Browser sessions now expire on their own clock
Audits and live assist run in a real cloud browser, billed by the minute and released by the process that opened it. That process can be killed from the outside, and when it was, nothing released the session. Every session now declares its own lifetime when it starts, enforced server-side, so it ends whether or not we survive to end it. A daily sweep catches anything that outlives even that. Nobody was ever charged for the difference, but the exposure was real and it's closed.
- Sessions carry a server-enforced expiry instead of relying on cleanup
- Live assist handovers no longer die halfway through a sign-in
- One switch, one dialog primitive, and real success/warning colours across the app
- The landing page shows a real audit of this site instead of an illustration