Add bounded WebSocket reads with absolute deadlines and ciphertext progress windows, plus in-memory non-blocking admission gates for global and per-sender browser-blob receives. Wire relay dispatch and blob receive deadlines with saturation telemetry while keeping the wire format, on-disk state, MAX_CT_LEN, pairing path, and forwarding path unchanged; all guards are in-memory and reset to zero on process restart. Add the lost-ACK retry proof showing that a fresh-blob_id retry after duplicate prune resolves to the manifest-backed survivor as a duplicate, sends the correlated ACK, and does not recreate the pruned segment directory. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>