@ours.network/fleet 1.2.0-nightly.70 → 1.2.0-nightly.71

package/dist/daemon-recovery.js

@@ -2,6 +2,7 @@ import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { createHash, randomUUID } from 'node:crypto';
 import { attachOursClient, } from '@ours.network/sdk/client';
+import { classifyIdentityPresence } from './monitor.js';
 import { readClientProfile } from './client-profile.js';
 import { replaceFileAtomically } from './atomic-file.js';
 export const DAEMON_RECOVERY_MAX_ATTEMPTS = 6;
@@ -41,7 +42,8 @@ function startupProgress(value) {
 /** Read generation and readiness through the selected gateway. Server paths are opaque. */
 export async function probeDaemonGeneration(fetch, env, deps = {}) {
     try {
-        return await probeSelectedDaemon(deps, readClientProfile(env));
+        const { identities: _identities, ...generation } = await probeSelectedDaemon(deps, readClientProfile(env));
+        return generation;
     }
     catch {
         return { state: 'unavailable', reason: 'CLIENT_GATEWAY_PROFILE_INVALID' };
@@ -56,7 +58,7 @@ async function probeSelectedDaemon(deps, profile) {
         const options = {
             endpoint: profile.endpoint, expectedInstanceId: profile.expectedInstanceId,
             credentialPath: profile.credentialPath,
-            sessionMode: 'external', leaseToken: randomUUID(), env: {},
+            sessionMode: 'external', leaseToken: randomUUID(), env: {}, requestSignal: deps.requestSignal,
         };
         client = await (deps.attachClient?.(options) ?? attachOursClient(options));
         const info = await client.version({ startup: true });
@@ -75,7 +77,7 @@ async function probeSelectedDaemon(deps, profile) {
             return { state: 'unavailable', reason: 'DAEMON_IDENTITIES_INVALID' };
         if (!identities.length)
             return { state: 'unavailable', reason: 'DAEMON_IDENTITIES_NOT_READY' };
-        return { state: 'ready', generation: {
+        return { state: 'ready', identities, generation: {
                 bootId: progress.bootId, pid: progress.pid, startedAt: progress.startedAt, stateDir: info.stateDir,
             } };
     }
@@ -87,6 +89,118 @@ async function probeSelectedDaemon(deps, profile) {
         await client?.close().catch(() => undefined);
     }
 }
+const selectedHealthOwners = new Map();
+const unavailableHealth = (reason) => ({
+    generation: { state: 'unavailable', reason },
+});
+/** Retained runtime health, independent of browser delivery and stream readiness. */
+export function acquireSelectedDaemonHealth(env, deps = {}) {
+    let profile;
+    try {
+        profile = readClientProfile(env);
+    }
+    catch {
+        return {
+            sample: async () => unavailableHealth('CLIENT_GATEWAY_PROFILE_INVALID'),
+            presence: () => ({ state: 'unknown', detail: 'selected daemon unavailable' }),
+            release: () => { },
+        };
+    }
+    // Credentials are part of the selection boundary, not merely endpoint identity.
+    const key = JSON.stringify([profile.endpoint, profile.expectedInstanceId, profile.credentialPath]);
+    let owner = selectedHealthOwners.get(key);
+    if (!owner) {
+        let stopped = false;
+        let timer;
+        let current;
+        let nextProbeAt = 0;
+        let pending;
+        let cancelProbe;
+        const run = () => {
+            let client;
+            let closed = false;
+            let cancelled = false;
+            const request = new AbortController();
+            const close = async () => {
+                if (client && !closed) {
+                    closed = true;
+                    await client.close().catch(() => undefined);
+                }
+            };
+            let deadline;
+            const interrupted = new Promise(resolve => {
+                cancelProbe = () => {
+                    cancelled = true;
+                    request.abort();
+                    void close();
+                    resolve(unavailableHealth('DAEMON_SELECTED_PROBE_UNAVAILABLE'));
+                };
+                deadline = setTimeout(cancelProbe, 10_000);
+                deadline.unref?.();
+            });
+            const probe = probeSelectedDaemon({ ...deps, requestSignal: request.signal, attachClient: async (options) => {
+                    client = await (deps.attachClient?.(options) ?? attachOursClient(options));
+                    if (cancelled) {
+                        void close();
+                        throw new Error('health probe cancelled');
+                    }
+                    return { version: (...args) => client.version(...args),
+                        identities: () => client.identities(), close };
+                } }, profile).then(({ identities, ...generation }) => ({ generation, identities }));
+            pending = Promise.race([probe, interrupted]).then(snapshot => {
+                if (!stopped)
+                    current = snapshot;
+                return snapshot;
+            }).finally(() => {
+                if (deadline)
+                    clearTimeout(deadline);
+                cancelProbe = undefined;
+                pending = undefined;
+                if (!stopped) {
+                    nextProbeAt = Date.now() + 2_000;
+                    timer = setTimeout(() => { void run(); }, 2_000);
+                    timer.unref?.();
+                }
+            });
+            return pending;
+        };
+        owner = {
+            consumers: 0,
+            sample: () => {
+                if (pending)
+                    return pending;
+                if (current && Date.now() < nextProbeAt)
+                    return Promise.resolve(current);
+                // A delayed timer after process suspension cannot certify old absence.
+                if (timer)
+                    clearTimeout(timer);
+                return run();
+            },
+            stop: () => { stopped = true; if (timer)
+                clearTimeout(timer); cancelProbe?.(); },
+        };
+        selectedHealthOwners.set(key, owner);
+        void run();
+    }
+    const retained = owner;
+    retained.consumers++;
+    let released = false;
+    return {
+        sample: () => released ? Promise.resolve(unavailableHealth('HEALTH_OWNER_RELEASED')) : retained.sample(),
+        presence: (name, snapshot) => snapshot.generation.state === 'ready'
+            ? classifyIdentityPresence(name, snapshot.identities)
+            : { state: 'unknown', detail: 'selected daemon unavailable' },
+        release: () => {
+            if (released)
+                return;
+            released = true;
+            if (--retained.consumers === 0) {
+                retained.stop();
+                selectedHealthOwners.delete(key);
+            }
+        },
+    };
+}
 export class DaemonGenerationObserver {
     current;
     unavailable = false;

