fix(browser): retire owned tabs after recovery

[steipete]

Recoverable browser failures can release their lease while leaving an Oracle-created tab indefinitely, even after a successful harvest or reattach. Browser-level CDP connections could also keep an incomplete controller alive after its page connection was detached.

Record explicit target ownership and save the full recovered answer plus completed session metadata before retiring the captured target. Per-tab claims survive document replacement and reserve retirement against a new controller; current session/lease ownership and generation checks preserve borrowed, kept, legacy, reclaimed, or active targets. Connection cleanup now releases the browser transport independently of whether its tab must remain available for recovery.

There is no automatic retention TTL. An interrupted retirement reservation remains conservative: the saved answer is available, and a new run should use another tab. Host ownership details remain excluded by the existing bridge result allowlist.

Fixes #435. Thanks @lhysin for the detailed lifecycle report.

Validation:

• Full suite: 2,258 passed / 45 skipped; build, formatting, lint/typecheck passed.
• Built main CLI before/after proof against real isolated Chrome: main retained the recovered owned tab and left capture status in error; the candidate saved the complete answer, marked completion, and retired only that tab.
• The real-Chrome matrix also passed borrowed/kept/active-generation/active-controller/reclaimed preservation and refusal of a new controller after retirement reservation. It includes a real same-origin page reload.
• Signed-in built CLI Pro run: deliberate timeout retained its target and the controller exited naturally; later reattach saved the full answer and retired only its owned tab. Peer tabs and Chrome survived.
• Regressions cover failed answer/model/session writes, optional identity-capture failure, host aliases, other sessions and shared leases, current generation controls, reservation ownership, and transport cleanup with target preservation.
• Local and committed-branch P0–P2 autoreview are clean. CI passed on 3f5529fb195fd7605d2d67fb0568cef9d8896bd6: https://github.com/steipete/oracle/actions/runs/34178930225.

The changelog entry is deferred to the final notes PR so sibling implementations do not conflict.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed September 7, 2026, 10:23 PM ET / September 8, 2026, 02:23 UTC.

ClawSweeper review

What this changes

Save recovered browser answers before closing explicitly owned tabs, preserve shared or retained tabs, and disconnect browser transports independently of tab cleanup.

Merge readiness

✅ Ready for maintainer review

The PR remains useful: pinned main and v0.19.0 lack post-recovery retirement. No blocking defect was found, and the supplied final-head proof covers recovery and preservation of other targets.

Priority: P2
Reviewed head: 3f5529fb195fd7605d2d67fb0568cef9d8896bd6

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A coherent lifecycle repair with relevant real-browser evidence, focused regression coverage and no blocking findings.
Proof confidence	🐚 platinum hermit (4/6)	Sufficient (logs): The supplied final-head report ties built-CLI harvest and signed-in Pro reattach to saved complete answers, controller exit and owned-tab retirement. Real-Chrome cases also preserve reclaimed, borrowed and active targets and reject acquisition after reservation; tests supplement persistence-failure and legacy-session coverage.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Verified	Sufficient (logs): The supplied final-head report ties built-CLI harvest and signed-in Pro reattach to saved complete answers, controller exit and owned-tab retirement. Real-Chrome cases also preserve reclaimed, borrowed and active targets and reject acquisition after reservation; tests supplement persistence-failure and legacy-session coverage.
Evidence reviewed	10 items	Policy and review identity: Read the complete root AGENTS.md; tracked policy discovery found no nested AGENTS.md or maintainer notes. The checkout matches the pinned PR head. Repository policy and OWNER association prohibit automatic cleanup closure. Main still lacks retirement: Pinned main reattach closes its attachment and returns the answer without retiring the recovered target. The existing harvest path similarly returns after recording harvest metadata. Latest-release comparison: Inspected v0.19.0 harvest: it prints or exports the captured answer and returns without the proposed completion/retirement step. The annotated tag resolves to the supplied release commit.
Findings	None	None.
Security	None	None.

How this fits together

Oracle’s browser engine sends consultations through Chrome and stores session information for later recovery. Reattach and harvest recover completed answers; this change connects successful persistence to safe cleanup of the original tab.

flowchart TD
  A[Interrupted browser consultation] --> B[Reattach or harvest]
  B --> C[Save full answer and completed session]
  C --> D[Check target identity and active controllers]
  D --> E[Reserve current tab ownership]
  E --> F[Close owned idle tab]
  D --> G[Preserve other targets]
  E --> G

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Production and validation growth	Production +416 net lines; tests +392; real-Chrome proof script +163	The production growth implements explicit ownership and persistence ordering, with focused failure and concurrency validation.

Root-cause cluster

Relationship: fixed_by_candidate
Canonical: #435
Summary: This PR is the explicit implementation candidate for the reported post-recovery tab lifecycle gap.

