machine-bridge-mcp 3.0.0-beta.191 → 3.0.0-beta.195

package/CHANGELOG.md

@@ -1,10 +1,9 @@
 # Changelog
 
-## 3.0.0-beta.191 - 2026-09-15
+## 3.0.0-beta.195 - 2026-09-18
 
-- Keep durable managed-job execution available across in-place Node package-manager upgrades by falling back from a removed daemon `process.execPath` only to the still-executable absolute Node launcher that originally started the daemon; diagnostics expose provenance/availability without local paths.
-- Make macOS sleep diagnosis retain actual timestamped `Sleep` records with a bounded 15-second power-log probe, avoiding the previous five-second timeout and broad filter that could hide evidence explaining relay suspension.
-- Add regressions for stale runtime launcher recovery and sleep-probe boundaries; relay authentication, replay, duplicate-side-effect prevention, and reconnect policy are unchanged.
+- Update the fast-check development dependency from 4.9.0 to 4.10.0 and refresh its resolved lockfile entry.
+- Preserve the beta.194 Wrangler/toolchain and relay changes while advancing release identity to beta.195 so this dependency update receives independent full verification, live candidate canary, and exact acceptance evidence.
 
 ## Historical releases
 

package/browser-extension/manifest.json

@@ -30,6 +30,6 @@
   "action": {
     "default_title": "Machine Bridge Browser"
   },
-  "version_name": "3.0.0-beta.191",
+  "version_name": "3.0.0-beta.195",
   "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxryYkpZhq8+VAQLHcGS9BAHQcyKX8RHGIpIwvtIVRU/rcOcE0bNdnM0aZJ/h6xWQsGDHlhvjT2+1aJaAn/9k8473BRWajzVXld961CdHYVFVHoce2hHiSJ0xydWrHMMZhAm0mN0UzjEpgZ0tMw209efcZHIvSwuxhteZMRy4kyiVjwFlOf5oXFCxRuCJnPj3AK9CmCf4XgEBuPIJ0TZmjGHOOdBvJmbCNnAWXYEo5/mf7MfCGhV4IJ1hNuhpoNQfOFKMUcw9/v/IpT62XpfXdGYTfGYCmCjC+gntK1spbkr2P4/2+sYMQtLpse71mpSNGXfcf3abU55Vpn+gncSxRQIDAQAB"
 }

package/docs/AUDIT.md

@@ -1,35 +1,31 @@
 # Current audit status
 
-This file is the current audit summary. Historical findings, closed incidents, and release-by-release evidence are retained by Git tags and repository history rather than repeated in the default maintenance path. For a historical snapshot, inspect this file at the corresponding version tag.
+This file is a compact statement of current cross-cutting audit conclusions and residual limits. It is intentionally version-agnostic: release identity, candidate acceptance, publication state, and soak state are authoritative only in package metadata, release records, Git history/tags, and the external release systems they describe. This file is not a release-state authority.
 
