Upgrade an authenticated application socket

Upcoming, not deployed. Browser admission requires the current session, exactly one configured browser Origin, no Authorization header, and the WebSocket subprotocol assign.realtime.v1. Native mobile admission requires one native access-token Authorization bearer, no Origin or Cookie header, and the same subprotocol. The optional X-Assign-Workspace-ID header selects a current authorized Workspace for native Workspace scopes; omit it for Account-only scopes. No query parameters or URL credentials are accepted. IDE admission also accepts a developer OAuth bearer issued to assign-jetbrains or assign-vscode with assign:read. It forbids Origin, Cookie and URL credentials. The grant fixes the Workspace; an optional X-Assign-Workspace-ID must match it. IDE tokens admit only workspace, projects and task_comments scopes, never Account or Discuss scopes. CLI, MCP and personal API tokens do not admit application sockets. Every active subscription rechecks the exact access token, grant, client, scope and current membership; reconnect after expiry/revocation requires valid authentication and new baseline custody. This operation is a WebSocket upgrade, not a JSON GET. HTTP SDK methods do not implement the upgraded transport; use the application WebSocket owner. JSON control frames negotiate bounded subscriptions and independent applied ACKs. Account/security scopes omit workspace_id and carry no client-supplied User identity. Inbox and personal Project scopes require workspace_id. A visible application owner may send presence_renew with an applied Workspace subscription ID and cursor. It renews only that owner's eligible human Workspace lease; transport pongs do not renew presence. An applied Workspace owner may send presence_observe with that cursor and up to 256 distinct active human member User IDs. An empty list clears observation. Authorized snapshots carry an epoch, revision and complete selected online states; presence_unknown clears confidence on source, observer or authorization loss. Wake recovery requires a fresh snapshot. Ordinary Workspace subscriptions exclude private collection hints. The discuss scope uses a separate session-bound private sequence and content-free message identity hints; its cursor is not a Workspace journal position. Source health is separate from canonical applied state. See the public realtime guide for authentication, scope and recovery rules.