package/dist/monitor.d.ts

@@ -108,6 +108,7 @@ export type IdentityPresence = {
  * valid but missing identity, which made a closed temp identity look healthy.
  */
 export declare function probeIdentityPresence(name: string, fetch: FetchLike, env: NodeJS.ProcessEnv, deps?: IdentityProbeDeps): Promise<IdentityPresence>;
+export declare function classifyIdentityPresence(name: string, identities: unknown): IdentityPresence;
 /** Keep only the events whose type the role asked to wake on. */
 export declare function filterEvents(events: NotifyEvent[], wakeSources: string[]): NotifyEvent[];
 /**

package/dist/monitor.js

@@ -65,7 +65,7 @@ export async function probeIdentityPresence(name, fetch, env, deps = {}) {
         await client?.close().catch(() => undefined);
     }
 }
-function classifyIdentityPresence(name, identities) {
+export function classifyIdentityPresence(name, identities) {
     if (!Array.isArray(identities))
         return { state: 'unknown', detail: 'identity index response is malformed' };
     // A healthy daemon normally has at least its Human identity. During daemon

package/dist/notifications/fleet-producer.d.ts

@@ -8,12 +8,15 @@ export declare class FleetNotificationProducer {
     private readonly config;
     private readonly warn;
     private readonly queues;
-    private readonly timer;
+    private readonly observation;
+    private continuation?;
+    private stopped;
     private readonly existing;
     private cleanup?;
     constructor(roots: string[], stateDir: string, config: ProducerConfig, warn?: (line: string) => void);
     private names;
     poll(): void;
+    private resume;
     drain(): Promise<void>;
     close(): Promise<void>;
 }

