Guest session runtime: isolate temporary ROMs and revoke them on environment exit #139

Parent: #136

Goal

Make guest ROM content a short-lived capability of the running authorized game, not a file saved to the guest's library.

Design boundary

Prefer a session-specific RAM-backed filesystem (tmpfs or equivalent where supported) in a narrow private mount/process namespace with a supervisor and process-group/cgroup ownership.

A session-only path is delivered to the selected emulator via TrainerOS's trusted launch adapter. The normal shell/library/file manager cannot browse or index the content through a public destination.

The chosen emulator must not be allowed to persist guest ROM bytes into config, recent-content history, thumbnails, logs, crash dumps, swap, savestate caches or unrelated host locations. Where that cannot be proven for a runtime, do not mark that runtime as guest-content eligible.

Use existing ProcessService and Home/exit lifecycle guarantees; do not replace the working emulator startup stack.

Valid versus invalid context

These are inside the authorized session and must not revoke the ROM:

• playing;
• the legitimate TrainerOS in-game Home overlay;
• in-session voice/mic controls;
• passive notifications/invitation overlays that do not escape the owned game session.

These revoke the session content:

• explicit Exit game / End party;
• switching to an unrelated app, desktop or shell session;
• trying to launch unapproved extra processes within the guest game sandbox;
• switching local Trainer or invalidating the session owner;
• guest emulator termination/crash;
• session cancellation/revocation/disconnection after the game no longer has a valid live lease.

Implement a clear supervised session lease, not a naive window-focus-loss heuristic. Focus can legitimately move to TrainerOS Home/notification overlays without leaving the game.

Revocation

On environment exit, promptly stop the owned game process tree, close its guest-content file handles, revoke access, unmount/discard RAM-backed storage and scrub session-only metadata/caches. For interruption during preparation, destroy partial content.

On app restart after abnormal exit, reclaim stale guest-session state. On reboot, memory-only content should not be persistently stored; confirm no swap/dumps/file caches undermine the policy.

This is practical containment, not a guarantee against extraction by a root-capable user on their own Linux device. Do not label it theft-proof, DRM-grade or secure erasure of immutable bytes. Deleting a pathname alone is not sufficient while processes retain open file descriptors.

Preserve

Preserve the host's original ROM, user's local mismatched ROM, existing Trainer-owned saves and ordinary runtime configuration. Make per-mode save authority explicit: shared-machine guests must not accidentally import host saves; independent-handheld guests retain only their own separately governed save data.

Acceptance

• Guest ROM is unavailable through normal library/rescan/recent-content flows throughout its lifetime.
• Authorized Home/voice/notification overlays do not end the session.
• Unrelated app/desktop launch or controlled-context exit promptly terminates guest runtime access and purges content.
• Explicit Exit, guest crash, owner switch, cancellation and lost lease clean both ROM and temporary artifacts.
• No removed content is accidentally reused by a later party or different Trainer.
• Swap, dumps and relevant emulator caches are audited for persistence.
• Actual SteamOS/Bazzite versus prepared image behavior is checked on supported systems rather than assumed identical.