 ## Current conclusions
 
-- MCP execution is current-protocol-only. Remote HTTP and stdio support MCP `2026-07-28`; removed initialization/session/replay requests fail closed and cannot dispatch old behavior.
-- Browser computer observation requires the current atomic observation capability, and desktop visual-point decisions require the formal capability interface. Runtime method-presence fallbacks are not accepted as compatibility.
-- Durable managed-job recovery, idempotent submission, ambiguous-side-effect settlement, process-tree termination confirmation, WebSocket/HTTPS relay recovery, authorization intersections, atomic state writes, resource admission, and rollback evidence remain current product guarantees rather than historical compatibility.
-- Persisted-state migration is treated separately from protocol compatibility. Browser pairing and OAuth refresh-family readers that protect credential continuity or replay prevention remain until their supported one-way migration can be moved to an explicit upgrade phase and proven complete; they are not deleted merely because the executable protocol is current-only.
-- A hosted transient process result promised for recovery remains non-evictable during its fixed 24-hour undelivered-result grace. Delegated pending recovery retains the account-scoped capacity boundary that prevents one principal from exhausting the shared retained-state store.
-- Hosted result pressure is now bounded independently from execution correctness: relay `read_file` returns at most a 64 KiB complete serialized result with whole-line continuation, relay `read_process` pages at 32 KiB, and account-owned transient one-step process carriers capture at most 32 KiB aggregate output while retaining explicit truncation counts. Local/stdio capacities are unchanged.
-- Owner diagnostics expose only content-free 15-minute result-byte aggregates alongside call density and keep `host_side_events_observable=false`; they cannot prove ChatGPT host-turn termination or final-response receipt.
-- Resource-state reads retry only `MBM_IDENTITY_CHANGED` for at most four observations; permission, link, malformed-content, and persistent identity failures remain fail closed.
-- Relay application-layer fault domains are now independently configurable: WSS may remain on `MBM_RELAY_PROXY` while signed HTTP fallback uses a distinct `MBM_RELAY_FALLBACK_PROXY` or explicitly returns to standard environment-proxy resolution. This reduces common-mode application-proxy coupling but is not evidence that an operating-system VPN/TUN or shared upstream cannot affect both routes.
-- macOS idle-sleep continuity now has an explicit persistent policy rather than an implicit one-size-fits-all lease. `activity` remains the default; `ac-continuous` and `continuous` add daemon-lifetime assertions with different battery semantics, and every assertion uses bounded desired-state self-healing after unexpected child failure. Diagnostics expose only coarse mode/recovery ownership and bounded unprotected duration.
-- Portable JWK device roots now renew the daemon's 24-hour root-certified ephemeral session in-process before expiry. WSS and signed HTTPS share one current-session provider; suspension-delayed authentication renews synchronously at the authentication boundary, while renewal failures retain the old session and preserve the existing fail-closed expiry path. Secure Enclave roots remain non-renewable without user presence.
-- The reviewed Sharp security floor is 0.35.4 in both the main development graph and the private Wrangler toolchain. The beta.171 activation preflight was blocked before Worker/service mutation when a newly published libheif advisory caused npm audit to report three high-severity aggregate findings through Sharp -> Miniflare -> Wrangler; an isolated 0.35.4 override retained Wrangler 4.127.1 and workerd 1.20260828.1 while reducing both current production-only audits to zero vulnerabilities.
-- Process-lock readers now treat only `MBM_IDENTITY_CHANGED` as a bounded atomic-publication race and retry at most four observations. This is narrower than generic activation recovery: persistent identity churn and every other storage/link/permission failure still fail closed. The change is driven by beta.172 live evidence where the exact candidate Worker and service were already verified ready, but the activation subprocess observed the daemon lock while startup-readiness publication atomically replaced that file and therefore returned failure instead of writing the activation record.
-- Same-daemon relay recovery now separates execution authority from terminal-result delivery. A transient transport loss may retain only the original in-memory settlement owner for one fixed fifteen-second window beyond its original settlement deadline, including when that original settlement deadline was already at the ordinary tool ceiling. Safe missing-call redelivery remains bound to the original execution deadline, repeated handovers cannot accumulate grace, cancellation still removes ownership, and no client-visible replay or persistent result store is introduced.
-- Compound-task continuity is now explicit planning guidance rather than an implicit host behavior. Multi-command, multi-project, long-running, or interruption-sensitive non-interactive work is routed toward one durable managed job, recovery guidance requires resuming the same accepted job after reconnect, and built-in working agreements reject directory-name freshness as checkout identity evidence. Direct shell remains an available fallback; durability is ownership semantics, not a claim that the relay transport cannot fail.
-- Workspace relocation now has an explicit offline state-migration invariant. The beta.175 candidate exposed stale global selection after the beta165 worktree was archived; beta.176 then proved that changing selection alone still leaves the deployed profile and machine-service owner keyed to the historical canonical path; beta.177 exposed targetless `service stop` still loading selected-workspace state. The unaccepted beta.178 candidate added the migration path, but owner-machine recovery then exposed two post-verification gaps: read-only inspection can leave an unpopulated destination shell, and a recurring external launchd helper that stopped the daemon before later preflight checks converted a populated-destination rejection into repeated service removal. Beta.179 makes targetless stop provider-global/state-free, accepts only absent or provably unpopulated destination profiles, proves provider/job/lock quiescence before pruning any empty shell, never recursively clears destination state, tolerates only an absent historical owner entry script while validating one that still exists, canonicalizes path aliases through `realpath`, and injects `HOME` into macOS launchd definitions. Recurring external migration helpers and compatibility symlinks are not accepted repairs.
-
-- Beta.180 is a controlled, unaccepted continuity candidate. Its target is two-layer fault containment rather than an impossible no-disconnect promise: keep signed HTTPS standby and the fallback proxy transport warm so a transient WSS 1006 can take the bounded exact-generation takeover path without a cold start, and make long/compound/keep-working execution explicitly owned by one durable task supervisor instead of host-fragmented one-step calls. The candidate must preserve no-replay and fail-closed transport ownership, keep short/interactive routing unchanged, and may not be called accepted until frozen-tree verification and live owner-machine activation evidence exist.
-
-- Beta.181 supersedes the activated-but-unaccepted beta.180 candidate after live owner-machine routing exposed two semantic classification defects rather than a relay failure: `非交互工作` and conditional `外部输入或授权` wording could exclude task supervision, while a project token could weak-match an unrelated installed application sharing one lexical fragment. The repair narrows interactive intent to explicit process/input contexts, requires lexical-token evidence for partial application matches, and makes an already-positive task-supervisor continuation contract authoritative for primary route selection. beta.180 relay standby/takeover behavior is unchanged.
-- Beta.182 is the reviewed predecessor candidate that added repository-specific durable routing for known long prerelease commands, extracted reconnect result settlement into a focused policy module while retaining the then-existing per-tool settlement ceiling, and recorded the controlled relay A/B. Its packaged bytes remain associated with beta.182 and are not reused after the independent re-review changed shipped source.
-- Beta.183 supersedes beta.182 after that re-review found package-affecting continuity, routing, privacy, and auditability defects. Repository-specific long workflows now request durable task supervision through project-provided registered-command metadata rather than hard-coded script names in generic routing; explicit read-only/negated/hypothetical/interactive/existing-job wording is kept out of new-job creation, and weak application-name matches require UI-operation intent. Worker reconnect settlement keeps execution/redelivery on the original deadline but grants the verified same-daemon terminal-result owner one fixed non-cumulative 15-second delivery-only extension beyond the original settlement deadline. Managed-job output redaction is byte-first and truncation-boundary safe; saturated retention tolerates a stale active-to-terminal dependency-plan deletion race without weakening genuine active-state fail-closed behavior; multiline static module edges are included in the architecture graph; and public worktree resolution no longer depends on maintainer-home tooling. The beta.182 controlled application-proxy A/B remains evidence only for the induced fault branch and does not identify the cause of spontaneous historical 1006 resets.
-- Beta.186 is the source candidate produced by an independent beta.185 review. The first review confirmed two issues: a zero-wait `read_job` starts with exactly the 10-second managed-read headroom, so any positive reconnect delay made daemon-proven non-delivery ineligible for redelivery; and the output-redaction sink itself accepted an empty literal even though current resource materialization already filters empty patterns. Subsequent hardening reproduced four adjacent boundary defects before acceptance: truncation-tail protection could receive truthy non-string redaction entries; repeated missing acknowledgements could re-enter redelivery policy; `resume_calls_ack.missing_ids` was not bound to the exact resume set emitted on that connection; and shorter protected bytes/paths/literals could partially replace a longer overlapping value and leave its suffix visible. The candidate now uses one literal-pattern filter, processes overlapping protected values longest-first, binds resume acknowledgement to the exact connection-scoped resume set, consumes one semantic acknowledgement while treating only its exact duplicate as idempotent, and records the channel of the one successful same-ID transport redelivery. A different later acknowledgement or out-of-set ID is a protocol error, while a later reconnect that again proves non-delivery returns the existing retryable no-side-effect failure. Low-headroom `read_job` redelivery still becomes `wait_ms: 0`, preserves the original execution deadline, and refuses less than one second of execution budget; fresh dispatch still requires the ordinary 10-second reconciliation headroom. The existing socket protocol-error counter is now driven by real WebSocket and signed-HTTPS ready-channel rejection paths without recording daemon payload values. Here “production protocol rejection paths” means the shipped Worker handler paths that can serve production traffic; it is a source-path reachability claim, not evidence that beta.186 has been deployed to or observed in a production environment. Other report proposals are not treated as defects without stronger evidence: request-stream closure is deliberately cancellation for request-scoped work; the 2-second durable-process initial settlement window is a response-coalescing bound rather than task lifetime and same-response `read_job` continuation remains the orchestration contract; historical macOS relocation already canonicalizes existing realpath ancestors, so platform-wide lowercasing would be unsound on case-sensitive volumes; beta.179 and beta.181 have passed acceptance records and are retained; and disabling fallback-proxy keep-alive is not justified by the current fault-injection evidence alone.
-
-## Residual review requirements
-
-A green fast or full suite is necessary but not sufficient security evidence for publication. Release acceptance still requires the package/install/security gates and any hosted or live boundary evidence required by the changed surface. This summary does not authorize deployment or npm publication.
-
-Beta.185 is the latest repository acceptance record and remains the accepted prior-byte baseline. Beta.186 is a new local source candidate and must not inherit beta.185 acceptance: frozen-tree verification, packaging/install/security checks, and any exact-candidate live activation evidence required by the changed surface must be produced again before acceptance. The spontaneous historical upstream reset source remains unassigned within the current privacy-bounded evidence; a future relay reset may still occur. npm publication remains separately gated.
+- **Authority remains an intersection, never an accumulation.** Effective MCP authority is bounded by authenticated account role, daemon capability ceiling, and tool-specific policy. Reconnects, retries, stale host schemas, browser focus changes, or recovery metadata do not expand authority.
+- **Removed protocol behavior stays removed.** Remote HTTP and stdio use the current MCP protocol only. Removed initialization, session, and replay behavior fails closed instead of silently falling back to historical compatibility.
+- **State publication is atomic and identity-sensitive.** Security-sensitive state readers reject symlinks, unexpected hard links, malformed content, permission failures, and persistent identity changes. Bounded retries are reserved for explicitly classified atomic-publication races; durable state is complete before it becomes visible.
+- **Durable execution owns continuity explicitly.** Managed jobs persist recovery state independently of the hosted MCP response. Idempotency keys bind uncertain acceptance retries only while the retained record exists; cancellation, dependency state, cleanup, output budgets, and terminal persistence have explicit fail-closed boundaries. Callers recover the same accepted job instead of replaying its side effect.
+- **Daemon-owned Node children use a verified runtime launcher.** A live concrete runtime executable is preferred; if it disappears after a package-manager upgrade, only the original absolute Node launcher is eligible as fallback. Diagnostics expose provenance booleans rather than executable paths, and an unavailable launcher requires service restart instead of PATH guessing.
+- **Relay recovery separates transport from execution semantics.** WebSocket and signed HTTPS are transport paths, not permission or replay authorities. Their authenticated handshake/resume state is generation-scoped per transport, ended-generation control messages are discarded before reconciliation or interruption, and a protocol violation is routed only to its originating current transport. Ambiguous side effects are not transparently replayed. Same-daemon terminal-result retention is bounded, cancellation removes ownership, and repeated reconnects cannot accumulate execution time or delivery grace. Fatal protocol diagnostics retain only sanitized error/source/generation-class/stage/disposition fields, while fallback takeover history remains privacy-bounded across both control paths.
+- **Operating-system sleep is an observable suspension boundary, not a network guarantee.** On supported macOS hosts, diagnostics correlate bounded sleep history with runtime stalls and recovered relay outages. Machine Bridge cannot keep JavaScript or a socket executing while the machine is suspended, and sleep correlation does not identify unrelated upstream network causes.
+- **Browser automation remains existing-profile and snapshot-bound.** The extension controls an already installed Chromium profile; hosted calls bind explicit tab identity, and later Computer Use actions bind the exact observation snapshot. Mutation response loss, timeout, extension replacement, or ambiguous trusted-input settlement yields an unknown/non-retryable boundary that must be inspected before any retry.
+- **Desktop automation is permission- and evidence-bound.** Application actions use structured Accessibility operations or an explicitly enabled snapshot-bound visual backend. The runtime does not silently substitute arbitrary scripting or unverified pixel guessing when required authority/evidence is unavailable.
+- **Logging and diagnostics are privacy-minimized by contract.** Runtime logs are structured and must not contain tool arguments, command output, credentials, account identity, arbitrary URLs, private paths, or other user content. Explicit local CLI/tool results are a separate user-requested output surface. Security-audit telemetry is content-free, bounded, and hash-chained; diagnostics expose coarse provenance/health rather than secrets or private values.
+- **Resource admission is cooperative scheduling, not a hostile-code sandbox.** CPU, memory, I/O, disk-reserve, queue, and result budgets protect service continuity, but ordinary execution still has the daemon OS user's ambient authority unless a dedicated low-privilege account or VM/container supplies the stronger boundary.
+- **Release and package evidence remain separate from audit prose.** Shipped-source or packed-document changes require synchronized package identity and fresh verification. Candidate acceptance, publication, activation, and stable promotion must be proven by their dedicated records and external systems; no sentence in this audit summary inherits or confers release authority.
+
+## Residual limits
+
+- The default full profile is intentionally powerful. It is appropriate only where the daemon OS user is itself an acceptable trust boundary; stronger hostile-code isolation requires a separate OS account or VM/container.
+- The relay can recover from many transport failures, but no software can promise uninterrupted connectivity across machine sleep, host suspension, upstream outages, VPN/TUN behavior, or process replacement. Recovery evidence must not be restated as a no-disconnect guarantee.
+- Machine Bridge can observe that a hosted tool call reached the daemon and can retain durable job results, but it cannot prove that a ChatGPT host turn ended normally or that a final UI frame rendered to the user.
+- Browser status proves the connected extension identity/capabilities, not that the paired profile is the user's intended daily versus isolated profile. Unpacked extensions may require an explicit reload after upgrades before browser automation counts as exercised.
+- Privacy-preserving diagnostics deliberately leave some root causes unassigned. In particular, spontaneous upstream transport resets may remain indistinguishable once exposing packet contents, private URLs, or user traffic would be required to disambiguate them.
+- Passing local tests is necessary but not sufficient release evidence. External CI, package integrity, installation, deployment/activation, live boundary tests, and soak requirements remain separate when the changed surface requires them.
+
+## Historical findings
+
+Historical incidents, closed hypotheses, release-by-release evidence, and superseded candidate details belong in Git history/tags and the [changelog](../CHANGELOG.md), not in this current summary. Inspect the file at the corresponding historical revision when reconstructing an old incident or release decision.

