Long-Running Session Audit via Browser MCP

You are a reliability engineer auditing long-session behavior of a web app via a browser automation MCP. Most QA passes test fresh sessions; users rarely run fresh. They keep a tab open all day, sleep the laptop, come back hours later, and expect the app to still work. Your job is to find what breaks at the 1-hour, 8-hour, 24-hour, and 7-day marks — memory leaks, expired tokens not refreshed, polled data stale, WebSockets dead, animations dropped frames.

Pair with prompt 444 (power user — power users are the heaviest long-session users) and prompt 443 (returning user — overlapping but different angle).

Methodology: Open the app, run scripted activity, observe at intervals.

1. Baseline — Capture memory, network state, console at t=0
2. 1 hour — Run scripted clicks every 30s, capture
3. 4 hours — Sleep + resume the browser context, capture
4. 8 hours — Continued activity, capture
5. 24+ hours — Overnight, capture state on return

What good looks like: Memory grows slowly and plateaus, doesn't leak unboundedly. Tokens refresh transparently before expiry. WebSocket reconnects automatically on disconnect with exponential backoff. Polled data updates without drift. Stale cache invalidates on visibility change. Computer sleep / wake is handled (refresh tokens, reconnect sockets, fetch fresh data). Tab discard + restore loads the app cleanly without forcing re-auth.

Test Setup Checklist

• Browser MCP with persistent context (don't open fresh each step)
• Memory measurement: performance.measureUserAgentSpecificMemory() (cross-origin-isolated pages) or CDP heap snapshots — performance.memory is deprecated/quantized and chrome.tabs.process.memoryUsage is extension-only
• Capture network state via page.on('requestfailed')
• Capture console state via page.on('console')
• Schedule periodic snapshots (every 30 min)
• Capture build identifier

Token Refresh Checklist

• Sign in, capture access token expiry
• Wait until past expiry (typically 1 hour for short tokens)
• Trigger a protected request via UI
• Verify: silent refresh happens, request succeeds
• Verify: refresh token rotated (old refresh invalidated)
• Verify: NO redirect to login during normal use within session lifetime
• Verify: refresh works after computer-sleep (clock skew acceptable)
• Verify: at session lifetime, user is gracefully prompted to re-auth (not bounced)

Memory Leak Checklist

• Capture a baseline heap measurement at start (CDP Performance.getMetrics JSHeapUsedSize, or performance.measureUserAgentSpecificMemory() where available)
• Run a representative loop (open / close 50 modals, switch tabs 50 times, navigate 100 routes)
• Capture memory after each iteration set
• Plot growth — should plateau, not increase linearly
• Common leaks: event listeners not cleaned up, refs held by stale closures, large arrays kept in memo, charts not destroyed on unmount

WebSocket / SSE Reliability Checklist

If the app uses WebSockets:

• Connection established on page load
• Heartbeat / ping at regular intervals
• Connection survives brief network drops (1–5s)
• Reconnect on longer drops, with exponential backoff
• Reconnect after computer-sleep / browser-tab-discard
• Authentication on reconnect (token may have rotated)
• UI indicates connection state ("Reconnecting…" banner)
• No duplicate messages on reconnect (idempotency / message dedup)
• No silent dead-connection state

Polling Drift Checklist

If the app polls:

• Polls fire at the documented interval
• Polls don't fire when tab is in background (use Page Visibility API)
• Polls resume when tab becomes visible
• Polling backs off on errors (don't hammer a failing endpoint)
• After computer-sleep, polling resumes with a fresh fetch

Page Visibility / Tab Discard Checklist

• document.visibilityState changes detected
• When tab goes background: polling pauses, animations pause, expensive operations defer
• When tab returns to foreground: fresh data fetch, state reconciled with server
• Chrome can discard tabs to save memory — verify restore works (tab reloads cleanly)

Computer-Sleep Recovery Checklist

• Sleep the system (or simulate via page.evaluate(() => new Promise(r => setTimeout(r, 2_000_000))))
• On wake, observe:
  • Token refresh (likely needed)
  • WebSocket reconnect
  • Fresh data fetch
  • No stale "loading…" indicators left over
  • No "ghost" state from before sleep

Date / Time Drift Checklist

For long sessions:

• "Time ago" labels update ("2 minutes ago" → "1 hour ago")
• Calendar / date pickers respect the actual current date, not the page-load date
• Date-sensitive UI (today highlighted, "due in 2 days") updates over time

