machine-bridge-mcp 3.0.0-beta.192 → 3.0.0-beta.195

package/CHANGELOG.md

@@ -1,12 +1,9 @@
 # Changelog
 
-## 3.0.0-beta.192 - 2026-09-16
+## 3.0.0-beta.195 - 2026-09-18
 
-- Replace the shipped current-audit document's stale release chronology with version-agnostic security, continuity, privacy, and residual-limit invariants; repository hygiene now rejects numbered prerelease chronology and mutable acceptance/candidate authority claims.
-- Keep WebSocket daemon handshake diagnostics aligned with the resilient relay wrapper so Worker `server_info` preserves the same bounded per-outage HTTPS fallback takeover attribution as HTTPS descriptors and local diagnostics; private relay values remain excluded, and execution/replay semantics are unchanged.
-- Keep durable managed-job execution available across in-place Node package-manager upgrades by falling back from a removed daemon `process.execPath` only to the still-executable absolute Node launcher that originally started the daemon; diagnostics expose provenance/availability without local paths.
-- Make macOS sleep diagnosis retain actual timestamped `Sleep` records with a bounded 15-second power-log probe, avoiding the previous five-second timeout and broad filter that could hide evidence explaining relay suspension.
-- Add regressions for stale runtime launcher recovery and sleep-probe boundaries; relay authentication, replay, duplicate-side-effect prevention, and reconnect policy are unchanged.
+- Update the fast-check development dependency from 4.9.0 to 4.10.0 and refresh its resolved lockfile entry.
+- Preserve the beta.194 Wrangler/toolchain and relay changes while advancing release identity to beta.195 so this dependency update receives independent full verification, live candidate canary, and exact acceptance evidence.
 
 ## Historical releases
 

package/browser-extension/manifest.json

@@ -30,6 +30,6 @@
   "action": {
     "default_title": "Machine Bridge Browser"
   },
-  "version_name": "3.0.0-beta.192",
+  "version_name": "3.0.0-beta.195",
   "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxryYkpZhq8+VAQLHcGS9BAHQcyKX8RHGIpIwvtIVRU/rcOcE0bNdnM0aZJ/h6xWQsGDHlhvjT2+1aJaAn/9k8473BRWajzVXld961CdHYVFVHoce2hHiSJ0xydWrHMMZhAm0mN0UzjEpgZ0tMw209efcZHIvSwuxhteZMRy4kyiVjwFlOf5oXFCxRuCJnPj3AK9CmCf4XgEBuPIJ0TZmjGHOOdBvJmbCNnAWXYEo5/mf7MfCGhV4IJ1hNuhpoNQfOFKMUcw9/v/IpT62XpfXdGYTfGYCmCjC+gntK1spbkr2P4/2+sYMQtLpse71mpSNGXfcf3abU55Vpn+gncSxRQIDAQAB"
 }

package/docs/AUDIT.md

@@ -9,7 +9,7 @@ This file is a compact statement of current cross-cutting audit conclusions and
 - **State publication is atomic and identity-sensitive.** Security-sensitive state readers reject symlinks, unexpected hard links, malformed content, permission failures, and persistent identity changes. Bounded retries are reserved for explicitly classified atomic-publication races; durable state is complete before it becomes visible.
 - **Durable execution owns continuity explicitly.** Managed jobs persist recovery state independently of the hosted MCP response. Idempotency keys bind uncertain acceptance retries only while the retained record exists; cancellation, dependency state, cleanup, output budgets, and terminal persistence have explicit fail-closed boundaries. Callers recover the same accepted job instead of replaying its side effect.
 - **Daemon-owned Node children use a verified runtime launcher.** A live concrete runtime executable is preferred; if it disappears after a package-manager upgrade, only the original absolute Node launcher is eligible as fallback. Diagnostics expose provenance booleans rather than executable paths, and an unavailable launcher requires service restart instead of PATH guessing.
-- **Relay recovery separates transport from execution semantics.** WebSocket and signed HTTPS are transport paths, not permission or replay authorities. Ambiguous side effects are not transparently replayed. Same-daemon terminal-result retention is bounded, cancellation removes ownership, and repeated reconnects cannot accumulate execution time or delivery grace. Relay diagnostics project the same privacy-bounded fallback takeover history across WebSocket and HTTPS control paths.
+- **Relay recovery separates transport from execution semantics.** WebSocket and signed HTTPS are transport paths, not permission or replay authorities. Their authenticated handshake/resume state is generation-scoped per transport, ended-generation control messages are discarded before reconciliation or interruption, and a protocol violation is routed only to its originating current transport. Ambiguous side effects are not transparently replayed. Same-daemon terminal-result retention is bounded, cancellation removes ownership, and repeated reconnects cannot accumulate execution time or delivery grace. Fatal protocol diagnostics retain only sanitized error/source/generation-class/stage/disposition fields, while fallback takeover history remains privacy-bounded across both control paths.
 - **Operating-system sleep is an observable suspension boundary, not a network guarantee.** On supported macOS hosts, diagnostics correlate bounded sleep history with runtime stalls and recovered relay outages. Machine Bridge cannot keep JavaScript or a socket executing while the machine is suspended, and sleep correlation does not identify unrelated upstream network causes.
 - **Browser automation remains existing-profile and snapshot-bound.** The extension controls an already installed Chromium profile; hosted calls bind explicit tab identity, and later Computer Use actions bind the exact observation snapshot. Mutation response loss, timeout, extension replacement, or ambiguous trusted-input settlement yields an unknown/non-retryable boundary that must be inspected before any retry.
 - **Desktop automation is permission- and evidence-bound.** Application actions use structured Accessibility operations or an explicitly enabled snapshot-bound visual backend. The runtime does not silently substitute arbitrary scripting or unverified pixel guessing when required authority/evidence is unavailable.

package/docs/LOGGING.md

@@ -72,7 +72,7 @@ Brief network interruptions are expected on laptop network changes, Worker deplo
 - a separate periodic twenty-five-second application heartbeat refreshes Worker daemon activity and retains a seventy-five-second application-silence timeout; it begins only after end-to-end readiness, so authenticated probing cannot send a message type that the Worker probing state does not accept. Protocol-level Pong therefore cannot mask a Worker application path that has stopped replying. The Worker queues the heartbeat's JSON `pong` before Durable Object alarm inspection or mutation, then performs one explicit coalesced schedule, so storage latency is not allowed to sit ahead of application-liveness acknowledgement;
 - a late local transport-watchdog tick is classified as `runtime.event_loop.stall`, sends a fresh transport probe, and defers disconnect for a bounded recovery interval instead of being mislabeled as immediate remote failure; a macOS sleep/wake interval may legitimately produce this warning without a daemon fault. The heartbeat snapshot retains the lag of the last actual stall separately from the rolling maximum. Owner `diagnose_runtime` can compare that end time and duration with a bounded fixed `pmset` sleep-history projection and reports `matched_system_sleep` only when both dimensions agree within the fixed tolerance; an unmatched stall remains unclassified rather than being labeled synchronous JavaScript blockage by elimination. The same diagnostic also intersects the most recent completed relay disconnect interval with that bounded sleep history and reports only outage/overlap timing plus a fixed classification; `majority_system_sleep_overlap` means host suspension dominated the observed outage, so a retained `connection_reset` is aftermath evidence rather than sufficient independent-network evidence. An authorized, schema-valid remote tool call enters macOS activity protection only after policy/account/operation authorization and argument validation succeed; remote process sessions extend that ownership through child settlement. The default `activity` mode keeps the existing shared `/usr/bin/caffeinate -i -s -w <owner-pid>` assertion and fixed thirty-minute rolling inactivity grace. `ac-continuous` adds a daemon-lifetime `-s` assertion, while `continuous` holds `-i -s` for the daemon lifetime and does not arm inactivity grace. Unexpected assertion-child failure retains desired-state ownership and schedules bounded 1/5/30-second recovery; explicit release/shutdown cancels pending recovery. `runtime.idle_sleep_guard.unavailable` still records only a coarse `error_class`, never argv, paths, PID, tool name/content, session identity, or job identity; mode, generation, restart count, recovery-pending state, and bounded unprotected-duration telemetry are exposed through diagnostics rather than logs. Remote account managed-job runners own the same self-healing assertion primitive only after runner-claim confirmation and persisted account ownership validation; local managed jobs do not acquire this remote-continuity assertion. The remote runner fallback stderr diagnostic remains the fixed text `managed job idle-sleep assertion unavailable` plus a sanitized coarse `error_class`, without job name/id, workspace path, argv, environment, or captured output.
 