package/dist/notifications/fleet-producer.js

@@ -1,5 +1,6 @@
+import { observeFleetResources } from '../application/resource-observer.js';
 import { roomsDir } from '../rooms-tasks/room-state.js';
-import { drainNotificationTargetCleanup, notificationAgentId } from './target-cleanup.js';
+import { cleanupDir, drainNotificationTargetCleanup, notificationAgentId } from './target-cleanup.js';
 import { closeSync, existsSync, lstatSync, openSync, readSync, readFileSync, readdirSync, statSync } from 'node:fs';
 import { join } from 'node:path';
 import { createHash } from 'node:crypto';
@@ -46,7 +47,9 @@ export class FleetNotificationProducer {
     config;
     warn;
     queues = new Map();
-    timer;
+    observation = new AbortController();
+    continuation;
+    stopped = false;
     existing = new Set();
     cleanup;
     constructor(roots, stateDir, config, warn = () => { }) {
@@ -54,12 +57,16 @@ export class FleetNotificationProducer {
         this.stateDir = stateDir;
         this.config = config;
         this.warn = warn;
+        observeFleetResources({ retryWatchFailures: true, roots, paths: [...roots, roomsDir(), cleanupDir()] }, state => {
+            if (state.health === 'healthy')
+                this.poll();
+            else
+                this.warn('Notification discovery observation unavailable; checkpoint retained');
+        }, this.observation.signal);
         for (const root of roots)
             for (const name of this.names(root))
                 this.existing.add(join(root, name));
         this.poll();
-        this.timer = setInterval(() => this.poll(), 1000);
-        this.timer.unref();
     }
     names(root) {
         try {
@@ -70,6 +77,8 @@ export class FleetNotificationProducer {
         }
     }
     poll() {
+        if (this.stopped)
+            return;
         this.cleanup ??= drainNotificationTargetCleanup(this.config, undefined, undefined, { beforeDelete: async (url) => {
                 const name = notificationAgentId(url);
                 if (!name || !/^[A-Za-z0-9_-]+$/.test(name))
@@ -105,7 +114,14 @@ export class FleetNotificationProducer {
                     }
                 }
                 return true;
-            } }).catch(() => { }).finally(() => { this.cleanup = undefined; });
+            } }).catch(() => { }).finally(() => {
+            this.cleanup = undefined;
+            try {
+                if (readdirSync(cleanupDir()).some(name => /^[a-f0-9]{64}\.json$/.test(name)))
+                    this.resume(3000);
+            }
+            catch { }
+        });
         let taskRoles;
         try {
             taskRoles = taskRoleAssociations();
@@ -157,6 +173,8 @@ export class FleetNotificationProducer {
                     finally {
                         closeSync(fd);
                     }
+                    if (current.offset + count < statSync(join(dir, current.segment)).size || index < segments.length - 1)
+                        this.resume();
                     let position = 0;
                     while (position < count) {
                         const end = buffer.indexOf(10, position);
@@ -187,8 +205,10 @@ export class FleetNotificationProducer {
                         if (['message.chunk', 'message.replace'].includes(event.kind) && event.promptId && event.messageId && current.prompts.includes(prompt))
                             current.messages[prompt] = event.messageId;
                         if (event.kind === 'turn.completed' && event.promptId && current.prompts.includes(prompt)) {
-                            if (!outbox.enqueue(`${roleId}:${event.sessionGeneration}:${event.seq}`, { ...(taskRoles ? { taskId: taskRoles.get(roleId) ?? null } : {}), url: `/fleet/chats/agents/${encodeURIComponent(roleId)}#fleet-message-${encodeURIComponent(current.messages[prompt] ?? event.promptId)}` }))
+                            if (!outbox.enqueue(`${roleId}:${event.sessionGeneration}:${event.seq}`, { ...(taskRoles ? { taskId: taskRoles.get(roleId) ?? null } : {}), url: `/fleet/chats/agents/${encodeURIComponent(roleId)}#fleet-message-${encodeURIComponent(current.messages[prompt] ?? event.promptId)}` })) {
+                                this.resume(1000);
                                 break;
+                            }
                             current.prompts = current.prompts.filter(p => p !== prompt);
                             delete current.messages[prompt];
                         }
@@ -200,9 +220,18 @@ export class FleetNotificationProducer {
                 }
                 catch {
                     this.warn('Notification ledger admission pending; checkpoint will replay');
+                    // Retained, not-yet-admitted ledger work needs its own next-due wake;
+                    // the outbox sender can retry only events that were already admitted.
+                    this.resume(1000);
                 }
             }
     }
+    resume(delay = 0) {
+        if (this.continuation || this.stopped)
+            return;
+        this.continuation = setTimeout(() => { this.continuation = undefined; this.poll(); }, delay);
+        this.continuation.unref();
+    }
     async drain() { await Promise.all([...this.queues.values()].map(q => q.drain())); }
-    async close() { clearInterval(this.timer); await this.cleanup; await Promise.all([...this.queues.values()].map(q => q.close())); }
+    async close() { this.stopped = true; this.observation.abort(); clearTimeout(this.continuation); await this.cleanup; await Promise.all([...this.queues.values()].map(q => q.close())); }
 }

