overlap` therefore prevents a sleep-dominated `connection_reset` from being promoted into an unsupported independent-network root cause, while an awake reset with no sleep overlap remains real transport evidence without guessing which external layer failed.
-- Strengthen the existing macOS remote-work power assertion on AC without extending its ownership lifetime. The fixed runtime/remote-runner primitive now launches `/usr/bin/caffeinate -i -s -w <owner-pid>` instead of `-i -w`: `-i` retains Idle Sleep prevention and Apple's `-s` assertion adds `PreventSystemSleep` only while on AC power. A live three-second probe on the affected Mac observed both assertions concurrently. The thirty-minute relay inactivity grace, process-session ownership, detached account-job ownership, fail-open error handling, and explicit/lid-close/battery limitations are unchanged; diagnostics report only whether the fixed child requests the AC-only system-sleep assertion.
-- Keep the external-host boundary explicit. The beta.142 `UNKNOWN / TaskGroup` episode occurred during an approximately nine-second awake relay `1006/connection_reset`, while the same durable job continued and was recovered by the same `job_id`. Worker pending-call deadlines already preserve the original absolute timeout across reconnect, and the public MCP response path already emits an immediate SSE priming frame plus five-second heartbeats. This tree does not invent a host timeout or shorten the proven forty-second hosted `read_job` default without evidence. Tool schema generation advances to 13 because owner-visible `diagnose_runtime` result semantics and guidance changed. npm registry publication remains a separate explicit owner-authorization boundary.
-
-## 3.0.0-beta.142 - 2026-08-27
-
-- Make retained one-step process recovery discoverable after a real host/tool boundary. A saturated live 512-state store can legitimately contain 496 durable terminal jobs plus the beta.141 sixteen-result transient recovery reserve; the existing durable-first `list_jobs.jobs` window may then contain no recent process helpers even though a known helper `job_id` is still readable. `list_jobs` now keeps that primary window unchanged and adds `recent_process_recovery`, capped at 16 authority-visible public job handles for recent transient terminal results that are still inside the existing thirty-minute recovery grace but omitted from `jobs`.
-- Preserve the request-scoped MCP boundary. The new recovery projection carries public job status only: no step output, argv, path, internal `retention_class`, conversation identity, terminal-result replay, or cross-request response session is added. It is inventory for recovering a lost `job_id`; known work still continues through `read_job`, and `list_jobs` remains a non-polling surface. The 512-state retention cap, 50-record primary inventory, 16-result/thirty-minute transient retention reserve, durable-first ordering, dependency pinning, and eviction priorities are unchanged.
-- Advance hosted tool schema generation to 12 because `list_jobs` public result semantics and tool guidance changed. These shipped runtime, catalog, tests, and documentation changes supersede beta.141 release evidence and require a fresh prerelease verification/candidate/activation sequence before any publication. npm registry publication remains separately owner-authorized.
-
-## 3.0.0-beta.141 - 2026-08-26
-
-- Preserve immediate recovery evidence for remote one-step process carriers under a saturated 512-state managed-job store. The previous eviction order always discarded `transient_process` terminal results before any ordinary durable terminal history; with 510 durable terminals already retained, short `exec_command` helpers could therefore return a recoverable job ID and then become `not_found` before the next `read_job`. Beta.141 reserves at most the newest 16 otherwise-removable transient results for thirty minutes. The incoming transient counts against that bound, older/excess transient history is still evicted first, ordinary durable history is next, dependency-protected records remain pinned, and the hard 512-state cap is unchanged.
-- Correct the Windows same-daemon runner-exit integration oracle exposed by merged-main CI. Production schedules reconciliation at 10.1 seconds and may retry two more times at 10.1-second intervals after transient `permission_denied`/conflict/timeout/resource-unavailable failures, but the fixture asserted autonomous relaunch after only 20 seconds. The provider logged attempt 1 with `retry_scheduled:true`, making the earliest legal second attempt 20.2 seconds. The fixture now allows forty seconds, while deterministic unit coverage continues to inject a first Windows sharing failure and require bounded retry semantics.
-- Keep the host boundary explicit: recent transient retention improves `read_job` recovery after MCP/host interruption but cannot revive a ChatGPT turn that the external host already terminated or prove final-response receipt. No tool arguments, results, paths, or identities are added to diagnostics or logs; hosted tool schema generation remains 11.
-- Supersede the accepted beta.140 candidate before GitHub prerelease publication because managed-job retention production code and shipped documentation changed. Beta.141 therefore requires a fresh frozen full verification, candidate, guarded activation, activated-package OAuth canary, live verification, acceptance, exact-head provider run, and merged-main exact-commit CI.
-
-## 3.0.0-beta.140 - 2026-08-26
-
-- Retire the expired beta.104 resource-transaction directory compatibility state machine after an independent maintenance review confirmed its documented removal condition is satisfied. Current `transaction.lock` ownership remains the complete-before-visible regular-file contract; the old directory reader, owner-publication staging recovery, quarantine/restore branch, and migration-only process-identity paths are removed. An obsolete `transaction.lock/owner.json` directory now fails closed without mutation so unsupported historical state remains inspectable instead of being destructively migrated by stale code.
-- Extract Worker role-visible tool selection and effective authority projection from the near-limit `BridgeRoom` composition root into `worker-tool-authority.ts`. Direct regressions bind owner/reviewer catalog filtering, cloned tool definitions, and daemon-tool intersection; the Worker root drops from 828 to 818 lines without changing OAuth, Durable Object, relay, or local authorization semantics.
-- Refresh current architecture/testing/upgrading documentation around those boundaries. The independent privacy pass continues to find no tracked credential-bearing files or real secret values in publication surfaces; current-tree and reachable-history privacy gates plus development/production dependency audits remain clean. Historical audit/changelog records are retained as history rather than rewritten.
-- Supersede the accepted beta.139 candidate because shipped local/Worker source and documentation changed after acceptance. Beta.140 therefore requires a fresh frozen full verification, candidate, activation, deployed OAuth canary, live verification, acceptance, and exact-head provider run before publication.
-
-## 3.0.0-beta.139 - 2026-08-26
-
-- Correct an independent documentation-contract drift that survived existing release tests: current `ARCHITECTURE.md`, `THREAT_MODEL.md`, and `TESTING.md` still described the retired GitHub TTY/confirmation ceremony even though governance, engineering, releasing, and the implemented publisher make GitHub source publication standing-authorized after exact evidence gates. npm registry publication remains the sole explicit current-task owner authorization boundary through `--owner-confirm`. Architecture regression coverage now treats those three normative guides as part of the same publication contract so the obsolete user-presence model cannot silently return.
-- Remove a duplicate managed-job terminal-state classifier from recent-activity diagnostics. Activity aggregation now consumes the canonical `isTerminalManagedJobStatus()` contract instead of maintaining a second negative list of active/staged/unreadable states, preventing future lifecycle additions from being miscounted as terminal merely because one diagnostic helper was not updated.
-- Move application-automation composition out of `runtime.mjs` into a dedicated runtime composition module. This is a behavior-preserving responsibility extraction that restores meaningful headroom to a core composition file that had reached 696/700 lines without changing application authorization, capability projection, background-input selection, cancellation, or process execution semantics.
-
-## 3.0.0-beta.138 - 2026-08-26
-
-- Supersede the accepted beta.137 candidate after its exact-head Windows provider run reached the new npm publication regression and proved the hard-timeout tree barrier was still incomplete. The resistant lifecycle descendant wrote its delayed marker after `runExecutable(..., hardTimeout:true)` had already returned, so the provider correctly rejected the claim that publication timeout settlement implied complete process-tree termination.
-- Separate **tree-termination request** from **tree-termination settlement** in the shared internal executable runner. On POSIX, isolated-process-group `SIGKILL` remains a synchronous kernel signal-dispatch boundary. On Windows, hard termination now uses a dedicated bounded barrier that launches `taskkill.exe /PID <leader> /T /F` and waits for the helper's terminal `close(0)` before tree settlement is accepted. A failed, nonzero, or non-settling helper cannot be silently reclassified as an ordinary successful timeout; publication reports unconfirmed termination distinctly.
-- Make `runExecutable` wait for both direct-child close and the hard tree barrier before returning a timeout result. Deterministic runtime coverage proves that an early direct-child `close` cannot release the caller while the tree barrier is still pending, and a Windows simulation proves the barrier remains pending until the forced `taskkill` helper completes. The existing real resistant-descendant publication regression remains unchanged, so hosted Windows must prove the original post-timeout side effect is impossible rather than passing through a longer sleep.
-- Remove the beta.137 acceptance record and advance package/runtime identity to **3.0.0-beta.138**. The new shared `src/local` process-tree module changes package bytes, so beta.138 requires a fresh full gate, candidate, activation, OAuth canary, live verification, acceptance, and exact-head provider run.
-
-## 3.0.0-beta.137 - 2026-08-26
-
-- Supersede the locally accepted beta.136 candidate after exact-head Windows CI independently validated the new npm publication regression and then failed later in `worker-types-generator:test`. The provider reached and passed `publish-npm:test`, proving the beta.136 process-tree/deadline repair itself was portable; it then failed in the older Wrangler lifecycle cleanup path with `wrangler types could not force cleanup`.
-- Fix the Windows cleanup-settlement race in `wrangler-command-lifecycle.mjs`. A `ChildProcess.kill()` return value now means only that a cleanup request was attempted; it is never treated as proof that the process has or has not reached terminal state. Graceful cleanup may escalate to a force request, but the wrapper waits for the child `close` event or a separate bounded post-force settlement deadline. A real zero exit retains precedence over raced cleanup requests, while a child that actually closes only after forced termination still fails closed.
-- Add a deterministic cross-platform regression for the exact provider semantics: the fixture crosses the completion grace, accepts the synthetic `SIGTERM`, returns `false` for the later synthetic `SIGKILL`, and then exits zero. The old implementation necessarily failed immediately on the `false` request result; beta.137 waits for observed settlement and succeeds. Architecture now forbids reintroducing `killed !== true` as process-settlement evidence.
-- Remove the beta.136 acceptance record and advance package/runtime identity to **3.0.0-beta.137**. Because `scripts/` ships in the npm package, the Windows provider repair changes package bytes and requires a fresh full gate, candidate, activation, OAuth canary, live verification, acceptance, and exact-head provider run.
-
-## 3.0.0-beta.136 - 2026-08-26
-
-- Fix the npm prerelease publication control plane exposed after beta.135 GitHub release. `prepublishOnly` legitimately ran the full verification plan for 681.4 seconds, but `publish-npm.mjs` applied one fixed ten-minute `spawnSync` deadline to every npm stage. The direct npm parent therefore returned `ETIMEDOUT` while lifecycle descendants continued the remaining verification, `version:check`, and `release:check` on the inherited terminal. The registry was independently checked after the incident and `machine-bridge-mcp@3.0.0-beta.135` remained absent, proving the upload stage never ran.
-- Run publication npm stages through the existing isolated process-tree execution boundary instead of `spawnSync`. Full prepublication verification now has a separate thirty-minute deadline while dry-run/upload retain ten-minute bounds; deadline expiry hard-terminates the complete npm lifecycle tree before returning failure. A real regression fixture launches a resistant descendant that would write after the parent timeout and proves it cannot continue after publication settlement.
-- Correct relay interruption evidence without inventing a network repair. The observed beta.135 episode was WSS close `1006` on a system VPN/TUN route with no daemon event-loop stall; the signed HTTPS fallback became verified-ready after roughly 1.35 seconds while WSS itself recovered after roughly 13 seconds. WebSocket warnings now name the affected WSS layer instead of claiming the whole relay is unavailable, and `https_fallback_last_takeover_ms` retains the bounded WSS-close-to-HTTPS-ready interval after WSS reclaims primary ownership. Same-instance call recovery, fallback takeover semantics, replay safety, and hosted tool schema generation **11** are unchanged.
-- Advance package/runtime identity to **3.0.0-beta.136** because the shipped publication script, relay diagnostics, and documentation changed after beta.135 acceptance and GitHub prerelease publication.
-
-## 3.0.0-beta.135 - 2026-08-26
-
-- Harden same-daemon managed-job runner recovery on Windows after PR #95 advanced beyond beta.134's fixed `file://` test-hook loading bug. The exact-head Windows run reached the later dependency-wait crash regression, observed the runner `exit` callback, then logged `permission_denied` from `reconcileStatus` and failed to autonomously relaunch the runner. This proves the remaining defect was transient Windows filesystem contention in the recovery path rather than a missed child-exit event or another ESM-loader failure.
-- Retry only bounded transient filesystem mutation errors (`EACCES`, `EBUSY`, `EPERM`, `ENOTEMPTY`) while clearing stale runner runtime/ownership artifacts, and clear those artifacts before persisting the next recovery-attempt state so a failed cleanup cannot leave a fresh half-committed status that suppresses immediate recovery. Runner-exit reconciliation also receives a bounded retry schedule for transient permission/conflict/timeout/resource-unavailable failures; integrity and other non-transient failures remain fail closed rather than being looped.
-- Add deterministic regression coverage for transient removal backoff and runner-exit reconciliation retry policy while preserving the existing real dependency-wait runner kill/relaunch integration test. Production authorization, resource admission, cleanup guarantees, managed-job execution ceilings, hosted read pacing, and tool schema generation **11** are unchanged. Advance package/runtime identity to **3.0.0-beta.135** because production recovery code changed after beta.134 acceptance.
-
-## 3.0.0-beta.134 - 2026-08-25
-
-- Correct the beta.131 managed-job test runner hook for Windows without changing production execution. PR #95 showed the test-only `node --import` argument was passed as a native absolute path; Node accepts that form on POSIX but the Windows ESM loader interprets a drive-letter path such as `D:\\...` as an unsupported `d:` URL scheme. The fixture now passes the hook as its canonical `file://` URL, preserving the exact-parent/exact-specifier interception boundary on every supported platform.
-- Keep beta.133 production continuity behavior unchanged: planned daemon drain, same-`job_id` read recovery, privacy-bounded Durable Object continuity evidence, managed-job retention/listing policy, resource admission, hosted read pacing, and the six-hour managed-job step ceiling are unchanged. Hosted tool schema generation remains **11**.
-- Advance package/runtime identity to **3.0.0-beta.134** because the candidate/test tree changed after beta.133 acceptance.
-
-## 3.0.0-beta.133 - 2026-08-25
-
-- Persist a privacy-bounded Worker continuity summary in Durable Object storage so post-incident diagnosis survives Worker isolate replacement. The owner/full `server_info` projection now retains only fixed-category counters/timestamps for planned drains, planned-drain affected-call count, socket disconnects with planned/unplanned classification and bounded close metadata, plus the latest request-abort and stream-cancel-control observations. It stores no account/client identity, call IDs, tool names, arguments, results, network endpoints, or close reasons.
-- This closes a diagnostic gap exposed by the beta.132 live restart canary itself: the in-flight hosted `read_job` correctly returned retryable `daemon_planned_drain` with `recovery.mode=read_same_job`, but a subsequent `server_info` landed on a fresh Worker isolate and the isolate-local continuity counters had reset to zero. The new durable summary is evidence for later causal classification; it still cannot observe or revive a ChatGPT host turn or prove final assistant-message receipt.
-- Keep beta.132 planned-drain execution semantics unchanged. Daemon process identities remain generation-distinct, generic ambiguous mutations remain fail closed, and a planned drain still only makes read-only `read_job` recoverable with the same `job_id`. Production managed-job/resource-admission limits, the 600-second durable-process ceiling, six-hour managed-job step ceiling, and hosted read pacing are unchanged.
-- Advance package/runtime identity to **3.0.0-beta.133** and hosted tool schema generation to **11** because `server_info` full diagnostics and its host-visible description now advertise durable continuity evidence.
-
-## 3.0.0-beta.132 - 2026-08-25
-
-- Convert planned local-daemon shutdown from an unclassified transport loss into an explicit drain handshake. Before a ready runtime closes its relay, it sends one bounded `daemon_draining` control message; the Worker settles calls still owned by that daemon with a structured `daemon_planned_drain` error and acknowledges the drain before shutdown proceeds. Generic calls remain fail-closed when execution may have started, while hosted `read_job` now carries read-only recovery metadata binding the original `job_id` and is retryable as the same read after reconnect. This does not make an already terminated ChatGPT host turn resumable and does not claim final-response receipt is observable.
-- Improve retained-job recovery visibility without expanding the 512-state cap. `list_jobs` still prioritizes unreadable/active/staged state, then durable terminal managed-job results, and only then transient one-step process history. Owner/local capacity diagnostics now distinguish `durable_terminal` from `transient_terminal`; delegated callers do not receive this global retained-state composition. Existing retention still reclaims transient process history before ordinary durable terminal history.
-- Preserve the beta.131 managed-job test-isolation work while keeping production resource security unchanged. Its private resource-lock fixture now tolerates only the test-side complete-before-visible hard-link publication window while acquiring the deliberate contention lock; the production transaction reader retains the fixed four-attempt multiple-link fail-closed policy.
-- Advance package/runtime identity to **3.0.0-beta.132** and hosted tool schema generation to **10** because hosted `read_job` recovery semantics and discovery guidance changed. The thirty-minute managed-job resource-admission ceiling, 600-second durable-process ceiling, six-hour managed-job step ceiling, and hosted read pacing remain unchanged.
-
-## 3.0.0-beta.131 - 2026-08-25
-
-- Isolate the managed-job integration suite's semantic child-process fixtures from unrelated hosted-runner pressure without weakening production resource admission. Beta.130 proved the deterministic light fixtures were fixed, then the merged `main` Windows run failed in `timeout terminates descendants`: that regression must execute a real Node script that creates a descendant process, so converting it to a light probe would destroy the behavior under test.
-- Thread the existing `launchRunner(..., { spawnProcess })` in-process test seam through `ManagedJobManager` normal launch and recovery paths. The option is a JavaScript function accepted only by direct in-process construction; it is not part of MCP input, persisted job plans, environment configuration, or the CLI. Production `LocalRuntime` does not provide it and `job-runner.mjs` still constructs the ordinary production `ResourceCoordinator` unchanged.
-- `managed-jobs:test` now uses that seam to start runner processes with a Node `--import` hook scoped to the exact `job-runner.mjs` parent URL and exact `./resource-admission.mjs` specifier. Only that runner import is redirected to a test fixture that subclasses the production coordinator and injects the established synthetic healthy-host sampler. Job child processes do not inherit the import hook, coordinator leases/locks/fairness still use the production implementation, and dedicated resource-admission tests continue to cover real pressure decisions independently.
-- Advance package/runtime identity to **3.0.0-beta.131**. Hosted schema generation remains **9**; production resource admission, the thirty-minute admission ceiling, 600-second durable-process ceiling, six-hour managed-job step ceiling, and hosted read pacing remain unchanged.
-
-## 3.0.0-beta.130 - 2026-08-25
-
-- Remove the last unrelated adaptive launch from the Windows dependency-retention fail-closed regression. Beta.129 correctly stopped injecting `NODE_V8_COVERAGE` into minimal-environment jobs, and PR CI then advanced to the next pressure-sensitive setup: `old protected dependency result` still used `node -e ""` even though the test only needs one successfully persisted upstream result before it mutates retention metadata. Under hosted Windows pressure that no-op was correctly classified as adaptive and remained in `resource_admission` until the fixture settlement window expired.
-- That setup now uses the exact current-runtime `node --version` light probe, matching the already-hardened dependency execution fixtures. An architecture contract prevents this specific retention setup from regaining adaptive work. Staged validation-only plans and fixtures whose scripts, failures, timing, process trees, resources, or cleanup behavior are themselves under test remain unchanged.
-- Advance package/runtime identity to **3.0.0-beta.130**. Hosted schema generation remains **9**; production resource admission, the thirty-minute admission ceiling, 600-second durable-process ceiling, six-hour managed-job step ceiling, and hosted read pacing remain unchanged.
-
-## 3.0.0-beta.129 - 2026-08-25
-
-- Fix the remaining Windows managed-job fixture pressure leak exposed only after beta.128 reached merged-main push CI. The dependency-failure regression uses a `minimalEnv:true` manager and an exact current-runtime `node --version` cleanup probe, but the suite-wide `createManagedJobTestManager()` wrapper still injected an empty `NODE_V8_COVERAGE` key into every step. Production correctly treats the presence of Node instrumentation keys as untrusted even when the value is empty, so that test-only injection forced the cleanup probe back into adaptive resource admission; on a pressured Windows runner it stayed in `cleaning/resource_admission` until the test settlement window expired.
-- Preserve coverage isolation only where it is actually needed. Full-environment test managers (`minimalEnv:false`) continue to receive the empty `NODE_V8_COVERAGE` override so their business children cannot write into the parent coverage stream. Minimal-environment managers no longer receive a synthetic instrumentation key because production `executionEnv` already excludes it. An architecture contract binds this distinction. Production light-command security, resource-admission policy, cleanup behavior, and all long-task execution ceilings remain unchanged.
-- Advance package/runtime identity to **3.0.0-beta.129**. Hosted schema generation remains **9**; the thirty-minute resource-admission ceiling, 600-second durable-process ceiling, six-hour managed-job step ceiling, and hosted read pacing remain unchanged.
-
-## 3.0.0-beta.128 - 2026-08-25
-
-- Harden the Wrangler lifecycle regression fixture against transient Windows filesystem locks after a fully settled child process. Beta.127 proved the earlier managed-job resource-admission issue was gone, then Windows CI failed much earlier in `worker-types-generator:test` with `EBUSY` while recursively removing its unique `machine-bridge-wrangler-lifecycle-*` temp root. The Wrangler helper resolves only from the child `close` event, after process exit and stdio closure; the remaining failure is the bounded Windows filesystem lock window seen immediately after releasing a process working directory.
-- Reuse the repository's established Node `fs.rm` cleanup policy for temporary roots: recursive forced removal now permits five native retries with a 50 ms retry delay. This applies only to test-fixture cleanup and only when Node reports a retryable filesystem removal error; it does not add a business-process sleep, change Wrangler completion/termination semantics, weaken resource admission, or change any production task execution ceiling.
-- Advance package/runtime identity to **3.0.0-beta.128**. Hosted schema generation remains **9**; the thirty-minute resource-admission ceiling, 600-second durable-process ceiling, six-hour managed-job step ceiling, and hosted read pacing remain unchanged.
-
-## 3.0.0-beta.127 - 2026-08-25
-
-- Fully isolate the managed-runner log-trimming fixture from shared coverage instrumentation as well as host pressure. Beta.126 Windows CI proved that changing its child argv to `node --version` was not sufficient: the suite-wide `isolateStepCoverage()` wrapper deliberately adds an empty `NODE_V8_COVERAGE` key to every managed-job step, while the production release-control classifier correctly treats the presence of Node instrumentation/preload environment keys as untrusted and therefore refuses the zero-resource light-command bypass. On a pressured hosted Windows runner that sent this unrelated log fixture back into normal resource admission for the test settlement window.
-- The fixture now uses a dedicated raw `ManagedJobManager`, independent job root, and `minimalEnv:true`, bypassing the suite's child-coverage wrapper only for this log-bounding probe. It explicitly asserts `full_env=false` and absence of `NODE_V8_COVERAGE` before launch, then still executes the exact current runtime `node --version`. Production environment hardening and fail-closed resource classification are unchanged; no unsafe environment is newly granted light admission.
-- Advance package/runtime identity to **3.0.0-beta.127**. Hosted schema generation remains **9**; the thirty-minute resource-admission ceiling, 600-second durable-process ceiling, six-hour managed-job step ceiling, and hosted read pacing remain unchanged.
-
-## 3.0.0-beta.126 - 2026-08-25
-
-- Make the same-daemon dependency-wait runner recovery regression prove its intended property without contaminating the observation. Beta.125 Windows CI showed that the final assertion still called `manager.read(upstream)` after the downstream had already failed, even though that read itself performs reconciliation. The test already proves autonomous relaunch from persisted state by observing `recovery_attempts=1` and a new runner PID without a managed-job read. It now completes the proof through the independently running downstream job's structured `dependency_failure` witness, requiring that downstream observed the recovered upstream as `status=failed` with `error_class=dependency_failed`; no external upstream read participates in that proof.
-- Beta.125 removed the previous eight-minute host-resource wait and reduced the Windows platform failure from 22m47s to 15m14s. macOS platform+install passed in 6m15s, Ubuntu full in 9m39s, and all CodeQL/governance/dependency/workflow/package gates were green. The remaining Windows failure was the test-only upstream read assertion above, not a production timeout or CI outer-envelope limit.
-- Advance package/runtime identity to **3.0.0-beta.126**. Hosted schema generation remains **9**; the thirty-minute resource-admission ceiling, 600-second durable-process ceiling, six-hour managed-job step ceiling, and hosted read pacing remain unchanged.
-
-## 3.0.0-beta.125 - 2026-08-25
-
-- Fix the remaining Windows `managed-jobs:test` host-pressure dependency exposed by beta.124 PR CI. The suite's bounded runner-log diagnostic fixture staged a no-op `node -e` child, manually promoted the draft to queued state, and launched a real runner only to verify log trimming. Since beta.123 correctly classifies arbitrary Node eval as adaptive, that otherwise unrelated diagnostic could spend the entire eight-minute test settlement window in production resource admission on a loaded Windows hosted runner. The fixture now uses the exact current-runtime `node --version` light probe, matching the deterministic dependency fixtures and testing log bounding rather than host scheduling. An architecture contract prevents this specific runner-diagnostic fixture from regaining adaptive business work.
-- Beta.124 remains valid evidence for the self-test isolation fix: macOS platform CI passed in 5m27s, proving the former macOS self-test hang was removed, while Ubuntu full, CodeQL, governance, dependency review, workflow policy, and package audit were all green. Windows failed only at the final `managed-jobs:test` fixture above after 22m47s; the new 30-minute platform CI envelope was not the failure source. Because beta.125 changes test/release inputs after beta.124 acceptance, it must earn fresh frozen verification and candidate acceptance before promotion.
-- Advance package/runtime identity to **3.0.0-beta.125**. Hosted schema generation remains **9**; the thirty-minute resource-admission ceiling, 600-second durable-process ceiling, six-hour managed-job step ceiling, and hosted read pacing remain unchanged.
-
-## 3.0.0-beta.124 - 2026-08-25
-
-- Make `local-self-test` resource/managed-job CLI fixtures deterministic on shared CI hosts instead of accidentally using real host pressure as a clock. Executing fixtures use the exact runtime `node --version` probe introduced in beta.122 and settlement uses one shared five-minute **test-harness** wall-clock budget with direct persisted-state reads plus one actual CLI read. A follow-up local run exposed a more serious isolation bug in the test itself: its uninstall-safety fixture could fall through to the real machine-level `stopAutostart`/launchd path when its synthetic managed-job state was not actually active, taking the currently serving beta.123 login daemon offline. The self-test now calls the exported managed-state uninstall preflight directly, never invokes the real uninstall command, and architecture contracts require the production uninstall path to run that preflight before any autostart mutation. Production resource admission remains capped at thirty minutes and managed-job steps remain capable of six-hour execution; no user-task or ChatGPT-turn duration was shortened.
-- Forward only `local-self-test` phase-start/phase-complete markers through the otherwise bounded/suppressed verification runner, so a future hosted hang identifies the active phase without enabling verbose test logs or increasing host-visible MCP call density.
-- Increase only the GitHub `platform-check` job envelope from 20 to 30 minutes. Beta.123 Windows CI completed all 123 platform checks in about 18.3 minutes and printed a successful global-install smoke result before GitHub cancelled the job at its old 20-minute shell deadline; the larger CI envelope preserves rather than shortens valid cross-platform verification.
-- Advance package/runtime identity to **3.0.0-beta.124**. Hosted schema generation remains **9** and all long-task delivery/read/step limits remain unchanged.
-
-## 3.0.0-beta.123 - 2026-08-25
-
-- Close a pre-commit resource-admission bypass found while independently reviewing the beta.122 diff. An absolute executable or exact runtime `node --version` invocation is no longer eligible for the generic light profile when its child environment contains Node startup injection/profiling/cache overrides, TLS/key-log overrides, `LD_PRELOAD`/`LD_AUDIT`/library-path overrides, or the corresponding Darwin dynamic-loader variables. This reuses the existing hardened release-control environment denylist rather than introducing a second security vocabulary. A caller that already has execution authority still retains that authority; the fix prevents injected work from being mis-accounted as a zero-resource probe.
-- Add regressions proving `NODE_OPTIONS=--require=...` keeps the exact runtime version command adaptive and `LD_PRELOAD` keeps a nominally trusted absolute executable adaptive. Clean exact runtime `--version`/`-v` remains light, while arbitrary Node eval/scripts and lookalike executable paths remain adaptive as introduced in beta.122.
-- Beta.122 was fully verified, locally activated, canaried, and accepted but had not been committed or pushed when this environment-injection gap was found. Its acceptance is therefore invalidated rather than promoted; beta.123 must earn fresh frozen verification and release evidence. Long-task execution limits, the thirty-minute resource-admission ceiling, the six-hour managed-job step ceiling, and hosted schema generation **9** remain unchanged.
-
-## 3.0.0-beta.122 - 2026-08-25
-
-- Remove host-resource-pressure nondeterminism from managed-job dependency integration coverage after beta.121 Windows CI spent the full eight-minute fixture wait on the first upstream job. The previous teardown `ENOTEMPTY` failure is gone, confirming beta.121 fixed that Windows filesystem race; the new failure was a separate fixture-design problem. Dependency success/failure and dependency-wait runner recovery now use persisted pending/terminal dependency fixtures plus real independent downstream runners, so those tests exercise dependency orchestration rather than accidentally waiting on the production thirty-minute resource-admission policy. Same-daemon dependency-wait runner relaunch remains covered, while exact active-child ownership/termination remains covered by its dedicated safety test.
-- Fix managed-job timeout diagnostics to inspect the manager's actual job root instead of the suite's unrelated default root. A future fixture timeout therefore retains bounded `status.json` and runner-log evidence instead of misleadingly reporting an empty diagnostic object.
-- Treat only the exact current Node runtime invoked solely with `--version` or `-v` as a light resource probe. Arbitrary Node eval/scripts and lookalike `node` paths remain adaptive/heavy, so this gives cross-platform dependency fixtures a deterministic no-side-effect child without creating a general resource-admission bypass.
-- Advance package/runtime identity to **3.0.0-beta.122**. Hosted tool schema generation remains **9**: long-task limits, the thirty-minute managed-job resource-admission ceiling, six-hour step ceiling, hosted read pacing, and MCP tool schemas are unchanged.
-
-## 3.0.0-beta.121 - 2026-08-25
-
-- Harden the managed-jobs integration-test teardown on Windows after PR CI exposed a terminal-runner filesystem race: the test had already observed terminal job state, but a runner could still be completing its final filesystem close while the suite recursively removed the temporary root, causing Windows `fs.rm` to fail with `ENOTEMPTY`. Keep product terminal semantics unchanged and use Node's documented bounded recursive-remove retry behavior only for the test root cleanup, so the suite waits for the OS deletion race to settle instead of weakening the CI gate or delaying managed-job terminal publication.
-- Advance package/runtime identity to **3.0.0-beta.121**. Hosted tool schema generation remains **9** because this patch changes only test teardown behavior and no MCP input/output contract or hosted description.
-
-## 3.0.0-beta.120 - 2026-08-24
-
-- Reopen the long-task interruption investigation after beta.119 still ended with a severe user-visible host interruption despite a healthy local daemon and successful Worker calls. The persisted content-free security audit makes the amplification measurable: in the 15 minutes ending at 2026-08-24T13:58:58Z, Machine Bridge recorded 152 daemon-reached relay tool calls with a 17-calls/minute peak, including 62 `read_job` calls and 54 one-step process-helper calls. Only three tool calls failed in that window and the Worker did not report execution timeouts. This is a lower-bound observation rather than a total ChatGPT event count because host-only schema discovery, control-plane activity, and final-message delivery never reach the daemon audit. It does not reveal ChatGPT's private turn-termination cause, but it materially strengthens the long-turn plus high host-visible event-density hypothesis over a local execution-timeout explanation.
-- A second severe interruption was reported while these beta.120 changes were still only an uncommitted checkout and the live Worker/login daemon remained beta.119/schema generation 8, so the recurrence does not constitute live evidence against the beta.120 mitigations. The immediate post-incident inventory was saturated at 512/512 retained managed-job states and its 50-record window was dominated by recent one-step helper churn; one older job remained pre-spawn in `resource_admission` for more than nine minutes. The daemon was still callable, resource pressure at the diagnostic instant was Green, the event-loop stall counter was zero, and no relay outage was active. Capacity saturation and the long waiter are therefore retained as amplifiers/diagnostic signals rather than asserted as the hidden ChatGPT termination trigger. Generic remote filesystem access to control-plane state is intentionally denied, so beta.120 obtains the audit/waiter evidence from the running runtime itself instead of guessing a profile path and risking a false-negative empty snapshot.
-- Remove the most common helper-event doubling without shortening work. Remote `exec_command`, `run_process`, and `run_local_command` still commit a durable one-step managed job first, but the original hosted tool call now keeps a two-second initial settlement window. Helpers that finish inside it return their terminal managed-job result in the same tool response with `follow_up_read_required=false`; helpers still active retain the same `job_id`/idempotent recovery envelope and continue through ordinary `read_job`. Child execution remains independently bounded up to 600 seconds, resource admission may still wait up to 30 minutes, and multi-step managed-job steps retain the six-hour ceiling.
-- Make interruption recovery inventory resilient to helper churn. The 50-record `list_jobs` response now prioritizes unreadable, active, and staged state ahead of terminal history, so an older long-running or pre-spawn-waiting job cannot disappear merely because more than 50 short helpers completed afterward. Owner/local inventory also exposes bounded 1/5/15/60-minute creation counts, transient-helper counts, terminal/failure counts, and peak creation rate without exposing internal retention labels per job.
-- Turn existing privacy-safe evidence into actionable interruption diagnostics. The 4096-event hash-chained security audit now publishes owner/local recent activity aggregates (call counts, process-helper/read/start-job counts, failure counts, peak calls/minute, and bounded top-tool frequencies) while still storing no tool arguments or results. Resource-admission snapshots now include up to four owner/local waiter summaries with age, resource class/family, bounded CPU/IO/memory request, protection state, and the current admission reason; waiter IDs, tokens, process identities, contention keys, paths, and command content remain hidden. `diagnose_runtime` also includes managed-job churn so one call can distinguish high host-visible event density from a task that is silently waiting pre-spawn.
-- The incident review found one real local stall amplifier: an interactive unbounded `pytest` request remained in resource admission for roughly eighteen minutes because `cpu_pressure_window` rejected its effective seven-core reservation while host CPU was already busy; generic machine pressure could still look green/yellow at another instant. This is a pre-spawn scheduling wait, not a job execution timeout and not a reason to shorten the overall task. The new waiter diagnostics make that distinction explicit.
-- Separate a later local suspension episode from the earlier user-visible host interruption instead of folding both into one vague "event-loop stall" diagnosis. macOS power history shows an idle-sleep assertion process disappearing at 00:32:43 +0800, the machine entering Idle Sleep five seconds later, and a subsequent 954-second sleep ending at 01:04:11; the runtime recorded a 947.954-second event-loop pause ending at 01:04:10.810. That near-exact duration/end-time match proves this particular pause was operating-system suspension rather than synchronous JavaScript blockage. It occurred more than two hours after the severe interruption whose immediate snapshot had zero event-loop stalls and no active relay outage, so it is a separate continuity risk rather than a retroactive explanation for that host failure. Beta.120 now projects a bounded owner-only macOS sleep history, correlates a recorded runtime stall with same-duration sleep evidence, and records idle-sleep-guard activity/grace/release timestamps plus coarse release reason. The existing thirty-minute post-activity grace is intentionally not lengthened merely to mask an unobservable host lifecycle failure.
-- Advance package/runtime identity to **3.0.0-beta.120** and the hosted tool contract to **schema generation 9** because hosted descriptions and process-result semantics changed. The npm-only authorization model from beta.118 remains unchanged: activation, Worker/daemon replacement, tags, GitHub push/release, and supported Action-control refresh may proceed automatically; npm publication still requires explicit owner authorization.
-
-## 3.0.0-beta.119 - 2026-08-24
-
-- Repair two external-CI defects found after beta.118 local acceptance. CodeQL correctly rejected a managed-job recovery test that interpolated a filesystem path into `node -e` source; the test now keeps executable source static and passes paths as ordinary argv values instead of constructing code from data.
-- Remove a Windows-sensitive wall-clock assertion from dependency-failure propagation coverage. The test continues to require the actual invariants that prevent the original blind-artifact-wait failure mode: the dependent remains in pre-execution `dependency_wait`, private inputs are not materialized early, upstream failure produces structured `dependency_failed`, the downstream business child never starts, and declared cleanup still runs. Host/runner scheduling speed is no longer mistaken for dependency semantics.
-- Beta.118 remains an exact locally accepted/activated candidate but is not releaseable because its PR failed required CodeQL and Windows platform gates. Beta.119 supersedes it and must earn fresh frozen verification, activation, live canary, acceptance, and required GitHub checks. The npm-only conversational authorization model introduced in beta.118 is unchanged, and hosted tool schema generation remains 8.
-
-## 3.0.0-beta.118 - 2026-08-24
-
-- Make npm package publication the sole conversational authorization boundary in the release workflow. Candidate activation, same-name Worker replacement, login-daemon/service replacement, guarded GitHub push/PR/merge, version tags, GitHub Releases/Prereleases, registry installation/activation, and supported ChatGPT Action control refresh/review may proceed automatically when the current task requires them and the effective policy plus repository integrity gates permit them. This removes unnecessary stop-and-ask handoffs without weakening clean-tree, exact-commit, acceptance, CI, digest, publication-lock, identity, idempotency, or unknown-settlement safeguards.
-- Move the explicit anti-accident confirmation to the operation that still requires owner authorization. `npm run prerelease:publish -- --owner-confirm` and `npm run stable:publish -- --owner-confirm` now fail before publication work when the flag is absent, while GitHub release/backfill no longer require `--owner-confirm` or a TTY ceremony. GitHub publication remains serialized by the common-Git-dir publication lock and continues to stage the exact accepted candidate, reconcile remote state, and verify the uploaded asset digest.
-- Synchronize repository automation, governance, release, upgrade, testing, client, and operations guidance with the new model. Historical audit/changelog entries retain the authorization rules that applied to those older releases; current guidance supersedes them. The hosted tool schema remains generation 8 because this change alters release-operation ownership and packaged guidance rather than MCP tool input/output semantics.
-
-## 3.0.0-beta.117 - 2026-08-24
-
-- Complete a fresh independent review after beta.116 activation instead of treating the previous green suite or release acceptance as proof. The pass rechecked managed-job architecture, dependency state transitions, crash windows, retention, cleanup/resource lifetimes, logging/privacy boundaries, tests, generated contracts, and current documentation while preserving the six-hour single-step ceiling and same-response hosted continuation contract.
-- Delay private registered-resource and temporary-file materialization until a dependent job actually clears `dependency_wait`. A dependency failure therefore does not create long-lived private execution copies while the job is only waiting; declared `finally_steps` still receive their inputs just in time when cleanup must run. Recovery keeps the existing error-attribution rule: a failed main-stage resource reconstruction is not retried and double-counted as an independent cleanup failure.
-- Harden dependency and retention integrity. Dependency polling now recognizes a valid durable terminal `result.json` during the result-first/status-second crash window without mutating upstream state, terminal job projections clear stale dependency-pending counts, public dependency counters/error labels are bounded, and active/staged dependency retention verifies the canonical plan hash before using `depends_on` to authorize destructive pruning. Missing, corrupted, or hash-mismatched protection state fails closed.
-- Close the same-daemon dead-runner gap without adding a polling loop. A daemon now observes exits only for detached runners it actually launched and schedules one reconciliation after the existing crash-settlement grace period; daemon restart still uses the established startup scan. Running business children also gain an owner-only job-scoped `active-child.json` identity claim containing PID/start-time/process-group evidence. Recovery verifies that exact process identity and terminates the old detached process tree before releasing the recovery lock or running `finally_steps`; unverifiable ownership is never signalled or deleted, and exhausted recovery cannot declare a job terminal while a verified old business child remains alive. Real integration coverage kills a running upstream runner without reading that upstream job and proves the same daemon terminates the orphaned child, recovers the upstream as non-success, and propagates `dependency_failed` downstream without user-driven polling.
-- Remove parallel managed-job identity/plan-integrity implementations. Managed-job IDs now come from the canonical directory contract, while hashing/integrity verification is centralized and shared by admission inspection, runner launch, recovery relaunch, and retention. Architecture checks pin those boundaries so a later refactor cannot silently reintroduce divergent security rules.
-- Tighten publication privacy and documentation freshness. The package no longer publishes an external project codename, local task label, or unrelated function names from the incident that motivated beta.116; the local privacy denylist carries the private vocabulary instead. Current client guidance now describes the 512-state durable store with a 50-record `list_jobs` window and generation-8 hosted orchestration semantics instead of carrying forward beta.114/beta.115 limits as current behavior.
-- Reduce host-visible event amplification after a long independent review completed locally but the external chat surface still failed to deliver a normal terminal response. The review had generated dozens of one-step durable helper jobs, and `read_job` could additionally wake on every short `current_step` transition. Generation 8 now treats host-visible event density as a continuity resource: coherent non-interactive command sequences should use a repository umbrella command or a multi-step `start_job`; hosted `read_job` ignores `current_step`-only wakeups and coalesces other nonterminal progress for at least 30 seconds by default while terminal settlement still returns on the next bounded poll. The 40-second default long-poll, five-minute opt-in maximum, same-response follow-up, and six-hour managed-step ceiling remain intact.
-- Advance package/runtime identity to **3.0.0-beta.117** and the hosted tool schema to **generation 8**. These fixes do not shorten autonomous task duration and do not authorize live activation; beta.116 remains the active accepted runtime until a separately owner-authorized beta.117 candidate is activated and verified.
-
-## 3.0.0-beta.116 - 2026-08-24
-
-- Fix a reproduced long-workflow failure mode without shortening autonomous task lifetime. An upstream implementation step failed immediately, while already-submitted downstream jobs kept polling for qualification/artifact files that could never appear and consumed 15–22 minutes each before failing. `start_job`/`stage_job` now accept up to 16 durable `depends_on` job IDs. An accepted dependent job stays pre-execution `queued` with `current_phase=dependency_wait`, does not spawn its main child, wakes hosted `read_job` when dependency progress changes, releases only after all upstream jobs succeed, and terminates with `result.error_class=dependency_failed` when an upstream later fails. Staged or already-failed dependencies are rejected before acceptance. This removes impossible artifact waits rather than imposing a shorter conversation or step lifetime.
-- Preserve dependency waiting across local runner failure. Dependency identity is bound at acceptance to the durable job ID, plan hash, and creation generation. If a dependency-wait runner dies before dependent business execution begins, manager reconciliation relaunches the same pre-execution job rather than converting it into cleanup-only recovery. Integration coverage force-kills the waiting runner, waits through the existing dead-runner observation window, and proves the original downstream job resumes and succeeds without resubmission or user input.
-- Harden the runner-claim publication race exposed by the full local self-test. The parent intentionally upgrades `runner.pid` through atomic provisional/committed generations; a reader that opened the old inode while the path moved to the committed generation could previously receive `MBM_IDENTITY_CHANGED` and misclassify a healthy runner as an invalid claim. Only this publication-coupled reader now retries that exact identity-change condition with the same fixed four-attempt, 1 ms budget used for transient publication races, then re-runs the full no-follow, single-link, path-identity and claim-shape checks. Ordinary and destructive secure-file reads remain fail-closed.
-- Expand managed-job recovery depth from 50 to 512 retained states while keeping `list_jobs` bounded to 50 returned records per response. Internal status inventory can still account for the complete retained set. One-step process carriers remain lower-priority `transient_process` history, and active/staged `depends_on` plans pin referenced upstream terminal records so helper churn or capacity pruning cannot remove recovery evidence that a live workflow still depends on. If dependency protection cannot be read safely, pruning fails closed rather than guessing that no dependency exists. Seven-day terminal and 24-hour staged-plan retention remain unchanged.
-- Keep the existing long-task pacing contract instead of reintroducing a forced handoff. Relay `read_job` still defaults to a 40-second server-side long-poll, same-response follow-up remains supported while calls continue to be accepted, individual managed-job steps may still run for up to 21,600 seconds (six hours), and no new aggregate few-minute task cutoff is introduced. Hosted status now states both `host_turn_deadline_observable=false` and `host_terminal_receipt_observable=false`, and exposes `same_response_followup_supported` rather than pretending Machine Bridge can observe or manufacture the host's final ChatGPT turn.
-- Advance the hosted tool contract to **schema generation 7** and package/runtime identity to **3.0.0-beta.116**. The public `start_job`/`stage_job` schema documents `depends_on`, `read_job` documents `dependency_wait` progress/failure semantics, and `list_jobs` distinguishes its 50-record response window from the 512-state durable store. Candidate activation remains a separately owner-authorized release boundary.
-
-## 3.0.0-beta.115 - 2026-08-22
-
-- Remove ChatGPT-internal `api_tool` / tool-loader cache inspection from release and upgrade acceptance entirely. Release evidence now stops at the governed Workspace Action control snapshot when that product layer applies, plus live MCP/runtime discovery, subscription behavior where the protocol contract changed, and harmless changed-generation invocation behavior. Historical loader-split observations remain audit history only; release automation must not query, compare, or grade those host-internal cache views.
-- Correct the ChatGPT schema-freshness evidence model after live beta.115 review reproduced a loader split that invalidates the earlier “complete unfiltered catalog is authoritative” assumption. In the same connected session, an unfiltered `api_tool.list_resources` load retained generation 5 while a query-targeted resource load returned generation 6; live `server_info` reported beta.115/schema generation 6, Workspace Action control already showed the refreshed 54-action generation-6 snapshot, and a valid-but-unretained `read_job` reached generation-6 runtime behavior and returned typed `not_found`. Release/upgrade/client/testing guidance now treats both filtered and unfiltered `api_tool` resource bundles as diagnostic model/tool-loader caches rather than Workspace publication authority. Product-level freshness is established from the governed Workspace Action control snapshot when applicable plus live runtime/discovery and changed invocation behavior. A stale loader bundle alone must never trigger connector recreation or app republication.
-- Remove the fixed >100-minute live managed-job soak from candidate acceptance. Long-running continuity remains release-blocking where affected, but acceptance now uses bounded evidence matched to the failure mode: hosted default long-poll survival, a second same-response `read_job`, durable same-`job_id` recovery across any exercised host/tool or daemon/relay boundary, representative helper churn, cancellation/cleanup, and replay-safety checks. A long soak may still be run as diagnostics, but elapsed duration alone is no longer a mandatory release gate.
-- Supersede the activated beta.114 candidate after a fresh independent post-activation review deliberately reopened its interruption assumptions, architecture, failure branches, logging, tests, documentation, package inventory, and privacy surfaces. The review did **not** find another runtime cancellation defect: one-shot execution and process sessions retain a strict same-isolate final `AbortSignal` check immediately before synchronous `spawn`, while cancellation-aware managed-job main steps retain their final cross-process marker read immediately before `spawn` as the documented launch decision point. The distinction is now explicit: `cancel_job` acknowledges a cancellation request and post-decision cancellation terminates owned work; it does not claim a stronger wall-clock guarantee that a concurrently racing OS spawn syscall can never win after the runner's final marker read. Implementing that different guarantee would require a serialized cross-process launch/cancel protocol rather than another asynchronous check.
-- Turn the review conclusions into maintenance guards instead of prose-only confidence. `src/local/job-runner.mjs` now has an architecture line budget near its current size so the most stateful managed-job module cannot continue expanding without an explicit extraction decision. The existing managed-job boundary assertion still pins the final cancellation-marker check directly to `spawn`, while integration tests cover cancellation/termination/cleanup and deterministic one-shot/session admission-time cancellation requires zero spawn plus exact lease release. Managed-job documentation now separates the launch decision point, post-dispatch cancellation, durable terminal authority, and idempotency/replay responsibilities.
-- Make the cancellation safety valve diagnosable without weakening it or leaking request identity. If bounded pre-open MCP cancellation tombstones are exhausted, the Worker still fails closed rather than evicting evidence and potentially dispatching an orphaned side effect, but the first overflow in each fail-closed window now increments the existing low-cardinality `mcp_request_cancellation_fail_closed` observability counter. Repeated overflow during the same bounded window does not spam the counter, callback failure cannot change cancellation behavior, and no stream ID, account identifier, tool arguments, path, or response content is recorded.
-- Tighten publication hygiene without discarding useful audit history. The beta.114 audit note that referred to beta.113 as a present-tense active runtime is rewritten as review-time history and linked to the later post-activation evidence. Tracked release/privacy/audit text no longer publishes a machine-specific ignored application-state directory name; it documents the reusable rule that ignored local databases remain archive-sensitive. The npm package intentionally continues shipping the engineering/security audit record, so its size remains an explicit transparency tradeoff rather than being reduced by silently removing historical security evidence.
-- Advance package/runtime identity to **3.0.0-beta.115** while keeping the hosted tool contract at **schema generation 6**. Because the follow-up changes packaged documentation after beta.114 activation, the beta.114 tarball, OAuth canary, list-change subscription proof, and interrupted long-soak evidence remain diagnostic evidence only for those exact beta.114 bytes. Beta.115 requires a new frozen-tree verification receipt and candidate/install-only preparation; live activation and renewed acceptance remain separately owner-authorized release stages.
-
-## 3.0.0-beta.114 - 2026-08-22
-
-- Supersede beta.113 after its live >100-minute continuity attempt exposed an aggregate host-boundary/recovery defect that per-call 40-second pacing did not solve. The activated beta.113 Worker/daemon, packaged OAuth canary, complete unfiltered 54-tool generation-5 catalog, validator probes, `toolsListChanged` proof, and short unchanged-status fixture all passed. The long soak then produced roughly 125 consecutive structured 40-second `read_job` checkpoints before the host imposed a real response/tool boundary. A later explicit 60-second active read also succeeded, proving that per-call lifetime and aggregate assistant-response lifetime are independent constraints. Release guidance no longer treats `duration / wait interval` arithmetic as long-duration continuity evidence: an actual >100-minute job must either reach terminal state in one response or remain recoverable by the same `job_id` after a real host boundary.
-- Protect explicit managed-job recovery evidence from ordinary helper-command churn without increasing retained private state. `exec_command`, `run_process`, and `run_local_command` one-step carriers now persist an internal `transient_process` retention class. Under the existing 50-state capacity bound, safely removable transient terminal history is reclaimed before explicit managed-job terminal history. The seven-day terminal and 24-hour staged expiry bounds remain unchanged, the marker is not part of public job projection, and it contains no argv/path/output/resource data. A valid job ID whose retained directory is gone now returns fixed non-retryable `not_found` instead of generic `execution_failed`; that absence is explicitly not proof that the underlying operation never executed and must not be converted into blind side-effect replay.
-- Fail closed per call when relay result evidence is lost without turning one old incident into a daemon-lifetime outage. A completed result retained for Worker acknowledgement can expire after the bounded settlement lifetime or be discarded when reconnect grace expires. The affected call ID now enters a bounded private replay-safety tombstone set, so later `resume_calls` cannot misclassify that already-executed call as daemon-proven missing, while unrelated resumed IDs can still recover normally. Tombstones retire once the Worker no longer resumes that ID; only exhaustion of the bounded tombstone set escalates to global fail-closed redelivery disablement. `diagnose_runtime.runtime.relay_result_recovery` exposes aggregate `automatic_redelivery_safe`, `unsafe_call_tombstones`, and `global_redelivery_disabled` state without call IDs, tool names, arguments, or result content.
-- Make hosted managed-job acceptance recoverable before side effects begin. The generation-6 Worker schema requires a caller-held `idempotency_key` for remote `start_job`, the actual invocation validator rejects a missing key before daemon dispatch, and timeout/disconnect errors carry the same idempotent-replay recovery descriptor already used by remote one-step process tools. The recovery descriptor identifies the key's source as the original request instead of echoing the key value into another host-visible payload. Retrying the same `start_job` arguments with the same key can therefore recover an ambiguous acceptance response instead of creating a second job. Local/stdio `start_job` keeps the underlying optional-key API; the stricter requirement is a hosted transport safety contract.
-- Close the pre-dispatch stream-cancellation ordering race. A private stream cancel that reaches the Durable Object before the matching direct request is registered is now retained as a bounded short-lived cancellation tombstone; a direct request whose public `AbortSignal` was already aborted is likewise cancelled when ownership opens. The dispatch gate rechecks that signal before pending-call registration and daemon send. Tombstone overflow fails closed for the same bounded lifetime instead of evicting cancellation evidence and later starting an orphaned side effect, then automatically recovers when the retention window expires.
-- Close the analogous local process-launch handoff window after resource admission. One-shot execution, interactive process sessions, and cancellation-aware managed-job main steps now perform their final synchronous cancellation check after launch arguments/resource ownership are ready and immediately before `spawn`, with no asynchronous boundary between the decision and dispatch. Cancellation visible at that decision point releases the admitted lease and remains definite non-execution; once dispatch wins, the existing process/session termination path keeps `side_effects_started=true`/pending-or-unknown settlement semantics instead of claiming safe replay. Deterministic one-shot/session regressions inject cancellation from resource admission and require zero spawns plus exact lease release; managed-job boundary coverage pins the durable-marker check directly to spawn and the full managed-job cancellation/cleanup integration remains green.
-- Bound public MCP stream cancellation when its private Durable Object control request never settles. Normal request/reader cancellation still waits for the private cancel settlement before exposing public closure, but that internal control fetch now has its own two-second abortable deadline. A regression uses a never-resolving private fetch and proves the public SSE response cannot hang indefinitely. No request arguments, result bytes, paths, or credentials are added to logs or persistent state.
-- Advance the hosted orchestration contract to **tool schema generation 6** and package/runtime identity to **3.0.0-beta.114**. Host-visible guidance now distinguishes per-call pacing from aggregate host-response lifetime, requires preserving the same durable identifier across a real host/tool boundary, and tells clients that `read_job` `not_found` is missing recovery evidence rather than a retry proof. Beta.113 live evidence remains diagnostic only; beta.114 requires fresh frozen verification, candidate preparation, explicit owner-authorized activation, packaged OAuth canary, generation-6 complete-catalog/validator proof, and renewed long-duration recovery acceptance before release acceptance.
-
-## 3.0.0-beta.113 - 2026-08-22
-
-- Correct the host-schema acceptance model after live beta.112 evidence proved that ChatGPT's filtered tool/resource search can retain a query-keyed stale schema snapshot independently of the complete Machine Bridge catalog. Repeated unfiltered discovery returned all 54 Machine Bridge tools at schema generation 5 with the 40,000 ms hosted `read_job` default, while an immediate filtered `read_job` search could still return a generation-4 bundle claiming the former 300,000 ms omitted default; the two result families alternated without replacing one another. Source tracing excludes a Machine Bridge query-dependent catalog path, and live state excluded old jobs, daemon sockets, and Worker isolates as the owner of the stale definition.
-- Bind freshness to evidence the repository can actually interpret. Release, upgrade, testing, client, operations, audit, and project-standard guidance now treats one complete unfiltered host catalog snapshot as the schema-freshness authority and keeps filtered tool/resource search as routing/index evidence only. A stale filtered result that conflicts with the complete catalog is recorded as host query/search-index cache staleness and cannot by itself classify the live runtime as mixed-generation or block acceptance. Harmless previous-generation invocation-validator/behavior probes remain mandatory, because displayed schema freshness still does not prove the host invocation layer or daemon validation path accepted the new boundary.
-- Keep the public hosted tool schema at **generation 5**. A control fixture loaded the stale generation-4 filtered definition, then an omitted-parameter `read_job` still executed with the live generation-5 40,000 ms default and returned generation-5 continuation metadata before a second same-response read reached terminal state. Machine Bridge cannot purge or determine the scope of the host's secondary filtered-search cache, so beta.113 removes the false release blocker rather than adding an unsupported cache-clear mechanism. The package identity advances because the corrected release/client/audit contracts are packaged bytes even though the public tool schema itself is unchanged.
-
-## 3.0.0-beta.112 - 2026-08-21
-
-- Supersede the activated beta.111 candidate after the required cross-generation invocation probe exposed a second schema split inside Machine Bridge. Beta.111 itself activated cleanly as Worker/login daemon, its activated-package OAuth canary passed authorization-code exchange, authenticated MCP, refresh rotation, refreshed MCP, and cleanup, and the 55-second live continuity fixture proved the beta.110 projection repair: the first omitted-parameter `read_job` remained inside one MCP call for 40 seconds and retained `host_turn_handoff_recommended=false`, `status_polling_mode=bounded_followup`, `tool_schema_generation=5`, and the other hosted metadata before a second same-response read reached terminal state. Host discovery also exposed generation-5 long-running tool definitions and a non-executing `stage_job(timeout_seconds=3601)` crossed the former one-hour boundary. However, a terminal `read_job(wait_ms=40001)` reached Machine Bridge and was rejected by the daemon with the local static schema maximum of 40,000 ms. The Worker correctly overlays hosted discovery to a 300,000 ms maximum, and the runtime wait implementation already permits that relay maximum, but `src/local/tool-executor.mjs` still validated every invocation against the static local catalog before dispatch. Beta.112 adds the missing relay-only validation extension, symmetric with the existing hosted durable-process timeout extension: only a relay `read_job` whose sole static-schema issue is `/wait_ms` `maximum` may use 40,001..300,000; malformed, negative, non-integer, or >300,000 values remain invalid, and local/stdio still rejects values above 40,000. Direct regression coverage binds all of those cases.
-- Keep the public hosted tool schema at **generation 5** and advance package/runtime identity to **beta.112**. The public schema did not change; the implementation now makes the already-advertised generation-5 hosted `read_job` maximum executable through the daemon defense-in-depth validator. Beta.111 activation/canary/continuity evidence remains useful diagnosis but cannot authorize beta.112 acceptance because packaged runtime and documentation bytes changed after live activation.
-
-## 3.0.0-beta.111 - 2026-08-21
-
-- Supersede the activated beta.110 candidate after its required live continuity fixture exposed a result-projection defect. The exact beta.110 Worker/daemon converged on tool schema generation 5 and its activated-package OAuth canary passed authorization-code exchange, authenticated MCP, refresh rotation, refreshed MCP, and cleanup. A 55-second durable fixture then proved the first parameter-omitting `read_job` correctly stayed inside one MCP call for 40 seconds, but the unchanged timeout checkpoint lost `host_turn_handoff_recommended=false`, `status_polling_mode=bounded_followup`, `tool_schema_generation=5`, and related hosted metadata because each lightweight `readProgress()` probe replaced the richer `readHosted()` state. The long-poll now merges unchanged lightweight progress into the full state instead of replacing it, with a regression that gives hosted metadata only to full reads so the original live failure is reproduced by the old implementation. At that point the same ChatGPT conversation still rejected the harmless generation-5 `read_job(wait_ms=40001)` probe at 40,000 ms while live `server_info` reported beta.110/generation 5, so the evidence was conservatively treated as an external approved-action snapshot blocker. Beta.111 live retesting later refined that diagnosis: generation-5 host definitions and the 3,601-second staged-job boundary were accepted, while the 40,001 ms call reached Machine Bridge and failed in the daemon's static local catalog validator. The beta.112 entry records that corrected causal classification. Because the Machine Bridge projection repair changes packaged runtime bytes after live beta.110 activation, beta.110 activation/canary evidence remains diagnostic only and cannot authorize beta.111 acceptance.
-
-- Independent 2026-08-21 follow-up reviews removed additional correctness/evidence hazards before release. Resource transaction reads no longer expand the fixed four-attempt/1 ms multiple-hard-link publication retry into transaction-deadline waiting; hosted managed-job liveness now reuses the secure runner-claim reader instead of bypassing path-identity/hard-link checks; `server_info` reports a server-opened list-change subscription rather than claiming client observation and explicitly says client receipt is unobservable; and an explicit five-minute `read_job` opt-in retains a 310-second daemon / 315-second settlement envelope so its non-current-runner fallback can cover both bounded process-generation probes. Live host probing then disproved the five-minute **default**: the model-facing schema advertised 300,000 ms, the same host's invocation validator still rejected values above 40,000 ms, an omitted wait entered the server-side five-minute default and the host terminated the tool call with `TimeoutError`, while an explicit 40,000 ms read completed normally. The hosted default is therefore restored to the empirically survivable 40 seconds while the 300-second explicit maximum remains available to clients that can actually carry it. Recovery now also refuses a `read_job` dispatch/redelivery when less than the dedicated ten-second reconciliation headroom remains instead of silently rewriting it to an impossible immediate read. Release acceptance includes harmless cross-generation argument probes rather than relying on discovery text alone. Current-tree/history privacy scanning and both npm audit modes remained clean; ignored application-local databases are documented as archive-sensitive local state without publishing machine-specific application directory names, and any pre-review beta.109 candidate artifact is historical evidence only because these source changes invalidate it for promotion.
-- Close two additional interruption/authority gaps found while tracing the hosted call lifecycle. The managed-job long-poll deadline now begins before the initial full reconciliation and unchanged timeout return no longer appends another heavyweight reconciliation after the advertised wait, so a nominal 40-second hosted read cannot structurally become `initial reconcile + 40s + final reconcile`. Worker daemon dispatch also removes the redundant asynchronous `PendingAdmissionGate`: an already-ready daemon is selected synchronously and capacity check -> pending registration -> daemon send has no `await`, while daemon-down requests remain in the existing authority-bound ready-waiter registry. This removes an otherwise unowned queued state in which account/client/family revocation could occur after request authorization but before the request became visible to either waiter cancellation or pending-call cancellation.
