cleanup_all_browsers (gateway shutdown, atexit) ran every teardown in the launch profile's scope,
unlike the janitor: a multiplexed profile's cloud session was closed through the launch profile's
provider (usually none), so it stayed open and billing until the provider's own timeout. Each
session is now torn down under its recorded owner home and secret scope.
REAL_PROFILE_KEY was process-global: under multiplex any consent-off profile's local session stopped
another profile's live real-profile browser, and a consenting profile reused another's cookie jar.
The key is now hermes-real-profile@<home>; real-profile sessions carry it as launcher_key so the
staleness check applies (they still outlive their sessions until exit / consent-off).
Sessions placed in the terminal sandbox all attach to one in-sandbox Chromium, but teardown of the
session that launched it SIGTERMed it under the others. Sandbox sessions now share a per-profile
launcher key (same in-use check as host profiles; the launch pid + env are kept per key), and
_backend_dead rebuilds once that Chromium is gone, relaunched or behind a new port forward.
Chromium launch records move to <HERMES_HOME>/cache/browser/chromium-records (0700, used only when it is
a real dir of this user closed to other writers), the reaper removes only dirs under that home's 0700
ephemeral root, and it walks every profile the process serves (launch home, launched-for homes, session
owner homes) by path, since the janitor and atexit run outside any profile scope.
- janitor force-reap untracks the session (activity + owner + failures)
before releasing it, so a teardown that keeps failing is not re-reaped
every third cycle forever.
- orphan reap refuses a record without a start-time fingerprint (never
signal on argv alone).
- an operator-pinned browser binary, even a missing one, never triggers the
PM Chromium auto-download.
- local Chromium honours Bot Desktop placement through
runtime.tool_placement(): refused raises, terminal starts the sandbox
screen; neither falls back to a host browser.
- running_instance finds the browser pid by argv on Windows (no
SingletonLock symlink there).
Teknium