package/dist/notifications/target-cleanup.d.ts

@@ -1,4 +1,5 @@
 import { type ProducerConfig } from './outbox.js';
+export declare const cleanupDir: () => string;
 /** Only the canonical agent namespace can authorize role-target cleanup. */
 export declare function notificationAgentId(path: string): string | null;
 /** Queue only after the owning lifecycle has established deletion, never on a failed inventory read. */

package/dist/notifications/target-cleanup.js

@@ -4,7 +4,7 @@ import { join } from 'node:path';
 import { replaceFileAtomically } from '../atomic-file.js';
 import { stateRoot } from '../paths.js';
 import { producerConfig } from './outbox.js';
-const cleanupDir = () => join(stateRoot(), 'notifications', 'removed-targets');
+export const cleanupDir = () => join(stateRoot(), 'notifications', 'removed-targets');
 /** Only the canonical agent namespace can authorize role-target cleanup. */
 export function notificationAgentId(path) {
     try {

package/dist/notifications/task-producer.d.ts

@@ -6,13 +6,15 @@ export declare class TaskNotificationProducer {
     private readonly config;
     private readonly warn;
     private readonly request;
-    private readonly timer;
+    private timer?;
+    private dirty;
     private running?;
     private offset;
     private stopped;
     private readonly shutdown;
     constructor(config: ProducerConfig, warn?: (line: string) => void, request?: typeof fetch);
     drain(): Promise<void>;
+    private retry;
     private drainOnce;
     close(): Promise<void>;
 }

package/dist/notifications/task-producer.js

@@ -1,3 +1,5 @@
+import { observeFleetResources } from '../application/resource-observer.js';
+import { tasksDir } from '../rooms-tasks/task-state.js';
 import { acknowledgeTaskNotification, pendingTaskNotifications } from '../rooms-tasks/task-state.js';
 /** The Fleet manager owns this sender even when the web console is stopped.
  * Events are already durable in their owning task commit, so no second outbox
@@ -7,6 +9,7 @@ export class TaskNotificationProducer {
     warn;
     request;
     timer;
+    dirty = false;
     running;
     offset = 0;
     stopped = false;
@@ -15,14 +18,42 @@ export class TaskNotificationProducer {
         this.config = config;
         this.warn = warn;
         this.request = request;
-        this.timer = setInterval(() => { void this.drain(); }, 3000);
-        this.timer.unref();
+        // Subscribe before startup replay: a commit while fetch is pending needs a second pass.
+        observeFleetResources({ retryWatchFailures: true, paths: [tasksDir()], roots: [] }, state => {
+            if (state.health !== 'healthy')
+                this.warn('Task notification observation unavailable; committed events retained');
+            else {
+                this.dirty = true;
+                void this.drain();
+            }
+        }, this.shutdown.signal);
         void this.drain();
     }
     drain() {
-        return this.running ??= this.drainOnce().catch(() => {
+        if (this.stopped)
+            return Promise.resolve();
+        if (this.running)
+            return this.running;
+        this.dirty = false;
+        clearTimeout(this.timer);
+        this.timer = undefined;
+        this.running = this.drainOnce().catch(() => {
             this.warn('Task notification snapshot unavailable; committed events retained');
-        }).finally(() => { this.running = undefined; });
+            this.retry();
+        }).finally(() => {
+            this.running = undefined;
+            if (this.dirty && !this.stopped) {
+                this.dirty = false;
+                void this.drain();
+            }
+        });
+        return this.running;
+    }
+    retry() {
+        if (this.stopped || this.timer)
+            return;
+        this.timer = setTimeout(() => { this.timer = undefined; void this.drain(); }, 3000);
+        this.timer.unref();
     }
     async drainOnce() {
         if (this.stopped)
@@ -33,6 +64,8 @@ export class TaskNotificationProducer {
         const start = this.offset % pending.length;
         const batch = [...pending.slice(start), ...pending.slice(0, start)].slice(0, 32);
         this.offset = start + batch.length;
+        // Retry only outstanding work; never run an idle discovery timer.
+        this.retry();
         for (let index = 0; index < batch.length; index += 4) {
             if (this.stopped)
                 break;
@@ -63,5 +96,5 @@ export class TaskNotificationProducer {
             }));
         }
     }
-    async close() { this.stopped = true; clearInterval(this.timer); this.shutdown.abort(); await this.running; }
+    async close() { this.stopped = true; clearTimeout(this.timer); this.shutdown.abort(); await this.running; }
 }