-- Tighten daemon handover and relay-result recovery under real transport interruptions. Ready-daemon waiters are released only after WebSocket/HTTPS handover reaches its final no-`await` point; while waiters exist, a newly visible ready socket remains handover-in-progress so fresh calls cannot leapfrog capacity or escape authority revocation. Waiter timeout no longer grabs a merely visible socket without formal readiness release. On the daemon, completed results awaiting Worker acknowledgement now consume the same 16-total / 14-ordinary / 2-reserved-control recovery ownership budget as active relay calls; ordinary overflow is rejected before execution with `side_effects_started=false`, the retained-result store has a separate 16-entry hard ceiling plus a monotonic 315-second acknowledgement lifetime, and diagnostics expose only aggregate recovery counts. This prevents lost acknowledgements from turning a network episode into unbounded memory/private-result retention while keeping diagnosis capacity available.
-- Keep the hosted tool schema at **generation 5** and advance the package/runtime identity through **beta.111**. The activated-but-unpublished beta.109 runtime used generation 4 for the five-minute default and initial freshness repair; beta.110 was the first generation-5 candidate carrying the host-safe 40-second default and reconnect/subscription repairs, but its live unchanged-timeout projection defect requires new packaged bytes. Reusing either `3.0.0-beta.109` or `3.0.0-beta.110` would let activation convergence checks (`daemon.version` / `worker.version`) confuse earlier runtime bytes with the repaired candidate. Candidate/host acceptance must therefore converge on beta.111 generation 5 before these interruption fixes are treated as delivered.
-- Bound `toolsListChanged` subscription ownership even when the Workers HTTP runtime does not surface client disconnect. Real Worker integration showed that aborting the public client closes its local response body without reliably aborting/cancelling the Durable Object stream—even after a public heartbeat interval—so relying only on request/stream cancellation can leave a ghost subscription consuming one of the 8-per-account / 32-global freshness slots. Current tool definitions are immutable within one Worker deployment and every listen receives an immediate level-trigger edge, so the stream now has a 10-second server lease in addition to explicit cancellation/authority revocation. `server_info.tool_delivery` advertises the lease; integration proves active capacity returns by that bound while server-opened history remains diagnostic only.
-- Supersede beta.108 after live host evidence showed that the long-task correction was incomplete. Beta.108 removed the high-density immediate-status loop, but it still advertised `tools.listChanged=false`; the same ChatGPT connector subsequently exposed a mixed-generation catalog in which some tools carried generation 3 while other long-running tools still carried beta.104/beta.106 guidance about one-read handoff or a guessed host response/execution budget. Zero discovery TTL is not enough when the server simultaneously tells the client that the tool list never changes. Publication of beta.108 was therefore stopped before tag or GitHub Release.
-- Implement the current MCP 2026-07-28 tool-list freshness contract instead of relying on eventual cache expiry. Current remote discovery advertises `tools.listChanged=true`; a client that opens `subscriptions/listen` with `toolsListChanged=true` receives a correlated `notifications/subscriptions/acknowledged`, an immediate level-trigger `notifications/tools/list_changed`, and a request-scoped SSE subscription bounded by explicit cancellation/authority revocation or the advertised 10-second server lease so it can re-fetch `tools/list`. The initialization-era 2025 compatibility surface continues to advertise `listChanged=false` because that protocol family uses different notification semantics. Subscription streaming lives in its own Worker module rather than expanding ordinary tool-response streaming responsibility. One Durable Object permits at most 32 simultaneously active subscriptions and one authenticated account at most 8; over-capacity requests fail before stream allocation, and abort/cancel/lease expiry returns the slot exactly once. This prevents both unbounded stream accumulation and one delegated account monopolizing the freshness channel for every other account. `server_info.tool_delivery` additionally exposes only the current account's active-subscription count, lease, and whether the server successfully opened a freshness subscription for that account during the current Durable Object instance; opened-stream history is bounded to the most recent 64 accounts. These are deliberately server-side facts only: `tools_list_change_subscription_client_receipt_observable=false` records that Machine Bridge cannot prove the external client read either SSE frame or refreshed its catalog. The fields do not leak another account's activity and are diagnostics, not an override for a host product's separate approval/cache policy.
-- Correct the ChatGPT rollout premise after live beta.109 activation falsified the earlier universal-subscription assumption. The activated Worker/daemon immediately reported generation 4, the five-minute `read_job` contract, and the six-hour managed-job step ceiling, while the same ChatGPT host continued exposing its previously approved generation-3 action definitions and `server_info` correctly remained `tools_list_change_subscription_opened_for_account=false`. Current ChatGPT workspace-app behavior freezes approved tool/input definitions rather than automatically replacing them when an MCP server changes. Enterprise/Edu owners/admins refresh and review changed actions through Workspace Settings -> Apps -> Action control -> Refresh; a published Business custom app must instead be recreated and republished. A server-opened subscription is useful evidence that a client attempted the live freshness path, but it cannot prove frame receipt or catalog refresh and is not a universal ChatGPT freshness gate. Whole-catalog live host generation convergence remains release-blocking after the plan-appropriate ChatGPT action-snapshot update.
-- Bound long-task interaction density without exceeding the hosted client's demonstrated per-call lifetime. Relay-origin `read_job` now defaults to a 40-second server-side wait and may explicitly request up to five minutes. A 100-minute unchanged job therefore needs at most 150 default hosted reads—far below the earlier rapid-loop incident class—while clients with verified longer request lifetimes may opt into fewer calls. The public SSE proxy emits a five-second heartbeat while the tool promise is pending. Internal lightweight status probes run every five seconds and full runner/recovery reconciliation at thirty-second intervals inside the same wait deadline. The deadline starts before the initial full read, and an unchanged timeout does not perform another heavy reconcile after the deadline; this prevents nominal wait duration from hiding extra reconciliation latency at both ends. The default call receives a 50-second daemon / 55-second settlement envelope; the explicit five-minute maximum receives 310/315 seconds. Pre-dispatch daemon recovery is deducted from those absolute envelopes and the requested wait is shortened accordingly. If fewer than ten seconds remain, the Worker fails retryably before dispatch/redelivery rather than pretending a recovery-sensitive read can safely execute as `wait_ms=0`. Ordinary remote tools retain the existing 50-second relay ceiling, and local/stdio reads remain immediate by default with their bounded local maximum.
-- Remove the one-hour single-step ceiling that still contradicted the 100+ minute continuity target. `stage_job`/`start_job` main and finally steps retain their ten-minute default but may now explicitly request up to 21,600 seconds (six hours); the managed runner starts that execution timer only after cooperative resource admission. Remote one-step process tools remain capped at 600 seconds and continue to route legitimately longer continuous commands to `start_job`. Tests bind the local plan validator and both local/Worker schemas to the same six-hour ceiling, accept a 6,100-second staged step without executing it, and reject 21,601 seconds.
-- Correct a false macOS host-pressure model that could block work even after the machine was idle. `iostat -Id` reports transfers and throughput activity, not SSD saturation, so the former 5,000-IOPS / 220-MB/s hard-red thresholds could produce `disk_iops_critical` / `host_pressure_red` from a short healthy NVMe burst. Fresh raw I/O throughput now contributes only Yellow concurrency pressure; Red requires independent critical evidence or a severe load backlog corroborated by current CPU/I/O evidence. Cached I/O hints expire after the same five-second freshness window instead of carrying one transient peak for thirty seconds. Live diagnostics during the reported incident class showed a Green 8-core host with roughly two busy cores, 41% free memory, no leases/waiters, and a direct one-second `iostat` sample of only 75 transfers / 0.62 MB, confirming that an already-idle machine must not remain blocked by the old peak model.
-- Remove two smaller interruption/privacy hazards found by the independent follow-up review. Hosted `read_job` full reconciliation no longer performs a synchronous process-start `ps` probe every thirty seconds for a healthy runner: relay reads first verify runner ownership through the async process-identity path and enter the legacy synchronous recovery reconciliation only when the runner is non-current or ambiguous. Browser request dispatch also no longer exposes a raw lower-level `transport.send()` exception on read-only operations; the public failure is the fixed `browser extension send failed` message, while mutating operations retain their existing non-replayable unknown-outcome projection.
-- The predecessor beta.109 activation established generation-4 live-host evidence but was never published to npm. Beta.110 invalidates that acceptance because its version identity, generation-5 tool contract, 40-second default continuation, handover ordering, relay-result ownership bounds, and subscription lease all differ. Beta.110 requires fresh frozen verification, candidate preparation, owner activation, activated-package OAuth canary, protocol-level subscription/lease verification, the plan-appropriate ChatGPT action-snapshot refresh or republication when ChatGPT is the hosted client, whole-catalog generation-5 verification, invocation-validator probes, and long-duration continuation proof before publication resumes.
-
-## 3.0.0-beta.108 - 2026-08-20
-
-- Correct the remaining autonomous-long-task orchestration defect after owner evidence disproved the earlier fixed-wall-clock explanation. The same hosted environment had repeatedly supported Machine Bridge work exceeding 100 minutes before the recent regressions, while beta.104's retained audit already demonstrated the relevant amplification class: 497 settled Machine Bridge calls in 25 minutes, including 91 immediate `read_job` calls. Beta.106 correctly removed the forced later-user-turn handoff, but it restored same-response `read_job` follow-up without moving durable-job waiting into the server, so an unchanged active job could again be followed through high-density host tool calls. The exact ChatGPT host quota/termination algorithm is not observable here and is not claimed; the supported causal conclusion is that Machine Bridge unnecessarily amplified host interactions and therefore could exhaust an external hosted-turn resource much sooner than the underlying long task required.
-- Move waiting back inside Machine Bridge instead of consuming one hosted tool interaction per checkpoint. `read_job` now has a bounded `wait_ms` contract; local/stdio reads remain immediate by default, while relay-origin reads with omitted `wait_ms` default to a **40-second server-side long-poll**, return early on meaningful status/phase progress or terminal state, and accept `wait_ms=0` only as an intentional immediate checkpoint. The Worker gives that long-poll a 45-second daemon execution budget plus the existing settlement envelope, while its 5-second SSE heartbeat keeps the response stream active. At that default interval, a 100-minute unchanged durable job requires at most 150 hosted `read_job` calls instead of a rapid checkpoint loop. One-second internal probes read only the secure status record; full runner/recovery reconciliation is bounded to ten-second intervals plus the authoritative return path, so reducing host-call density does not create a synchronous process-identity loop inside the daemon. The same composition defect existed in interactive process-session pacing: beta.104 converted a repeated would-block read inside the fifteen-second cooldown into an immediate running result. That made sense only while beta.104 forced a user-turn handoff; under beta.106 same-turn autonomy it became another rapid-call path. The actual output/exit blocking wait remains capped at one second, but a repeated would-block request now stays inside the same MCP call until output/exit or the cooldown boundary, and the Worker reserves a 20-second execution / 25-second settlement envelope for that server-side pacing. For `wait_for_exit=true`, ordinary stdout/stderr changes do not release the cooldown stage early; the same call continues until process exit or the cooldown deadline before entering the bounded one-second exit wait. `server_info.tool_delivery` reports the managed-job read wait bounds, `host_turn_deadline_observable=false`, and `managed_jobs_detached_from_mcp_response=true`; these fields describe Machine Bridge's observable boundary without inventing a fixed host wall-clock limit.
-- Make hosted schema freshness explicit instead of assuming a daemon/Worker replacement refreshes the client's cached tool contract. Both `server/discover` and `tools/list` now advertise `ttlMs=0`; hosted tool descriptions carry **tool schema generation 3**; `server_info.tool_delivery` reports the generation, live server version, discovery/tool-list TTLs, and `host_visible_schema_known_to_server=false`. The request-scoped server deliberately continues to advertise `tools.listChanged=false` because it has no persistent notification registry and does not claim to emit a notification it cannot deliver. Activation/acceptance must therefore compare the active client's host-visible generation with the live server generation whenever hosted tool semantics change.
-- Remove the remaining resource-coordinator event-loop blocking path uncovered by the independent second review. Production host/Darwin/process-parent resource sampling is async-only; lease/waiter pruning now uses a cached lock-external async process-start snapshot and performs only `kill(0)` plus in-memory generation comparison while the transaction lock is held. Missing snapshot evidence fails closed by retaining a live owner; a proven PID-generation mismatch remains reclaimable and takes precedence over a numerically live isolated process group. Lease/waiter staging recovery uses the same snapshot evidence, while the beta.104 legacy transaction-owner migration reader now performs its process-generation check asynchronously before destructive recovery. The current complete-before-visible `transaction.lock` owner-state writer also uses the shared bounded transient-multiple-link retry on reads: the short `link(staging,target)` publication window may expose `nlink=2` to another process, but the reader never parses or reclaims that state until it settles; a persistent multiply-linked lock still fails closed after the bounded retry. Tests cover live-owner fail-closed behavior, PID reuse, process-group reuse, in-flight snapshot coalescing, stale staging, transient publication races, persistent hard-link rejection, and the absence of blocking resource-probe transport.
-- These runtime, Worker, protocol, tests, and documentation changes supersede beta.107 source evidence and beta.106 live acceptance. Beta.108 requires a fresh frozen full verification, audits/signatures/SBOM, Worker/package dry runs, exact release candidate, persistent activation, host-visible schema-generation check where the client supports refresh, and live same-assistant-response multi-read proof before it can be accepted or published.
-
-## 3.0.0-beta.107 - 2026-08-20
-
-- Promote the beta.106 autonomous follow-up correction into a repository hard invariant. `AGENTS.md` and `docs/PROJECT_STANDARDS.md` now state that user interaction must never become the scheduler tick for a durably owned long-running operation: when the current task needs terminal state and host budget remains, a known managed job or process session must be followed autonomously through bounded same-response reads rather than waiting for repeated `continue`/`继续` messages.
-- Define the acceptable anti-amplification boundary explicitly: one-second remote blocking process reads, the fifteen-second would-block cooldown, durable ownership, idempotency, authoritative job/session read surfaces, and bounded host execution budgets remain mandatory; a one-read-per-assistant-response or later-user-turn policy is prohibited. Recurrence is classified as a release-blocking continuity defect.
-- Add an architecture/documentation contract that requires the autonomous-continuity language in both the repository automation contract and project standards and rejects the beta.104 forced-handoff wording. Candidate acceptance for future hosted follow-up changes must include a live same-assistant-response multi-read proof, not documentation or unit tests alone. These packaged documentation/test changes supersede beta.106 source-candidate evidence; beta.106 may remain the currently activated runtime until a separately authorized beta.107 activation.
-
-## 3.0.0-beta.106 - 2026-08-20
-
-- Restore bounded autonomous hosted follow-up after beta.104 over-corrected a real same-turn polling amplifier. Active relay-origin `read_job` results now advertise `status_polling_mode=bounded_followup` with `host_turn_handoff_recommended=false`, and live `read_process` results advertise `paced_followup`; terminal reads report `terminal`. Hosted tool descriptions and shared server guidance no longer impose a one-checkpoint-per-assistant-response boundary, so an agent may follow a known job/session to terminal state while the host response/execution budget remains.
-- Keep the actual anti-busy-loop controls that fixed the August 19 amplification: remote blocking `read_process.wait_ms` remains capped at one second, repeated would-block process reads remain subject to the fixed fifteen-second cooldown, stale cached schemas still fail before daemon dispatch, and `list_jobs`/`server_info`/`diagnose_runtime` remain inventory/diagnostic surfaces rather than polling substitutes. This separates pacing and bounded host budgets from forced user-turn handoff.
-- Add regressions across managed-job projection, process-session projection, Worker tool discovery, stale-schema compatibility, hosted integration, and architecture/documentation contracts so future continuity fixes cannot silently reintroduce the forced handoff. These packaged runtime/Worker/documentation changes invalidate beta.105 candidate evidence and require a fresh full verification, candidate, owner activation, and live verification before acceptance or publication.
-
-## 3.0.0-beta.105 - 2026-08-20
-
-- Retire the resource coordinator's legacy directory-lock writer now that beta.104 is the immediately preceding supported prerelease. Current `transaction.lock` claims are published as complete-before-visible owner-state regular files through the shared exclusive-file primitive, so the active writer no longer creates a visible `transaction.lock/` directory before `owner.json` exists and no longer needs the directory-quarantine restore exception on ordinary release. Ownership remains bound to token plus process generation and release/reclamation still revalidates the exact published file before unlink.
-- Keep one bounded rolling-upgrade reader for beta.104 directory claims. A beta.105 process still recognizes live/stale `transaction.lock/owner.json` generations, including incomplete owner publication and the historical staging recovery rules, while beta.104 already recognizes the owner-state file shape written by beta.105. The pathname therefore remains one cross-version exclusion point in both directions during the beta.104 -> beta.105 handoff. The legacy directory path is now migration-only rather than the current writer and can be removed once beta.104 is no longer an immediately preceding/live supported runtime.
-- Update resource-admission and managed-job recovery regressions for the new current wire shape while retaining adversarial coverage for live legacy owners, late owner publication, dead/live staging, replacement-before-restore, and fail-closed unknown directory contents. Synchronize package, Worker, and browser-extension prerelease identity to beta.105. These packaged changes invalidate beta.104 release evidence for beta.105; live activation, publication, registry installation, and acceptance still require their separate explicit authorization/evidence gates.
-
-## 3.0.0-beta.104 - 2026-08-19
-
-- Supersede beta.103 after owner use again reproduced two host-visible continuity failures: a conversation could remain with no assistant response while Machine Bridge activity continued, and the client could separately report “message send timed out.” The current incident does not match beta.103's idle-sleep defect: the launchd daemon remained live with one run, the macOS idle-sleep assertion was active, and the contemporaneous daemon warning log contained no relay outage. The retained security-audit window instead shows 497 settled tool calls in 25 minutes, including 68 `read_process` calls and 91 `read_job` calls; many process reads consumed the complete five-second remote wait, while repeated managed-job status reads kept foreground reasoning attached to work that was already durable. This proves the no-response interval was amplified by same-turn polling composition rather than by one hung MCP call.
-- Bound that polling amplifier at discovery, rolling-upgrade, and runtime layers. Remote `read_process.wait_ms` is now capped at one second, and the daemon independently enforces the same cap for relay-origin reads. A running process session records the completion of a remote blocking wait and converts another would-block read inside a fixed fifteen-second cooldown into an immediate status read. Every relay-origin result is explicitly a `status_polling_mode=checkpoint`; the blocking-only fields are named `blocking_poll_throttled` and `next_blocking_poll_after_ms`, and `host_turn_handoff_recommended=true` for any still-running session. Remote `start_process`/`read_process` guidance reserves sessions for interactive stdin or incremental output and limits a hosted assistant response to one live-session checkpoint regardless of whether that checkpoint returned output. The maximum-only stale-schema compatibility response follows the same rule instead of telling an already-open client to “use short polling,” so a cached pre-beta.104 5-second schema cannot reintroduce the old loop through its recovery message. Local stdio/CLI process-session waits remain unchanged.
-- Make durable-job status explicitly yield the hosted turn. Remote `start_job`, durable one-step process tools, `read_job`, and the shared server guidance now describe acceptance/status reads as checkpoints rather than a wait loop: after at most one active-job status read in an assistant response, callers should return the `job_id`/status/current phase and stop polling until a later user turn or explicit request. Relay-origin `read_job` results reinforce that contract with `status_polling_mode=checkpoint` and `host_turn_handoff_recommended=true` while the job remains active; relay-origin `list_jobs` is also an inventory checkpoint and recommends handoff when its already-authorized returned set contains active work, closing the listing-as-polling bypass. Local reads/listings do not gain hosted-only metadata.
-- Re-audit the recurrent “message send timed out” symptom without inventing an SSE fix. Machine Bridge cannot observe a client message submission that fails before an MCP request reaches the Worker. Source tracing also disproves an initial five-second tool-stream silence: the Durable Object's `jsonRpcResponseStream()` synchronously enqueues `: connected` before the tool Promise settles, and the outer proxy begins pumping that already-open stream immediately. An attempted extra outer first-byte heartbeat was therefore removed rather than retained as an unproven fix. The server-side repair in beta.104 is the demonstrated hosted-turn polling/handoff defect above; a host-side send timeout that occurs before MCP dispatch still requires host/client evidence.
-- Tighten the independent beta.104 review beyond the original incident. Process-session read orchestration is extracted from the near-limit lifecycle manager into `process-session-read.mjs`, remote blocking-poll policy remains in `process-session-remote-poll.mjs`, and after the async wait returns the manager re-checks cancellation before hosted projection is finalized so a Promise-boundary cancel is not lost and final `running` state, handoff, and cooldown cannot disagree across an exit race. Hosted managed-job handoff policy lives in `managed-job-hosted-status.mjs`, and directory scanning/authority-visible list projection lives in `managed-job-listing.mjs` rather than bloating the persistence/lifecycle manager. Wrangler type generation now passes a workspace-relative output path and rejects targets outside its working directory so generated comments do not embed the local username/workspace path; stale ignored `.wrangler` type artifacts carrying older path comments are removed, and regenerated files remain outside the package surface. A live WSS→HTTPS fallback episode also exposed a diagnostic bug: pending calls wait only until the smaller of reconnect grace and their original absolute deadline, but the old error always said “reconnect grace expired.” Beta.104 now reports when the original call deadline is the actual limiter without widening or pausing that deadline. A later full-verification burst exposed a separate diagnostic-only resource-coordinator issue: a five-second snapshot that lost a healthy, changing transaction-lock race was surfaced as generic `execution_failed`. Beta.104 now reports transaction/staging contention as retryable `unavailable` with `reason=coordinator_busy` and `snapshot_available=false`; admission limits, fairness, lock ownership, and resource-pressure decisions are unchanged. Independent wording review also removed the generic configurable-foreground advice to “use process sessions or managed jobs for longer work” from both the shared tool catalog and the Worker projection: longer browser/application workflows are now described as independently terminal foreground calls, while durable process/job routing is reserved for process-based work and `start_process` remains interactive-I/O only. The generated 54-tool reference is rebuilt from that corrected source and the architecture gate rejects the obsolete advice in either catalog or reference output. Fast verification also exposed a pre-existing clock inconsistency in device-session construction: `createDeviceSessionIdentity(..., now)` generated a certificate from the explicit clock but final validation silently used real wall time. Beta.104 now threads the same `now` through finalization (including the secure-root provider), so historical/synthetic-clock authentication tests remain deterministic without changing production default time semantics.
-- Continue the WSS root-cause audit rather than leaving transport instability as unexplained. The old transport watchdog both measured the ten-second Pong deadline from the previous inbound frame and treated `ws.ping()` returning as proof that the control frame had been sent. Because `ws` can queue Ping behind data compression/socket backpressure, either behavior could make local `terminate()` produce `relay_transport_timeout`/1006 without granting an actually transmitted probe its full response window. Beta.104 now models queued Ping dispatch separately: only the sender write callback starts the ten-second Pong deadline; protocol Pong or explicit application `pong` observed while that callback is pending can satisfy only that exact dispatch token if the callback later completes inside its bound; unrelated inbound is receive-side evidence only and cannot excuse a stuck daemon-to-Worker send path; local send-queue no-progress has a separate thirty-second bound and distinct `relay_transport_send_timeout`; bounded dispatch delay/timeout age and `bufferedAmount` expose only numeric backlog evidence. The HTTPS fallback also previously authorized takeover only by daemon `instance_id`; an already-dispatched stale takeover could arrive after a newer same-instance WSS recovered and retire the new socket. Worker welcome now carries its per-socket `connection_id`, same-version clients require it, and fallback takeover is signed/bound to that exact disconnected generation; stale targets stay standby. A third deterministic continuity defect existed at the credential boundary: the root-signed daemon session intentionally expires after 24 hours, but the daemon reused the same session forever, so the next WSS/HTTPS reconnect after expiry could retry permanently with unusable credentials. Expiry now has stable `device_session_expired`/`relay_device_session_expired` classification; runtime cleanup precedes nonzero exit, allowing existing launchd/systemd/Windows supervision to mint a fresh session on restart without extending the 24-hour security boundary (manual daemons require restart; Secure Enclave mode retains user-presence semantics). Relay diagnostics retain current and last-failed DNS/TCP/TLS/upgrade milestones, strict privacy-safe transport reasons, authenticated/ready context, and HTTPS last-error evidence after recovery. A later live beta.103 outage was `relay_transport_error`/`network_error` for about 274 seconds across 16 attempts; HTTPS fallback and WSS recovered within roughly 0.4 seconds of one another, the local event loop had no stall, and the OS route was VPN/TUN. That strongly supports a shared system-network episode, but beta.103 discarded the exact failed-stage/fallback errno evidence, so the historical event is not attributed more narrowly to a specific DNS/TCP/TLS/VPN/Cloudflare component.
-- Follow the live WSS evidence one layer further instead of accepting the remaining watchdog as harmless. August 19 beta.103 logs contain repeated ready-channel `relay_transport_timeout` episodes after roughly 12–15 seconds of inbound silence, while later successful WSS connection attempts themselves took about 13.8 and 14.4 seconds and one network-error episode required 16 retries over roughly 4.5 minutes. Cloudflare handles protocol Ping/Pong below the Durable Object message handler, and local event-loop diagnostics did not show a matching stall, so a missed protocol Pong is evidence of an impaired persistent transport path, not proof that Worker JavaScript failed to run. The external trigger still cannot be assigned honestly to one VPN/TUN implementation, edge, ISP, DNS/TCP/TLS layer, or upstream device, but the Machine Bridge amplification is deterministic: one ten-second Pong miss immediately hard-terminated WSS, and the old fifteen-second connect ceiling sat almost on top of observed successful upgrades. Beta.104 now treats one missed dispatched Pong as `relay.transport.suspect`, sends one ready-only JSON heartbeat during a separate fifteen-second confirmation window, and prewarms signed HTTPS in standby without takeover. A later protocol Pong or explicit JSON application `pong` records recovery and keeps WSS; ordinary inbound tool/control traffic cannot prove the outbound direction and does not clear suspicion. Only a second-stage miss closes it. Send completions are fenced to the exact WSS generation so a late callback from a superseded socket cannot poison the replacement confirmation/error state. A real disconnect upgrades the prewarm to exact-generation takeover and aborts any obsolete in-flight standby request first; successful standby prewarm runs at five-second cadence, while request/session/protocol failures use bounded one/two/four/five-second backoff instead of retrying near the 750 ms hard floor. WSS connect attempts receive a thirty-second outer budget while fallback still starts independently. Application liveness is separately gated on verified readiness so probing sockets never receive a heartbeat type the Worker probing state forbids. HTTPS status now distinguishes `last_success_at` from true `last_ready_at`, and relay diagnostics expose bounded confirmation/dispatch-recovery timing plus `https_fallback_warming` so a future incident can distinguish avoided false positives from confirmed two-stage black holes.
-- Add red/green regressions for remote blocking-poll cooldown/handoff metadata, relay-origin `read_job`/`list_jobs` handoff metadata, the one-second hosted poll schema and timeout budget, stale-schema anti-loop guidance, reconnect-deadline cause classification, relative Wrangler type-output paths, generation-bound WSS/HTTPS takeover, queued-versus-dispatched Ping deadlines, local send-timeout classification even under unrelated inbound traffic, protocol/application-Pong-only bidirectional proof, stale prior-generation send-callback isolation, HTTPS standby/failure backoff and takeover-timer preemption, privacy-safe transport reasons, HTTPS post-recovery last-error retention, 24-hour device-session expiry restart behavior, and shared hosted instructions that reject same-response waiting through job/process/diagnostic status surfaces. These packaged runtime/Worker/documentation changes invalidate beta.103 release evidence; beta.104 requires fresh frozen verification and a new explicit owner authorization before any persistent activation or release acceptance.
-
-## 3.0.0-beta.103 - 2026-08-18
-
-- Supersede beta.102 after owner use still reproduced a severe whole-control-plane interruption. Live beta.102 evidence separates this event from the signed HTTPS fallback: the final `PreventUserIdleSystemSleep` assertion ended, macOS entered ordinary `Idle Sleep` about five seconds later for roughly 632 seconds, and the daemon reported an aligned event-loop pause of roughly 626 seconds while launchd retained one continuously running service process. A suspended host cannot execute either WSS or HTTPS recovery. The confirmed product defect is therefore the daemon-side post-activity power lease: beta.102's five-minute grace was shorter than a normal multi-turn ChatGPT reasoning/wait interval and could release immediately before the operating system chose Idle Sleep.
-- Extend the authorized remote-activity guard to a fixed **thirty-minute rolling inactivity lease**. Policy/account/operation authorization and argument validation still precede acquisition; concurrent relay handlers still share one daemon-bound `/usr/bin/caffeinate -i -w <daemon-pid>` child; long remote process sessions and account-backed managed-job runners retain their existing execution-lifetime ownership. After the final daemon-side activity settles, release is scheduled thirty minutes later. Any new authorized remote activity cancels the pending release and starts a fresh full thirty-minute window after the new activity settles. Relay/application heartbeats do not renew the lease, so an otherwise idle login daemon does not keep the machine awake indefinitely. Explicit sleep and lid-close behavior remain outside the guarantee.
-- Add a red/green runtime regression for the thirty-minute default and actual release-timer wiring, update architecture contracts to reject a return to the five-minute policy, and synchronize README/architecture/operations/testing/logging guidance. These packaged changes invalidate beta.102 candidate/acceptance evidence for beta.103 release purposes. Beta.102 source/npm publication remains stopped; beta.103 requires fresh frozen verification, exact candidate/install-only preparation, new explicit owner authorization before live activation, activated-package OAuth canary, observed live verification, and new acceptance before review/publication can continue.
-
-## 3.0.0-beta.102 - 2026-08-18
-
-- Supersede beta.101 after a fresh live interruption disproved the assumption that faster WebSocket half-open detection was sufficient recovery. The activated beta.101 launchd daemon remained the same PID with `runs=1` and no exit or matching Sleep/Wake event, yet the daemon-to-Worker relay disappeared at `2026-08-18T04:00:07.944Z` and required about 323.8 seconds plus 13 reconnect attempts before recovery; the final retained classification was `relay_connect_timeout`, with 9,830 ms of inbound silence before the ready socket closed. During the incident Worker-local HTTP/MCP remained responsive while no authenticated/ready/candidate daemon socket existed. The host's default route was carried by `utun5`, and same-window system logs showed multi-second TLS/read stalls in other applications even while Network.framework considered the route satisfied, but the available evidence cannot identify a particular VPN/TUN/provider, Wi-Fi component, Cloudflare edge, ISP, or upstream device as the physical trigger.
-- Remove the WebSocket-only recovery single point. WebSocket remains the preferred daemon transport with its five-second native Ping, ten-second inbound-silence timeout, independent 25/75-second application heartbeat, and background reconnect. If verified WSS readiness is absent, the same root-certified ephemeral P-256 device identity can establish a bounded signed `POST /daemon/http` fallback that reuses the same daemon instance, pending-call registry, account/tool authority, cancellation rules, `RelayCallRecovery`, and same-instance `resume_calls` ownership proof. Each HTTP request signature binds the fixed route, Worker origin, server/version, nonce, issue time, and exact body SHA-256; the replay window is 30 seconds with bounded nonce storage. After an established WSS disappears, the daemon may explicitly request same-instance takeover so the signed fallback can retire a Worker-side zombie WSS that has not observed the close; stale/new-session preconditions are checked before any incumbent is retired, so a malformed signed request cannot knock down a healthy channel. This is transport redundancy only: it does not restore `Mcp-Session-Id`, recovery GET, `Last-Event-ID`, a second MCP state model, alternate account authority, or durable public tool-result replay.
-- Make fallback delivery explicitly at-most-once at the business side-effect boundary. Both directions use contiguous in-memory transport sequences; unacknowledged envelopes retain the same sequence across an HTTP response loss, duplicates are discarded before business handling, sequence gaps fail closed, queue item/count/byte limits are fixed, and a daemon `tool_call` is transport-acknowledged only after successful synchronous ownership handoff to the existing local handler. Old HTTP responses cannot commit a transport sequence after that handler resets/replaces the session. Control messages remain strictly ordered. HTTPS handover has candidate, probing, and verified-ready states. The daemon first reconciles `resume_calls`, then processes Worker `ready_ack`, commits local readiness, emits sequenced `https_ready`, and only afterward emits `resume_calls_ack`; a non-empty `missing_ids` list therefore proves both replacement readiness and that the same daemon has neither active-call nor retained-result ownership for those IDs. For that proof only, the Worker may transparently retransmit the exact same call ID, arguments, authority, and a reduced timeout while at least one second remains inside the original execution deadline. If redelivery cannot be accepted or the budget is too small, the call retains beta.101's retryable `unavailable`/`side_effects_started=false` fallback. Active calls, retained terminal results, different-daemon calls, and any ambiguous mutation are never automatically replayed. Real Wrangler regressions exercise WSS → HTTPS takeover with an in-flight call, invalid takeover fail-closed behavior, lost/replayed HTTP terminal transport, safe same-ID proven-non-delivery redelivery, exactly one MCP settlement, and verified WSS reclaim.
-- Repair recovery timing rather than only shortening detection. Relay elapsed time, heartbeat silence, outage duration, ready duration, connection-attempt duration, and reconnect deadlines now use monotonic `performance.now()` while persisted/operator timestamps remain wall clock; forward/backward wall-clock jumps therefore cannot manufacture or suppress a timeout. Direct WSS attempts record only coarse DNS/TCP/TLS/HTTP-Upgrade/Open stage, duration, and bounded HTTP status diagnostics without addresses, headers, arguments, or credentials. A connection attempt that already consumed most of its 15-second connection budget no longer pays another full exponential idle delay. New calls may wait up to 15 seconds for verified daemon recovery—long enough to cover two bounded seven-second HTTPS fallback exchanges and the measured multi-second degraded TLS path—but that measured recovery interval is still deducted from the original tool execution budget rather than extending the hosted foreground envelope.
-- Bound fallback load and failure state. HTTPS requests have a seven-second deadline, 12-second liveness window, one-second ordinary poll cadence, and a hard 750 ms minimum start interval, keeping the fallback below 80 requests/minute and leaving headroom under the existing 120/minute daemon route limiter. Request/response bodies and retained queues are independently bounded; HTTP(S) proxy/NO_PROXY selection reuses the existing network-proxy policy. Query-only status code never silently closes a channel that owns pending calls: expiration, protocol failure, replacement, and WSS handback all flow through the same pending detach/reconnect-grace lifecycle first.
-- Close two additional interruption amplifiers found during the all-path review. Chromium MV3 extension keepalive now negotiates a broker Pong watchdog: new brokers echo a bounded ping sequence, the extension closes/reconnects after ten seconds without the matching Pong, and old brokers remain compatible without the negotiated watchdog. Daemon-lifetime in-memory process-session retention/eviction now ages sessions with a monotonic clock while preserving wall-clock `started_at`/`closed_at` metadata, so NTP or manual clock changes cannot prematurely destroy `read_process` recovery state.
-- Preserve privacy-bounded outage evidence while no daemon channel is ready. `DaemonRegistry` retains one in-memory `server_info.daemon.previous_connection` observation for the last verified channel with only transport, connected/last-seen/disconnected timestamps, and already-sanitized relay diagnostics. It omits policy, tool membership, account/client identity, daemon instance/connection identity, call IDs, arguments, and results, and is never consulted for authorization, routing, reconnect ownership, or persistence. A live all-channel outage therefore no longer erases the immediately preceding transport evidence into only `relay_transport:null` before the daemon returns.
-- The independent pass re-audited Computer Use dispatch/effect settlement, idle-sleep guards, managed-job claim/finally/restart behavior, resource-admission cancellation/leases, launchd service handoff/rollback, browser mutation ambiguity, and logging/privacy boundaries. No second concrete interruption defect was found in those subsystems. New operational events remain aggregate-only, and the HTTPS transport store is in-memory transport state rather than a content log. These packaged bytes invalidate all beta.101 candidate/activation/acceptance evidence; beta.102 requires fresh frozen fast/full verification, candidate/install-only preparation, new explicit owner authorization before activation, activated-package OAuth canary, live WSS/HTTPS/browser verification, and only then release acceptance.
-
-## 3.0.0-beta.101 - 2026-08-18
-
-- Supersede beta.100 after its exact candidate had been activated and its activated-package canary had passed, but before browser-extension acceptance completed. The follow-up interruption investigation changed packaged runtime/tool/documentation bytes, so beta.100 remains operational evidence for its exact bytes only and cannot be reused as beta.101 release evidence.
-- Repair a compound Computer Use deadline mismatch that could surface as apparently interrupted GUI work even when the lower macOS Accessibility operation itself was healthy. Hosted configurable foreground work normally defaulted to 20 seconds while local `computer_act` defaulted to 30 seconds, and preflight, mutation dispatch, verification, and post-observation could each receive nearly the original timeout. `computer_act` now owns one monotonic end-to-end action deadline and gives every stage only the remaining budget; verification capture is capped by both the verification window and the overall action deadline. `computer_observe` applies the same rule across application screenshot, Accessibility inspection, and fallback window revalidation. The remaining millisecond execution budget is projected to integer child seconds with `floor`, not `ceil`, so an internal stage can never receive a longer timeout than the end-to-end deadline actually has left. No extra local settlement reserve is deducted because the hosted Worker already owns a separate five-second reply-settlement margin outside the daemon execution budget. Final pre-dispatch budget exhaustion is checked before the snapshot is claimed, preserving one-shot mutation authority on a definite no-side-effect failure. The Worker now defaults both compound Computer Use tools to 30 seconds while retaining the shared 45-second explicit maximum; ordinary configurable foreground tools remain at 20 seconds. Deadline exhaustion during browser/application preflight is no longer swallowed and reclassified as stale/unavailable.
-- Diagnose the separate whole-control-plane interruption with host evidence instead of attributing it to a daemon crash. The launchd daemon remained the same PID with one lifetime run, while `pmset` recorded consecutive Idle/Maintenance Sleep intervals at 06:50–06:58, 06:58–07:15, and 07:15–07:27 local time; daemon `runtime.event_loop.stall` values of roughly 505/718 seconds and a 981-second relay outage align with those suspension windows. On macOS, one `macos-idle-sleep-assertion.mjs` adapter now owns the fixed non-shell `/usr/bin/caffeinate -i -w <owner-pid>` primitive. Authorized, schema-valid relay handlers share a daemon-bound assertion only after policy/account/operation authorization and argument validation succeed; concurrent handlers hold it for their full execution lifetime, and the fixed five-minute inactivity grace begins only after the last daemon-side activity settles. A remote `start_process` extends the same daemon assertion only after resource admission succeeds and releases it when the child settles, including startup failure. Remote account managed-job runners independently acquire a runner-PID-bound assertion only after their runner claim is confirmed and persisted ownership identifies an account-backed job, then retain it across recovery handoff, resource admission, steps, cleanup, and terminal persistence; local managed jobs do not acquire this remote-continuity assertion, so daemon reconnect or service replacement does not own remote runner sleep protection. Runtime shutdown terminates process sessions before releasing the daemon assertion. The relay grace is deliberately fixed rather than depending on shell-only environment inheritance that launchd does not persist as service configuration. Rejected relay traffic cannot keep the host awake, auxiliary guard failures/logging remain fail-open, and no guard claims to prevent explicit sleep or lid-close sleep. Owner diagnostics expose only coarse supported/enabled/active/grace/error-class state, and guard failure logs only a coarse error class without session/job identity.
-- Close the distinct awake relay-interruption path reproduced after beta.100. At 09:12:30 local time macOS reported the network path reachable again while the launchd daemon remained the same process and there was no Sleep/Wake event; the previously ready relay did not close with WebSocket `1006` until about 09:13:39 and returned ready about two seconds later. Beta.100's twenty-five-second application heartbeat and seventy-five/ninety-second local/Worker silence windows therefore allowed an apparently OPEN but black-holed transport to outlive ordinary twenty-second and compound thirty-second foreground budgets. Beta.101 separates transport from application liveness: `RelayLiveness` sends protocol-level WebSocket Ping every five seconds and terminates a transport after ten seconds without inbound proof, while preserving the twenty-five-second JSON application heartbeat and its independent seventy-five-second application-silence timeout; the Worker keeps its wider ninety-second liveness fallback. Protocol Pong therefore cannot mask a Worker application path that has stopped replying. For a scheduling-responsive daemon, the executable contract guards the full probe-plus-silence detection horizon—fifteen seconds—below the ordinary twenty-second hosted execution default, leaving reconnect/result-settlement headroom; a diagnosed local event-loop stall follows the separate recovery-grace path. `relay_transport_timeout` distinguishes that local half-open decision while `relay_heartbeat_timeout` remains the application-silence classification, and authenticated relay diagnostics retain `previous_ready_inbound_silence_ms` so the pre-close black-hole interval is not hidden behind a short close-to-ready recovery duration. The existing five-second new-call readiness wait remains unchanged because the defect was delayed stale-transport detection, not slow reconnect after detection.
-- Close the post-reconnect lost-dispatch hole found during the second independent pass. A Worker call could be registered and written to an apparently OPEN old WebSocket immediately before a half-open transport was rebuilt; if that frame never reached the local dispatcher, same-instance reconnect rebound the Worker pending record but the existing one-way `resume_calls` reconciliation gave the Worker no proof that the daemon had never owned that call, so the request could still wait until its original deadline after the relay itself had recovered. Reconnect reconciliation now snapshots the daemon's active-call and unacknowledged-result ledgers, returns only Worker-resumed IDs absent from both, and sends those bounded IDs as pre-ready `resume_calls_ack.missing_ids` on the same authenticated relay generation. The Worker rejects exactly those still-owned pending records immediately as retryable `unavailable` with `side_effects_started=false` and `reason=daemon_call_not_received_after_reconnect`; active calls and retained terminal results remain rebound, and no mutation is replayed automatically. If the acknowledgement itself cannot be sent, that relay generation is interrupted instead of claiming successful reconciliation. New logs expose only aggregate missing-call counts, never raw resumed IDs, tool arguments, account identity, or results.
-- Close documentation and executable-contract drift found during the independent pass. README no longer claims a blanket 60-second remote foreground process/browser/application envelope; Computer Use documentation no longer claims the first application verifier capture can restart the full action timeout. Architecture, operations, testing, logging, shared server guidance, generated tool reference, Worker timeout tests, and release-contract guards now encode the compound 30-second/default single-deadline contract and the bounded runtime sleep guard.
-- These packaged changes invalidate beta.100's candidate/activation evidence for release purposes. Beta.101 requires fresh frozen fast/full verification, exact candidate preparation and install-only preflight, then a new explicit owner authorization before live activation, activated-package canary, live verification, and acceptance. No commit, push, npm publication, tag, or GitHub Release is authorized by this repair alone.
-
-## 3.0.0-beta.100 - 2026-08-17
-
-- Supersede the prepared but never activated/accepted beta.99 candidate after a fresh maintainer-level review challenged architecture, state/timeout boundaries, logging, tests, package impact, privacy, and current documentation instead of treating the previous green suite as sufficient evidence. The live owner runtime remains beta.98; beta.99 produced only local fast/full/candidate/install-only evidence and therefore has no live acceptance to preserve.
-- Remove the obsolete internal `LocalRuntime.execCommand(command, timeout)` compatibility branch. The MCP handler has long passed the validated argument record `{ command, timeout_seconds }`; only self-test/full-access fixtures still exercised the second shape. Runtime routing and those fixtures now use the same object contract, and an architecture guard rejects reintroduction of `legacyCall`/`timeoutOrContext` branching. This reduces one parallel parameter/state path without changing the public `exec_command` schema or durable relay routing.
-- Close two audit/hygiene edge cases. `SecurityAuditLog.close()` now normalizes invalid or oversized shutdown delays before `setTimeout` and never extends its existing five-second bounded close window; a control experiment on the previous source produced Node's `TimeoutOverflowWarning` because `Infinity` was converted to a 1 ms timer. Regressions prove both non-finite and `Number.MAX_SAFE_INTEGER` inputs remain pending until a synthetic worker acknowledgement rather than collapsing into timer-overflow behavior. The asynchronous worker-failure termination catch now documents its best-effort semantics, while repository hygiene also recognizes optional-chained empty Promise catches (`.catch?.(() => {})`) so that syntax cannot bypass the existing catch-and-continue rule.
-- Remove duplicated deterministic-host fixtures by sharing one `tests/fixtures/healthy-resource-host.mjs` source across agent-context, full-access, and runtime self-test. Separately, correct package-impact terminology: current `package.json.files` does not ship `tests/`, the beta.99 tarball contains no `package/tests/**`, and `release-impact:check` intentionally ignores a test-only repository change. Contributor/testing guidance, release-impact regression coverage, and architecture contracts now distinguish verification evidence from npm package bytes; recent beta.98 wording is corrected without rewriting historical audit records wholesale.
-- Correct verification-runner concurrency documentation. The default is `min(4, os.availableParallelism())`, not an unconditional four workers; this explains observed beta.99 runs reporting two or three available workers. The release contract now binds that implementation and the documentation states the capped/dynamic rule. Independent tracing of the persistent `activate --json` path found no second stdout-contamination mechanism after beta.97: the inner activation remains captured, JSON mode keeps service loggers quiet/stderr-only, and the remaining inherited-stdio branch belongs to the separate non-persistent foreground path. Targeted sensitive-data scans likewise found no concrete home path, account ID, Worker endpoint, private-key header, bearer header, or client secret in tracked source/docs. Large Computer Use/browser/runtime modules remain close to their executable line ceilings, but no threshold was raised and no speculative refactor was added without a concrete ownership boundary.
-- Diagnose a recurrent owner-visible “message send timed out” symptom without collapsing it into the relay. During the symptom window the live beta.98 relay was ready, Worker call telemetry reported zero tool timeouts, and the only recent transport interruption was a recovered close-1006 episode of about 4.5 seconds. Independently, machine-user resource diagnostics showed Green sampled pressure alongside one active heavy lease, nine queued waiters, and six aged protected waiters; one durable lightweight process query later terminated after the full 30-minute admission ceiling with `resource_error` and no executed step, proving it had never spawned. This is concrete pre-spawn queueing evidence but not proof that the ChatGPT client message timeout had the same direct cause. Beta.100 keeps the existing fairness policy and instead makes the boundary observable: managed jobs publish `current_phase=resource_admission` before spawn and retain `resource_admission_ms` internally within their existing total `duration_ms`; local/owner reads expose that queue timing for diagnosis while delegated non-owner reads omit it, diagnostics expose privacy-safe `waiters.drain_active`, the 1,800,000 ms admission ceiling joins the shared durable-delivery contract and `server_info.tool_delivery`, and remote process tool descriptions distinguish admission time from the 1–600-second child execution budget.
-- Close two additional review races rather than relying on timeout-only mitigation. The local daemon-fixture exit waiter now registers its `exit` listener before a second child-state check, so an exit between the original pre-check and listener installation cannot become a false 30-second hang; settlement is single-shot and architecture-guarded. Promise catch hygiene now also rejects whitespace-, parameter-, and `async`-equivalent empty catches in addition to direct and optional-chained zero-argument forms. The managed-job admission-phase status write is also failure-aware: if restoring the post-admission phase cannot be persisted after a lease is acquired but before spawn, the runner explicitly releases the lease before propagating the status error; if that cleanup itself fails, both failures are surfaced together rather than hiding the lease-cleanup fault.
-- These source/script/documentation changes invalidate beta.99's local receipt and candidate. Beta.100 must complete fresh frozen verification, exact candidate preparation and install-only preflight, then obtain new explicit owner authorization before any live activation/canary/acceptance. No commit, guarded push, npm publication, tag, or GitHub Release is authorized by this review alone.
-
-## 3.0.0-beta.99 - 2026-08-17
-
-- Supersede beta.98 after its exact candidate was owner-authorized and persistently activated successfully, the activated-package OAuth canary passed authorization-code exchange, authenticated MCP, refresh rotation, refreshed MCP, and cleanup, and live Machine Bridge diagnostics reported `3.0.0-beta.98`, relay readiness, zero pending calls, and a healthy verified security-audit chain with `content_logged=false`. No beta.98 acceptance was recorded: the pre-acceptance source/runtime/documentation cross-check found a shipped testing-contract defect before the candidate could be accepted or guarded-pushed.
-- Correct `docs/TESTING.md`, which still described `full-access:test`, `local-self-test`, and `agent-context-test` as using five-minute real-host-pressure resource-admission waits. The current fixtures are intentionally isolated from shared-host pressure: full-access and agent-context use synthetic healthy-host sampling with ten-second process-admission budgets, and beta.98's runtime self-test uses the same synthetic healthy-host isolation with ten-second one-shot/session admission plus bounded daemon child-exit waits and per-phase progress markers. The separate five-minute managed-job/stdio background-settlement observation windows remain unchanged.
-- Make that documentation boundary executable. Architecture release contracts now reject the obsolete five-minute fixture guidance and require the isolated/synthetic ten-second descriptions to remain present. Because `docs/` is part of `package.json.files`, this documentation repair changes npm-package bytes; beta.98's successful live activation and canary remain operational evidence only and cannot authorize beta.99. Beta.99 requires a fresh frozen fast/full receipt, exact candidate, install-only preflight, new explicit owner activation authorization, activated-package canary, observed live verification, and acceptance before the PR branch can be updated again.
-
-## 3.0.0-beta.98 - 2026-08-17
-
-- Supersede beta.97 after its accepted branch was committed, passed the guarded GitHub push, and reached PR #85 exact-head hosted validation. Dependency Review, Governance, Workflow Policy, CodeQL Actions, package-audit, Ubuntu full verification, and Windows platform/install all passed on exact commit `e7bf465790961db203ad751e8d876a60db880f98`. Two hosted-only gates did not: JavaScript/TypeScript CodeQL rejected five `js/superfluous-trailing-arguments` findings, while the macOS platform job reached its 20-minute workflow ceiling with task 118/122 (`self-test`) still in progress and was cancelled before the documented global-install step. Neither result is treated as a provider flake or waived.
-- Restore the declared one-parameter runtime API as `remoteForegroundMaximumSeconds(_name)` without changing the calculation or any hosted timeout. Add a direct runtime-arity regression requiring `Function.length === 1`, so future declaration/implementation drift fails locally before GitHub CodeQL. The regression was first demonstrated red against beta.97 and then passed after the repair; lint, typecheck, architecture, and whitespace gates also pass with the behavior-neutral fix.
-- Make the broad runtime/local self-test deterministic on shared macOS CI instead of inheriting machine-pressure behavior that belongs to the dedicated resource-admission suites. The old runtime fixture used a private coordinator namespace but still sampled the real host and allowed each process admission to wait up to five minutes; the local daemon fixture also had an unbounded child-`exit` wait, and the old test emitted no phase markers. The cancelled provider log cannot identify which of those latent paths directly held beta.97, so beta.98 fixes both structural hazards without inventing a single observed cause: runtime fixtures use the existing synthetic-healthy host sampler and a ten-second resource wait, daemon child exit is bounded by the 30-second fixture budget, and each self-test phase reports start/completion. The hardened owner-machine self-test completes all phases in about 30 seconds.
-- Move host-cache coverage back to the resource-admission suite after deterministic self-test isolation removed its accidental real-host coverage. The first beta.98 full run correctly failed only the critical coverage gate because `resource-host-cache.mjs` function coverage dropped to 75%; explicit regressions now prove both non-I/O and fresh-I/O quick CPU refreshes preserve valid scope-local throughput/IOPS hints. The dedicated coverage gate then reports `resource-host-cache.mjs` at 100% function coverage (4/4) without reintroducing shared-host sampling into the broad self-test.
-- Beta.97 acceptance remains valid evidence for the exact beta.97 bytes that were live-tested, but it cannot authorize beta.98 because the packaged shared timeout module, synchronized version metadata, and release notes changed afterward; the accompanying regression test also changed as repository verification evidence but is not part of the npm tarball. Beta.98 therefore requires a fresh frozen fast/full receipt, candidate and install-only preflight, explicit owner authorization for a new live activation, activated-package OAuth canary, observed live verification, and a new acceptance before the PR branch may be guarded-pushed again.
-
-## 3.0.0-beta.97 - 2026-08-17
-
-- Supersede beta.96 after its exact candidate was owner-activated, passed the activated-package OAuth canary, live Worker/daemon/browser checks, and local acceptance, but recovery of the earlier agent-launched activation job exposed a blocking release-carrier defect. That detached managed-job activation had run for 793.6 seconds and then failed with `persistent candidate activation did not return valid JSON`; the same guarded command subsequently succeeded from an ordinary owner terminal. `pmset` records no sleep/wake event during the failed interval, so the previously repaired idle-sleep mechanism is falsified for this incident.
-- Close the unsafe Wrangler-auth branch that can explain that outcome and independently violates the release contract even when it is not taken. Persistent activation previously stopped the verified login service before `ensureWorkerDeployment()` checked `wrangler whoami`; a failed probe could then start an uncaptured, inherited-stdio `wrangler login` with a ten-minute budget while the inner `machine-mcp activate --json` process was required to emit a single JSON document on stdout. Beta.97 preflights Wrangler authentication in the outer release wrapper before any service handoff. A detached managed job fails before live mutation if authentication is unavailable; an ordinary owner terminal may complete interactive login at that preflight boundary and must pass a second captured `whoami` before activation starts.
-- Make machine-readable Worker deployment non-interactive as defense in depth against authentication expiry between preflight and handoff. `ensureWorkerDeployment(..., { json: true })` now returns `worker_authentication_required` without launching Wrangler login, so an authentication race enters the existing activation rollback instead of holding the service offline or contaminating the activation JSON channel. Ordinary non-JSON startup retains interactive login but now rechecks `whoami` before Worker deploy. Behavior tests cover managed-job fail-closed, terminal login/recheck, JSON no-login, and deploy ordering; architecture guards bind the preflight ahead of the release-runtime lock and forbid JSON-mode login drift.
-
-## 3.0.0-beta.96 - 2026-08-17
-
-- Adjudicate a second independent reliability/security review against the current source instead of accepting its beta.94-era claims verbatim. The relay already cleared readiness/outage/heartbeat timers on stop, close, fatal, and generation replacement; its first-start resolver was already single-settlement guarded, pending calls and daemon-ready waiters already shared bounded capacity and expiry, JWT/JWS-shaped values were already redacted, and WebSocket 1002/1008/1009/1012 classifications were already explicit. No speculative timer manager, queue LRU, universal IP regex, close-code rewrite, or large-module refactor was added for claims not supported by current behavior.
-- Fix the real lifecycle defect uncovered while testing the timer claim: stopping `RelayConnection` before the first end-to-end readiness acknowledgement now settles the pending `start()` Promise instead of leaving it unresolved forever. `LocalRuntime.start()` also treats a concurrently stopping/stopped lifecycle as authoritative, so a late relay success or failure cannot overwrite shutdown with `running` or `failed`. Deterministic regression coverage binds both sides of the race.
-- Harden internal deadline and relay-envelope boundaries without widening any public timeout. Worker pending-call operation/reconnect delays must now be finite positive safe integers within their shared contract before a timer or alarm is armed; `Infinity`, `NaN`, non-positive, and over-contract values fail before pending state mutates. Local relay tool calls now require the same `call_...` identifier shape used by resume state, a bounded lowercase tool-name shape, strictly typed authorization version/role fields, and an explicit 1–50-second integer `timeout_ms` instead of coercing malformed values.
-- Make catch-and-continue intent executable. Previously silent cleanup/fail-closed catches in browser, application, release, audit, diagnostics, and macOS helper paths now state why the error is intentionally irrelevant to the primary settlement; repository hygiene rejects newly introduced empty synchronous or Promise catch bodies in production/script/extension sources. Browser WebSocket `onerror` also documents that `onclose` owns settlement/reconnect classification rather than pretending the error callback is an independent terminal signal.
-- Remove two post-beta.93 guidance drifts missed by the previous review. `docs/TESTING.md` and shared `server-metadata.json` no longer advertise 30-second ordinary/process foreground behavior: ordinary hosted tools default to 20 seconds plus the separate Worker settlement margin, configurable browser/application work defaults to 20 seconds with a 45-second explicit maximum, `start_process` has a 10-second execution budget, and remote process one-shots are durable-first with 10-second acceptance plus independently bounded 1–600-second execution. Shared instructions now direct ordinary one-step durable process work to its returned `job_id`/`read_job`, reserving owner-only `start_job` for multi-step/resource/finally plans. Privacy guidance also states the actual boundary: compact JWT/JWS/DPoP-shaped values are redacted, while network identity is omitted at source rather than relying on a broad IPv4/IPv6 anonymizer.
-- Keep release verification from inheriting the 600-second remote process-step ceiling. An otherwise green beta.96 full run completed all 130 tasks in 596.0 seconds because `install:test` alone took 229.7 seconds, proving that the process carrier can become the narrower deadline than the suite. Active server guidance, testing/releasing docs, and the agent contract now direct owner-authorized remote `check:full` runs that may exceed 600 seconds through detached `start_job` with a larger explicit step timeout; ordinary one-step durable process work within 600 seconds still uses `run_process`/`run_local_command`/`exec_command` plus `read_job`.
-
-## 3.0.0-beta.95 - 2026-08-17
-
-- Complete an independent post-incident architecture review of the beta.94 reply-safety repair. The Worker new-call readiness fallback now derives from the shared five-second relay contract instead of retaining a stale ten-second local default, and `start_process` derives its ten-second request-owned execution budget from the same contract rather than a private literal. The obsolete 30-second remote-process foreground budget has been removed from the shared/public delivery contract: remote process one-shots are durable jobs with a ten-second acceptance window and up to 600 seconds of detached execution, while request-owned `start_process` has its own explicit ten-second session-start budget. The lower process service retains a private 30-second defense ceiling only if an internal caller incorrectly bypasses durable relay routing.
-- Make resource-pressure failures more diagnosable without increasing default log noise or exposing user activity. Debug-only `tool.call.failed` events may now include enumerated `resource_admission_reason` and coarse `resource_pressure_state` when cooperative admission rejects before spawn; command text, argv, cwd, project/lease identity, host process names, and probe output remain excluded. Regression coverage binds the safe field set.
-- Stop structurally impossible fixed CPU fan-out from masquerading as transient pressure. A fixed request whose CPU reservation exceeds the machine's best-case priority-specific launch window now fails immediately with non-retryable `cpu_request_exceeds_launch_window` instead of occupying a waiter until its long admission deadline or entering starvation drain. Explicit concurrency is never silently rewritten and the existing host headroom is not relaxed; callers must lower explicit parallelism or resource demand. Elastic/unbounded requests keep their pressure-aware fitting behavior, and genuinely transient `cpu_pressure_window` remains retryable.
-- Keep macOS release verification from fabricating timeout failures during ordinary Idle Sleep. `scripts/run-checks.mjs` now re-executes fast/platform/full checks under a verification-only `/usr/bin/caffeinate -i` guard on macOS, with a private recursion marker and no platform dependency elsewhere. This was added after a frozen-tree fast run entered Idle Sleep six seconds after launch, slept for 594 seconds, and then misclassified a two-second Wrangler lifecycle fixture as timed out immediately after DarkWake. Explicit/lid-close sleep remains outside this guard and still invalidates a live-machine verification run.
-- Repair current-state documentation drift found during the independent review: README, architecture, testing, and logging guidance now agree on the 20+5-second ordinary hosted envelope, five-second new-call recovery, zero-queue relay `start_process` admission, ten-second process-session startup envelope, durable-process timing, and the 500 ms host-snapshot freshness window. Architecture gates reject the stale timing claims and the removed `server_info.remote_process_foreground_execution_max_ms` field so these values cannot silently diverge again.
-
-## 3.0.0-beta.94 - 2026-08-17
-
-- Close the host-pressure reply-stall path left after beta.93. A live owner-machine incident reproduced `host_pressure_red` and `coordinator_busy` while heavy Xcode/Simulator work kept the machine explicitly awake; remote `start_process` could spend its previous 10-second cooperative resource-admission wait before it even attempted a spawn, consuming a material fraction of the request-owned MCP response lifetime. Relay-origin process sessions now perform one resource-admission attempt without queueing and return the existing retryable `unavailable` error immediately when the host cannot safely admit the process. Owner-local process sessions retain their 10-second cooperative wait, and an explicitly configured resource wait is still honored.
-- Increase hosted reply headroom without reducing explicit long-operation capability. Ordinary daemon-backed tools now default to 20 seconds of remote execution plus the separate five-second Worker settlement margin, configurable browser/application tools also default to 20 seconds while retaining their existing 45-second explicit maximum, and `start_process` receives a 10-second execution / 15-second settlement envelope. A new tool call waits at most five seconds for a temporarily disconnected daemon before returning retryable `unavailable`; already-dispatched calls retain the existing same-instance reconnect/rebind path and their original absolute deadline.
-- Preserve the transport/task durability boundaries that already survived close-1006 relay interruptions in beta.93. Remote process one-shots remain durable managed jobs with caller-held idempotency keys, daemon results remain retained until Worker acknowledgement, and same-daemon reconnect still uses `resume_calls`. The repair does not add MCP replay/session storage or treat response-stream closure as durable delivery; it removes avoidable queueing and default deadline consumption so the Host receives a structured terminal result before its own interaction budget is exhausted whenever the request channel remains available.
-
-## 3.0.0-beta.93 - 2026-08-16
-
-- Decouple remote process-task lifetime from one MCP response. Hosted `exec_command`, `run_process`, and `run_local_command` now require a caller-held `idempotency_key`, validate their existing authority/cwd/argv contract, commit the operation as a principal-bound one-step managed job, and return a `job_id` with `read_job` recovery metadata before the detached step runs. The MCP acceptance budget is 10 seconds plus the separate five-second Worker settlement margin, while the durable execution budget is independently capped at 600 seconds. Because the recovery key exists before dispatch, an ambiguous acceptance response can be retried against the same durable job instead of creating duplicate work. Worker settlement timeout, response-stream cancellation, and relay reconnect expiry preserve that key plus an explicit same-key replay action in the public error instead of collapsing the call to an unactionable `effect_settlement=pending/unknown`. This makes normal code/build/test commands recoverable across MCP disconnect, relay reconnect, daemon restart, or service replacement instead of terminating or losing their final result with the request stream.