-A WebSocket close code such as `1006` means the transport ended without a normal close handshake, but it does not identify who initiated termination: Machine Bridge's own liveness recovery calls `terminate()` when a transport/send timeout is confirmed, and that local hard close can surface as 1006. Diagnose the cause from `last_close_category`, transport-confirmation/send-timeout evidence, and retained network milestones rather than treating 1006 itself as proof of a remote/network-initiated close. If it recovers inside ten seconds, the warning-level service log is intentionally silent and the authenticated `daemon.relay_transport` snapshot is the post-event evidence surface. It is useful for debug diagnosis but not useful as the default user message. It is not evidence that the daemon process restarted. Worker `daemon_transport_error` / `daemon_liveness_timeout` messages and their 1012 close frames are likewise retryable connection conditions, not upgrade instructions. Only an unknown/incompatible Worker error, authentication failure, or identity/version mismatch may produce the fatal protocol/configuration log and daemon exit. Default logs therefore describe the affected layer, duration, classification, and recovery behavior rather than printing raw close envelopes.
+A WebSocket close code such as `1006` means the transport ended without a normal close handshake, but it does not identify who initiated termination: Machine Bridge's own liveness recovery calls `terminate()` when a transport/send timeout is confirmed, and that local hard close can surface as 1006. Diagnose the cause from `last_close_category`, transport-confirmation/send-timeout evidence, and retained network milestones rather than treating 1006 itself as proof of a remote/network-initiated close. If it recovers inside ten seconds, the warning-level service log is intentionally silent and the authenticated `daemon.relay_transport` snapshot is the post-event evidence surface. It is useful for debug diagnosis but not useful as the default user message. It is not evidence that the daemon process restarted. Worker `daemon_transport_error` / `daemon_liveness_timeout` messages and their 1012 close frames are likewise retryable connection conditions, not upgrade instructions. Only an unknown/incompatible Worker error, authentication failure, or identity/version mismatch may produce the fatal protocol/configuration log and daemon exit. A fatal relay protocol log retains only a sanitized protocol error code, source transport (WebSocket or HTTPS), coarse connection-generation class, handshake stage, and fatal/retry disposition; it never records the numeric session generation, endpoint, credentials, account identity, call IDs, or message payload. Default logs therefore describe the affected layer, duration, classification, and recovery behavior rather than printing raw close envelopes.
 
 Streamed-call diagnostics are deliberately coarse. MCP `2026-07-28` request/response-stream ownership and the Worker pending-call registry are memory-only; there is no protocol-session, terminal-result, subscriber, or replay store. Worker event counters are scoped to the current isolate and say so in `metric_scope`, while `server_info` exposes only bounded current pending-call/capacity state. These diagnostics do not prove public SSE consumption or MCP-host receipt. Logs and `server_info` must not include tool arguments, terminal results, command text, request keys, account identifiers, raw call IDs, raw connection generations, mirrored parameter values, private paths, or subscriber payloads. A stale-generation result is counted as unmatched rather than logged with its envelope.
 

package/docs/OPERATIONS.md

@@ -93,7 +93,7 @@ After the host path recovers, compare authenticated `server_info`, `machine-mcp
 
