[fmhall]

Browser cleanup depended on the worker choosing to delete its browser. This adopts provider-independent lifecycle practices from BELL Stack: retire a worker's tracked browsers when its Eve session ends, keep ownership records if Kernel cannot confirm release, and reserve a fresh provider-release deadline after bounded optional telemetry/reference cleanup. Parked workers remain available between turns.

Also reject non-HTTP(S) launch URLs and embedded URL credentials before contacting Kernel. Add an explicitly opt-in Kernel check that verifies synthetic cookie persistence across writer retirement and a fresh read-only browser, then verifies cleanup of its temporary resources.

The comparison notes explain what we adopted, what our existing workspace isolation already covers, and why expiring handoff/payment quarantine need separate adaptations. Kernel, server-side autofill, and the existing worker architecture remain in place; Link stays disabled.

Source reviewed: browserbase/bell-stack at 89954b6. These are adapted design practices, not its older Eve APIs or single-operator storage.

Validation:

• pnpm check: 907 tests across 97 files; lint, types, formatting, Knip pass.
• pnpm build and pnpm build:eve pass.
• pnpm test:runtime: 2 evals, 16 gates pass.
• OPENINSTINCT_LIVE_BROWSER_CHECK=1 pnpm test:browser:live: real Kernel profile persistence and browser retirement passed; temporary browsers/profile cleaned up.
• Timeout regressions cover stalled telemetry and local disposal before release. Independent review and final re-review have no remaining findings.

The live check exercises Kernel directly. The new terminal hook has mocked regression coverage and has not yet been verified end to end on a deployed session.