package/dist/rooms-tasks/add-member.js

@@ -1,3 +1,4 @@
+import { publishFleetResourceCommit } from '../application/resource-observer.js';
 import { createHash } from 'node:crypto';
 import { existsSync, mkdirSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
@@ -62,7 +63,7 @@ export async function requestMemberAddition(input) {
         })();
         const template = sealTemplateSnapshot(plan.snapshot, input.cfg.agentTemplates ?? {}, plan.launchDefinitions);
         const receipt = { taskId, requestId: r.requestId, roleId, hash, state: 'running' };
-        const save = () => replaceFileAtomically(path, JSON.stringify(receipt) + '\n', 0o600);
+        const save = () => { replaceFileAtomically(path, JSON.stringify(receipt) + '\n', 0o600); publishFleetResourceCommit(path); };
         save();
         running.add(path);
         void (input.provision ?? provisionMembers)({ cfg: input.cfg, cowork: input.cowork, configPath: input.configPath, binPath: input.binPath,

package/dist/rooms-tasks/layout.js

@@ -1,3 +1,4 @@
+import { publishFleetResourceCommit } from '../application/resource-observer.js';
 /** Durable local room-layout controller.
  * Uses native Cowork operations and a supervising Fleet's exact-instance port.
  * Unknown mutation outcomes stop for reconciliation; they are never replayed.
@@ -45,7 +46,7 @@ export class RoomLayout {
     }
     get cowork() { return this.coworkAdapter ??= this.coworkFactory(); }
     snapshot() { return JSON.parse(readFileSync(this.file, 'utf8')); }
-    save(s) { replaceFileAtomically(this.file, JSON.stringify(s, null, 2)); }
+    save(s) { replaceFileAtomically(this.file, JSON.stringify(s, null, 2)); publishFleetResourceCommit(this.file); }
     async verify(i) {
         need(i.supervisor === this.supervisor.id || i.remote, 'remote binding unsupported');
         need(i.launch && i.cid && i.session, 'incomplete instance reference');

package/dist/rooms-tasks/task-state.d.ts

@@ -39,6 +39,7 @@ export declare function listTasks(filter?: {
     state?: TaskState | TaskState[];
     listId?: string;
     includeDeleting?: boolean;
+    strict?: boolean;
 }): TaskRecord[];
 export declare function moveTaskToList(id: string, listId: string): TaskRecord;
 export declare function findByIdempotencyKey(key: string): TaskRecord | undefined;

package/dist/rooms-tasks/task-state.js

@@ -1,3 +1,4 @@
+import { publishFleetResourceCommit } from '../application/resource-observer.js';
 import { existsSync, lstatSync, mkdirSync, readdirSync, readFileSync, unlinkSync, writeFileSync, rmSync, renameSync } from 'node:fs';
 import { join } from 'node:path';
 import { randomUUID } from 'node:crypto';
@@ -107,6 +108,7 @@ function writeTask(record) {
     else
         delete persisted.notification_events;
     replaceFileAtomically(taskPath(record.task_id), JSON.stringify(persisted, null, 2) + '\n');
+    publishFleetResourceCommit(taskPath(record.task_id));
 }
 const retiredNotificationsDir = () => join(tasksDir(), '.notification-retired');
 /** Atomic snapshots contain the events, including intermediate states between polls. */
@@ -280,7 +282,10 @@ export function listTasks(filter) {
             if ((!states || states.includes(t.state)) && (!filter?.listId || t.list_id === filter.listId))
                 tasks.push(t);
         }
-        catch { /* corrupt file, skip */ }
+        catch (error) {
+            if (filter?.strict)
+                throw error; /* legacy CLI inventory tolerates corrupt files */
+        }
     }
     const order = new Map(readTaskLists().map((item, index) => [item.list_id, index]));
     return tasks.sort((a, b) => (order.get(a.list_id) - order.get(b.list_id))

