Problem
Dynamic n.eko surfaces already stop after the idle TTL when their browser state can be restored from the persistent profile. ChatGPT is deliberately different: its provider API session is held in the live browser process, so retainSurfaceProcess excludes it from idle and capacity cleanup.
That protects authentication, but it means each retained account can hold a Chromium, X11, n.eko process, WebRTC port, and allocator slot indefinitely. Two retained ChatGPT surfaces on the development instance were recently observed running for more than 26 hours.
Putting several authenticated accounts in one browser container is not an acceptable shortcut. It would enlarge the failure and security boundary and make account isolation harder to verify.
Required outcome
Add a bounded lifecycle for retained browser surfaces without weakening account isolation or causing unnecessary reconnect prompts.
- Never suspend or stop a surface with an active run, lease, stream, or owner interaction.
- After a configurable idle grace period, move an inactive retained surface into a state that materially reclaims resources.
- Resume it on demand and verify the provider session before collection continues.
- If continuity cannot be restored, emit typed evidence that authentication was lost. Do not infer that the owner must reconnect from process replacement alone.
- Preserve the existing profile-per-connection boundary.
- Keep non-retained idle-TTL behavior unchanged.
- Reconcile lifecycle state after controller, allocator, or host restart.
- Expose enough status to distinguish active, idle, suspended, resuming, and authentication-lost states.
Evidence required
- A provider-session probe demonstrates that the chosen suspend/resume mechanism preserves ChatGPT authentication, or clearly identifies when it does not.
- Tests prove active work cannot be interrupted by the idle sweep.
- Tests prove idle retained surfaces release their bounded resources and can be resumed.
- Tests cover restart reconciliation, duplicate cleanup attempts, resume failure, and concurrent run admission.
- A resource receipt compares steady-state memory and allocator-slot usage before and after the change.
- Physical browser UAT confirms that an idle account resumes without an unnecessary reconnect.
Design constraint
Choose the mechanism from evidence. A clean stop with persistent-profile restart, process checkpointing, or another allocator-managed approach is acceptable only if it satisfies the session and resource tests. docker pause alone is insufficient because it keeps the browser memory resident.
Assisted-by: AI
Problem
Dynamic n.eko surfaces already stop after the idle TTL when their browser state can be restored from the persistent profile. ChatGPT is deliberately different: its provider API session is held in the live browser process, so
retainSurfaceProcessexcludes it from idle and capacity cleanup.That protects authentication, but it means each retained account can hold a Chromium, X11, n.eko process, WebRTC port, and allocator slot indefinitely. Two retained ChatGPT surfaces on the development instance were recently observed running for more than 26 hours.
Putting several authenticated accounts in one browser container is not an acceptable shortcut. It would enlarge the failure and security boundary and make account isolation harder to verify.
Required outcome
Add a bounded lifecycle for retained browser surfaces without weakening account isolation or causing unnecessary reconnect prompts.
Evidence required
Design constraint
Choose the mechanism from evidence. A clean stop with persistent-profile restart, process checkpointing, or another allocator-managed approach is acceptable only if it satisfies the session and resource tests.
docker pausealone is insufficient because it keeps the browser memory resident.Assisted-by: AI