package/docs/LOGGING.md

@@ -72,7 +72,7 @@ Brief network interruptions are expected on laptop network changes, Worker deplo
 - a separate periodic twenty-five-second application heartbeat refreshes Worker daemon activity and retains a seventy-five-second application-silence timeout; it begins only after end-to-end readiness, so authenticated probing cannot send a message type that the Worker probing state does not accept. Protocol-level Pong therefore cannot mask a Worker application path that has stopped replying. The Worker queues the heartbeat's JSON `pong` before Durable Object alarm inspection or mutation, then performs one explicit coalesced schedule, so storage latency is not allowed to sit ahead of application-liveness acknowledgement;
 - a late local transport-watchdog tick is classified as `runtime.event_loop.stall`, sends a fresh transport probe, and defers disconnect for a bounded recovery interval instead of being mislabeled as immediate remote failure; a macOS sleep/wake interval may legitimately produce this warning without a daemon fault. The heartbeat snapshot retains the lag of the last actual stall separately from the rolling maximum. Owner `diagnose_runtime` can compare that end time and duration with a bounded fixed `pmset` sleep-history projection and reports `matched_system_sleep` only when both dimensions agree within the fixed tolerance; an unmatched stall remains unclassified rather than being labeled synchronous JavaScript blockage by elimination. The same diagnostic also intersects the most recent completed relay disconnect interval with that bounded sleep history and reports only outage/overlap timing plus a fixed classification; `majority_system_sleep_overlap` means host suspension dominated the observed outage, so a retained `connection_reset` is aftermath evidence rather than sufficient independent-network evidence. An authorized, schema-valid remote tool call enters macOS activity protection only after policy/account/operation authorization and argument validation succeed; remote process sessions extend that ownership through child settlement. The default `activity` mode keeps the existing shared `/usr/bin/caffeinate -i -s -w <owner-pid>` assertion and fixed thirty-minute rolling inactivity grace. `ac-continuous` adds a daemon-lifetime `-s` assertion, while `continuous` holds `-i -s` for the daemon lifetime and does not arm inactivity grace. Unexpected assertion-child failure retains desired-state ownership and schedules bounded 1/5/30-second recovery; explicit release/shutdown cancels pending recovery. `runtime.idle_sleep_guard.unavailable` still records only a coarse `error_class`, never argv, paths, PID, tool name/content, session identity, or job identity; mode, generation, restart count, recovery-pending state, and bounded unprotected-duration telemetry are exposed through diagnostics rather than logs. Remote account managed-job runners own the same self-healing assertion primitive only after runner-claim confirmation and persisted account ownership validation; local managed jobs do not acquire this remote-continuity assertion. The remote runner fallback stderr diagnostic remains the fixed text `managed job idle-sleep assertion unavailable` plus a sanitized coarse `error_class`, without job name/id, workspace path, argv, environment, or captured output.
 
-A WebSocket close code such as `1006` means the transport ended without a normal close handshake, but it does not identify who initiated termination: Machine Bridge's own liveness recovery calls `terminate()` when a transport/send timeout is confirmed, and that local hard close can surface as 1006. Diagnose the cause from `last_close_category`, transport-confirmation/send-timeout evidence, and retained network milestones rather than treating 1006 itself as proof of a remote/network-initiated close. If it recovers inside ten seconds, the warning-level service log is intentionally silent and the authenticated `daemon.relay_transport` snapshot is the post-event evidence surface. It is useful for debug diagnosis but not useful as the default user message. It is not evidence that the daemon process restarted. Worker `daemon_transport_error` / `daemon_liveness_timeout` messages and their 1012 close frames are likewise retryable connection conditions, not upgrade instructions. Only an unknown/incompatible Worker error, authentication failure, or identity/version mismatch may produce the fatal protocol/configuration log and daemon exit. Default logs therefore describe the affected layer, duration, classification, and recovery behavior rather than printing raw close envelopes.
+A WebSocket close code such as `1006` means the transport ended without a normal close handshake, but it does not identify who initiated termination: Machine Bridge's own liveness recovery calls `terminate()` when a transport/send timeout is confirmed, and that local hard close can surface as 1006. Diagnose the cause from `last_close_category`, transport-confirmation/send-timeout evidence, and retained network milestones rather than treating 1006 itself as proof of a remote/network-initiated close. If it recovers inside ten seconds, the warning-level service log is intentionally silent and the authenticated `daemon.relay_transport` snapshot is the post-event evidence surface. It is useful for debug diagnosis but not useful as the default user message. It is not evidence that the daemon process restarted. Worker `daemon_transport_error` / `daemon_liveness_timeout` messages and their 1012 close frames are likewise retryable connection conditions, not upgrade instructions. Only an unknown/incompatible Worker error, authentication failure, or identity/version mismatch may produce the fatal protocol/configuration log and daemon exit. A fatal relay protocol log retains only a sanitized protocol error code, source transport (WebSocket or HTTPS), coarse connection-generation class, handshake stage, and fatal/retry disposition; it never records the numeric session generation, endpoint, credentials, account identity, call IDs, or message payload. Default logs therefore describe the affected layer, duration, classification, and recovery behavior rather than printing raw close envelopes.
 
 Streamed-call diagnostics are deliberately coarse. MCP `2026-07-28` request/response-stream ownership and the Worker pending-call registry are memory-only; there is no protocol-session, terminal-result, subscriber, or replay store. Worker event counters are scoped to the current isolate and say so in `metric_scope`, while `server_info` exposes only bounded current pending-call/capacity state. These diagnostics do not prove public SSE consumption or MCP-host receipt. Logs and `server_info` must not include tool arguments, terminal results, command text, request keys, account identifiers, raw call IDs, raw connection generations, mirrored parameter values, private paths, or subscriber payloads. A stale-generation result is counted as unmatched rather than logged with its envelope.
 

package/docs/OPERATIONS.md

@@ -93,7 +93,7 @@ After the host path recovers, compare authenticated `server_info`, `machine-mcp
 