Members:

• canonical: Browser mode: recovered/error runs can release the lease while retaining Oracle-owned tabs indefinitely #435 - The report describes retained owned targets after recovery; this PR explicitly addresses that path.
• adjacent_distinct: chore: consolidate pending notes and refresh dependency patches #470 - It collects release notes and credit after the implementation lands.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Technical review

Best possible solution:

Keep recovery available until the answer is saved, then retire only the currently owned idle target while preserving legacy sessions and other controllers.

Do we have a high-confidence way to reproduce the issue?

Yes: an owned persistent-profile run can time out, release its lease, and later recover without main retiring its tab. Source inspection supports that path, and the supplied baseline CLI run reports it; this review did not execute target code.

Is this the best way to solve the issue?

Yes: explicit ownership plus save-before-close ordering fits the existing recovery lifecycle without adding a retention policy or migrating older sessions.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against fe2c8d990562.

Labels

Label justifications:

• P2: This repairs accumulated recovery tabs and lingering browser transports in a bounded browser-session workflow.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (logs): The supplied final-head report ties built-CLI harvest and signed-in Pro reattach to saved complete answers, controller exit and owned-tab retirement. Real-Chrome cases also preserve reclaimed, borrowed and active targets and reject acquisition after reservation; tests supplement persistence-failure and legacy-session coverage.
• proof: sufficient: Contributor real behavior proof is sufficient. The supplied final-head report ties built-CLI harvest and signed-in Pro reattach to saved complete answers, controller exit and owned-tab retirement. Real-Chrome cases also preserve reclaimed, borrowed and active targets and reject acquisition after reservation; tests supplement persistence-failure and legacy-session coverage.

Evidence

What I checked:

• Policy and review identity: Read the complete root AGENTS.md; tracked policy discovery found no nested AGENTS.md or maintainer notes. The checkout matches the pinned PR head. Repository policy and OWNER association prohibit automatic cleanup closure. (AGENTS.md:1, 3f5529fb195f)
• Main still lacks retirement: Pinned main reattach closes its attachment and returns the answer without retiring the recovered target. The existing harvest path similarly returns after recording harvest metadata. (src/browser/reattach.ts:239, fe2c8d990562)
• Latest-release comparison: Inspected v0.19.0 harvest: it prints or exports the captured answer and returns without the proposed completion/retirement step. The annotated tag resolves to the supplied release commit. (src/cli/browserTabs.ts, 2d664c1a60a9)
• Persistence precedes target closure: Harvest awaits the full answer write, model update, and completed session update before invoking retirement. Manual and automatic reattach follow the same ordering. (src/cli/recoveredBrowserHarvest.ts:44, 3f5529fb195f)
• Current authority checked before closure: Retirement requires matching saved endpoint, target and conversation, no active controller or lease, and a matching current tab claim. The renderer reserves that claim before Target.closeTarget; reclaimed claims and existing reservations refuse retirement. (src/browser/recoveryTarget.ts:104, 3f5529fb195f)
• Compatibility and failure coverage: The ownership field is optional; legacy sessions remain readable and ineligible for retirement. Regression coverage preserves mismatched, explicit, active and legacy targets and prevents closure after answer, model or metadata write failures. (tests/browser/recoveryTarget.test.ts:130, 3f5529fb195f)

Likely related people:

• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• oraclexing: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (1 earlier review cycle)

• reviewed 2026-09-08T02:09:28.221Z sha 3f5529f :: needs maintainer review before merge. :: none

[steipete]

Final-head proof for 3f5529fb195fd7605d2d67fb0568cef9d8896bd6:

• Full suite: 2,258 passed / 45 skipped; build, formatting, lint/typecheck passed.
• node scripts/recovery-retirement-proof.mjs --baseline-cli <built-main-cli> reproduced retained owned-tab/error status on main. The candidate matrix saves the complete answer and completes the session before retiring the owned tab; borrowed, kept, generating, active-controller, reclaimed, and peer targets survive. A same-origin reload preserves ownership and a retirement reservation refuses a new controller.
• Signed-in built CLI Pro run: a deliberate timeout left the target recoverable while the controller exited naturally. Later reattach saved the complete answer containing ORACLE_PERSISTENT_RECOVERY_OK and reported “Retired Oracle-owned browser tab after saving the recovered answer.” Chrome and other tabs survived.
• Local and final branch P0–P2 autoreview: scoped-clean.
• Exact-head CI: all four jobs passed, including Linux browser proofs and Windows shared-Chrome lifecycle: https://github.com/steipete/oracle/actions/runs/34178930225.
• The combined six-PR tree also passed the real-Chrome retirement matrix and a signed-in Latest/Pro Web Search with bundled attachments.

Fixes #435. Changelog and thanks @lhysin are collected in #470, to merge last.