 ### Relay interruption messages
 
-A reconnect warning proves a transport interruption, not a daemon crash. Compare daemon PID and process start time with `connected_at`, `last_seen_at`, `daemon.relay_transport.last_close_category`, `last_close_code`, `outage_count`, `recent_outages`, `outage_attempts`, `previous_ready_inbound_silence_ms`, `last_connect_milestones_ms`, and the coarse network-route class. In each completed `recent_outages` entry, `disconnected_at` is the first transition into that outage, `last_disconnect_at` is the final failed reconnect/close transition, `ready_at` is verified recovery, and `duration_ms` measures first-disconnect-to-ready time. The bounded `probe_dispatch_pending_at_start`, `probe_dispatch_age_ms_at_start`, `probe_outstanding_at_start`, `probe_age_ms_at_start`, `transport_confirmation_pending_at_start`, and `application_inbound_silence_ms_at_start` fields freeze the liveness phase at that first transition. Use them to test hypotheses such as a failure coinciding with the first five-second protocol Ping, but do not treat that timing correlation as proof that Ping caused the reset. Also distinguish a planned restart from an accidental outage: a current-generation daemon sends `daemon_draining` before relay close, affected calls receive `reason=daemon_planned_drain`, and owner/full `server_info.worker.continuity_evidence` schema 2 durably retains the planned-drain count/time plus bounded socket-disconnect and client-cancellation observations across Worker isolate replacement. Treat `ready_socket_disconnects`, `unplanned_ready_socket_disconnects`, and `last_ready_socket_disconnect` as the qualified durable socket-outage evidence; the broader `socket_disconnects` counters include candidate/probing transport churn. `last_socket_disconnect.role`, `was_ready`, and `connected_at` identify whether the newest first-observed close/error had ever become the authoritative ready channel. Planned-drain intent is serialized into the WebSocket attachment before close so a Durable Object isolate replacement cannot turn a planned shutdown into an unplanned disconnect. Schema-1 disconnect counts are intentionally reset during the schema-2 transition because old isolates could count stale/expired close callbacks more than once. `worker.observability.continuity` remains isolate-local and may reset; use the qualified durable summary for post-incident correlation rather than relying on a later close-1006 inference. For hosted `read_job`, recover with the same returned `job_id` plus its `recovery_key`; do not resubmit the job's underlying mutation. If the job predates capability issuance or its capability was never delivered, use local CLI/stdio administration instead of attempting hosted global discovery. `last_connect_milestones_ms` contains only bounded relative timings for the most recent connection attempt phases such as DNS resolution, TCP connect, TLS establishment, HTTP rejection, and WebSocket open; `last_failed_connect_stage`, `last_failed_connect_duration_ms`, `last_failed_connect_milestones_ms`, and `last_failed_connect_http_status` retain the most recent failed attempt even after a later retry succeeds. `last_transport_error_ready` and `last_transport_error_authenticated` distinguish failure of an already-established channel from a pre-readiness connection failure. `last_transport_error_reason` is a strict privacy-safe allowlist (`connection_reset`, `connection_timeout`, `network_unreachable`, bounded DNS/TLS classes, or `unknown`) rather than the raw operating-system message. The signed HTTPS fallback retains its last error class/reason after a later successful poll while resetting the current `http_poll_failures` count, so post-recovery diagnosis can determine whether WSS and HTTPS failed through the same system-network episode. None of these fields contains a hostname, address, DNS answer, certificate, close reason, or proxy endpoint. While no daemon channel is ready, `server_info.daemon.previous_connection` retains only the last verified channel's transport, connected/last-seen/disconnected timestamps, and sanitized relay diagnostics; it excludes policy, tools, account identity, daemon instance/connection identity, call IDs, arguments, and results, and it never participates in routing or authorization. `outage_duration_ms` measures the close-to-ready recovery episode; `previous_ready_inbound_silence_ms` measures how long the preceding ready socket had stopped producing inbound transport proof before it actually closed. The second value is therefore the field that exposes a black-holed OPEN WebSocket whose visible reconnect later completes quickly. A VPN/TUN UI may remain “connected” while its upstream route is unusable. Local OS logs can be compared with the exact `last_disconnected_at` timestamp, but an interface-quality change or tunnel-process correlation is not by itself proof of which product, node, edge, or upstream failed. Correlated failure of an independent HTTPS client at the same timestamp—for example an external API `unexpected EOF` while the relay records WebSocket 1006/`connection_reset`—is stronger evidence of a shared system-network/VPN/TUN episode than of a Machine Bridge event-loop or resource-admission failure; it still does not identify the failing tunnel node or upstream provider. Machine Bridge reports only coarse route/proxy classes and never sends or logs interface names, addresses, DNS answers, proxy credentials, or Worker secrets.
+A reconnect warning proves a transport interruption, not a daemon crash. When the daemon instead exits on a relay protocol error, inspect the same default service-log entry for the sanitized protocol error code, source transport, coarse generation class, handshake stage, and disposition; those fields distinguish a current-generation fatal WebSocket violation from a retryable HTTPS fallback violation without exposing raw connection identifiers. Compare daemon PID and process start time with `connected_at`, `last_seen_at`, `daemon.relay_transport.last_close_category`, `last_close_code`, `outage_count`, `recent_outages`, `outage_attempts`, `previous_ready_inbound_silence_ms`, `last_connect_milestones_ms`, and the coarse network-route class. In each completed `recent_outages` entry, `disconnected_at` is the first transition into that outage, `last_disconnect_at` is the final failed reconnect/close transition, `ready_at` is verified recovery, and `duration_ms` measures first-disconnect-to-ready time. The bounded `probe_dispatch_pending_at_start`, `probe_dispatch_age_ms_at_start`, `probe_outstanding_at_start`, `probe_age_ms_at_start`, `transport_confirmation_pending_at_start`, and `application_inbound_silence_ms_at_start` fields freeze the liveness phase at that first transition. Use them to test hypotheses such as a failure coinciding with the first five-second protocol Ping, but do not treat that timing correlation as proof that Ping caused the reset. Also distinguish a planned restart from an accidental outage: a current-generation daemon sends `daemon_draining` before relay close, affected calls receive `reason=daemon_planned_drain`, and owner/full `server_info.worker.continuity_evidence` schema 2 durably retains the planned-drain count/time plus bounded socket-disconnect and client-cancellation observations across Worker isolate replacement. Treat `ready_socket_disconnects`, `unplanned_ready_socket_disconnects`, and `last_ready_socket_disconnect` as the qualified durable socket-outage evidence; the broader `socket_disconnects` counters include candidate/probing transport churn. `last_socket_disconnect.role`, `was_ready`, and `connected_at` identify whether the newest first-observed close/error had ever become the authoritative ready channel. Planned-drain intent is serialized into the WebSocket attachment before close so a Durable Object isolate replacement cannot turn a planned shutdown into an unplanned disconnect. Schema-1 disconnect counts are intentionally reset during the schema-2 transition because old isolates could count stale/expired close callbacks more than once. `worker.observability.continuity` remains isolate-local and may reset; use the qualified durable summary for post-incident correlation rather than relying on a later close-1006 inference. For hosted `read_job`, recover with the same returned `job_id` plus its `recovery_key`; do not resubmit the job's underlying mutation. If the job predates capability issuance or its capability was never delivered, use local CLI/stdio administration instead of attempting hosted global discovery. `last_connect_milestones_ms` contains only bounded relative timings for the most recent connection attempt phases such as DNS resolution, TCP connect, TLS establishment, HTTP rejection, and WebSocket open; `last_failed_connect_stage`, `last_failed_connect_duration_ms`, `last_failed_connect_milestones_ms`, and `last_failed_connect_http_status` retain the most recent failed attempt even after a later retry succeeds. `last_transport_error_ready` and `last_transport_error_authenticated` distinguish failure of an already-established channel from a pre-readiness connection failure. `last_transport_error_reason` is a strict privacy-safe allowlist (`connection_reset`, `connection_timeout`, `network_unreachable`, bounded DNS/TLS classes, or `unknown`) rather than the raw operating-system message. The signed HTTPS fallback retains its last error class/reason after a later successful poll while resetting the current `http_poll_failures` count, so post-recovery diagnosis can determine whether WSS and HTTPS failed through the same system-network episode. None of these fields contains a hostname, address, DNS answer, certificate, close reason, or proxy endpoint. While no daemon channel is ready, `server_info.daemon.previous_connection` retains only the last verified channel's transport, connected/last-seen/disconnected timestamps, and sanitized relay diagnostics; it excludes policy, tools, account identity, daemon instance/connection identity, call IDs, arguments, and results, and it never participates in routing or authorization. `outage_duration_ms` measures the close-to-ready recovery episode; `previous_ready_inbound_silence_ms` measures how long the preceding ready socket had stopped producing inbound transport proof before it actually closed. The second value is therefore the field that exposes a black-holed OPEN WebSocket whose visible reconnect later completes quickly. A VPN/TUN UI may remain “connected” while its upstream route is unusable. Local OS logs can be compared with the exact `last_disconnected_at` timestamp, but an interface-quality change or tunnel-process correlation is not by itself proof of which product, node, edge, or upstream failed. Correlated failure of an independent HTTPS client at the same timestamp—for example an external API `unexpected EOF` while the relay records WebSocket 1006/`connection_reset`—is stronger evidence of a shared system-network/VPN/TUN episode than of a Machine Bridge event-loop or resource-admission failure; it still does not identify the failing tunnel node or upstream provider. Machine Bridge reports only coarse route/proxy classes and never sends or logs interface names, addresses, DNS answers, proxy credentials, or Worker secrets.
 