-- Preserve the original security boundary while adding durability. Automatic process persistence authorizes the source tool rather than the owner-only `start_job` capability, keeps managed-job principal ownership/revocation semantics, uses interactive resource-admission priority, and carries non-owner delegated-process isolation into the detached runner. The runner reconstructs the verified workspace sandbox at step spawn using the job's persistent runtime directory; sandbox unavailability still fails closed. The required remote `idempotency_key` reuses the managed-job deduplication contract for ambiguous acceptance responses without making owner-only multi-step job submission available to operators.
-- Separate diagnostic process health from resource queueing. `diagnose_runtime` fixed spawn/shell probes now use the implementation-owned fixed-process path and bypass cooperative resource admission, while resource pressure and waiters remain a separate check. This prevents a healthy OS spawn boundary from being reported unavailable merely because a foreground process was waiting for heavy-resource admission.
-- Keep the daemon's defense-in-depth argument validation aligned with the Worker's durable-process projection. The canonical local MCP schema remains capped at 60 seconds for request-scoped process calls, while relay-origin `exec_command`, `run_process`, and `run_local_command` may carry the Worker's separately validated 1–600 second detached execution budget through daemon validation. A 600-second cross-layer regression proves the widened durable execution field no longer gets rejected by the local 60-second foreground schema before job acceptance.
-- Make persistent activation ownership commit follow verified handoff rather than service-definition installation. Activation now installs the candidate with `service_owner=pending`, starts the candidate against that pending identity, verifies the exact service daemon and Worker version, and only then commits ownership while the machine-service lock is still held. A failed initial start may recover the same pending candidate and commit only after recovery convergence; failed convergence stops an uncommitted candidate, and an owner-commit failure stops the already-verified candidate while retaining pending state for explicit recovery. This removes the `committed` + `loaded=false/active=false` intermediate state without creating the inverse old-owner/new-definition mismatch.
-- Correct the architecture documentation for beta.91's reconnect semantics: pending calls retain one absolute operation deadline across detach/rebind; reconnect consumes that remaining budget rather than pausing it. Regression coverage now proves durable acceptance/recovery after MCP call settlement, strict 1–600 second remote execution validation, delegated sandbox preservation without operator access to `start_job`, and the distinct 10-second acceptance versus 600-second execution budgets. Bounded task-capability routing now also retains an authorized direct-shell fallback even when browser/workspace route scoring fills the route budget, rather than silently evicting the escape hatch it advertises. During targeted verification the live beta.92 relay also experienced and recovered from a close-1006 interruption while the detached test job continued, directly exercising the transport/task-lifecycle separation.
-
-## 3.0.0-beta.92 - 2026-08-16
-
-- Harden persistent activation against an ambiguous macOS `launchctl bootout` settlement discovered during the beta.91 live candidate run. The activation job failed after 9.1 seconds because the existing launchd service could not be verified stopped, yet the previously ready beta.90 daemon then remained unavailable until launchd recovered it roughly 17 minutes later. `stopLaunchdService()` now keeps observing the bootout for up to about ten seconds and, once a bootout mutation has been dispatched against an initially active service, reports `restore_required=true` even when the stop result remains inconclusive.
-- Make previous-service rollback retryable instead of single-shot. A failed activation that had a verified prior service runtime now repeatedly invokes the idempotent provider start/bootstrap operation and rechecks the exact previous daemon version/entrypoint identity for up to 30 bounded attempts. This specifically closes the race where an immediate recovery `bootstrap`/`kickstart` collides with a still-settling launchd `bootout`; transient start failures no longer abandon the machine with its login daemon offline. The original activation error is still returned after verified rollback, while rollback failure is aggregated with the primary failure.
-- Give autostart-stop failure a stable `autostart_stop_failed` activation reason and add regression coverage for delayed/ambiguous launchd stop rollback obligation plus multi-attempt previous-service recovery. Beta.91's reply-safe hosted execution ceilings, five-second process polling, five-second SSE heartbeat, and absolute pending-call deadline across daemon reconnect remain unchanged.
-
-## 3.0.0-beta.91 - 2026-08-16
-
-- Close the remaining blank-response timeout path in hosted MCP calls. Beta.90 narrowed process one-shots, but non-configurable daemon tools still received a 60-second execution budget and an in-flight daemon disconnect paused that operation deadline while the Worker waited up to the 120-second reconnect grace. A short call could therefore outlive its original host-visible deadline after relay/service interruption. Pending calls now keep their original absolute operation deadline across detach/rebind: reconnect grace is capped by the remaining operation budget and reconnect time consumes that budget instead of extending it.
-- Make remote synchronous work reply-safe by default without reducing local administrator capability. Ordinary daemon-backed tools now receive at most 30 seconds of remote execution, configurable browser/application foreground tools are capped at 45 seconds, and remote `exec_command`, `run_process`, and `run_local_command` default to 20 seconds with a 30-second maximum. Local stdio/CLI schemas and owner-local command budgets remain unchanged. Long work keeps its full capability through process sessions or durable managed jobs rather than one blocking hosted response.
-- Turn process-session progress reads into short polling. The remote `read_process.wait_ms` schema is capped at 5 seconds and its Worker execution budget is only 5–10 seconds plus the separate five-second settlement margin; the underlying process may continue for its normal session lifetime. `start_process` receives a 20-second remote startup envelope. This prevents repeated process observation from monopolizing a host reply window while preserving retained output and resumability.
-- Increase response-stream liveness and rolling-upgrade clarity. Public MCP SSE heartbeats now arrive every five seconds. Cached hosts that still permit the former process timeout or 30-second `read_process` wait receive a normal pre-dispatch MCP `invalid_request` tool result with `schema_refresh_recommended=true`; malformed types and unrelated schema failures remain JSON-RPC protocol errors. `server_info.tool_delivery` now reports the ordinary remote tool ceiling and process-poll wait ceiling alongside foreground/process maxima and settlement overhead.
-
-## 3.0.0-beta.90 - 2026-08-16
-
-- Make the new 45-second remote process ceiling compatible with hosts that still cache the previous 60-second `tools/list` schema. A live beta.89 probe from the current ChatGPT connector accepted `run_process(timeout_seconds=46)` at the stale host-schema layer, while the updated Worker correctly rejected it before daemon dispatch; the connector surfaced that JSON-RPC `-32602` as a generic `UNKNOWN/ExceptionGroup`, recreating the class of unhelpful/no-actionable reply the timeout hardening was intended to avoid. Timeout-maximum schema mismatches now return a normal MCP tool `isError` result with `invalid_request`, `side_effects_started=false`, `schema_refresh_recommended=true`, validation detail, and explicit session/job guidance. Fresh hosts still reject from the advertised 45-second schema, while stale hosts receive a structured pre-dispatch error instead of a transport-looking failure.
-- Preserve protocol errors for genuinely malformed calls. Only validation failures consisting exclusively of `/timeout_seconds` `maximum` issues take the stale-schema compatibility path; type errors, unknown fields, missing/unknown tools, and other invalid arguments remain JSON-RPC `-32602`. Unit and full Worker integration coverage assert both sides of that boundary.
-- Supersede beta.89 after its durable managed-job activation successfully crossed the daemon handoff, the exact beta.89 Worker/login daemon became ready, and the activated-package OAuth canary passed. The stale-host compatibility defect was found by a subsequent live over-limit probe, so beta.89 is not accepted and beta.90 requires a fresh exact-tree receipt/candidate/canary cycle.
-
-## 3.0.0-beta.89 - 2026-08-16
-
-- Fix a live candidate-activation self-termination defect. A release activation launched through Machine Bridge `run_process`, `exec_command`, `run_local_command`, or `start_process` was owned by the current daemon's process tracker; activation intentionally stops that daemon during the service handoff, and daemon shutdown drains tracked process groups with `SIGKILL`. The activation could therefore kill its own parent operation after installing/committing the candidate service definition but before relaunching it, leaving the exact observed state: candidate Worker and committed service owner, but launchd unloaded/inactive. Execution surfaces are now runtime-marked, persistent activation fails before live mutation on daemon-lifetime foreground/process-session surfaces, and durable managed jobs or an ordinary local terminal are the supported activation carriers.
-- Reduce reply-timeout and task-interruption risk for remote process work. `exec_command`, `run_process`, and `run_local_command` now default to 30 seconds remotely and have a 45-second remote ceiling, leaving explicit Worker/host settlement margin instead of consuming the full 60-second interactive envelope. Longer or restart-sensitive work must use `start_process`/`read_process` or, when it must survive daemon replacement or MCP disconnect, `start_job`/`read_job`; browser/application foreground tools retain their existing tool-specific 30/60-second contract.
-- Make execution-surface identity non-spoofable at the runtime boundary. Foreground one-shot processes, process sessions, and detached managed-job runners receive distinct internal surface markers after policy/environment construction; full-env managed jobs overwrite any inherited marker. Release activation accepts only the durable managed-job marker or an unmarked ordinary local terminal, and rejects unknown non-empty markers fail-closed.
-- Keep runtime-scoped resource coordination consistent across detached jobs. A `LocalRuntime` configured with a private `resourceCoordinatorRoot` previously applied it to foreground/process-session execution but not to managed-job runners; a full-access test running under an outer verification-plan lease could therefore wait five minutes for its inner background job behind unrelated machine-global waiters. Managed-job launch and recovery now inherit the runtime's coordinator-root override, eliminating that split-brain while production runtimes with the default root remain machine-user coordinated.
-- Fix a latent no-coordinator process-admission boundary: `acquireProcessResources(null, ...)` now preserves the original command/argv instead of returning only environment metadata, so a standalone `ProcessSessionManager` remains executable without a resource coordinator. Targeted activation, process-session, managed-job, timeout, architecture, lint, and typecheck regressions cover the new contracts.
-- Supersede beta.88 after its exact candidate passed local verification and updated the Worker, but its activation process was terminated by the old daemon during handoff and left the committed beta.88 service definition inactive until manual `machine-mcp service start`. Because this repair changes packaged runtime, release tooling, tests, documentation, and synchronized version metadata after live beta.88 mutation, none of beta.88's candidate evidence is reusable for beta.89.
-
-## 3.0.0-beta.88 - 2026-08-16
-
-- Clarify execution-layer diagnosis after a real nested-SSH incident exposed an attribution trap: a returned child exit code/stdout/stderr proves the local process was spawned, while an SSH forced-command allowlist refusal is downstream target evidence. Shared MCP instructions, `diagnose_runtime`, README, and operations guidance now direct maintainers to change the narrowest failing authorization layer instead of widening canonical `full` unnecessarily.
-- Reduce Computer Use responsibility concentration by extracting expectation normalization and application state-action validation from the 2.4k-line orchestration module into `computer-use-expectation.mjs`. The public behavior is unchanged, while the architecture gate now budgets the extracted boundary separately and lowers the `computer-use.mjs` ceiling instead of spending its former headroom.
-- Reduce CLI responsibility pressure by moving ready/start presentation into `cli-ready-output.mjs`. The start JSON, human connection banner, initial-owner one-time credential output, and policy summary retain the same behavior; `cli.mjs` drops below 900 lines and its architecture ceiling is lowered from 950 to 900 while the new presentation module receives its own 80-line budget.
-- Make cross-process resource host-sample reads generation-safe without weakening secure-file identity checks. The host sample is intentionally published by atomic replacement; readers now reopen at most four times when that exact cache changes identity during `open`/path verification, while symlink/hard-link violations, malformed JSON, and persistent generation churn still fail closed. This closes a real `agent-context:test` race found under concurrent resource-admission load.
-- Close a filesystem generation race in structured mutations. Patch update/move/delete now re-read and hash the exact source generation after it has been renamed into the transaction backup, before any replacement is published or deletion is finalized; a concurrent change between preflight and rename is restored and rejected instead of being mistaken for the observed source. `edit_file` and `write_file` with `expected_sha256` now reuse that same quarantine/no-overwrite transaction path rather than maintaining a weaker check-then-overwrite sequence. Deterministic fault injection covers both patch deletion and optimistic atomic writes.
-- Remove the release workflow's duplicate full-suite run without weakening the frozen-tree gate. A successful `check:full` now writes an ignored owner-local receipt bound to the exact verification generation, package identity, Node/platform identity, and a six-hour freshness window; starting another full run clears the old receipt before tests begin, so a failed or interrupted rerun cannot leave reusable success evidence. `release:candidate` requires that exact-tree receipt before packing and fails with explicit `check:full` guidance when source, runtime, version, or freshness drifts. The receipt contract has direct behavior tests, architecture assertions, and critical coverage.
-- Isolate `agent-context:test` from the machine-user resource-admission namespace. Its registered-command fixture previously inherited the production cross-process coordinator and allowed a five-minute fairness wait inside a full-plan task whose own timeout was also five minutes, so unrelated heavy jobs on the same Mac could turn an otherwise healthy verification into a deterministic timeout. The fixture now uses a private temporary coordinator root and a ten-second internal wait; cross-process fairness remains covered by the dedicated resource-admission suites instead of leaking into an unrelated capability-discovery test.
-- Apply the same isolation rule to the full-access diagnostic. Its purpose is to prove canonical `full` file, process, shell, environment, SSH-key, client, sudo-probe, and managed-job capabilities; machine-user admission fairness is independently covered by resource-admission tests. The diagnostic's `LocalRuntime` now uses a private temporary resource coordinator and a ten-second process wait instead of allowing unrelated host workloads to consume five minutes. This removes an observed 299-second release-gate stall without weakening any full-access assertion.
-- Make capability-test resource admission deterministic under real host load. `LocalRuntime` now accepts internal `resourceCoordinatorOptions` dependency injection while production callers retain the default real host sampler. The agent-context and full-access test fixtures inject a healthy synthetic host snapshot in addition to private coordinator roots, so host red-pressure cannot turn unrelated capability assertions into admission failures; dedicated resource-admission tests remain the authority for real/synthetic pressure, fairness, aging, and denial behavior.
-- Supersede beta.87 after its exact candidate completed local fast/full/frozen-candidate verification, owner-authorized activation, exact deployed OAuth canary, live runtime/application verification, acceptance, guarded push, all exact-PR-head CI/CodeQL/platform checks, and squash merge to `main`. The first exact-main CI display then exposed a final current-control-plane terminology leak: Ubuntu/package-audit steps were still named `Verify interactive candidate acceptance`.
-- Close the terminology boundary across the whole current CI path rather than patching only the visible step names. `.github/workflows/ci.yml` now labels both portable acceptance steps `Verify local candidate acceptance`; the portable verifier's success message, workflow-policy contract description, TESTING guide, and release-contract diagnostics use the same term. Historical changelog/audit references remain untouched.
-- Strengthen architecture verification so CI workflow YAML, the portable verifier, the workflow-policy contract, and TESTING all reject the obsolete `interactive candidate acceptance` phrase and positively require the new local-acceptance wording. Because workflow/docs/tests and versioned package metadata change after beta.87 acceptance, beta.88 requires a fresh candidate/live/acceptance/exact-head cycle.
-
-## 3.0.0-beta.87 - 2026-08-15
-
-- Supersede the live-verified, accepted, committed, and guarded-pushed beta.86 after its own guarded-push output exposed a remaining documentation/diagnostic consistency defect: `scripts/github-push.mjs` still printed "Verified interactive local candidate acceptance", the portable CI acceptance verifier used the same obsolete adjective in failure messages, and current ENGINEERING/RELEASING/OPERATIONS guidance still contained fragments of the retired owner-terminal/real-TTY activation and publication contract. The executable beta.86 authorization behavior was already correct; these stale current-contract surfaces could still mislead operators and future maintainers back toward the policy the owner explicitly removed.
-- Remove the remaining current `interactive`/`owner-terminal` release wording without rewriting historical changelog/audit records. Guarded push and portable CI now refer simply to local candidate acceptance. ENGINEERING requires explicit current-task owner authorization plus `--owner-confirm` and the publication lock, while making TTY presence explicitly optional. RELEASING now states that, after explicit owner authorization, either the owner or an authorized agent may run exact candidate activation; conversational authorization is sufficient, and an agent must not race an operation the owner says they will perform themselves. OPERATIONS now classifies a failed activation command by outcome rather than terminal shape.
-- Add executable architecture regressions that reject the obsolete current-contract phrases in GitHub push/portable acceptance verification and operational documentation. This closes the review gap that allowed beta.85's audit to state that current operational TTY wording had been removed while several current surfaces still retained it. Because these scripts, docs, and regression tests are release-relevant/package-shipped bytes, beta.86 acceptance cannot be reused; beta.87 requires a fresh candidate/live/acceptance cycle.
-
-## 3.0.0-beta.86 - 2026-08-15
-
-- Supersede beta.85 after its frozen candidate passed the final 102-task fast plan, two independent 129-task full/candidate gates, direct-Node install-only verification, owner-authorized live activation, exact activated-package OAuth canary, Worker/service/relay diagnostics, and live application inventory. The live inventory exposed one remaining authority-projection defect before acceptance: an authenticated owner correctly had 54 effective tools at the Worker/account layer, but the local runtime projected application capabilities as if the owner lacked `open_local_application`, Accessibility automation, and Computer Use.
-- Fix effective tool derivation at its real authorization boundary. Relay authority intersection intentionally produces a synthetic `effectivePolicy.profile="custom"`; `runtime.effectiveToolNames()` incorrectly passed that synthetic profile back through `toolNamesForPolicy()`, where tools with `availability="full"` require the literal canonical `full` profile. A full owner therefore collapsed to 37 projected tools even though the actual ToolExecutor authorization chain (`daemon PolicyGate` followed by the account-role gate) allowed all 54. The runtime now derives projected effective tools from that same executable gate intersection instead of reinterpreting the synthetic policy profile.
-- Add a direct relay-owner application-inventory regression requiring discovery, launch, Accessibility inspection/actions, and window-observation capabilities to remain visible under a full daemon, while the existing reviewer regression still requires read-only discovery with projected paths and no launch/UI capabilities. This preserves custom-daemon restrictions because the daemon PolicyGate remains the first operand; no synthetic custom policy is promoted to full.
-- beta.85 was deliberately not accepted, committed, or pushed after this live mismatch. beta.86 therefore requires a fresh fast/full/candidate/install-only cycle, live activation, exact packaged OAuth canary, live capability verification, acceptance, guarded push, and exact-head hosted validation.
-
-## 3.0.0-beta.85 - 2026-08-15
-
-- Supersede beta.84 before source publication. beta.84 was activated, canary/live-verified, accepted, merged to `main`, and passed exact-head Ubuntu/macOS/Windows/package-audit/governance/CodeQL checks, but it was not tagged, published to npm, or installed from the registry. The owner then explicitly rejected two unnecessarily restrictive workflow contracts before publication: GitHub source release required a real TTY even after explicit owner authorization, and delegated capability resolution suppressed installed-application discovery entirely. Because this change affects shipped release tooling, policy metadata, runtime routing, tests, and documentation, beta.84 acceptance is not reused for beta.85.
-- Replace the GitHub publication TTY ceremony with explicit owner authorization. Source publication/backfill now use `--owner-confirm`; the guarded script accepts either a TTY or an explicitly authorized local automation/Machine Bridge invocation. The flag remains mandatory and is checked before fetch or remote mutation. No integrity gate is removed: clean `main`, exact `origin/main`, current candidate acceptance, required soak for stable, full verification, exact-head CI, accepted-tarball staging, local/remote tag conflict checks, GitHub asset SHA-256 reconciliation, release metadata convergence, trusted local `git`/`gh`, and the common-Git-dir publication lock all remain fail-closed. npm publication and registry/global activation remain separate operations that require their own explicit owner request.
-- Make installed-application inventory a baseline read-only capability. `list_local_applications` moves from `full` to `always`, and the account-access contract revision advances from 3 to 4 so remote authority metadata truthfully reflects the wider reviewer/editor/operator tool set. Restricted roles still receive projected external paths rather than raw absolute paths and still cannot open applications, inspect Accessibility/window contents, operate UI, control the browser, or gain shell/write authority.
-- Fix a path-projection privacy bug exposed by that widening. `AppAutomationManager.listApplications()` accepted the request context for cancellation/discovery but previously called its injected `displayPath()` without forwarding that context for application and warning paths; on a full daemon, a delegated account could therefore fall back to the local owner/full absolute-path display policy. Application inventory and discovery warnings now project paths with the originating request context, and the launch result uses the same context-aware projection. A real reviewer relay fixture requires both application and warning paths to omit the private temporary root.
-- Separate application inventory from desktop automation in both capability projection and routing. A new `application-capability-projection.mjs` projects backend support through the effective tool set so reviewer bootstrap **and direct inventory results** can report `discovery=true` without falsely advertising launch/inspection/action/screenshot capabilities. Routing gains an `application-discovery` set containing only `list_local_applications`; the existing `application` route contains only actionable desktop tools. Behavior tests pin both the discovery-only and full projections and prevent delegated routing from recommending unusable mutation surfaces. The extracted authority boundary is also an explicit package-inventory item, architecture boundary module with a 50-line ceiling, strict-JS typecheck root, and 100% function/branch critical-coverage target rather than relying on transitive import reachability.
-- Independent review rechecked multi-account authorization order, path projection, structured logging, current/reachable-history privacy, release-evidence boundaries, generated policy/tool documentation, source-module ceilings, package modes, consumer security, and SBOM closure. The new source module was initially created as `0600`; the existing package-mode contract correctly caught that drift and the file was normalized to `0644` instead of weakening the gate. Read-only surfaces that expose window/page contents remain `full` because they are privacy-sensitive reads rather than harmless inventory. No additional confirmed credential leak, swallowed-success branch, or authorization bypass was found.
-
-## 3.0.0-beta.84 - 2026-08-15
-
-- Supersede beta.83 before owner activation. beta.83 passed its focused matrix, 102-task fast plan, two independent 129-task full/candidate gates, privacy-history review, and direct-Node install-only verification, but was never activated, accepted, committed, or pushed. A subsequent host-routing investigation found additional shipped diagnostic/documentation/privacy-contract improvements, so none of beta.83's candidate evidence is reused; its Windows state-root canonical-path fix carries forward unchanged.
-- Correct the remaining host-routing diagnosis gap. Live `server_info` and `diagnose_runtime` proved beta.82 owner/full authority, 54 effective tools, daemon readiness, relay readiness, and healthy local probes while explicitly reporting that final host exposure is unknown. The ChatGPT workspace custom app was independently observed as enabled, and two fresh Work conversations successfully invoked `machine-mcp server_info`, while the user's quoted historical statements that Machine Bridge was "directly disabled by the platform" were both found in one older conversation. A pre-response failure is therefore still not observable by Machine Bridge and now explicitly names conversation/surface app routing plus stale host action/tool snapshots alongside filtering/gateway/client/platform possibilities. A fresh-conversation success is documented as evidence against a blanket server/platform outage, not as proof of the exact host-internal cause of an older conversation failure.
-- Harden browser-source privacy guidance. During the host investigation, bounded raw DOM serialization of an authenticated web application demonstrated that source markup can contain hidden bootstrap/session/account/authentication data that is absent from the rendered page. No such live data is retained in repository evidence. `browser_get_source` now advertises itself as a high-disclosure raw-markup read and directs routine semantic work to `browser_inspect_page`; privacy, security, local-automation, generated tool-reference, and routing regressions enforce the same boundary. Machine Bridge deliberately does not claim to redact arbitrary site-controlled HTML.
-- Refresh ChatGPT client guidance to current workspace-app semantics: workspace-level enablement, per-surface host routing, cached action/tool snapshots, and app refresh/review after MCP action/schema changes are separate from Machine Bridge daemon authority. Independent review also rechecked empty catches, destructive-path canonicalization, Windows tail fixtures, logging/privacy boundaries, debt markers, and large-module ceilings; no additional confirmed swallowed-success branch, destructive containment flaw, tracked secret, or portable-host regression was found.
-
-## 3.0.0-beta.83 - 2026-08-15
-
-- Supersede the accepted and guarded-pushed beta.82 exact head after hosted Windows independently validated the beta.81 launchd repair and then exposed the next production safety defect. Windows `check:platform` passed `service-platform:test` plus tasks 112-116 (`delegated-sandbox`, macOS trust/native-build synthetic boundaries, agent context, and browser page automation) before failing task 117 `self-test`. The state phase expected removal validation to reject a state root containing the currently executing Machine Bridge CLI, but that guard did not trigger on Windows.
-- Fix the current-entrypoint state-root removal guard instead of weakening the fixture. `assertSafeStateRootForRemoval()` passes an existing root canonicalized with ordinary `realpathSync`, while `currentEntrypointInsideStateRoot()` canonicalized only the entrypoint through the potential-path helper backed by `realpathSync.native`. Windows can represent the same drive through different path namespaces (for example ordinary `D:\\...` versus native `\\\\?\\D:\\...`); `path.relative()` then sees different roots and can return an absolute path, incorrectly classifying the live CLI as outside the state root. The guard now canonicalizes both the root and entrypoint through the same potential-path path family before containment, and falls back to `path.resolve()` for both together rather than mixing representations.
-- Add deterministic `node:path.win32` regression evidence for the ordinary/native namespace mismatch and same-namespace containment, plus an architecture guard requiring both operands to pass through the same canonicalizer. Marker validation, allowed namespaces, workspace/source exclusions, maintenance locking, generation-bound quarantine/removal, and all other uninstall semantics remain unchanged. Because packaged runtime/test/documentation bytes changed after beta.82 activation and acceptance, beta.83 requires a fresh candidate, owner activation, activated-package canary, live verification, acceptance, guarded push, and exact-head hosted validation.
-
-## 3.0.0-beta.82 - 2026-08-15
-
-- Supersede beta.81 before owner activation. The beta.81 launchd target-resolution repair passed its targeted checks, the 102-task fast plan, two independent 129-task full/candidate gates, and direct-Node install-only validation, but its exact tarball was never owner-activated, accepted, committed, or pushed. A fresh independent review then found additional packaged privacy and verification-boundary defects, so none of beta.81's candidate evidence is reused. The launchd repair carries forward unchanged.
-- Make recovered activation evidence synthetic rather than exception-derived. Verified post-readiness recovery previously copied the lower-layer `error.message` into `recoveryDetail`, which then flowed through CLI JSON/owner output and could be persisted in schema-2 activation records. Recovery now has one shared allowlisted reason-to-canonical-detail contract. Runtime recovery, persistent child-result validation, activation-record validation, and the activation writer all use that boundary. Historical bounded schema-2 detail remains readable but is normalized in memory; current writers never republish the historical raw text. Fault-injection tests place private-looking paths, reserved test URLs, and credential-shaped placeholders in lower-layer errors and require them to stay absent from returned and persisted recovery evidence.
-- Harden the generic non-replayable process pre-spawn boundary. A raw child/spawn exception before mutation no longer becomes an exposed `BridgeError` message; callers receive the fixed `process failed before spawn` result while the original exception remains available only as a local `cause`. Already-classified policy/cancellation errors retain their explicit public contracts, and post-spawn mutation uncertainty remains unchanged.
-- Close a verification blind spot around `src/shared`. Shared JavaScript runtime contracts are now included in the dynamic syntax scanner and in the correctness ESLint configuration/CLI, with self-tests proving `no-undef` and unused-import enforcement on the shared surface. The new activation-recovery contract is also an explicit strict-JS typecheck root, npm-package inventory requirement, architecture line-budget target, and critical-coverage module; measured coverage is 100% functions and 100% branches. The package gate also caught the newly created source file at owner-only `0600`; it was normalized to the existing `0644` source-file contract rather than weakening package-mode validation.
-- Correct current release documentation that still claimed schema-1 prerelease activation records were accepted and normalized. The executable release contract has intentionally been schema-2-only since the beta.62 hardening; schema-1 `previous` records are historical evidence rather than supported input to current release commands. Privacy/testing documentation now records the canonical recovery-evidence rule and the broader cross-platform fixture rule: injecting a logical platform must not silently reuse incompatible UID, mode-bit, signal, path, or service-manager evidence from the physical CI host.
-- Independent review also rechecked structured logging/audit output, empty-catch cleanup sites, package contents/modes, source-module reachability, later Windows platform tasks, tracked/reachable-history privacy, generated policy/tool references, consumer package security, and CycloneDX structure. No additional confirmed credential leak, swallowed-success branch, orphan source module, or stale current operational compatibility path was found. Because these packaged runtime/test/documentation bytes change after beta.81 candidate preparation, beta.82 requires a completely fresh candidate, owner activation, activated-package canary, live verification, acceptance, guarded push, and exact-head hosted validation.
-
-## 3.0.0-beta.81 - 2026-08-15
-
-- Supersede beta.80 after its exact candidate completed local fast/full/candidate gates, direct-Node install-only validation, owner activation, activated-package OAuth canary, live Worker/service/relay/browser/privacy verification, acceptance, commit, and guarded push. Exact-head hosted Windows directly validated both preceding portability repairs: `resource-admission:test` passed in 3.5 seconds and `macos-background-input:test` passed in 0.3 seconds. The next independent failure was `service-platform:test`, which invoked the synthetic launchd stop contract on Windows and failed before its mocked status read because `stopLaunchdService()` eagerly resolved `gui/<uid>` targets from the host's nonexistent `process.getuid()`.
-- Make launchd stop target resolution follow the mutation boundary. `stopLaunchdService()` now reads and classifies current status before resolving any launchd domain/service target; safely-unloaded and status-unavailable branches therefore require no UID and still perform no provider mutation. Only an actually loaded service resolves targets. The internal test dependency may supply an explicit UID for synthetic launchd mutation contracts, while the production default remains the current OS user's `process.getuid()`.
-- Strengthen the platform-independent regression instead of skipping Windows. Status-only launchd cases deliberately provide an invalid test UID and must still return without target resolution; loaded-service cases inject UID 501 and assert the exact `launchctl bootout gui/501/dev.machine-bridge-mcp.daemon` command. No service-provider selection, launchd label, production UID source, stop verification, or fallback semantics are relaxed. Because packaged source and tests changed after beta.80 acceptance and guarded push, beta.81 requires a fresh candidate, activation, live verification, acceptance, guarded push, and exact-head hosted validation.
-
-## 3.0.0-beta.80 - 2026-08-15
-
-- Supersede beta.79 after its exact candidate passed the 102-task fast plan, two independent 129-task full gates, direct-Node install-only verification, owner activation, the activated-package OAuth canary, live Worker/service/relay/browser/privacy checks, acceptance, commit, and guarded push. Exact-head hosted Windows then proved the beta.78 resource-admission repair was effective: `resource-admission:test` completed successfully in 3.8 seconds. The next independent failure was `macos-background-input:test`, whose synthetic forced-darwin fixture required exactly one helper compilation from the real host filesystem.
-- Keep production native-helper trust unchanged. `MacosBackgroundInputService` intentionally reuses a cached helper only when `executableRegularFile()` can prove a trusted regular file with POSIX executable bits and no group/other write bits. The cross-platform test forces `platform: "darwin"`, but on a real Windows host Node cannot use `chmod` to establish POSIX execute-bit evidence. The second synthetic helper call therefore recompiles instead of trusting that cache entry, even though real macOS reuse remains correct.
-- Make only the non-portable cache assertion host-aware. The fixture still requires a compile, validates the hashed owner-local source copy, helper payloads, native-result projection, invalid-coordinate rejection, probe behavior, and mutation settlement on Windows; exact compile-once cache reuse is asserted only where the host filesystem can provide POSIX mode evidence. No production macOS helper build, ownership, permission, digest, cache, or input-dispatch rule is relaxed. Because the packaged regression changed after beta.79 acceptance and guarded push, beta.80 requires a fresh candidate, owner activation, activated-package OAuth canary, live verification, acceptance, guarded push, and exact-head hosted validation.
-
-## 3.0.0-beta.79 - 2026-08-15
-
-- Supersede beta.78 before owner activation. The beta.78 resource-admission portability repair passed targeted validation, the 102-task fast plan, two independent 129-task full gates, candidate packing, and direct-Node disposable installation, but its exact tarball was never activated, accepted, committed, or pushed. A separate review then found packaged diagnostic, privacy, architecture, and documentation improvements, so beta.78 evidence is intentionally not reused. The Windows cwd fixture repair remains unchanged: host-canonical `path.resolve()` results are the contract and no resource-admission production behavior is relaxed.
-- Correct pre-runtime failure attribution. A successful `diagnose_runtime` now states only the fact it can prove—that the current request reached the local runtime—and explicitly says this evidence does not support a blanket current platform disable. A request rejected before Machine Bridge returns a structured response is marked **not observable by Machine Bridge**; host tool filtering, connector gateway, client routing, and platform policy remain possible causes that require host-side evidence rather than being collapsed into a platform diagnosis. Client guidance and regression coverage now encode the same distinction.
-- Harden Computer Use public error projection. Ambiguous mutation and post-observation results no longer echo lower-layer exception text into successful MCP result fields, and browser preflight/verification details no longer embed raw backend messages in exposed `BridgeError.details`. Public settlement retains the stable reason plus a coarse `error_class`; original causes remain local-only debugging evidence. Regressions inject private filesystem paths into trusted-input, wait, cancellation, and document-preflight failures and require those paths to stay absent from public results.
-- Reduce high-risk orchestration density without changing behavior. The fixed macOS Accessibility JXA implementation moved from `app-automation.mjs` into `app-automation-macos-jxa.mjs`; Computer Use request normalization/cross-field validation moved into `computer-use-arguments.mjs`. Architecture guards now inspect the extracted JXA secure-field and selector-index invariants directly, tighten the `app-automation.mjs` and `computer-use.mjs` line budgets, and add explicit growth ceilings for the largest browser-extension execution modules instead of allowing those boundaries to expand silently.
-- Clean live documentation drift. `UPGRADING.md` no longer labels the beta.61/beta.60 transition or its old npm-channel snapshot as current; it preserves only the historical persisted-state invariant needed to explain bounded migration readers. Architecture, local-automation, Computer Use, and client diagnostics documentation now name the actual module/error-projection boundaries. Independent privacy/security review found no obvious tracked credentials; the repository privacy gate also passed over tracked files and reachable Git history. Because packaged bytes changed after the beta.78 candidate was prepared, beta.79 requires a completely fresh candidate, owner activation, activated-package OAuth canary, live verification, acceptance, guarded push, and exact-head hosted validation.
-
-## 3.0.0-beta.78 - 2026-08-15
-
-- Supersede beta.77 after its exact candidate passed local fast/full gates, owner activation, packaged OAuth canary, live Worker/service/relay/browser verification, acceptance, and guarded push. Exact-head Windows then ran well past the beta.76 Wrangler cleanup-race failure and exposed the next independent portability defect in `resource-admission:test`: `resourceCommandEffectiveCwd()` correctly returned the host-canonical Windows path `D:\\tmp\\project-a`, while the fixture required the POSIX input literal `/tmp/project-a`.
-- Keep resource-admission production semantics unchanged. `resourceCommandEffectiveCwd()` deliberately canonicalizes both the base cwd and literal shell `cd` targets through Node `path.resolve()`, so contention keys use host-native absolute paths. The regression now compares both the narrowed literal cwd and the dynamic-cwd fallback against `resolve(...)`, preserving the same POSIX expectations while accepting the correct drive-qualified Windows result.
-- Because `tests/resource-admission-test.mjs` is packaged and changed after beta.77 acceptance and guarded push, beta.78 requires a fresh exact candidate, owner activation, activated-package OAuth canary, live verification, acceptance, guarded push, and exact-head hosted validation from scratch.
-
-## 3.0.0-beta.77 - 2026-08-15
-
-- Supersede beta.76 after its exact candidate completed local fast/full gates, owner activation, activated-package OAuth canary, live Worker/service/relay/browser verification, acceptance, and guarded push. Exact-head Windows then proved both preceding repairs were effective: `process-output:test` passed in 1.3 seconds and `managed-job-boundary:test` passed in 0.2 seconds. The next independent failure was `worker-types-generator:test`, whose cleanup-race fixture required a child-installed `SIGTERM` listener to print a marker after the completion grace elapsed.
-- Remove that host-signal assumption from the Wrangler lifecycle regression. Node's Windows signal model does not deliver `SIGTERM` to a JavaScript listener like POSIX; `subprocess.kill("SIGTERM")` uses Windows termination emulation instead. `runCompletedWranglerCommand()` now exposes its existing child-kill operation through an injectable internal `killChild` dependency whose default remains exactly `child.kill(signal)`. The cleanup-race fixture injects only the graceful cleanup request, records that the completion grace actually triggered `SIGTERM`, and lets the real child reach its existing 250 ms normal exit. This tests the lifecycle state-machine race directly without changing default production termination behavior or depending on OS signal delivery.
-- Keep the real hanging-Wrangler cases on the default kill path, so bounded graceful cleanup and forced-cleanup behavior remain exercised against actual subprocesses. Because the packaged lifecycle script and regression changed after beta.76 acceptance and guarded push, beta.77 requires a fresh exact candidate, owner activation, activated-package OAuth canary, live verification, acceptance, guarded push, and exact-head hosted validation from scratch.
-
-## 3.0.0-beta.76 - 2026-08-15
-
-- Supersede beta.75 after its exact candidate passed the local 102-task fast plan, 129-task release-candidate gate, owner activation, activated-package OAuth canary, stable-path protocol-3 browser handshake, real background-tab DOM click/hover verification, one-shot snapshot rejection, runtime/privacy audit, local acceptance, and guarded push. Exact-head Windows then proved the beta.75 process-session repair itself was effective: `process-output:test` completed successfully in 1.2 seconds. The Windows platform job instead failed later in `managed-job-boundary:test` because that test unconditionally required an observed directory-descriptor mode of `0o700`, while the production resolver deliberately does not open managed-job directories with POSIX descriptor flags on Windows.
-- Preserve the existing platform-specific managed-job boundary instead of changing runtime behavior to satisfy the fixture. POSIX continues to pin an already-existing directory with `O_RDONLY | O_NOFOLLOW | O_DIRECTORY` and an explicit private `0o700` mode argument. Windows continues to use its existing real-directory `lstat` plus canonical/path device-and-inode identity checks rather than a POSIX-only directory-descriptor open. The testing contract already documented the explicit mode requirement as POSIX-only; the hosted failure exposed that the executable fixture had not encoded the same boundary.
-- Make `managed-job-boundary:test` platform-correct. The real-host `openSync` mode assertion now runs only off Windows, while a synthetic `platform: "win32"` case supplies an `openSync` implementation that would fail if called and proves the Windows root resolver returns the canonical directory without entering POSIX descriptor pinning. No managed-job production source or permission/identity rule is relaxed by this repair.
-- Because `tests/managed-job-boundary-test.mjs` is part of the candidate package and changed after beta.75 acceptance and guarded push, beta.76 requires a fresh exact candidate, owner activation, activated-package OAuth canary, live verification, acceptance, guarded push, and exact-head hosted validation from scratch.
-
-## 3.0.0-beta.75 - 2026-08-15
-
-- Supersede beta.74 after its exact candidate passed the full 129-task gate, owner activation, packaged deployed OAuth canary, stable-path protocol-3 extension handshake, live background-tab DOM click/hover verification, one-shot replay rejection, runtime/privacy audit, local acceptance, guarded source push, and hosted Ubuntu/full, macOS/platform+install, package-audit, governance, dependency-review, workflow-policy, and both CodeQL jobs. The only exact-head failure was Windows `check:platform`, where `process-output:test` spent about 31 seconds and finally reported an incomplete process-session shutdown from `testSessionAuthorityRevocation`.
-- The Windows failure was a test-portability defect, not evidence that the production five-second shutdown contract was too short. `terminateProcessTree()` on Windows returns true once `taskkill.exe` is successfully spawned, because target settlement is asynchronous; the synthetic failed-delivery fixtures instead assumed that a fake child's `kill() => false` would be consulted synchronously. The forced-kill assertion therefore failed on Windows, skipped deletion of its fake session, and the test's `finally` cleanup waited on that impossible synthetic session and replaced the original assertion with a teardown error. The earlier beta.72 fifteen-second fixture override merely stretched the same failure twice, matching the roughly 31-second hosted duration.
-- Make the synthetic failure cases platform-independent by explicitly injecting `manager.terminateTree = () => false` only while testing definite delivery rejection, restoring the real tree terminator afterward, and deleting every synthetic session in its own `finally` block so a failed assertion cannot contaminate or mask final cleanup. The delivered-but-unsettled case keeps its explicit 100 ms synthetic deadline. Remove the test-only fifteen-second manager override so the real current-version session cleanup again exercises the unchanged production-default five-second settlement contract.
-- No runtime process-tree or process-session implementation is relaxed by this repair. Because the packaged test bytes changed after beta.74 acceptance and guarded push, beta.75 must repeat candidate preparation, owner activation, candidate-bound deployed OAuth canary, live verification, acceptance, guarded push, and exact-head hosted checks from scratch.
-
-## 3.0.0-beta.74 - 2026-08-14
-
-- Supersede beta.73 after its exact candidate was owner-activated, its packaged deployed OAuth canary passed, the new stable release-channel extension path was loaded successfully, and the browser completed an exact `3.0.0-beta.73` protocol-3 handshake with Computer Use/CDP capabilities present. Real background-tab acceptance then exposed a separate blocker: ordinary `browser_inspect_page` could read a complete synthetic tab while `computer_observe` intermittently timed out, and a snapshot-bound click later hit the five-second browser preflight timeout before any safe replay decision could be made. Beta.73 therefore proves the stable extension-path migration but is not accepted or publishable.
-- Bound the shared Chromium DevTools session lifecycle instead of letting raw `chrome.debugger` promises hold a tab queue indefinitely. Attach and each `sendCommand` now have five-second settlement deadlines, detach has a bounded cleanup deadline, and a late successful attach after timeout schedules best-effort detach. A timed-out command releases the per-tab session queue instead of waiting for the outer broker timeout while subsequent Computer Use requests accumulate behind it.
-- Preserve failure semantics across that new deadline. DevTools observation treats the internal timeout marker as a fatal CDP-capture failure so `observe_computer` can use its existing semantic fallback rather than swallowing the timeout and issuing more CDP commands. Trusted Input already marks dispatch before invoking each Input command; a timed-out Input command therefore remains `dispatchStarted=true`, `safeToFallback=false`, and resolves through the existing unknown-mutation settlement instead of DOM fallback or automatic replay.
-- Regression coverage makes a CDP command promise never settle, verifies that the observation rejects promptly, detaches, and a second observation on the same tab can run; a separate trusted-hover fixture verifies that an Input command timeout is not replay-safe. Focused trusted-input, DevTools-observation, and browser-Computer-observation checks pass. Because packaged bytes changed after beta.73 activation/canary, beta.74 must repeat exact candidate preparation, owner activation, candidate-bound canary, live background-tab verification, hosted exact-head checks, and acceptance from scratch.
-
-## 3.0.0-beta.73 - 2026-08-14
-
-- Supersede beta.72 after its exact candidate was owner-activated and passed the packaged deployed OAuth canary, but browser acceptance could not begin: the documented upgrade flow said to reload the unpacked extension while local-candidate `extension_path` pointed inside a versioned release runtime that activation later pruned. Chrome retains the original unpacked source directory, so reloading an extension loaded from a prior candidate could not switch it to the new candidate directory. The broker correctly rejected the resulting stale/no-hello candidate and kept `extension_reload_required=true`; beta.72 is therefore not accepted or publishable.
-- Give local release candidates one stable owner-only `release-channels/browser-extension` source directory. A versioned candidate runtime reports that stable path, while ordinary checkout/global runtimes keep their own package path. After Worker/daemon convergence is verified, activation copies the exact installed candidate extension into the stable directory with bounded no-symlink reads, atomic per-file replacement, stale-file removal, and `manifest.json` committed last as the version marker; only then may inactive candidate runtimes be pruned or activation evidence be written.
-- Existing users whose unpacked extension was loaded from a now-pruned beta.72-or-earlier candidate runtime need one migration: Load unpacked from the beta.73 `extension_path`. Subsequent local-candidate upgrades keep that path stable and require only Reload plus any newly requested browser permission. Pairing replacement still requires the existing explicit extension-icon gesture when browser-local pairing belongs to different local state.
-- Candidate-runtime/store regression coverage now proves same-path cross-version publication, manifest-last ordering, stale-file cleanup, source-symlink rejection, candidate-runtime path routing, and release activation ordering. State-root removal recognizes the bounded real-file browser-extension namespace and still fails closed on unexpected entry types.
-
-## 3.0.0-beta.72 - 2026-08-14
-
-- Supersede beta.71 after its exact candidate was owner-activated, passed the packaged deployed OAuth canary, passed live background-tab Computer Use click/hover verification, and was locally accepted, but the first exact-head hosted PR checks found portability and static-analysis defects that the macOS release gate could not exercise. Ubuntu exposed a test-only assumption that the default Linux sampler could not read `/proc/pressure/*`; Windows exposed an authority-revocation fixture whose final cleanup reused the production five-second teardown deadline even though the test was not asserting that deadline; CodeQL 2.26.3 rejected nine newly introduced findings before merge. Beta.71 therefore remains historical live evidence but is not publishable.
-- Make the Linux resource-admission fixture platform-correct while retaining the injected no-PSI regression, and give the authority-revocation fixture a bounded fifteen-second cleanup settlement budget without changing the runtime's fail-closed five-second process-session shutdown contract. The ordinary live-child cleanup test continues to exercise the default runtime deadline.
-- Resolve the CodeQL findings rather than blanket-accepting them. Browser drag cleanup removes redundant press/release flags while preserving the same best-effort release after every attempted press; form and Computer Use validation remove provably unreachable branches; application window-box comparison relies on the already-normalized sole caller contract. macOS screenshot capture and the manual background-input smoke now perform size/type validation and content reads through the same open file handle, eliminating the reported path `stat`/`read` races.
-- The first beta.72 complete candidate rerun exposed one more real teardown race in the packaged full-access self-test: `LocalRuntime.stop()` is asynchronous, but the fixture discarded its promise and immediately removed the temporary root while managed-job shutdown could still be writing below `jobs/`, producing `ENOTEMPTY`. The fixture now awaits complete runtime shutdown before deleting its sandbox, preserving the runtime's close-settled ownership contract instead of racing its own cleanup.
-- Focused DevTools input, page automation, Computer Use, application automation/screenshot, macOS background-input, process-output, resource-admission, and syntax checks pass after the repair. Because packaged source changed after beta.71 activation and acceptance, beta.72 must repeat complete candidate preparation, owner-terminal activation, candidate-bound deployed OAuth canary, observed live browser verification, hosted exact-head checks, and acceptance from scratch.
-
-## 3.0.0-beta.71 - 2026-08-14
-
-- Supersede the owner-activated but unaccepted beta.70 candidate after real browser Computer Use smoke exposed a background-tab settlement defect. The beta.70 extension paired successfully at protocol 3 and `computer_observe` returned coherent DOM/Chromium-Accessibility snapshots, but DOM `click` and `hover` could time out at the broker after dispatch while a read-only inspection proved the click had actually changed the page. The existing non-replayable settlement correctly returned an unknown outcome and forbade same-action retry, so no duplicate mutation occurred, but a normal browser action could not reliably produce confirmed live evidence. Beta.70 is therefore not accepted or publishable for these bytes.
-- Keep the existing pointer safety checks and remove their dependency on throttled page-renderer timers. Packaged page automation now requests its bounded 50/100 ms actionability waits from a same-extension service-worker timing endpoint; the endpoint accepts only the current extension identity and exact integer delays from 1 through 250 ms. If the extension timing service becomes unavailable, the action still fails through the existing definite/unknown side-effect boundary rather than bypassing stable-box or pointer-hit validation. The renderer `setTimeout` fallback remains only for non-extension/unit environments where `chrome.runtime.sendMessage` is absent.
-- Add regressions that make the old failure deterministic by disabling renderer timers while retaining the extension timing service, and separately pin the service-worker sender/range boundary. Focused page-automation, service-worker, trusted-input, browser-request-settlement, Computer Use, browser-security, and module-boundary checks pass, followed by the frozen 102-task fast plan. Because this repair changes packaged extension bytes after beta.70 activation and deployed OAuth canary evidence, beta.71 must repeat exact candidate preparation, owner-terminal activation, candidate-bound deployed canary, observed live browser verification, and acceptance from scratch.
-
-## 3.0.0-beta.70 - 2026-08-14
-
-- Integrate the independently developed Computer Use vNext capability onto the current beta.69 codebase without merging its obsolete parallel MCP session/resumption architecture. The native MCP contract remains request-scoped `2026-07-28`; remote initialization compatibility remains stateless and bounded, with no `Mcp-Session-Id`, recovery GET, `Last-Event-ID`, persisted replay/session state, or legacy prepare/subscribe delivery descriptors. The packaged catalog grows from 52 to 54 tools by retaining beta.69 `git_commit` and adding owner-scoped `computer_observe` / `computer_act`.
-- Add snapshot-bound browser and macOS application control. `computer_observe` combines bounded semantic evidence with native MCP screenshot content when available; `computer_act` requires the exact one-shot snapshot, performs read-only preflight, consumes mutation authority before backend handoff, dispatches at most once, captures post-state, and reports dispatch/effect settlement separately. Browser identity is bound to tab/document/frame/semantic evidence with high-confidence backend-node trusted input; application identity binds PID to exact libproc process birth plus owner-window evidence. Continuation, semantic delta, explicit expectation verification, screenshot-bound point/drag/scroll actions, and conservative retry guidance are included without exposing caller-selected JavaScript, JXA, raw CDP methods, backend-node IDs, or unbound screen coordinates.
-- Extend the packaged browser extension with fixed shared DevTools session/observation modules, Chromium Accessibility plus DOMSnapshot fusion, frame/document epoch checks, screenshot provenance, trusted drag/wheel/text input, mutation-settlement tracking, and cancellation gates. The existing beta.69 pairing design is retained unchanged: process-owned one-shot fragment bootstrap, broker HMAC proof, extension identity/version/capability checks, and token-free public pairing status continue to be authoritative. Browser mutation classification now has one source, and transport send/timeout/disconnect/malformed-response uncertainty after dispatch is a fixed non-retryable unknown outcome while pre-send/read-only failures preserve their definite/retryable semantics.
-- Extend macOS application automation with bounded window screenshots, PID-generation-bound Accessibility state, exact private value readback for verification, owner-window geometry, and a fixed native input helper. Snapshot-bound visual input remains disabled unless `MBM_MACOS_BACKGROUND_VISUAL_BACKEND=skylight-experimental` is explicitly configured and its probe succeeds. A new manual smoke runner uses a synthetic temporary application fixture and refuses to run without both the experimental setting and `--run`; it is intentionally outside automatic CI/TCC-dependent release preparation.
-- Close two settlement gaps exposed by the integration. Fixed launch/JXA/native-input subprocesses now preserve definite pre-spawn failures but report timeout, cancellation, process error, resource-binding loss, or nonzero unknown settlement after process start as non-retryable `process_outcome_unknown_after_spawn`; the ordinary process API retains its historical behavior. Patch transactions now separately expose `patch_recovery_incomplete` when rollback of already-committed user-file state fails, while staging-only cleanup failure remains an internal cleanup fault.
-- Apply the ordinary 7 MiB MCP tool-result boundary before publishing a Computer Use snapshot. If screenshot content alone would exceed the result, Machine Bridge removes the image and pixel-action authority but retains the still-valid semantic snapshot and private identity evidence. Post-action capture applies the same rule without losing the already-established dispatch/effect settlement or bounded `post_snapshot_id`; both capture-level and action-result-level screenshot omission now expose the structured `tool_result_budget` reason, while semantic-only compaction does not invent a screenshot omission. `post_screenshot_included` reflects actual returned native image content rather than policy intent. Regressions cover oversized initial and post-action application images and preserve non-replayable continuation semantics.
-- An independent integration review challenged the seams added around the vNext port rather than assuming reference-source parity was sufficient. It corrected the actual-vs-requested post-image flag, unified two-stage result-budget observability, removed a latent false screenshot-omission reason from semantic-only compaction, and found stale snapshot-version documentation after the page module had moved to version 3. Browser snapshot-version documentation is now executable architecture policy. README and system overview also distinguish current native MCP from bounded stateless initialization compatibility so the removed session/replay model cannot return through documentation drift.
-- The first complete release gate exposed a separate integration artifact: 17 ported browser/Computer Use/native/documentation files still had owner-only `0600` checkout modes and were rejected by `package:test`. The source modes are normalized to ordinary non-executable `0644` rather than weakening package hygiene; the targeted package manifest check now accepts the 455-file package inventory. A final repository-mode inventory also normalized six non-packaged Computer Use test fixtures that retained the same accidental owner-only mode.
-- A subsequent candidate rerun exposed an unrelated but real resource-coordinator race under concurrent machine load: a reader could observe the exclusive publisher's legitimate short-lived staging inode and fail a heavy command with an internal error even though no corrupt lease/waiter existed. Live staging now has the stable `MBM_RESOURCE_STAGING_BUSY` classification; transaction readers release the lock generation and perform at most four five-millisecond retries, persistent live ownership still fails closed, and process admission maps exhausted staging/transaction contention to the existing retryable resource-unavailable result. Existing dead-publisher recovery remains identity-bound, and the original `full-access` path plus focused admission/process tests cover the repaired race.
-- A second independent post-closure review found three additional cross-layer defects and two governance gaps. Computer Use snapshot TTL and application verification deadlines had inherited an injectable `Date.now()` duration clock, while resource-backed exact-value verification handles still used wall time despite the manager already owning a monotonic clock; snapshot authority now lives in a dedicated bounded store, all three lifetimes are monotonic, and clock rollback has regression coverage. Browser mutations whose extension-side result was oversized or unserializable were already non-retryable but lost structured side-effect settlement at the broker boundary; direct application unknown outcomes likewise dropped lower-level process settlement metadata. Both paths now preserve structured `side_effects_started` / `termination_requested` / `effect_settlement` evidence. Architecture now governs the Computer Use core/observation/recovery/native/browser modules and extension responsibility sizes, pins the local and extension 7 MiB result caps together, and critical coverage gates the Computer Use kernel rather than only its budget helper. Cheap DevTools input/observation, browser Computer Use, service-worker, and application-automation fixtures move into the fast plan.
-- Keep the new responsibilities bounded instead of expanding central orchestrators: browser request settlement, non-replayable process settlement, and Computer Use result-budget handling are extracted into dedicated modules with architecture line caps; `LocalRuntime` remains below its constructor responsibility ceiling. The three settlement/budget boundaries now have explicit critical coverage thresholds and focused behavior fixtures, and BrowserOperationService coverage includes the Computer Use adapter entrypoints. Generated Tool/Policy references, local automation, architecture, security, threat-model, privacy, logging, overview, and testing documentation describe the same current contracts. The fast verification plan now contains 102 tasks after promoting five high-value GUI security fixtures; the final frozen fast run is required before candidate preparation. After normalizing the ported file modes, the complete 129-task plan also passes 129/129, including package, SBOM, install, stdio, Worker integration, and OAuth-browser verification; candidate preparation still reruns the complete frozen gate against the exact packaged source.
-
-## 3.0.0-beta.69 - 2026-08-13
-
-- Supersede beta.68 after its exact candidate was owner-activated, matched candidate provenance, passed the packaged deployed OAuth canary and live Worker/daemon/service verification, and was locally accepted, but the next ordinary local `git commit` could no longer be issued reliably through the generic MCP process surface. Machine Bridge's owner/full authorizer still permits local execution; the unstable boundary was the public tool shape: `run_process`/`exec_command` correctly advertise destructive/open-world arbitrary execution, so an upstream host safety layer may stop a repository-local commit before the request reaches the daemon. Beta.68 was never committed or pushed, its acceptance is removed, and the packaged repair moves to beta.69 rather than weakening the generic process annotations.
-- Add a narrow `git_commit` tool for the common local-history operation without weakening generic process risk signaling. It is available only at the existing direct-exec policy level, so an edit-only account cannot create history. The trusted Git executable uses fixed plumbing: `write-tree`, `commit-tree`, then compare-and-swap `update-ref` against the previously observed HEAD. The message crosses stdin rather than argv; repository hooks, signing, editor invocation, staging, amend, push, tag, and publication are absent from the operation. A concurrent HEAD change fails closed instead of overwriting the competing commit, and an empty staged tree is rejected. Because a control experiment proved that even `write-tree` can execute a repository clean filter, structured commit also rejects executable filter configuration before touching the staged tree.
-- Move Git repository discovery in front of every implementation-owned Git subprocess. Machine Bridge now walks only authority-permitted ancestors, rejects symbolic `.git` markers, reads bounded no-follow single-link gitdir/commondir pointer files, canonicalizes and authorizes the Git/common/object metadata roots plus recursive alternate object stores, and only then runs status/diff/log/show/commit. This closes a pre-existing linked-worktree/submodule class where a workspace-local `.git` pointer could make fixed read-only Git tools cross the configured filesystem boundary; alternate object stores receive the same recursive authority check, partial-clone lazy fetch is disabled, and `git_commit` separately authorizes its canonical worktree/object/ref metadata write roots before mutation.
-- A second independent Git challenge reproduced repository-controlled clean-filter execution from both structured status and ordinary working-tree diff under the old fixed argv. Structured Git now disables optional index refresh, system config/attributes, lazy fetch, terminal prompts, signatures, submodule traversal, and external diff/textconv where applicable; working-tree/index-conversion operations fail closed on executable repository filters or external config/attributes indirection. `git_log` additionally requires exact record framing so malicious control characters cannot shift an unrequested author email into another projected field. Direct `.git` metadata is classified sensitive for delegated file access.
-- Redacted local status now omits active, pending, and retired public/private JWK coordinates plus local key tags while retaining bounded diagnostic key identity/provider/timestamp metadata.
-- Add real temporary-repository regressions for staged-only commit behavior, hook/signing suppression, stdin message isolation, empty-index and UTF-8 size failures, actual Git metadata write-root authorization, filter/include fail-closed behavior, alternate-object authority, CAS ref conflicts, malicious-log framing, local-state JWK redaction, and linked-worktree denial before any unauthorized Git subprocess. Catalog/schema/handler/authorization/routing tests now cover the 52-tool contract, and generated Tool Reference documentation is synchronized from the catalog.
-- A fresh independent beta.69 review tightened structured Git discovery again before candidate freeze. Restricted callers now reject symbolic-link or special-file descendants inside Git metadata trees; literal path names cannot be reinterpreted as pathspec magic; `project_overview` reuses the same filesystem-first repository discovery instead of a second raw probe; and uncommon symbolic refs accepted by Git are no longer rejected by a narrower local grammar. External diff-order indirection plus partial-clone/promisor configuration also fail closed.
-- Full verification exposed a separate Worker ready-path timing drift: ordinary async scheduling could be counted as reconnect recovery even when a verified daemon was already available. `daemon-ready-dispatch.ts` now assigns zero recovery delay to the already-ready path and measures only actual recovery waiting; focused runtime and Wrangler integration regressions preserve the original execution/settlement deadline contract.
-- A third independent review found that the new plumbing commit path could flatten an in-progress merge into a single-parent commit while leaving `MERGE_HEAD` behind. `git_commit` now refuses merge, rebase, cherry-pick, revert, bisect, and sequencer state before `write-tree`; exhaustive marker coverage plus a real merge repository prove the rejection leaves HEAD/state unchanged. Restricted Git metadata-tree inspection now observes the runtime cancellation signal instead of traversing up to its entry ceiling after a call is cancelled or times out, and the five fixed Git process environment values have one authoritative source shared with the exact-value validator. The same review removed an obsolete `SECURITY.md` section that still described the retired resumable/session-backed MCP transport and added a documentation contract so those replay semantics cannot silently return.
-
-## 3.0.0-beta.68 - 2026-08-13
-
-- Supersede beta.67 after its exact accepted commit was guarded-pushed and mandatory hosted provider checks exposed four defects that local macOS verification could not close. Ubuntu reproduced an inode-reuse ABA in managed-job retirement; Windows exposed an unreferenced process-session revocation settlement timer that could leave top-level await unsettled; hosted macOS exposed lifecycle-test ordering that started a new termination case while a prior timeout was still draining and attached its rejection observer too late; JavaScript/TypeScript CodeQL rejected two read-only descriptor opens that omitted explicit private modes. Because the repair changes packaged source after beta.67 activation and acceptance, beta.67 remains historical live evidence but cannot authorize these bytes; beta.68 uses a new prerelease identity and must repeat candidate activation, deployed canary, live observation, and acceptance.
-- Pin managed-job directories across the destructive quarantine rename on POSIX instead of relying on pathname reinspection alone. The pre-rename generation still matches the full filesystem identity, while an open directory descriptor keeps the original inode referenced through rename so a remove/recreate race cannot recycle that numeric inode before the moved-path device/inode check. This mirrors the state-root retirement boundary and fixes the Linux ABA without incorrectly comparing ctime after rename, because rename itself legitimately changes directory ctime.
-- Keep process-session authority-revocation/shutdown settlement deadlines referenced while the caller is awaiting them. Ordinary `read_process` waits remain unreferenced, but a security-critical revocation cannot allow an otherwise-idle Node process to exit with an unsettled top-level await merely because its deadline timer was `unref()`ed. The Windows regression now completes under the production settlement contract.
-- Make the runtime self-test observe lifecycle boundaries rather than machine speed. After a deliberate timeout it waits within the production process-tree escalation budget for tracker cleanup before beginning the next termination case, waits for the new process to increase tracker ownership, and attaches a rejection observer immediately so a fast SIGTERM cannot become an unhandled rejection. This preserves the production resource coordinator instead of bypassing it for the test.
-- Add explicit private modes to the read-only project-metadata descriptor (`0600`) and state-root directory pin (`0700`). These flags do not create the existing targets, but make the least-privilege intent explicit at the open boundary and remove the ambiguous temporary-file sink shape reported by hosted CodeQL without adding a SARIF exception or weakening the zero-unaccepted-findings gate.
-
-## 3.0.0-beta.67 - 2026-08-13
-
-- Supersede the activated beta.66 candidate after a relay-availability incident review found real transport interruptions that did not correspond to daemon-process restarts. Historical logs include repeated abnormal WebSocket interruption/connect-timeout episodes and one reconnect-grace expiry that discarded a retained completed result; a fresh observation during this review reproduced a short `1006` relay interruption while the daemon remained healthy. macOS sleep/dark-wake explains some multi-minute event-loop stalls, but a separate long outage occurred without a matching sleep event, so VPN/TUN/network transport and local suspend remain distinct fault classes rather than one assumed root cause. Beta.66 has activation evidence but no repository acceptance record for this source generation; the packaged relay repair therefore moves to a new prerelease number instead of reusing the activated version.