 ### Relay interruption messages
 
-A reconnect warning proves a transport interruption, not a daemon crash. Compare daemon PID and process start time with `connected_at`, `last_seen_at`, `daemon.relay_transport.last_close_category`, `last_close_code`, `outage_count`, `recent_outages`, `outage_attempts`, `previous_ready_inbound_silence_ms`, `last_connect_milestones_ms`, and the coarse network-route class. In each completed `recent_outages` entry, `disconnected_at` is the first transition into that outage, `last_disconnect_at` is the final failed reconnect/close transition, `ready_at` is verified recovery, and `duration_ms` measures first-disconnect-to-ready time. The bounded `probe_dispatch_pending_at_start`, `probe_dispatch_age_ms_at_start`, `probe_outstanding_at_start`, `probe_age_ms_at_start`, `transport_confirmation_pending_at_start`, and `application_inbound_silence_ms_at_start` fields freeze the liveness phase at that first transition. Use them to test hypotheses such as a failure coinciding with the first five-second protocol Ping, but do not treat that timing correlation as proof that Ping caused the reset. Also distinguish a planned restart from an accidental outage: a current-generation daemon sends `daemon_draining` before relay close, affected calls receive `reason=daemon_planned_drain`, and owner/full `server_info.worker.continuity_evidence` schema 2 durably retains the planned-drain count/time plus bounded socket-disconnect and client-cancellation observations across Worker isolate replacement. Treat `ready_socket_disconnects`, `unplanned_ready_socket_disconnects`, and `last_ready_socket_disconnect` as the qualified durable socket-outage evidence; the broader `socket_disconnects` counters include candidate/probing transport churn. `last_socket_disconnect.role`, `was_ready`, and `connected_at` identify whether the newest first-observed close/error had ever become the authoritative ready channel. Planned-drain intent is serialized into the WebSocket attachment before close so a Durable Object isolate replacement cannot turn a planned shutdown into an unplanned disconnect. Schema-1 disconnect counts are intentionally reset during the schema-2 transition because old isolates could count stale/expired close callbacks more than once. `worker.observability.continuity` remains isolate-local and may reset; use the qualified durable summary for post-incident correlation rather than relying on a later close-1006 inference. For hosted `read_job`, recover with the same returned `job_id` plus its `recovery_key`; do not resubmit the job's underlying mutation. If the job predates capability issuance or its capability was never delivered, use local CLI/stdio administration instead of attempting hosted global discovery. `last_connect_milestones_ms` contains only bounded relative timings for the most recent connection attempt phases such as DNS resolution, TCP connect, TLS establishment, HTTP rejection, and WebSocket open; `last_failed_connect_stage`, `last_failed_connect_duration_ms`, `last_failed_connect_milestones_ms`, and `last_failed_connect_http_status` retain the most recent failed attempt even after a later retry succeeds. `last_transport_error_ready` and `last_transport_error_authenticated` distinguish failure of an already-established channel from a pre-readiness connection failure. `last_transport_error_reason` is a strict privacy-safe allowlist (`connection_reset`, `connection_timeout`, `network_unreachable`, bounded DNS/TLS classes, or `unknown`) rather than the raw operating-system message. The signed HTTPS fallback retains its last error class/reason after a later successful poll while resetting the current `http_poll_failures` count, so post-recovery diagnosis can determine whether WSS and HTTPS failed through the same system-network episode. None of these fields contains a hostname, address, DNS answer, certificate, close reason, or proxy endpoint. While no daemon channel is ready, `server_info.daemon.previous_connection` retains only the last verified channel's transport, connected/last-seen/disconnected timestamps, and sanitized relay diagnostics; it excludes policy, tools, account identity, daemon instance/connection identity, call IDs, arguments, and results, and it never participates in routing or authorization. `outage_duration_ms` measures the close-to-ready recovery episode; `previous_ready_inbound_silence_ms` measures how long the preceding ready socket had stopped producing inbound transport proof before it actually closed. The second value is therefore the field that exposes a black-holed OPEN WebSocket whose visible reconnect later completes quickly. A VPN/TUN UI may remain “connected” while its upstream route is unusable. Local OS logs can be compared with the exact `last_disconnected_at` timestamp, but an interface-quality change or tunnel-process correlation is not by itself proof of which product, node, edge, or upstream failed. Correlated failure of an independent HTTPS client at the same timestamp—for example an external API `unexpected EOF` while the relay records WebSocket 1006/`connection_reset`—is stronger evidence of a shared system-network/VPN/TUN episode than of a Machine Bridge event-loop or resource-admission failure; it still does not identify the failing tunnel node or upstream provider. Machine Bridge reports only coarse route/proxy classes and never sends or logs interface names, addresses, DNS answers, proxy credentials, or Worker secrets.
+A reconnect warning proves a transport interruption, not a daemon crash. When the daemon instead exits on a relay protocol error, inspect the same default service-log entry for the sanitized protocol error code, source transport, coarse generation class, handshake stage, and disposition; those fields distinguish a current-generation fatal WebSocket violation from a retryable HTTPS fallback violation without exposing raw connection identifiers. Compare daemon PID and process start time with `connected_at`, `last_seen_at`, `daemon.relay_transport.last_close_category`, `last_close_code`, `outage_count`, `recent_outages`, `outage_attempts`, `previous_ready_inbound_silence_ms`, `last_connect_milestones_ms`, and the coarse network-route class. In each completed `recent_outages` entry, `disconnected_at` is the first transition into that outage, `last_disconnect_at` is the final failed reconnect/close transition, `ready_at` is verified recovery, and `duration_ms` measures first-disconnect-to-ready time. The bounded `probe_dispatch_pending_at_start`, `probe_dispatch_age_ms_at_start`, `probe_outstanding_at_start`, `probe_age_ms_at_start`, `transport_confirmation_pending_at_start`, and `application_inbound_silence_ms_at_start` fields freeze the liveness phase at that first transition. Use them to test hypotheses such as a failure coinciding with the first five-second protocol Ping, but do not treat that timing correlation as proof that Ping caused the reset. Also distinguish a planned restart from an accidental outage: a current-generation daemon sends `daemon_draining` before relay close, affected calls receive `reason=daemon_planned_drain`, and owner/full `server_info.worker.continuity_evidence` schema 2 durably retains the planned-drain count/time plus bounded socket-disconnect and client-cancellation observations across Worker isolate replacement. Treat `ready_socket_disconnects`, `unplanned_ready_socket_disconnects`, and `last_ready_socket_disconnect` as the qualified durable socket-outage evidence; the broader `socket_disconnects` counters include candidate/probing transport churn. `last_socket_disconnect.role`, `was_ready`, and `connected_at` identify whether the newest first-observed close/error had ever become the authoritative ready channel. Planned-drain intent is serialized into the WebSocket attachment before close so a Durable Object isolate replacement cannot turn a planned shutdown into an unplanned disconnect. Schema-1 disconnect counts are intentionally reset during the schema-2 transition because old isolates could count stale/expired close callbacks more than once. `worker.observability.continuity` remains isolate-local and may reset; use the qualified durable summary for post-incident correlation rather than relying on a later close-1006 inference. For hosted `read_job`, recover with the same returned `job_id` plus its `recovery_key`; do not resubmit the job's underlying mutation. If the job predates capability issuance or its capability was never delivered, use local CLI/stdio administration instead of attempting hosted global discovery. `last_connect_milestones_ms` contains only bounded relative timings for the most recent connection attempt phases such as DNS resolution, TCP connect, TLS establishment, HTTP rejection, and WebSocket open; `last_failed_connect_stage`, `last_failed_connect_duration_ms`, `last_failed_connect_milestones_ms`, and `last_failed_connect_http_status` retain the most recent failed attempt even after a later retry succeeds. `last_transport_error_ready` and `last_transport_error_authenticated` distinguish failure of an already-established channel from a pre-readiness connection failure. `last_transport_error_reason` is a strict privacy-safe allowlist (`connection_reset`, `connection_timeout`, `network_unreachable`, bounded DNS/TLS classes, or `unknown`) rather than the raw operating-system message. The signed HTTPS fallback retains its last error class/reason after a later successful poll while resetting the current `http_poll_failures` count, so post-recovery diagnosis can determine whether WSS and HTTPS failed through the same system-network episode. None of these fields contains a hostname, address, DNS answer, certificate, close reason, or proxy endpoint. While no daemon channel is ready, `server_info.daemon.previous_connection` retains only the last verified channel's transport, connected/last-seen/disconnected timestamps, and sanitized relay diagnostics; it excludes policy, tools, account identity, daemon instance/connection identity, call IDs, arguments, and results, and it never participates in routing or authorization. `outage_duration_ms` measures the close-to-ready recovery episode; `previous_ready_inbound_silence_ms` measures how long the preceding ready socket had stopped producing inbound transport proof before it actually closed. The second value is therefore the field that exposes a black-holed OPEN WebSocket whose visible reconnect later completes quickly. A VPN/TUN UI may remain “connected” while its upstream route is unusable. Local OS logs can be compared with the exact `last_disconnected_at` timestamp, but an interface-quality change or tunnel-process correlation is not by itself proof of which product, node, edge, or upstream failed. Correlated failure of an independent HTTPS client at the same timestamp—for example an external API `unexpected EOF` while the relay records WebSocket 1006/`connection_reset`—is stronger evidence of a shared system-network/VPN/TUN episode than of a Machine Bridge event-loop or resource-admission failure; it still does not identify the failing tunnel node or upstream provider. Machine Bridge reports only coarse route/proxy classes and never sends or logs interface names, addresses, DNS answers, proxy credentials, or Worker secrets.
 