 Brief retryable outages recover automatically. On a verified current daemon channel, `server_info.daemon.relay_transport.outage_active=false`; retained fields describe the immediately preceding transport episode rather than claiming a current outage. WebSocket remains preferred and requests a protocol-level probe after five seconds. Calling `ws.ping()` only queues the control frame; it is not treated as remote-probe dispatch until the WebSocket sender's write callback confirms that the Ping actually left the local send queue. The local sender has a separate thirty-second bounded dispatch window, while a confirmed Ping retains its full ten-second Pong deadline. This deliberately prevents compression/backpressure or a slow local socket queue from spending the remote-response budget before any probe was transmitted. A protocol Pong that arrives while a Ping callback is still pending records bidirectional proof for that dispatch round; if the local write callback then completes inside the thirty-second dispatch budget, it does not arm a stale future Pong deadline. Unrelated application inbound is receive-side evidence only and cannot prove the daemon-to-Worker direction. A local queue whose Ping write callback still has not completed after thirty seconds is classified as `relay_transport_send_timeout` even if unrelated inbound traffic continues. One dispatched Ping that reaches the ten-second response deadline does not hard-kill an otherwise ready WSS: the relay runtime enters a fifteen-second `transport_confirmation_pending` window, sends the existing JSON application heartbeat as an independent path check, and prewarms signed HTTPS in standby without taking ownership away from the still-ready WSS. A protocol Pong or the explicit JSON application `pong` clears suspicion and stops standby prewarm; ordinary tool/control traffic does not, because it proves only the Worker-to-daemon receive direction. Only a second-stage confirmation window that receives no application `pong` becomes `relay_transport_timeout` and terminates the WSS. This keeps a true black hole bounded while no longer amplifying a roughly ten-to-fifteen-second persistent-flow stall into an immediate reconnect storm. `heartbeat.probe_dispatch_*`, `heartbeat.transport_confirmation_*`, and bounded sender-backlog fields distinguish local send delay, first-stage response loss, successful second-stage recovery, and confirmed two-stage failure. The separate periodic JSON application heartbeat remains twenty-five seconds with a seventy-five-second application-silence timeout, begins only after verified relay readiness, and the Worker keeps a wider ninety-second WebSocket liveness fallback. This is a detection/recovery bound, not a guarantee that a degraded network can complete another WebSocket handshake inside the same interval. WebSocket connect attempts have a thirty-second outer budget so a degraded but still valid DNS/TCP/TLS/WebSocket upgrade is not misclassified by an unrealistically narrow connection cutoff. The daemon also explicitly disables client `permessage-deflate`: the relay carries bounded control/JSON traffic, while `ws` enables compression by default on clients and compression adds sender-state/CPU overhead that can queue later frames; the stability path does not need that optional negotiation. The fallback still begins independently rather than waiting thirty seconds for WSS. On first-stage WSS liveness suspicion, the same root-certified ephemeral daemon identity prewarms signed HTTPS in standby; if WSS proves live during the second-stage confirmation, that standby poller stops. If the WSS actually disconnects, fallback switches to exact-generation takeover immediately; an in-flight standby request is aborted and replaced rather than being allowed to consume up to its own request deadline before takeover can start. That in-memory session certificate intentionally has a 24-hour maximum lifetime. For the default portable JWK root, the runtime derives a fresh root-certified ephemeral session ten minutes before expiry, swaps the shared WSS/HTTPS authentication provider, and reconnects the same daemon instance so existing reconnect reconciliation can resume in-flight relay calls without `runtime.stop()`. If the machine was suspended across the renewal timer, the next authentication boundary synchronously renews before signing instead of first attempting an expired certificate. `server_info.runtime.trust.daemon_session` exposes only coarse renewal state such as `automatic_renewal`, `session_generation`, `expires_at`, `renewal_due_at`, and failure class/count; it never exposes session keys or certificate material. A Secure Enclave root does not receive unattended renewal because signing may require user presence. If unattended renewal is unavailable or repeatedly fails until the session is truly expired, the existing fail-closed path still terminates with `relay_device_session_expired` rather than retrying forever with unusable credentials; installed launchd/systemd/Windows supervision may then restart the daemon and obtain a new root-signed session, while a manually run daemon requires operator restart. Ordinary standby/ready fallback requests retain the seven-second deadline; exact-generation takeover requests use a three-second deadline until verified readiness. The ordinary one-second ready poll cadence, five-second standby-prewarm cadence, bounded one/two/four/five-second retry backoff, 750 ms hard minimum request-start interval, and twelve-second liveness window are unchanged. A new daemon-backed call waits at most fifteen seconds for some verified daemon channel, and the measured wait is deducted from that call's original execution budget; the takeover budget is deliberately small enough for one fully timed-out stale request, the first retry backoff, and two further takeover exchanges to fit inside that ceiling. After an established WSS disappears, the daemon explicitly marks its signed HTTP request as a takeover of the Worker-issued `connection_id` for that exact disconnected WebSocket generation. Once candidate preconditions pass, HTTPS may retire only that targeted same-instance zombie WSS that the Worker has not yet observed closing. If a newer same-instance WSS is already ready before the HTTP request arrives, the old generation no longer matches and the stale takeover remains standby instead of retiring the recovered socket. A takeover request without the exact Worker-issued WebSocket connection ID is invalid rather than being treated as an instance-only legacy takeover. Malformed, stale, wrongly targeted, or different-instance requests cannot preempt a healthy incumbent. During replacement, the daemon reconciles `resume_calls`, processes `ready_ack`, proves local readiness, and only then returns `resume_calls_ack.missing_ids`. A missing ID therefore proves both that the same daemon has no active/unacknowledged-result ownership for that call and that the replacement channel is ready. If the initiating MCP response is still open and at least one second remains in the original execution budget, the Worker may transparently retransmit exactly that same call ID, arguments, authority, and a reduced timeout. `read_job` is stricter: redelivery requires the full ten-second reconciliation headroom to remain, otherwise the Worker declines redelivery and returns retryable recovery failure rather than rewriting the call into an under-budget immediate read. If safe redelivery cannot be accepted, the call falls back to retryable `unavailable` with `side_effects_started=false`. Calls that may have executed, retained terminal results, different-daemon calls, and ambiguous mutations are never automatically replayed. Completed relay results that are still waiting for Worker acknowledgement remain bounded in daemon memory and consume the same recovery-ownership capacity as active calls: 16 total with two control-plane slots reserved for `diagnose_runtime`/`list_roots`. When ordinary recovery ownership reaches 14, another ordinary relay call is rejected before execution with retryable `limit_exceeded` and `side_effects_started=false`; the two reserved diagnostic/recovery calls remain available until total capacity reaches 16. The retained-result implementation also keeps one non-admission emergency ownership slot solely for a violated internal capacity invariant: if an already-executed result reaches retention after the normal 16-entry ceiling is unexpectedly full, that one result remains retained for acknowledgement/reconnect ownership instead of being sent unowned and later misclassified as safe to redeliver. Use of that slot emits an error-level capacity event and may make diagnostics temporarily report ownership above the normal maximum; a second such overflow is not sent. This slot is not usable admission capacity and must never be counted to raise the 16-call execution ceiling. An acknowledgement that is permanently lost cannot pin a result forever: first retention is monotonic and the result expires after the 315-second maximum Worker settlement lifetime on the next live relay heartbeat; the disconnected path still uses the shorter reconnect-grace cleanup. `diagnose_runtime.runtime.relay_result_recovery` exposes only aggregate `active_calls`, `retained_results`, active ownership, and capacity counts—never call IDs, tool arguments, or results. Compare outage intervals with sleep/wake records and `diagnose_runtime.runtime.relay.heartbeat` before classifying them as active network faults; local stdio `server_info.runtime.relay.heartbeat` exposes the same state. On macOS, authorized relay activity is protected only after policy/account/operation authorization and argument validation succeed, and relay heartbeats do not count as user activity. The persisted idle-sleep mode is `activity` by default, `ac-continuous`, or `continuous`: `activity` retains the existing shared `/usr/bin/caffeinate -i -s -w <daemon-pid>` assertion plus fixed thirty-minute inactivity grace; `ac-continuous` adds a daemon-lifetime `-s -w <daemon-pid>` assertion while keeping that activity lease; `continuous` holds `-i -s -w <daemon-pid>` for the daemon lifetime and does not arm inactivity grace. A remote `start_process` extends activity ownership only after resource admission and through child settlement. Remote account managed-job runners independently hold the same `-i -s -w <runner-pid>` primitive after runner-claim/account-ownership validation and through admission, steps, cleanup, and terminal persistence. Every assertion retains desired-state recovery after unexpected child failure with fixed 1/5/30-second backoff; explicit release/shutdown disables recovery before terminating the child. `diagnose_runtime.runtime.idle_sleep_guard` reports only coarse mode/activity/recovery ownership and bounded unprotected-duration telemetry; it does not enumerate process-session or job identities. Runtime shutdown terminates process sessions before releasing daemon assertions. None of these modes claims to prevent explicit sleep, lid-close sleep, power loss, or operating-system behavior outside `caffeinate` contracts. A nonzero `event_loop_stall_count` with a large `max_event_loop_lag_ms` means the local daemon was not scheduled promptly; a short stall enters recovery grace, sends a fresh transport probe, and deliberately postpones disconnect. A large stall that aligns with `pmset` Sleep/Wake is suspension evidence. Independently, `relay_outage_analysis` can show either that a close-to-ready interval was itself dominated by system sleep or that the socket failure was first observable at the wake boundary while the same sleep matches the runtime pause; a genuinely awake outage without either evidence remains real transport evidence without identifying which network/host layer caused it. A large `previous_ready_inbound_silence_ms` without a matching local stall remains useful pre-close half-open evidence. Use `--verbose` only when close codes, liveness deadlines, and retry delays are required.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "machine-bridge-mcp",
-  "version": "3.0.0-beta.192",
+  "version": "3.0.0-beta.195",
   "description": "Cross-client MCP bridge for local agent context, structured browser and application automation, files, Git, processes, resources, and durable jobs over stdio or OAuth relay.",
   "type": "module",
   "license": "MIT",
@@ -272,10 +272,10 @@
   "devDependencies": {
     "@types/node": "26.4.0",
     "eslint": "10.9.1",
-    "fast-check": "4.9.0",
+    "fast-check": "4.10.0",
     "globals": "17.11.0",
     "typescript": "7.0.2",
-    "wrangler": "4.127.1"
+    "wrangler": "4.131.2"
   },
   "keywords": [
     "mcp",
@@ -307,7 +307,7 @@
     "esbuild@0.28.1": true,
     "fsevents": false,
     "sharp@0.35.4": true,
-    "workerd@1.20260828.1": true
+    "workerd@1.20260911.1": true
   },
   "packageManager": "npm@12.0.2",
   "devEngines": {

package/src/local/relay-connection.mjs

@@ -335,7 +335,7 @@ export class RelayConnection {
       terminateSocket(socket);
       return true;
     }
-    this.failPermanently("relay_protocol_error");
+    this.failPermanently("relay_protocol_error", { diagnostics: message?.diagnostics || null });
     return true;
   }
 