-- Keep short event-loop stalls tolerant but stop treating a many-minute local pause plus continued relay silence as a fresh liveness grace period. If measured event-loop lag already exceeds the heartbeat timeout plus the full recovery grace and the relay is still silent beyond the heartbeat timeout, the daemon treats the old WebSocket as stale and enters the existing same-daemon reconnect/rebind path immediately. Fresh inbound relay traffic processed after resume preserves that proven-live socket on the ordinary recovery path. A deterministic relay regression covers the fresh-inbound race as well as the stale-silent boundary.
-- Make reconnect-grace expiry machine-queryable. `RelayCallRecovery` now emits the warning event `relay.calls.reconnect_expired` with only aggregate `cancelled_calls`, `discarded_results`, and `grace_ms`; no arguments, results, account identity, or call identifier is added. Runtime tests pin the aggregate fields, and operations/testing documentation now distinguishes short-stall recovery from long-pause reconnect.
-- Complete an independent post-fix review across Worker waiter capacity/deadline accounting, release-runtime provenance, resource admission, state-root retirement, logging, privacy, documentation, and module boundaries. The review kept delegated pending activity hidden, preserved the 30+2 Worker capacity contract, found no tracked secret/key artifacts or TODO/FIXME/HACK residue, and explicitly scoped the stale historical audit wording about the first failed beta.66 activation so it cannot be read as denying the later successful beta.66 activation.
-
-## 3.0.0-beta.66 - 2026-08-13
-
-- Supersede beta.65 after its exact candidate passed frozen local/release gates, was activated by the owner, reported matching live daemon/Worker identity, completed the candidate-bound OAuth canary, and was locally accepted. A second independent staged-diff review before commit then found another member of the same resource-accounting family: npm's project/user configuration can redirect `npm run` through `script-shell`, so a canonical outer npm argv could still execute an arbitrary wrapper before the canary entrypoint while retaining the zero-resource `release-control` profile. An isolated control project reproduced that behavior, while the real beta.65 checkout reported `script-shell=null`, so the successful live canary itself was not affected. Beta.65 acceptance was deleted; beta.65 was never committed, pushed, tagged, released, or published.
-- Move the liveness exception off npm lifecycle execution entirely. A subsequent independent pre-candidate review also rejected the first direct-Node form because `node scripts/release-oauth-canary.mjs ...` executed the mutable checkout module graph while admission proved only the canary entry file bytes; a same-version change in one of its local imports could therefore run unaccounted work. Beta.66 had not yet produced or activated a candidate, so the same beta.66 generation was tightened before freeze. Only exact direct Node argv `node <activated-runtime-package>/scripts/release-oauth-canary.mjs --allow-live-oauth-canary` may become `release-control`: the script operand must be absolute and canonicalize to the running package's own canary, the resolved Node executable must canonicalize to the daemon's `process.execPath`, the environment must contain none of the guarded Node/native debugging, profiling, TLS, loader, or resource-startup overrides, and the cwd package/version plus canary source bytes must match the running package. The packaged canary imports only activated-runtime modules while treating `process.cwd()` as the candidate/evidence data root. For prereleases it also canonicalizes its own package root and requires it to equal the package root containing activation `runtime_entry`, so a workspace/developer copy cannot produce indistinguishable release evidence even when its entry bytes match. Across both prerelease and stable channels it additionally requires the currently verified, startup-ready service daemon to report the candidate version, an `entryScript` canonically equal to that same package's `bin/machine-mcp.mjs`, and a canonical Node executable equal to the canary's `process.execPath`, and a daemon-lock Node runtime version equal to `process.versions.node`; this closes the future stable provenance gap without introducing a second activation-record schema. It requires exactly one `--allow-live-oauth-canary` argument, requires an empty `process.execArgv` so ordinary invocations cannot add Node preload/loader/debugger/profiler/runtime flags, and refuses `--state-dir`, `--workspace`, or any other unrecorded local-state override before state access, so acceptance evidence cannot silently describe a noncanonical state root. Workspace-relative Node, npm lifecycle, copied canary, shell-wrapped, and alternate-package-manager forms remain ordinary accounting. Regression coverage pins PATH shadowing, relative PATH resolution, Windows executable lookup, Node startup/environment injection, npm lifecycle fallback, activated-runtime entry identity, exact canary argv, and runtime/workspace byte identity.
-- Make the canary independent of `npm_execpath` while retaining its package-content proof. The reusable `npm-cli.mjs` resolver locates a validated npm CLI from the running Node installation layout, including a package-manager prefix derived from Homebrew Cellar Node paths; the release canary disables lifecycle-provided and unrelated fallback locations before its explicit `--ignore-scripts` pack dry-run. The beta.66 npm version, Git tag, and GitHub Release were confirmed unused before the bump. Because these packaged bytes differ from the accepted beta.65 candidate, beta.66 must repeat the full frozen candidate, owner-terminal activation, deployed canary, live observation, and acceptance sequence.
-- Reject the first prepared beta.66 candidate before activation after the owner-terminal command hit the promotion-content preflight with `npm pack dry-run returned an invalid file mode: 384`. The two post-candidate source files `src/local/resource-foreground-wait.mjs` and `src/worker/daemon-ready-waiters.ts` had been created as owner-only `0600`; promotion identity deliberately permits only package-safe `0644`/`0755`. That source/candidate check runs before the hardened npm session, candidate-runtime installation, Worker deployment, service handoff, or activation-record write, and no beta.66 activation record exists. Both files, plus the later extracted recovery-budget module, are normalized to `0644`. A tarball-to-current-package comparison also proved that the checkout had accumulated packaged runtime changes after the old candidate was frozen, so that candidate is discarded rather than repaired in place and beta.66 must be regenerated from the final reviewed tree. To prevent another owner-terminal attempt from being used as an agent-side freshness check, the canonical agent preflight is now direct Node argv `node scripts/start-release-candidate.mjs --install-only`, which runs the same source/promotion/tarball checks plus a disposable candidate install without Worker/service activation or activation evidence. The install-only path resolves a validated npm CLI from the running Node installation instead of trusting lifecycle `npm_execpath`, so project/user `script-shell` cannot interpose before the proof. The release workflow requires this agent preflight immediately before owner handoff.
-- Harden the post-candidate availability work uncovered while reviewing that failed activation. Production foreground process resource admission no longer gets accidentally pinned to the historical two-second constructor override: `resource-foreground-wait.mjs` derives the default from 20% of the execution budget with a two-second floor, ten-second ceiling, and never beyond the execution timeout, while process-session startup defaults to ten seconds and explicit test/diagnostic overrides remain bounded at thirty minutes. New remote calls may wait up to ten seconds for a briefly reconnecting verified daemon, but that wait is capped by and deducted from the call's original execution/settlement budget using monotonic elapsed time, so the 60-second execution plus five-second Worker-settlement envelope cannot grow to 75 seconds and a one-second call cannot wait ten seconds before dispatch. Pre-dispatch daemon-ready waiters and already-detached pending calls share the same 30 ordinary + 2 reserved-control admission algebra, preserving `diagnose_runtime`/`list_roots` recovery capacity during an outage. Owner `server_info` keeps `pending_calls.active` as dispatched-call count while adding privacy-safe pre-dispatch waiter and combined capacity totals, so diagnostics no longer under-report the admission slots consumed during reconnect; delegated accounts continue to receive only hidden-activity capacity limits. Focused runtime/resource/Worker/architecture tests and critical-coverage thresholds pin the default wiring, deadline consumption, cancellation, waiter cleanup, combined-capacity behavior, and diagnostic projection.
-
-## 3.0.0-beta.65 - 2026-08-13
-
-- Supersede beta.64 after its exact candidate was owner-activated, the live daemon/Worker reported `3.0.0-beta.64`, the deployed OAuth canary started immediately and passed authorization-code exchange, authenticated MCP, refresh rotation, refreshed MCP, and cleanup, and local acceptance was recorded. An independent staged-diff review before commit then found one remaining member of the same resource-admission failure family: the release-control exception proved the cwd package/script identity but still identified the outer package manager only by basename `npm`. A PATH-resolved wrapper or lookalike could therefore inherit zero-resource accounting even though generic light commands had already been hardened to executable identity. Beta.64 was never committed, pushed, tagged, released, or published; its acceptance record is removed and cannot authorize beta.65.
-- Bind the release-control exception to the executable that the OS would actually invoke. `resource-release-control-executable.mjs` resolves the first npm candidate in spawn search order instead of skipping an untrusted first match, canonicalizes its target, requires an npm/npm-cli target name, rejects cwd/HOME-contained targets and POSIX group/world-writable files, and supports explicit absolute npm paths. Only after that executable proof, the existing exact npm `run release:oauth-canary` lexical contract, and the runtime-bound cwd package/entrypoint proof all succeed does `resource-process-admission.mjs` grant the `release-control` light profile; otherwise the command falls back to ordinary heavy/adaptive accounting. Focused regressions cover a trusted npm, a HOME-shadowing first PATH match, an unsafe writable npm, a missing executable, a cwd-local executable, absolute invocation, and non-npm targets.
-- Reserve `3.0.0-beta.65` only after confirming the npm version, Git tag, and GitHub Release are unused. Because the fix changes packaged runtime bytes after beta.64 activation, beta.65 must repeat frozen fast/full/release-only verification, exact candidate preparation, owner-terminal activation, deployed OAuth canary, observed live verification, and acceptance before any commit or push.
-
-## 3.0.0-beta.64 - 2026-08-12
-
-- Supersede the activated but unaccepted beta.63 candidate after the deployed OAuth-canary step exposed a resource-classification false positive under real multi-project concurrency. The exact canary managed job remained in admission for roughly twenty minutes without spawning a step or producing OAuth evidence because the generic package-script heuristic treated any `release:*` name as a `js-build` workload, charging 2 CPU, 0.5 I/O, and 2 GiB even though `release:oauth-canary` performs bounded local evidence work, an `--ignore-scripts` npm pack dry-run for promotion identity, and network control-plane requests. The job was cancelled only after its terminal result proved `steps=[]` and no `oauth-canary.json` existed, so no synthetic OAuth mutation had started. The classifier now exempts only direct npm argv for the canonical `release:oauth-canary` command as a light control-plane operation; shell-wrapped forms, alternate package managers, `release:candidate`, and lookalike names remain heavy. Architecture also pins the exact script body and forbids implicit `prerelease:oauth-canary`/`postrelease:oauth-canary` npm hooks so lifecycle expansion cannot smuggle extra local work into the exception. The liveness exception is additionally bound to the command cwd: its package name/version must match the currently running Machine Bridge runtime and its canary entrypoint bytes must match the runtime's packaged entrypoint, so another workspace cannot obtain the exception merely by choosing the same script name. Beta.63 is not accepted or published, and beta.64 must repeat frozen verification, exact candidate preparation, owner activation, and the live canary so the classification fix is exercised by the installed runtime itself.
-- Close the adjacent generic shell-light laundering path found while challenging that exception. The previous light detector trusted a shell payload whose text began with a cheap probe such as `echo`, `ps`, or `git status` unless a short denylist appeared after a control operator; an unrelated generic command, startup profile, PATH-resolved lookalike, substitution, or later shell segment could therefore inherit a zero-resource bypass without proving the executable that would actually run. Arbitrary shell execution now receives no generic zero-resource class at all: it remains adaptive or is promoted by the existing heavy shell/build classifiers. The canary exception is direct npm only, so no shell syntax/profile proof is part of that liveness boundary.
-- Narrow the direct arbitrary-process light allowlist by executable identity rather than basename. `resource-light-command.mjs` accepts only a small set of standard absolute executables for constant/output, process-table, uptime, and sleep probes; the same basenames reached through PATH remain adaptive. `find -exec`, `awk system()`, arbitrary `osascript`, `open`, caller-controlled Git helpers/configuration, recursive search, whole-file processors, filesystem metadata traversal, configurable lookup helpers, and every arbitrary shell likewise remain under admission. Implementation-owned Git and health probes already use a separate fixed-argv/internal boundary, so control-plane liveness does not depend on trusting caller-selected executable names.
-- Extend the beta.63 Linux state-root retirement repair across the full moved-root verification interval. The original POSIX descriptor pin prevented immediate inode reuse before the first post-rename identity check, but a same-user replacement installed while the verifier traversed the quarantine could still become the pathname handed to recursive deletion. The descriptor now remains authoritative through a second device/inode recheck after verification; a deterministic fixture replaces the quarantine inside the verifier and requires the replacement to remain retained. Portable Node.js still lacks descriptor-relative recursive `openat`/`unlinkat` deletion, so the final identity-check-to-`rm` hostile-same-user race is documented as a residual instead of being claimed eliminated.
-
-## 3.0.0-beta.63 - 2026-08-12
-
-- Supersede beta.62 after its exact candidate was owner-activated, passed the deployed OAuth canary and live daemon/Worker verification, was accepted, committed, and guarded-pushed, but the exact pushed head then failed mandatory hosted provider gates. Ubuntu `check:full` exposed a Linux inode-reuse ABA in state-root retirement, Windows `check:platform` exposed a test-only 100 ms process-session settlement deadline leaking into real cleanup, and JavaScript/TypeScript CodeQL rejected ten new findings. Beta.62 therefore remains useful live evidence but is not publishable; its source acceptance is removed and beta.63 must repeat the complete candidate/activation/canary/acceptance/provider sequence.
-- Pin the original POSIX state-root directory by an `O_NOFOLLOW|O_DIRECTORY` descriptor across quarantine rename. The pre-rename path still has to match the complete `(dev, ino, ctime)` generation, while the open descriptor keeps that inode referenced so a same-user remove/recreate race cannot recycle the numeric inode before the moved-path `(dev, ino)` recheck. A replacement generation remains quarantined and never reaches destructive state verification; Windows retains its platform path because directory replacement while held open follows different filesystem semantics.
-- Keep the synthetic delivered-but-never-settled process-session revocation deadline local to that negative fixture. The shared manager once used 100 ms for the whole test, so its final cleanup could misclassify a normally terminating Windows `taskkill` process as unsettled; real spawned sessions now use the production five-second settlement budget, while only the artificial never-close record temporarily uses 100 ms and restores the manager contract in `finally`.
-- Resolve the exact-head CodeQL findings without adding blanket suppressions: verification-generation file reads now use the existing descriptor/identity-verified bounded read primitive; resource-accounting calls no longer pass a dead timestamp parameter; host-snapshot single-flight state stores a record containing the Promise rather than treating the Promise itself as lifecycle identity; and the two file-race test fixtures avoid check-then-reuse path patterns. Existing accepted findings remain narrowly scoped and unchanged.
-
-## 3.0.0-beta.62 - 2026-08-12
-
-- Supersede the activated but unaccepted beta.61 candidate after deployed OAuth-canary cleanup exposed an end-to-end account-administration success-status mismatch. The Worker `/admin/clients` DELETE route removes the client plus its codes and tokens and returns JSON `200`, while beta.61's local `AccountAdminClient` incorrectly required `204` for every DELETE and could therefore report `protocol_error` after client cleanup had already committed. Success status is now endpoint-specific: OAuth-client deletion requires `200` JSON, account deletion requires `204`, account creation requires `201`, and the remaining admin operations require `200`; reverse-status regressions prevent the two DELETE contracts from collapsing together again. Because this is a packaged-source change after beta.61 activation, beta.61 must not be accepted or published; beta.62 requires a fresh frozen gate, exact candidate, owner activation, deployed OAuth canary, and observed live verification.
-- Preserve mutation-settlement ambiguity when account administration receives an HTTP success whose response violates the local protocol contract. Unexpected successful status codes and empty, oversized, malformed, or non-object successful response bodies can arrive after the Worker has already committed a mutation, so those `protocol_error` results are now explicitly non-retryable and carry only the bounded facts `request_delivery=sent` and `effect_settlement=unknown`. Read-only protocol failures remain ordinary protocol errors. Regression coverage exercises both reversed DELETE statuses and malformed successful mutation JSON so callers cannot mistake a response-decoding failure for proof that the remote effect did not happen.
-- Refuse automatic HTTP redirects on credential-bearing release and administration requests. `AccountAdminClient` now uses `redirect=error` for every signed admin request, and the deployed release OAuth canary uses the same fail-closed default for dynamic registration, token exchange, and authenticated MCP calls; only the authorization request opts into `manual` so its expected `303` callback can be validated locally. Focused regressions pin both policies, preventing an unexpected Worker or intermediary redirect from turning a same-origin signed/mutation or synthetic OAuth request into a second network request at a Location target.
-- Removed a load-dependent false-positive from the shared Wrangler completion wrapper after an intentionally concurrent beta.62 fast/full verification run reproduced it. The completion-grace timer could request SIGTERM in the narrow interval after a normal CLI had already begun natural exit but before Node had published its child exit state; the later `close(code=0)` was then mislabeled as “completed but did not exit”. A real zero exit now wins over a raced cleanup request, while only a completed CLI that actually closes from the requested `SIGTERM` is accepted through the bounded-hang path. A deterministic fixture holds a successful command alive just beyond the short test grace while ignoring the raced SIGTERM, then exits zero, so the original misclassification is reproducible without relying on scheduler load; the existing completed-resident fixture still proves real hangs are terminated and diagnosed.
-- Make every fast/full/platform verification result generation-bound instead of relying on operator discipline to keep the checkout frozen. Repeated independent review runs proved that a concurrent source/test/documentation edit can otherwise produce a plausible mixed-generation success or failure. `run-checks.mjs` now hashes the complete verification input surface before and after the plan—including source, tests, scripts, browser/CI/docs, release evidence/candidate state, package/configuration files, and file modes—and discards the run if that identity changes. The guard deliberately supersedes even an individual task failure when inputs drift, because a failure from mixed bytes is not valid causal evidence; stable-generation failures retain their original error. Unit and architecture contracts pin both behaviors. The Wrangler lifecycle regression file was also normalized from accidental owner-only `0600` to ordinary source mode `0644` rather than weakening package hygiene.
-- Split local account administration's HTTP response boundary out of the signing/command client after the architecture gate correctly rejected the accumulated module at 250 lines against its 240-line responsibility ceiling. `account-admin-response.mjs` now owns endpoint-specific success status, bounded response streaming/UTF-8 JSON decoding, remote error sanitization, body cancellation, and mutation-settlement protocol errors under its own 120-line architecture budget; `account-admin.mjs` is back to account/signing/request orchestration. The extracted source is normalized to package-safe `0644` mode and the existing end-to-end account-admin regression continues to exercise the same behavior through the public client. The critical coverage gate now pins the extracted response boundary independently at 100% function coverage and at least 75% branch coverage; the frozen regression currently measures 100% (9/9) functions and 85.7% (36/42) branches, so extraction cannot silently move settlement/status logic outside the gated surface.
-
-## 3.0.0-beta.61 - 2026-08-09
-
-- Repaired a deployed-edge OAuth token-persistence failure discovered during ChatGPT connector verification. Authorization and token issuance reached the persistence stage but the deployed Durable Object returned an unexpected server error on the security-critical multi-record convenience write even though the equivalent local Wrangler/workerd flow passed. OAuth access/refresh state now commits atomically through an explicit Durable Object transaction with named single-key writes and bounded `oauth`/`refresh`/`commit` failure classes; live verification restored the connector, authenticated MCP calls, and refresh-token rotation. The project does not claim that Cloudflare multi-key `put()` is unsupported; the exact provider-internal difference remains unresolved and is treated as a local-vs-deployed runtime parity gap.
-- Applied the same transaction/per-key persistence discipline to authority-protected multi-record writes even when no revocation record is queued, eliminated writes to the reserved authority-revocation queue key, and regression-budgeted the maximum authority queue. Refresh replay markers still compact retry-only payload after their bounded concurrent-retry window, and consumed-token replay state now persists in 8 deterministic 1024-record shards rather than inside the main `oauth-refresh` value; legacy schema-2/schema-3 state is reconstructed and migrated atomically through the same persistence codec so active-token, replay, retry, admin-revocation, and capacity semantics stay unified.
-- Made the schema-1 authority-revocation queue structurally exact, not merely value-valid. Unknown top-level or per-record fields now fail closed instead of being copied through `readQueue()` and silently persisted by the next protected transaction; this keeps the 1024-record/single-value capacity budget meaningful even for damaged or unexpected Durable Object state.
-- Extended that exact versioned-state rule across OAuth persistence. The main schema-1 OAuth envelope and account/client/code/token/failure records, the schema-3 refresh envelope and token/replay/family records, and the new consumed-token shard envelope now reject unknown fields at their read boundary. Shared field sets live in a dedicated structural contract beside the existing OAuth identifier grammar so optional beta.61 additions remain explicit while damaged state cannot smuggle unbudgeted payload through validation and back into the next transaction.
-- Tightened the shared Worker replay-nonce store at the same read boundary. Persisted daemon-preflight, admin, and DPoP nonce maps must now fit the caller's declared cardinality cap before they are copied or pruned; an oversized same-key value fails closed even if its excess entries are already expired. The unused `boundedNoncePresent` export was removed so the single consume path owns replay-state validation and mutation.
-- Bound persisted replay-nonce expirations to each protocol's reachable time horizon as well as its count cap. Daemon preflight, signed administration, and DPoP each pass a maximum future window of twice their accepted timestamp skew/TTL, matching the farthest expiry a valid proof can produce. Corrupt state can no longer pin a full replay map indefinitely with safe-integer expirations years in the future.
-- Removed a phantom local error code from account administration. Malformed, empty, or oversized successful Worker responses previously constructed `invalid_response`, but that value was not part of the `BridgeError` contract and was silently normalized to `execution_failed`. Those branches now use the existing `protocol_error` code explicitly, with regressions asserting the actual contract rather than only matching human-readable text.
-- Bounded and sanitized non-success account-admin error text at the local client boundary. The same client backs the direct terminal command as well as tool-mediated flows, so it no longer relies on later MCP serialization to constrain a Worker-provided `message`/`error`: control and bidirectional-text characters are removed, whitespace is normalized, and the terminal-facing message is capped at 2,000 characters before `BridgeError` construction.
-- Corrected account-admin 5xx classification and mutation settlement. The Worker intentionally converts uncaught admin failures to HTTP 500, so the local client now reports those responses as `unavailable` rather than `invalid_request`; reads remain retryable, while mutations are non-retryable and explicitly record that the request was sent but effect settlement is unknown.
-- Added account-admin success-status validation instead of accepting arbitrary successful responses, but the beta.61 candidate still incorrectly treated every DELETE as a `204` operation. Its deployed OAuth canary later proved that `/admin/clients` deletion uses JSON `200`; beta.62 supersedes the incomplete beta.61 rule while retaining `201` for account creation and strict `200`/`204` endpoint validation.
-- Removed the unused `remoteBridgeError` deserializer and its self-referential test. No production path imported it; retaining a tested-but-unreachable remote-error reconstruction API after the old stateful remote/session paths were removed created dead contract surface without protecting any executable flow.
-- Tightened incident and release evidence rules after the investigation: exact live identity and privacy-safe stage evidence precede speculative semantic changes; observed facts, inferences, falsified hypotheses, and unknowns stay distinct; disproved patches require independent justification or removal; credentials/state/security controls are not generic diagnostic resets; hosted-runtime behavior requires deployed canaries when local emulation cannot prove parity; and verification runs are valid only against a frozen source snapshot. Release acceptance now requires candidate-bound deployed OAuth canary evidence: a synthetic reviewer/client must complete authorization-code exchange, authenticated MCP, refresh rotation, refreshed MCP, and cleanup without persisting or printing canary credentials/tokens/identifiers.
-- Superseded beta.60 as the source release target after a second scheduler review. Beta.60 was activated from a local candidate at `2026-08-08T23:23:27.866Z` but has no local acceptance record; it remains the live Worker/daemon baseline until a new beta.61 candidate is explicitly activated, observed, and accepted.
-- Refined machine-user resource scheduling with conservative protected backfill: young or structurally impossible large requests still allow fit-aware smaller work, while an aged feasible rank-zero waiter blocked by current coordinator leases can stop new backfill long enough for CPU, I/O, memory, disk, or same-project capacity to drain. Queue diagnostics expose only the protected-waiter count, not command text or paths.
-- Preserved the one bounded beta.60-to-beta.61 machine-user resource-lock transition required for a safe live update. Beta.60 uses `transaction.lock/owner.json` as a directory mutex, so beta.61 keeps that schema-1 directory wire shape instead of publishing the same path as a regular owner-state file. The final-name `mkdir` remains the cross-version atomic exclusion point; `owner.json` is written atomically immediately afterwards, and a directory with no owner record is never reclaimed until a bounded incomplete-owner grace has elapsed. Release and stale recovery revalidate the exact directory inode plus owner token/process generation, quarantine that generation by rename before recursive removal, and restore it if identity verification fails. A transition-only branch can also wait for or reclaim the short-lived regular-file beta.61 lock generation used before this correction. This state bridge does not restore an obsolete runtime protocol and is not a mixed-version steady-state contract.
-- Bound stale resource-lease pruning to the lease generation that was actually inspected. Reclamation now removes a lease only while its `lease_id`, ownership token, single-link regular-file shape, and filesystem identity still match; a path replacement during cleanup fails closed instead of being deleted by a bare pathname unlink.
-- Fixed nested coordinator self-deadlock by treating process-ancestor leases as orchestration envelopes instead of blindly summing every nested lease. Active leases keep their full persisted requests and independent crash ownership, while live accounting builds an ephemeral process-ancestry forest and charges each root as the component-wise maximum of its own envelope and the sum of direct child envelopes. A pending nested request reserves only the additional delta; same-key ancestor contention is ignored only for that ancestry chain, while same-key siblings still serialize. If ancestry sampling fails, accounting falls back to conservative full summation. Process ancestry is not sampled at all while the lease set is empty; once leases exist, the full parent snapshot is cached for one second and concurrent callers coalesce behind the same sample.
-- Kept isolated POSIX process-group reservations durable after the direct caller releases its local lease handle. Explicit release now verifies ownership but leaves a bound lease persisted while the process group is still alive; ordinary pruning removes it only after the group exits. This closes the accounting gap where a detached compiler/test descendant could be reparented to launchd and continue consuming resources after its caller returned.
-- Bound that retained POSIX group reservation to the original process generation rather than the numeric PGID alone. A live group still keeps the lease when its original leader has exited and descendants remain, but if the leader PID has been reused with a different recorded start identity the stale lease is reclaimable even when the reused numeric process group is currently alive. Deterministic regression coverage simulates the generation mismatch against a real detached process group so PID/PGID reuse cannot indefinitely pin phantom capacity.
-- Removed blocking host/process probes from the ordinary live admission path. CPU pressure now comes from Node's cumulative OS CPU counters instead of a whole-process `%cpu` scan: full quick evidence is reused for at most 500 ms, while a machine-global cumulative CPU anchor may cross project scopes for at most two seconds to avoid a needless cold sample. Older anchors force a fresh 50 ms CPU window so a long idle interval cannot smear current pressure into a stale average. CPU/mixed/adaptive work uses the quick host path; fresh `iostat` is reserved for I/O-dominant or unbounded roots, and successful I/O evidence may be reused boundedly only within its original project/filesystem scope. Host probes remain single-flight per anonymous canonical project scope so concurrent requests do not create a probe herd. Child process-start identity remains sampled asynchronously before the coordinator lock.
-- Kept failed Darwin I/O probes out of that five-second evidence cache. `io_sampled` and its reusable timestamp are now published only after `iostat` succeeds and yields a finite numeric sample; timeout/failure/malformed output remains unknown so a later heavy admission retries the full probe instead of treating a failed observation as recent I/O evidence.
-- Made heavy roots yield without reducing bounded interactive throughput. POSIX background resource roots are launched through `nice +5`; heavy roots whose internal fan-out cannot be safely bounded (for example a shell-composed build) use the smaller `nice +2`, while bounded ordinary/interactive roots are unchanged. This remains scheduler preference rather than CPU quota enforcement. Unknown/unbounded CPU fan-out is expanded to the current admission CPU limit, and that policy-expanded reservation is now persisted into the durable lease instead of falling back to the smaller profile hint after admission, so later roots and surviving nested children continue to see the capacity that was actually approved. Cheap bounded metadata probes (`ps`, `wc`, `uptime`, `df`) bypass heavy admission while recursive filesystem walks such as `du` do not.
-- Added disk-headroom pressure without restoring a rigid global build ban. The soft floor is `min(80 GiB, max(8 GiB, 15% of the volume))` and the hard post-reservation floor is `min(50 GiB, max(5 GiB, 10%))`, so small volumes are not permanently classified as pressured while large volumes retain bounded safety headroom. Build-cache partition hashes reuse the canonical project identity, preventing symlink/path aliases from duplicating compiler cache roots.
-- Scoped Yellow admission penalties to the pressured resource instead of taxing every dimension. CPU busy/CPU PSI tightens CPU capacity, disk throughput/I/O PSI/soft disk headroom tightens I/O capacity, and memory/pageout/swap/memory PSI tightens memory capacity. `heavy_root_count` remains advisory density telemetry but no longer recreates a global CPU/I/O/memory penalty without a corresponding bottleneck signal. This prevents disk-only or count-only warnings from stranding otherwise healthy capacity while retaining per-resource backpressure.
-- Canonicalized project-contention identity across implementations and filesystem aliases. The v1 contention-key material now uses the canonical filesystem path (including existing symlink ancestors) before hashing, so `/var` versus `/private/var` and symlinked workspace aliases cannot silently create different Node/Python project mutexes. Windows identity additionally normalizes separators, case, and extended-path prefixes so equivalent NTFS aliases converge before hashing.
-- Corrected project contention scope for shell roots. A provable literal `cd` chain now narrows same-project serialization to the last certain directory even when the inner executable is not a known build family; dynamic/quoted/otherwise ambiguous directory changes fall back conservatively instead of guessing. This prevents sibling repositories under one parent from sharing a false contention key.
-- Extracted shell command-shape analysis and tightened orchestration-script classification so an ordinary argument such as `tests/foo` or `release-notes.md` cannot make a read-only command look heavy. Only the actually invoked shell/Node/Python script operand or package-manager script name can select a bounded heavy profile. The verification runner reserves its actual configured/default internal concurrency before spawning parallel checks. Direct Cargo/Swift/Xcode and make/ninja/cmake/Gradle/Maven/Go builds now make admission and execution agree: absent an explicit worker count the bounded default is a ceiling that is refit on every coordinator admission iteration to the smaller of measured CPU headroom and durable reservation headroom. The same schema-1 waiter is atomically updated before fairness selection without resetting its ID, enqueue time, or aging rank, so a constrained build can shrink while waiting and re-expand when capacity returns; the final lease-selected worker count is enforced through argv/environment (`CARGO_BUILD_JOBS` or `MBM_CHECK_CONCURRENCY` where applicable). Verification-plan memory reservation contracts with fitted fan-out down to its 2048 MiB floor instead of retaining the stale larger-worker budget. Empty `MBM_CHECK_CONCURRENCY` keeps the runner's implicit/default semantics and may be replaced by the fitted value, while non-empty values outside `1..16` are preserved and classified unbounded instead of being silently rewritten or charged as the default. The elasticity marker is process-local only and does not change the schema-1 waiter/lease wire shape. Explicit `-j`/`--parallel`/`--max-workers`/`-T`/`-p` values and valid `CARGO_BUILD_JOBS`/`CMAKE_BUILD_PARALLEL_LEVEL` are never silently reduced. Cargo now accounts its current explicit jobs grammar exactly: negative CLI/environment values resolve relative to logical CPUs, `default` resolves to the logical-CPU default, CLI jobs override `CARGO_BUILD_JOBS`, and arguments after Cargo's `--` separator do not become compiler fan-out; invalid/zero/nonpositive/out-of-contract values remain fail-closed as unbounded, while the no-explicit-setting path retains Machine Bridge's elastic default ceiling. Maven 3.9+ `MAVEN_ARGS` is now part of thread accounting: because the launcher prepends it to the CLI and Maven reads the first `-T`/`--threads` value, an environment thread setting is charged and preserved even when a later user argv specifies another value. Maven core-multiplier forms such as `-T2.5C` are charged using Maven's integer multiplier-times-available-processors calculation. Visible GNU make settings in `GNUMAKEFLAGS`/`MAKEFLAGS` now follow make's implicit leading-dash and compact short-option parsing while preserving jobserver state. Gradle now has a dedicated current-semantics worker parser: `JAVA_OPTS` precedes `GRADLE_OPTS` in the launcher, direct `-Dorg.gradle.workers.max=...`/`--system-prop=...` updates that system-property map, and `--max-workers` is the final build-option override. Valid effective values are charged without injecting a replacement; invalid final properties fail before CLI recovery, and repeated/invalid `--max-workers` values use the lightweight pre-build validation profile. Malformed JVM-option quoting and otherwise valid counts above the modeled maximum remain fail-closed as unbounded. The obsolete mixed build-config concurrency adapter was removed after CMake, Go, Ninja, and Gradle gained dedicated parsers; Make environment accounting is now wired directly. Go concurrency now has a dedicated parser matching the current go command's ordering and failure boundaries: quoted `GOFLAGS` applies first, direct `-p`/`--p` overrides it, repeated numeric values use the final effective setting, `go test` respects package-list versus `-args`/positional-test-argument boundaries, and ordinary `go build` stops at its first package operand. A final nonpositive numeric `-p` uses a lightweight pre-build validation profile because Go rejects it before compiler fan-out, malformed/non-numeric GOFLAGS remains fatal before CLI override, and a syntactically possible `-p` value belonging to a preceding flag fails closed as unbounded instead of entering that light fast path. SwiftPM fan-out now has a dedicated parser matching its scalar `UInt32` Argument Parser contract: repeated `-j`/`--jobs` values use the final setting, equals forms and accepted leading-plus integers are charged exactly, zero remains unbounded because llbuild substitutes hardware concurrency, and valid counts above the modeled maximum remain unbounded unless a later scalar option replaces them. Direct missing/non-UInt32 or unsupported joined-short forms such as `-j8` use lightweight pre-build validation; shell-wrapped Swift is only bounded when the shell contains one provable Swift segment, so mixed orchestration remains fail-closed as unbounded. Xcodebuild now separates real build/test invocations from query, package-resolution, export/import, and platform/component-maintenance modes before build-root mutation, so `-help`/`-usage` and non-build commands no longer receive synthetic `-jobs`/`-derivedDataPath` flags. Those non-build modes now receive workload-specific admission instead of the generic adaptive fallback: settings/metadata queries stay small adaptive work; package resolution is project-serialized mixed work with a 4 GiB disk safety reservation; archive/localization/xcframework import-export is project-serialized I/O with an 8 GiB reservation; platform/component install/download/prepare operations are unbounded high-I/O with an 8 GiB minimum safety reservation; component deletion is I/O-heavy with no invented future disk consumption and no disk-reclaim privilege. These reservations are safety floors, not claimed upper bounds on native operation size. Its dedicated build parser reflects the current native CLI observed on this host: only separated `-jobs NUMBER` enters the native jobs-option path and accepts leading `+`; lookalike `-jobs=...` forms do not receive the same native validation and are never treated as hard concurrency bounds. Canonical zero/negative separated counts fail before build, and a second real `-jobs` option is rejected outright. Canonical positive separated bounds are charged exactly; equals forms, noncanonical values that Xcode may accept by numeric-prefix conversion, and oversized values stay fail-closed as unbounded. `test` and `test-without-building` remain overall unbounded because Xcode exposes independent destination and parallel-testing runner fan-out, while the known/default build-phase `-jobs` ceiling is still retained separately. The obsolete generic compiler-job parser chain was removed once Xcode gained this dedicated model. Ninja direct fan-out now has its own getopt-aligned parser: repeated `-j` options use the final value, `-j0` remains effectively infinite/unbounded, and negative/non-numeric values or Ninja's unsupported `--jobs` spelling use the lightweight pre-build validation profile instead of waiting for heavy capacity before Ninja exits. Any valid positive direct `-jN` remains the hard local worker bound and disables inherited jobserver participation. Ninja 1.13+ GNU jobserver participation is no longer accidentally disabled by Machine Bridge's implicit `-j` cap: supported FIFO/semaphore jobserver authentication in `MAKEFLAGS` is preserved without injecting a local `-j`. Jobserver-aware Ninja is conservatively classified cooperative/unbounded even when MAKEFLAGS exposes `-jN`, because current Ninja can fail to initialize the inherited jobserver and continue with native local parallelism. The jobserver parser mirrors current Ninja ordering: MAKEFLAGS dry-run flag letters disable jobserver use, the last recognized auth/fds descriptor wins, negative descriptors disable it, malformed `--jobserver-fds` fails closed, and unsupported POSIX pipe descriptors do not suppress the local bound. This preservation marker is process-local and never changes the schema-1 wire shape. pytest-xdist now distinguishes fixed and truly dynamic worker counts: numeric `-n` is charged directly, `-n 0` is single-process, and `auto`/`logical` is only bounded when `--maxprocesses=N` supplies a hard ceiling; auto-worker environment hints remain non-authoritative because project hooks can override them. CMake build concurrency now uses a dedicated current-semantics parser instead of generic first-match handling: repeated `-j`/`--parallel` options use the final CMake-level value, positive CLI concurrency overrides `CMAKE_BUILD_PARALLEL_LEVEL`, and invalid/zero/too-large pure CLI or environment values use the lightweight pre-build validation profile rather than waiting for heavy capacity before CMake rejects them. Value-less/defined-empty parallelism remains unbounded because CMake delegates it to the native tool. Uninspected `--preset` builds and native arguments after `--` are also fail-closed as unbounded and are left untouched because presets can provide `jobs`/`nativeToolOptions` and generator-specific native options can independently raise fan-out. Explicit fan-out that cannot be bounded safely is classified unbounded instead of being charged as the default. Shell-wrapped implicit Swift and generic compositions that cannot be safely rewritten remain conservatively unbounded.
-- Fixed admission-wait liveness under real pressure. Coordinator backoff/lock waits now use a referenced timer so an otherwise-idle Node process cannot exit with an unsettled top-level await, and abort listeners are removed on both timeout and cancellation instead of accumulating during long waits. Same-daemon cancellation/timeout, stale-lease pruning, and stale/expired-waiter pruning now wake peer waiters immediately so capacity or fairness changes do not wait for the next jittered poll. Stale waiter pruning revalidates ownership and filesystem identity and fails closed if the record changes before deletion instead of silently dropping a changed queue entry.
-- Made resource-directory crash recovery generation-aware as well. Internal exclusive-file staging names intentionally remain PID-based, but recovery no longer treats a live numeric PID as proof that an uncommitted staging artifact still belongs to that process. It compares the current process start identity with the staging file's write-time ownership lower bound through the existing process-instance inspector, so a PID reused long after a crashed publisher cannot permanently block lease/waiter directory recovery; a genuine current publisher is still protected.
-- Closed resource-lease cleanup races around failure and short-lived children. A failed durable `ResourceLease.release()` no longer marks its handle closed before the caller can retry; a validated/token-matching lease whose identity changes before destructive removal now fails closed instead of returning an ambiguous false success; fire-and-forget cleanup paths consume cleanup rejection explicitly instead of creating unhandled rejected promises; and persistent process sessions do not release a provisional lease until process binding has settled, matching the one-shot and managed-job ordering for children that exit almost immediately. Process binding is now a one-way ownership transition over the complete owner tuple: an exact PID/process-group retry is idempotent, while changing the PID, isolation flag, or POSIX process-group identity is rejected instead of replacing durable accounting ownership. Persisted isolated process-group IDs are required to equal their leader PID.
-- Made managed-job cleanup wait behind process-tree termination settlement. A timed-out, cancelled, or resource-bind-failed step no longer resolves merely because its direct leader closed while an isolated descendant is still awaiting the escalation phase; `finally_steps` begin only after that termination barrier, preventing cleanup from racing a still-live forward-effect process tree. Recovery never replays ordinary business steps; it runs only recovery/finally work, and any resource/state reconstruction `mainError` now makes the terminal status `recovery_failed` rather than the contradictory `recovered` plus `error_class`. Staged cancellation, runner-launch failure, recovery exhaustion, and runner completion now converge on the same result-first terminal persistence contract with explicit result/artifact evidence. `recovery.lock` and `transition.lock` are no longer treated as ordinary terminal artifacts: only their owner/reclaimer lock primitive may remove them, preventing a terminal scrub from publishing an unlocked critical section before the holder actually exits.
-- Closed two managed-job lifecycle gaps found while investigating interrupted work. An exact 50-record retained set no longer deadlocks all new durable submissions: a create transaction reserves one slot by evicting only the oldest safely removable terminal record, returns a structured retryable `limit_exceeded` error when all slots are active/staged/unreadable, and serializes prune/recheck/publication across processes through an owner-identity-checked root capacity lock so two concurrent creators cannot exceed the hard cap. The previously unreachable internal staged-plan `approve()` path and its misleading `pending-local-operator` continuation were removed; staged jobs are now explicitly review-only and can only be cancelled/inspected, while execution always requires a separate direct submission. Retention policy moved to a dedicated critical-coverage module with explicit capacity-boundary, lock-inventory, and no-promotion regressions.
-- Hardened managed-job retention as part of the independent lifecycle review. Staged expiry now participates in the per-job transition lock, re-reads the winning state before mutation, and commits through the shared result-first terminal persistence boundary; `read_job` returns explicit `result_persisted=false` status evidence without re-reading an unpersisted result. Seven-day terminal retention is measured from terminal `finished_at` rather than pre-transition directory age, so a long-abandoned staged draft is not deleted in the same pass that first expires it. During the narrow result-first/status-second runner settlement window, `read_job` now derives an in-memory terminal outer status from a valid durable terminal result instead of returning a mixed active-status/terminal-result generation; runner-owned status persistence remains untouched. Staged cancellation and expiry no longer treat `recovery.lock` as a terminal artifact; transition/recovery locks remain removable only by their owner/reclaimer primitives.
-- Made local authority revocation acknowledgement fail closed across durable jobs. A matching managed job that cannot be safely inspected or cancelled now makes the revocation application incomplete instead of being reduced to a warning; the daemon withholds `authority_revoke_ack` and interrupts the current relay generation so the Worker's persisted revocation queue is replayed promptly on reconnect. Successful partial cancellation remains idempotent on retry, and revocation uses a module-internal cancellation path so a job accepted under an earlier writable policy remains revocable after the public `cancel_job` tool is disabled by a narrower daemon policy. The same review removed an unused shared revocation-message serializer and a test-only production service-convergence wrapper, and removed process IDs from routine default-level startup/takeover logs and the managed-job identifier from default asynchronous runner-failure logs while keeping exact identity available in explicit diagnostic/job state. Managed-job observation windows in stdio/local-self integration now allow up to five minutes for real machine-level resource admission while leaving the job step execution timeouts unchanged, preventing a busy host from being misclassified as a product failure. The `start_job` schema/documentation now also states the real idempotency boundary: `idempotency_key` deduplicates uncertain retries only while the original job record is retained, and capacity/retention eviction ends that evidence window; the tool remains explicitly non-idempotent rather than implying permanent exactly-once execution.
-- Tightened the independent managed-job integrity review around destructive cleanup and operator diagnosis. Terminal artifact cleanup now accepts persisted status/result only when job ID, terminal state, and `finished_at` identify one commit generation; the degraded `result_persisted=false` form must carry a valid settlement timestamp and bounded terminal-record error class. Corrupt terminal evidence is projected as unreadable state for uninstall inventory instead of being treated as harmless completed metadata, and integrity errors retain their explicit diagnostic class rather than collapsing into generic resource unavailability. Seven-day/capacity retirement now verifies the exact observed filesystem generation, atomically moves that generation to an identity-encoded retired name, rechecks the moved inode before recursive removal, and reclaims a verified retired generation on the next managed-job maintenance pass if the process crashes between quarantine and deletion. Retired-state inventory is itself fail closed: the internal `retired_job_*` namespace is deliberately outside the public `job_...` ID grammar, a valid crash residue is reported only as privacy-bounded cleanup-pending internal state until reclaimed, and a same-name replacement, wrong-type retired entry, encoded-generation mismatch, or unreadable retired directory becomes an `unreadable` destructive-state blocker without exposing the encoded device/inode as a job ID. Recognized retired state continues to count against the 50-item hard capacity until safely removed. Full uninstall performs this retired cleanup only after acquiring its maintenance/service locks and still refuses to remove the state root when any abnormal residue remains; its error names only coarse `retired-managed-job:<status>` state and directs persistent unreadable residue to owner-only state inspection rather than `read_job`. Sustained `local_authority_revocation_retry` relay warnings now direct operators to local authority, process-session, and managed-job state rather than incorrectly suggesting internet/Worker troubleshooting. The remaining dead `approval` and `job approve` parser tables were removed after the executable approval path had already been deleted; unknown job actions now reach the single command handler instead of being misreported by a stale `approve` positional rule, and persisted `status.approval` remains only as an on-disk launch/review compatibility field.
-- Extended the independent lifecycle review from managed-job state into process ownership and whole-state deletion. One-shot commands, fixed internal executables, and detached managed-job steps no longer treat a ChildProcess `error` event as process death; tracker/session/resource ownership is released only after close/exit settlement. A process-session start that fails after spawn retains hidden ownership and its resource lease until real close, forced `kill_process` fails rather than claiming termination when the direct tree-kill request cannot be delivered, and authority revocation retains/retries an unkillable matching session while still attempting every other local execution category before withholding acknowledgement. Idempotent `start_job` replay now reconciles a durable terminal result before any queued-runner relaunch and treats only a genuinely missing status as absence; runner fatal settlement also requires a confirmed runner claim plus valid same-job active state before it may write terminal evidence or scrub artifacts. Recovery bootstrap is stricter still: a recovery runner confirms its runner claim, completes the token-bound recovery-lock handoff, and only then gains authority to persist terminal evidence; bootstrap failure therefore leaves `interrupted` status and the plan available for retry, with a 30-second monotonic handoff budget. Full state-root uninstall is now generation-bound through a reserved rename/revalidate/delete transaction with crash-residue recovery; malformed, wrong-type, mismatched, unreadable, replaced, or symlink-traversed state evidence blocks destructive cleanup. Managed-job retirement follows the same no-pathname-rollback rule on verification failure; malformed `retired_job_*` residue and wrong-type public `job_...` state are reserved blockers that count toward capacity, while deterministic target inspection occurs before any terminal-history eviction. Destructive profile inventory likewise rejects unknown or wrong-type children of the reserved `profiles/` namespace instead of filtering them out. The beta.60 resource-transaction compatibility lock uses a narrower rule: incomplete owner-less directories are reclaimed with generation-checked empty `rmdir`, so a late owner publication atomically defeats reclamation, while the remaining token-bearing quarantine restore refuses to overwrite a replacement generation. Resource-coordinator lock waiting is now operation-bounded: acquisition is capped by the caller's remaining admission budget, while post-spawn lease bind/release may wait up to 30 seconds. A deterministic 5.5-second transaction-lock hold proves dead-runner recovery no longer punches through the old five-second internal lock deadline as permanent `recovery_failed`, including under V8 coverage instrumentation. Managed-job active lifecycle classification now has one shared source used by retention, manager reconciliation, detached-runner fatal settlement, and the production full-access diagnostic; the latter no longer omits `recovered`, `cancelled_before_start`, or `expired_before_start` and therefore cannot turn an already-terminal job into a five-minute false wait. A dedicated fast/critical-coverage state-root retirement regression measures 100% function and 81.1% branch coverage against a 90/70 gate.
-- Hardened the private npm bootstrap against transient **and slow-but-progressing** registry transfers after the install smoke gate exposed the difference. Exact immutable npm/undici/brace-expansion GETs still make at most three attempts with 750/1500 ms bounded backoff for explicit transient network codes, HTTP 429, or HTTP 5xx, but the old per-attempt 60-second wall deadline is now a referenced **no-progress** timeout refreshed only by response/body progress plus an independent five-minute absolute attempt ceiling. A real registry path measured at roughly 20 KiB/s therefore no longer restarts a multi-megabyte immutable tarball every minute; the repaired `install:test` completed the isolated hardened npm, pack, global install, and default-start boundary in about 7 minutes. Redirects, proxy-configuration/certificate/policy failures, size violations, and other non-transient errors remain single-attempt fail-closed results. Fault injection now covers timeout→503→byte-identical success, continuously progressing slow bodies, idle and absolute timeouts, exact-HTTPS enforcement, default proxy-aware agent construction, invalid proxy/NO_PROXY input, setup/response failure, declared and streaming byte ceilings, retry exhaustion, and no retry for redirects/certificate rejection. Critical coverage records `hardened-npm-download.mjs` at 94.7% function / 78.1% branch and its timeout helper at 100% / 92.3%, while the download module remains within its existing 110-line architecture ceiling.
-- Made platform service status/mutation fail closed instead of collapsing unknown state into inactivity. launchd exit 113 is the explicit missing-service evidence; every other nonzero `launchctl print` is `status_unavailable`, failed-query stdout is ignored, and stop succeeds only after the service is both inactive and unloaded from the launchd domain, so a failed `bootout` plus an independently exited process cannot authorize plist deletion. systemd now projects only active/inactive/failed/confirmed-missing evidence as boolean activity; transition states, installed-but-unknown state, and unrecognized command output remain `active:null`. launchd/systemd direct start/restart refuse unavailable provider status or a missing definition, matching the owned-service runtime guard. `service status` preserves provider uncertainty as `effective_active:null` unless a workspace daemon is positively alive. Deterministic platform/status/CLI tests cover missing, arbitrary query failure, normal unload, still-loaded/inactive launchd state, post-bootout status loss, systemd transition/unknown state, and tri-state status projection; architecture checks lock these boundaries.
-- Stopped advertising an already-started foreground process timeout as safe to retry while tree termination is still settling. One-shot execution keeps its low-latency timeout contract, but the public `timeout` error is now `retryable: false` with bounded `side_effects_started`, `termination_requested`, and `effect_settlement: "pending"` metadata; process tracking and the durable resource lease continue until the child/tree lifecycle closes.
-- Applied the same ambiguous-side-effect contract at the Worker settlement boundary. Once a transient request-scoped call has reached the daemon, timeout/cancellation evidence is non-retryable instead of inviting an automatic duplicate while the original effect may still be settling. A successful `cancel_call` send reports `termination_requested: true` with pending settlement; a detached/closed transport reports unknown settlement without inventing a termination request. If an already-dispatched call loses its daemon connection and the bounded same-instance reconnect grace expires, the resulting `unavailable` error is likewise non-retryable; pre-dispatch availability failures remain separately retryable.
-- Bound relay `cancel_call` to the authenticated ready connection generation and the canonical call-ID grammar. Reconnect promotion already sends `resume_calls`, queued revocations, and `ready_ack` in-order before a rebound socket can receive later cancellation traffic, so accepting cancellation before readiness served no continuity purpose and allowed a pre-ready control frame to mutate local call state. Malformed or pre-ready cancellation is now a protocol violation; a ready-generation cancellation still suppresses/terminates the matching request exactly as before.
-- Kept the stateless remote initialization compatibility surface from weakening current intermediary-routing invariants. Older HTTP clients are not required to send the beta.61 `Mcp-Method`, `Mcp-Name`, or schema-declared `Mcp-Param-*` mirrors, but if any of those current headers are present they must agree with the JSON-RPC body before compatibility dispatch. This preserves old-host interoperability without allowing a request body to execute one tool or method while an intermediary-visible current header claims another.
-- Closed the remaining mirrored-header namespace ambiguity for both native and compatibility requests. `Mcp-Name` is now rejected on methods where no name/URI mirror is defined, and every supplied `Mcp-Param-*` header must belong to the selected tool's declared `x-mcp-header` bindings; undeclared headers, headers belonging to another tool, and parameter mirrors on non-tool methods fail with the same `-32020` routing-contract error instead of being silently ignored. For current named methods, malformed or missing body name/URI fields are validated first and remain ordinary `-32602` parameter errors rather than being misclassified as a missing mirror-header contract error.
-- Made long integration/coverage runtimes cooperate with real machine-user pressure instead of treating a transient busy host as a product failure. Production foreground process admission still uses the 2-second retryable window; `local-self-test` waits up to five minutes at both one-shot and persistent-process boundaries, its command timeouts still begin only after admission/spawn, and the resource-executing `agent-context-test` runtime uses the same test-only wait. `full-access-test` now also gives its internal real-machine `LocalRuntime` a five-minute cooperative admission budget and its detached managed-job lifecycle the same five-minute observation window; this prevents the full gate's own parallel CPU/I/O load from making a healthy diagnostic fail after the production two-second admission window without changing ordinary foreground runtime behavior.
-- Promoted the resource scheduler into the critical-module coverage contract. The full coverage suite now executes the direct admission/build-root fixtures and enforces explicit thresholds for admission policy, fairness/waiters, command/shell classification, host pressure, wait liveness, staging recovery, build-root/process admission, and the persisted request contract; release architecture tests prevent those fixtures/thresholds from being silently removed. The V8 collector now merges repeated function executions by exact range with nearest-enclosing inheritance when a child range disappears, instead of treating a missing child record as uncovered. A source/test/mode/symlink generation digest is checked before and after collection so a long coverage run cannot combine multiple source generations into false evidence.
-- Added Linux `MemAvailable` and Pressure Stall Information sampling for CPU, memory, and I/O. PSI is optional live-pressure evidence, not quota enforcement: 10% recent stalls tighten admission to Yellow and sustained memory `full` pressure at 60% is Red; missing PSI remains unknown and is not reported as sampled I/O. Windows now also contributes physical-memory availability plus cumulative CPU idle/total evidence from Node's OS APIs; once two samples exist, the coordinator derives busy cores from the delta instead of treating Windows CPU and memory pressure as permanently unknown. The cumulative counters remain private coordinator evidence and are stripped from public diagnostics; Windows I/O throughput remains unknown rather than relying on localized performance-counter text.
-- Kept historical resource learning out of this release. A source review of local CognactApp showed the right prerequisite: settlement-time `wait4`/`rusage` CPU, peak RSS, I/O, wall-time, descendant, and process-group evidence. Node does not currently expose an equivalent trustworthy per-child boundary, so beta.61 does not infer resource cost from wall time or `ps` snapshots.
-- Kept disk-pressure protection self-recoverable without creating a general pressure bypass. Only direct standard absolute deletion executables are internally classified into a fixed small `disk-reclaim` envelope; PATH-resolved or shell-composed deletion cannot claim it. That envelope may proceed under Yellow limits when free-disk headroom is the sole Red reason, while memory, thermal, PSI, CPU/load, or any other independent Red evidence still blocks it. This lets an operator remove already-identified regenerable data after crossing the disk hard floor without teaching arbitrary heavy work to impersonate cleanup.
-- Made MCP `2026-07-28` the only native state model and removed the old stateful `2025-11-25` initialize/session/recovery adapter, signed-session store, `Last-Event-ID` replay path, durable MCP stream/pending-call persistence, prepare/subscribe delivery descriptors, era-specific controllers, and their production retry/cancellation machinery. HTTP and stdio share the current request-scoped tool core; `server/discover`, per-request metadata, current tool methods, direct tool-response streaming/cancellation, and same-daemon transient relay rebinding remain the only native delivery semantics. Final remote HTTP interoperability additionally accepts bounded stateless initialization-era `2025-06-18` and `2025-11-25` requests for `initialize`, `notifications/initialized`, `ping`, `tools/list`, and `tools/call`; those tool calls route through the current controller, never create `Mcp-Session-Id` or replay state, and do not restore the removed protocol session architecture. stdio remains current-only. Because this server advertises no change notifications, native `subscriptions/listen` remains finite and stateless: it validates the filter, acknowledges an empty honored subset, returns graceful completion, and closes without constructing a subscription registry or replay stream.
-- Corrected the current `subscriptions/listen` zero-capability path after a `2026-07-28` conformance reread. The server no longer reports a fictitious subscription-capacity failure merely because it advertises no change notifications. HTTP and stdio now validate bounded filters, acknowledge the empty supported notification subset, return a correlated `resultType: "complete"` result carrying the subscription ID, and terminate immediately. This remains stateless: no subscription registry, replay store, resumable stream, or compatibility-era state was restored.
-- Removed the remaining browser-visible and authorization scaffolding that implied the deleted MCP delivery era. CORS no longer advertises or accepts `Mcp-Session-Id` or `Last-Event-ID`; the DPoP internal-retry binding used only by legacy prepare retries is gone; Worker alarms, pending capacity, observability, and result ownership now model transient request-scoped calls only. A new deterministic response-proxy regression drives both response-body cancellation and `Request.signal` abort, proves caller-supplied internal stream capabilities are replaced, binds one credential-free cancel control to the random direct-call capability, and requires the public stream to close after queued data drains. Local Wrangler raw-TCP disconnect propagation is not treated as authoritative cancellation evidence; deployed-edge candidate verification remains the real transport check.
-- Narrowed retained upgrade code to migration-only state readers backed by real source states instead of broad runtime compatibility. At this source cutoff the public npm channels are `latest=2.0.0` and `beta=3.0.0-beta.38`, while the owner machine has the explicitly recorded live beta.60 candidate. Browser pairing and OAuth migrations remain because those published states differ from the current schema; the beta.60 resource-lock bridge remains only for the live handoff. Successful migration writes the current state shape and never makes the producing protocol/runtime executable again.
-- Aligned the final MCP `2026-07-28` HTTP mismatch path with the released wire contract. A present `MCP-Protocol-Version` that does not match a missing or different body `_meta.protocolVersion` returns HTTP 400 / JSON-RPC `-32020 HeaderMismatch` before body-metadata structural validation, including at the real Worker entrypoint. Unknown/future versions stay on current validation and are rejected as unsupported rather than being interpreted as another protocol era. Authenticated POSTs require a parsed `application/json` media type before JSON materialization and return HTTP 415 for missing/non-JSON values even when the body is not JSON; exact base-type parsing accepts case variants and parameters while rejecting values such as `application/jsonx` or `text/plain; a=application/json`. The rejection path boundedly drains/cancels the network body before responding so workerd cannot resume reading an abandoned stream after the 415 has already been sent.
-- Tightened account least-privilege discovery independently of dynamic daemon availability. The shared account-access contract now marks `diagnose_runtime`, `list_local_resources`, `stage_job`, and `start_job` owner-only for authenticated remote accounts; local policy profiles keep their existing machine-owner behavior. Local and Worker tool catalogs remove those tools from non-owner remote roles while the operation authorizer enforces the same owner-only invariant before operation-risk classification as defense in depth. `server_info`, `project_overview`, session bootstrap, and task routing now consume one effective tool set equal to daemon/effective policy intersected with the account contract, rather than reconstructing authority from policy alone; the routing combiner also intersects project/skill/keyword seed recommendations with that same set. Durable-job creation routes are omitted when an account has only list/read/cancel controls, while inspection/cancellation of that account's own existing jobs remains principal-bound and routable. Capability responses label repository/skill/registered-command metadata as project-or-user-provided planning context with `authority_expansion: false`; actual execution authority remains the policy, account, and operation gates even when project metadata recommends an action. `start_job` also exposes its already-implemented principal-bound `idempotency_key` in the public schema so uncertain remote submission retries can return the same durable job instead of forcing clients to risk duplicate execution. Routing/automation diagnostics now call that account-attenuated set `effective authority` rather than `effective policy`, and application-discovery denial distinguishes a pure policy denial from an account/daemon authority denial so diagnostics cannot overstate the caller's permissions.
-- Closed a transient process-session shutdown leak found while making the resource-binding regression load-independent. The test now waits for the short-lived child to actually exit instead of assuming a 25 ms post-bind close latency, while still proving that the provisional lease is never released before binding settles and is released exactly once. Separately, `ProcessSessionManager.clear()` now terminates every still-live session process tree before dropping the registry, so daemon stop, supersession, or fatal relay teardown cannot leave detached interactive sessions running as ownerless processes; their existing close handlers still perform the binding-ordered durable lease release.
-- Closed the corresponding post-spawn cancellation hole in `start_process`. If cancellation becomes visible only after the child has spawned and its resource lease has bound, the session is removed before any handle can escape and the child tree is force-terminated; the ordinary close path still releases the durable lease exactly once. A cancelled start can therefore no longer return an error while leaving an unaddressable interactive process running.
-- Closed diagnostic and mixed-version privacy side channels between remote account principals. Non-owner `server_info` no longer exposes global task/tool/call/process/audit activity, stable device-root key identity, protected local-resource inventory, Worker pending/socket/observability activity, or exact daemon-only tool names; principal-scoped managed-job and process-session aggregates remain available, while hidden global state is represented explicitly rather than forged as zero. The Worker now also attenuates `project_overview` returned by an older daemon before it reaches a non-owner account: absolute workspace/Git/top-level paths, daemon-only tool names, and daemon-global capability-routing history are removed while daemon tool counts and hidden markers remain. Account/relay activity projection fails closed unless account ownership is explicitly `true`. Owner diagnostics retain the complete authorized view.
-- Strengthened the privacy of local audit and edge observability without changing authorization semantics. Risky-operation target correlation is HMAC-keyed with a per-daemon runtime key before persistence, and account/client/family identifiers are likewise HMAC-pseudonymized before the existing per-file salted audit references are derived; the salt stored beside the audit chain is therefore no longer sufficient to recompute those references from guessed paths, short commands, or account identifiers. Cross-restart target/principal correlation is intentionally not promised. The throttled Worker edge logger now reuses the same value-level portable redactor as ordinary Worker observability, so credentials, email addresses, user-home paths, and private-key material embedded inside otherwise innocuous string fields cannot bypass key-name redaction.
