Browser: keep controls responsive during launch and enforce session capacity #289

A stalled Browser launch leaves other owned sessions responsive. Runtime enforces declared capacity and keeps cancellation, late completion and cleanup bound to the exact principal/session.

Goal: responsive bounded sessions. Lane: Contract and source. Own B07.A1–A3 implementation and the applicable B06.A4/A5 contribution. #131 keeps exact native terminal/lifetime, full-effect settlement and gateway/orphan cleanup. The qualification task measures capacity and the B07.A4 100-cycle result.

Scope and milestones

Use the existing accepted-operation/pending-handle contract and exact response correspondence. Separate long preparation/Open work from bounded status/input/Close dispatch; reuse the existing owner/journal and quota model. A deadline ends a wait while the lifecycle owner retains unresolved effects. Keep one authoritative session/capacity state rather than adding a second supervisor.

M0 and existing owner contracts permit source work. An accepted compatible #131 terminal/settlement output supplies lifecycle integration. The consumed implementation requires its own checks, review and integration; broader #131 issue acceptance remains open. The ordinary preparation consumer separates long image acquisition from bounded launch controls.

Done means

• Deliberately stall one launch; another active session receives status, input and Close within the original B07.A1 budgets. Interleaved responses reach their exact operation/session.
• Cancel, concurrent retry and late completion create at most one live page and cross neither principal nor session. Restart replays exact unsettled ownership before releasing conflicting leases.
• Advertised memory/CPU/disk/process/stream limits are enforced at capacity. An excess request gets the original typed refusal and remedy before partial acquisition.
• Numeric deadlines and active leases cover all nonterminal states; website actions use the same cancellation and lifecycle semantics.
• Integration consumes Gateway SIGTERM leaves orphan browser-vm-control-service #131's natural complete cleanup receipt. Qualification measures capacity and 100 cycles against this implementation, without another capacity controller.

Next experiment: use a controlled provider that blocks Open while an existing page receives status/input/Close. Capture response ownership and cancellation/late completion before changing the smallest dispatch boundary. Also test a nonblocking stalled writer and peer half-close, count retries, and retain the existing two-second shutdown-join bound before deciding whether the retry path needs a change.

Ownership and acceptance

Product owner: Anders (@andersalm). Part of Browser mission #283, acceptance revision Browser-2026-10-07-R1. The complete original criterion text and numerical budgets in #283 remain authoritative. This task supplies the stated contribution; shared-producer and full-mission acceptance remain open.

Record one execution owner, lane, approved task base/PR target, file scope, exact candidate and resource lease before implementation. Planning uses fetched develop 1828919980b1af1d60895c6cee178f769daed74c; existing branches retain their approved bases/history. Keep at most one active task per Browser lane. New tasks start in Backlog; #131 remains the installed-product task.

Runtime owns admission, principal/grants, placement, routing, resource limits, lifecycle and audit. Engine executes and renders websites and owns website TLS; the selected Exit performs authorized DNS and destination streams. Carrier carries off-box traffic below the same contract. Immutable signed capsule/dependency identity and separately rooted mutable profiles retain their distinct owners.

Source responsiveness finding - 2026-10-08

Read-only review of the #131 candidate b2498befc855f596d6c9202812ff490dd651fcaf, tree c6e44372b7e406d30e5a38d77f51b00884fa7a3f, found repeated durability work in metadata reads. In gateway_browser_sessions.rs:3629, read_bounded_browser_json_dir sets private permissions and calls sync_all for every record it reads. In gateway_browser_remote.rs:1229, the process-wide CONSUMER_WRITES mutex covers the read of all prior records before each insert. The 128-insert capacity fixture therefore requests 0 + 1 + ... + 127 = 8128 prior-record syncs, in addition to its actual writes and later checks. The separate 140-lifetime fixture performs repeated writes and retirement under the same mutex.

The cached full-server unit run issued over-60-second warnings for remote_engine_pending_capacity_rejects_before_write_and_keeps_exact_cleanup_available and remote_engine_terminal_retirement_exceeds_128_lifetimes_and_preserves_profile_owner. That b2498bef run completed within its predeclared 900-second bound: 2588 passed, 0 failed and 27 existing ignored cases in 458.37 seconds, without compilation. After normal develop integration, the dbae2a35 canonical gate's server suite passed 2589 cases with 0 failures and 27 existing ignored cases in 435.09 seconds. #131 owns the exact source and result records. The finite filesystem fixtures completed; these passing suites leave the responsiveness finding open. The warnings establish elapsed test time. The 8128 count comes from source control flow; syscall counts and installed latency remain unmeasured. These fixtures exercise a separate path from the focused remote-close receipt correction.

This belongs to B07.A1–A3: synchronous record scans and syncs under a shared mutation lock can delay independent sessions. The smallest candidate change is to validate ownership, type, permissions, schema and size on already-private records without repeating permission writes and durability syncs on each read. Keep permission repair explicit and preserve durable record writes, terminal-proof persistence and profile-flush gates. When this issue takes its normal execution slot, compare the two fixtures and concurrent independent-session controls against the original budgets, using the existing journal and quota model. This is a recorded source finding; implementation and measured acceptance remain open with this issue's existing owner and dependencies.

The posted Opus review on exact ff4c9e46 passed with a nonblocking retry/backpressure note. Every write retry already checks explicit launch shutdown; done records directional EOF, and owned sockets use 250 ms timeouts. Actual Apple descriptor flags and a busy retry rate remain unmeasured. This issue owns the smallest stalled-writer/half-close fixture and retry count, with the existing two-second shutdown-join requirement and ordinary uncancelled I/O errors intact. Measure the behavior before changing cancellation or backpressure semantics; this note does not change the accepted #131 terminal proof.

Verification and closeout

Use the smallest behavior tests that exercise the changed boundary. Freeze the affected input closure, then batch one needed build under the shared Mac lease. Reuse the verified image/helpers when inputs match. Source presence and prepared fixtures provide bounded evidence; installed acceptance binds source commit/tree, built/installed/served hashes, package/image/helper manifests, device/client/adapter versions, selected Engine/Exit, placement/network, commands, failures, cleanup and matching media/manual evidence.

Use one isolated Mac test owner and the authorized Mac/Jetson targets; existing Namespace is an optional x86 fallback. Other physical role/network rows remain unverified until their evidence exists. OMP and existing Homes keep their owners. Disposable fixture signing uses separate trust; production signing, existing-Home changes, release and deployment retain their approval gates.

Before reporting, update this issue with passed, failed, pending, exact candidate and next experiment; use 30-minute checkpoints during sustained execution. Full closure requires accepted behavior, resolved findings, required independent review, applicable irzhywau/security/signing review and human UX/media review, and a merged implementing PR. Applicable #173 changes retain its approval and different-model-family adversarial review gate. All #283 hardware/media/soak/second-maintainer gates remain intact.

Related Browser outputs: #131 exact lifecycle/settlement; #288 preparation; #293 measured capacity/cycles.