@@ -521,7 +521,7 @@ export class RelayConnection {
     });
   }
 
-  failPermanently(category, { socketAlreadyClosed = false, wasReady = this.ready } = {}) {
+  failPermanently(category, { socketAlreadyClosed = false, wasReady = this.ready, diagnostics = null } = {}) {
     if (this.closed) return;
     const socket = this.socket;
     this.closed = true;
@@ -550,11 +550,12 @@ export class RelayConnection {
     this.connectedOnceResolve = null;
     this.connectedOnceReject = null;
     this.resetOutage();
+    if (diagnostics) this.logger.error?.(message, diagnostics);
     if (!this.hasConnected && reject) {
       reject(error);
       return;
     }
-    this.logger.error?.(message);
+    if (!diagnostics) this.logger.error?.(message);
     this.logger.debug?.("remote relay fatal details", { category, cause: relayCloseUserCause(category) });
     queueMicrotask(async () => {
       try {

package/src/local/resilient-relay-connection.mjs

@@ -1,6 +1,7 @@
 import relayContract from "../shared/relay-contract.json" with { type: "json" };
 import { RelayConnection } from "./relay-connection.mjs";
 import { DaemonHttpRelayConnection } from "./daemon-http-relay-connection.mjs";
+import { relayServerErrorReconnectCategory, sanitizeProtocolErrorCode } from "./relay-connection-classification.mjs";
 
 export class ResilientRelayConnection {
   constructor(options = {}) {
@@ -107,6 +108,14 @@ export class ResilientRelayConnection {
     return this.activeTransport === "https" ? this.http.currentSessionId() : this.websocket.currentSessionId();
   }
 
+  isCurrentSession(relayContext = {}) {
+    const sessionId = Number(relayContext?.sessionId) || 0;
+    if (!sessionId) return false;
+    if (relayContext?.transport === "https") return sessionId === this.http.currentSessionId();
+    if (relayContext?.transport === "websocket") return sessionId === this.websocket.currentSessionId();
+    return false;
+  }
+
   send(value) {
     if (this.activeTransport === "websocket") return this.websocket.send(value);
     if (this.activeTransport === "https") return this.http.send(value);
@@ -124,6 +133,13 @@ export class ResilientRelayConnection {
     return this.websocket.interrupt(category);
   }
 
+  interruptForContext(category, relayContext = {}) {
+    if (!this.isCurrentSession(relayContext)) return false;
+    return relayContext?.transport === "https"
+      ? this.http.interrupt(category)
+      : this.websocket.interrupt(category);
+  }
+
   refreshAuthentication() {
     const websocketInterrupted = this.websocket.interrupt("relay_session_rotated");
     const httpInterrupted = this.http.interrupt("relay_session_rotated");
@@ -139,14 +155,40 @@ export class ResilientRelayConnection {
     return this.websocket.acknowledge(message);
   }
   confirmReady(message, relayContext = {}) {
+    if (!this.isCurrentSession(relayContext)) return false;
     return relayContext?.transport === "https" ? this.http.confirmReady(message) : this.websocket.confirmReady(message);
   }
   observeApplicationPong(relayContext = {}) {
     return relayContext?.transport === "https" ? false : this.websocket.observeApplicationPong(relayContext);
   }
   handleServerError(message, relayContext = {}) {
-    if (relayContext?.transport === "https") return this.http.interrupt(message?.error);
-    return this.websocket.handleServerError(message);
+    const sessionId = Number(relayContext?.sessionId) || 0;
+    if (sessionId && !this.isCurrentSession(relayContext)) {
+      this.logger.debug?.("discarded relay error from an ended transport generation", {
+        source_transport: relayTransport(relayContext), connection_generation: "stale",
+        handshake_stage: relayHandshakeStage(relayContext),
+      });
+      return false;
+    }
+    const errorCode = sanitizeProtocolErrorCode(message?.error);
+    const reconnectCategory = relayServerErrorReconnectCategory(errorCode, {
+      authenticated: relayContext?.authenticated === true, ready: relayContext?.ready === true,
+    });
+    const sourceTransport = relayTransport(relayContext);
+    const diagnostics = {
+      error_code: errorCode, source_transport: sourceTransport,
+      connection_generation: sessionId ? "current" : "unbound",
+      handshake_stage: relayHandshakeStage(relayContext),
+    };
+    if (sourceTransport === "https") {
+      if (!reconnectCategory) this.logger.warn?.(
+        "remote HTTPS relay reported a protocol error; restarting the fallback transport",
+        { ...diagnostics, disposition: "retry_transport" },
+      );
+      return this.http.interrupt(errorCode);
+    }
+    return this.websocket.handleServerError(reconnectCategory
+      ? message : { ...message, error: errorCode, diagnostics: { ...diagnostics, disposition: "fatal_runtime" } });
   }
 
   handleReady(transport, event) {
@@ -278,3 +320,14 @@ function positiveInteger(value, fallback) {
   const number = Number(value);
   return Number.isFinite(number) && number > 0 ? Math.floor(number) : fallback;
 }
+
+function relayTransport(relayContext = {}) {
+  const transport = String(relayContext?.transport || "");
+  return transport === "websocket" || transport === "https" ? transport : "unknown";
+}
+
+function relayHandshakeStage(relayContext = {}) {
+  if (relayContext?.ready === true) return "post_ready";
+  if (relayContext?.authenticated === true) return "authenticated_pre_ready";
+  return "pre_authentication";
+}

package/src/local/runtime-relay-connection-options.mjs

@@ -40,7 +40,7 @@ export function runtimeRelayConnectionOptions(runtime, input) {
       ownedCallIds: () => runtime.relayOwnedCallIds(),
       onMessage,
     },
-    onDisconnect: () => runtime.handleRelayDisconnect(),
-    onReady: () => runtime.handleRelayReady(),
+    onDisconnect: (event) => runtime.handleRelayDisconnect(event),
+    onReady: (event) => runtime.handleRelayReady(event),
   };
 }

package/src/local/runtime-relay-control.mjs

@@ -3,30 +3,69 @@ import { handleRuntimeRelayAcknowledgement } from "./runtime-relay-acknowledgeme
 import { normalizeRelayResumeCalls } from "./runtime-relay.mjs";
 import { normalizeAuthorityRevocation } from "../shared/authority-revocation.mjs";
 