-- Preserved privacy-bounded deny-path audit evidence at the same execution boundary. Once a relay operation has been effect-classified, `OperationAuthorizer` publishes only `allowed: false`, the coarse risk category/scopes, and the runtime-keyed HMAC target fingerprint into the request context before role-ceiling or protected-root checks can reject it. The existing outer audit middleware therefore records `authorization_denied` with the correct risk class and opaque target correlation instead of degrading a denied sensitive/external operation to `ordinary operation`; raw paths, argv, resource names, and raw target hashes remain absent from persistent audit state. Owner-only tools that are rejected before effect classification receive only a static `owner-only tool` category and no target fingerprint.
-- Closed a rolling-upgrade TOCTOU in stale resource-transaction recovery. If beta.61 observes a beta.60-compatible `transaction.lock/` directory without `owner.json` after the orphan grace, but the older holder completes `owner.json` before quarantine, recovery now revalidates that the owner record is still absent after moving the exact directory generation; a newly completed owner restores the directory and forces a wait instead of being deleted as an orphan.
-- Normalized newly added packaged source modules to ordinary `0644` file mode. The full `package:test` already rejects any npm tarball entry outside the expected `0644`/`0755` set; the correction prevents source modules created with owner-only local write defaults from becoming unreadable when a package is installed by one account and executed by another low-privilege service account.
-- Fixed `candidate-runtime-store-test` teardown so its top-level candidate and external symlink-target fixtures are removed in `finally` on both success and assertion failure. Repeated green runs had been leaving `mbm-candidate-runtime-*` and `mbm-candidate-outside-*` directories under the macOS temporary root; the nested symlink fixtures already had their own cleanup. Interrupted/force-killed tests can still leave ordinary OS-temporary evidence, but a successful run no longer accumulates it.
-- Kept managed-job effect classification aligned with the actual resource-injection contract. Protected local resources referenced through `stdin_resource`, `env_resources`, or `{{resource:name}}` argv tokens now all add the same `sensitive-read` effect scope and bounded reference-count projection, so audit/authorization metadata cannot describe an argv-injected secret as an ordinary persistent job.
-- Hardened the co-hosted OAuth authorization server for the final 2026 MCP authorization profile. Authorization-server metadata now advertises RFC 9207 issuer responses, successful authorization redirects carry the exact `iss` issuer, Protected Resource Metadata no longer advertises `offline_access` as a resource scope, and successful RFC 7591 Dynamic Client Registration returns `201 Created` instead of `200 OK` while retaining refresh-token support in authorization-server metadata. MCP 401 challenges now include only the minimum Machine Bridge resource scope alongside `resource_metadata` for both Bearer and DPoP paths. Persisted authorization codes, refresh tokens, and access tokens are rechecked against the canonical server scope when consumed; damaged scope state can no longer mint, rotate, or authorize credentials merely because the resource/audience still matches.
-- Hardened the retained DCR fallback against first-use trust confusion and capacity drift. The authorization page now labels an unapproved dynamically registered client as unverified and its display name as self-asserted, distinguishes a previously authorized account-bound client, and adds an explicit warning for loopback HTTP callbacks while continuing to show the exact validated redirect URI. Registration and owner client-admin views now share one client-capacity/idle-TTL contract, so `/admin/clients.maximum` reports the actual 50-client DCR ceiling instead of an obsolete 128-client value; unused and long-idle client pruning continues to use the same source constants.
-- Implemented RFC 6749 refresh-scope narrowing without shrinking the refresh grant itself. A refresh request may ask for an originally granted subset for the new access token, while the rotated refresh token retains the full source scope. The consumed-token retry marker records the access scope of the first replacement so bounded concurrent retries can reproduce the same deterministic token pair only under the same scope; a changed-scope retry is rejected rather than reinterpreting an already issued access token with broader authority.
-- Added the RFC 6749 cache-control compatibility header required on credential-bearing token responses: successful authorization-code and refresh exchanges now send both `Cache-Control: no-store` and `Pragma: no-cache` without changing generic MCP JSON response headers.
-- Fixed a source-verification liveness gap around Worker type generation. On the current Node 26.7.0 owner environment, both retained Wrangler 4.115.0 and current 4.120.0 can write the requested declarations, print the command's final completion notice, and then remain resident instead of returning control to `typecheck`; the A/B result therefore does not justify blaming the 4.120.0 upgrade. `worker:types` now deletes any stale target before launch, forwards Wrangler output, enforces a hard generation timeout, and grants a short post-completion exit grace only after both the final command-completion notice and a newly written target exist. A completed CLI that still does not exit is terminated gracefully; failure to terminate gracefully remains an error rather than being converted to success. A deterministic regression covers normal exit, completed-but-resident cleanup, nonzero failure, and a pre-completion stall, and the real `worker:types -> worker tsc -> local tsc` chain returns normally again.
-- Extended that bounded Wrangler lifecycle to the release `worker:dry-run` gate after final release-readiness review reproduced the same defect there: Wrangler 4.120.0 printed `--dry-run: exiting now.` and the complete upload/binding summary, yet the real CLI process remained resident for more than ninety seconds. `worker:types` and `worker:dry-run` now share one completion/timeout/termination state machine; a hanging command is accepted only after its command-specific completion marker (and, for generated types, the new target file) has been observed, then a bounded natural-exit grace and graceful termination succeed. Clean exit, completed-but-resident, nonzero failure, and pre-completion stall fixtures cover both adapters, and the real Worker dry run now returns zero with no residual Wrangler process instead of blocking release preparation indefinitely. The upstream Node/Wrangler lifecycle cause remains unresolved.
-- Closed a crash-recovery hole in the rolling-compatible resource transaction mutex after the full coverage sequence repeatedly reproduced `MBM_RESOURCE_TRANSACTION_BUSY`. If a process died after `mkdir(transaction.lock)` but before the atomic `owner.json` rename, `replaceFileAtomicallySync` could leave `.owner.json.<pid>.<nonce>.tmp` inside the ownerless directory. The existing incomplete-owner path intentionally used empty-directory `rmdir` so a late beta.60 owner publication could atomically defeat reclamation; the crash staging made that directory permanently non-empty and therefore permanently busy. `resource-staging-recovery.mjs` now recognizes only that exact owner-staging shape, waits for a still-current publisher, and removes only a dead-publisher single-link generation after identity revalidation; unknown, multiple, or hard-linked ownerless contents remain fail-closed, and canonical `rmdir` still preserves the late-owner race guarantee. Deterministic tests cover dead staging recovery, live-publisher preservation, and unknown-content refusal. The investigation also fixed the managed-job recovery fixture's separate unhandled-rejection escape hatch so setup-lock acquisition failure now wakes the readiness waiter and surfaces through the test boundary. Full critical coverage passes after the production repair.
-- Fixed the current MCP response proxy's upstream-failure semantics. An exception from the internal SSE reader previously entered the generic cancellation helper, which closed the public `ReadableStream` before `target.error()` ran; clients could therefore observe a transport failure as a clean EOF. Upstream pump failure now retains the public stream long enough to surface the original stream error while still aborting/cancelling the internal call and issuing the credential-free cancellation control. The regression requires the frame before the failure to arrive and the following public read to reject, while normal upstream completion and client/request cancellation continue to close cleanly.
-- Closed a managed-job launch ownership race around `runner.pid`. The launcher previously spawned the detached runner before publishing its provisional claim; if claim publication wrote the file but failed during its final permission check, the parent could classify launch as failed while a kill-delivery failure still left the child able to confirm that claim and execute. Runner claims are now two-phase (`committed:false` then an owner-only atomic `committed:true` replacement), and the child refuses to upgrade or execute an uncommitted claim. The managed-job integration regression covers idempotent committed publication plus an uncommitted valid pid/token claim that must time out unchanged.
-- Strengthened local authority revocation and terminal runtime teardown from "termination requested" to "termination settled" semantics. Windows `taskkill.exe` is asynchronous, so a successful spawn of the helper could previously let process-session revocation delete its retained handle and acknowledge the durable Worker revocation before the process actually closed. Process-session revocation now waits for `close` within a bounded deadline and retains/retries on non-settlement. Runtime shutdown additionally drains the shared process tracker, immediately terminates any child registered after drain begins, waits for all tracked children and process sessions to close, and enters a distinct retryable `stop_failed` lifecycle state rather than advertising `stopped` when ownership remains. Superseded/fatal relay callbacks and CLI signal shutdown now await that teardown before releasing the daemon lock or exiting.
-- Closed the final shutdown late-spawn window above the process tracker. `CallRegistry.cancelAll()` used to abort and immediately `finish()` every call, erasing handler ownership before the handler's lifecycle `finally` had actually returned; such a cancelled handler could therefore register a child after an empty process drain had already completed. Runtime shutdown now uses a terminal call-registry drain that rejects new opens, cancels existing calls without deleting them, waits for real handler `finish()` settlement on a monotonic deadline, and only then begins the process/session drains. A stalled handler remains accounted and makes shutdown retryable rather than allowing daemon ownership release. The critical coverage gate now includes both this call-drain helper and the extracted process-session termination helper, and coverage collection includes the dedicated process-output/authority-settlement regression.
-- Made that `stop_failed` retry contract real rather than nominal. `ProcessTracker.drain()` previously kept its per-child `drainRequested` marker after a failed settlement deadline, so a later `runtime.stop()` retry could retain the child but never issue another termination request. Failed drains now clear only the surviving attempt markers before returning retryable `unavailable`; a deterministic first-fail/second-success regression requires the next drain to send termination again. The same review unified one-shot processes, process sessions, and managed-job steps on `child-process-settlement.mjs`: all prefer real `close`, but an observed `exit` with no `close` gets the same one-second residual-stdio fallback before tracker/session/resource release. Adapter-level fault injection proves one-shot and session ownership no longer remains indefinitely when libuv never emits `close`, while the managed-job integration suite remains green after removing its duplicate settlement wiring.
-- Normalized six newly added local source modules from owner-only `0600` working-tree modes to ordinary read-only-source `0644` package modes after the npm package contract caught them at task 112/117. Two were introduced by this review and four predated it in the current uncommitted tree; no content or executable bit changed. The package manifest regression now passes with all 417 packed files using their expected modes.
-- Removed the obsolete fire-and-forget process-session `clear()` path after all production and test cleanup moved to close-settled `clearAndWait()`. Also eliminated unexplained empty `catch {}` blocks from production source: intentionally suppressed parse, observer, socket-close, temporary-cleanup, and last-resort diagnostic failures now carry an explicit local rationale, while the review of those sites drove the ownership fixes above instead of merely adding comments.
-- Advanced the exact source and private control-plane Wrangler toolchain from `4.115.0` to `4.120.0` and its reviewed lifecycle-script allowlist from `workerd@1.20260722.1` to `workerd@1.20260801.1`. The private toolchain still pins Wrangler, undici `7.29.0`, sharp `0.35.3`, and install-script permissions exactly. Prior deploy dry-run, private-toolchain lifecycle, and live Worker OAuth/MCP evidence remains specific to the recorded source/runtime generations; current source type generation additionally uses the bounded completion/cleanup contract above instead of treating raw CLI process exit as the only completion signal.
-
-## 3.0.0-beta.60 - 2026-08-08
-
-- Supersede the unactivated beta.59 candidate before publication and move resource coordination into a separate beta.60 change. The beta.59 tarball/manifest were removed; the running service remains on the previously activated baseline until a new candidate is independently verified.
-- Add a per-user durable resource coordinator shared by one-shot processes, process sessions, detached managed-job steps, and compatible external workflow runners. Heavy/adaptive roots acquire crash-recoverable PID/start-time leases with CPU, I/O, memory, and disk reservations; control-plane/internal fixed commands and explicit light reads bypass the heavy gate. Interactive calls wait only briefly and return a structured retryable capacity error, while detached/background work may queue without consuming local MCP call slots.
-- Make admission work-conserving rather than globally serial: host pressure combines macOS memory pressure, pageout/swapout deltas, CPU/load, thermal state, disk throughput/IOPS, free-space floors, and a five-second startup reservation window; Green permits bounded overcommit, Yellow tightens it, and Red defers heavy work. Durable waiters use interactive/ordinary/background priority with two-minute aging and select the highest-priority request that actually fits, avoiding head-of-line blocking. Same-project Cargo/Swift/Xcode/JS build families serialize only their shared cache family while unrelated projects can still run concurrently.
-- Bound compiler fan-out and move supported build caches outside repositories. Cargo receives `CARGO_BUILD_JOBS` plus a stable per-project `CARGO_TARGET_DIR`; direct SwiftPM uses documented `--jobs`/`--scratch-path`; direct Xcode uses `-jobs`/`-derivedDataPath`; explicit user paths remain authoritative. macOS caches live under `~/Library/Caches/AgentBuilds.noindex` with a Spotlight exclusion marker. Build-root preparation is transactional with admission: any preparation failure releases the lease instead of leaving phantom capacity.
-- Add privacy-safe resource diagnostics and strict protocol validation. `diagnose_runtime` reports pressure state, aggregate reservations, and waiter counts without command text or project paths; lease/waiter files are owner-only, bounded, strict-schema records and stale PID generations are reclaimed. New fast-plan tests cover pressure/admission, fairness, project contention, build-root controls, override propagation, and failure-path lease release.
-- Make the shared coordinator crash-consistent across its own atomic file primitives. A runner killed between hard-link publication and staging unlink, or during an atomic lease replacement, can leave a strictly named `.lease_*.tmp` generation. The coordinator now recovers only provable internal staging shapes: same-inode two-link committed aliases, or dead-publisher single-link uncommitted replacements. All other unexpected directory entries still fail closed; managed-job integration uses a test-private coordinator/build root so fault injection cannot corrupt the real user scheduling domain.
-- Correct an over-conservative shell-script profile discovered by the real-world workflow gate. Named build/test/verify/gate/release/archive/fuzz shell roots now use a bounded mixed reservation (`2.5` CPU, `0.5` normalized I/O, 2 GiB memory, 3 GiB disk) with same-project serialization instead of being treated as effectively unbounded. This keeps process-tree accounting conservative while allowing long project gates to start under ordinary Yellow load; Node and Python profiles use the same values.
-
-## 3.0.0-beta.59 - 2026-08-08
-
-- Reject the activated-but-unaccepted beta.58 candidate after live browser verification found that the local CLI `browser setup` path had not migrated with the hardened pairing protocol. The MCP pair action opened the new process-owned ephemeral listener, but the CLI still opened the sanitized long-lived broker `/pair` URL directly. That page intentionally contains no grant, so the `document_start` content script exits without bootstrap material and first pairing cannot complete. beta.58 has no acceptance record and must not be published.
-- Make the ephemeral pairing launcher the single grant-construction boundary. Callers now provide only the broker port and current extension credential; `browser-pairing-launch.mjs` creates the 30-second grant itself. The CLI reads the current non-legacy pairing state through the same bounded/no-follow/single-link store path, opens the same one-shot listener as the MCP action, keeps its printed/JSON `pairing_url` sanitized, and closes the listener immediately if the OS browser opener fails.
-- Add `browser-cli-pairing:test` to the fast plan and release contract. The regression runs a real ephemeral listener against temporary pairing state, proves the opened port differs from the broker port, verifies the fragment carries only broker port plus short-lived grant, verifies the served page contains neither grant nor long-lived token, and requires opener failure to leave no reachable listener. Architecture guards forbid the CLI from reopening the fixed broker URL directly.
-
-## 3.0.0-beta.58 - 2026-08-08
-
-- Bound signed account-admin request bodies before hashing or parsing. The authorization path now drains the original network body once under the 64 KiB limit, hashes those exact bytes, and rebuilds the internal admin request from the verified buffer; declared oversize bodies are cancelled before the first pull and chunked oversize bodies stop at the limit.
-- Bound internal MCP JSON materialization too: stream descriptors are capped at 1 KiB and HTTP terminal fallback responses reuse the resumable-message byte ceiling instead of calling bare `response.json()`.
-- Make managed-job approval normalization strict: explicit invalid booleans, timeouts, capture modes, final-step lists, or temporary-file lists are rejected instead of silently becoming defaults. Corrupt resource registries no longer truncate beyond 64 entries or normalize invalid `resources` types to an empty registry.
-- Preserve browser rollback readability while hardening pairing. The envelope remains schema 2 for beta.55 compatibility and uses `pairingAuthVersion: 2`; `migrationPending` is a required boolean. Explicit pairing now uses a process-owned one-shot random loopback page, so a process occupying the long-lived broker port cannot redirect the fragment bootstrap. Both normal broker auth and first-pair auth require an init HMAC before allocating pending state, and repeated identical challenges are idempotent rather than consuming extra slots.
-- Remove remaining small semantic drift: MCP HTTP era detection now checks the supported-version set rather than index 0 and uses one legacy fallback; call-registry origin diagnostics use a null-prototype map so prototype-shaped origin labels remain ordinary data.
-
-- Supersede the unfinished beta.57 candidate after continued SSH fault injection found that hard-link installation still released the staging pathname without a descriptor-pinned ownership check. The installer now holds the original staging file descriptor across `link`, compares the post-link target and source against the descriptor after link-count/ctime mutation, removes the staging source only while it still matches that generation, rolls back a verified installed target if the source changes, and performs final staging cleanup only against identities captured from the generated files. A deterministic regression replaces the staging pathname immediately after link creation and requires both the installed target rollback and preservation of the replacement.
-- Bind provisional managed-job runner claims to one launch attempt rather than PID alone. Publication rejects malformed launch tokens before creating `runner.pid`, and an existing claim is reusable only when both PID and the 32-hex launch token match, so PID reuse or a second launch in the same parent process cannot inherit stale runner ownership.
-- Remove reusable browser broker credentials from the network path and close the first-pair loopback TOFU gap. Already-paired runtime/extension clients first send a role-bound init HMAC so untrusted local processes cannot consume challenge slots, then authenticate the broker with role-separated HMAC server proofs before WebSocket upgrade and send only five-second one-time client proofs; legacy bearer subprotocols are rejected. The fixed `/pair` HTTP page is permanently token-free. An explicit pair action places a 30-second bootstrap only in the URL fragment; the Manifest V3 content script runs at `document_start`, strips the fragment before page scripts, and keeps it in the extension isolated world. A two-step `/pair-auth` exchange uses that fragment proof as the temporary key: an init HMAC is verified before any pending slot is allocated, then the broker proves possession, consumes the client proof once, and only then releases the long-lived extension token. The pairing envelope intentionally remains schema 2 so beta.55 rollback can still read it; `pairingAuthVersion: 2` marks the hardened protocol, rotates the previously page-exposed extension token, preserves the runtime key for migration identity, and persists `migrationPending` so an old broker occupying the original port causes a fail-closed restart requirement rather than adjacent-port split-brain.
-
-## 3.0.0-beta.57 - 2026-08-08
-
-- Supersede the unactivated beta.56 candidate after another independent architecture/security review found additional packaged local-state and rollback defects. Beta.56 had no activation or acceptance record; its tarball/manifest were removed before these changes. Live beta.55 remains the operational service while beta.57 is verified.
-- Make SSH-key setup validate before mutation and compensate by object identity instead of pathname. Existing private/public pairs are fully verified before any permission normalization; permission changes reopen the exact expected generation and fchmod the descriptor, so an invalid or replaced public path cannot be widened to `0644`. Generated-key results retain non-enumerable internal generation identities for rollback without exposing key bytes or identities through CLI/MCP JSON. State-write rollback and partial key installation delete only files that still match those identities, preserve replacements, retain primary-before-cleanup error causality, verify a newly linked target is still the staging inode before source cleanup, and remove the unreachable cross-filesystem copy fallback for same-directory staging.
-- Treat malformed managed-job runner ownership as damaged authority, never absence. Successfully read but invalid `runner.pid` JSON now propagates as unreadable ownership; pruning retains the job directory and logs only a bounded error class, while active-job inventory conservatively reports `unreadable` with `runner_alive=true` so uninstall cannot proceed from corrupt ownership evidence. Managed-job JSON readers also distinguish legitimate atomic-generation churn from corruption: a stable `MBM_IDENTITY_CHANGED` code may be retried at most four times so the runner can publish terminal status concurrently with readers, while persistent churn, hard links, symlinks, and other I/O still fail closed as `identity_changed`/their existing error class.
-- Bind service-definition removal to the definition observed before provider shutdown. Launchd/systemd uninstall snapshots the no-follow, single-link filesystem generation before stop/disable and removes the definition only if that exact generation remains afterward. A replacement or newly appeared definition is retained and removal returns `definition_changed` instead of deleting a pathname merely because the provider was stopped. Windows Task Scheduler removal likewise snapshots the state-root `service-launcher.cmd`; successful task deletion removes only that unchanged launcher, while a replacement is retained and returns `launcher_changed`.
-- Eliminate stale workspace-state mutations around startup locks. SSH resource registration, ordinary start, secret rotation, and persistent activation use pre-lock state only to identify the lock namespace, then reload authoritative workspace state after acquiring the startup lock before modifying resources, policy, Worker/device state, or persisted secrets. Daemon-only service network environment is likewise loaded only after that lock/fresh-state boundary, preventing a wait from pinning obsolete proxy/CA values into `process.env`. Ordinary foreground start no longer performs its later best-effort machine-global autostart write after releasing all service serialization: it reacquires a short `runtime-start-autostart` machine-service lock only around the final provider/service-owner/environment mutation, without holding that lock across Worker/OAuth/relay network work.
-- Remove the unused `state-locations.mjs`. The beta.53 review had incorrectly described it as an active state-location boundary and claimed direct `state.mjs` fan-in fell to 17; a later import-graph audit proved the module had zero importers, its Windows/state-root/workspace-hash semantics had already diverged from the live contract, and actual direct `state.mjs` fan-in is 22. Static package identity remains correctly isolated in `package-identity.mjs`; state-root/profile/workspace identity remains in `state.mjs` until a future extraction has real consumers and parity tests.
-- Prevent same-state browser broker split-brain after partial proxy authentication. A contender that receives `EADDRINUSE` still probes the existing broker with the shared runtime credential; if the WebSocket upgrade succeeds but the authenticated peer does not complete its runtime hello before the bounded handshake deadline, startup now fails and retries later instead of moving to another port, becoming a second owner, and rewriting the shared pairing port. Unauthenticated/unrelated occupied ports can still fall through to the next bounded port.
-- Distinguish the exclusive-file publisher's own hard-link commit window from persistent multiple-link ownership corruption. `createExclusiveFileSync` intentionally links a fully written staging inode to its final no-replace name before unlinking the staging alias; a concurrent legitimate reader can therefore observe `nlink=2` for a few microseconds. Secure-file now reports that condition as `MBM_MULTIPLE_HARD_LINKS`, and only process/owner-state/managed-job locks, browser pairing, and runner-claim reads that explicitly consume this publication protocol retry it up to four times with 1 ms scheduling gaps. A persistent hard link still fails closed after the fixed budget. Runner claims also moved from the generic bounded reader to path-identity-verified, single-link reads.
-
-## 3.0.0-beta.56 - 2026-08-08
-
-- Supersede beta.55 after exact-head CodeQL reported `js/insecure-temporary-file` on the new POSIX managed-job directory descriptor open. The call is read-only (`O_RDONLY | O_NOFOLLOW | O_DIRECTORY`) and never sets `O_CREAT`, so it does not create a temporary file; however CodeQL models an `open` reached from an OS-temp test path as insecure when no explicit private mode argument is present.
-- Keep the descriptor-pinned directory design and make its privacy contract explicit by passing mode `0o700` to `openSync`. Node ignores the mode when no file is created, while the explicit owner-only mode documents the intended boundary and satisfies the static-analysis model without weakening no-follow, directory-only, descriptor identity, canonical containment, or inode-pinning guarantees. A managed-job boundary regression captures the actual third argument and requires `0o700`; architecture tests prohibit dropping it.
-- Invalidate the beta.55 acceptance and candidate because `src/local/managed-job-directory.mjs` is packaged source. Beta.56 requires a new frozen-source verification, exact candidate, owner activation, independent live verification, acceptance, guarded push, and exact-head provider checks. The live beta.55 Worker remains operational and retains the previously verified Durable Objects rows-read repair.
-
-## 3.0.0-beta.55 - 2026-08-08
-
-- Supersede the activated and locally accepted beta.54 candidate after exact-head Ubuntu CI exposed a filesystem-generation ABA defect. The secure-file regression deleted a snapshot source and recreated the same pathname; Linux immediately reused the freed inode, so the production `(dev, ino)`-only identity comparison treated the replacement as the original file. The test failure is therefore release-blocking production evidence rather than a flaky fixture.
-- Extend the shared filesystem identity with change-time generation. Real Node 26 BigInt `fstat`/`lstat` observations retain exact `ctimeNs`; Number-backed injected metadata may retain `ctimeMs`; when either compared identity has generation evidence, both must carry the same generation. This keeps the existing lossless device/inode protection while rejecting same-inode unlink/recreate ABA across secure descriptor/path checks, owner/state cleanup, process and managed-job locks, Worker-secret cleanup, security-audit identity, and SSH-key snapshots.
-- Preserve legitimate self-mutation in Worker-secret setup. The temporary secret file keeps its creation identity until the mandatory owner-only chmod succeeds, then refreshes the identity before the deployment callback so final cleanup compares against the post-chmod generation. A deterministic injected regression changes only `ctimeNs` across that intentional chmod and requires cleanup to succeed against the refreshed generation. Managed-job directories deliberately use a different invariant: directory ctime changes whenever children are created or removed, so POSIX resolution pins an `O_DIRECTORY|O_NOFOLLOW` descriptor across realpath/path rechecks and compares exact device/inode while the old inode cannot be recycled. Windows retains exact device/inode path rechecks because Node does not expose the same directory-descriptor behavior there.
-- Keep beta.54's Durable Objects quota result as operational evidence only. The owner activated the exact beta.54 candidate and live Cloudflare analytics showed beta.50 at 24,801 rows read across 546 invocations (45.42 rows/request) versus beta.54 at 3,321 rows across 280 invocations (11.86 rows/request) over the first three complete post-activation minutes, about a 74% reduction despite materially higher request rate. That validates the DO repair but does not authorize publishing a candidate whose packaged local filesystem source is now known to be incomplete. The beta.54 acceptance record is removed; beta.55 requires a fresh exact candidate, owner activation, live verification, acceptance, guarded push, and exact-head provider checks.
-
-## 3.0.0-beta.54 - 2026-08-08
-
-### Durable Object rows-read amplification repair
-
-- Supersede beta.53 before candidate preparation after live Cloudflare quota evidence exposed a release-blocking Durable Objects read-amplification defect. After the free-tier daily reset at 00:00 UTC, the active beta.50 deployment had already accumulated 1,344,623 `rows_read` and 13,918 `rows_written` by roughly 03:31 UTC. The reads came from one active `BridgeRoom` object and were accompanied by thousands of hibernation/HTTP stream-disconnect events, proving that the previous 90% daily warning was not a one-off spike. Beta.53 had no release candidate, activation, or acceptance record.
-- Remove the hot-path full-table sweep that caused the quota growth. Ordinary HTTP/WebSocket event entry now checks the persisted Durable Object alarm and enumerates durable stream records only when the alarm is missing, already due, or unreadable. A future alarm is authoritative for existing durable deadlines. New durable-call admission updates the active stream row and advances the persisted alarm to no later than the operation deadline inside the same storage transaction, so a crash cannot leave a committed earlier call behind a later alarm. Post-dispatch scheduling only coalesces daemon/transient deadlines and does not rescan durable rows. Actual alarm events still perform bounded durable expiry/recovery and compute the next deadline.
-- Collapse legacy streamed-call admission into one transaction. Request-idempotency, expiry pruning, completed-stream capacity, daemon-call capacity, stream creation, and durable-call activation share one `list({prefix:"mcp-stream:"})` observation and one active-stream write before daemon dispatch. The removed beta.44 global `mcp-stream-index` remains migration-only and is never recreated, so the rows-read repair does not reintroduce the old global-row write hotspot.
-- Give each new random stream/call generation one shared random suffix. Daemon terminal results can therefore point-read the exact stream row instead of scanning all retained streams by call ID. Pre-beta.54 calls used independent random IDs and retain only a bounded migration fallback after a point miss until those old pending calls expire. Duplicate terminal results against a ready derived stream also stop after the point read and cannot fall back to enumeration.
-- Remove the production request-key full-scan helper. Lost legacy `prepare` responses are still idempotent because the combined admission transaction returns the already authoritative stream as `resume`; changed arguments still conflict before a second daemon send. Sessionless legacy calls remain intentionally non-idempotent and receive independent random stream generations. Modern request-scoped cancellation returns after the transient-registry miss instead of scanning legacy durable state.
-- Add explicit Durable Object read observability and budgets. `server_info` now exposes isolate-local aggregate `stream_rows_read_estimate`, `stream_gets`, `stream_lists`, and `stream_list_rows` beside the existing write/alarm counters without recording storage keys, stream IDs, request IDs, or account identity. Tests retain 24 background stream rows and require the production combined lifecycle to perform one prefix scan at admission, one point lookup for terminal ownership, zero prefix scans during settlement/duplicate terminal lookup, and three stream-row mutations through acknowledgement cleanup. Future-alarm scheduling tests require zero durable deadline scans and preserve missing/overdue-alarm recovery.
-- Treat the fix as unverified until it is observed live. The currently running accepted service remains beta.50 and will continue consuming the old read pattern until an exact beta.54 candidate is owner-activated. Beta.54 requires complete frozen-source gates, an exact candidate, owner activation, independent service/Worker identity verification, and a post-activation Cloudflare `rows_read` slope check before acceptance.
-
-## 3.0.0-beta.53 - 2026-08-08
-
-- Make local ownership snapshots descriptor-coherent. Process/startup locks, managed-job locks, owner-state/owned-JSON cleanup, service ownership, state recovery markers, and persisted control JSON now bind bytes and lossless BigInt filesystem identity to the same open descriptor, reject multiple hard links, and recheck single-link identity at destructive removal. Corrupt state recovery preserves the exact bytes that were classified as corrupt and will not rename or delete a path that was replaced after inspection.
-- Harden destructive evidence and provider cleanup. Worker-name inventory and state-root/log-schema markers use identity-verified single-link reads; a nonzero Wrangler delete result can no longer become success from stderr prose. Systemd removal is decided from parsed provider state plus command exit status, retains an installed unit after any failed disable, and no longer assumes a missing unit file means an in-memory service is inactive.
-- Deep-validate the main Durable Object OAuth store before authorization consumes it. Persisted accounts, clients, codes, tokens, throttling records, map keys, redirect/resource URLs, PKCE material, refresh families, DPoP thumbprints, and authorization identities now have a shared bounded contract. Structurally corrupt schema-1 state fails with the existing repair-required service error while invalid account roles retain their explicit quarantine/revocation path.
-- Remove check/use splits in local file flows. Browser resource injection now uses the exact byte snapshot that passed resource validation; managed-job internal plan/status JSON uses identity-verified single-link reads while explicitly supplied user files retain ordinary hard-link compatibility; external plan file errors are no longer mislabeled as JSON parse failures.
-- Reduce duplicate static package-identity parsing by moving package root/name/version to `package-identity.mjs`. The same review also introduced `state-locations.mjs` and reported that state path/hash consumers had migrated to it; beta.57 later proved that statement incorrect: the module had zero importers, the live path contract remained in `state.mjs`, and the claimed fan-in reduction to 17 never occurred. The dead/divergent module is removed in beta.57 rather than retroactively treated as an architectural boundary.
-- Remove duplicate and obsolete adapters: CLI browser pairing now consumes a port-only projection from the canonical pairing store instead of parsing credential state itself; CLI/account/stdio reuse package identity instead of reparsing the root manifest; duplicate package-root calculation, unused device-root/WebCrypto/bearer adapters, `remoteBridgeError`, and the unused active-status convergence wrapper were removed.
-- Tighten privacy and diagnostic cardinality. Worker health accepts only a bounded printable version token before including it in mismatch diagnostics; structured local/Worker log maps and security-audit target projection use null-prototype objects; audit target hashing is canonical across object key order while retaining prototype-shaped own keys; `search_text` skip logic uses typed error reasons instead of English messages.
-- Clean reconstructible ignored review evidence from `.project-local`, reducing the local scratch tree from about 135 MiB to about 12 MiB before the final verification scratch, and remove obsolete local files containing the live Worker endpoint. Tracked/package privacy scans continue to contain only synthetic/example sensitive-looking fixtures.
-- Invalidate and delete the unactivated `3.0.0-beta.52` candidate. Beta.52 was never owner-activated or accepted. Beta.53 requires a new full verification, exact candidate, owner activation, independent live verification, and acceptance cycle; no beta.52 candidate hash or prior full-gate result is release evidence for beta.53.
-
-## 3.0.0-beta.52 - 2026-08-08
-
-- Re-review two external agent/control-plane codebases at fixed upstream commits before the next owner activation: `earendil-works/pi@e47b8e37a6211ebd0b2942fa87059d64f81eec02` and `huangruiteng/loopx@29b086a1752a5329cb46de220225f2902353af3e`. The review line-scanned the complete text/source trees and then deeply traced their concurrency, deferred-tool, retry, lease, state/projection, output-budget, canary, and transaction implementations against Machine Bridge rather than importing either architecture wholesale.
-- Apply Pi's bounded metadata fan-out pattern only where Machine Bridge had independent read-only I/O. `list_dir` now resolves metadata in ordered batches of 16 instead of serially awaiting up to 10,000 `lstat` operations. A 10,000-file local benchmark kept byte-identical output while reducing the stable median from about 160 ms to 79 ms; fault tests require bounded concurrency, enumeration-order preservation, cancellation between prefetched entries, and exact consumed-error behavior.
-- Apply the same ordered bounded fan-out to `search_text`. Up to 16 independent secure file reads execute concurrently, but results are consumed in the original walk order; `max_files`/`max_matches` accounting and early-stop semantics remain sequentially equivalent, and failures from work beyond an already-satisfied stop condition cannot escape. Three old-vs-new result fixtures are byte-identical; the 10,000-small-file no-match benchmark fell from about 649 ms to 287 ms median, with colder prototype runs showing larger gains.
-- Extend the explicit compact read-model pattern from `server_info` to `project_overview`. `detail: "summary"` preserves workspace/Git identity, effective and daemon policies/tool counts, compact capability-routing evidence, and up to 40 top-level `name/type` entries while omitting exact tool arrays, account ID, routing fingerprints, per-entry absolute paths/sizes, and long cold-path explanations. Remote calls deliberately ask the daemon for its backward-compatible default/full state, compute authenticated account authority in the Worker, and only then project summary; durable replay persists the requested summary bit and performs the same post-authority projection. The empty/default call remains backward-compatible `full`. On the current workspace the local result shrank from roughly 7.5 KiB to 2.7 KiB and a simulated owner-decorated remote result from roughly 10.5 KiB to 3.5 KiB.
-- Add LoopX-style semantic output ratchets without adopting its canary scheduler. Compact `server_info` and `project_overview` now have absolute size budgets, exact hot-path shape assertions, and scale tests proving that hundreds of tool names/per-tool counters do not make the summary grow or leak cold-path identities. New directory/search/projector modules are critical-coverage gated. Dynamic task-dependent MCP tool exposure is intentionally not copied from Pi's provider-level deferred tools: MCP tool-list changes are a protocol/client concern, and Machine Bridge keeps a deterministic stable catalog.
-- Invalidate and delete the unactivated beta.51 candidate because these improvements change packaged production bytes. Beta.51 was never owner-activated or accepted. The persistent live beta.50 service remains operational evidence only; beta.52 requires a fresh full gate, exact candidate, owner activation, observed live verification, acceptance, guarded push, and exact-head provider checks.
-
-## 3.0.0-beta.51 - 2026-08-07
-
-- Supersede the accepted-but-unpublished beta.50 candidate after exact-head provider checks exposed two release blockers. JavaScript/TypeScript CodeQL rejected two packaged no-op assignments (`ownsTemporary = false` immediately before return in atomic replacement and `staged = false` immediately before return in workspace atomic write). Remove those assignments without changing settlement or cleanup semantics; because packaged source bytes change, beta.50 acceptance is invalid for publication and a fresh candidate/activation/acceptance cycle is mandatory.
-- Fix the Windows-only security-property fixture for managed-job identity checks. The test previously compared injected paths against the POSIX literal `/tmp/jobs`, while production correctly resolves the requested root first; on Windows the drive-qualified canonical path caused the fixture to trigger an earlier root-identity mismatch and never reach the intended canonical-target assertion. The fixture now uses `path.resolve()`/`path.join()` for root, outside target, and expected job directory. Production managed-job resolution is unchanged.
-- Remove `release-acceptance/v3.0.0-beta.50.json` from the release branch because provider-side gates found defects after local acceptance. The live beta.50 owner activation remains historical operational evidence only; beta.51 must pass the complete local suite, exact candidate preparation, owner activation, observed live verification, acceptance, guarded push, and exact-head provider checks before prerelease publication.
-
-## 3.0.0-beta.50 - 2026-08-07
-
-### Close independent-review filesystem, stream, logging, and privacy gaps
-
-- Supersede beta.49 before owner activation. A fresh independent review found that patch collision identity and patch commit identity had diverged: the per-path mutation coordinator case-folded resolved paths on Windows and macOS, while patch collision detection case-folded only Windows and staged patch targets still used overwrite-capable rename. On a common case-insensitive macOS volume, two patch targets such as `Foo` and `foo` could therefore pass preflight and one staged commit could replace the other. Beta.49 was never activated; its private candidate was removed and must not be accepted or reused.
-- Make one `fileMutationPathKey` the path-conflict identity for both coordination and patch preflight. Patch targets now commit with a no-overwrite hard-link primitive; a target that appears after preflight fails as `conflict/target_appeared` rather than being replaced. Fault injection covers Darwin case aliases, late `EEXIST`, same-path ordering, and multi-path reservations.
-- Extract staging, whole-file commit, multi-file patch commit, rollback, and artifact cleanup into `workspace-file-transaction.mjs`. `workspace-file-service.mjs` returns to authorization/path/content orchestration and falls below a tightened responsibility ceiling. Pre-commit cleanup failure preserves `[primary, cleanup...]` causes behind a non-exposed internal error; post-commit staging cleanup returns a fixed warning instead of retroactively reporting a committed mutation as failed.
-- Harden the shared exclusive-file primitive used by owner state, locks, managed-job claims, pairing state, audit state, and Worker-secret setup. Remove the unused `cleanupTargetOnFailure` behavior that could delete an already-existing target after `EEXIST`; aggregate pre-commit staging cleanup failures with the primary error; and represent post-commit staging cleanup as a non-serialized internal artifact plus a fixed warning. Worker-secret setup immediately retries such a secret-bearing staging artifact with an identity check and refuses deployment if cleanup cannot be proved.
-- Generalize the beta.47 Windows filesystem-identity correction. `filesystem-identity.mjs` now rejects lossy Number-backed device/inode values and compares exact BigInt identities. Secure descriptor/path verification performs independent BigInt `fstat`/`lstat` observations instead of treating unsafe identifiers as equal. Process/startup locks, managed-job locks/directories, Worker-secret cleanup, exclusive owner-file removal, security-audit cache identity, and SSH-key snapshots use the shared lossless boundary. Tests distinguish adjacent inode values above `2^53` and require unrepresentable Number identities to fail closed.
-- Remove the Worker legacy-stream channel's process-wide subscriber-admission Promise. Subscriber count plus WebSocket registration is a synchronous per-stream Durable Object admission step; the post-registration storage recheck must not serialize unrelated streams behind one slow storage read. A deterministic regression holds one stream's recheck open while another stream must subscribe independently, and the channel responsibility ceiling is tightened.
-- Reduce routine log metadata. Worker unexpected HTTP errors report a bounded route class (`mcp`, `daemon`, `oauth`, `admin`, or `other`) rather than the raw request pathname. Routine Worker deployment success/progress logs no longer retain the workspace-derived Worker name or `workers.dev` endpoint; the explicit ready/connection handoff still prints the endpoint when the operator actually needs it.
-- Re-review ignored local artifacts as privacy state, not merely Git-excluded files. Remove reconstructible downloaded toolchains/experiments, obsolete timeout snapshots, and stale beta.13-beta.15 live endpoint probes that had no tracked references. The local review directory fell from roughly 406 MiB to 12 MiB and no remaining ignored text file matched the live Worker-endpoint pattern. Tracked/unignored privacy and reachable-history gates remain authoritative for publication.
-- Distinguish malformed lock content from lock-storage failure across startup/daemon, owner-state, managed-job transition/recovery, and runner-owner reads. Successfully read malformed JSON may use the existing bounded stale-recovery rules, but oversized, permission, I/O, descriptor, or identity failures now propagate and retain the lock/job state for inspection instead of being treated as an absent or reclaimable owner. Deterministic oversized-lock regressions cover startup, daemon-owner inspection, owner-state, recovery, and runner metadata.
-- Preserve daemon log evidence when its schema marker cannot be trusted. Only a missing marker or a successfully read explicit schema-version mismatch can initialize/reset log format; an oversized, inaccessible, symbolic, hard-linked, or otherwise unreadable `.log-schema` blocks trimming before either daemon log is truncated. A cross-platform oversized-marker regression verifies both log streams and the marker remain byte-for-byte intact.
-- Preserve the decisions not to over-refactor: the local/Worker import graph remains acyclic, same-OS-user adversarial filesystem replacement remains an explicitly documented residual risk requiring OS isolation, and near-ceiling OAuth/daemon/diagnostic modules are not split unless an independent responsibility can be extracted without obscuring their state machines.
-
-## 3.0.0-beta.49 - 2026-08-07
-
-### Remove unrelated file-mutation contention without weakening commit safety
-
-- Replace the process-wide file mutation queue with a dedicated per-resolved-path coordinator. Writes and edits to the same canonical target remain strictly ordered, while independent files no longer block each other merely because they share one runtime.
-- Reserve every source and destination of a multi-file patch synchronously before waiting on prior reservations. An overlapping write/edit/patch therefore queues behind the complete transaction, unrelated paths remain concurrent, and no lock-order cycle can arise between two multi-path mutations.
-- Keep each path reservation until the mutation callback itself settles; cancellation does not race the lock release ahead of an already-started filesystem await. Existing SHA-256 compare-and-swap checks, flushed temporary files, atomic rename/link commits, symlink and hard-link protections, patch collision checks, and rollback semantics remain authoritative.
-- Add direct concurrency/failure regressions, same-file concurrent edit coverage, architecture ownership limits, and critical-module coverage for the new coordinator. `LocalRuntime` no longer owns a global mutation queue, restoring composition-root headroom.
-- Add an opt-in `server_info { detail: "summary" }` hot-path projection inspired by LoopX's canonical-decision/compact-projection split. The existing empty/default call remains byte-shape compatible with full diagnostics. Summary keeps effective policy/count, automatic-execution/owner-ambient-authority semantics, daemon readiness and relay state, bounded pending/socket capacity, and foreground/settlement limits while omitting account identifiers, OAuth metadata, exact tool arrays, and per-tool observability. Worker projection ownership moves out of stream dispatch, and legacy resumable calls now preserve the detail argument.
-- Extract the Worker daemon-status projection into `daemon-status.ts`; `BridgeRoom` retains stale-socket reclamation but no longer owns the ready-socket/attachment-to-status mapping. The Worker composition root falls from 843 to 820 lines and its architecture ceiling is tightened from 850 to 830.
-- Define handler return as the local tool settlement point. Cancellation remains cooperative before/during cancellable work, and remote cancellation still suppresses a result whose owner stopped waiting, but a signal arriving after a non-cancellable commit has begun can no longer make `ToolExecutor` report `cancelled` after the handler, observability, and audit have recorded successful completion.
-- Preserve the primary owner-state operation failure when lock release also fails. Shared state locks now aggregate `[primary, release]` in causal order instead of allowing a changed/unreadable lock during cleanup to replace the original failure.
-- Set repository `save-exact=true` in addition to `engine-strict=true`. Root dependency fields were already architecture-gated to exact semantic versions; the npm setting prevents future save operations from silently reintroducing ranges. The project deliberately does not set npm `min-release-age`: a blanket age window can block a newly published security fix, while Machine Bridge already uses exact pins, committed locks, hardened npm, audit/signature checks, and reviewed lifecycle-script allowlists.
-- The accepted beta.48 artifact remains valid evidence only for beta.48 and cannot be reused for beta.49.
-
-## 3.0.0-beta.48 - 2026-08-07
-
-### Keep release activation out of first-run account provisioning
-
-- Supersede beta.47 after the owner ran the exact candidate activation command and the Worker advanced to beta.47, but the command exited nonzero with an `unauthorized` authentication error before foreground candidate relay readiness. Forward recovery then installed, started, and verified the exact beta.47 login service, so remote control recovered and the live Worker/daemon converged on beta.47; however, no beta.47 activation record was written and the failed owner command is not valid release evidence.
-- Remove the redundant initial-owner provisioning round trip from candidate activation and its one allowed same-identity Worker repair. Candidate activation already requires an existing deployment; after Worker convergence it now creates only the device session needed for the candidate relay. Ordinary first-run/start still checks account inventory and creates the initial owner when required. This removes an independent account-admin authentication dependency from the pre-readiness release path without weakening relay authentication or account administration.
-- Preserve the phase boundary: any failure before candidate relay readiness still exits nonzero even if forward recovery later restores a ready candidate service, while only explicitly classified post-readiness settlement failures may become recovered success. The fault-injection regression now uses the observed `BridgeError(authentication_failed, "unauthorized")` shape and still proves nonzero pre-readiness recovery.
-- Add release-architecture wiring checks so both the normal activation preparation and same-identity repair path must disable initial-owner provisioning, while general startup keeps provisioning enabled by default. Beta.47 remains blocked; beta.48 requires a new exact candidate, owner activation, observed live verification, acceptance, guarded push, and provider-side gates.
-- Harden the real process-tree regression exposed by beta.48 candidate preparation under V8 coverage. The test no longer samples descendant liveness at one fixed 2.5-second instant; it polls only through the production SIGTERM grace plus both bounded ownership-observation budgets and fails if the SIGTERM-ignoring descendant is still alive after that complete bound. This removes scheduler-sensitive false failures without changing runtime termination deadlines or accepting a leaked process.
-
-## 3.0.0-beta.47 - 2026-08-07
-
-### Preserve Windows filesystem identity and bounded process-tree cleanup
-
-- Supersede beta.46 after exact-head Windows CI reached packaged managed-job directory validation and exposed a production portability defect: Number-backed filesystem identity can lose precision for Windows file identifiers. Managed-job root and job-directory before/after/canonical checks now use lossless BigInt `lstat` observations while retaining symlink, type, containment, canonical-target, and TOCTOU fail-closed checks.
-- Bound one-shot process termination more tightly. Pre-SIGTERM ownership capture and post-SIGTERM refresh share one monotonic snapshot budget; forced termination still requires current captured process identity, so a direct child exiting cannot silently cancel cleanup of an owned SIGTERM-ignoring descendant and stale or unprovable ownership still prevents SIGKILL.
-- Add deterministic boundary, property, architecture, real-process, and coverage regressions for BigInt identity, unsafe/changing identity rejection, shared ownership-budget exhaustion, descendant cleanup, and module responsibility limits.
-- Remove the beta.46 acceptance record because packaged production bytes changed. Beta.47 requires a fresh exact candidate, owner activation, observed live verification, acceptance, guarded push, and successful provider-side Windows/security gates before merge or publication.
-
-### Cut verification latency and remote-call amplification
-
-- Replace the serial fast-check launcher with a bounded runner that directly executes simple single-Node package scripts, preserves npm for lifecycle hooks/compound or non-Node scripts, parallelizes only the fast-plan tasks not marked as process-heavy barriers, and stops scheduling new work after the first observed failure while retaining bounded diagnostics. No verification task is removed.
-- Replace hundreds of per-file `node --check` child processes with one parse-only Node VM-module subprocess plus the existing shell-wrapper syntax check. This removes process-start amplification and large latency variance without evaluating or linking repository modules.
-- Shorten real process-tree fault-injection fixtures without replacing them with mocks: managed-job descendant timeout coverage now reaches the same timeout/SIGTERM/SIGKILL/terminal-state path in seconds instead of deliberately idling for three minutes, and the local shell tree fixture uses a bounded ten-second timeout. The coverage runner also stops executing `runtime-self-test` twice because `local-self-test` already invokes it.
-- Make `project_overview` run its independent top-level-directory and Git-root probes concurrently and bound the returned top-level inventory to 40 entries with explicit total/truncation metadata, reducing response/context amplification for broad workspaces.
-- Stop instructing hosts to call `resolve_task_capabilities` before every substantive direct task. Resolution remains the explicit path for refreshed instructions, local skills/commands, and application/browser routing; straightforward file, Git, and shell work can use the exposed tools directly.
-- Extract relay close/error, handshake/readiness, user-cause, and reconnect classification from the previously saturated connection lifecycle module into a dedicated boundary module, preserving the existing relay API while restoring architectural responsibility headroom.
-- Keep the extracted relay-classification boundary inside the critical-module coverage gate and preserve publishable source modes; package inspection rejects private-only source modes before candidate creation.
-- Clarify the host boundary: host-rendered tool-call indicators and cached connector schemas are not Machine Bridge logs and cannot be suppressed or invalidated by the server. The runtime now documents reducing unnecessary calls and treating the server-reported 60-second foreground ceiling as authoritative.
-
-## 3.0.0-beta.46 - 2026-08-07
-
-### Clear Windows and CodeQL release gates without weakening policy
-
-- Supersede beta.45 after its first exact-commit pull-request run exposed two blocking external-gate defects. Windows checkout converted executable workflow YAML to CRLF, so the repository-native LF-only Workflow Policy Gate failed even though the dedicated Linux gate passed. The JavaScript/TypeScript CodeQL run also rejected seven release failure sinks whose externally influenced diagnostic value was interpolated into a log string and one trust-broker test mutation that reopened a previously inspected path.
-- Add a minimal Git attribute contract that normalizes `.github/workflows/*.yml` and `.yaml` as text with `eol=lf`. The workflow-policy regression queries Git's effective `text` and `eol` attributes for both extensions; the verifier still rejects CRLF source and is not weakened for Windows.
-- Encode every top-level release, acceptance, publication, soak, backlog, candidate-start, and guarded-push failure as one JSON log record with a fixed validated event name and the existing bounded portable-redaction result. Hostile CR/LF, terminal controls, credentials, email addresses, and home paths cannot create a second physical log line or escape the redaction boundary.
-- Replace the macOS trust-broker tamper test's path-based append with an `O_NOFOLLOW` descriptor open, `fstat` regular-file/single-link validation, descriptor write, and guaranteed close. The test still proves tampered binaries are rebuilt and re-signed without retaining a CodeQL-visible check/use split.
-- Remove the beta.45 acceptance record because these release-script bytes change the package. Beta.46 requires a new exact candidate, owner activation, live verification, acceptance, guarded push, and successful Windows/CodeQL reruns before prerelease publication.
-
-## 3.0.0-beta.45 - 2026-08-06
-
-### Stop Durable Objects stream write amplification and restore fresh CI bootstrap
-
-- Supersede beta.44 after live quota evidence and GitHub CI exposed two release-blocking mechanisms. One beta.44 Worker isolate reported 264 estimated resumable-stream rows for 40 calls (about 6.6 rows per call before all acknowledgement cleanup); the state machine could write both a per-stream row and the global `mcp-stream-index` at begin, activation, terminal settlement, and cleanup, producing up to eight logical rows for one ordinary call.
-- Make `mcp-stream:*` records the sole Durable Object authority. Capacity admission, request-id deduplication, persisted-call lookup, detach/rebind, deadline expiry, terminal replay, and cleanup use bounded transaction-safe prefix enumeration. Existing beta.44 records remain readable, while the derived legacy index is deleted at most once and is never recreated.
-- Bound an immediate Worker-local lifecycle to three committed rows and an ordinary daemon lifecycle to four. Duplicate settlement and read-only lookup paths write zero rows. A committed-mutation meter separates stream puts, stream deletes, one-time legacy-index migration, alarm sets/deletes, and alarm no-ops; rolled-back transactions are excluded.
-- Add repeated lifecycle, migration, reconnect, expiry, race, persistence-failure, key-integrity, and transaction-rollback regressions. Repository Durable Object storage doubles now implement the production `list({ prefix })` contract rather than preserving a production fallback for incomplete mocks.
-- Fix the pre-`npm ci` CI bootstrap. The beta.44 workflow imported `https-proxy-agent` through the hardened npm downloader before dependencies existed, so Ubuntu, macOS, and package-audit jobs failed in a fresh checkout. The bootstrap download closure now uses only Node 26 standard-library `https.Agent({ proxyEnv })`, with exact HTTPS artifact URLs, bounded downloads, proxy validation, redirect rejection, and cleanup guarantees retained.
-- Remove the beta.44 acceptance record because both Worker and packaged bytes changed. Beta.45 requires a fresh exact candidate, owner activation, live Worker/service verification, acceptance, guarded push, and complete external CI before any prerelease publication.
-
-## 3.0.0-beta.44 - 2026-08-06
-
-### Make managed-job cancellation and workflow governance fail closed
-
-- Supersede beta.43 before owner activation. A Workflow Bundle-controlled independent review found that managed-job cancellation and job-directory discovery still used `existsSync`: permission or I/O failure could be interpreted as no cancellation, and a symbolic-link job directory could redirect status, plan, cancellation, or cleanup operations outside the managed-job root. Beta.44 canonicalizes the root before resolving a validated job id, rejects symlinked or identity-changing directories, writes cancellation markers through flushed atomic replacement, and treats only `ENOENT` as no cancellation. Marker type, link count, UTF-8, timestamp shape, and path identity are independently verified; unreadable cancellation evidence fails the job instead of allowing later steps to continue.
-- Make runner ownership discovery fail closed. Provisional claim polling now uses the shared present-path inspector and preserves the storage error as the cause; permission, I/O, wrong-type, and symbolic-link failures no longer become a thirty-second false absence.
-- Centralize temporary hardened-npm session settlement. Candidate and registry-package activation clear their live session reference and call one helper that preserves the primary failure and aggregates cleanup failure, preventing the two owner entrypoints from drifting.
-- Redact the remaining release subprocess diagnostics. npm global-prefix and GitHub Release command failures use the shared bounded command label and portable log redaction rather than exposing full arguments, credential-bearing URLs, home paths, or raw remote output.
-- Rename the GitHub-side workflow checker to **Workflow Policy Gate** so it cannot be confused with the local Universal AI Development Workflow Bundle control plane. The gate now validates executable YAML structure: required commands must be real `run` steps, required action inputs must belong to the matching immutable action step, and comments, names, or near-match commands cannot forge release evidence.
-- Add fast fault injection for managed-job storage errors, symlink and hard-link markers, job-root escape, malformed cancellation evidence, runner-claim I/O failure, workflow comment forgery, near-match commands, and release diagnostic redaction. Local Workflow Bundle authority remains excluded from Git and npm package bytes.
-- Advance all runtime and extension identities to beta.44. The beta.43 tarball and pending manifest are stale after these packaged changes and must not be activated, accepted, published, or used as soak evidence. A fresh exact beta.44 candidate and complete local/owner/registry lifecycle are required.
-
-## 3.0.0-beta.43 - 2026-08-06
-
-### Close second-pass activation, publication, and deployment-fingerprint gaps
-
-- Block beta.42 before owner activation. Its candidate wrapper disposed the temporary hardened npm before reading the current global rollback baseline, then attempted to execute the deleted npm CLI path. The owner command would therefore fail before Worker/service mutation. Beta.43 captures the baseline while the session is live, authorizes Worker mutation before downloads or installation, and allocates a persistent release-channel runtime only for a real persistent activation; `--install-only` removes its disposable foreground runtime. Candidate prepare/record/verify and the first guarded push also use hardened npm, so accepted bytes are never regenerated by the ambient bundle.
-- Make candidate-runtime pruning path-safe and evidence-safe. State, release-channel, runtime-container, active-runtime, and inactive-runtime directories must be real contained directories; symlinked ancestors and identity changes fail before recursive deletion. Operational quota, memory, stale-handle, retry, and buffer failures remain non-blocking warnings, while structural failures remain blocking. All blocking pruning completes before an activation record is written.
-- Restore bounded network behavior after trusted-executable migration. Absolute POSIX and Windows Git paths retain the forced HTTP/1.1 transport policy, and every Git/GitHub/npm registry network attempt has a hard timeout, bounded output, and classified retry behavior.
-- Reconcile irreversible publication outcomes. npm publication checks for an exact preexisting version, publishes only the privately staged accepted tarball, and after every upload result waits for matching version, SHA-1, SRI, dist-tag, and publication metadata. Ambiguous results prohibit blind retry; an exact remotely visible object settles idempotently or as a bounded recovered success. GitHub Release mutation similarly waits for matching prerelease/final metadata and the exact REST SHA-256 asset before reporting success.
-- Preserve primary and cleanup failures throughout acceptance, consumer verification, hardened npm construction, soak verification, GitHub publication, and CI bootstrap. Concurrent failures are aggregated instead of allowing temporary cleanup to replace the causal error. Storage/resource failures such as `EDQUOT`, `ENOMEM`, `EAGAIN`, `ENOBUFS`, `EINTR`, and `ESTALE` are operational and do not trigger destructive private-toolchain reconstruction.
-- Make registry installation state explicit. The published-prerelease installer records the global-install attempt before npm mutation and distinguishes an attempted, completed-but-unverified, and fully verified global replacement in failure guidance.
-- Upgrade the Worker deployment fingerprint to a length-framed v5 format. Required Worker/shared/config sources are read through bounded no-follow identity checks; missing, unreadable, hard-linked, special, or symlinked paths fail closed. File count, normalized relative paths, and bytes are individually framed so different file layouts cannot produce the same HMAC input.
-- Bound the OAuth browser regression itself. Headless Chrome runs in a dedicated process group; cleanup escalates from TERM to KILL, closes every local HTTP server, removes the profile with bounded retries, and aggregates cleanup failures with the causal assertion error. A renderer that inherits Chrome stderr can no longer keep the full release gate alive indefinitely.
-- Add a repository-native Workflow Policy Gate. Six workflows are read through bounded no-follow identity checks and validated for approved triggers, read-only default permissions, reviewed job-level writes, per-job timeouts, workflow/ref concurrency, immutable Action SHAs, disabled checkout credentials, fixed Node selection, and direct event-data shell interpolation. Fault injection covers dynamic/unreviewed Actions, privileged triggers, permission expansion, malformed UTF-8, missing contracts, symlinks, and hard links; release creation now requires a successful exact-commit Workflow Policy Gate run.
-- Make security and release state discovery fail closed. Browser pairing, service network environment, machine service ownership, global configuration, legacy approval state, prerelease activation, soak evidence, and official conformance checkout inspection treat only `ENOENT` as absence. Permission, I/O, wrong-type, symlink, hard-link, and identity errors remain distinct failures instead of generating new credentials, dropping saved environment, overwriting ownership, or reporting missing evidence.
-- Bind the development macOS trust-broker cache to both source and compiled binary SHA-256. Reuse additionally requires a regular single-link owner-only executable; tamper or an obsolete marker rebuilds and re-signs the broker, while access and cleanup failures remain blocking. Temporary compiler output is read through the same bounded no-follow boundary before atomic replacement.
-- Redact release diagnostics consistently. Git/GitHub/npm subprocess failures expose only a bounded executable/subcommand label and sanitized output; access tokens, bearer values, credential-bearing URLs, email-shaped identities, home paths, controls, and excessive remote output are removed. GitHub control scripts are now included in syntax, lint, and complexity gates, and the redundant release-side npm-environment forwarding module was removed.
-- Retain the beta.39 consumer isolation and beta.40-beta.42 activation/publication hardening. Beta.43 changes packaged and Worker bytes and requires a fresh exact candidate, owner-machine activation, registry publication, published-package activation, and complete seven-day soak.
-
-## 3.0.0-beta.42 - 2026-08-05
-
-### Close release-path and recovered-activation audit gaps
-
-- Block beta.41 before owner activation. An independent source review found that its recovered-success branch accepted any post-readiness exception once the exact candidate service converged, so an unexpected `TypeError`, invariant defect, or other programming failure could be converted into a successful activation. Beta.42 permits recovered success only for three explicit operational classes: relay authentication rejection, autostart definition installation failure, and autostart start/persistence failure. Unknown errors retain their original error type and remain nonzero even when the compatible service is verified ready.
-- Preserve recovered activation evidence end to end. The CLI returns a bounded reason and detail, the owner wrapper validates and prints the recovery warning, and local/registry activation records persist the same optional metadata. Missing, malformed, or inconsistent recovery fields fail closed.
-- Remove ambient npm from sensitive release mutations. Candidate installation, registry-published global installation, and `npm publish` now use a temporary integrity-pinned hardened npm 12.0.1 with fixed undici 6.28.0 and brace-expansion 5.0.9. Nested npm execution modes are removed case-insensitively, and critical pack/install/publish commands explicitly override dry-run and workspace configuration so parent lifecycle variables or user npm configuration cannot create a false success.
-- Make private-toolchain recovery non-destructive. Only positively identified marker, manifest, path-shape, or dependency-integrity corruption triggers reconstruction. Permission, I/O, storage, read-only-filesystem, descriptor exhaustion, and timeout failures are propagated without deleting the existing hardened npm or Wrangler tree. Global rollback-baseline discovery likewise treats only an absent package as empty state and rejects unreadable, malformed, symlinked, or escaping installations.
-- Strengthen artifact evidence. The consumer gate performs an ordinary installation including optional production dependencies, and both workspace and consumer CycloneDX validation require one complete, unique, closed dependency entry for every root/component reference. Hardened npm and Wrangler verification are split into bounded modules and reject symlinked critical runtime paths.
-- Canonicalize the consumer fixture itself before npm operations and stage the accepted tarball inside that fixture. This avoids npm 12 treating a valid external `file:` dependency as invalid when macOS aliases `/var` to `/private/var`, without weakening the zero-problem dependency-tree requirement.
-- Bind every publication channel to the exact accepted tarball. GitHub Release publication stages the no-follow, single-link accepted candidate into a private temporary directory, uploads that file without repacking, and verifies the remote REST asset SHA-256. npm publication runs the full prepublication gate, requires npm's own tarball dry-run to report the accepted name/version/SHA-1/SRI, and then publishes the same staged bytes with lifecycle scripts disabled. Published installation and formal soak independently require the GitHub asset digest and npm registry hashes to match local acceptance.