 Brief retryable outages recover automatically. On a verified current daemon channel, `server_info.daemon.relay_transport.outage_active=false`; retained fields describe the immediately preceding transport episode rather than claiming a current outage. WebSocket remains preferred and requests a protocol-level probe after five seconds. Calling `ws.ping()` only queues the control frame; it is not treated as remote-probe dispatch until the WebSocket sender's write callback confirms that the Ping actually left the local send queue. The local sender has a separate thirty-second bounded dispatch window, while a confirmed Ping retains its full ten-second Pong deadline. This deliberately prevents compression/backpressure or a slow local socket queue from spending the remote-response budget before any probe was transmitted. A protocol Pong that arrives while a Ping callback is still pending records bidirectional proof for that dispatch round; if the local write callback then completes inside the thirty-second dispatch budget, it does not arm a stale future Pong deadline. Unrelated application inbound is receive-side evidence only and cannot prove the daemon-to-Worker direction. A local queue whose Ping write callback still has not completed after thirty seconds is classified as `relay_transport_send_timeout` even if unrelated inbound traffic continues. One dispatched Ping that reaches the ten-second response deadline does not hard-kill an otherwise ready WSS: the relay runtime enters a fifteen-second `transport_confirmation_pending` window, sends the existing JSON application heartbeat as an independent path check, and prewarms signed HTTPS in standby without taking ownership away from the still-ready WSS. A protocol Pong or the explicit JSON application `pong` clears suspicion and stops standby prewarm; ordinary tool/control traffic does not, because it proves only the Worker-to-daemon receive direction. Only a second-stage confirmation window that receives no application `pong` becomes `relay_transport_timeout` and terminates the WSS. This keeps a true black hole bounded while no longer amplifying a roughly ten-to-fifteen-second persistent-flow stall into an immediate reconnect storm. `heartbeat.probe_dispatch_*`, `heartbeat.transport_confirmation_*`, and bounded sender-backlog fields distinguish local send delay, first-stage response loss, successful second-stage recovery, and confirmed two-stage failure. The separate periodic JSON application heartbeat remains twenty-five seconds with a seventy-five-second application-silence timeout, begins only after verified relay readiness, and the Worker keeps a wider ninety-second WebSocket liveness fallback. This is a detection/recovery bound, not a guarantee that a degraded network can complete another WebSocket handshake inside the same interval. WebSocket connect attempts have a thirty-second outer budget so a degraded but still valid DNS/TCP/TLS/WebSocket upgrade is not misclassified by an unrealistically narrow connection cutoff. The daemon also explicitly disables client `permessage-deflate`: the relay carries bounded control/JSON traffic, while `ws` enables compression by default on clients and compression adds sender-state/CPU overhead that can queue later frames; the stability path does not need that optional negotiation. The fallback still begins independently rather than waiting thirty seconds for WSS. On first-stage WSS liveness suspicion, the same root-certified ephemeral daemon identity prewarms signed HTTPS in standby; if WSS proves live during the second-stage confirmation, that standby poller stops. If the WSS actually disconnects, fallback switches to exact-generation takeover immediately; an in-flight standby request is aborted and replaced rather than being allowed to consume up to its own request deadline before takeover can start. That in-memory session certificate intentionally has a 24-hour maximum lifetime. For the default portable JWK root, the runtime derives a fresh root-certified ephemeral session ten minutes before expiry, swaps the shared WSS/HTTPS authentication provider, and reconnects the same daemon instance so existing reconnect reconciliation can resume in-flight relay calls without `runtime.stop()`. If the machine was suspended across the renewal timer, the next authentication boundary synchronously renews before signing instead of first attempting an expired certificate. `server_info.runtime.trust.daemon_session` exposes only coarse renewal state such as `automatic_renewal`, `session_generation`, `expires_at`, `renewal_due_at`, and failure class/count; it never exposes session keys or certificate material. A Secure Enclave root does not receive unattended renewal because signing may require user presence. If unattended renewal is unavailable or repeatedly fails until the session is truly expired, the existing fail-closed path still terminates with `relay_device_session_expired` rather than retrying forever with unusable credentials; installed launchd/systemd/Windows supervision may then restart the daemon and obtain a new root-signed session, while a manually run daemon requires operator restart. Ordinary standby/ready fallback requests retain the seven-second deadline; exact-generation takeover requests use a three-second deadline until verified readiness. The ordinary one-second ready poll cadence, five-second standby-prewarm cadence, bounded one/two/four/five-second retry backoff, 750 ms hard minimum request-start interval, and twelve-second liveness window are unchanged. A new daemon-backed call waits at most fifteen seconds for some verified daemon channel, and the measured wait is deducted from that call's original execution budget; the takeover budget is deliberately small enough for one fully timed-out stale request, the first retry backoff, and two further takeover exchanges to fit inside that ceiling. After an established WSS disappears, the daemon explicitly marks its signed HTTP request as a takeover of the Worker-issued `connection_id` for that exact disconnected WebSocket generation. Once candidate preconditions pass, HTTPS may retire only that targeted same-instance zombie WSS that the Worker has not yet observed closing. If a newer same-instance WSS is already ready before the HTTP request arrives, the old generation no longer matches and the stale takeover remains standby instead of retiring the recovered socket. A takeover request without the exact Worker-issued WebSocket connection ID is invalid rather than being treated as an instance-only legacy takeover. Malformed, stale, wrongly targeted, or different-instance requests cannot preempt a healthy incumbent. During replacement, the daemon reconciles `resume_calls`, processes `ready_ack`, proves local readiness, and only then returns `resume_calls_ack.missing_ids`. A missing ID therefore proves both that the same daemon has no active/unacknowledged-result ownership for that call and that the replacement channel is ready. If the initiating MCP response is still open and at least one second remains in the original execution budget, the Worker may transparently retransmit exactly that same call ID, arguments, authority, and a reduced timeout. `read_job` is stricter: redelivery requires the full ten-second reconciliation headroom to remain, otherwise the Worker declines redelivery and returns retryable recovery failure rather than rewriting the call into an under-budget immediate read. If safe redelivery cannot be accepted, the call falls back to retryable `unavailable` with `side_effects_started=false`. Calls that may have executed, retained terminal results, different-daemon calls, and ambiguous mutations are never automatically replayed. Completed relay results that are still waiting for Worker acknowledgement remain bounded in daemon memory and consume the same recovery-ownership capacity as active calls: 16 total with two control-plane slots reserved for `diagnose_runtime`/`list_roots`. When ordinary recovery ownership reaches 14, another ordinary relay call is rejected before execution with retryable `limit_exceeded` and `side_effects_started=false`; the two reserved diagnostic/recovery calls remain available until total capacity reaches 16. The retained-result implementation also keeps one non-admission emergency ownership slot solely for a violated internal capacity invariant: if an already-executed result reaches retention after the normal 16-entry ceiling is unexpectedly full, that one result remains retained for acknowledgement/reconnect ownership instead of being sent unowned and later misclassified as safe to redeliver. Use of that slot emits an error-level capacity event and may make diagnostics temporarily report ownership above the normal maximum; a second such overflow is not sent. This slot is not usable admission capacity and must never be counted to raise the 16-call execution ceiling. An acknowledgement that is permanently lost cannot pin a result forever: first retention is monotonic and the result expires after the 315-second maximum Worker settlement lifetime on the next live relay heartbeat; the disconnected path still uses the shorter reconnect-grace cleanup. `diagnose_runtime.runtime.relay_result_recovery` exposes only aggregate `active_calls`, `retained_results`, active ownership, and capacity counts—never call IDs, tool arguments, or results. Compare outage intervals with sleep/wake records and `diagnose_runtime.runtime.relay.heartbeat` before classifying them as active network faults; local stdio `server_info.runtime.relay.heartbeat` exposes the same state. On macOS, authorized relay activity is protected only after policy/account/operation authorization and argument validation succeed, and relay heartbeats do not count as user activity. The persisted idle-sleep mode is `activity` by default, `ac-continuous`, or `continuous`: `activity` retains the existing shared `/usr/bin/caffeinate -i -s -w <daemon-pid>` assertion plus fixed thirty-minute inactivity grace; `ac-continuous` adds a daemon-lifetime `-s -w <daemon-pid>` assertion while keeping that activity lease; `continuous` holds `-i -s -w <daemon-pid>` for the daemon lifetime and does not arm inactivity grace. A remote `start_process` extends activity ownership only after resource admission and through child settlement. Remote account managed-job runners independently hold the same `-i -s -w <runner-pid>` primitive after runner-claim/account-ownership validation and through admission, steps, cleanup, and terminal persistence. Every assertion retains desired-state recovery after unexpected child failure with fixed 1/5/30-second backoff; explicit release/shutdown disables recovery before terminating the child. `diagnose_runtime.runtime.idle_sleep_guard` reports only coarse mode/activity/recovery ownership and bounded unprotected-duration telemetry; it does not enumerate process-session or job identities. Runtime shutdown terminates process sessions before releasing daemon assertions. None of these modes claims to prevent explicit sleep, lid-close sleep, power loss, or operating-system behavior outside `caffeinate` contracts. A nonzero `event_loop_stall_count` with a large `max_event_loop_lag_ms` means the local daemon was not scheduled promptly; a short stall enters recovery grace, sends a fresh transport probe, and deliberately postpones disconnect. A large stall that aligns with `pmset` Sleep/Wake is suspension evidence. Independently, `relay_outage_analysis` can show either that a close-to-ready interval was itself dominated by system sleep or that the socket failure was first observable at the wake boundary while the same sleep matches the runtime pause; a genuinely awake outage without either evidence remains real transport evidence without identifying which network/host layer caused it. A large `previous_ready_inbound_silence_ms` without a matching local stall remains useful pre-close half-open evidence. Use `--verbose` only when close codes, liveness deadlines, and retry delays are required.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "machine-bridge-mcp",
-  "version": "3.0.0-beta.191",
+  "version": "3.0.0-beta.195",
   "description": "Cross-client MCP bridge for local agent context, structured browser and application automation, files, Git, processes, resources, and durable jobs over stdio or OAuth relay.",
   "type": "module",
   "license": "MIT",
@@ -272,10 +272,10 @@
   "devDependencies": {
     "@types/node": "26.4.0",
     "eslint": "10.9.1",
-    "fast-check": "4.9.0",
+    "fast-check": "4.10.0",
     "globals": "17.11.0",
     "typescript": "7.0.2",
-    "wrangler": "4.127.1"
+    "wrangler": "4.131.2"
   },
   "keywords": [
     "mcp",
@@ -307,7 +307,7 @@
     "esbuild@0.28.1": true,
     "fsevents": false,
     "sharp@0.35.4": true,
-    "workerd@1.20260828.1": true
+    "workerd@1.20260911.1": true
   },
   "packageManager": "npm@12.0.2",
   "devEngines": {

package/src/local/relay-connection.mjs

@@ -335,7 +335,7 @@ export class RelayConnection {
       terminateSocket(socket);
       return true;
     }
-    this.failPermanently("relay_protocol_error");
+    this.failPermanently("relay_protocol_error", { diagnostics: message?.diagnostics || null });
     return true;
   }
 
@@ -521,7 +521,7 @@ export class RelayConnection {
     });
   }
 
-  failPermanently(category, { socketAlreadyClosed = false, wasReady = this.ready } = {}) {
+  failPermanently(category, { socketAlreadyClosed = false, wasReady = this.ready, diagnostics = null } = {}) {
     if (this.closed) return;
     const socket = this.socket;
     this.closed = true;
@@ -550,11 +550,12 @@ export class RelayConnection {
     this.connectedOnceResolve = null;
     this.connectedOnceReject = null;
     this.resetOutage();
+    if (diagnostics) this.logger.error?.(message, diagnostics);
     if (!this.hasConnected && reject) {
       reject(error);
       return;
     }
-    this.logger.error?.(message);
+    if (!diagnostics) this.logger.error?.(message);
     this.logger.debug?.("remote relay fatal details", { category, cause: relayCloseUserCause(category) });
     queueMicrotask(async () => {
       try {

package/src/local/resilient-relay-connection.mjs

@@ -1,6 +1,7 @@
 import relayContract from "../shared/relay-contract.json" with { type: "json" };
 import { RelayConnection } from "./relay-connection.mjs";
 import { DaemonHttpRelayConnection } from "./daemon-http-relay-connection.mjs";
+import { relayServerErrorReconnectCategory, sanitizeProtocolErrorCode } from "./relay-connection-classification.mjs";
 
 export class ResilientRelayConnection {
   constructor(options = {}) {
@@ -107,6 +108,14 @@ export class ResilientRelayConnection {
     return this.activeTransport === "https" ? this.http.currentSessionId() : this.websocket.currentSessionId();
   }
 
+  isCurrentSession(relayContext = {}) {
+    const sessionId = Number(relayContext?.sessionId) || 0;
+    if (!sessionId) return false;
+    if (relayContext?.transport === "https") return sessionId === this.http.currentSessionId();
+    if (relayContext?.transport === "websocket") return sessionId === this.websocket.currentSessionId();
+    return false;
+  }
+
   send(value) {
     if (this.activeTransport === "websocket") return this.websocket.send(value);
     if (this.activeTransport === "https") return this.http.send(value);
@@ -124,6 +133,13 @@ export class ResilientRelayConnection {
     return this.websocket.interrupt(category);
   }
 