+export function handleRuntimeRelayProtocolViolation(runtime, errorCode, relayContext = {}) {
+  const sessionId = Number(relayContext?.sessionId) || 0;
+  if (staleRelayGeneration(runtime, relayContext)) {
+    runtime.logger?.event?.("debug", "relay.protocol_violation.stale_generation_discarded", {
+      source_transport: relayTransport(relayContext) || "unknown",
+      connection_generation: "stale",
+      handshake_stage: relayHandshakeStage(relayContext),
+    }, "Discarded a protocol violation from an ended relay generation");
+    return;
+  }
+  if (runtime.relay) {
+    runtime.relay.handleServerError({ type: "error", error: errorCode }, relayContext);
+    return;
+  }
+  runtime.logger?.error?.("remote relay protocol error; upgrade and redeploy both components, then restart the daemon", {
+    error_code: safeMessageType(errorCode),
+    source_transport: relayTransport(relayContext) || "unknown",
+    connection_generation: sessionId ? "unknown" : "unbound",
+    handshake_stage: relayHandshakeStage(relayContext),
+    disposition: "fatal_runtime",
+  });
+}
+
+export function handleRuntimeRelayDisconnect(runtime, relayContext = {}) {
+  const transport = relayTransport(relayContext);
+  const states = relayResumeState(runtime);
+  if (!transport) states.clear();
+  else clearRelayResumeState(runtime, transport);
+  runtime.relayCallRecovery.disconnected();
+}
+
 export async function handleRuntimeRelayControlMessage(runtime, message, relayContext = {}) {
   if (message.type === "welcome") {
     runtime.relay?.observeWelcome(message, relayContext);
     return true;
   }
   if (message.type === "hello_ack") {
-    runtime.relayResumeSessionId = 0;
-    runtime.relayResumeMissingIds = [];
+    clearRelayResumeState(runtime, relayTransport(relayContext) || "websocket");
     runtime.relay?.acknowledge(message, relayContext);
     return true;
   }
+  if (staleRelayGeneration(runtime, relayContext)) {
+    runtime.logger?.event?.("debug", "relay.control.stale_generation_discarded", {
+      source_transport: relayTransport(relayContext) || "unknown",
+      connection_generation: "stale",
+      handshake_stage: relayHandshakeStage(relayContext),
+      message_type: safeMessageType(message?.type),
+    }, "Discarded a control message from an ended relay generation");
+    return true;
+  }
   if (message.type === "resume_calls") return handleResumeCalls(runtime, message, relayContext);
   if (message.type === "authority_revoke") {
     const sessionId = Number(relayContext.sessionId) || 0;
     const revocationId = String(message.revocation_id || "");
     const revocation = normalizeAuthorityRevocation(message);
     if (!sessionId || relayContext.authenticated !== true || !/^revoke_[A-Za-z0-9_-]{43}$/.test(revocationId) || !revocation) {
-      runtime.handleRelayProtocolViolation("invalid_authority_revoke");
+      runtime.handleRelayProtocolViolation("invalid_authority_revoke", relayContext);
       return true;
     }
     try {
       await runtime.applyAuthorityRevocation(revocation);
     } catch (error) {
-      runtime.relay?.interrupt?.("local_authority_revocation_retry");
+      interruptRelayContext(runtime, "local_authority_revocation_retry", relayContext);
       throw error;
     }
     runtime.relay?.sendForSession?.({ type: "authority_revoke_ack", revocation_id: revocationId }, sessionId);
@@ -34,29 +73,30 @@ export async function handleRuntimeRelayControlMessage(runtime, message, relayCo
   }
   if (message.type === "ready_ack") {
     const sessionId = Number(relayContext.sessionId) || 0;
-    if (!sessionId || sessionId !== runtime.relayResumeSessionId) {
-      runtime.handleRelayProtocolViolation("resume_calls_required");
+    const key = relayResumeKey(relayContext);
+    const resume = key ? relayResumeState(runtime).get(key) : null;
+    if (!sessionId || !resume) {
+      runtime.handleRelayProtocolViolation("resume_calls_required", relayContext);
       return true;
     }
     if (!runtime.relay?.confirmReady(message, relayContext)) {
-      runtime.relay?.interrupt?.("relay_transport_error");
+      interruptRelayContext(runtime, "relay_transport_error", relayContext);
       return true;
     }
     const acknowledgement = runtime.relay?.sendForSession?.({
       type: "resume_calls_ack",
-      missing_ids: Array.isArray(runtime.relayResumeMissingIds) ? runtime.relayResumeMissingIds : [],
+      missing_ids: Array.isArray(resume.missingIds) ? resume.missingIds : [],
     }, sessionId);
     if (!acknowledgement?.ok) {
-      runtime.relay?.interrupt?.("relay_transport_error");
+      interruptRelayContext(runtime, "relay_transport_error", relayContext);
       return true;
     }
-    runtime.relayResumeSessionId = 0;
-    runtime.relayResumeMissingIds = [];
+    relayResumeState(runtime).delete(key);
     return true;
   }
   if (message.type === "pong") return handlePong(runtime, relayContext);
   if (message.type === "tool_result_ack" || message.type === "daemon_draining_ack") {
-    return handleRuntimeRelayAcknowledgement(runtime, message, relayContext);
+    return handleRuntimeRelayAcknowledgement(runtimeForRelayContext(runtime, relayContext), message, relayContext);
   }
   if (message.type === "error") {
     runtime.relay?.handleServerError(message, relayContext);
@@ -66,7 +106,7 @@ export async function handleRuntimeRelayControlMessage(runtime, message, relayCo
     if (!isRelayReadyContext(relayContext, runtime.relay)
         || typeof message.id !== "string"
         || !/^call_[A-Za-z0-9_-]{8,240}$/.test(message.id)) {
-      runtime.handleRelayProtocolViolation("invalid_cancel_call");
+      runtime.handleRelayProtocolViolation("invalid_cancel_call", relayContext);
       return true;
     }
     runtime.cancelRelayCall(message.id, "caller_cancelled");
@@ -78,13 +118,19 @@ export async function handleRuntimeRelayControlMessage(runtime, message, relayCo
 function handleResumeCalls(runtime, message, relayContext) {
   const sessionId = Number(relayContext.sessionId) || 0;
   const resume = normalizeRelayResumeCalls(message);
-  if (!resume.ok || !sessionId || relayContext.authenticated !== true || relayContext.ready === true) {
-    runtime.handleRelayProtocolViolation("invalid_resume_calls");
+  const key = relayResumeKey(relayContext);
+  if (!resume.ok || !sessionId || !key || relayContext.authenticated !== true || relayContext.ready === true) {
+    runtime.handleRelayProtocolViolation("invalid_resume_calls", relayContext);
     return true;
   }
+  const states = relayResumeState(runtime);
+  if (states.has(key)) {
+    runtime.handleRelayProtocolViolation("invalid_resume_calls", relayContext);
+    return true;
+  }
+  clearRelayResumeState(runtime, relayTransport(relayContext));
   const missingIds = runtime.reconcileRelayCalls(resume.ids);
-  runtime.relayResumeSessionId = sessionId;
-  runtime.relayResumeMissingIds = Array.isArray(missingIds) ? missingIds : [];
+  states.set(key, { missingIds: Array.isArray(missingIds) ? missingIds : [] });
   return true;
 }
 
@@ -93,3 +139,65 @@ function handlePong(runtime, relayContext) {
   runtime.relayCallRecovery.pulse();
   return true;
 }
+
+function relayResumeState(runtime) {
+  if (!(runtime.relayResumeStates instanceof Map)) runtime.relayResumeStates = new Map();
+  return runtime.relayResumeStates;
+}
+
+function relayTransport(relayContext = {}) {
+  const value = String(relayContext?.transport || "");
+  return value === "websocket" || value === "https" ? value : "";
+}
+
+function relayResumeKey(relayContext = {}) {
+  const transport = relayTransport(relayContext);
+  const sessionId = Number(relayContext?.sessionId) || 0;
+  return transport && sessionId ? transport + ":" + sessionId : "";
+}
+
+function clearRelayResumeState(runtime, transport = "") {
+  const states = relayResumeState(runtime);
+  if (!transport) {
+    states.clear();
+    return;
+  }
+  const prefix = transport + ":";
+  for (const key of states.keys()) {
+    if (key.startsWith(prefix)) states.delete(key);
+  }
+}
+
+function staleRelayGeneration(runtime, relayContext = {}) {
+  const sessionId = Number(relayContext?.sessionId) || 0;
+  if (!sessionId || !relayTransport(relayContext) || typeof runtime.relay?.isCurrentSession !== "function") return false;
+  return runtime.relay.isCurrentSession(relayContext) !== true;
+}
+
+function interruptRelayContext(runtime, category, relayContext) {
+  if (typeof runtime.relay?.interruptForContext === "function") {
+    return runtime.relay.interruptForContext(category, relayContext);
+  }
+  return runtime.relay?.interrupt?.(category);
+}
+
+function runtimeForRelayContext(runtime, relayContext) {
+  return {
+    relay: runtime.relay,
+    relayCallRecovery: runtime.relayCallRecovery,
+    relayShutdownDrain: runtime.relayShutdownDrain,
+    handleRelayProtocolViolation(errorCode) {
+      return runtime.handleRelayProtocolViolation(errorCode, relayContext);
+    },
+  };
+}
+
+function relayHandshakeStage(relayContext = {}) {
+  if (relayContext?.ready === true) return "post_ready";
+  if (relayContext?.authenticated === true) return "authenticated_pre_ready";
+  return "pre_authentication";
+}
+
+function safeMessageType(value) {
+  return String(value || "unknown").replace(/[^A-Za-z0-9_-]/g, "_").slice(0, 64) || "unknown";
+}