-- Remove PATH-resolved release control tools and ambiguous post-success cleanup. GitHub push/backlog/Release, acceptance indexing, publication locking, soak tag lookup, and the portable verifier use trusted absolute git/gh executables. Registry installation resolves the owner's actual global npm prefix before hardened installation. Non-critical candidate-runtime, Release staging, backfill, and post-publish temporary cleanup failures produce bounded warnings only after the irreversible result is independently verified; unknown/programming failures remain blocking.
-- Retain the beta.39 consumer dependency isolation and beta.40/beta.41 relay/service recovery mechanics. Beta.42 is a new functional prerelease and requires a new complete seven-day soak after exact registry publication and published-package activation.
-
-## 3.0.0-beta.41 - 2026-08-05
-
-### Complete verified forward recovery as an activation success
-
-- Block beta.40 after the owner-terminal command reached an exact beta.40 Worker and verified login daemon through automatic compatible-service recovery but still exited nonzero and wrote no activation record. The final runtime was healthy, yet the release workflow correctly could not treat a failed command as candidate acceptance.
-- Distinguish pre-verification failure from post-verification handoff failure. A candidate that never completed device authentication and `ready_ack` still fails even when a compatible service later recovers. When the foreground candidate had already completed end-to-end readiness, however, a later installation, asynchronous relay, or strict service-start failure may settle successfully only after compensation independently verifies the exact candidate service daemon, readiness checkpoint, and Worker version.
-- Return a structured recovered activation result for that narrow final-state success. Human output emits a warning with the bounded recovery class, JSON output records `activation_recovered` and `activation_recovery_reason`, and the owner command exits successfully so the existing candidate wrapper can write its activation evidence. Primary error text is not silently discarded into an ordinary success path.
-- Keep cleanup and convergence fail closed. Provider-active state alone, an unverified daemon, wrong entrypoint/version, Worker mismatch, lock-release failure, or a candidate that never reached readiness continues to produce a nonzero error with aggregated diagnostics.
-- Retain the beta.39 installed-consumer security corrections and beta.40 bounded authentication/convergence mechanics unchanged. Beta.41 was prepared but blocked before owner activation by the independent release-path audit described in beta.42; no beta.41 activation or soak evidence is valid.
-
-## 3.0.0-beta.40 - 2026-08-05
-
-### Make failed candidate activation converge or remain diagnostically exact
-
-- Block beta.39 after its owner-terminal activation updated the Worker but exhausted candidate device-authentication startup and then failed to restore a running persistent daemon. The compatible beta.39 service could be recovered manually from the exact isolated candidate, but the owner command exited unsuccessfully and wrote no activation record; beta.39 therefore cannot be accepted, published, or used for soak evidence.
-- Extend post-deployment candidate authentication convergence to ten bounded starts with exponential delay while retaining exactly one same-name, same-device-identity repair deployment. This accommodates delayed Worker secret/identity convergence without turning ambiguous network, TLS, proxy, or health errors into repeated remote writes.
-- Separate strict service handoff from failure compensation. Normal activation still requires the committed service owner and post-`ready_ack` daemon checkpoint. After the Worker has advanced, compensation starts the compatible provider without the ordinary readiness helper immediately stopping it, then independently requires the exact candidate service daemon and Worker to converge before recovery is reported successful.
-- Preserve the primary activation error together with the exact candidate-service recovery failure. A provider that merely appeared active is no longer described as recovered, and incomplete cleanup reports both the authentication cause and the final daemon/Worker convergence state.
-- Retain the beta.39 consumer-artifact, hardened npm, private Wrangler, audit, signature, SBOM, nested npm-environment, and Dependabot metadata corrections unchanged. Beta.40 was prepared as the next prerelease but was later blocked by the recovered-activation settlement defect described in beta.41; no beta.40 soak evidence is valid.
-
-## 3.0.0-beta.39 - 2026-08-05
-
-### Audit the installed consumer and isolate the deployment toolchain
-
-- Remove Wrangler from the published package's production dependency graph. The package now ships an exact private-toolchain manifest and lockfile, installs that control-plane toolchain under the owner-only state root on demand, serializes installation with a process-identity lock, rejects tampered templates or dependency edges, requires Wrangler 4.115.0, undici 7.29.0, and sharp 0.35.3 exactly, and refreshes a zero-vulnerability npm audit plus registry-signature verification at least every 24 hours. The installer itself runs through a package-owned hardened npm 12.0.1 whose pinned tarball is rebuilt with undici 6.28.0 and brace-expansion 5.0.9 after independent SHA-512 verification.
-- Add a final-consumer security gate that packs the actual tarball, installs it into an empty package, requires a zero-vulnerability production audit, validates the installed dependency tree, and generates a CycloneDX SBOM from that consumer installation. Wrangler and Miniflare are forbidden from the published runtime tree; vulnerable undici versions fail both tree and SBOM validation. CI package-audit, the full installation test, and release verification now execute this gate.
-- Sanitize inherited npm dry-run/global/workspace settings for nested package operations. An outer `npm publish --dry-run` can no longer make release-acceptance or consumer-security fixture packs report success without writing a tarball.
-- Keep Node.js 26 as the package/runtime requirement while changing only the development-engine mismatch policy to a warning. This lets GitHub's Node 24 Dependabot updater inspect and update dependency metadata; the published `engines` contract, strict consumer installation, CLI startup guard, doctor check, and CI Node 26 baseline remain unchanged.
-- Invalidate the beta.38 soak. Its root override selected undici 7.29.0 only in the source workspace; ordinary npm consumers installed Wrangler/Miniflare with undici 7.28.0 and therefore inherited one high and three moderate audit findings. Beta.39 is a new functional prerelease and requires a new complete soak.
-
-## 3.0.0-beta.38 - 2026-08-05
-
-### Keep relay liveness acknowledgement off durable storage paths
-
-- Send the Worker `pong` immediately after the authenticated socket attachment is refreshed, before any Durable Object alarm read or write. A slow alarm/storage operation can no longer delay heartbeat acknowledgement and make an otherwise healthy connection appear silent.
-- Make daemon activity refresh scheduling-explicit. Heartbeats perform one alarm schedule after `pong`, and terminal tool results coalesce liveness and pending-call deadline updates into exactly one schedule instead of the previous implicit-plus-explicit pair.
-- Isolate the complete event-time alarm scheduling path, not only the final alarm write. Durable deadline reads, invalid-socket cleanup, or diagnostic callback failures now become bounded observability events instead of aborting a registered call before dispatch or rejecting a WebSocket message event. The actual Durable Object `alarm()` handler remains failure-propagating so the platform can retry it.
-- Add architecture regressions that require `pong` to precede alarm scheduling, forbid socket-touch helpers from acquiring hidden alarm ownership, and require one terminal-result alarm schedule.
-- Record the live beta.37 incident boundary: the same launchd daemon (PID unchanged, `runs=1`) recovered a `1006 connection_interrupted` episode in 2.631 seconds on its first attempt. macOS changed the `utun5` link-quality classification from good to poor four seconds before the close while the default route remained inside the Karing system-extension tunnel. This is strong temporal correlation with OS Wi-Fi/TUN path degradation, not proof that Karing, a selected proxy node, Cloudflare, or any specific upstream component caused the close.
-
-## 3.0.0-beta.37 - 2026-08-04
-
-### Close second-order relay recovery races
-
-- Bind asynchronous daemon-authentication proof failures to the WebSocket generation that requested them. A rejected proof from an already closed socket can no longer terminate a replacement connection that is currently connecting or ready.
-- Apply explicit close-category precedence. The first specific connect, handshake, readiness, heartbeat, or Worker recovery cause survives later specific or generic close signals; only an empty or generic transport category may be upgraded.
-- Separate socket cleanup from alarm ownership. Runtime-alarm invalidation no longer recursively schedules another alarm, and the final alarm deadline is recomputed after detach/rebind state changes so reconnect grace cannot inherit a stale pre-detach deadline.
-- Close invalidated sockets before awaiting durable cleanup. Concurrent `error`/`close` callbacks share one cleanup Promise; successful cleanup remains terminal, while a transient failure is retried once in-event and releases its slot for a later callback without duplicating disconnected metrics or warning logs. Welcome, readiness-probe, replacement, liveness, send-failure, error, and close paths preserve the intended close reason even when storage cleanup fails.
-- Mark the authenticated relay diagnostic snapshot as recovered when a probing socket becomes ready, extend outage duration through the actual readiness instant, canonicalize timestamps, and accept only stable coarse transport error classes. Failed reconnect attempts no longer erase the duration of the preceding healthy ready interval. A healthy `server_info.daemon.relay_transport` no longer reports the preceding reconnect as currently active or exposes arbitrary daemon metadata.
-- Add fault-directed regressions for stale authentication promises, competing specific close causes, send-failure precedence, post-invalidation deadline recomputation, cleanup deduplication/retry, previous-ready-duration retention, ready-state diagnostic projection, and the scheduling-free cleanup architecture contract. Beta.36 was prepared but not activated; beta.37 supersedes that local candidate.
-
-## 3.0.0-beta.36 - 2026-08-04
-
-### Preserve and expose relay-disconnect evidence
-
-- Preserve a specific connect, handshake, readiness, or heartbeat timeout classification when a later generic WebSocket error arrives before the close event. The late error can still terminate the socket, but it no longer erases the causal category used for recovery diagnosis.
-- Make Worker daemon-socket cleanup idempotent. Error, close, candidate timeout, readiness timeout, liveness timeout, verified replacement, and send-failure paths converge on one expiry, pending-call detach, disconnected metric, and runtime-alarm transition, preventing duplicate Durable Object work when one socket emits both error and close. Synchronous stale-socket reclamation now retains its asynchronous cleanup with Durable Object `waitUntil` and converts storage failures into one bounded observability event instead of an unhandled rejection.
-- Add a schema-versioned, privacy-bounded relay diagnostic summary to the authenticated daemon hello. The Worker sanitizes and preserves the immediately preceding reconnect episode in the daemon attachment and exposes it as authenticated `server_info.daemon.relay_transport`; endpoints, interface names, DNS data, arguments, and results remain excluded.
-- Make `machine-mcp doctor` report its diagnostic scope explicitly. Doctor uses an isolated local runtime and does not inspect the running service process or its remote relay, so a green doctor result can no longer be mistaken for service WebSocket health.
-- Add deterministic regressions for late-error classification, diagnostic bounding/projection, idempotent socket expiry, unified stale-candidate invalidation, retained asynchronous cleanup, authenticated server-info projection, and doctor scope.
-- Pin the transitive `brace-expansion` and `undici` packages to fixed same-major releases through root overrides. The release audit discovered high-severity advisories in ESLint/Wrangler dependency paths; `npm audit fix --force` proposed an unrelated Wrangler downgrade, so beta.36 keeps the tested Wrangler/Miniflare versions while selecting `brace-expansion` 5.0.9 and `undici` 7.29.0.
-
-## 3.0.0-beta.35 - 2026-08-03
-
-### Enforce the patch-helper call contract
-
-- Remove the obsolete third argument from the workspace patch call after beta.32 intentionally removed path data from `applyUpdateHunks` errors. The extra argument had no runtime effect but violated the helper contract and was rejected by the zero-unaccepted-findings CodeQL gate.
-- Add an architecture source-contract regression requiring the single workspace call to match the two-argument helper signature, so local verification catches the mismatch before remote CodeQL.
-
-## 3.0.0-beta.34 - 2026-08-03
-
-### Classify daemon terminal-result dispositions
-
-- Replace the ambiguous Worker `unmatched_results` interpretation with an explicit `terminal_results` disposition matrix. Successful transient and durable settlements are counted separately from owner-missing results that are acknowledged to terminate normal at-least-once replay and stale-connection results that are rejected without acknowledgement.
-- Retain `calls.unmatched_results` as a compatibility aggregate of `owner_missing_acknowledged` and `stale_connection_rejected`, and mark that scope machine-readably. Operators no longer need to treat a harmless duplicate after cancellation, timeout, reconnect, deployment, or lost acknowledgement as evidence of a connection-identity defect.
-- Centralize the settlement-to-acknowledgement decision and test all four outcomes. A deployed Worker integration regression completes a real call, consumes its acknowledgement, resends the identical result, proves a second acknowledgement, and verifies that only `owner_missing_acknowledged` increases.
-- Update architecture and operations contracts so stale ownership is diagnosed from `stale_connection_rejected`, while sustained owner-missing growth is investigated as acknowledgement loss or bounded lifecycle overlap rather than automatically classified as protocol corruption.
-
-## 3.0.0-beta.33 - 2026-08-03
-
-### Clarify prerelease rollback evidence
-
-- Upgrade prerelease activation records to schema 2 and replace the ambiguous `previous` field with `global_package_rollback_baseline`. The field now states exactly what activation records retain: the globally installed npm package version and entrypoint available for operator-directed disaster recovery, not the service runtime active immediately before activation.
-- Keep schema 1 activation records readable without rewriting historical evidence. Legacy `previous` values are normalized in memory to the schema 2 field, while mixed-version fields, duplicate baseline fields, relative entrypoints, and malformed baselines fail closed.
-- Keep transaction-scoped service recovery separate. `runtime-activation` continues to capture and verify the actual pre-handoff service version and entrypoint during activation; the persistent activation record no longer invites those two recovery concepts to be conflated.
-- Make both local-candidate and published-prerelease writers consume the shared activation schema constant, add disk-level migration and rejection regressions, and enforce the field distinction in architecture and release documentation gates.
-
-## 3.0.0-beta.32 - 2026-08-03
-
-### Typed file mutation failures
-
-- Replace ordinary exceptions in workspace file, patch, and remote path-boundary operations with the existing stable `BridgeError` contract. `write_file`, `edit_file`, and `apply_patch` now preserve actionable error codes and bounded `details.reason` values through local execution, stdio MCP, daemon WebSocket transport, Worker adaptation, and public MCP tool results instead of collapsing expected state failures to `execution_failed`.
-- Classify create-only collisions, optimistic SHA-256 mismatches, targets that appear during commit, unsupported target types, symbolic-link destinations, duplicate patch paths, and stale or ambiguous patch contexts as `conflict`. Missing edit text is `not_found`; malformed patch envelopes, invalid text/image inputs, and invalid line ranges are `invalid_request`; bounded read/write violations are `limit_exceeded`; hard-link read denial is `permission_denied`; workspace escape is `path_boundary`.
-- Keep sensitive and irrecoverable failures fail-closed. Error details contain only bounded reason tokens, counts, limits, and hunk/line indexes, never paths, file contents, old/new text, or expected/actual hashes. Incomplete staged-write cleanup and incomplete patch rollback remain non-exposed `internal_error` results while retaining their causes locally.
-- Add direct runtime, atomic fault-injection, Worker-adapter, and live stdio regressions proving stable code/reason propagation, no overwrite after create-only or stale-precondition failure, transactional rollback, and absence of absolute paths in public error objects. Update tool discovery descriptions, generated reference, architecture, testing, and client guidance.
-
-## 3.0.0-beta.31 - 2026-08-03
-
-### Preserve host delivery margin for synchronous tools
-
-- Reduce the remote synchronous foreground ceiling from 85 to 60 seconds. The previous 85-second execution allowance plus five seconds of Worker settlement could consume roughly 90 seconds before terminal handling completed; live evidence showed a temporally aligned 83.5-second command complete locally after the ChatGPT task had already ended with a message-send timeout. Defaults remain 30 or 60 seconds, owner-local commands retain their local budget, and longer remote work continues through process sessions or managed jobs.
-- Separate the daemon execution deadline from the Worker settlement deadline. A second review found that the first beta.31 candidate sent the 65-second settlement deadline to the daemon as its local execution deadline, so the claimed five-second margin was not real for tools governed only by the relay envelope. The daemon now receives at most 60 seconds, while the Worker records a settlement deadline five seconds later for result acceptance, persistence, acknowledgement, and terminal settlement. Admission and transport latency may consume part of that internal interval, so it is not an external host guarantee.
-- Replace the ambiguous zero-recipient counter with explicit Worker-internal transport metrics for terminal publication, live internal-subscriber sends, storage responses, and the completion-between-lookup-and-subscription race. These metrics do not assert public SSE consumption or host receipt; `server_info.tool_delivery.host_terminal_receipt_observable=false` makes that boundary machine-readable without logging call IDs, arguments, or results.
-- Reduce the unactivated legacy-stream retention ceiling from the obsolete 730-second local-envelope-derived value to 185 seconds: the 65-second maximum hosted settlement deadline plus the 120-second terminal replay window. Activated calls still extend their records across the actual operation/reconnect state machine; abandoned prepare records no longer occupy the bounded 64-stream capacity for more than the hosted contract requires.
-- Update the executable tool catalog, client guidance, generated reference, timeout regressions, and upgrade documentation. Existing MCP hosts may retain an older cached tool schema until they rediscover or reconnect; Worker validation remains authoritative and rejects oversized requests before dispatch.
-
-## 3.0.0-beta.30 - 2026-08-02
-
-### Resumable MCP delivery under transient interruption
-
-- Make the advertised and executed foreground timeout contract match the enforced Worker ceiling: configurable foreground tools now declare a maximum of 85 seconds and default to 30 or 60 seconds. Relay execution uses those same defaults when the argument is omitted, and a registered-command manifest cannot silently extend a relay call beyond 85 seconds; owner-local registered commands may retain their explicit local manifest budget. Longer remote work must use process sessions or managed jobs, eliminating host-generated or locally inherited 120–600 second work that outlived its Worker response.
-- Stop legacy recovery subscribers from replacing one another. Up to four concurrent subscribers may observe the same persisted terminal result; excess subscribers receive a bounded retryable response, and terminal fan-out closes every subscriber cleanly.
-- Extend internal terminal-subscription recovery from a sub-second retry burst to a bounded multi-second backoff. Cancelling a public SSE reader now releases only its internal delivery subscription while the durable legacy operation remains resumable through `Last-Event-ID`. DPoP-protected prepare retries use one outer-Worker-generated opaque retry ID: the first attempt atomically consumes the proof and binds it, and only the same internal request may reuse that proof for at most four authorization attempts; another request remains a replay failure.
-- Make repeated signed-session legacy `tools/call` delivery idempotent throughout the bounded two-minute recovery window. OAuth token, signed MCP session, typed request ID, tool name, and a canonical SHA-256 argument fingerprint bind the stream before daemon dispatch; an identical retry reattaches to the active or terminal stream, while changed arguments are rejected instead of duplicating side effects. Sessionless legacy POSTs never retry an ambiguous prepare.
-- Add regressions for concurrent subscriber fan-out and limits, delivery-subscription cleanup, canonical request fingerprints, persisted retry identity, the unified foreground timeout catalog, and effective relay timeout alignment for shell, direct-process, and registered-command execution. Clarify that a macOS sleep interval may legitimately surface as an event-loop-stall warning without implying daemon failure.
-
-## 3.0.0-beta.29 - 2026-08-01
-
-### Bounded security-audit throughput and retention
-
-- Reuse one verified security-audit state inside the dedicated audit worker instead of rereading, reparsing, and rehashing the complete retained chain for every batch. The cache is invalidated by file identity, size, modification time, or metadata-change time, so another process or external alteration still forces full verification before a write.
-- Bound retention by both 4,096 events and 4 MiB. Oversized-but-valid event histories now evict the oldest events, advance the chain anchor, and remain verifiable instead of permanently failing before the advertised event limit. Runtime diagnostics expose the byte ceiling explicitly.
-- Fix an owner-state-lock race where a contender observed `EEXIST` just before the holder released the lock and then misclassified the now-missing file as malformed. Missing, invalid, and valid-owner states are now distinct, preserving fail-closed handling for actual corruption while allowing normal retry.
-- Add regressions for cached-state tamper invalidation, byte-driven retention, cross-worker sequence preservation, and the lock release/acquire window. Keep audit state construction in a focused module rather than raising the existing architecture budget.
-- Mark Worker observability counters as current-isolate metrics and state explicitly that durable calls can cross isolate lifetimes, so completed/failed counts are not misread as algebraically closed process-lifetime totals.
-
-## 3.0.0-beta.28 - 2026-07-31
-
-### Verified service restart semantics
-
-- Fix `service restart` returning `already_running` without invoking launchd, systemd, or Task Scheduler. Start remains idempotent, while restart now always reaches the provider when the committed service is active.
-- Require an active-service restart to return explicit provider restart evidence and to converge on a replacement daemon PID before reporting success. A still-ready pre-restart daemon is now `daemon_replacement_not_observed`, not successful convergence.
-- Extract service daemon convergence into a focused module and add regressions for provider invocation, old-PID rejection, replacement readiness, and missing restart evidence.
-
-## 3.0.0-beta.27 - 2026-07-31
-
-### Control-plane resilience under host I/O pressure
-
-- Remove synchronous process-table inspection from foreground timeout and cancellation paths. Process-group identity capture, post-`SIGTERM` refresh, and pre-`SIGKILL` PID/start-time revalidation now use bounded asynchronous `ps` execution with a fixed minimal `PATH`/locale environment, while ambiguous ownership still fails closed. Windows taskkill fallback is idempotent across an `error`/nonzero-`exit` race.
-- Preserve process ownership after a tool result has timed out or been cancelled. Runtime status now distinguishes active calls from draining calls, terminating processes, and pending escalation checks instead of implying that a returned timeout means all operating-system work has stopped.
-- Extend `diagnose_runtime` with privacy-safe local lifecycle, call-capacity, draining-process, execution-guardrail, relay-heartbeat, and audit-health snapshots so remote operators can observe the repaired control plane; local stdio `server_info` retains the equivalent detailed runtime view.
-- Reserve control-plane capacity at both relay layers: two of thirty-two Worker pending-call slots and two of sixteen local runtime slots are restricted to bounded diagnosis/recovery tools. Ordinary transient and durable-stream work share the same admission contract and cannot consume those slots.
-- Split relay heartbeat policy from WebSocket transport. The daemon measures local event-loop lag, reports bounded `runtime.event_loop.stall` warnings, sends a fresh heartbeat, and grants a short recovery interval before classifying remote silence. A locally stalled daemon no longer immediately destroys a healthy relay socket and amplifies one slow operation into a reconnect outage.
-- Move security-audit startup verification, hash-chain updates, atomic replacement, and `fsync` into a dedicated Worker thread; construction now reports `audit_initializing` without synchronously reading persistent state, and stale post-failure Worker events cannot overwrite the original failure class. Tool results no longer wait for audit disk persistence; events are privacy-projected before transfer, batched, queue-bounded, cross-process serialized, and exposed through health/queue/drop diagnostics. Persistent audit failures emit rate-limited warnings with suppressed-count reporting rather than one warning per tool call.
-- Reduce audit Worker message amplification by acknowledging each persisted batch once instead of sending one duplicate snapshot per record. The existing bounded SHA-256 chain, owner-only state, tamper detection, and prohibition on command text, paths, values, and results remain intact.
-- Add the fast-plan `control-plane-resilience:test` gate and deterministic regressions for local event-loop stalls versus genuine relay silence, capture-before-signal ordering, asynchronous process-tree supervision, draining-process visibility, end-to-end Worker/local reserved control capacity, non-blocking audit dispatch, audit warning suppression, batch persistence, and privacy-safe audit projection.
-- Bound headless OAuth browser startup, DevTools HTTP discovery, WebSocket connection, and individual CDP commands. A wedged Chrome process under extreme host pressure now fails with bounded diagnostics instead of hanging release verification indefinitely.
-- Refactor heartbeat, call-capacity, process signaling/supervision/snapshotting, and audit dispatch/storage/warnings into focused modules. Architecture line budgets and import-direction checks were retained rather than relaxed.
-
-## 3.0.0-beta.26 - 2026-07-29
-
-### Explicit GitHub publication ownership
-
-- Require GitHub tag, Release, prerelease, and backfill writes to present TTY-backed stdin/stdout/stderr plus the explicit `--owner-terminal-confirm` flag. Background MCP calls, managed jobs, CI, redirected sessions, and ordinary automation fail before repository fetch, verification, tag creation, or remote mutation. This is an anti-accident workflow boundary, not cryptographic human-presence proof against arbitrary same-user code.
-- Serialize GitHub publication through an owner-only process-identity lock at the common Git state path, so the main checkout and linked worktrees share one owner. A second publication attempt fails while the first process is alive, and a stale lock is reclaimed only after PID/start-time verification.
-- Convert release-script failures to exceptions so the publication lock is released on every ordinary failure path instead of being abandoned by `process.exit()`.
-- Add deterministic guard, non-interactive rejection, linked-worktree path, live contention, stale-owner reclamation, callback-failure release, package-manifest, architecture, and critical-coverage tests. npm publication remains a separate owner operation and is not attempted by this change.
-- Label top-level local self-test phases so a transient process, service, shell, or Worker-source failure identifies its causal test boundary instead of surfacing only a low-level timeout stack.
-- Keep the fail-closed common-Git-directory probe bounded but raise its local metadata deadline from 5 to 30 seconds, and give self-test process/CLI success fixtures scheduler-tolerant 30–60 second budgets; explicit timeout/cancellation tests retain their short deadlines.
-- Make the managed-job descendant cleanup test wait for the fixture PID checkpoint before judging timeout cleanup, and use bounded scheduler-tolerant observation windows; this preserves the production timeout/tree-kill contract while eliminating an ENOENT race.
-- Give `diagnose_runtime` direct-process and shell health probes an explicit 30-second diagnostic budget, separate from user command deadlines and from the short timeout/cancellation fixtures, so temporary scheduler starvation is reported only after a meaningful bounded observation window.
-- Remove the hidden 10-second Git repository-root subdeadline beneath 30-60 second Git operations: read-only `rev-parse --show-toplevel` metadata detection and runtime Git success fixtures now use a bounded 30-second budget, while command failure remains fail-closed.
-- Make the shell process-tree cleanup fixture observe a descendant-PID readiness checkpoint before its timeout path, with bounded 25-30 second coverage-tolerant windows; the separate 50 ms timeout fixture still verifies immediate timeout classification.
-- Give the direct-argv isolation success fixture a named 30-second process budget so V8 coverage and host scheduling cannot turn an argv/shell-boundary assertion into an unrelated 10-second timeout; dedicated timeout tests remain unchanged.
-- Replace the maintenance-lock test's 1.2-second time-based holder with a parent-controlled stdin handshake. The child holds the lock until assertions finish and releases on explicit `release` or pipe closure, so scheduler delay cannot erase the contention state under test.
-- Prevent V8 coverage from recursively instrumenting process-lock helper processes. Node propagates `NODE_V8_COVERAGE` to children even when the variable is deleted, so the fixture spawn boundary now sets it explicitly to an empty value and verifies the helpers remain uninstrumented; only the top-level test contributes coverage.
-- Keep the atomic-exclusive process test cross-process but use four simultaneous contenders instead of twelve. Four independently spawned processes are sufficient to prove the single-winner invariant, while avoiding a 3x Node cold-start amplification that can dominate the test under unrelated host saturation.
-- Apply the same explicit coverage isolation to daemon-takeover fixtures and give readiness plus successful stop/takeover paths a named 30-second budget. The 100 ms foreground-owner refusal and 20 ms force-escalation trigger remain intentionally short and independently asserted.
-- Keep managed-job runner coverage intact while explicitly disabling profiler inheritance for trivial marker-writing business steps. Those success fixtures now use a named 120-second step budget; the independent timeout, cancellation, and process-tree tests keep their short semantic deadlines.
-- Apply the same named 120-second success-step budget across managed-job approval markers, resource validation/redaction, bounded-output, discard-output, and cleanup/recovery markers. The managed-job process-tree fixture uses a 180-second timeout and a 150-second descendant-readiness window so the resistant descendant exists before timeout/tree-kill is judged; cancellation behavior remains independently asserted; the aggregate-output fixture uses four steps and a 600-second observer, exceeding its legal plan upper bound without multiplying cold starts.
-- Raise the ordinary managed-job test observer to 480 seconds so it exceeds the longest three-phase 3×120-second success/cleanup plan plus startup margin. This changes only test observation; production timeout semantics, the 180-second managed-job tree timeout, and cancellation behavior remain independently tested.
-- Give managed-job CLI list/inspect/submit/read success and rejection fixtures a separate 120-second subprocess budget and structured status/signal/error diagnostics. Their purpose is CLI/state validation, not a 60-second latency contract; production job step deadlines and explicit timeout tests remain unchanged.
-- Prevent those local-self managed-job CLI subprocesses from inheriting V8 coverage. The top-level local-self remains instrumented, while dedicated CLI-entrypoint and managed-job fixtures provide the relevant module evidence without recursively profiling each detached CLI probe.
-- Treat a POSIX zombie child as exited-but-awaiting-event-drain instead of timing it out. Managed-job settlement now re-reads the real exit code during the bounded fallback, preventing scheduler-starved `exit`/`close` delivery from converting a completed cleanup step into a false timeout.
-- Close a managed-job launch/recovery race: the parent now publishes an owner-only provisional PID plus one-time launch token immediately after spawn, and the runner must verify that claim before executing or atomically upgrading it to an exact start-time identity. A queued job can no longer be misclassified as interrupted merely because V8 startup exceeds the ten-second recovery grace period; conflicting claims fail closed and terminate the unowned child.
-- Give browser-broker fixture HTTP, WebSocket open/message/close, rejection, handshake, and state-convergence observations a named 30-second scheduler-tolerant budget. Product request deadlines remain unchanged, including the one-second timeout regression and the normalized two/four-second browser operation parameters.
-
-## 3.0.0-beta.25 - 2026-07-29
-
-### MCP 2026-07-28 dual-era protocol architecture
-
-- Make MCP `2026-07-28` the primary protocol while retaining `2025-11-25` behind an explicit legacy adapter. Modern requests are stateless, carry protocol version and client capabilities in every request `_meta`, use `server/discover`, never mint `Mcp-Session-Id`, and do not enter the legacy resumable-SSE store.
-- Split Worker and stdio dispatch into modern and legacy paths. Per-request metadata takes precedence over method names when selecting the era, so a modern `initialize` request is rejected with HTTP 404 / JSON-RPC `-32601` instead of accidentally entering the legacy handshake.
-- Implement modern Streamable HTTP mirrored-header validation for `MCP-Protocol-Version`, `Mcp-Method`, `Mcp-Name`, and schema-declared `Mcp-Param-*` values, including Base64 sentinel decoding, case-sensitive value comparison, required dual-media `Accept`, and `-32020 HeaderMismatch` precedence over unsupported-version handling.
-- Add modern `subscriptions/listen` acknowledgment, subscription-ID correlation, strict notification-filter validation, and graceful completion. The server advertises no dynamic list notifications and therefore acknowledges only the supported subset rather than fabricating capability.
-- Separate modern request-scoped streams from legacy durable recovery. Modern response streams have no event IDs or `Last-Event-ID` replay. The outer Worker makes one direct Durable Object request, forwards bounded SSE heartbeats, and uses a stream-scoped private cancellation control when the public response closes; it never creates a prepare/subscribe descriptor or retains a cross-event terminal Promise. Legacy session-bound GET recovery remains compatibility-only.
-- Remove token-wide modern JSON-RPC request identity. Two clients sharing one OAuth token may concurrently reuse the same request ID without collision; request IDs remain scoped to the individual modern request/stream, while legacy and stdio cancellation retain their transport-appropriate indexes.
-
-### Capability routing and context efficiency
-
-- Add bounded set-level execution routing to `resolve_task_capabilities`. It ranks compatible route bundles—registered commands, direct Bash/argv, interactive processes, durable jobs, workspace/Git operations, browser, applications, protected resources, and diagnostics—rather than pretending every tool is an independent island. The output includes a primary route, alternatives, ambiguity, fallback routes, and failure-aware guidance. It is advisory only: `exec_command` remains the convenient general escape hatch whenever the effective policy allows shell execution.
-- Fix an account-authority privacy gap in capability discovery. Application inventory and browser metadata now use the authenticated account/daemon policy intersection rather than the daemon's global ceiling; a reviewer connected to a full daemon can no longer learn or receive recommendations for application, browser, shell, or write surfaces outside the role-visible catalog.
-- Add conditional capability-context reuse. A caller may return `refresh.fingerprint` as `known_refresh_fingerprint`; when the target, scope, instruction provenance/precedence, skills, and complete registered-command definitions are unchanged, the resolver still recomputes task-specific matches and routing but omits the repeated static instruction payload. Calls that omit the fingerprint retain the previous complete response.
-- Rewrite the highest-collision tool descriptions with explicit positive selection boundaries: registered project command versus direct argv versus Bash composition; raw DOM source versus semantic browser inspection; tab inventory versus tab mutation; repository overview versus live relay/authority status; context inventory versus task-specific routing.
-- Extend privacy-safe routing telemetry with only the primary route, ambiguity class, and score gap. Raw task text remains absent and the existing runtime-keyed HMAC fingerprint remains the only task correlation value.
-- Add bilingual routing regression cases and critical coverage for shell, registered commands, interactive processes, managed jobs, Git, workspace edits, browser, applications, diagnostics, and protected resources. Package checks require the new routing module. Route envelopes are schema-versioned and state that scores are relative ranks, not probabilities or cross-version metrics.
-- Keep per-task routing lightweight: it reads frozen name/title/description records from the policy-visible catalog instead of deep-cloning all 51 input schemas on every resolver call. Architecture tests reject reintroducing the full-catalog clone.
-
-### Protocol and schema correctness
-
-- Require `resultType` and server identity metadata on every modern successful result. Preserve `structuredContent` for every JSON value, including arrays, strings, numbers, booleans, and `null`, instead of silently discarding non-object values.
-- Add a bounded shared JSON Schema 2020-12 argument validator. Worker dispatch and the local runtime enforce the same catalog constraints before side effects; unsupported dialects or keywords, including automatic network `$ref` dereference, fail at catalog compilation instead of being ignored.
-- Bound schema depth, node count, validation issue count, regular-expression length, and total runtime validation work. Array items and every own object property consume the same budget, so a high-cardinality object cannot force an unbounded `Object.keys()` allocation or traversal. Validation errors expose only instance paths, keywords, and constraint messages—never argument values.
-- Move one shared role-aware tool-call inspection boundary ahead of both modern and legacy dispatch. Missing/hidden tools, non-object arguments, and schema-invalid values return protocol-level `-32602` with `side_effects_started=false`; legacy SSE rejects them before allocating resumable state or contacting the daemon.
-- Validate modern `_meta` key syntax, client capability objects, extension identifiers/settings, progress tokens, log levels, optional client identity/icon URIs, subscription filters, strict HTTP quality values, and header/body version ordering. Open metadata/extension trees share a fixed 4,096-node, 32-level, bounded-key structure budget; resource subscriptions are capped at 256 bounded strings. Header mismatch and unknown-input errors no longer reflect caller-controlled names, URIs, metadata keys, or parameter values.
-- Validate `Origin` on actual `/mcp` requests as required by Streamable HTTP while leaving OAuth navigation semantics unchanged. CORS preflight allows only the fixed protocol headers plus exact catalog-declared `Mcp-Param-*` names, with bounded count/bytes instead of reflecting arbitrary parameter headers.
-- Treat the random private modern stream ID as an internal cancellation capability. The outer Worker strips caller-supplied control headers, the Durable Object handles cancel before OAuth/DPoP replay validation, and the internal cancel request carries no Authorization or DPoP header; closing a DPoP-bound stream therefore cannot fail because its original proof JTI was already consumed.
-
-### Conformance and verification
-
-- Add protocol-contract, tool-schema, modern stdio, modern Worker, same-ID concurrency, malformed-call non-dispatch, subscription validation, arbitrary structured-content, and request-scoped stream-cancellation coverage while preserving the complete legacy integration suite.
-- Make the process-tree timeout fixture readiness-driven under coverage load. The test starts the real timeout operation, waits within a fixed bound for a valid descendant PID publication, then verifies the timeout result and descendant exit; it no longer assumes Node startup and child creation finish within 200 ms. Add direct valid/invalid/unknown-tool coverage for the Worker catalog validator rather than lowering its 95% function threshold; the module now reaches 100% function coverage.
-- Derive the resistant-descendant escalation assertion from the exported two-second graceful-termination interval and three-second ownership-verification budget, plus a bounded scheduling margin. The former exact five-second assertion could race the final identity probe under release-candidate load even though the forced kill was still pending; production termination timing is unchanged.
-- Make managed-job integration waits distinguish the persisted terminal checkpoint from confirmed private-artifact cleanup. A terminal status with `artifact_cleanup_pending=true` is intentionally recoverable but does not yet prove that runtime resource copies, temporary files, the plan, or PID claim are gone; deterministic boundary assertions and ten repeated integration runs cover the distinction without changing the production two-phase protocol.
-- Add an opt-in driver for the official MCP conformance checkout. It uses a test-only loopback proxy to inject a short-lived test bearer token without weakening production OAuth or adding the alpha conformance package to the project dependency graph. The proxy accepts only its relative `/mcp` endpoint, maps it to the exact configured upstream path, rejects absolute/scheme-relative or alternate same-origin targets, bounds request bodies, settles aborted uploads, and reclaims the complete child process tree on timeout.
-- Pass the official `http-header-validation` scenario. Pass `server-stateless` and `caching` with check-scoped expected-failure entries only for production capabilities the server intentionally does not expose: conformance-only diagnostic tools and absent prompt/resource feature families. Any unrelated failure or stale baseline still fails the run.
-- Advance the exact production Wrangler runtime from `4.114.0` to `4.115.0` and Miniflare from `4.20260722.0` to `4.20260722.1`. The reviewed workerd build remains `1.20260722.1`, so its exact lifecycle-script allowlist does not change. Wrangler now applies bounded `429` retry handling, honors reasonable `Retry-After` values, and exposes `retry_after_ms` in its machine-readable failure record, improving candidate deployment diagnosis without adding an unbounded wait.
-- Make candidate activation compare the pending manifest's promotion-content digest with the current source before tarball verification, npm installation, Worker deployment, or service mutation. A candidate becomes unusable immediately after any packaged-source change instead of remaining internally self-consistent but stale.
-- Add the modern protocol, shared subscriptions, bounded schema validator, role-aware tool input boundary, modern proxy/controller, and candidate-source guard to fast/full behavior and critical coverage gates. The npm package manifest now requires every new shared and Worker protocol module and still excludes tests, generated Worker types, local candidates, logs, and secret-shaped artifacts.
-- Add a first-party `sbom:test` release gate that invokes the pinned npm CLI directly, validates bounded CycloneDX 1.5 JSON, confirms the current package identity and root dependency graph, and rejects local filesystem paths. This avoids ambiguous unscoped helper packages and makes SBOM generation part of candidate verification rather than an operator-only command.
-- Advance the unreleased working version to `3.0.0-beta.25`; immutable beta.24 GitHub artifacts are not reused. No npm package is published by this change.
-
-## 3.0.0-beta.24 - 2026-07-28
-
-### Candidate activation authentication convergence
-
-- Treat a current-version Worker health response and successful upload as necessary but insufficient activation evidence. The exact candidate must also complete device preflight, challenge authentication, and end-to-end relay readiness before service handoff.
-- Recover one explicit candidate device-authentication rejection by redeploying the same Worker exactly once with the already selected device identity. The repair never rotates credentials, never changes the Worker name, and is bounded to three candidate starts with exponential delay.
-- Prevent split-version recovery after a remote transition. If remote preparation has changed or verified the candidate Worker but activation later fails, cleanup installs and starts the compatible candidate service definition instead of reviving an older daemon that cannot authenticate to the current Worker. Failures remain explicit, and cleanup errors are aggregated rather than hidden.
-- Report whether activation used the authentication-repair deployment in structured output. The operator warning contains only the failure class and repair action; it does not expose device identifiers, public keys, Worker endpoints, or credentials.
-- Require persistent-service state, not merely a successful service-manager command. Candidate activation now consumes verified stop/restore evidence on launchd, systemd, and Windows; systemd activating/reloading states retain restoration intent while unknown/maintenance states fail before mutation, and a Windows task that exits successfully without remaining active is reported as `completed_without_persistence`.
-- Bind the machine-global service definition to an owner-only `service-owner.json` record containing the canonical workspace, state root, exact runtime entrypoint, and package version. Installation writes `pending` before provider mutation and commits only after the definition succeeds; ambiguous or partial installation remains pending so start/restart fail closed instead of trusting an obsolete owner.
-- Make daemon readiness a token-protected, monotonic checkpoint in the daemon process lock. A login service is accepted only after the exact service-mode process completes device authentication, relay probe, and `ready_ack`; provider-active samples alone are no longer treated as runtime truth.
-- Serialize every machine-global service mutation with one fixed user-level lock and acquire it before any workspace startup lock. Foreground takeover releases the machine-service lock after service/daemon ownership is established, while activation retains it through the complete persistent handoff; daemon-only service children never re-enter the parent transaction lock.
-- Keep the ordinary profile state root and machine-service control root distinct on every platform. POSIX defaults to `~/.local/state/machine-bridge-mcp`, while the global service lock/owner ledger uses the sibling `machine-bridge-mcp-control`; XDG and Windows APPDATA preserve the same application-versus-control separation. This prevents the standard candidate command from installing its runtime into the control directory and then failing state-schema initialization.
-- Reject a foreground or unverifiable daemon before any launchd/systemd/Task Scheduler mutation. Pre-remote recovery of an older compatible service also requires the same version and entrypoint to reappear as a verified service daemon; post-remote recovery continues forward with the candidate owner/readiness contract.
-- Remove the candidate wrapper's outer hard kill around the activation transaction. Deployment, health, relay, service-manager, and convergence stages retain their own bounded deadlines, while service-manager commands now have an explicit 30-second hard boundary; the wrapper cannot bypass lock release and compensation with an unrelated global timeout.
-- Fail closed before POSIX forced escalation when no process ownership snapshot was captured, and require exact process start-time continuity instead of accepting adjacent-second identities. This favors a diagnosable surviving descendant over signaling a possibly reused process group.
-- Make synchronous helper deadlines real. Process-tree and process-identity probes, delegated sandbox checks, macOS trust-broker commands, candidate activation, published-prerelease installation, and synchronous verification helpers now use `SIGKILL` on `spawnSync` timeout; the Node default `SIGTERM` can otherwise be ignored while the caller remains blocked indefinitely. Trust-broker `ETIMEDOUT` is classified before signal-based signing diagnostics.
-- Bound managed-job and foreground-shell process-tree shutdown under macOS process-table stalls. Darwin ownership capture and revalidation now query only the target process group with `ps -g <PGID>` instead of scanning the complete process table; other full and targeted probes still share one three-second monotonic budget instead of multiplying a three-second timeout by every captured descendant. This prevents an overloaded full-table snapshot from yielding empty fail-closed ownership and leaving an anti-`SIGTERM` descendant alive. If libuv reports `exit` but omits the final `close` event, the runner waits one second for output drain, then destroys residual stream handles and settles through the same terminal path.
-
-### Verification
-
-- Add fault-injection coverage for service-stop refusal, ambiguous provider results, daemon-lock takeover denial, malformed version/wait/repair inputs, missing lock-release contracts, invalid retry budgets, first-attempt authentication rejection, exactly one same-identity repair deployment, bounded repeated rejection, compatible-service forward recovery, cleanup aggregation, normal foreground-to-service convergence, and cross-platform separation of default profile state from the machine-service control root.
-- Keep the runtime-diagnostics composition test platform-correct: macOS must classify the injected `utun` route as VPN/TUN interception, while Linux and Windows must skip the macOS-only fixed route probe with `unsupported_platform`. Dedicated route tests cover both contracts independently.
-- Canonicalize service-owner workspace, state-root, and entrypoint paths with the native filesystem resolver used by the state layer. This prevents Windows 8.3 short-path aliases such as `RUNNER~1` from diverging from long-path state identity while retaining exact real-file ownership.
-- Remove a service-platform test lifecycle race: create owner-test directories synchronously before canonicalization instead of starting unawaited `mkdir()` promises that could race both owner creation and teardown. Temporary-tree cleanup also uses a fixed retry budget and still fails closed after that budget.
-- Make the Worker integration daemon-message waiter protocol-aware: while waiting for a subsequent `tool_call` or `cancel_call`, it may skip an asynchronously interleaved `tool_result_ack`; handshake, error, and every other unexpected message remain strict failures.
-- Track every Worker integration HTTP request from creation through settlement. Deferred requests receive an immediate rejection observer, successful completion requires the request set to drain to zero, and failure cleanup closes Wrangler before a bounded all-settled drain; a late connection refusal can no longer bypass the test error path as a process-level unhandled rejection.
-- Add deterministic child-settlement tests, process-snapshot budget accounting, repeated managed-job timeout/descendant termination runs, and an explicit assertion that the detached runner exits after terminal persistence.
-- Reject non-numeric, fractional, zero, negative, non-finite, or over-limit remote `timeout_seconds` values before daemon dispatch; generated schemas and runtime enforcement now share the exact 1–85 second integer contract.
-- Add strict checked-JavaScript contracts for child settlement, process-tree ownership, and system-route classification, plus a dedicated child-settlement coverage threshold of 100% functions and 85% branches.
-- Add `runtime-activation.mjs` to the critical coverage gate. The module reaches 100% function coverage and 80% branch coverage in the current suite.
-- Block beta.23 from acceptance, publication, or promotion because owner-machine activation exposed the authentication-convergence and split-version recovery defects after the Worker had already advanced.
-
-## 3.0.0-beta.23 - 2026-07-28
-
-### Workflow closeout continuity
-
-- Correct the remote foreground timeout contract instead of silently shortening a caller-declared 120–600 second operation. The Worker-specific catalog now advertises an 85-second maximum while preserving 30- or 60-second tool defaults for configurable foreground process, shell, browser, and application tools. A larger request is rejected before daemon dispatch with `side_effects_started=false`, so a mutation cannot complete locally and then appear to fail only when validation loses its response.
-- Direct long work to process sessions or managed jobs. Initialization instructions now require mutation and validation to be independently terminal, and describe a bounded output/status-file fallback for hosts that omit durable tools.
-- Add a fixed macOS default-route diagnostic. `diagnose_runtime` and `doctor` report only a coarse `tunnel-or-vpn`, `physical-or-other`, `loopback`, or `other` route class plus an interception boolean; they never return interface names, addresses, DNS answers, proxy endpoints, or credentials. This distinguishes application proxy selection from an operating-system VPN/TUN that Machine Bridge cannot repair.
-- Preserve architecture limits by extracting route inspection into its own boundary module, then add line budgets and critical coverage thresholds for the new route module and the Worker timeout/catalog projection.
-
-### Verification
-
-- Add direct timeout-unit tests and a real Wrangler integration proving an over-limit request produces no daemon `tool_call`. Add macOS-route success, unsupported-platform, and fixed-command failure coverage. Refresh architecture, operations, logging, threat-model, client, testing, upgrading, and audit contracts.
-- Refresh the exact development-only pins for `@types/node`, ESLint, and `globals` to their current patch releases; the production dependency graph is unchanged and `npm audit` reports zero known vulnerabilities.
-
-## 3.0.0-beta.22 - 2026-07-28
-
-### ChatGPT call continuity and terminal delivery
-
-- Add an explicit daemon-result acknowledgement. The local runtime retains every terminal result after WebSocket queueing, replays unacknowledged results after reconnect and on heartbeat, and removes them only after the Worker confirms that the generation-guarded terminal transaction committed. This closes the loss window between local `send()` acceptance and Durable Object persistence that could leave a completed local command as a ghost Worker call.
-- Make durable settlement fail closed. A terminal-storage exception is observable and retryable instead of being reported as a completed call; stale connection generations remain unacknowledged, while duplicate results for an already terminal call are acknowledged idempotently so replay converges.
-- Stop treating one tool deadline as proof that the complete daemon socket is dead. Tool timeout now cancels only that call; the independent 90-second daemon-liveness alarm remains the sole connection-invalidating authority.
-- Bound remote foreground execution to 85 seconds plus five seconds of relay overhead, below the observed hosted-client request ceiling. The local process APIs retain their 600-second schema range, but work expected to exceed the interactive budget must use process sessions or managed jobs rather than one foreground ChatGPT call.
-- Tail-trim background daemon logs every 15 minutes as well as before startup, reusing the existing owner-only, no-follow, single-link, schema-checked, UTF-8 line-safe maintenance path.
-
-### Verification
-
-- Add acknowledgement-loss/replay, persistent-terminal-write failure, stale generation, hosted-client deadline, runtime log-maintenance, and real Wrangler acknowledgement coverage. Type checking, lint, architecture, privacy, structured logging, security properties, SARIF, critical coverage, local self-test, Worker infrastructure, and Worker OAuth/MCP integration pass.
-
-## 3.0.0-beta.21 - 2026-07-27
-
-### Relay continuity and stable MCP catalog
-
-- Keep `tools/list` stable for an authenticated account role instead of withdrawing almost every tool whenever the local relay is briefly unavailable. The Worker still fails every execution closed against the live daemon capability ceiling, and `server_info` now distinguishes the stable advertised catalog from the currently effective daemon/account intersection.
-- Persist streamed daemon-call ownership, request correlation, operation deadlines, reconnect deadlines, and result transformation metadata in Durable Object storage. A hibernated or restarted Worker can recover the active call, a verified same-instance daemon can reclaim it, and a per-WebSocket connection generation prevents stale close events or delayed results from mutating the rebound call. Active-record expiry advances monotonically across repeated detach/rebind cycles instead of being capped by the original single-reconnect window.
-- Make Durable Object alarms the sole deadline owner for persisted streamed calls while retaining the existing Promise/timer path for bounded JSON-only calls. A FIFO admission gate computes one combined 32-call ceiling across both paths. Cancellation, send failure, operation timeout, reconnect-grace expiry, daemon replacement, and successful completion all converge through one guarded terminal write.
-- Classify Worker-requested transport and liveness invalidation as retryable relay recovery instead of a permanent protocol mismatch. The daemon now terminates only the affected socket, preserves ordinary disconnect cleanup, and reconnects automatically; Worker transient invalidation uses WebSocket 1012, while unknown protocol messages, authentication failure, and identity/version mismatch remain fatal. Close-only delivery is also classified from bounded reasons so loss of the preceding error frame cannot restart the daemon. A failed daemon `hello` send and a readiness-probe result lost to an ending relay generation are likewise transport races, not authentication or protocol violations.
-- Add red-green persistence, stale-generation, exactly-once, stable-catalog, disconnected-execution, reconnect, cancellation, timeout, transient Worker-error/close-only recovery, and real Wrangler OAuth/MCP integration coverage.
-- Repair POSIX process-tree escalation after workflow-level repeated full verification exposed a surviving anti-`SIGTERM` descendant. Ownership is refreshed immediately after graceful termination, and escalation falls back to targeted PID/start-time/PGID checks when a full process-table snapshot is unavailable under load; PID reuse still fails closed.
-- Extend post-deployment Worker health convergence for edge propagation, and treat an already recorded current deployment fingerprint as verification-only unless `--force-worker` is explicitly supplied. Persistent candidate activation now compensates an early failure by restarting a service that was active before the transaction, after candidate and lock cleanup; restoration failures remain aggregated with the primary failure.
-
-### Audit and documentation
-
-- Re-audit the relay lifecycle, tool-advertisement contract, pending-call accounting, storage validation, state-machine boundaries, privacy-safe diagnostics, and obsolete event-settlement code. Synchronize architecture, operations, logging, testing, security, privacy, upgrading, and audit documentation with the implemented continuity model and its residual failure boundaries.
-
-## 3.0.0-beta.20 - 2026-07-26
-
-### Fixed
-
-- Rewrite the bounded Worker error-cause traversal with an explicit object type guard and `WeakSet<object>` cycle tracking. This preserves the eight-level/cycle-safe classification behavior while eliminating the CodeQL `js/comparison-between-incompatible-types` finding; the existing cyclic-cause regression test continues to enforce non-duplication.
-
-## 3.0.0-beta.19 - 2026-07-26
-
-### Fixed
-
-- Restore the documented `account revoke-client CLIENT_ID` CLI command. The action was implemented end to end, but its positional-argument limit was omitted, so every valid client ID was rejected as an extra positional argument before the signed administration request could be sent. Add direct parser regression coverage for both `account clients` and `account revoke-client`.
-
-## 3.0.0-beta.18 - 2026-07-26
-
-### Fixed
-
-- Prevent intermittent hosted-client account loss during refresh-token rotation. A consumed refresh token may now recover at most two same-client, same-resource, same-scope, same-DPoP retries inside a 30-second concurrency window. Both retries reproduce the original deployment-keyed HMAC replacement pair without creating another credential branch or extending expiration; retries beyond that bound return `temporarily_unavailable`, while replay after the window still revokes the complete family. Schema-2 refresh state migrates in place to schema 3.
-- Normalize unexpected outer-Worker failures to a structured retryable `502 worker_gateway_error` instead of allowing `scriptThrewException`/Cloudflare 1101 to surface as a generic account connection failure. Logged error classes contain only error names/codes, never exception messages.
-- Retry an internal terminal WebSocket subscription with bounded delays after transport closure or retryable 429/5xx responses. Normal streamed calls retain the fixed two-request Durable Object path; failure recovery is capped at three subscription attempts.
-- Stop reading request bodies immediately after a declared or observed size violation instead of draining attacker-controlled bytes. Permission and I/O failures during write-path and workspace traversal checks now propagate rather than being misclassified as missing files.
-- Make partial application and skill discovery explicit through bounded path-projected warnings and coarse error classes. Optional `session_bootstrap` failure remains non-fatal but is now visible in Worker observability.
-- Bound account-administration responses to one MiB, cancel oversized bodies, and require successful replies to be JSON objects. Generated SSH key registration now attempts both cleanup targets and reports incomplete rollback instead of silently leaving an unregistered private key.
-- Add a fixed browser-extension error boundary, remove raw debugger details from successful fallback results, and enforce the 32-operation concurrency ceiling independently inside the extension. Error-cause inspection is cycle-aware and capped at eight levels.
-
-### Quota and deployment hardening
-
-- Serve all public discovery metadata and unknown-path 404 responses in the outer Worker. Only an exact stateful route-and-method allowlist can reach the rate limiter and Durable Object; invalid methods are rejected at the stateless edge.
-- Add a Cloudflare Rate Limiting binding before Durable Object dispatch. Binding failure is fail-open because it is a quota guard rather than an authorization boundary; OAuth, session, and role checks remain inside the Durable Object.
-- Coalesce Durable Object alarms: an already scheduled earlier alarm is reused instead of being rewritten on every daemon heartbeat, and empty alarm state avoids redundant deletes.
-- Report refresh outcomes, estimated resumable-stream row writes, and alarm set/delete/no-op counters in Worker observability. Regression tests hold a normal stream to four storage-row writes before expiry cleanup.
-- Rate-limit repeated edge degradation logs and report suppressed-event counts, while redacting sensitive field names. Remove duplicate `waitUntil` registration for one streamed terminal operation.
-- Add hard critical-coverage thresholds for every new OAuth, stream, metadata, quota, edge-logging, and filesystem-state module rather than relying only on line-count architecture checks.
-- Split OAuth refresh exchange, token issuance, terminal subscription, public metadata, and edge quota guards into focused modules rather than raising architecture limits.
-
-## 3.0.0-beta.17 - 2026-07-26
-
-### Fixed
-
-- Serve `/healthz`, `/`, and CORS preflight from the outer Worker so activation and doctor checks no longer consume Durable Object free-tier request volume. Durable Object free-tier exhaustion now returns a structured `503 durable_object_quota_exceeded` instead of Cloudflare error 1101.
-
-### Durable Object stream request amplification fix
-
-- Replace the outer Worker's time-proportional internal Durable Object poll loop with a fixed two-request terminal path: one authenticated descriptor `prepare`, then one hibernatable WebSocket `subscribe`.
-- Add `mcp-stream-channel.ts` so `BridgeRoom` accepts a single stream subscriber through `DurableObjectState.acceptWebSocket()`, replaces stale resume subscribers, rechecks storage after registration to close the completion race, and pushes exactly one terminal JSON-RPC message.
-- Persist-ready notifications are fire-and-forget from `McpResumptionStore`; if persistence fails, the current online subscriber can still receive the transient terminal result while recovery storage keeps failure semantics.
-- Keep daemon candidate cleanup from treating stream-subscriber sockets as daemon candidates, and reject client-to-DO data on receive-only stream subscribers.
-- Fix the outer subscription waiter so invalid terminal payloads reject instead of leaving the SSE completion Promise permanently unsettled.
-- Extend deterministic infrastructure coverage for the fixed two-request budget, obsolete poll-mode rejection, subscriber replacement, registration races, immediate-completion paths, protocol errors, and non-daemon socket isolation. Update architecture, engineering, testing, audit, and operations contracts to describe subscribe push delivery instead of short pending/terminal polls.
-
-## 3.0.0-beta.16 - 2026-07-25
-
-### Pending-call recovery and verified handover
-
-- Separate the upstream MCP host/connector shard-mapper incident from Machine Bridge evidence. The exact temporary-keyspace error never appeared in Worker or daemon diagnostics and did not increment Worker server-error counters, so it is documented as an external boundary failure with unknown platform ownership rather than misclassified as a local daemon, OAuth, Git, or Cloudflare defect.
-- Close the Machine Bridge failure-amplification path discovered after recovery. Pending calls now retain monotonic operation and reconnect deadlines, schedule the earliest deadline through the Durable Object alarm, and run a compensating overdue sweep on every HTTP/WebSocket event. In-memory timers remain the fast path; a transient alarm-storage error is observable without converting already-dispatched work into a false terminal failure.
-- Make verified same-instance daemon handover atomic with respect to in-flight calls. Both attached and detached records move to the replacement before the incumbent closes, the complete `resume_calls` set is sent, remaining operation timeout is preserved, and failed replacement acknowledgement restores ownership to a still-open incumbent.
-- Add deterministic disabled-timer deadline tests, direct runtime-alarm scheduling/failure tests, and a real Wrangler/workerd race regression that connects a same-instance replacement while the incumbent still owns an active call. The call remains active rather than detached and completes through the verified replacement.
-- Use null-prototype dictionaries for managed-job `env` and `env_resources`, so valid variable names such as `__proto__`, `constructor`, `toString`, and `valueOf` remain ordinary own data instead of mutating JavaScript object prototypes. Add behavior coverage without weakening duplicate-variable rejection.
-- Correct architecture and operations documentation that still described Durable Object `waitUntil` ownership or direct rejection during socket replacement. Document the three deadline enforcement paths, stale-pending diagnosis, host/connector internal-storage error triage, and the exact test evidence.
-
-## 3.0.0-beta.15 - 2026-07-25
-
-### Event-driven streamed-call settlement
-
-- Block `3.0.0-beta.14` after exact owner-machine activation and repeated production verification. Version, launchd identity, private candidate runtime, status, doctor, sequence-zero delivery, session isolation, disconnect recovery, and terminal acknowledgement all converged, but a concurrent `server_info` still timed out while the original SSE remained open; session-scoped cancellation therefore could not enter. Beta.14 has no acceptance record and must not be pushed, published, or promoted.
-- Remove the last cross-event terminal Promise from streamed `tools/call` initiation. `BridgeRoom` now commits the recovery record, registers an event-settled pending call, sends the daemon envelope, and returns the descriptor without retaining a Promise for the daemon result. The later daemon WebSocket `tool_result`, explicit cancellation request, timeout, send failure, or reconnect-grace expiry owns terminal settlement and persistence.
-- Preserve ordinary JSON-only calls with the existing Promise-based request path while adding a separate event settlement mode to `PendingCallRegistry`. Same-instance daemon reconnect still detaches and rebinds both modes; terminal settlement removes request keys, closes observability, and writes exactly one resumable JSON-RPC result.
-- Replace the resumption store's live Promise map with an active-stream set plus a bounded transient terminal map used only when persistence fails. A pending persisted record without matching active state still produces the existing restart-ambiguity error instead of inventing completion.
-- Add deterministic event-lifecycle regressions that prove stream initiation returns before any terminal event, then exercise success, daemon rejection, cancellation, timeout, send failure, result transformation, persistence failure, and same-instance reconnect. Architecture checks forbid `dispatchJsonRpc` terminal Promises, `resumption.attach`, and Durable Object `waitUntil` from returning to the stream initiation path.
-
-## 3.0.0-beta.14 - 2026-07-25
-
-### Concurrent MCP control during streamed delivery
-
-- Block `3.0.0-beta.13` after exact owner-machine activation. Live recovery itself succeeded—sequence zero, session isolation, disconnect recovery, and one-time terminal acknowledgement all worked—but a production Cloudflare Durable Object that directly owned the open SSE response did not accept concurrent `server_info` or `notifications/cancelled` requests until that stream ended. Beta.13 has no acceptance record and must not be published or promoted.
-- Move public SSE ownership to the stateless outer Worker. `BridgeRoom` now authenticates and binds the request, commits the resumable record, dispatches local work, and returns only a bounded internal descriptor. The outer Worker emits sequence zero/keepalives/sequence one and polls the Durable Object with short immediate requests for pending or terminal state, so no Durable Object request remains open while a client stream is active.
-- Strip all internal stream-control headers from public requests before forwarding, then add them only on the trusted service-binding path. OAuth/DPoP, signed MCP-session, token/session replay isolation, explicit cancellation, bounded persistence, and acknowledged-terminal suppression remain enforced by `BridgeRoom`.
-- Extend real Wrangler integration to hold an SSE call open while a concurrent `server_info` succeeds and a session-scoped cancellation reaches the exact daemon call. Transport tests now parse complete SSE events rather than assuming one network chunk equals one event.
-
-## 3.0.0-beta.13 - 2026-07-25
-
-### Resumable MCP result delivery and outage closure
-
-- Complete the Streamable HTTP recovery contract. Every streamed `tools/call` now emits a sequence-zero SSE event identifier before local execution can complete, persists a token- and MCP-session-bound delivery record, emits the terminal result as sequence one, and accepts authenticated `GET /mcp` recovery with `Last-Event-ID`. Reusing sequence one returns an empty completed stream instead of delivering the terminal response twice.
