Lifecycle

client                                server
  │── initialize ───────────────────────▶│  version + capabilities
  │── device/describe ──────────────────▶│  descriptor into agent context
  │── session/acquire {ttl:600} ────────▶│  optional exclusive control
  │── signals/subscribe ────────────────▶│  optional streaming
  │── settings/write / actions/invoke ──▶│  operate, gated by §7
  │◀─ notifications/... ─────────────────│
  │── ping (within watchdog_s) ─────────▶│  keeps the watchdog fed
  │── session/release ──────────────────▶│

Watchdog. If the descriptor declares safety.watchdog_s, the server MUST fail safe (the device-specific equivalent of e-stop, or at minimum refusing further writes) when it has received no request from the lease holder within that window. This is what protects the lab when the agent process dies mid-protocol.

Versioning. protocolVersion is a date string, as in MCP. A server MUST answer with the highest version it supports that is not newer than the client's; a client that receives an older version MUST either speak it or disconnect.