package/src/local/runtime.mjs

@@ -41,7 +41,7 @@ import { policyForContext } from "./authority-context.mjs";
 import { createRuntimeRelayConnection, normalizeRelayToolCall } from "./runtime-relay.mjs"; import { relayRecoveryCapacityRejection } from "./relay-recovery-admission.mjs";
 import { runtimeControlPlaneSnapshot } from "./runtime-diagnostic-state.mjs";
 import { shortCallId } from "./short-identifiers.mjs";
-import { handleRuntimeRelayControlMessage } from "./runtime-relay-control.mjs";
+import { handleRuntimeRelayControlMessage, handleRuntimeRelayDisconnect, handleRuntimeRelayProtocolViolation } from "./runtime-relay-control.mjs";
 import { RelayCallRecovery } from "./relay-call-recovery.mjs";
 import { RuntimeRelayShutdownDrain } from "./runtime-relay-shutdown-drain.mjs";
 import { RuntimeResourceService } from "./runtime-resource-service.mjs";
@@ -83,7 +83,7 @@ export class LocalRuntime {
     this.relayInstanceId = `daemon_${randomBytes(18).toString("base64url")}`;
     this.activeRelayCalls = new Map();
     this.suppressedRelayResults = new Map();
-    this.relayResumeSessionId = 0; this.relayResumeMissingIds = [];
+    this.relayResumeStates = new Map();
     this.remoteActivityIdleSleepGuard = new RemoteActivityIdleSleepGuard({ logger: this.logger, mode: idleSleepMode });
     this.callRegistry = new CallRegistry({
       maximum: MAX_CONCURRENT_TOOL_CALLS,
@@ -359,11 +359,7 @@ export class LocalRuntime {
   handleRelayControlMessage(message, relayContext = {}) { return handleRuntimeRelayControlMessage(this, message, relayContext); }
 
   handleRelayProtocolViolation(errorCode, relayContext = {}) {
-    if (this.relay) {
-      this.relay.handleServerError({ type: "error", error: errorCode }, relayContext);
-      return;
-    }
-    this.logger.error?.("remote relay protocol error; upgrade and redeploy both components, then restart the daemon");
+    return handleRuntimeRelayProtocolViolation(this, errorCode, relayContext);
   }
 
   handleRelayProbe(message, relayContext = {}) {
@@ -452,11 +448,7 @@ export class LocalRuntime {
 
   relayOwnedCallIds() { return this.relayCallRecovery?.ownedCallIds?.() ?? [...this.activeRelayCalls.keys()]; }
 
-  handleRelayDisconnect() {
-    this.relayResumeSessionId = 0;
-    this.relayResumeMissingIds = [];
-    this.relayCallRecovery.disconnected();
-  }
+  handleRelayDisconnect(relayContext = {}) { return handleRuntimeRelayDisconnect(this, relayContext); }
 
   handleRelayReady() {
     this.relayCallRecovery.ready();

package/src/local/wrangler-toolchain/package-lock.json

@@ -8,7 +8,7 @@
       "name": "machine-bridge-mcp-wrangler-toolchain",
       "version": "1.0.0",
       "dependencies": {
-        "wrangler": "4.127.1"
+        "wrangler": "4.131.2"
       },
       "engines": {
         "node": ">=26.0.0",
@@ -40,9 +40,9 @@
       }
     },
     "node_modules/@cloudflare/workerd-darwin-64": {
-      "version": "1.20260828.1",
-      "resolved": "https://registry.npmjs.org/@cloudflare/workerd-darwin-64/-/workerd-darwin-64-1.20260828.1.tgz",
-      "integrity": "sha512-CVd+xPhqUESg8Xhq09TZx0wl4FSirfJGOzvbPz2yHhBIvmNHFFQkSN3rkd7wEwnhQQk37Xi0/aD6ykPLJbmGiQ==",
+      "version": "1.20260911.1",
+      "resolved": "https://registry.npmjs.org/@cloudflare/workerd-darwin-64/-/workerd-darwin-64-1.20260911.1.tgz",
+      "integrity": "sha512-785eaY1bkR1cm4Z/PCUeteZYmTMe6lre2zz63/GdGGimsoMsKxgl4brFPRukim8iv28EyD1XoCB/VPYF20BERA==",
       "cpu": [
         "x64"
       ],
@@ -56,9 +56,9 @@
       }
     },
     "node_modules/@cloudflare/workerd-darwin-arm64": {
-      "version": "1.20260828.1",
-      "resolved": "https://registry.npmjs.org/@cloudflare/workerd-darwin-arm64/-/workerd-darwin-arm64-1.20260828.1.tgz",
-      "integrity": "sha512-5HDPXRM152vU5JveByGFk34X57TVyIsfp4cabepAf45DC0MKvm52ucJqAjW1h8bvW4X+zRw9GU35OHF9FEC9Ww==",
+      "version": "1.20260911.1",
+      "resolved": "https://registry.npmjs.org/@cloudflare/workerd-darwin-arm64/-/workerd-darwin-arm64-1.20260911.1.tgz",
+      "integrity": "sha512-WU4bFqEN0H7ndGWxoedegv95DmNVBtv0ncXcHG9nYFTUI78sxEb0qoT3U6Ga4hyBkzsJFBX/zvVBIGX3qKldGA==",
       "cpu": [
         "arm64"
       ],
@@ -72,9 +72,9 @@
       }
     },
     "node_modules/@cloudflare/workerd-linux-64": {
-      "version": "1.20260828.1",
-      "resolved": "https://registry.npmjs.org/@cloudflare/workerd-linux-64/-/workerd-linux-64-1.20260828.1.tgz",
-      "integrity": "sha512-MQ1Ll9P7F72HHUKizbb7BlDfbY8fRoNMpbIpZoU6uKsSkneFICWSKv6UlgU9EQZ+w0i7TMa12iUgJ8l29eRI9A==",
+      "version": "1.20260911.1",
+      "resolved": "https://registry.npmjs.org/@cloudflare/workerd-linux-64/-/workerd-linux-64-1.20260911.1.tgz",
+      "integrity": "sha512-0Y2gy62oxQxWa38qinSPE6zNL5+JmumJtDY9AWW1HB8KHuATxN71o5MGzmVFfB8PwZsiHfUd2Sv7O22krCOrhw==",
       "cpu": [
         "x64"
       ],
@@ -88,9 +88,9 @@
       }
     },
     "node_modules/@cloudflare/workerd-linux-arm64": {
-      "version": "1.20260828.1",
-      "resolved": "https://registry.npmjs.org/@cloudflare/workerd-linux-arm64/-/workerd-linux-arm64-1.20260828.1.tgz",
-      "integrity": "sha512-FBTaUQ1xcU9jcp4OyBPcH8x0QiFvc1iuZL2GkD8zp2q1WyTVHYOptRDQUU+cuHjt0rQ2EIKVPBjahPxfa0joBw==",
+      "version": "1.20260911.1",
+      "resolved": "https://registry.npmjs.org/@cloudflare/workerd-linux-arm64/-/workerd-linux-arm64-1.20260911.1.tgz",
+      "integrity": "sha512-kttNPnx1r2lCqFUoMH62z7CqGV+j4QBbw5fdtaz4pzOrzBv0AWkNATt7onFUe+SwP8zhcepMtbm2F4kKzTf6VA==",
       "cpu": [
         "arm64"
       ],
@@ -104,9 +104,9 @@
       }
     },
     "node_modules/@cloudflare/workerd-windows-64": {
-      "version": "1.20260828.1",
-      "resolved": "https://registry.npmjs.org/@cloudflare/workerd-windows-64/-/workerd-windows-64-1.20260828.1.tgz",
-      "integrity": "sha512-yvr77hC7dUbvK5K+SCg062kkPq3sx+drV1PcgHslzHDYcJBtT0V3X80qLE49LW1vq2svaeNmsVQS+vHsqWu8cQ==",
+      "version": "1.20260911.1",
+      "resolved": "https://registry.npmjs.org/@cloudflare/workerd-windows-64/-/workerd-windows-64-1.20260911.1.tgz",
+      "integrity": "sha512-5iO/YfoBDOgO3CrHdkiiVP8SL3O2jC+c6Ux3d378TSPKLhU5+CgHjtE/ZSodWQrzr4FzFRqdW8S7n5nbyD1MHQ==",
       "cpu": [
         "x64"
       ],
@@ -1276,15 +1276,15 @@
       }
     },
     "node_modules/miniflare": {
-      "version": "5.20260828.0-alpha",
-      "resolved": "https://registry.npmjs.org/miniflare/-/miniflare-5.20260828.0-alpha.tgz",
-      "integrity": "sha512-6nbxhZEcz/UET3Y1OnYPsrAUjUmuFoib3ynUqteRdn1YnDxsLg8cwgZJZCk9QmtOmGzXwzXzgE/d/C0dJAPtVw==",
+      "version": "5.20260911.1-alpha",
+      "resolved": "https://registry.npmjs.org/miniflare/-/miniflare-5.20260911.1-alpha.tgz",
+      "integrity": "sha512-7IDj9monoYcCPrS8HfcTt90T3pDwKGvNEAR1Y061KbJhBd5JkStOwOpHMUDFBo9PEbjWVDxPICAnXGNNV2LNfQ==",
       "license": "MIT",
       "dependencies": {
         "@cspotcode/source-map-support": "0.8.1",
-        "sharp": "0.35.2",
+        "sharp": "0.35.4",
         "undici": "7.29.0",
-        "workerd": "1.20260828.1",
+        "workerd": "1.20260911.1",
         "ws": "8.21.0",
         "youch": "4.1.0-beta.10"
       },
@@ -1403,9 +1403,9 @@
       }
     },
     "node_modules/workerd": {
-      "version": "1.20260828.1",
-      "resolved": "https://registry.npmjs.org/workerd/-/workerd-1.20260828.1.tgz",
-      "integrity": "sha512-pB9yvt0kkwZDAGZHmpY59r0o3hM0DzdW6BJERqwZOhunZ3ssOyDSgQxOQer2cSZW4YCFeOTIQYN1qwhK5wv/Cw==",
+      "version": "1.20260911.1",
+      "resolved": "https://registry.npmjs.org/workerd/-/workerd-1.20260911.1.tgz",
+      "integrity": "sha512-vRr8QdBxueQOZJO1hRCI73EZlix87IAyBAcSyI3rA1VB+6oxjw3oaqzYnIV8C4IOPtUgihbdMAgzkb5GM4V7DQ==",
       "hasInstallScript": true,
       "license": "Apache-2.0",
       "bin": {
@@ -1415,27 +1415,27 @@
         "node": ">=16"
       },
       "optionalDependencies": {
-        "@cloudflare/workerd-darwin-64": "1.20260828.1",
-        "@cloudflare/workerd-darwin-arm64": "1.20260828.1",
-        "@cloudflare/workerd-linux-64": "1.20260828.1",
-        "@cloudflare/workerd-linux-arm64": "1.20260828.1",
-        "@cloudflare/workerd-windows-64": "1.20260828.1"
+        "@cloudflare/workerd-darwin-64": "1.20260911.1",
+        "@cloudflare/workerd-darwin-arm64": "1.20260911.1",
+        "@cloudflare/workerd-linux-64": "1.20260911.1",
+        "@cloudflare/workerd-linux-arm64": "1.20260911.1",
+        "@cloudflare/workerd-windows-64": "1.20260911.1"
       }
     },
     "node_modules/wrangler": {
-      "version": "4.127.1",
-      "resolved": "https://registry.npmjs.org/wrangler/-/wrangler-4.127.1.tgz",
-      "integrity": "sha512-OzsiNgaI8i681L/+KnAKc+uEZ5D57xK5JuNvCOpRKICF4/5Q3Cu1oTGuUiT/f3GDUqQb3gzXNT0tfOHGMEtknw==",
+      "version": "4.131.2",
+      "resolved": "https://registry.npmjs.org/wrangler/-/wrangler-4.131.2.tgz",
+      "integrity": "sha512-jmkGE7monbPKyYQr1FPQN+SARVhddqw2fhXOmTKCw4lroqlFGSS6rit/RTvPi/qzNLKrXxkS8DhWXasJnStplg==",
       "license": "MIT OR Apache-2.0",
       "dependencies": {
         "@cloudflare/kv-asset-handler": "0.5.0",
         "@cloudflare/unenv-preset": "2.16.1",
         "blake3-wasm": "2.1.5",
         "esbuild": "0.28.1",
-        "miniflare": "5.20260828.0-alpha",
+        "miniflare": "5.20260911.1-alpha",
         "path-to-regexp": "6.3.0",
         "unenv": "2.0.0-rc.24",
-        "workerd": "1.20260828.1"
+        "workerd": "1.20260911.1"
       },
       "bin": {
         "cf-wrangler": "bin/cf-wrangler.js",
@@ -1449,7 +1449,7 @@
         "fsevents": "2.3.3"
       },
       "peerDependencies": {
-        "@cloudflare/workers-types": "^5.20260828.1"
+        "@cloudflare/workers-types": "^5.20260911.1"
       },
       "peerDependenciesMeta": {
         "@cloudflare/workers-types": {