-- Separate execution continuity from result-delivery continuity. An HTTP/SSE disconnect does not cancel the daemon call; only session-scoped `notifications/cancelled` does. A new POST always starts a new request, while GET only resumes a previously issued stream identifier, preventing retry semantics from being conflated with replay.
-- Bound Durable Object recovery state to 64 streams, two minutes, and 1.5 MiB per persisted terminal message. A compact metadata index avoids scanning stored result bodies. Result records carry SHA-256 integrity metadata, are isolated by OAuth token and MCP session, evict expired or oldest completed entries first, and return explicit errors for oversized replay data, lost in-memory execution after Worker restart, or stored-result corruption.
-- Preserve online delivery when persistence fails transiently, fail before side effects when a new recovery record cannot be admitted, and allow browser DPoP/resumption preflights by advertising both `DPoP` and `Last-Event-ID` in CORS.
-- Promote the recovery summary for an already-warned relay outage to `warn`, while brief self-healing interruptions remain debug-only. Default background-service logs now contain both outage start and recovery closure without exposing raw close reasons.
-- Add direct store fault/tamper/capacity tests, SSE framing tests, and live Wrangler integration that disconnects after sequence zero, completes the daemon call, rejects another session, recovers through GET, and proves the acknowledged terminal event is not duplicated.
-- Refresh the locked development-only `brace-expansion` transitive dependency from 5.0.7 to 5.0.8 after the mandatory pre-candidate registry audit reported GHSA-mh99-v99m-4gvg. Both complete and production-only audits must be clean before beta.13 candidate preparation.
-- Integrate Dependabot PR #56 into the complete beta.13 candidate rather than merging its incomplete two-file update. Wrangler advances to 4.114.0, Miniflare/workerd to the 2026-07-22 build, the exact `workerd@1.20260722.1` postinstall approval is reviewed and updated, and the existing patched `sharp@0.35.3` override remains authoritative.
-
-## 3.0.0-beta.12 - 2026-07-23
-
-### ChatGPT Streamable HTTP task continuity
-
-- Fix remote `tools/call` handling so an HTTP/SSE connection closing is no longer interpreted as MCP cancellation. Only an explicit session-scoped `notifications/cancelled` request may remove the pending request key and send `cancel_call` to the daemon.
-- Negotiate `text/event-stream` for clients that advertise it, prime the response immediately, send a bounded ten-second keepalive comment while work is active, and deliver the terminal JSON-RPC result as an SSE message. This prevents a long-running local operation from leaving the ChatGPT-to-Worker HTTP path completely idle.
-- Preserve the underlying Durable Object operation with `waitUntil` when the response stream is no longer writable, so transport disposal cannot silently terminate local work. JSON-only clients retain the existing single-response behavior.
-- Replace duplicated relay timing literals with one shared contract. Same-daemon reconnect recovery is extended from thirty seconds to two minutes, and the Worker pauses only the remaining normal call deadline while detached, avoiding both premature expiry during recovery and inflated timeouts while the daemon is healthy.
-- Add deterministic and live Worker regressions for SSE negotiation, immediate priming, keepalives, terminal result delivery, HTTP abort without cancellation, explicit cancellation after disconnect, shared timeout ceilings, and same-instance recovery timing.
-
-## 3.0.0-beta.11 - 2026-07-23
-
-### External-review verification and observability hardening
-
-- Share one portable content-redaction implementation between local and Worker logs. Worker string fields now redact embedded bearer/API tokens, credential URLs, email addresses, private-key headers, and user-home paths even when the field name itself is not sensitive.
-- Prevent caller-supplied local or Worker fields from replacing authoritative `timestamp`, `level`, `component`, `message`, or `event` metadata, and add regression coverage for both value leakage and metadata forgery.
-- Make the automatic execution model explicit in authenticated `server_info` authority snapshots and `machine-mcp doctor`: operations inside effective authority do not use per-operation prompts, and remote owner shell/browser/application actions have the daemon OS user's ambient authority.
-- Extract local-resource reads and SSH-resource registration into `runtime-resource-service.mjs`, reducing `LocalRuntime` from 697 to 653 lines while retaining the existing zero-extra-step browser/application resource path and public result contract.
-- Re-verify review claims against the repository invariants. The default `full` profile, single-maintainer release controls, Node 26/npm 12 baseline, packaged deployment/release helpers, systemd-user support, and cross-platform behavior suites remain intentional; none is weakened or removed merely to reduce surface area or ceremony.
-- Refresh the exact Wrangler runtime from 4.112.0 to 4.113.0 and advance the reviewed npm install-script allowlist to its exact `workerd 1.20260721.1`; a clean install must not depend on an unreviewed or locally cached postinstall.
-
-## 3.0.0-beta.10 - 2026-07-22
-
-### Published prerelease activation repair
-
-- normalize npm 12 single-result JSON arrays for version, integrity, SHA-1, dist-tags, and publication timestamps;
-- unblock exact registry-backed prerelease installation and soak activation without weakening integrity or dist-tag verification;
-- add a regression fixture matching the real npm 12 response shape that blocked beta.9 activation.
-
-## 3.0.0-beta.9 - 2026-07-22
-
-### Cross-platform release-gate repair
-
-- Block `3.0.0-beta.8` after owner activation and acceptance because pull-request CI found three release-blocking defects that local macOS verification could not establish: the Windows trusted-Git regression forced Linux permission semantics onto NTFS, Ubuntu coverage did not execute the macOS delegated-sandbox behavior probe, and CodeQL rejected an unused cleanup-path assignment.
-- Make trusted-Git regression coverage use the actual host platform while retaining POSIX group-writable rejection on Unix. Make macOS sandbox availability accept explicit platform and executable-presence probes for deterministic cross-platform tests, and exercise the complete read/write/outside-path/Keychain behavior matrix with a synthetic process boundary.
-- Remove the unused activation cleanup assignment rather than adding a CodeQL exception. These changes require a new exact candidate, live activation, acceptance, and full prerelease gate.
-
-## 3.0.0-beta.8 - 2026-07-22
-
-### Candidate repository hygiene correction
-
-- Block `3.0.0-beta.7` after owner-machine acceptance. A full staged-tree `git diff --cached --check` exposed an extra blank line at EOF in the newly added Worker device-session verifier; the earlier working-tree-only check did not inspect that untracked file, so the reported hygiene result was incomplete.
-- Remove only the extraneous EOF blank line. Runtime behavior, protocol behavior, activation logic, and the beta.7 live conclusions are unchanged.
-- Assign a new prerelease version and regenerate the exact candidate because even this packaged-source change invalidates the accepted beta.7 package and promotion digests.
-
-## 3.0.0-beta.7 - 2026-07-22
-
-### Nested npm lifecycle PATH normalization
-
-- Block `3.0.0-beta.6`. Its exact Worker and daemon activated successfully, but live launchd inspection still found repository `node_modules/.bin` entries and npm's private `node-gyp-bin`. The packaged beta.6 function was present and produced a clean PATH when called directly; the failure was caused by nested activation: the existing daemon PATH already contained one npm run-script prefix, and invoking `npm run release:candidate:activate` prepended a second. Beta.6 removed only through the first marker and therefore persisted the complete inner prefix.
-- Normalize through the last npm run-script marker, removing every nested lifecycle prefix while retaining the current Node/package directories, the operator PATH after the innermost marker, and platform defaults. Inactive candidate-runtime entries remain excluded.
-- Expand Unix and synthetic Windows regressions to two complete npm prefix/marker layers followed by a stale candidate and a user bin. Both layers must be removed; ordinary non-lifecycle `node_modules/.bin` entries remain supported.
-
-## 3.0.0-beta.6 - 2026-07-22
-
-### Reproducible background service environment
-
-- Block `3.0.0-beta.5`. Its exact candidate activated successfully on the owner machine: the same-version Worker and single launchd daemon reached readiness, `project_overview` reported distinct effective and daemon-ceiling authority, fixed Git metadata succeeded, `service start` preserved the existing PID, and detached `service restart` replaced the PID and returned to readiness with no pending calls. Post-activation inspection nevertheless found that the launchd `PATH` captured npm lifecycle injection from the activation command, including project `node_modules/.bin` prefixes, npm's private `node-gyp-bin`, and the beta.4 candidate runtime that activation immediately pruned.
-- Make service `PATH` construction reproducible across ordinary installation and prerelease activation. The current Node directory and current package bin are always added explicitly. When npm's `@npmcli/run-script` marker is present, the lifecycle-injected prefix is removed before inheriting the operator PATH. Any other entry below the candidate runtime store is rejected while the current candidate bin remains available. Ordinary user-supplied `node_modules/.bin` entries are retained when they were not injected by an npm lifecycle.
-- Add a cross-platform regression that reproduces the exact activation topology: npm project bins before the lifecycle marker, a stale prior candidate runtime after the marker, an inherited user bin, and the current runtime entry. The service definition must retain Node/current runtime/user tools, reject npm-private and stale candidate entries, preserve absolute-only deduplication, and continue to embed the sanitized value in launchd and systemd definitions.
-
-## 3.0.0-beta.5 - 2026-07-22
-
-### Relay resilience, lifecycle correctness, and fail-closed state hardening
-
-- Block `3.0.0-beta.4`. Live observation showed that the daemon process and launchd job could remain healthy while the authenticated WebSocket disappeared and later recovered with the same PID. The affected route was carried through the machine's system VPN/TUN; Machine Bridge cannot prove which internal VPN hop failed, but it can now distinguish application-level proxy selection from the operating-system network stack instead of reporting the misleading label `direct`.
-- Cap relay reconnect backoff at 15 seconds instead of 60 seconds. Add bounded outage count/start/duration, last close category/code, transport error class, last disconnect/ready timestamps, ready duration, and next-retry timing to `server_info` and `diagnose_runtime`. Emit timestamped `relay.outage.active` and `relay.outage.recovered` events without exposing close reasons, proxy endpoints, page data, tool arguments, or results.
-- Make `service start` idempotently ensure a running service and reserve explicit replacement for `service restart`. Require verified state/workspace ownership before touching the machine-global service, use detached restart handoff where behavior is verified, and fail closed on in-process Windows restart rather than risking a Task Scheduler `/End` operation that also kills the restart helper.
-- Replace raw launchd/systemd status dumps with structured summaries. Service status no longer exposes the user's home path, complete PATH, SSH agent socket, environment, or provider diagnostics. Autostart log schema migration now validates both owner-only log files before mutation, rejects symbolic or multiple-hard-link paths, writes schema 4 strictly, and aborts startup on incomplete migration instead of mixing text and NDJSON.
-- Treat a tool result, public error, Worker pong/welcome, browser response, and extension keepalive as explicit serialization/delivery boundaries. Circular values, BigInt, oversized structures, half-closed sockets, and send failures terminate only the affected request or transport and no longer crash or silently strand the whole relay.
-- Prevent delayed process-tree escalation from signaling a reused PID or process group while still cleaning descendants that survive their parent. Snapshot process identity before graceful termination, verify it before SIGKILL, bind escalation timers to tracker/session lifecycle, and cover parent-exits-first and resistant-descendant cases.
-- Pin implementation-owned Git and release-control commands to absolute, executable, non-group-writable binaries outside the workspace, state root, runtime root, and user home. Fixed metadata probes remain no-shell and minimal-environment; npm lifecycle PATH and workspace shims cannot replace `git` or `gh` in security/release decisions.
-- Pin the browser broker to the repository extension ID derived from `manifest.key`, verify both WebSocket Origin and `chrome.runtime.id`, split extension and runtime credentials, and migrate legacy pairing state under the maintenance lock. The extension now cleans per-socket keepalive timers and active requests on replacement, disables stale reconnect, rejects duplicate request IDs, and closes half-dead sockets on response-delivery failure.
-- Make corrupt workspace trust state persistently fail closed. Only a current-schema state envelope with matching workspace hash, canonical state-root/profile/state paths, and required policy/worker/resource objects can clear `recovery-required`; recovery markers are read once and strictly validate their bounded backup name and timestamp.
-- Make managed-job terminal persistence recoverable. Result, terminal status, private runtime/plan/PID/cancel cleanup, and cleanup confirmation form an ordered protocol. Result-write, status-write, and artifact-cleanup failures remain visible; status reconstruction from a valid terminal result prevents duplicate finally execution, while leftover secret/resource copies are retried by read/list/prune.
-- Give security-audit and legacy authorization state true cross-process locks. State removal also detects those locks plus managed-job transition/recovery locks, preventing uninstall from deleting a profile during an active mutation. Concurrent audit writers retain every event and a continuous hash chain.
-- Reject multiple-hard-link inodes at owner-only state, autostart logs, runner diagnostics, and path-based existing-file reads. Atomic overwrite remains safe because it replaces the workspace directory entry rather than modifying a shared inode.
-- Upgrade delegated macOS sandbox enablement from executable-presence testing to a behavior matrix that proves workspace access and denies outside reads/writes. Current hosts where the matrix fails remain fail closed; Keychain isolation is no longer claimed without an independently verified boundary.
-- Bound detached managed-job credentials and staging lifetime. Minimal plans launch the runner with a minimal control environment, explicit full-environment plans retain that choice, and unexecuted sensitive plans expire after 24 hours instead of remaining for the seven-day result-retention period.
-- Preserve both primary and cleanup failures for Secure Enclave enrollment and persistent candidate activation. Local cleanup failure is returned as an `AggregateError`; transactional rollback of an already updated Cloudflare Worker and local service definition remains an explicit operational residual rather than a false guarantee.
-- Add explicit 32-call stdio admission control, refresh-family revocation before replay-marker capacity eviction, constant-memory unauthorized-request body draining before rejection, trusted Windows PowerShell literal tests, browser broker load counters, function-complexity/module-size gates, and risk-directed coverage for every new boundary.
-
-## 3.0.0-beta.4 - 2026-07-22
-
-### Explicit daemon-ceiling reporting and fixed internal metadata execution
-
-- Mark `3.0.0-beta.3` as blocked. Its owner activation, persistent daemon handoff, relay readiness, service restart, and ordinary owner tool calls succeeded, but live verification exposed two delegated-account defects before publication: `project_overview` could report the request-effective `custom` policy as the daemon ceiling, and reviewer/editor Git metadata calls were routed through the arbitrary-process sandbox boundary.
-- Return request-effective `policy`/`tools` and daemon-ceiling `daemonPolicy`/`daemonTools` as separate local fields. The Worker now consumes the explicit ceiling fields and retains a compatibility fallback for older daemon responses, preventing a second interpretation of an already-intersected policy.
-- Add a fixed internal process path for bounded implementation-owned metadata probes. It uses validated argv, no shell, an isolated minimal environment, the existing timeout/output/cancellation/process-tree accounting, and never inherits the daemon full environment. Git status, diff, log, show, and project-root detection use this path; user-selected `run_process`, registered commands, and `exec_command` remain subject to the delegated sandbox and ordinary role ceilings.
-- Add real `LocalRuntime` regressions for editor project snapshots and reviewer Git metadata, a process-layer regression proving the internal path is not wrapped as delegated arbitrary execution, and Worker integration coverage that supplies distinct effective and daemon fields.
-- Prevent foreground startup in an unrelated workspace or isolated state root from unloading the machine-global autostart service. Platform service control now requires a live, verified `service` daemon lock for the exact state/workspace; the installed-package smoke test traps service-manager calls and proves zero-argument startup cannot stop the operator's real daemon. This fixes the repeated relay outages observed when the full verification plan reached `install:test`.
-- Make `--log-format json` authoritative for the complete logger surface. Direct `debug`/`info`/`success`/`warn`/`error` calls and persistent daemon readiness now emit one timestamped, redacted JSON object per line instead of silently falling back to unstructured text. Add regressions for stream routing, normalized levels, timestamps, and sensitive/path field redaction.
-- Override Wrangler/Miniflare’s transitive `sharp` dependency from vulnerable 0.34.5 to patched 0.35.3 after GHSA-f88m-g3jw-g9cj entered the audit database. Keep Wrangler itself pinned, update the npm script allowlist, and require full Worker/Miniflare integration plus zero-high-severity audit evidence for the override.
-
-## 3.0.0-beta.3 - 2026-07-21
-
-### Provisioned Secure Enclave broker boundary
-
-- Mark `3.0.0-beta.2` as blocked. Its live activation restored version 2 device-ID compatibility, but then attempted to create a persistent Secure Enclave key from a runtime-compiled, ad-hoc-signed command-line helper. Modern macOS routes Secure Enclave keys through the data-protection Keychain and rejected that helper with `errSecMissingEntitlement` (`-34018`) before Worker deployment or daemon handoff.
-- Stop treating a source-built ad-hoc helper as a production trust anchor. Without an explicitly configured provisioned broker, macOS retains or creates the owner-only portable P-256 root, performs no Keychain operation, requests no user-presence prompt, and proceeds with the coordinated version 3 upgrade.
-- Add opt-in Secure Enclave enrollment through `MBM_MACOS_TRUST_BROKER`. The configured absolute path must resolve to a regular executable that is not group/other writable, has a strict valid Apple code signature, carries a stable signing identifier and Team ID, and passes an end-to-end probe that creates and deletes a temporary Secure Enclave key. The enrolled root binds the canonical broker path, signing identifier, Team ID, protocol version, key tag, and public key; every later public-key check or signature revalidates that binding.
-- Keep the packaged Swift source and ad-hoc build only as a development and protocol-conformance fixture. It is intentionally rejected by the production broker validator. Add cross-platform provider-selection tests, macOS signature/binding/probe regressions, and truthful `server_info` provider metadata.
-
-## 3.0.0-beta.2 - 2026-07-21
-
-### Version 2 device-identity compatibility
-
-- Restore the stable RFC-style P-256 JWK member order (`crv`, `kty`, `x`, `y`) used by version 2 device identifiers. The initial beta accidentally reordered those members through a new shared canonicalization helper, causing an intact version 2 portable identity to fail before Worker or daemon handoff.
-- Add an explicit backward-compatibility regression that validates a persisted version 2 identifier and rejects the incorrect beta.1 ordering. Beta.1 is blocked and must not be activated or promoted.
-
-## 3.0.0-beta.1 - 2026-07-21
-
-### Request-scoped authority, trusted clients, and zero-routine-prompt security
-
-- Replace delegated terminal approval IDs and broad capability leases with a request-scoped authority intersection. Every remote request now evaluates the daemon capability ceiling, the authenticated account role ceiling, the OAuth client and refresh-token family, automatic safety invariants, and object ownership. A grant can no longer expand a reviewer, editor, or operator beyond its canonical role. Owner/full automation remains uninterrupted, but owner requests are still risk-classified and audited.
-- Bind retained process output, interactive process sessions, and managed jobs to account ID, account version, OAuth client, and refresh-token family. Cross-account or stale-session reads, input, cancellation, and output access fail closed. Protected local resources cannot be smuggled into delegated managed jobs, and non-owner accounts cannot create durable execution plans.
-- Enforce request-specific path visibility, unrestricted-path authority, absolute-path disclosure, and child-process environment selection throughout file, Git, Agent-context, process, and job services. Generic path-based file tools cannot read or write Machine Bridge control-plane state even under owner/full; arbitrary owner shell execution remains equivalent to the OS user and is documented as a residual risk. Delegated process execution requires a behavior-verified OS workspace sandbox; platforms where the sandbox merely exists but fails a deny-default launch probe reject delegated execution rather than silently running with local-user authority. Owner execution is unchanged.
-- Remove terminal-based operation authorization from the normal CLI and runtime. OAuth client authorization is the low-frequency trust event; ordinary operations run automatically within the account ceiling. Legacy leases are ignored by runtime and remain visible only for incident-response revocation. Trusted clients bind to one account and can be listed or revoked independently without rotating every account credential.
-- Propagate refresh-token family identity to the local daemon and reject relay envelopes without it. Access tokens remain fifteen minutes and rotating refresh families remain bounded. Client trust, account version, role, and family identity participate in authorization and object ownership.
-- Add a privacy-preserving chained security audit. It records tool, coarse risk category, result, duration, byte counts, target digest, and keyed principal references without storing command text, paths, file contents, form values, or output. Hash-chain verification detects local corruption or alteration and is exposed through runtime diagnostics without blocking ordinary work when the audit sink is unavailable.
-- Stop nonce-capacity handling from evicting live replay markers. A full replay cache now rejects new signed requests until entries expire instead of reopening the replay window.
-- Replace the long-lived file-backed device signer with a root-certified ephemeral session hierarchy. macOS prefers a non-exportable Secure Enclave P-256 root protected by user presence; one root signature per daemon start certifies a 24-hour in-memory session key used for preflight, challenge authentication, reconnect, and account administration. Root migration and rotation are two-phase: a pending public key is deployed and health-verified before local promotion.
-- Remove `ACCOUNT_ADMIN_SECRET` from local state and Worker secrets. Account/client administration now uses the same root-certified ephemeral P-256 session, with each request bound to origin, method, path, body hash, key ID, timestamp, and nonce. Add optional DPoP ES256 token binding for compatible clients while preserving Bearer interoperability. DPoP proof verification no longer consumes replay capacity before OAuth credential validation, preventing unauthenticated cache exhaustion; unsupported critical JWS headers are rejected.
-- Remove the terminal `job approve` execution path. `stage_job` remains a validated non-running draft; execution requires trusted owner `start_job` authority or an explicit local `machine-mcp job submit PLAN.json` action.
-- Add behavior-level regressions for canonical-full daemon versus delegated-role boundaries, cross-account process/job ownership, control-plane path protection, token-family binding, nonce saturation, chained audit tampering, and delegated sandbox capability probing. Expand critical-module coverage and rewrite authorization, operations, upgrade, security, and threat-model documentation around the zero-routine-prompt model.
-- This is a coordinated Worker, daemon, state, and browser-extension protocol upgrade. Version 3 components must converge together; existing remote clients must authorize once again because the relay principal now requires refresh-family and trusted-client binding.
-- Replace the direct-to-stable release path with mandatory `dev`/`beta`/`rc` channels, registry-verified soak, and content-preserving stable promotion. Major, minor, and patch releases require at least seven days, three days, and one day respectively. A blocking fix increments the prerelease and restarts the interval.
-- Add one persistent candidate activation command that verifies the exact tarball, updates the same-name Worker, proves candidate relay readiness, hands off to the login daemon, verifies the background version, and exits while the service remains active. Add exact prerelease npm/GitHub channel checks, published-package activation records, tracked soak evidence, promotion-content digests, and stable push/release/publication gates.
-- Remove the remaining internal APIs that could create version 2 capability leases. Only migration cleanup (`list`, `revoke`, `clear`) remains.
-
-## 2.0.0 - 2026-07-21
-
-### Device identity and usable local transaction authorization
-
-- Replace the long-lived daemon bearer secret with an enrolled P-256 device identity. Every WebSocket upgrade now requires a signed short-lived preflight bound to Worker origin, package version, nonce, and timestamp. Its nonce is consumed once through bounded transactional state, preventing both unauthenticated candidate churn and replay of a captured preflight. The Worker then issues a fresh challenge whose signature also binds the daemon instance before tools may be advertised or a verified incumbent may be replaced.
-- Fix Windows authorization tests to avoid asserting POSIX mode bits on NTFS, and record the exact expiring CodeQL assessment for the mandatory 256-bit machine-generated account credential verifier.
-- Let authenticated owner sessions execute directly within the daemon policy ceiling without terminal approval, while retaining local capability leases for high-impact operations from delegated non-owner accounts. The canonical `full` profile is unchanged. Workspace-contained reads and ordinary edits, project inspection, Git, and diagnostics remain automatic. Because the extension controls an existing logged-in browser profile, one `browser-session` lease covers profile reads and actions instead of prompting per click; registered-resource input and file upload retain an independent `data-export` boundary. Compound operations must satisfy every applicable scope, so browser uploads require both scopes and protected-resource desktop input requires both application control and data export. Remote process control and continuation, outside-workspace or sensitive reads/writes, managed-job listing/output/mutation, credential operations, and application inspection/control run uninterrupted once the bound account and OAuth client hold the required time-bounded scopes. The CLI supports scoped leases and an explicit at-most-eight-hour `--full` automation window.
-- Store only bounded identity/scope/time metadata and SHA-256 target digests in owner-only approval state; validate every persisted record and fail closed on malformed state. Canonicalize every patch destination, including `Move to` and symbolic-link ancestors, before classifying it, and reject final symbolic-link overwrites so classification and execution share the real target. Serialize daemon and CLI approval mutations with an owner-only process-identity lock so concurrent pending, grant, approval, revocation, and clear operations cannot silently overwrite one another. A catalog-completeness test forces every current and future tool through explicit risk review. Relay authorization now carries the authenticated OAuth client identity so leases cannot cross clients.
-- Reduce access-token lifetime from 30 days to 15 minutes. Refresh tokens now have a 14-day idle limit and a 30-day family limit; reuse of a rotated refresh token revokes the complete family, including active access tokens. Consumed-token and revoked-family replay records are hard-bounded, oldest-first pruned, and record-schema validated. The first device enrollment also rotates the deployment token version so pre-2.0 credentials cannot survive the upgrade.
-- Replace the account-management network bearer with per-request HMAC-SHA-256 authentication bound to Worker origin, HTTP method, path, body hash, timestamp, and random nonce. Transactional Durable Object nonce state rejects replay and fails closed when malformed; the local CLI workflow is unchanged.
-- Split operation-risk classification, lease persistence, daemon authentication, refresh-family persistence, and administration authentication into focused domain modules with behavior-level tests. Document capability ceilings, transaction authorization, upgrade/rollback boundaries, residual same-user risk, and the controls deliberately left external.
-- This is a coordinated Worker/daemon protocol upgrade. Version 2.0.0 components must be deployed and run together; the removed daemon bearer protocol is not retained as a compatibility bypass.
-
-## 1.2.11 - 2026-07-20
-
-### Bounded output continuation and repository backlog gate
-
-- Stop large one-shot process responses from overwhelming MCP hosts. `run_process`, `run_local_command`, and `exec_command` now inline only a bounded stdout/stderr preview, retain up to 1 MiB per stream in a temporary completed process session, and return an `output_session_id` for paged `read_process` continuation. Nonzero exits keep their human error message bounded while preserving structured continuation details.
-- Avoid protocol-level payload duplication by replacing the text mirror of large object results with a compact field summary while retaining the authoritative object in `structuredContent`. The fast/platform/full check runner suppresses successful child noise, preserves bounded head/tail diagnostics on failure, and supports explicit `MBM_CHECK_VERBOSE=1` streaming. Coverage cleanup now retries concurrent late V8 coverage-file writes instead of failing after the thresholds already passed.
-- Resolve the release-acceptance file race by opening no-follow descriptors first, checking descriptor/path identity, and reading acceptance records and tarballs through bounded descriptors. Remove the temporary CodeQL exception and add deterministic path-replacement and symbolic-link regressions.
-- Add a guarded GitHub backlog pre-push check. `npm run github:push` now blocks unrelated open pull requests and open issues not covered by a standard closing keyword in the current branch commits; the current branch PR remains updateable. Add unit and integration coverage for output paging, compact MCP projection, bounded check diagnostics, and backlog enforcement.
-
-## 1.2.10 - 2026-07-20
-
-### Relay interruption recovery
-
-- Preserve an in-flight MCP tool call across a brief daemon WebSocket interruption instead of converting every transient proxy or network reset into an immediate cancellation. The Worker now detaches pending calls for a bounded 30-second grace period and rebinds them only when the same local daemon process instance completes the full authenticated readiness probe on its replacement socket.
-- Keep the local operation running during that grace period and queue a completed result until the relay is ready again. Before `ready_ack`, the Worker sends an authoritative `resume_calls` set so the runtime cancels work whose client disappeared during the outage; results are replayed only for same-instance calls that still have a receiver. A different daemon instance cannot claim them, and an unrecovered outage cancels ordinary calls and process trees when the grace period expires.
-- Add deterministic registry/runtime regressions and a real Worker/OAuth/MCP fault-injection test that starts a tool call, forcibly drops the daemon WebSocket, reconnects the same daemon instance, and proves the original HTTP request completes. Expose the bounded `pending_calls.detached` count for diagnosis, require a validated ephemeral daemon instance identifier in the current-version hello contract, and update architecture, logging, operations, audit, and multi-account documentation.
-
-## 1.2.9 - 2026-07-18
-
-- Repair cross-platform release infrastructure found by PR CI: the layered check runner now invokes the pinned npm CLI through Node instead of spawning `npm.cmd`, and `release:accept` computes and locally validates the portable Git-content digest through a temporary index so CI can verify accepted package content across merge commits without mutating the maintainer index.
-- Correct the release handoff: add `npm run release:candidate:start -- --allow-worker-deploy` for an isolated local installation plus explicitly authorized in-place candidate Worker deployment, require owner-authorized and agent-operated live verification before acceptance, allow the coding agent to record acceptance and complete commit/push/tag/GitHub Release work, and add `npm run release` as the canonical source-release command. npm publication and Worker deployment remain owner-operated.
-
-### Architecture headroom, verification feedback, and threat model
-
-- Split tool registration, relay adaptation, path redaction, Agent-context projection/rendering, bounded skill discovery and text reading, browser request lifecycle, runtime-client broker routing, authenticated loopback server setup, browser HTTP handling, Windows launcher quoting, managed-job transition locks, runner identity, private storage, public projections, Worker OAuth authorization-page rendering, JSON-RPC framing, and WebSocket protocol cleanup out of near-limit orchestration modules. Tighten architecture budgets around the new boundaries so `runtime`, Agent context, browser broker, Windows service, managed jobs, and `BridgeRoom` retain explicit headroom instead of treating their previous line caps as targets.
-- Replace the monolithic package-script chain with audited `check:fast`, `check:platform`, and `check:full` plans while keeping `npm run check` as the complete gate. Each task reports elapsed time; macOS and Windows CI run the cross-platform behavior plan plus installed-package smoke coverage, while Ubuntu runs the full coverage, browser, package, stdio, Worker/OAuth, and real-browser suites.
-- Expand critical-module coverage gates to state persistence, relay lifecycle, managed jobs, runtime path redaction, Agent-context projection, browser broker/request routing, Worker OAuth, JSON-RPC framing, and WebSocket protocol helpers. Add strict checked-JavaScript coverage for the runtime path/redaction, Agent-context projection, skill-discovery, and bounded text-file boundaries. Repair a detached-process self-test race by waiting monotonically for the child PID handoff file, and remove fixed CI-job-count and implementation-location assumptions from source-shape tests.
-- Replace the oversized README with a decision-oriented entry path, add a component overview and explicit threat model, document the Node 26/npm 12 support trade-off, and add a contributor first-30-minutes workflow. Security objectives, attacker classes, non-goals, and external governance gaps are now stated separately from incident and release audit history.
-
-## 1.2.8 - 2026-07-17
-
-### Owner-tested release gate and dependency workflow repair
-
-- Replace the previous automation-only release assumption with an explicit repository-owner local acceptance boundary. `npm run release:candidate` runs the complete suite and creates the exact npm tarball under ignored local state; `npm run release:accept` records the owner decision only when a second pack is byte-identical. The tracked acceptance record contains package identity, SHA-1, SHA-512 integrity, timestamp, and a fixed confirmation marker, while excluding personal identity, machine paths, logs, credentials, and user content.
-- Add `npm run github:push`, which rejects dirty trees, detached HEAD, direct `main` pushes, untracked acceptance records, or package-hash drift before pushing a release-relevant branch. Pull-request CI and `release:publish` independently rebuild and verify the accepted package. `release:publish` no longer pushes `main`; it requires the accepted branch to have been reviewed and merged so local `HEAD` already equals `origin/main`.
-- Distinguish npm-package changes from GitHub-only repository infrastructure. The release-impact gate now derives package relevance from `package.json.files`, so Action-only Dependabot PRs no longer deadlock on an unrelated npm version bump while source, scripts, browser extension, package metadata, and shipped documentation remain versioned.
-- Consolidate the five pending GitHub Action updates atomically: CodeQL `init`, `analyze`, and `upload-sarif` now use the same 4.37.1 commit; `actions/setup-node` advances to 7.0.0; and `actions/upload-artifact` advances to 7.0.1. Dependabot now groups all GitHub Action updates so coupled action families cannot be split into incompatible PRs.
-- Update Wrangler from 4.111.0 to 4.112.0 and advance the exact reviewed `workerd` install-script allowlist to 1.20260714.1. Complete and production dependency audits remain at zero known vulnerabilities.
-- Rewrite the release, contribution, automation, engineering, architecture, testing, and audit contracts around the owner-tested artifact boundary. Add executable regression coverage for package-impact classification, package-hash acceptance, workflow grouping, CI verification, no automatic `main` push, and package-manifest inclusion of every new helper.
-
-## 1.2.7 - 2026-07-17
-
-### Process supervision, lifecycle, and isolation audit
-
-- Separate argv validation, execution limits, process-tree supervision, one-shot execution, and interactive process sessions into explicit modules. Shell helpers, managed jobs, call cancellation, runtime shutdown, and process sessions now share one graceful `SIGTERM` followed by forced tree-termination contract instead of importing session internals or maintaining duplicate platform branches.
-- Reclaim an unresponsive detached service daemon only after revalidating PID, process start time, entrypoint, command line, daemon mode, workspace, and state root immediately before `SIGKILL`. PID reuse, identity drift, foreground ownership, and ambiguous records remain fail closed. Process-session termination now also escalates after a bounded grace period.
-- Add a machine-readable `server_info.runtime.execution_guardrails` contract for tool-call concurrency, process timeout/stdin/output limits, process-session limits, and cleanup semantics. CPU quota, memory quota, and network isolation are reported explicitly as `not-enforced`; hard isolation still requires a dedicated account, container, or VM.
-- Make browser-broker startup generation-aware so `stop()` cannot race an asynchronous listen/proxy connection and leave a listener alive. Pending proxy routes now receive a terminal error during shutdown, broker recovery failures emit structured debug events, and the local browser-health probe uses bounded direct `127.0.0.1` HTTP instead of environment-routed `fetch`.
-- Reject detached managed-job launch when no process ID was obtained, attach an asynchronous child-error observer, make `shell: false` explicit, and remove duplicate plan-scrubbing logic. Correct stale relay-readiness and runtime-observability documentation, and add fault-path tests for resistant descendants, forced daemon reclamation, startup cancellation, proxy-bypassed loopback health, runner spawn failure, and honest OS-enforcement reporting.
-
-## 1.2.6 - 2026-07-17
-
-### Relay ready-context and implicit service-daemon takeover
-
-- Keep end-to-end readiness fail-closed, but stop treating an incomplete inbound relay context that only carries `sessionId` as permanently unready. After a verified ready connection, the runtime consults live relay status when the per-message snapshot omits `ready`; an explicit `ready: false` snapshot still rejects tool calls. `RelayConnection` now always forwards boolean `authenticated` and `ready` with the session generation.
-- Recognize managed service daemons started with only `--daemon-only` (no explicit `--workspace` / `--state-dir` on the process argv) when the lock owner already matches the active workspace state. Partial identity (one of the two path flags) remains rejected so foreign processes cannot be taken over. This allows recovery of source-tree recovery daemons that previously stayed orphaned across CLI upgrades.
-- Add regression coverage for pre-ready vs ready inbound message contexts, sessionId-only dispatch after readiness, explicit `ready: false` fail-closed behavior, and implicit daemon-only stop/takeover.
-
-## 1.2.5 - 2026-07-17
-
-### End-to-end relay readiness and safe daemon handover
-
-- Separate authenticated WebSocket transport from verified service readiness. A daemon now becomes externally usable only after the Worker sends a random readiness probe and receives its result through the same local message dispatch, relay-session binding, and `tool_result` delivery path used by real calls. `hello_ack` and heartbeats alone can no longer produce `daemon.connected=true` when result delivery is broken. The local runtime also rejects pre-ready tool calls and a premature `ready_ack` that was not preceded by a successfully delivered probe result.
-- Keep the incumbent verified daemon active while a replacement is authenticated and probed. A failed, malformed, silent, or incompatible candidate is closed without displacing the working connection; only a successful `ready_ack` handover replaces the incumbent. Candidate hello, readiness, and steady-state liveness have independent bounded deadlines enforced by Durable Object alarms.
-- Extract daemon attachment/state transitions into `DaemonSocketRegistry`, expose authenticated/probing/ready counts and readiness timestamps through `server_info`, and add fault-injection coverage for missing acknowledgements, invalid probe results, replacement races, reconnect backoff, session-generation propagation, and full OAuth/MCP/WebSocket routing.
-- Correct capability ranking after the local research-skill rename: generic identity tokens such as `web`, `cli`, and `tool` no longer dominate selection, while concrete Chinese research/search intent maps to `research`, `search`, and `find`. This prevents a browser-form task from selecting a web-research skill without weakening explicit research requests.
-- Remove a duplicate Worker route guard, require awaited alarm rescheduling after inbound activity, retain zero production dependency vulnerabilities, and refresh architecture, operations, logging, testing, upgrade, and audit documentation. State schema 6 and policy revision 5 remain unchanged.
-
-## 1.2.4 - 2026-07-17
-
-### Relay tool_result session context regression
-
-- Pass the authenticated relay session generation into every inbound WebSocket `onMessage` callback. The 1.2.2 session-binding change discarded every `tool_result` with `session_ended` because handlers received `sessionId=0` even while heartbeats kept the socket live, so MCP tools timed out despite `daemon.connected=true`.
-- Emit an explicit error when a tool result is discarded because the inbound call context lacked a session id, and include both expected and active session ids in the structured event.
-- Add a regression that proves message dispatch attaches the current authenticated session generation.
-
-## 1.2.3 - 2026-07-17
-
-### Worker daemon false-online liveness
-
-- Treat authenticated daemon sockets as live only when inbound traffic is recent. `role=daemon` plus `readyState=OPEN` is no longer enough after Durable Object hibernation or a half-closed transport, which previously left `daemon.connected=true` while every `tool_call` timed out.
-- Persist `lastSeenAt` on daemon attachments, refresh it on `hello`, heartbeats, and `tool_result`, and reclaim silent sockets through the Durable Object alarm as well as on tool send failure or prolonged silence during a timed-out call.
-- Report `daemon.last_seen_at`, `daemon.liveness_timeout_ms`, and `worker.sockets_live` from `server_info` so control-plane counters that reset on DO wake are not mistaken for live authenticated sockets.
-- Add pure liveness helpers and regression coverage for fresh, silent, candidate, and legacy attachments without `lastSeenAt`.
-
-## 1.2.2 - 2026-07-17
-
-### Relay result lifecycle and human-readable diagnostics
-
-- Bind every local `tool_result` to the authenticated relay session that delivered its `tool_call`. A result from a disconnected or replaced socket is discarded instead of being sent over a newer connection, and a caller cancellation marks the eventual local result as intentionally undeliverable. Routine late-result races are debug-only rather than repeated `relay.tool_result.delivery_failed` warnings; an actual synchronous WebSocket send failure still invalidates the ambiguous transport.
-- Propagate MCP HTTP cancellation into the Worker pending-call registry. Incoming request cancellation removes both internal and session request-key indexes, sends a best-effort daemon cancellation, and records the call as cancelled. The Worker deployment now explicitly enables Cloudflare request-signal delivery and passthrough to the Durable Object.
-- Add an `unmatched_results` Worker metric for results that arrive after their pending record was removed. Human log mode uses natural-language event messages and omits the redundant machine event key, while JSON mode retains stable event names and bounded structured fields.
-- Add regression coverage for relay-session replacement, stale-result suppression, request-signal cleanup, human log rendering, compatibility flags, and unmatched-result observability. Local Wrangler integration continues to cover the complete OAuth/MCP/WebSocket flow and explicit MCP cancellation.
-
-## 1.2.1 - 2026-07-16
-
-### Fail-closed input contracts and bounded CLI adapters
-
-- Eliminate prototype-chain lookup from externally controlled command, action, account-role, policy-profile, form-field, keyboard, and local-resource keys. Dispatch and enumerations now use `Map`, `Set`, `Object.hasOwn`, or null-prototype records; names such as `constructor` and `__proto__` can no longer become inherited handlers or unauthorized enum members. A malformed current-schema OAuth account role is repaired in place to a disabled reviewer account, its version is advanced, and every existing authorization code and token is revoked so an affected installation remains administrable without granting authority.
-- Make Worker deployment output parsing and health verification share one canonical `workers.dev` origin validator. Wrangler output containing unrelated `/mcp`, `/healthz`, path-bearing, or wrong-name URLs is no longer accepted as deployment evidence and cannot poison the persisted URL or deployment fingerprint.
-- Preserve the exact browser `maxBytes` contract for non-ASCII page source. The DOM serializer now backs off to a complete UTF-8 prefix instead of decoding a split code point into a replacement character whose encoded size exceeds the reported budget; regressions cover emoji and Chinese text at every partial-byte boundary.
-- Replace ordinary browser and service CLI branch trees with named, map-driven adapters. The service adapter is independently injectable and reaches 100% function and over 90% branch coverage; architecture checks are split into module boundaries, repository hygiene, browser/security structure, and release/documentation contracts so source-shape guards remain supplemental to executable behavior tests.
-- Keep local state schema 6, policy revision 5, browser pairing, resources, jobs, and Worker identity unchanged for an in-place upgrade from 1.2.0. Normal startup still converges the versioned Worker and the unpacked extension must be reloaded; no live deployment, credential rotation, daemon replacement, global installation, or npm publication is performed by this source change.
-
-## 1.2.0 - 2026-07-16
-
-### Typed evolution boundaries and project governance
-
-- Split the highest-change orchestration modules along real lifecycle boundaries. Worker OAuth storage, registration, authorization, account administration, token verification, and mutation serialization now live in `OAuthController`; local runtime reporting, fixed diagnostics, and capability composition have dedicated services; Agent configuration/path validation and browser MCP operation semantics no longer share files with discovery or loopback broker transport. Persisted state schema 6, policy revision 5, token records, browser pairing, resources, and managed-job data remain unchanged for an in-place upgrade from 1.1.5.
-- Make Worker TypeScript imports explicit and directly executable under Node 26, including `.ts` specifiers and JSON import attributes. Add a focused OAuth-controller state-machine suite covering registration throttling, authorization failure/success, resource-bound access tokens, expiry pruning, schema mismatch, and missing identity keys while retaining the real workerd OAuth/MCP integration.
-- Add a strict checked-JavaScript contract gate for local policy, call lifecycle, Agent configuration and path containment, browser handshake parsing, capability ranking, monotonic deadlines, record/number normalization, and bounded metadata reads. Expand correctness linting to reject async Promise executors, returned Promise-executor values, unsafe `finally`, useless catches, invalid `typeof`, self-assignment, and invalid NaN comparisons, and unused imports/variables; fix every newly detected occurrence rather than waiving the rules.
-- Raise risk-directed coverage gates and include Agent, browser, runtime-boundary, and OAuth-controller fixtures. Worker pending-call and policy modules now have branch floors; the extracted runtime reporting, diagnostics, capability, browser operation, browser protocol, Agent contract, and capability-ranking modules have independent function and branch minima. Lower architecture line caps prevent the orchestration modules from regaining the extracted responsibilities.
-- Add a five-minute README path, explicit Node 26/npm 12 support boundaries, a current-only upgrade and rollback contract, support/reporting guidance, project governance and succession rules, and a code of conduct. The first control required after a second active maintainer joins is non-author and last-push approval for security-sensitive code and release surfaces.
-- Preserve release and supply-chain behavior: no live npm publication, Worker deployment, secret rotation, or daemon/service replacement is performed by this source release. Trusted npm publishing with GitHub OIDC still requires the external package-owner trust relationship and remains the next publication-control improvement.
-
-## 1.1.5 - 2026-07-16
-
-### Windows autostart and persisted network environment
-
-- Replace the oversized Windows Scheduled Task `/TR` invocation with a short private launcher. The launcher contains the full quoted Node/CLI/workspace argv, routes output to the normal service logs, exits on success, and restarts nonzero daemon exits after five seconds. Register it for current-user logon at `LIMITED` run level, and reject a custom state path when even the short action exceeds Task Scheduler's 262-character boundary.
-- Query Windows task state and last result through fixed PowerShell object properties instead of localized `schtasks` text. Creation, start, stop, and removal are verified against observed state; an installed `Ready` task is no longer reported as active, and localized nonzero stop/delete output cannot create a false failure after the requested state is reached. Default reboot recovery occurs after that Windows user signs in, not before login or as `SYSTEM`.
-- Persist an owner-only allowlist of proxy and custom-CA environment variables for autostart daemons. Session-only PowerShell proxy settings now survive logon/reboot, environment-free later starts do not erase them, explicit case-insensitive replacements remove stale variants, and status/logging expose only configured key names. Unrelated environment secrets, oversized values, and control characters are rejected.
-- Extend Worker idempotency coverage through a real disk-state reload to prove that a successful Wrangler upload followed by health timeout is not repeated by a new process. Clarify that a different canonical `--workspace` intentionally selects a different profile and Worker, and add terminal guidance to rotate any one-time account password exposed in shared output.
-- Refresh the exact `ws` and Wrangler pins. The `ws` patch tightens fragment buffering limits, while Wrangler advances its bundled `workerd`; update the reviewed install-script allowlist to the exact new `workerd` version and retain zero high-severity or production audit findings.
-
-## 1.1.4 - 2026-07-15
-
-### File integrity and contract corrections
-
-- Preserve exact UTF-8 line endings in `read_file` whole-file and line-range results. CRLF files no longer return LF-normalized content paired with a SHA-256 value for different text.
-- Flush workspace write and patch staging files through their open descriptors before atomic commit, remove partial staging files after failed writes, and report incomplete staging cleanup instead of leaving hidden residual data silently. This aligns `write_file`, `edit_file`, and `apply_patch` with the documented durability contract while retaining exact POSIX mode application.
-- Surface incomplete `apply_patch` rollback as an explicit recovery error, and return a warning when a committed transaction cannot remove an internal staging or backup artifact instead of silently hiding residual workspace state.
-- Enforce the documented 3-64 character account-name rule for newly created accounts in both the local administration client and Worker. Existing one-character accounts created by older versions remain discoverable for login and administration.
-- Correct CLI `--json` guidance to state that a newly generated account password is intentionally included once during initial creation or rotation; stored administration, daemon, and token-version secrets remain omitted.
-
-## 1.1.3 - 2026-07-15
-
-### Copilot Studio final OAuth callback
-
-- Complete the Power Platform browser callback chain by allowing `https://copilotstudio.microsoft.com` only when the already validated OAuth redirect URI belongs to Microsoft's HTTPS `consent.azure-apim.net` domain. Copilot Studio redirects global consent to a regional consent endpoint and then to its own `/connection/oauth/redirect` page; Chromium applies the originating authorization page's `form-action` policy across every hop.
-- Preserve the narrow security boundary: ordinary OAuth clients still receive only `'self'` plus their exact validated redirect origin, Microsoft consent callbacks retain the consent-subdomain allowance, and lookalike domains receive neither the regional nor Copilot Studio exception.
-- Extend the real Chrome regression to prove four policy states: self-only blocks the first callback, global-only blocks the regional handoff, global-plus-regional blocks the final Studio handoff, and the complete policy preserves `code` and `state` through the entire chain.
-
-## 1.1.2 - 2026-07-15
-
-### Copilot Studio regional OAuth callback
-
-- Allow a validated Microsoft `consent.azure-apim.net` OAuth callback to continue through Power Platform's HTTPS regional consent subdomains. Chromium applies the authorization page's `form-action` policy across redirects; the previous exact-global-origin policy let the Worker issue a valid authorization code but blocked Microsoft's `global` to `asia-001` handoff before token exchange, leaving Copilot Studio disconnected.
-- Keep the exception narrow: every authorization page still allows only `'self'` and its exact validated redirect origin, and only callbacks already validated on the Microsoft consent domain receive `https://*.consent.azure-apim.net`. Other OAuth clients, CORS rules, redirect binding, PKCE, account authentication, and token validation are unchanged.
-- Add Worker integration coverage for the Copilot Studio CSP and a real headless-Chrome three-stage regression proving that self-only policy blocks the first callback, exact-first-hop policy blocks the regional redirect, and the completed policy preserves `code` and `state` through the two-hop chain.
-
-## 1.1.1 - 2026-07-15
-
-### Windows Worker deployment convergence
-
-- Make Worker health probes use the same standard `HTTP_PROXY`, `HTTPS_PROXY`, and `NO_PROXY` routing model as the relay. The previous direct `fetch` probe could time out on Windows or managed networks after Wrangler had already completed a valid deployment. Restrict probes to the recorded HTTPS `workers.dev` origin and reject redirects so persisted state cannot redirect the verifier to an arbitrary network target.
-- Persist the successful Wrangler deployment URL, content/secret fingerprint, and deployed package version before the secondary health probe. A timeout, proxy failure, TLS failure, network failure, or temporary HTTP 5xx response now stops with corrective guidance and a later start verifies the same Worker instead of uploading it again; only bounded, definitive stale-version/identity evidence triggers automatic same-name redeployment.
-- Prevent accidental Worker proliferation by rejecting a changed `--worker-name` for an initialized workspace unless `--force-worker` explicitly authorizes the replacement. Retain prior names in local inventory so full uninstall can delete intentionally replaced Workers. Add a real local CONNECT-proxy regression, deployment ambiguity/idempotency tests, worker-name replacement tests, expanded CLI/state coverage, and higher critical-module coverage floors.
-
-## 1.1.0 - 2026-07-15
-
-### Claude and Microsoft Copilot Studio remote MCP
-
-- Add hosted-client OAuth interoperability for Claude custom connectors and Microsoft Copilot Studio while preserving the existing Streamable HTTP transport and current MCP protocol contract. Authorization-server and protected-resource discovery now advertise `offline_access` and the refresh-token grant; dynamic client registration declares both authorization-code and refresh-token grants.
-- Issue hashed access and refresh-token records from authorization-code exchange. Public-client refresh requests are form-encoded, bound to the original client/account/version/role/scope/resource, and rotate the refresh token atomically. Reuse, expiry, account changes, or deployment token-version changes return `invalid_grant`. Refresh state uses a separate versioned Durable Object key, so existing primary OAuth state does not require migration. The per-source DCR throttle now counts only registrations that have not completed authorization, preventing legitimate Claude or Copilot reconnections from consuming the abuse quota while retaining the deployment-wide client cap.
-- Exercise the exact hosted Claude callback, the unauthenticated `resource_metadata` challenge, discovery/DCR metadata, refreshed MCP access, refresh replay rejection, and account-targeted refresh revocation in the real Worker integration. Document Claude and Copilot Studio setup, and retain the narrow ChatGPT/Grok browser CORS set because Claude and Copilot Studio connect through cloud-side infrastructure rather than browser-origin response sharing.
-
-## 1.0.8 - 2026-07-14
-
-### Effective account authority reporting
-
-- Separate the authenticated account authority from the local daemon capability ceiling in remote diagnostics. `server_info.authorization.effective_policy` and `effective_tools` are now the authoritative account fields, while `daemon.policy` and `daemon.tools` are explicitly scoped as pre-role ceilings. The response also includes a deterministic authority summary and scope labels so clients cannot reasonably equate an `editor` account with a `full` daemon.
-- Make remote `project_overview` return the role-intersected policy and tools at its existing top-level fields, while preserving the daemon values separately as `daemonPolicy` and `daemonTools`. Add a Worker integration regression that authorizes an `editor` account against a canonical `full` daemon and proves shell/browser tools remain excluded at both reporting surfaces and at relay enforcement.
-- Update MCP initialization guidance, tool descriptions, operations diagnostics, architecture, client, account, testing, and generated tool-reference documentation to use the effective-account fields when diagnosing permissions.
-
-## 1.0.7 - 2026-07-14
-
-### Browser-complete OAuth callback navigation
-
-- Fix the authorization page CSP so a successful same-origin form POST may follow its `303 See Other` to the exact, already registered and validated OAuth redirect origin. The previous static `form-action 'self'` policy let the Worker issue a correct redirect but caused Chromium to block the callback navigation and leave the user on the consent page.
-- Keep the policy narrow: each consent page receives only `'self'` plus that request's exact redirect origin, never a wildcard or scheme-wide allowance. Add a real headless-Chrome negative/positive regression proving the old policy blocks the callback and the new policy preserves `code` and `state`; retain Worker-level CSP, PKCE, redirect/resource, password, and token tests. Invalid credentials now preserve only the non-secret account name and display an accessible error while never reflecting the password.
-
-## 1.0.6 - 2026-07-14
-
-### OAuth navigation origin handling
-
-- Stop treating the browser `Origin` header as an authentication boundary for actual Worker requests. OAuth authorization navigations and form submissions from opaque or client-specific browser containers now reach normal protocol validation instead of failing early with `origin_not_allowed`.
-- Keep CORS response sharing strict: only the Worker origin, the built-in ChatGPT/Grok origins, and exact `MBM_ALLOWED_ORIGINS` additions pass preflight and receive `Access-Control-Allow-Origin`. Unrelated and `null` origins receive no CORS permission, while PKCE, exact redirect/resource binding, account authentication, bearer tokens, and admin/daemon secrets remain authoritative.
-
-## 1.0.5 - 2026-07-14
-
-### Built-in ChatGPT and Grok origins
-
-- Allow the exact first-party browser origins used by ChatGPT (`https://chatgpt.com` and legacy `https://chat.openai.com`) and Grok (`https://grok.com` and `https://x.com`) directly in Worker origin validation. Users no longer need to run Wrangler or edit Cloudflare variables to complete OAuth from those clients.
-- Keep `MBM_ALLOWED_ORIGINS` as an additive exact-origin extension point, preserve same-origin and no-Origin requests, reject unrelated and `null` origins, and apply one predicate to preflight and actual requests. Integration tests exercise every built-in origin alongside a configured custom origin.
-
-## 1.0.4 - 2026-07-14
-
-### Windows first-run workspace
-
-- Keep the first interactive workspace question on Windows, but default it to `%USERPROFILE%\MachineBridge` instead of the Command Prompt current directory. Pressing Enter creates, canonicalizes, and remembers that folder, so users do not need `cd` or directory knowledge and an elevated prompt cannot accidentally select `C:\Windows\System32`.
-- Preserve explicit `--workspace` semantics for automation, while allowing an interactively entered Windows workspace folder to be created when it does not yet exist. The installed zero-argument startup test now verifies the remembered platform default.
-
-## 1.0.3 - 2026-07-14
-
-### Code-scanning and supply-chain integrity
-
-- Fix the SARIF gate so results with omitted rule metadata fail closed instead of being silently classified as non-security. Remove stale broad CodeQL exceptions, harden the generic process boundary with a fixed-option non-shell `child_process.spawn` wrapper and behavior regression, and retain only one exact, expiring false-positive record for that intentional authority boundary.
-- Gate OpenSSF Scorecard SARIF before upload. Replace mutable npm bootstrap commands with an exact npm 12.0.1 tarball plus pinned SHA-512 verification, make the source wrapper use `npm ci`, and convert randomized security properties to a deterministic `fast-check` `.js` suite recognized by the pinned Scorecard scanner, and separate the signed Scorecard analysis job from the failing SARIF gate job required by the action's workflow-verification rules.
-- Record only four expiring Scorecard governance/time exceptions that cannot be repaired by source code alone, reject remediable pinning/fuzzing exceptions, and require exact-commit CI, CodeQL, Governance, and Scorecard success before creating a source release.
-
-## 1.0.2 - 2026-07-14
-
-### Deadline and architecture integrity
-
-- Replace wall-clock arithmetic in startup-lock waits, verified daemon takeover/stop, process-session exit waits, managed-job recovery-lock handoff, full-access diagnostics, browser waits, page actionability/stability checks, application-discovery cache freshness, and local/Worker duration metrics with monotonic elapsed time. System clock rollback can no longer extend these bounded state machines, and a forward correction cannot force premature timeout; persisted expiry and retention timestamps remain wall-clock based.
-- Add deterministic clock-fault regressions at the shared deadline primitive, startup-lock production path, and browser-extension production path, and make the deadline suite a mandatory part of `npm run check`.
-- Correct stale architecture claims after the state-schema-6 and named-account releases: remote tokens are bound to named account principals and roles, duplicate JSON-RPC ids are scoped to one signed MCP session, and application-level account isolation is distinguished from OS/browser tenancy. Architecture tests reject a return to the obsolete statements.
-
-## 1.0.1 - 2026-07-14
-
-### Startup and release-gate reliability
-
-- Fix two production CLI references that were used without imports: `readdirSync` in the default Worker deployment fingerprint path and `inspectProcessInstance` in secret rotation. The former made a freshly installed 1.0.0 package fail immediately on zero-argument startup even though syntax, package, and cross-platform CI checks were green.
-- Fix the Windows Wrangler execution boundary uncovered by the new startup probe. Runtime code no longer passes `wrangler.cmd` to `spawn(..., { shell: false })`, which fails with `EINVAL` on Node 26; it invokes the dependency's declared JavaScript entrypoint through the current Node executable on every platform. A focused regression and the installed startup probe prevent a return to shell shims.
-- Add an ESLint correctness gate over Node production code, tests, scripts, and the packaged browser extension. Undefined identifiers, redeclarations, duplicate keys, unreachable statements, and non-loop constant conditions now fail `npm run check` before packaging or publication. A configuration self-test injects synthetic undefined Node/browser bindings so retaining a no-op or mis-scoped lint script cannot satisfy the gate.
-- Strengthen `install:test` to install the real `npm pack` tarball into an isolated global prefix and execute the installed CLI with zero arguments from a package-free workspace and isolated state root. A cross-platform fake Wrangler shim provides a controlled external boundary; the test requires state initialization, rejects `ReferenceError`/`is not defined`, and proves that default startup reaches Worker orchestration rather than only supporting `--version`.
-- Make both static lint and the installed zero-argument startup probe mandatory parts of the complete local, prepublish, Linux, macOS, and Windows release gate. Architecture checks prevent either gate from being removed silently and now enforce the existing exact-semver dependency policy instead of leaving it as documentation only.
-
-## 1.0.0 - 2026-07-14
-
-### Current-only protocol and runtime contract
-
-- Declare only MCP protocol `2025-11-25` across shared metadata, stdio, the local runtime, daemon handshakes, and the Cloudflare Worker. Older protocol dates are no longer advertised as supported; clients must negotiate the current protocol before invoking tools.
-- Add stateless, HMAC-bound `MCP-Session-Id` issuance. Concurrent chat windows using the same OAuth token now have independent JSON-RPC request-id and cancellation domains; sessionless independent POST requests no longer share a token-wide request-id lock.
-- Make terminal relay delivery fail closed: when a completed daemon call cannot return its `tool_result`, the daemon interrupts the ambiguous socket so Worker socket cleanup releases pending calls immediately instead of retaining a phantom active call until its long timeout.
-- Remove numeric-only managed-job lock interpretation and the remaining dead compatibility branches, unused imports, unreachable conditions, and stale orchestration variables. Current JSON ownership records with process start identity and random tokens are the only accepted lock contract.
-- Keep the current local state schema intact so an existing 0.18.x state root upgrades in place. The source upgrade remains operationally bounded: install the new package, run one normal `machine-mcp` startup to converge Worker and daemon versions, then reload the unpacked browser extension.
-
-### Descriptor-first file and process security
-
-- Centralize regular-file opens behind a no-follow descriptor primitive that validates the opened object, applies permissions through the descriptor, and performs bounded reads without a separate path check. State, privacy scanning, service logs, managed-job diagnostics, and owner-only files now use this boundary.
-- Inspect SSH key pairs from private, bounded snapshots copied into a private temporary directory. Fingerprinting and public/private correspondence no longer operate on mutable caller paths, and the original files are revalidated by identity and constant-time byte comparison before success is returned.
-- Fix managed-job recovery handoff so the recovery runner must remove `recovery.lock` with the exact handed-off PID and ownership token. It can no longer delete a replacement claim by path alone.
-- Separate the internal `runExecutable` argv boundary from explicit shell execution, bound executable/argv sizes, reject NUL bytes, and retain `shell: false` for direct execution. Worker deployment consistency now uses an HMAC fingerprint keyed by deployment secrets rather than an ordinary digest over secret values.
-
-### Enforced security evidence
-
-- Extend classified Windows atomic-replacement retries from 16 to 32 bounded attempts after hosted Windows runners reproduced an `EPERM` sharing window beyond the previous budget. The algorithm still uses one same-directory atomic rename, exponential backoff with jitter, and no delete-destination fallback.
-- Move the repository's local GitHub control-plane prohibition into shared MCP initialization and built-in working agreements so it is visible before project-specific task execution. If local Machine Bridge `git`/`gh` access is unavailable, automation must stop rather than fall back to a hosted GitHub connector or ChatGPT plugin. Align `ENGINEERING.md` and `CONTRIBUTING.md` with the source-release ownership contract.
-- Fail closed when owner-only directories are symlinks, non-directories, cannot be restricted to `0700` on POSIX, or remain group/other-accessible. Extract Worker deployment secret-file lifecycle from the CLI, bind temporary names to process-start identity, delete only positively reclaimable stale files, and surface cleanup failures instead of silently retaining management secrets.
-- Apply the same private-directory boundary to browser pairing, fail managed-job launch when existing diagnostic logs cannot be safely trimmed, and roll back POSIX file/patch commits when exact mode application fails. State-root removal now blocks on unreadable, malformed, symbolic-link, oversized, or otherwise unverifiable config/profile/daemon records instead of treating them as absent.
-- Remove the unused local error factory and default-role constant and make internal-only protocol, pairing, instruction, file, and OAuth helpers non-exported, reducing dead and misleading module surface.
-
-- Add a SARIF security gate to the required CodeQL workflow. Any new security-tagged result fails the required check; intentional high-authority process boundaries require an exact rule/path exception with a substantive rationale and expiry date.
-- Add deterministic property tests over hostile browser-protocol bytes, policy combinations, argv values, and shell-metacharacter arguments. Add production-path service command coverage and remove test-only filesystem check/use patterns that obscured CodeQL results.
-- Preserve the complete cross-platform, Worker, stdio, browser, lifecycle, atomic-file, process-tree, package, privacy-history, dependency, and release-integrity suite as the release gate.