+  interruptForContext(category, relayContext = {}) {
+    if (!this.isCurrentSession(relayContext)) return false;
+    return relayContext?.transport === "https"
+      ? this.http.interrupt(category)
+      : this.websocket.interrupt(category);
+  }
+
   refreshAuthentication() {
     const websocketInterrupted = this.websocket.interrupt("relay_session_rotated");
     const httpInterrupted = this.http.interrupt("relay_session_rotated");
@@ -139,14 +155,40 @@ export class ResilientRelayConnection {
     return this.websocket.acknowledge(message);
   }
   confirmReady(message, relayContext = {}) {
+    if (!this.isCurrentSession(relayContext)) return false;
     return relayContext?.transport === "https" ? this.http.confirmReady(message) : this.websocket.confirmReady(message);
   }
   observeApplicationPong(relayContext = {}) {
     return relayContext?.transport === "https" ? false : this.websocket.observeApplicationPong(relayContext);
   }
   handleServerError(message, relayContext = {}) {
-    if (relayContext?.transport === "https") return this.http.interrupt(message?.error);
-    return this.websocket.handleServerError(message);
+    const sessionId = Number(relayContext?.sessionId) || 0;
+    if (sessionId && !this.isCurrentSession(relayContext)) {
+      this.logger.debug?.("discarded relay error from an ended transport generation", {
+        source_transport: relayTransport(relayContext), connection_generation: "stale",
+        handshake_stage: relayHandshakeStage(relayContext),
+      });
+      return false;
+    }
+    const errorCode = sanitizeProtocolErrorCode(message?.error);
+    const reconnectCategory = relayServerErrorReconnectCategory(errorCode, {
+      authenticated: relayContext?.authenticated === true, ready: relayContext?.ready === true,
+    });
+    const sourceTransport = relayTransport(relayContext);
+    const diagnostics = {
+      error_code: errorCode, source_transport: sourceTransport,
+      connection_generation: sessionId ? "current" : "unbound",
+      handshake_stage: relayHandshakeStage(relayContext),
+    };
+    if (sourceTransport === "https") {
+      if (!reconnectCategory) this.logger.warn?.(
+        "remote HTTPS relay reported a protocol error; restarting the fallback transport",
+        { ...diagnostics, disposition: "retry_transport" },
+      );
+      return this.http.interrupt(errorCode);
+    }
+    return this.websocket.handleServerError(reconnectCategory
+      ? message : { ...message, error: errorCode, diagnostics: { ...diagnostics, disposition: "fatal_runtime" } });
   }
 
   handleReady(transport, event) {
@@ -278,3 +320,14 @@ function positiveInteger(value, fallback) {
   const number = Number(value);
   return Number.isFinite(number) && number > 0 ? Math.floor(number) : fallback;
 }
+
+function relayTransport(relayContext = {}) {
+  const transport = String(relayContext?.transport || "");
+  return transport === "websocket" || transport === "https" ? transport : "unknown";
+}
+
+function relayHandshakeStage(relayContext = {}) {
+  if (relayContext?.ready === true) return "post_ready";
+  if (relayContext?.authenticated === true) return "authenticated_pre_ready";
+  return "pre_authentication";
+}

package/src/local/runtime-relay-connection-options.mjs

@@ -18,7 +18,7 @@ export function runtimeRelayConnectionOptions(runtime, input) {
       helloMessage: async (welcome, relayStatus) => ({
         type: "hello", instance_id: runtime.relayInstanceId, tools: runtime.tools(), policy: runtime.policy,
         protocol_versions: MCP_SUPPORTED_PROTOCOL_VERSIONS,
-        relay_diagnostics: relayHandshakeDiagnostics(relayStatus),
+        relay_diagnostics: relayHandshakeDiagnostics(runtime.relay?.status?.() || relayStatus),
         authentication: await createDaemonAuthentication(currentSessionIdentity(), welcome, runtime.relayInstanceId),
       }),
       onMessage,
@@ -40,7 +40,7 @@ export function runtimeRelayConnectionOptions(runtime, input) {
       ownedCallIds: () => runtime.relayOwnedCallIds(),
       onMessage,
     },
-    onDisconnect: () => runtime.handleRelayDisconnect(),
-    onReady: () => runtime.handleRelayReady(),
+    onDisconnect: (event) => runtime.handleRelayDisconnect(event),
+    onReady: (event) => runtime.handleRelayReady(event),
   };
 }

package/src/local/runtime-relay-control.mjs

@@ -3,30 +3,69 @@ import { handleRuntimeRelayAcknowledgement } from "./runtime-relay-acknowledgeme
 import { normalizeRelayResumeCalls } from "./runtime-relay.mjs";
 import { normalizeAuthorityRevocation } from "../shared/authority-revocation.mjs";
 
+export function handleRuntimeRelayProtocolViolation(runtime, errorCode, relayContext = {}) {
+  const sessionId = Number(relayContext?.sessionId) || 0;
+  if (staleRelayGeneration(runtime, relayContext)) {
+    runtime.logger?.event?.("debug", "relay.protocol_violation.stale_generation_discarded", {
+      source_transport: relayTransport(relayContext) || "unknown",
+      connection_generation: "stale",
+      handshake_stage: relayHandshakeStage(relayContext),
+    }, "Discarded a protocol violation from an ended relay generation");
+    return;
+  }
+  if (runtime.relay) {
+    runtime.relay.handleServerError({ type: "error", error: errorCode }, relayContext);
+    return;
+  }
+  runtime.logger?.error?.("remote relay protocol error; upgrade and redeploy both components, then restart the daemon", {
+    error_code: safeMessageType(errorCode),
+    source_transport: relayTransport(relayContext) || "unknown",
+    connection_generation: sessionId ? "unknown" : "unbound",
+    handshake_stage: relayHandshakeStage(relayContext),
+    disposition: "fatal_runtime",
+  });
+}
+
+export function handleRuntimeRelayDisconnect(runtime, relayContext = {}) {
+  const transport = relayTransport(relayContext);
+  const states = relayResumeState(runtime);
+  if (!transport) states.clear();
+  else clearRelayResumeState(runtime, transport);
+  runtime.relayCallRecovery.disconnected();
+}
+
 export async function handleRuntimeRelayControlMessage(runtime, message, relayContext = {}) {
   if (message.type === "welcome") {
     runtime.relay?.observeWelcome(message, relayContext);
     return true;
   }
   if (message.type === "hello_ack") {
-    runtime.relayResumeSessionId = 0;
-    runtime.relayResumeMissingIds = [];
+    clearRelayResumeState(runtime, relayTransport(relayContext) || "websocket");
     runtime.relay?.acknowledge(message, relayContext);
     return true;
   }
+  if (staleRelayGeneration(runtime, relayContext)) {
+    runtime.logger?.event?.("debug", "relay.control.stale_generation_discarded", {
+      source_transport: relayTransport(relayContext) || "unknown",
+      connection_generation: "stale",
+      handshake_stage: relayHandshakeStage(relayContext),
+      message_type: safeMessageType(message?.type),
+    }, "Discarded a control message from an ended relay generation");
+    return true;
+  }
   if (message.type === "resume_calls") return handleResumeCalls(runtime, message, relayContext);
   if (message.type === "authority_revoke") {
     const sessionId = Number(relayContext.sessionId) || 0;
     const revocationId = String(message.revocation_id || "");
     const revocation = normalizeAuthorityRevocation(message);
     if (!sessionId || relayContext.authenticated !== true || !/^revoke_[A-Za-z0-9_-]{43}$/.test(revocationId) || !revocation) {
-      runtime.handleRelayProtocolViolation("invalid_authority_revoke");
+      runtime.handleRelayProtocolViolation("invalid_authority_revoke", relayContext);
       return true;
     }
     try {
       await runtime.applyAuthorityRevocation(revocation);
     } catch (error) {
-      runtime.relay?.interrupt?.("local_authority_revocation_retry");
+      interruptRelayContext(runtime, "local_authority_revocation_retry", relayContext);
       throw error;
     }
     runtime.relay?.sendForSession?.({ type: "authority_revoke_ack", revocation_id: revocationId }, sessionId);
@@ -34,29 +73,30 @@ export async function handleRuntimeRelayControlMessage(runtime, message, relayCo
   }
   if (message.type === "ready_ack") {
     const sessionId = Number(relayContext.sessionId) || 0;
-    if (!sessionId || sessionId !== runtime.relayResumeSessionId) {
-      runtime.handleRelayProtocolViolation("resume_calls_required");
+    const key = relayResumeKey(relayContext);
+    const resume = key ? relayResumeState(runtime).get(key) : null;
+    if (!sessionId || !resume) {
+      runtime.handleRelayProtocolViolation("resume_calls_required", relayContext);
       return true;
     }
     if (!runtime.relay?.confirmReady(message, relayContext)) {
-      runtime.relay?.interrupt?.("relay_transport_error");
+      interruptRelayContext(runtime, "relay_transport_error", relayContext);
       return true;
     }
     const acknowledgement = runtime.relay?.sendForSession?.({
       type: "resume_calls_ack",
-      missing_ids: Array.isArray(runtime.relayResumeMissingIds) ? runtime.relayResumeMissingIds : [],
+      missing_ids: Array.isArray(resume.missingIds) ? resume.missingIds : [],
     }, sessionId);
     if (!acknowledgement?.ok) {
-      runtime.relay?.interrupt?.("relay_transport_error");
+      interruptRelayContext(runtime, "relay_transport_error", relayContext);
       return true;
     }
-    runtime.relayResumeSessionId = 0;
-    runtime.relayResumeMissingIds = [];
+    relayResumeState(runtime).delete(key);
     return true;
   }
   if (message.type === "pong") return handlePong(runtime, relayContext);
   if (message.type === "tool_result_ack" || message.type === "daemon_draining_ack") {
-    return handleRuntimeRelayAcknowledgement(runtime, message, relayContext);
+    return handleRuntimeRelayAcknowledgement(runtimeForRelayContext(runtime, relayContext), message, relayContext);
   }
   if (message.type === "error") {
     runtime.relay?.handleServerError(message, relayContext);
@@ -66,7 +106,7 @@ export async function handleRuntimeRelayControlMessage(runtime, message, relayCo
     if (!isRelayReadyContext(relayContext, runtime.relay)
         || typeof message.id !== "string"
         || !/^call_[A-Za-z0-9_-]{8,240}$/.test(message.id)) {
-      runtime.handleRelayProtocolViolation("invalid_cancel_call");
+      runtime.handleRelayProtocolViolation("invalid_cancel_call", relayContext);
       return true;
     }
     runtime.cancelRelayCall(message.id, "caller_cancelled");
@@ -78,13 +118,19 @@ export async function handleRuntimeRelayControlMessage(runtime, message, relayCo
 function handleResumeCalls(runtime, message, relayContext) {
   const sessionId = Number(relayContext.sessionId) || 0;
   const resume = normalizeRelayResumeCalls(message);
-  if (!resume.ok || !sessionId || relayContext.authenticated !== true || relayContext.ready === true) {
-    runtime.handleRelayProtocolViolation("invalid_resume_calls");
+  const key = relayResumeKey(relayContext);
+  if (!resume.ok || !sessionId || !key || relayContext.authenticated !== true || relayContext.ready === true) {
+    runtime.handleRelayProtocolViolation("invalid_resume_calls", relayContext);
     return true;
   }
+  const states = relayResumeState(runtime);
+  if (states.has(key)) {
+    runtime.handleRelayProtocolViolation("invalid_resume_calls", relayContext);
+    return true;
+  }
+  clearRelayResumeState(runtime, relayTransport(relayContext));
   const missingIds = runtime.reconcileRelayCalls(resume.ids);
-  runtime.relayResumeSessionId = sessionId;
-  runtime.relayResumeMissingIds = Array.isArray(missingIds) ? missingIds : [];
+  states.set(key, { missingIds: Array.isArray(missingIds) ? missingIds : [] });
   return true;
 }
 