package/src/local/wrangler-toolchain/package.json

@@ -8,7 +8,7 @@
     "npm": ">=12.0.0"
   },
   "dependencies": {
-    "wrangler": "4.127.1"
+    "wrangler": "4.131.2"
   },
   "overrides": {
     "sharp": "0.35.4",
@@ -18,6 +18,6 @@
     "esbuild@0.28.1": true,
     "fsevents": false,
     "sharp@0.35.4": true,
-    "workerd@1.20260828.1": true
+    "workerd@1.20260911.1": true
   }
 }

package/src/local/wrangler-toolchain.mjs

@@ -152,13 +152,13 @@ async function runNpm(npmCli, args, cwd, runCommand, options, timeoutMs, allowFa
 }
 
 function validateTemplate(manifest, lock) {
-  if (manifest.private !== true || manifest.dependencies?.wrangler !== "4.127.1") {
+  if (manifest.private !== true || manifest.dependencies?.wrangler !== "4.131.2") {
     throw new Error("Wrangler toolchain manifest lost its exact private Wrangler dependency");
   }
   if (manifest.overrides?.undici !== "7.29.0" || manifest.overrides?.sharp !== "0.35.4") {
     throw new Error("Wrangler toolchain manifest lost its security overrides");
   }
-  const expectedScripts = { "esbuild@0.28.1": true, fsevents: false, "sharp@0.35.4": true, "workerd@1.20260828.1": true };
+  const expectedScripts = { "esbuild@0.28.1": true, fsevents: false, "sharp@0.35.4": true, "workerd@1.20260911.1": true };
   if (JSON.stringify(manifest.allowScripts) !== JSON.stringify(expectedScripts)) {
     throw new Error("Wrangler toolchain manifest lost its exact install-script policy");
   }

package/src/worker/index.ts

@@ -57,7 +57,7 @@ import { hostedManagedJobDaemonArguments, projectHostedManagedJobResult } from "
 import { cancelManagedJobMonitorClaimsIfAvailable, claimManagedJobMonitor, hasManagedJobMonitorClaimIfAvailable, ManagedJobMonitorClaimStore } from "./mcp-job-monitor-claims.ts";
 import { JOB_MONITOR_CLAIM_TOOL, JOB_MONITOR_READ_TOOL, JOB_MONITOR_RENDER_TOOL, managedJobMonitorReadDaemonArguments, projectManagedJobMonitorStatus, renderManagedJobMonitor } from "./mcp-job-monitor-tools.ts";
 import { closeWebSocketQuietly, daemonErrorCloseCode, isObjectRecord, rejectDaemonMessage, sendWebSocketQuietly, trySendWebSocket } from "./websocket-protocol.ts";
-const SERVER_VERSION = "3.0.0-beta.192";
+const SERVER_VERSION = "3.0.0-beta.195";
 const MCP_SERVER_INFO = mcpServerInfo(SERVER_VERSION);
 const MAX_DAEMON_MESSAGE_BYTES = 8 * 1024 * 1024;
 const DAEMON_RECONNECT_GRACE_MS = relayContract.reconnectGraceMs; const NEW_CALL_RECONNECT_GRACE_MS = relayContract.newCallReconnectGraceMs;