-
-## 0.18.1 - 2026-07-14
-
-### Fixed
-
-- Wait for launchd service state to converge after a successful `bootout` before deciding that stop or restart failed. The bounded poll handles macOS's asynchronous unload window while still failing closed when the service remains active.
-- Add deterministic coverage for delayed launchd inactivity and for the bounded failure path.
-
-## 0.18.0 - 2026-07-14
-
-### Isolated multi-account authorization
-
-- Replace the workspace-wide shared OAuth password with named accounts and four roles: reviewer, editor, operator, and owner. OAuth codes and tokens are bound to one account id, account version, and role; account changes revoke only that account's credentials.
-- Intersect each account role with the connected daemon policy when listing or invoking tools. The Worker rejects unauthorized tools before relay, and every relayed call carries immutable account authorization metadata for a second local enforcement check.
-- Add owner-only account administration for listing, creating, enabling, disabling, changing roles, rotating passwords, and removing accounts. Passwords are generated 256-bit tokens stored as independent salted HMAC-SHA-256 verifiers; arbitrary human-chosen passwords are rejected, plaintext tokens are shown once, and they are not retained in local state.
-- Upgrade the existing Cloudflare Worker and Durable Object in place. A one-time release operation converts the current shared credential into the initial owner account and annotates existing OAuth codes and tokens without changing their keys or the global token version, preserving the existing ChatGPT connector authorization.
-
-### Runtime reliability and diagnostics
-
-- Cancel all relay-owned local calls immediately when the relay disconnects. Process execution now rejects cancellation before a child emits `close`, while process ownership remains tracked until actual exit, preventing permanently active calls without losing process cleanup.
-- Replace prefix-only command capture with bounded beginning-and-end retention. Long stdout and stderr report exact omitted byte counts and preserve the diagnostic tail where test and compiler failures normally appear.
-- Consume rejected authenticated MCP request bodies before returning 401, preventing workerd request-stream exceptions after per-account token revocation.
-
-### Breaking state and maintenance model
-
-- Advance local state to schema 6, the state-root marker to schema 2, and policy to revision 5. Final runtime code accepts only the current formats; valid obsolete state is rejected instead of migrated, while syntactically corrupt JSON is isolated and rebuilt as current empty state.
-- Remove shared-password CLI flags, policy migration branches, old daemon-lock interpretation, numeric managed-job PID compatibility, and old log-format archival. The one-time in-place release operation updates live state and deletes obsolete artifacts before the final runtime is installed.
-
-## 0.17.1 - 2026-07-14
-
-### Installation and first use
-
-- Add an end-to-end installation and first-use guide covering transport selection, authority profiles, prerequisites, released and source installation, first remote deployment, current ChatGPT developer-mode connection, stdio configuration, existing-profile browser pairing, verification, routine operation, multi-workspace use, upgrades, layered troubleshooting, and fail-closed removal.
-- Link the detailed guide from the README while retaining the compact command reference, and clarify how to distinguish package, Cloudflare, daemon, MCP-host, operating-system, and browser failures.
-
-### Multi-client and multi-account boundary
-
-- Document that the existing Worker supports multiple OAuth client registrations and access tokens but does not provide isolated human/service accounts: all successful authorizations use one per-workspace connection password and share the same policy and daemon authority.
-- Define a principal-aware evolution path that keeps OAuth clients separate from principals, memberships, and named grants; uses capability intersection and dual Worker/local enforcement; adds targeted revocation and per-principal quotas; and retains one bridge/Durable Object per workspace or trust domain.
-- Make the security and architecture contracts explicit: mutually untrusted users require separate bridge instances and preferably separate low-privilege OS, container, or VM boundaries because application-level roles cannot isolate local process, shell, browser, or credential-store authority.
-
-## 0.17.0 - 2026-07-13
-
-### Project governance and contribution flow
-
-- Define a risk-based project standard covering GitHub Flow, Conventional Commits, architecture boundaries, MCP contract ownership, testing, errors, logging, supply-chain security, documentation, review, and explicit exceptions. Add pull-request and structured issue templates plus area ownership through CODEOWNERS.
-- Add an executable Conventional Commit policy for pull-request and main-branch commit titles. Keep the repository on squash-based GitHub Flow rather than introducing permanent develop/release branches that do not match its single-maintainer, continuously released operating model.
-- Require all repository-host operations to use local `git`, `gh`, and `gh api` through Machine Bridge. Explicitly prohibit hosted GitHub connectors or ChatGPT GitHub plugins so remote mutations, credentials, refs, checks, and recovery remain observable from one local control plane.
-- Make repository automation responsible for closing the source-change lifecycle: after all required checks pass it squash-merges the pull request, verifies `main`, creates and pushes the annotated version tag, and creates or updates the matching GitHub Release. npm publication, Worker deployment, credentials, global installation, and daemon/service replacement remain separately authorized live operations.
-
-### Generated contracts and security automation
-
-- Generate a complete MCP tool reference from the shared tool catalog and reject stale output in the required suite. The tool catalog remains the single source for names, availability, annotations, and JSON input schemas; REST-specific Swagger documentation is not duplicated for the MCP surface.
-- Add pinned, least-privilege GitHub workflows for CodeQL analysis, pull-request dependency review, OpenSSF Scorecard publication, and governance checks. Preserve exact dependency versions, registry signature/attestation verification, SBOM generation, history privacy scanning, and cross-platform package tests.
-
-### Cohesion, reuse, and runtime reliability
-
-- Extract optional project-metadata reads, strict integer normalization, plain-record validation, and uninstall/service state inventory into focused shared modules. Remove duplicate numeric clamping, record classification, and no-follow UTF-8 metadata readers while preserving the distinct strict validation semantics used by browser/application commands and Agent Context instruction files. Plain-record validation now rejects class instances instead of treating every non-array object as protocol/configuration data.
-- Reduce the CLI entrypoint from 1,169 to 1,063 lines by moving profile, Worker, active-job, and process-lock inventory behind a dedicated boundary. Add direct failure-path tests and enforce 91% function/73% branch coverage for the new inventory module; raise the CLI branch floor from 5% to 10%.
-- Canonicalize existing state roots before profile enumeration, fixing macOS `/var` versus `/private/var` alias mismatches that could make service removal or lock inspection report inconsistent profile paths. Retry only the final daemon-lock handoff after a verified service stop, and keep daemon fixture subprocesses out of V8 coverage so process teardown does not create platform-timing failures.
-- Generate Wrangler environment declarations through a cross-platform script that creates ignored `.wrangler/` state before invoking Wrangler, instead of writing under `src/worker`; packaging tests reject generated type declarations. This removes clean-runner state dependence and reduces the dry-run package from about 410 KB/1.8 MB unpacked to about 314 KB/1.22 MB while retaining every Worker runtime module.
-- Replace repeated empty WebSocket send/close catches in the Worker and browser extension with small module-local best-effort helpers whose comments preserve the primary failure semantics. Architecture checks reject unexplained empty catches on those protocol boundaries.
-
-### Tests and documentation
-
-- Extend architecture checks to require generated tool documentation, governance scripts, security workflows, explicit workflow permissions, immutable Action references, and rejection of privileged pull-request triggers or write-all permissions.
-- Document why aggregate 80% coverage is not a sufficient quality target, identify the current CLI orchestration branch-coverage weakness, and retain per-module risk thresholds plus behavior-level cross-platform, concurrency, fault-injection, and protocol tests.
-
-## 0.16.2 - 2026-07-13
-
-### Fixed
-
-- Package the entire `src/worker` directory (instead of just `src/worker/index.ts`) in the published npm package so that global installations have all files required to compile/deploy the Worker.
-- Add regression coverage in packaging tests to verify all worker modules are present.
-
-## 0.16.1 - 2026-07-13
-
-### Fixed
-
-- Fix `machine-mcp` startup after 0.16.0 by keeping normalized policy capabilities immutable while allowing the sealed CLI-owned state record to update persistence metadata.
-- Add regression coverage proving `updatedAt` remains writable without permitting capability fields or undeclared fields to be mutated.
-
-## 0.16.0 - 2026-07-13
-
-### Runtime boundaries and lifecycle
-
-- Replace the monolithic local tool dispatcher with a middleware-based execution pipeline covering policy authorization, bounded call registration, cancellation/deadlines, stable error normalization, structured lifecycle events, and per-tool metrics. Add explicit runtime lifecycle states and a process tracker so stop/cancel paths release calls and child ownership deterministically.
-- Extract workspace filesystem transactions, process/shell execution, Git operations, CLI option/policy parsing, local resource/browser/job administration, capability ranking, managed-job plan/resource validation, browser extension protocol handling, and browser pairing persistence into focused modules. Add executable line-count and dependency-direction limits so these responsibilities cannot silently return to `LocalRuntime`, the CLI entrypoint, or browser manager.
-- Split the Worker Durable Object into HTTP/CORS boundaries, OAuth state/PKCE helpers, shared policy evaluation, structured errors, pending-call indexing, and observability. Replace the linear pending-call scan with an atomic ID/request-key registry so completed, cancelled, timed-out, send-failed, and disconnected calls clear both indexes before settling; JSON-RPC request IDs can be reused immediately after completion.
-
-### Policy, errors, logging, and observability
-
-- Define policy revision 4 in one shared contract consumed by the local daemon, Worker, generated documentation, tests, and architecture checks. Fix `start_job` to require both write and direct-execution capabilities, keep `cancel_job` write-gated, and expose read-only resource/job inventory to review-mode clients without granting mutation authority.
-- Introduce typed `BridgeError`/Worker errors with allowlisted stable codes and retryability. Centralize legacy error classification at adapters instead of making transports and tests depend on free-form English messages. Unknown programming errors are no longer silently converted into ordinary managed-resource unavailability; a failing timeout callback still settles and clears its pending indexes.
-- Add structured JSON lifecycle logging and in-memory observability for calls, durations, errors, active processes, pending request indexes, daemon candidates, socket transitions, and per-tool outcomes. Autostart services now use warning-level JSON logs by default while foreground output remains human-readable; local and Worker structured-field redaction is behavior-tested.
-
-### Tests, documentation, and audit follow-up
-
-- Add behavior tests for policy parity, compound ACLs, middleware order, runtime lifecycle transitions, process ownership, pending-ID reuse, socket cleanup, Worker/local error serialization, structured log privacy, bilingual capability ranking, and generated policy documentation. Replace brittle source-string and monkeypatched happy-path tests with production-path deadline, process-tree, OAuth/MCP, and resource-reload coverage.
-- Add a critical-module V8 coverage gate with per-module function/branch baselines, rather than a single aggregate percentage that hides weak orchestration coverage. Generate `docs/POLICY_REFERENCE.md` from the shared policy contract and tool catalog; CI rejects stale generated documentation.
-- Correct an extraction defect where a re-exported resource inspector was not locally bound and a broad catch disguised the resulting `ReferenceError` as `resource_unavailable`. File availability now degrades only for classified filesystem conditions; unexpected implementation faults remain visible.
-
-## 0.15.0 - 2026-07-13
-
-### Daily-profile browser verification and protocol safety
-
-- Verify the unpacked extension in the user's ordinary Chrome profile with a localhost-only live smoke test covering the acknowledged protocol handshake, real tab lifecycle, semantic inspection, open Shadow DOM, complex form fill, fixed DevTools text/click input, waits, screenshot capture, and cleanup. `browser status` and loopback health now report extension version/protocol, that Machine Bridge did not launch the browser, and the fact that daily-vs-isolated profile identity is not machine-verifiable.
-- Upgrade the extension protocol to an acknowledged `hello`/`hello_ack` state machine with exact packaged-version, protocol, and capability equality. WebSocket open is no longer treated as authenticated readiness, pairing material is persisted only after a successful capability handshake, failed candidate pairing preserves the prior configuration, pairing-page and broker ports must match, and extension WebSocket origins require a canonical 32-character Chromium extension ID.
-- Prevent duplicate side effects after an ambiguous trusted-input failure. `auto` falls back to DOM only before any DevTools `Input` command starts; after dispatch begins, the operation fails with an explicit unknown-outcome instruction to inspect the page before retrying. Screenshot capture temporarily activates only the requested tab, never focuses its window, and restores the previous active tab unless the user changed it concurrently.
-
-### Bounded page processing and extension architecture
-
-- Apply `max_bytes` and `max_elements` as aggregate request budgets across at most 64 accessible frames. Replace full `outerHTML` construction with a bounded iterative DOM serializer, cap page scans at 100,000 nodes, bound page-controlled metadata/text, cap reusable refs at 10,000 per frame, redact URL userinfo, mark contenteditable secret controls as sensitive, and report frame/node/text/ref truncation explicitly.
-- Report partial multi-field form mutation precisely when a later field or submission fails. Navigation waits now inherit the bounded request deadline rather than using a hidden fixed 30-second timer.
-- Extract tab/page/wait/source/screenshot orchestration into fixed `browser-operations.js`; the Manifest V3 service worker now owns only pairing, transport, acknowledged readiness, cancellation, and response routing. Architecture tests enforce this responsibility boundary.
-
-### Cross-platform audit and regression coverage
-
-- Replace ad-hoc Windows Scheduled Task argument quoting with the Windows CRT-compatible backslash/quote algorithm, including drive-root and trailing-backslash paths.
-- Add behavior tests for handshake readiness, provisional pairing persistence, trusted-input replay prevention, focus restoration, aggregate frame/source budgets, hostile DOM/text bounds, partial form failure, strict extension origins, and Windows command-line quoting. Synchronize architecture, security, operations, testing, audit, and tool documentation.
-
-## 0.14.0 - 2026-07-13
-
-### Windows installation and OAuth callback reliability
-
-- Bootstrap installation through pinned npm 12.0.1 from an empty temporary directory before using `--allow-scripts`, declare the npm 12 requirement in package `engines`, and make `machine-mcp doctor` verify the active npm version. This removes the unsupported old-npm path shown by Windows and gives accurate diagnostics for `Unknown cli config "--allow-scripts"` and legacy `devEngines.node` errors without guessing which package supplied the invalid metadata.
-- Construct OAuth callback destinations with the URL API and return `303 See Other` after consent instead of manually concatenating a `Location` string. Add an end-to-end ChatGPT callback regression with reserved state characters and exact origin/path checks.
-- Extend the isolated install smoke test to require npm 12, install from an empty directory, verify the packaged npm engine requirement, and run the test on Linux, macOS, and Windows CI.
-
-### Existing-profile browser automation
-
-- Keep the authenticated Manifest V3 extension as the primary browser backend so automation operates the user's ordinary Chromium profile, tabs, extensions, cookies, and login state instead of launching a separate profile. Add tab creation/activation/closure and explicit combined waits for URL, document readiness, page text, and element state.
-- Replace fragile inspect-then-selector flows with bounded semantic snapshots containing stable per-document/frame element references, visibility/enabled/editable state, and viewport geometry. Page actions now wait for attachment, visibility, enabled/editable state, geometric stability, and unobscured pointer hit targets; ambiguous selectors and stale references fail explicitly.
-- Add double-click, hover, append-text, and scroll-into-view actions. Top-frame click, double-click, hover, key press, and text input can use fixed short-lived Chromium DevTools Input commands through explicit `auto`, `trusted`, or `dom` modes. The extension exposes no caller-selected CDP method or arbitrary JavaScript and detaches the debugger in `finally`.
-
-### Architecture, security, tests, and documentation
-
-- Extract browser command normalization into a focused local module and isolate trusted input in a fixed extension module. Add a versioned extension capability handshake, stale-build reload guidance, explicit keepalive handling, and replacement validation that preserves the current compatible connection until the candidate is accepted; accepted replacements reject in-flight direct and proxied requests with retry guidance instead of leaving them to time out. Preserve resource-backed secrets/files, strict action/value validation, bounded broker messages, cancellation, source limits, and the existing owner-only pairing model.
-- Add behavior-level tests for command contracts, trusted-input command sequences and cleanup, semantic-ref stability, deterministic scrolling, obscured-target waiting, stale refs, broker routing, catalog parity, and architecture invariants. Update browser setup, permission, security, architecture, testing, and tool documentation.
-
-## 0.13.0 - 2026-07-13
-
-### Automatic capability routing and observability
-
-- Register bounded `package.*` commands from safe root `package.json` script names, while preserving explicit manifest override/deletion and never injecting script bodies. Windows uses a fixed `cmd.exe` wrapper for package-manager shims; Unix keeps direct executable argv. Extend default skill discovery to project `.codex/skills` and unrestricted `CODEX_HOME/skills` compatibility roots.
-- Match installed applications by their actual names for every canonical-full task instead of requiring generic “app/window” words, with a bounded discovery cache to avoid repeated filesystem scans.
-- Normalize a bounded set of common English inflections and Chinese workflow intents before skill/command ranking, and weight capability-name matches above incidental description overlap. This fixes Chinese selection of `skill-creator`, `web-research-cli`, and `skill-installer` and prevents generic “create” wording from preferring unrelated design skills.
-- Record privacy-preserving bootstrap and task-resolution telemetry in `server_info` and `project_overview`: counts, timestamps, source/load flags, selected capability metadata, and a runtime-keyed task fingerprint rather than raw task text. Suppress weak skill-overlap recommendations and clarify that the MCP host still controls whether the resolver and recommended tools are invoked.
-
-### Process and network lifecycle
-
-- Consolidate graceful process-tree termination plus forced escalation. Timeout, cancellation, and replacement now retain the escalation timer after the direct child exits, preventing a SIGTERM-resistant descendant with detached stdio from surviving as an orphan.
-- Add relay support for standard `HTTP_PROXY`, `HTTPS_PROXY`, and `NO_PROXY` routing through a reviewed HTTP(S) proxy agent. Invalid proxy URLs or unsupported proxy protocols fail fast with corrective guidance; status exposes only direct/proxy/invalid route state and never proxy URLs or credentials.
-
-### Architecture, tests, and documentation
-
-- Extract package metadata/command discovery and capability observation into focused modules, add domain-to-adapter import-boundary checks, remove duplicate object fields, and centralize reused metadata parsing.
-- Add behavior-level regression coverage for automatic package commands, direct `.codex/skills` compatibility, capability telemetry privacy, application-cache refresh, proxy selection/failure, and the direct-child-exits-first orphan-process boundary. Synchronize architecture, operations, logging, security, testing, and agent-context documentation.
-
-## 0.12.2 - 2026-07-12
-
-### Cross-platform persistence and browser reliability
-
-- Extend transient Windows atomic replacement from eight short linear retries to sixteen bounded exponential retries with jitter. The implementation continues to use one same-directory atomic rename and never falls back to deleting the destination, while tolerating longer antivirus/indexer/reader sharing windows.
-- Eliminate a broker-test race that could miss the runtime `hello` message between WebSocket `open` and listener registration. Pairing HTTP requests and WebSocket open/message/close waits are now bounded, and failed proxy candidates are terminated so a handshake cannot retain the test process indefinitely.
-
-### CI, release, and supply-chain integrity
-
-- Require a completed successful push-triggered GitHub Actions run for the exact `origin/main` commit before creating or verifying a version tag, GitHub Release, or release asset. A local test pass is necessary but no longer sufficient for publication.
-- Pin all third-party GitHub Actions to immutable commit SHAs, retain Dependabot updates, and enforce the pinning plus the release-CI wiring through architecture and dedicated release-gate tests.
-- Run a reachable-history privacy audit in the package-audit job. The scanner covers historical UTF-8 blob contents, historical paths, and commit messages without printing matched values, while narrowly ignoring the standard public Dependabot signing trailer.
-
-### Regression coverage and audit follow-up
-
-- Add deterministic tests for twelve consecutive transient Windows replacement failures, exponential delay selection, lost browser handshakes, bounded socket waits, portable simulated-Linux launcher paths on Windows, POSIX-versus-Windows daemon-stop semantics, deleted historical credential blobs, public automation trailers, and successful/failed/pending release CI states.
-- Update the architecture, engineering, privacy, testing, release, security, and audit documentation. Record remaining immutable Git-history identity metadata separately from current-tree and active-credential findings.
-
-## 0.12.1 - 2026-07-12
-
-### Real local automation corrections
-
-- Make the fixed macOS JXA helper return JSON as the top-level `osascript` result instead of using `console.log`, which real `osascript` sends to stderr. Empty helper stdout now fails explicitly rather than being interpreted as a successful empty object.
-- Skip recursive macOS menu-bar/menu traversal by default so bounded inspection reaches main-window controls promptly. Add `include_menus` to inspection and actions for explicit menu automation.
-- Normalize hyphens, underscores, dots, and spaces during capability ranking, and strongly boost explicitly named skills and commands. Natural-language references such as `agents progressive disclosure` now select `agents-progressive-disclosure` instead of a generic competing skill.
-
-### Live verification and regression coverage
-
-- Add regression coverage for missing JXA output, menu-recursion forwarding, and punctuation-normalized Skill selection. Add an opt-in real macOS Calculator smoke path and document isolated-profile MV3 browser validation.
-- Validate the source runtime with a temporary real global instruction file, an existing user Skill, a registered direct-argv command, shell execution, Calculator discovery/open/activation/inspection/click, and a real unpacked browser extension controlling a local form through inspect/fill/click/source/screenshot operations. Test files, browser profiles, temporary global configuration, tabs, and application state are removed afterward.
-
-## 0.12.0 - 2026-07-12
-
-### Locking, persistence, and process lifecycle
-
-- Replace partial-write-prone final-path lock creation with fully written, flushed temporary files and atomic same-directory hard-link claims. Record ownership tokens and process start times, detect PID reuse, verify file identity before stale-lock removal, preserve recent malformed locks, and add bounded startup-lock waiting.
-- Add a state-root maintenance lock for full uninstall, including checks in already constructed managed-job and browser managers. State roots must be disjoint from selected workspaces, including non-existent paths beneath canonicalized platform aliases; unreadable locks/jobs and ambiguous process identities now block destructive cleanup rather than being treated as inactive.
-- Consolidate owner-only state, managed-job, runner, browser-pairing, and service-definition commits on one flushed atomic replacement primitive. Only successfully read invalid JSON is backed up; permission, symbolic-link, size, invalid UTF-8, and I/O failures propagate without silently reconstructing empty state.
-- Persist managed-job runner process identity, protect transition/recovery locks with token and file-snapshot checks, hand recovery ownership to the runner without an unconditional delete, and keep timeout/cancellation escalation alive until resistant descendant process trees are terminated.
-
-### Services, uninstall, and cross-platform behavior
-
-- Extract one fail-closed service lifecycle: stop the platform service, stop every verified workspace daemon, and remove the service definition only after all stop phases succeed. Full uninstall scans every profile and rechecks managed jobs and process locks while holding maintenance ownership.
-- Normalize launchd, systemd user services, and Windows Scheduled Tasks to a common success/failure contract so non-zero Linux/Windows stop results cannot be mistaken for success. Preserve service definitions and local state whenever stop, verification, definition removal, or remote Worker discovery is incomplete.
-- Make CLI helper timeouts terminate process groups/trees rather than only direct children, including forced escalation for descendants that ignore graceful termination.
-
-### Security, privacy, and local automation
-
-- Expand repository privacy and log redaction coverage for npm authentication, common cloud/source-control/chat/payment tokens, JWT-shaped values, embedded-credential URLs, broader private-key headers, credential-shaped filenames, and non-example identities. Scanner read/traversal failures now fail closed without echoing matched values.
-- Add final-component no-follow reads in restricted filesystem paths, reject NUL application action values, and normalize browser-upload filenames and MIME types to prevent deceptive metadata or downstream form parsing ambiguity.
-- Close authenticated browser broker sockets with protocol-specific WebSocket codes for oversized, invalid UTF-8/JSON, or structurally invalid messages instead of silently retaining faulty clients.
-
-### Tests, architecture, and documentation
-
-- Replace the hand-maintained JavaScript syntax list with recursive entrypoint discovery; remove stale imports and duplicated lifecycle logic. Add executable concurrency, atomicity, PID-reuse, service-failure, process-tree, state-corruption, unsafe-root, unreadable-job, browser-protocol, upload-metadata, and privacy regression tests.
-- Add `docs/AUDIT.md` and synchronize architecture, security, operations, logging, privacy, managed-job, local-automation, testing, contribution, and release documentation with the implemented fail-closed behavior and residual OS-level limitations.
-
-## 0.11.1 - 2026-07-12
-
-### Reliable macOS service and orphan-daemon takeover
-
-- Stop launchd jobs by their loaded service target first, with the plist form retained as a compatibility fallback. Treat an already-unloaded job as an idempotent success, verify the post-stop state before reporting success, and prevent `service start` or `service uninstall` from continuing when the existing job remains active.
-- Detect legacy daemon locks that predate mode/version metadata by inspecting the live process command line. A process is eligible for takeover only when its PID, daemon purpose, canonical workspace, canonical state root, entrypoint, and `--daemon-only` arguments all match. Foreground or unverifiable processes are never signalled.
-- Let normal foreground startup and `machine-mcp service stop` terminate a verified detached/orphan service daemon with `SIGTERM`, wait for the actual PID as well as the lock to disappear, reclaim stale locks through the normal token-aware primitive, and fail with a bounded timeout rather than escalating to a forced kill.
-- Extend `machine-mcp service status` to report platform-service state and workspace-daemon state separately, including whether a live legacy process was verified as service-style. This makes a launchd-unloaded but still-running daemon visible instead of presenting a misleading inactive-only status.
-
-### Tests and documentation
-
-- Add real child-process regression coverage for legacy orphan takeover, canonical `/var` versus `/private/var` path aliases, foreground-process protection, non-forcing timeout behavior, launchd service-target generation, and packaged daemon-process module presence. Update upgrade and recovery guidance for the exact npm install command and split service/daemon diagnosis.
-
-## 0.11.0 - 2026-07-12
-
-### Zero-configuration agent working agreements
-
-- Add a package-controlled `machine-bridge://defaults/working-agreements` instruction layer so every stdio and remote MCP session starts with conservative, auditable guidance even when the user and repository provide no `MODEL.md`, `AGENTS.md`, or manifest. The baseline covers inspect-before-editing, minimal coherent changes, preservation of unrelated work, existing-toolchain reuse, tests/documentation synchronization, honest validation reporting, secret handling, safe Git practice, and explicit authorization for publication, deployment, credential rotation, live-data mutation, system-wide installation, and destructive operations.
-- Keep the baseline lower precedence than explicit user and root-to-target project instructions. Expose its source, size, hash, precedence, and optional content through `session_bootstrap`, `agent_context`, and `resolve_task_capabilities`; include its hash in live capability fingerprints. The defaults are behavioral guidance rather than a replacement for Machine Bridge policy, host approvals, operating-system permissions, hooks, sandboxes, or external isolation.
-
-### Bounded automatic project context
-
-- Add `machine-bridge://project-context/current`, regenerated on every relevant context scan from bounded repository metadata: target-relative path, recognized project/build entry files, JavaScript package-manager and lockfile facts, package script names, runtime constraints/version hints, common documentation files, and CI entrypoint filenames. The scanner executes nothing, writes no user or repository files, omits script bodies, dependency values, source/document contents, absolute home paths, and command output, and never claims a declared command was validated.
-- Harden repository-controlled metadata with strict character/count/byte limits, no-follow regular-file reads, safe workflow-name filtering, independent 16 KiB output bounds, and conservative skipping of symbolic links, invalid UTF-8, oversized files, permission failures, and transient metadata races. Add user-global `builtin_instructions` and `automatic_project_context` boolean opt-outs; project manifests cannot disable the user's baseline controls.
-
-### Documentation and verification
-
-- Document the default instruction model, precedence, opt-outs, privacy data surface, security boundary, recommended `AGENTS.md` content, progressive disclosure, and official cross-agent best-practice sources. Update repository automation guidance, shared MCP tool descriptions, initialization instructions, architecture, clients, logging, privacy, security, testing, and package contents.
-- Add regression coverage for no-file defaults, initialization injection over stdio, automatic project refresh/fingerprints, package-manager/lockfile/script/CI discovery, script-body non-disclosure, hostile metadata filtering, global opt-out, project opt-out rejection, precedence, and packaged-module presence.
-
-## 0.10.1 - 2026-07-12
-
-### Foreground startup and upgrade takeover
-
-- Make a normal `machine-mcp` start reliably take over from an active platform autostart daemon: detect whether the service is active, request shutdown, wait up to 15 seconds for the workspace daemon lock to be released, and then continue foreground startup with the newly installed CLI. A failed bounded takeover now exits with explicit `service stop`/`service status` recovery guidance instead of silently leaving the old process in place.
-- Record foreground/background mode and package version in new daemon locks. A genuine lock conflict now identifies the running mode/version when known, explains how to stop it, and no longer prints the misleading `[ok] ready` block when no restart or requested change occurred. Service-style duplicate starts remain silent idempotent successes.
-
-### Global instructions and operator guidance
-
-- Add copy-paste setup instructions for `~/.config/machine-bridge-mcp/agent.json` and the global `MODEL.md`, explain global-versus-project precedence, live rescanning, and when a new MCP conversation/reconnection is needed for initialization-time injection.
-- Document the foreground/background distinction, safe global upgrade sequence, owner-only instruction-file permissions, background log locations, and the exact optional-dependency install command that avoids the development-only `fsevents` warning.
-
-## 0.10.0 - 2026-07-12
-
-### Session context and capability selection
-
-- Add a global `model_instructions_file` in `~/.config/machine-bridge-mcp/agent.json`. Stdio and remote MCP initialization append the bounded user-designated instructions when the local runtime is reachable; `session_bootstrap` exposes the same content explicitly. Project manifests cannot override the global file.
-- Add `resolve_task_capabilities`, which rescans effective instructions, filesystem skills, and registered commands for every task, returns a refresh fingerprint, ranks relevant capabilities, optionally loads the best skill, and recommends application/browser/file/Git/process tools. Newly added or edited skills are visible without daemon restart or dynamic MCP tool registration. Multilingual tokenization avoids weak single-character Chinese overlap when automatically selecting a skill.
-- Preserve the host boundary: Machine Bridge automates discovery, refresh, ranking, and progressive loading, while the ChatGPT/MCP host still decides whether a tool is exposed, approved, or invoked.
-
-### Existing-profile browser and local applications
-
-- Add a packaged Manifest V3 Chromium extension and authenticated loopback machine broker for the user's existing browser profile, windows, tabs, cookies, extensions, and login state. Multiple workspace or stdio runtimes share one extension connection through authenticated broker clients.
-- Add structured browser tools for tab listing, current DOM source, frame-aware and open-Shadow-DOM interactive-element inspection, navigation/actions, complex multi-field forms, visible screenshots, and resource-backed file inputs. Page operations run through a fixed packaged module injected into the target frame rather than caller-provided or service-worker-closure code. Registered local resources can provide sensitive field text or upload bytes without returning those values through MCP results.
-- Add installed-application discovery/opening and structured macOS Accessibility inspection/actions. The implementation uses fixed JXA code and does not accept caller-supplied JavaScript, AppleScript, JXA, or browser-extension source. Application paths are normalized to process names, selector indices apply to filtered matches, Linux desktop launchers use `gio launch`, Windows discovery prioritizes Start Menu launchers, and secure Accessibility fields never return values.
-- Add `machine-mcp browser status|setup|pair|path` for one-time unpacked-extension setup and diagnosis. Pairing tokens remain in owner-only state and non-cacheable loopback HTML rather than MCP output, browser URL fragments, or operational logs. Established pairing is replacement-locked and requires a browser-action click on the active local pairing page before switching broker state. The extension badge reports connection state and its action opens the saved pairing page; signed browser-store packaging is the intended mass-market distribution path.
-
-### Architecture, security, and verification
-
-- Split agent context, application automation, and browser broker into dedicated local domain modules while retaining one static catalog shared by Worker and stdio. Bound Worker initialization bootstrap to a short failure-tolerant daemon call.
-- Add loopback Host validation, extension-origin checks, authenticated extension/runtime WebSocket subprotocols, bounded messages/concurrency/source/forms/uploads, proxy timeout/cancellation cleanup, restricted-page handling, secret/value/result non-disclosure, and full-profile gating. Treat the owner-only browser pairing file as a recognized state-root entry so safe uninstall remains available.
-- Extend version synchronization to the browser-extension manifest and add broker owner/client proxy, pairing-token, resource-upload, stdio initialization, live skill refresh, and remote initialization regression coverage. Update architecture, security, operations, logging, privacy, testing, client, release, and user documentation.
-
-## 0.9.0 - 2026-07-12
-
-### Agent context and local workflows
-
-- Add `agent_context`, a bounded bootstrap tool with Codex-compatible instruction precedence: unrestricted `CODEX_HOME`/`~/.codex` guidance, then project root-to-target scopes, selecting the first non-empty `AGENTS.override.md` or `AGENTS.md` candidate per directory under a default 32 KiB combined budget. Add hierarchical `.machine-bridge/agent.json` manifests plus an optional unrestricted user manifest at `~/.config/machine-bridge-mcp/agent.json` for custom candidate priority and bounds.
-- Add `list_local_skills` and `load_local_skill` with Codex-style progressive disclosure. Default discovery scans target-to-root `.agents/skills`, unrestricted user/admin roots, and canonicalized symlinked skill directories; invalid metadata is skipped with bounded warnings. Skill loading returns instructions and a relative file inventory without implicitly executing scripts.
-- Add `list_local_commands` and direct-argv `run_local_command`. Nearest manifests can override or remove inherited commands, caller arguments require manifest opt-in, and callers cannot increase the manifest timeout ceiling.
-
-### Architecture, security, and tests
-
-- Extract agent discovery into `AgentContextManager` rather than expanding transport or runtime dispatch responsibilities. Keep a static MCP catalog across Worker and stdio transports so host-side caching and filtering do not require dynamic per-skill tools.
-- Reject escaping instruction/config paths, unknown manifest fields, out-of-policy skill symlink targets, symbolic-link skill entrypoints, ambiguous skill names, oversized content/argv, and execution attempts under non-execution profiles. Document that repository instructions and skills are untrusted content and that registered commands are convenience aliases, not a sandbox or approval boundary.
-- Add regression coverage for global/project override selection, empty-candidate fallback, custom priority, instruction-byte ceilings, target-to-root skill discovery, symlinked skill folders, invalid metadata warnings, command override/removal, literal argument handling without shell parsing, timeout ceilings, path escape denial, and execution-profile denial. Update server instructions, architecture, security, testing, and operator documentation for the new bootstrap workflow.
-
-## 0.8.2 - 2026-07-11
-
-### Relay reliability and protocol correctness
-
-- Add a deadline for WebSocket connection establishment so a transport stuck in `CONNECTING` cannot freeze automatic reconnection indefinitely. Sustained-outage reminders now run on an independent exponential-backoff timer capped at 15 minutes instead of appearing only when another reconnect event happens.
-- Handle Worker `{type:"error"}` messages explicitly. A daemon hello timeout is classified as transient and retried; unknown protocol errors, duplicate hello messages, identity/version mismatch, and authentication rejection terminate with actionable guidance instead of becoming an `unknown websocket message` warning.
-- Validate daemon WebSocket JSON as a non-array object before field access. Invalid JSON closes with code 1007, non-object/unknown/duplicate protocol messages close with code 1002, and active daemon replacement semantics remain unchanged.
-
-### Logging, tests, and documentation
-
-- Replace default outage/recovery JSON field dumps with readable duration, attempt, cause, automatic-recovery, and long-outage action text. Exact seconds, error classes, retry delays, and raw transport details remain debug-only. Advance the autostart log schema so historical 0.8.1-format lines are separated into the bounded owner-only legacy snapshot. Treat a service-style daemon-only start that finds the workspace daemon already running as a silent idempotent success, preventing repeated lock warnings and duplicate readiness output from accumulating in service logs.
-- Add deterministic tests for stalled connection attempts, autonomous reminder backoff, retryable versus fatal relay error messages, close-reason classification, and runtime control-message routing. Extend live Worker integration coverage to invalid JSON, non-object messages, duplicate hello, and unknown authenticated messages. Enable TypeScript unused-local and unused-parameter checks to prevent dead Worker code from accumulating.
-- Update architecture, operations, logging, testing, and README guidance to match the implemented state machine and operator-facing behavior. Add a repository automation contract separating code/test/commit/push work from npm publication, global CLI installation, Worker deployment, credential rotation, and daemon/service operations; the owner performs those live release steps explicitly. Improve release-check diagnostics so a missing local or remote version tag is reported distinctly from a tag pointing at the wrong commit, with the required `release:publish` step named directly.
-
-## 0.8.1 - 2026-07-11
-
-### Fixed
-
-- Recognize and validate the Worker's pre-handshake `welcome` control message instead of reporting it as an unknown WebSocket warning. A valid welcome remains debug-only and does not imply authenticated readiness; identity or version mismatch still fails immediately.
-- Add a versioned autostart-log schema migration. On the first daemon start after this logging-format change, bounded prior logs are copied to owner-only `daemon.*.legacy.log` snapshots and the active logs are cleared, preventing historical raw close-code lines from appearing to be current behavior.
-
-### Tests and documentation
-
-- Add relay/runtime regression coverage for valid welcome handling and welcome metadata validation, plus service tests for one-time bounded legacy-log migration and schema-marker idempotence.
-- Record the protocol producer/consumer contract rule and document how current and legacy daemon logs are separated.
-
-## 0.8.0 - 2026-07-11
-
-### Architecture
-
-- Rename the transport-independent tool engine from `LocalDaemon`/`daemon.mjs` to `LocalRuntime`/`runtime.mjs`, reserving daemon terminology for the background process and relay attachment.
-- Extract authenticated WebSocket lifecycle into `relay-connection.mjs`, separating transport state, handshake readiness, heartbeat liveness, reconnect backoff, and outage observability from local file/Git/process execution.
-- Add `docs/ENGINEERING.md` as the normative record for product invariants, architectural boundaries, logging semantics, resilience, testing, documentation, and public-versus-local project knowledge. Record the owner-required default `full` profile as an explicit invariant.
-
-### Logging and operator experience
-
-- Replace raw default-level relay close output such as `{"code":1006,"reason":""}` with a state-transition policy: brief self-healing interruptions are debug-only, sustained outages produce one rate-limited actionable warning, and recovery produces one duration/attempt summary.
-- Keep WebSocket close codes, reason strings, retry delays, heartbeat details, and brief recoveries at debug level. Expand coarse operational error classification for network and authentication failures; treat authentication and relay identity/version mismatch as immediate actionable fatal errors rather than retryable network outages.
-- Add an ignored `.project-local/` area for machine-specific maintenance notes while keeping reusable decisions in tracked documentation and credentials out of both.
-
-### Reliability and correctness
-
-- Treat a WebSocket `open` event only as transport availability; authenticated relay readiness now requires `hello_ack`. Remove the startup path that printed `Remote MCP bridge is ready` after a timeout even when authentication had not completed.
-- Terminate and retry candidates that do not acknowledge the daemon handshake, detect silent half-open connections through inbound heartbeat timeouts, and preserve bounded exponential reconnect backoff.
-- Handle Cloudflare Durable Object `webSocketError` as well as `webSocketClose`, immediately rejecting pending calls bound to the failed socket through one idempotent cleanup path.
-- Consolidate managed-job transition/recovery locking into one stale-PID-aware primitive and manager/runner regular-file reads into one no-follow bounded helper, with direct regression tests.
-- Replace mechanical runtime/CLI switch and conditional routing with catalog-checked handler tables and named command phases while preserving explicit patch, runner, and recovery state machines.
-- Replace technical Worker health warning details at default level with a user-facing reason while retaining the raw health code at debug.
-
-### Installation, tests, and documentation
-
-- Use the empirically verified npm 12 global install command with `--omit=optional` and the reviewed `esbuild,workerd,sharp,fsevents` script names. Add an isolated tarball/global-install smoke test that rejects blocked-script warnings, verifies `fsevents` is absent from the installed runtime, and executes the installed CLI.
-- Add deterministic relay lifecycle tests for authenticated readiness, brief-interruption suppression, persistent-outage escalation, recovery summaries, handshake/heartbeat timeout, transport construction/error paths, supersession, acknowledgement identity/version mismatch, and close-code classification. Add architecture/documentation regression checks for module cycles, obsolete naming, broken links, invisible ASCII controls, and retained engineering invariants.
-- Update architecture, operations, logging, privacy, testing, contribution, README, and CLI guidance to match the implemented behavior.
-
-## 0.7.1 - 2026-07-11
-
-### Fixed
-
-- Persist a sanitized absolute-only command `PATH` in launchd and systemd service definitions, always including the stable Node and CLI directories plus platform defaults. This restores Homebrew/npm/git command resolution for background canonical `full` daemons without accepting empty or relative PATH entries.
-- Align `doctor` with the declared sole runtime baseline by requiring Node.js 26 instead of reporting Node.js 22-25 as supported.
-
-### Tests and documentation
-
-- Add service-definition regression tests for PATH preservation, duplicate removal, relative-entry rejection, and launchd/systemd emission; document why `machine-mcp service install` should be rerun after PATH layout changes.
-
-## 0.7.0 - 2026-07-11
-
-### Runtime and dependencies
-
-- Raise the sole supported runtime baseline to Node.js 26 and npm 12, add exact local version files and strict engine checks, update Node type definitions to 26.1.1, and run the cross-platform CI suite on Node 26, and disable setup-node's automatic package-manager cache, and bootstrap npm 12 outside the repository before strict project engine checks apply.
-- Confirm Wrangler 4.110.0, ws 8.21.0, and TypeScript 7.0.2 are current; retain exact reviewed dependency versions and zero known audit findings.
-- Accept both legacy array and npm 12 keyed-object `npm pack --json` metadata, invoke the active npm CLI through Node on Windows, keep generated CI SBOM files outside the repository privacy/publication surface, and retry only classified transient GitHub network failures with Git forced to HTTP/1.1. Release creation verifies server state after an ambiguous response before proceeding.
-
-### Security and privacy
-
-- Replace private environment-derived aliases in public examples with synthetic identifiers and add a repository privacy gate covering tracked and unignored new files, file names, common credential forms, local home paths, SSH host identifiers, and an ignored machine-specific denylist without echoing matched values. Reject publication-surface symbolic links instead of following their targets.
-- Hide local resource and generated-key paths by default; require explicit `--show-paths` or `expose_paths=true`, return only bare SSH fingerprints, and broaden operational-log redaction for paths, email addresses, token forms, key headers, and Unicode display controls.
-- Separate unrestricted filesystem access from absolute-path display, dynamically redact requested external paths from tool errors, harden autostart files/logs against permissive modes and symbolic links, canonicalize OAuth redirect URIs, and remove bidirectional/zero-width controls from authorization-page display text.
-
-### Correctness and durability
-
-- Verify staged managed-job hashes during inspection, approval, and runner startup; serialize approve/cancel transitions and reclaim stale transition/recovery locks even after PID reuse; reject direct execution of unapproved staged plans; remove stale runner claims during recovery; and redact registered-resource source-path aliases from retained output.
-- Clear delayed force-kill timers after process exit, enforce the stdio line limit during incremental reads, reject oversized local WebSocket payloads before string conversion, reject ID-less `tools/call` notifications instead of silently executing them, and accept actual collision-suffixed corrupt-config backups during guarded state removal.
-- Make autostart prefer a stable PATH alias that resolves to the active Node executable instead of a versioned package-manager Cellar path, preventing minor Node upgrades from leaving launchd/systemd definitions pointing at removed binaries.
-- Open and trim managed-job runner diagnostic logs through no-follow file descriptors, rejecting symbolic-link targets instead of following them.
-
-### Release governance and diagnostics
-
-- Add a release-impact gate requiring a newer package version and matching CHANGELOG section for every tracked or nonignored repository change after the latest version tag. Document that reviewed changes must be pushed to GitHub and followed by a matching npm release.
-- Clarify in `server_info`, runtime diagnostics, and operations documentation that canonical `full` controls the local daemon and relay catalog only. A connector host can expose a smaller subset, and that host-side subset is not observable or overrideable by Machine Bridge.
-
-### Tests and documentation
-
-- Add regression coverage for privacy scanning of new files, clean/parseable package manifests and sensitive-artifact exclusion, default path omission and explicit disclosure, hidden unrestricted paths, plan tampering, direct staged-runner invocation, transition locks, source-path redaction, symlink log targets, corrupt-state cleanup, Unicode authorization spoofing, oversized stdio recovery, ID-less tool calls, and comment-free SSH fingerprints.
-- Make release packaging resilient to lifecycle output by using silent JSON mode, and document repository privacy incident response, immutable history/package limitations, explicit path disclosure, plan integrity enforcement, same-user filesystem race residuals, and privacy checks in the release process.
-
-## 0.6.2 - 2026-07-10
-
-### Fixed
-
-- Retry atomic JSON file replacement with bounded backoff for transient Windows sharing failures (`EPERM`, `EACCES`, `EBUSY`, and `ENOTEMPTY`). State, managed-job manager, and detached runner commits now use one shared implementation.
-- Prevent an intermittent Windows `runner_failed` result caused by a transient status-file replacement failure after the same commit had passed the protected pull-request checks.
-- Preserve immediate failure for non-transient filesystem errors and keep temporary-file cleanup behavior unchanged.
-- Restore corrupt-state backup creation through the shared replacement primitive, add collision-resistant backup names, and verify that recovery preserves the original corrupt bytes.
-
-### Tests and diagnostics
-
-- Add deterministic injected transient/non-transient atomic replacement tests.
-- Run the full real-machine sandbox three consecutive times on Windows, exercising repeated detached runner, status, result, and finally-step commits.
-- Include managed-job error and cleanup classifications in `full-test` output when a lifecycle check fails.
-
-## 0.6.1 - 2026-07-10
-
-### Full-profile contract and operator workflows
-
-- Make named profiles canonical capability contracts. A stored `full` label is repaired to writes, shell execution, unrestricted paths, full parent environment, absolute path output, and the complete tool catalog; deliberate individual overrides remain `custom`. Advance the policy revision to 3 and expose the contract in `server_info` and `doctor`.
-- Add `machine-mcp full-test`, a real local-machine acceptance suite using disposable directories. It verifies outside-workspace I/O, direct and shell execution, parent-environment inheritance, SSH key generation, sandbox `authorized_keys`, SSH client parsing, Google OS Login command availability, a non-mutating sudo probe, and detached finally cleanup without changing cloud or remote state.
-- Add `machine-mcp resource generate-ssh-key NAME [PATH]` and the canonical-full-only MCP tool `generate_ssh_key_resource`. Both generate or reuse an Ed25519 pair locally, register the private file as a resource, and return only paths, modes, key type, and public fingerprint.
-
-### Logging
-
-- Remove every ordinary per-tool event from default `info`/`warn` logs. Starts, successes, failures, cancellations, durations, slow calls, tool names, coarse outcome classes, and call correlation are now debug-only in both remote daemon and stdio transports.
-- Keep default logs focused on deployment, connection, protocol, relay, service, and infrastructure health. Tool arguments, command text, inputs, outputs, and results remain omitted at all levels.
-
-### Security, correctness, and portability
-
-- Verify that an existing SSH public key matches its private key and that the private key is usable non-interactively before reuse. Reject incomplete pairs and symbolic links, enforce owner-only private modes where supported, and never return private bytes.
-- Fix the previously untested RSA key-generation argument order and add real RSA coverage.
-- Centralize CLI and MCP key generation/registration in one locked state transaction. Roll back a newly created pair if state persistence fails, handle canonical path aliases, and reapply permissions after cross-filesystem installation.
-- Validate the resource state layout before deriving its root and restrict the MCP key generator to the complete canonical `full` profile.
-- Avoid reading user SSH configuration during `full-test`, canonicalize temporary path aliases, and report sudo/cloud prerequisites separately from core Machine Bridge capability.
-
-### Tests and documentation
-
-- Add real Ed25519/RSA generation, reuse, mismatch, incomplete-pair, symlink, mode, private-content, CLI, stdio, Worker-policy, and real-machine full-profile regression coverage.
-- Update logging, architecture, operations, client, managed-job, security, and testing documentation to match the canonical-full and debug-only per-tool event contracts.
-
-## 0.6.0 - 2026-07-10
-
-### Added
-
-- Add `diagnose_runtime`, a fixed-input layered diagnostic that distinguishes requests reaching the daemon from Machine Bridge policy, local filesystem, process-spawn, shell, managed-job storage, and registered-resource failures. `machine-mcp doctor` runs the same local probes.
-- Add operator-registered local file resources. Credentials and other local-only files can be referenced by alias and injected into managed steps through a private copied path, stdin, or an environment variable without sending file contents or source paths through MCP.
-- Add durable managed jobs with ordered argv steps, bounded output, job-scoped temporary files, detached execution, cancellation, idempotent `finally_steps`, dead-runner detection, bounded recovery, and local CLI inspection/cancellation.
-- Add two-phase handoff: `stage_job` persists a validated non-running plan for operator review, and `machine-mcp job approve JOB_ID` provides explicit local authorization when a host blocks execution-class tools.
-- Add a local JSON fallback with `machine-mcp job submit plan.json` for situations where the MCP host cannot deliver an execution request.
-
-### Security and privacy
-
-- Keep resource values out of MCP plans and results. Referenced files are reopened, bounded, hashed at acceptance, verified before use, copied with owner-only permissions, and removed after cleanup.
-- Redact exact resource paths, exact UTF-8 values, and bounded exact base64/hex forms from retained output. Add `capture_output: "discard"` for credential-consuming commands where output must not be retained.
-- Delete active job plans, runner PID files, temporary helper contents, argv, stdin, environment overrides, resource source paths, and hashes after terminal commit. Retain only bounded status/redacted results for up to seven days and 50 jobs.
-- Enforce canonical managed-job cwd containment in restricted profiles, bounded per-job resources/temporary files/output, no-follow plan/resource reads, owner-only job state, bounded runner diagnostics, recovery mutual exclusion, and a three-attempt automatic recovery limit.
-- Refuse uninstall while detached jobs remain active. Later profile changes affect new submissions; accepted running jobs require explicit cancellation.
-- Clarify that managed jobs are durability and local-authorization mechanisms, not a bypass for MCP-host, operating-system, or endpoint-security policy.
-
-### Operations and tests
-
-- Add local resource commands: `resource add`, `list`, `check`, and `remove`.
-- Add local managed-job commands: `job submit`, `inspect`, `approve`, `list`, `read`, and `cancel`. Approval is interactive by default; `--yes` is required for non-interactive JSON approval.
-- Add state schema version 5 for resource registry metadata while redacting resource source paths from normal status output.
-- Add regression coverage for staging/approval/cancel-before-start, stdio disconnect survival, resource replacement races and output redaction, job-scoped helper cleanup, failure/timeout/cancellation finally paths, concurrent recovery, corrupt plans, output budgets, local CLI fallback, uninstall refusal, and cross-profile tool exposure.
-- Add a dedicated managed-jobs/resource operations and threat-model guide.
-
-## 0.5.0 - 2026-07-10
-
-### Changed
-
-- Replace routine per-tool success chatter with explicit log levels. Foreground mode defaults to `info`, autostart uses `warn`, fast successful calls are debug-only, and successful calls over 30 seconds remain visible as slow-call events. `--verbose` maps to `debug`; `--quiet` maps to `error`; `--log-level` accepts `error`, `warn`, `info`, or `debug`.
-- Record policy origin and revision in state and daemon metadata. The exact legacy implicit-default policy shape is migrated once to the current maximum-permission `full` profile, while explicit named profiles and identified custom policies are preserved.
-- Redact JSON connection credentials and standalone secret-rotation output by default. Printing the client connection password now requires the explicit reconnect flag; the daemon secret is never printed in full.
-- Centralize server name, MCP protocol versions, and instructions in shared metadata consumed by both Worker and local transports.
-- Reject obsolete removed-local-API flags instead of silently accepting them.
-
-### Security and privacy
-
-- Upgrade and pin `ws` to 8.21.0 to address current memory-disclosure and denial-of-service advisories; pin the reviewed Wrangler runtime version.
-- Bind text, image, and search reads to an opened file handle, enforce limits against that handle, and avoid `stat`/read growth races.
-- Bound state, configuration, marker, lock, service-command, log-message, and structured-log sizes. Reject symbolic-link state files, use no-follow reads where supported, and make service-log tail trimming UTF-8 and line safe.
-- Remove stale temporary Worker secret files when their owner process is gone, not only after an age threshold.
-- Document and expose that Machine Bridge has no sensitive-filename blacklist. Local `full` permits any OS-readable UTF-8 regular file, but cannot override operating-system or independent MCP-host/platform policy.
-
-### Tests and operations
-
-- Add regression coverage for legacy policy migration, sensitive-looking files outside the workspace, inherited full-profile environment, default daemon/stdio log suppression, log bounding, state write bounds, service warning-level configuration, and shared metadata drift.
-- Audit both complete and production-only dependency graphs in GitHub Actions.
-- Document npm's scoped install-script approval for Wrangler native dependencies and add a dedicated logging/observability reference.
-
-## 0.4.2 - 2026-07-10
-
-### Fixed
-
-- Canonicalize the configured workspace and requested targets through the same asynchronous `realpath` path on Windows, while retaining a native synchronous initial value. This prevents Windows short-path/long-path aliases for the same temporary directory from being misclassified as a workspace escape.
-- Keep workspace confinement unchanged: only the representation comparison changed, and targets outside the canonical workspace remain rejected in restricted profiles.
-
-### Verification
-
-- Preserve the existing cross-platform path-boundary regression, which exposed the issue on the Windows GitHub Actions runner while Linux and macOS passed.
-- Make the minimal-environment shell regression use a cross-platform Node command instead of POSIX parameter-expansion syntax under PowerShell.
-- Convert test entry-point file URLs with `fileURLToPath()` so Windows does not interpret `/D:/...` URL paths as `C:\D:\...` filesystem paths.
-- Launch Wrangler's JavaScript entry point through the active Node executable in integration tests instead of directly spawning the Windows `.cmd` shim.
-
-## 0.4.1 - 2026-07-10
-
-### Changed
-
-- Make `full` the default policy for newly selected workspaces and generated client configurations, prioritizing immediate usability. The default now enables all tools, unrestricted direct filesystem paths, absolute path output, shell execution, process sessions, and the complete parent environment; existing saved workspace policies remain unchanged.
-- Reframe stdio as an optional local transport rather than a model provider or a replacement for native Claude, Cursor, Codex, or ChatGPT Desktop tooling. Expand client documentation to distinguish the MCP host/model from the Machine Bridge tool server and explain when stdio is redundant or useful.
-- Activate cross-platform GitHub Actions checks on Linux, macOS, and Windows, update official actions to the current major releases, disable checkout credential persistence, and retain production dependency/package auditing.
-
-### Tests and documentation
-
-- Add regression coverage for the maximum-permission default and for `client-config` emitting `full` when no profile is supplied.
-- Update architecture, operations, security, and client guidance for profile-dependent path display, filesystem scope, and environment inheritance.
-
-## 0.4.0 - 2026-07-10
-
-### Architecture and compatibility
-
-- Refactor the project into one transport-independent local runtime shared by the existing OAuth-protected Cloudflare relay and a new local MCP stdio server.
-- Update MCP negotiation to `2025-11-25` while retaining compatibility with `2025-06-18` and `2025-03-26`; validate protocol-version headers and implement cancellation in both transports.
-- Add ready-to-paste stdio configuration generation for Claude Desktop, Cursor, Codex CLI, and generic MCP clients.
-- Replace duplicated Worker/runtime tool declarations with one schema-and-annotation catalog, tested for drift and policy consistency.
-
-### Security and privacy
-
-- Make the least-privilege `review` profile the default for newly selected workspaces; preserve stored pre-0.4 permissions during upgrade.
-- Add explicit `review`, `edit`, `agent`, and `full` profiles plus `off`, direct-argv, and shell execution modes.
-- Return workspace-relative paths by default, redact canonical/platform-alias paths from tool errors, omit Git author email unless requested, and reduce operational failures to coarse error classes.
-- Replace the previous minimal environment with isolated HOME, temp, and cache directories; retain full parent environment only through explicit opt-in.
-- Reject duplicate in-flight JSON-RPC IDs, canonical patch-path collisions, stale edits, unsupported image signatures, oversized session data, and ambiguous patch context.
-- Make create-only writes atomic against concurrent destination creation and strengthen multi-file patch staging, revalidation, rollback, and mutation serialization.
-
-### Tools and runtime
-
-- Add bounded line-range reads, native MCP raster-image results, exact text editing, and structured multi-file add/update/move/delete patches.
-- Add staged diffs, structured Git log, bounded Git show, and privacy-aware author metadata.
-- Add direct argv execution and bounded interactive process sessions with retained offsets, stdin, output/exit waits, cancellation, tree termination, and disconnect cleanup.
-- Return structured tool content alongside text compatibility output and expose tool annotations for client planning.
-
-### Reliability, testing, and operations
-
-- Add live stdio integration coverage for initialization, tool discovery, structured/image content, edits, patches, direct execution, sessions, cancellation, and post-cancellation health.
-- Expand Worker integration coverage for latest protocol negotiation, disconnected tool advertisement, rich content, exact daemon tool sets, and remote cancellation.
-- Add catalog, policy-profile, canonical-collision, no-partial-patch, Git privacy, path-redaction, isolated-environment, and session tests.
-- Add a Linux/macOS/Windows GitHub Actions template, Node 22/24 coverage, package/audit checks, and Dependabot configuration.
-- Rewrite architecture, security, client, operations, and testing documentation around explicit trust boundaries and non-goals.
-
-## 0.3.3 - 2026-07-10
-
-### Security
-
-- Add an exact-version npm `allowScripts` policy for the reviewed Wrangler runtime/build binaries (`esbuild@0.28.1`, `sharp@0.34.5`, and `workerd@1.20260708.1`) and explicitly deny the optional `fsevents` install script. Dependency upgrades therefore require renewed script approval.
-
-### Changed
-
-- Exclude the development-only Worker integration test from the published npm package while retaining it in the repository and CI.
-- Add a fail-closed release command that synchronizes `main`, the version tag, the GitHub Release, and its npm tarball; block `npm publish` when those artifacts do not match.
-
-## 0.3.2 - 2026-07-10
-
-### Fixed
-
-- Keep the healthy daemon active until a replacement connection completes its authenticated `hello` handshake; enforce the candidate deadline with a Durable Object alarm so it survives WebSocket hibernation, and reject stale or non-handshaking candidates without disrupting the active connection.
-- Send the candidate acknowledgement before closing the previous daemon, expire failed acknowledgements, clean up duplicate authenticated sockets on subsequent handshakes, and reject pre-handshake messages without changing active tool metadata.
-
-## 0.3.1 - 2026-07-10
-
-### Security
-
-- Replace reversible unsalted source-address hashes used for OAuth registration limits and password throttling with deployment-keyed HMAC identifiers; stop persisting User-Agent-derived identities, remove legacy unsalted identifiers during store migration, and fail closed if no identity key is configured.
-
-### Fixed
-
-- Preserve timeout escalation after the direct child exits so a process-group `SIGKILL` still removes descendants that ignore `SIGTERM`; add a regression test for the orphan-process boundary.
-- Replace legacy unsalted source-identity hashes with deployment-keyed HMAC identifiers, prune legacy stored identifiers, and add integration coverage for registration quotas and login throttling.
-
-## 0.3.0 - 2026-07-10
-
-### Security
-
-- Confine filesystem tools to the canonical workspace by default; add explicit `--unrestricted-paths` opt-in and symbolic-link escape protection.
-- Make `write_file` bounded and atomic, reject symbolic-link/non-regular destinations, and enforce optimistic hashes consistently.
-- Add recursive log-field and token redaction, control-character neutralization, owner-only service logs, and bounded log trimming.
-- Harden OAuth with strict PKCE/resource/client/redirect validation, validated client disclosure on the consent page, password-failure throttling, bounded dynamic registration, per-source and per-client limits, inactive-client cleanup, strict HTTP methods/UTF-8 handling, and security response headers.
-- Minimize unauthenticated and relay metadata disclosure: remove workspace name/path hash/process ID from the daemon handshake, reduce default observability sampling, and bind pending calls to their originating daemon socket.
-- Bound Worker/daemon request sizes and concurrency; serialize OAuth mutations; isolate WebSocket generations; serialize per-workspace startup/deploy/rotation operations; terminate timed-out or disconnected child processes and bound Wrangler subprocesses.
-
-### Changed
-
-- Raise the minimum Node.js version to 22 because the current Wrangler release no longer runs on Node 20; require the installed Wrangler dependency instead of falling back to an implicit network `npx` execution.
-- Remove the experimental local OpenAI-compatible `/v1` API and MCP sampling proxy.
-- Detect nested Git repositories for `git_status` and `git_diff`, while disabling repository-configured external diff, text conversion, and filesystem-monitor hooks for bridge Git operations.
-- Use atomic local state/config writes, bounded corrupt-state backups, strict adoption/migration of dedicated state roots, and guarded state-root deletion during uninstall, including refusal while active daemon/startup locks remain.
-- Reject unknown, duplicate, malformed, and command-inapplicable CLI options; fix boolean options consuming positional workspaces.
-- Verify the expected Worker version before accepting a deployment hash.
-- Reduce the default Worker request-body limit to 8 MiB; bound command length, directory results, recursive traversal, and path-result payloads; provide exact-origin CORS while rejecting implicit loopback browser origins.
-- Update Wrangler to 4.110.x, TypeScript to 5.9.x, and Node type definitions to the supported Node 22 API line.
-
-### Tests and documentation
-
-- Expand self-tests across path boundaries, symlinks, writes, UTF-8, nested Git, environment isolation, locking, CLI parsing, state recovery/removal guards, logging, service logs, and Worker hardening invariants.
-- Add a live local Worker OAuth/MCP integration test, verified Node 22/24 compatibility, a Worker build dry-run, dependency audit, security policy, and architecture document.
-
-## 0.2.5
-
-- Previous release.
+Historical prerelease entries remain available from Git tags and repository release records. From a source checkout, inspect the changelog shipped by a prior release with `git show v<version>:CHANGELOG.md`. This current file intentionally describes only the active candidate and the history location.