@@ -93,3 +139,65 @@ function handlePong(runtime, relayContext) {
   runtime.relayCallRecovery.pulse();
   return true;
 }
+
+function relayResumeState(runtime) {
+  if (!(runtime.relayResumeStates instanceof Map)) runtime.relayResumeStates = new Map();
+  return runtime.relayResumeStates;
+}
+
+function relayTransport(relayContext = {}) {
+  const value = String(relayContext?.transport || "");
+  return value === "websocket" || value === "https" ? value : "";
+}
+
+function relayResumeKey(relayContext = {}) {
+  const transport = relayTransport(relayContext);
+  const sessionId = Number(relayContext?.sessionId) || 0;
+  return transport && sessionId ? transport + ":" + sessionId : "";
+}
+
+function clearRelayResumeState(runtime, transport = "") {
+  const states = relayResumeState(runtime);
+  if (!transport) {
+    states.clear();
+    return;
+  }
+  const prefix = transport + ":";
+  for (const key of states.keys()) {
+    if (key.startsWith(prefix)) states.delete(key);
+  }
+}
+
+function staleRelayGeneration(runtime, relayContext = {}) {
+  const sessionId = Number(relayContext?.sessionId) || 0;
+  if (!sessionId || !relayTransport(relayContext) || typeof runtime.relay?.isCurrentSession !== "function") return false;
+  return runtime.relay.isCurrentSession(relayContext) !== true;
+}
+
+function interruptRelayContext(runtime, category, relayContext) {
+  if (typeof runtime.relay?.interruptForContext === "function") {
+    return runtime.relay.interruptForContext(category, relayContext);
+  }
+  return runtime.relay?.interrupt?.(category);
+}
+
+function runtimeForRelayContext(runtime, relayContext) {
+  return {
+    relay: runtime.relay,
+    relayCallRecovery: runtime.relayCallRecovery,
+    relayShutdownDrain: runtime.relayShutdownDrain,
+    handleRelayProtocolViolation(errorCode) {
+      return runtime.handleRelayProtocolViolation(errorCode, relayContext);
+    },
+  };
+}
+
+function relayHandshakeStage(relayContext = {}) {
+  if (relayContext?.ready === true) return "post_ready";
+  if (relayContext?.authenticated === true) return "authenticated_pre_ready";
+  return "pre_authentication";
+}
+
+function safeMessageType(value) {
+  return String(value || "unknown").replace(/[^A-Za-z0-9_-]/g, "_").slice(0, 64) || "unknown";
+}

package/src/local/runtime.mjs

@@ -41,7 +41,7 @@ import { policyForContext } from "./authority-context.mjs";
 import { createRuntimeRelayConnection, normalizeRelayToolCall } from "./runtime-relay.mjs"; import { relayRecoveryCapacityRejection } from "./relay-recovery-admission.mjs";
 import { runtimeControlPlaneSnapshot } from "./runtime-diagnostic-state.mjs";
 import { shortCallId } from "./short-identifiers.mjs";
-import { handleRuntimeRelayControlMessage } from "./runtime-relay-control.mjs";
+import { handleRuntimeRelayControlMessage, handleRuntimeRelayDisconnect, handleRuntimeRelayProtocolViolation } from "./runtime-relay-control.mjs";
 import { RelayCallRecovery } from "./relay-call-recovery.mjs";
 import { RuntimeRelayShutdownDrain } from "./runtime-relay-shutdown-drain.mjs";
 import { RuntimeResourceService } from "./runtime-resource-service.mjs";
@@ -83,7 +83,7 @@ export class LocalRuntime {
     this.relayInstanceId = `daemon_${randomBytes(18).toString("base64url")}`;
     this.activeRelayCalls = new Map();
     this.suppressedRelayResults = new Map();
-    this.relayResumeSessionId = 0; this.relayResumeMissingIds = [];
+    this.relayResumeStates = new Map();
     this.remoteActivityIdleSleepGuard = new RemoteActivityIdleSleepGuard({ logger: this.logger, mode: idleSleepMode });
     this.callRegistry = new CallRegistry({
       maximum: MAX_CONCURRENT_TOOL_CALLS,
@@ -359,11 +359,7 @@ export class LocalRuntime {
   handleRelayControlMessage(message, relayContext = {}) { return handleRuntimeRelayControlMessage(this, message, relayContext); }
 
   handleRelayProtocolViolation(errorCode, relayContext = {}) {
-    if (this.relay) {
-      this.relay.handleServerError({ type: "error", error: errorCode }, relayContext);
-      return;
-    }
-    this.logger.error?.("remote relay protocol error; upgrade and redeploy both components, then restart the daemon");
+    return handleRuntimeRelayProtocolViolation(this, errorCode, relayContext);
   }
 
   handleRelayProbe(message, relayContext = {}) {
@@ -452,11 +448,7 @@ export class LocalRuntime {
 
   relayOwnedCallIds() { return this.relayCallRecovery?.ownedCallIds?.() ?? [...this.activeRelayCalls.keys()]; }
 
-  handleRelayDisconnect() {
-    this.relayResumeSessionId = 0;
-    this.relayResumeMissingIds = [];
-    this.relayCallRecovery.disconnected();
-  }
+  handleRelayDisconnect(relayContext = {}) { return handleRuntimeRelayDisconnect(this, relayContext); }
 
   handleRelayReady() {
     this.relayCallRecovery.ready();