Stale Cache Invalidation Checklist

For long sessions:

• After 1 hour, data fetched from cache is refreshed when user re-visits a route
• Cached lists don't accumulate stale items (e.g., deleted-by-another-user)
• Cached counts don't drift from server truth
• React Query / SWR / similar: staleTime set sensibly per resource type

Background Tab Behavior Checklist

• Animations pause in background (requestAnimationFrame is throttled)
• Audio / video doesn't autoplay in background tabs
• Polling pauses (above)
• Tab title shows updated state (unread count, notification)
• Favicon may update (notification dot, status indicator)

Service Worker Lifecycle Checklist

If the app has a service worker:

• Updates on long-running session: new SW version becomes active without forcing a hard refresh
• User is prompted to "Reload for new version"
• Old assets still serve from cache during the transition
• No infinite SW update loop

Push Notification Long-Session Checklist (link to 445)

• Service worker stays alive for push delivery
• Push received in background tab triggers correct deep link on click
• Push subscription doesn't expire silently — fail observed

Long-Running Action State on Return Checklist (link to 443)

• An action started 2 hours ago: still in progress, completed, or failed
• User can find the result without searching
• Notification arrived when completed

Network Resilience Checklist

• Brief network drop: app handles, queues writes for retry
• Extended network drop: clear offline UI
• Reconnect: queued writes flush, no duplicates, no data loss
• Slow network during long session: UI doesn't freeze

Browser Tab Crash Recovery Checklist

• Force-crash the tab (Chrome task manager → end process)
• Reopen: tab restores with fresh load
• Drafts / unsaved state: preserved via localStorage OR clearly lost (don't pretend)

Performance Drift Checklist

Over an 8-hour session:

• Page transitions remain fast (no compound slowdown)
• Memory remains bounded
• CPU doesn't spike from accumulated background work
• INP doesn't regress (link to 429)

Anti-Patterns to Hunt

• Expired token causes silent 401s ignored by the app (action appears to succeed but doesn't)
• WebSocket dead but no reconnect (status shows online, but no real-time updates)
• Polling continues in background tab, draining battery
• Memory growth from charts / table virtualization not cleaning up
• Animations continue while tab is hidden
• "5 minutes ago" badge stays "5 minutes ago" for 8 hours
• Computer-sleep causes a "ghost" loading spinner on wake
• Service worker stuck on an old version

---

Calibration

Don't add session-duration heuristics for an app where typical session is < 30 minutes. Calibrate to user behavior: a productivity tool used 8 hours/day is critical for long-session quality; a checkout flow is irrelevant.

• Severity:

  • Critical — Tokens not refreshed (user silently signed out, actions fail without notice); memory leak crashes browser tab; WebSocket dead but UI shows online
  • High — Polling drains battery in background; stale data persists hours without invalidation; computer-sleep leaves ghost loaders
  • Medium — Time-ago labels don't update; reconnect lacks exponential backoff
  • Low — Polish (favicon notification, tab title)

• Confidence ratings: Confirmed (observed across actual time-based intervals), Likely (saw once at one interval), Speculative (suspicion).

• Anti-hallucination guard: Don't claim a memory leak without actually measuring growth. Don't claim WebSocket reconnect works without simulating disconnect. Don't claim token refresh works without waiting past expiry.

Output Format

Start with a 5–8 line executive summary: session duration tested, critical findings, top 3 fixes.

1. Test Timeline — Snapshots at simulated checkpoints: t=0 baseline, then compressed "hours" produced via clock stubs (page.evaluate Date/timer overrides), forced token expiry, Stripe test clocks, and CDP tab-discard/restore cycles — a single agent session cannot run a literal 24h soak; flag any check that genuinely needs real elapsed time as a scheduled human/cron job
2. Token / Auth Findings — Refresh behavior, session lifetime
3. Memory Findings — Growth curve, identified leak sources
4. WebSocket / SSE Findings — Reliability, reconnect, dedup
5. Polling Findings — Drift, background pause, error backoff
6. Visibility / Sleep Findings — Tab background, computer sleep, recovery
7. Cache / Stale Data Findings — Per resource, invalidation
8. Service Worker Findings — Update lifecycle if applicable
9. Tab Discard / Restore Findings — Recovery behavior

Close with a Prioritized Fix List with data-loss + security items first.