Lifecycle

client                                server
  │── initialize ───────────────────────▶│  version + capabilities
  │── device/describe ──────────────────▶│  descriptor into agent context
  │── session/acquire {ttl:600} ────────▶│  optional exclusive control
  │── signals/subscribe ────────────────▶│  optional streaming
  │── settings/write / actions/invoke ──▶│  operate (gated by §7)
  │◀─ notifications/... ─────────────────│
  │── session/renew (< watchdog_s) ─────▶│  keeps the lease and the watchdog fed
  │── session/release ──────────────────▶│

Watchdog. If the descriptor declares safety.watchdog_s, the watchdog is armed whenever a session holds the lease. Any request from the holder renews it; the reference client sends session/renew at a third of the window. If the holder is silent for longer than the window, or its lease expires without release, the server MUST fail safe: enter estop, cancel active jobs, run the stop hook, and drop the lease. Recovery needs a verified safety/reset. The watchdog protects against the controlling process dying or losing its connection; it does not notice a model that is alive but idle. A driver running inside the host process dies with the host, so host power loss is covered only by a device-side or hardware watchdog, which the descriptor should describe in safety.notes.

Versioning. protocolVersion is a date string, as in MCP. A server MUST answer initialize with the highest version it supports that is ≤ the client's; a client that receives an older version MUST either speak it or disconnect. The MCP bridge negotiates MCP versions separately: it answers with the client's version when it supports it, and otherwise with its newest supported version.