package/src/local/wrangler-toolchain/package-lock.json

@@ -8,7 +8,7 @@
       "name": "machine-bridge-mcp-wrangler-toolchain",
       "version": "1.0.0",
       "dependencies": {
-        "wrangler": "4.127.1"
+        "wrangler": "4.131.2"
       },
       "engines": {
         "node": ">=26.0.0",
@@ -40,9 +40,9 @@
       }
     },
     "node_modules/@cloudflare/workerd-darwin-64": {
-      "version": "1.20260828.1",
-      "resolved": "https://registry.npmjs.org/@cloudflare/workerd-darwin-64/-/workerd-darwin-64-1.20260828.1.tgz",
-      "integrity": "sha512-CVd+xPhqUESg8Xhq09TZx0wl4FSirfJGOzvbPz2yHhBIvmNHFFQkSN3rkd7wEwnhQQk37Xi0/aD6ykPLJbmGiQ==",
+      "version": "1.20260911.1",
+      "resolved": "https://registry.npmjs.org/@cloudflare/workerd-darwin-64/-/workerd-darwin-64-1.20260911.1.tgz",
+      "integrity": "sha512-785eaY1bkR1cm4Z/PCUeteZYmTMe6lre2zz63/GdGGimsoMsKxgl4brFPRukim8iv28EyD1XoCB/VPYF20BERA==",
       "cpu": [
         "x64"
       ],
@@ -56,9 +56,9 @@
       }
     },
     "node_modules/@cloudflare/workerd-darwin-arm64": {
-      "version": "1.20260828.1",
-      "resolved": "https://registry.npmjs.org/@cloudflare/workerd-darwin-arm64/-/workerd-darwin-arm64-1.20260828.1.tgz",
-      "integrity": "sha512-5HDPXRM152vU5JveByGFk34X57TVyIsfp4cabepAf45DC0MKvm52ucJqAjW1h8bvW4X+zRw9GU35OHF9FEC9Ww==",
+      "version": "1.20260911.1",
+      "resolved": "https://registry.npmjs.org/@cloudflare/workerd-darwin-arm64/-/workerd-darwin-arm64-1.20260911.1.tgz",
+      "integrity": "sha512-WU4bFqEN0H7ndGWxoedegv95DmNVBtv0ncXcHG9nYFTUI78sxEb0qoT3U6Ga4hyBkzsJFBX/zvVBIGX3qKldGA==",
       "cpu": [
         "arm64"
       ],
@@ -72,9 +72,9 @@
       }
     },
     "node_modules/@cloudflare/workerd-linux-64": {
-      "version": "1.20260828.1",
-      "resolved": "https://registry.npmjs.org/@cloudflare/workerd-linux-64/-/workerd-linux-64-1.20260828.1.tgz",
-      "integrity": "sha512-MQ1Ll9P7F72HHUKizbb7BlDfbY8fRoNMpbIpZoU6uKsSkneFICWSKv6UlgU9EQZ+w0i7TMa12iUgJ8l29eRI9A==",
+      "version": "1.20260911.1",
+      "resolved": "https://registry.npmjs.org/@cloudflare/workerd-linux-64/-/workerd-linux-64-1.20260911.1.tgz",
+      "integrity": "sha512-0Y2gy62oxQxWa38qinSPE6zNL5+JmumJtDY9AWW1HB8KHuATxN71o5MGzmVFfB8PwZsiHfUd2Sv7O22krCOrhw==",
       "cpu": [
         "x64"
       ],
@@ -88,9 +88,9 @@
       }
     },
     "node_modules/@cloudflare/workerd-linux-arm64": {
-      "version": "1.20260828.1",
-      "resolved": "https://registry.npmjs.org/@cloudflare/workerd-linux-arm64/-/workerd-linux-arm64-1.20260828.1.tgz",
-      "integrity": "sha512-FBTaUQ1xcU9jcp4OyBPcH8x0QiFvc1iuZL2GkD8zp2q1WyTVHYOptRDQUU+cuHjt0rQ2EIKVPBjahPxfa0joBw==",
+      "version": "1.20260911.1",
+      "resolved": "https://registry.npmjs.org/@cloudflare/workerd-linux-arm64/-/workerd-linux-arm64-1.20260911.1.tgz",
+      "integrity": "sha512-kttNPnx1r2lCqFUoMH62z7CqGV+j4QBbw5fdtaz4pzOrzBv0AWkNATt7onFUe+SwP8zhcepMtbm2F4kKzTf6VA==",
       "cpu": [
         "arm64"
       ],
@@ -104,9 +104,9 @@
       }
     },
     "node_modules/@cloudflare/workerd-windows-64": {
-      "version": "1.20260828.1",
-      "resolved": "https://registry.npmjs.org/@cloudflare/workerd-windows-64/-/workerd-windows-64-1.20260828.1.tgz",
-      "integrity": "sha512-yvr77hC7dUbvK5K+SCg062kkPq3sx+drV1PcgHslzHDYcJBtT0V3X80qLE49LW1vq2svaeNmsVQS+vHsqWu8cQ==",
+      "version": "1.20260911.1",
+      "resolved": "https://registry.npmjs.org/@cloudflare/workerd-windows-64/-/workerd-windows-64-1.20260911.1.tgz",
+      "integrity": "sha512-5iO/YfoBDOgO3CrHdkiiVP8SL3O2jC+c6Ux3d378TSPKLhU5+CgHjtE/ZSodWQrzr4FzFRqdW8S7n5nbyD1MHQ==",
       "cpu": [
         "x64"
       ],
@@ -1276,15 +1276,15 @@
       }
     },
     "node_modules/miniflare": {
-      "version": "5.20260828.0-alpha",
-      "resolved": "https://registry.npmjs.org/miniflare/-/miniflare-5.20260828.0-alpha.tgz",
-      "integrity": "sha512-6nbxhZEcz/UET3Y1OnYPsrAUjUmuFoib3ynUqteRdn1YnDxsLg8cwgZJZCk9QmtOmGzXwzXzgE/d/C0dJAPtVw==",
+      "version": "5.20260911.1-alpha",
+      "resolved": "https://registry.npmjs.org/miniflare/-/miniflare-5.20260911.1-alpha.tgz",
+      "integrity": "sha512-7IDj9monoYcCPrS8HfcTt90T3pDwKGvNEAR1Y061KbJhBd5JkStOwOpHMUDFBo9PEbjWVDxPICAnXGNNV2LNfQ==",
       "license": "MIT",
       "dependencies": {
         "@cspotcode/source-map-support": "0.8.1",
-        "sharp": "0.35.2",
+        "sharp": "0.35.4",
         "undici": "7.29.0",
-        "workerd": "1.20260828.1",
+        "workerd": "1.20260911.1",
         "ws": "8.21.0",
         "youch": "4.1.0-beta.10"
       },
@@ -1403,9 +1403,9 @@
       }
     },
     "node_modules/workerd": {
-      "version": "1.20260828.1",
-      "resolved": "https://registry.npmjs.org/workerd/-/workerd-1.20260828.1.tgz",
-      "integrity": "sha512-pB9yvt0kkwZDAGZHmpY59r0o3hM0DzdW6BJERqwZOhunZ3ssOyDSgQxOQer2cSZW4YCFeOTIQYN1qwhK5wv/Cw==",
+      "version": "1.20260911.1",
+      "resolved": "https://registry.npmjs.org/workerd/-/workerd-1.20260911.1.tgz",
+      "integrity": "sha512-vRr8QdBxueQOZJO1hRCI73EZlix87IAyBAcSyI3rA1VB+6oxjw3oaqzYnIV8C4IOPtUgihbdMAgzkb5GM4V7DQ==",
       "hasInstallScript": true,
       "license": "Apache-2.0",
       "bin": {
@@ -1415,27 +1415,27 @@
         "node": ">=16"
       },
       "optionalDependencies": {
-        "@cloudflare/workerd-darwin-64": "1.20260828.1",
-        "@cloudflare/workerd-darwin-arm64": "1.20260828.1",
-        "@cloudflare/workerd-linux-64": "1.20260828.1",
-        "@cloudflare/workerd-linux-arm64": "1.20260828.1",
-        "@cloudflare/workerd-windows-64": "1.20260828.1"
+        "@cloudflare/workerd-darwin-64": "1.20260911.1",
+        "@cloudflare/workerd-darwin-arm64": "1.20260911.1",
+        "@cloudflare/workerd-linux-64": "1.20260911.1",
+        "@cloudflare/workerd-linux-arm64": "1.20260911.1",
+        "@cloudflare/workerd-windows-64": "1.20260911.1"
       }
     },
     "node_modules/wrangler": {
-      "version": "4.127.1",
-      "resolved": "https://registry.npmjs.org/wrangler/-/wrangler-4.127.1.tgz",
-      "integrity": "sha512-OzsiNgaI8i681L/+KnAKc+uEZ5D57xK5JuNvCOpRKICF4/5Q3Cu1oTGuUiT/f3GDUqQb3gzXNT0tfOHGMEtknw==",
+      "version": "4.131.2",
+      "resolved": "https://registry.npmjs.org/wrangler/-/wrangler-4.131.2.tgz",
+      "integrity": "sha512-jmkGE7monbPKyYQr1FPQN+SARVhddqw2fhXOmTKCw4lroqlFGSS6rit/RTvPi/qzNLKrXxkS8DhWXasJnStplg==",
       "license": "MIT OR Apache-2.0",
       "dependencies": {
         "@cloudflare/kv-asset-handler": "0.5.0",
         "@cloudflare/unenv-preset": "2.16.1",
         "blake3-wasm": "2.1.5",
         "esbuild": "0.28.1",
-        "miniflare": "5.20260828.0-alpha",
+        "miniflare": "5.20260911.1-alpha",
         "path-to-regexp": "6.3.0",
         "unenv": "2.0.0-rc.24",
-        "workerd": "1.20260828.1"
+        "workerd": "1.20260911.1"
       },
       "bin": {
         "cf-wrangler": "bin/cf-wrangler.js",
@@ -1449,7 +1449,7 @@
         "fsevents": "2.3.3"
       },
       "peerDependencies": {
-        "@cloudflare/workers-types": "^5.20260828.1"
+        "@cloudflare/workers-types": "^5.20260911.1"
       },
       "peerDependenciesMeta": {
         "@cloudflare/workers-types": {

package/src/local/wrangler-toolchain/package.json

@@ -8,7 +8,7 @@
     "npm": ">=12.0.0"
   },
   "dependencies": {
-    "wrangler": "4.127.1"
+    "wrangler": "4.131.2"
   },
   "overrides": {
     "sharp": "0.35.4",
@@ -18,6 +18,6 @@
     "esbuild@0.28.1": true,
     "fsevents": false,
     "sharp@0.35.4": true,
-    "workerd@1.20260828.1": true
+    "workerd@1.20260911.1": true
   }
 }

package/src/local/wrangler-toolchain.mjs

@@ -152,13 +152,13 @@ async function runNpm(npmCli, args, cwd, runCommand, options, timeoutMs, allowFa
 }
 
 function validateTemplate(manifest, lock) {
-  if (manifest.private !== true || manifest.dependencies?.wrangler !== "4.127.1") {
+  if (manifest.private !== true || manifest.dependencies?.wrangler !== "4.131.2") {
     throw new Error("Wrangler toolchain manifest lost its exact private Wrangler dependency");
   }
   if (manifest.overrides?.undici !== "7.29.0" || manifest.overrides?.sharp !== "0.35.4") {
     throw new Error("Wrangler toolchain manifest lost its security overrides");
   }
-  const expectedScripts = { "esbuild@0.28.1": true, fsevents: false, "sharp@0.35.4": true, "workerd@1.20260828.1": true };
+  const expectedScripts = { "esbuild@0.28.1": true, fsevents: false, "sharp@0.35.4": true, "workerd@1.20260911.1": true };
   if (JSON.stringify(manifest.allowScripts) !== JSON.stringify(expectedScripts)) {
     throw new Error("Wrangler toolchain manifest lost its exact install-script policy");
   }

package/src/worker/index.ts

@@ -57,7 +57,7 @@ import { hostedManagedJobDaemonArguments, projectHostedManagedJobResult } from "
 import { cancelManagedJobMonitorClaimsIfAvailable, claimManagedJobMonitor, hasManagedJobMonitorClaimIfAvailable, ManagedJobMonitorClaimStore } from "./mcp-job-monitor-claims.ts";
 import { JOB_MONITOR_CLAIM_TOOL, JOB_MONITOR_READ_TOOL, JOB_MONITOR_RENDER_TOOL, managedJobMonitorReadDaemonArguments, projectManagedJobMonitorStatus, renderManagedJobMonitor } from "./mcp-job-monitor-tools.ts";
 import { closeWebSocketQuietly, daemonErrorCloseCode, isObjectRecord, rejectDaemonMessage, sendWebSocketQuietly, trySendWebSocket } from "./websocket-protocol.ts";
-const SERVER_VERSION = "3.0.0-beta.191";
+const SERVER_VERSION = "3.0.0-beta.195";
 const MCP_SERVER_INFO = mcpServerInfo(SERVER_VERSION);
 const MAX_DAEMON_MESSAGE_BYTES = 8 * 1024 * 1024;
 const DAEMON_RECONNECT_GRACE_MS = relayContract.reconnectGraceMs; const NEW_CALL_RECONNECT_GRACE_MS = relayContract.newCallReconnectGraceMs;