package/dist/runner.js

@@ -17,7 +17,7 @@ import { agentDir, stateRoot } from './paths.js';
 import { loadConfig, findRole, isolationContextFor, resolveSnapshotMonitor, resolvePermissions, } from './config.js';
 import { getAdapter } from './harness/registry.js';
 import { createMonitor, probeIdentityPresence, } from './monitor.js';
-import { DaemonGenerationObserver, RoleRecoveryController, probeDaemonGeneration, } from './daemon-recovery.js';
+import { DaemonGenerationObserver, RoleRecoveryController, probeDaemonGeneration, acquireSelectedDaemonHealth, } from './daemon-recovery.js';
 import { realExec } from './exec.js';
 import { resolveIsolation } from './isolation/policy.js';
 import { pinSubscriptionForLaunch } from './subscriptions/launch.js';
@@ -48,6 +48,7 @@ export class SupervisorRecycleRequiredError extends Error {
         this.name = 'SupervisorRecycleRequiredError';
     }
 }
+const defaultProbeGeneration = (env) => probeDaemonGeneration((url, init) => globalThis.fetch(url, init), env);
 const defaultDeps = () => ({
     prepareAgentOurs: prepareManagedAgent,
     releaseAgentOurs: releaseManagedAgent,
@@ -64,7 +65,7 @@ const defaultDeps = () => ({
     now: () => Date.now(),
     log: line => process.stderr.write(line + '\n'),
     fetch: (url, init) => globalThis.fetch(url, init),
-    probeGeneration: env => probeDaemonGeneration((url, init) => globalThis.fetch(url, init), env),
+    probeGeneration: defaultProbeGeneration,
     createMonitor: opts => createMonitor(opts),
     createOwnerChannel: opts => new OwnerChannel(opts),
     startAgentSession: (adapter, options) => adapter.start(options),
@@ -622,6 +623,7 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
     // Self-reminders live and die with this attempt's runtime binding: every exit
     // path below stops the dispatcher before that binding is released.
     let reminderManager;
+    let selectedHealth;
     try {
         const managedHarness = prepareManagedHarness(role, dir, runCwd, managedService.descriptor, { ...harnessChildEnv(role, launch.env, dir), ...subscription?.env });
         // Start-stagger: space this launch at least start_stagger_ms after the previous
@@ -669,8 +671,15 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
             name, identity: role.identity, agentDir: dir, cfg: role.monitor,
             deps: resolvedMonitorDeps,
         }) : null;
+        // Injected legacy probes keep their test/embedding contract. Production uses
+        // one retained owner for generation and identity health in this process.
+        const retainHealth = deps.probeGeneration === defaultProbeGeneration
+            && !deps.identityProbeDeps ? acquireSelectedDaemonHealth : undefined;
+        selectedHealth = retainHealth?.(resolvedMonitorDeps.env);
         const daemonObserver = new DaemonGenerationObserver();
-        const initialDaemon = daemonObserver.observe(await deps.probeGeneration(resolvedMonitorDeps.env));
+        const initialDaemon = daemonObserver.observe(selectedHealth
+            ? (await selectedHealth.sample()).generation
+            : await deps.probeGeneration(resolvedMonitorDeps.env));
         let sessionStartedWithoutDaemonBaseline = initialDaemon.kind !== 'baseline';
         if (monitor)
             await monitor.prime({ resetCursor: resetMonitorCursor });
@@ -1113,7 +1122,9 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
             const now = deps.now();
             if (now >= nextDaemonProbeAt) {
                 nextDaemonProbeAt = now + 2_000;
-                const observation = daemonObserver.observe(await deps.probeGeneration(resolvedMonitorDeps.env));
+                const observation = daemonObserver.observe(selectedHealth
+                    ? (await selectedHealth.sample()).generation
+                    : await deps.probeGeneration(resolvedMonitorDeps.env));
                 if (observation.kind === 'lost')
                     recoveryController.noteLoss(observation.reason);
                 if (observation.kind === 'changed' || observation.kind === 'available'
@@ -1147,19 +1158,22 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
             }
             if (temp && now >= nextIdentityPollAt) {
                 nextIdentityPollAt = now + TEMP_IDENTITY_POLL_MS;
-                const presence = await probeIdentityPresence(role.identity, deps.fetch, resolvedMonitorDeps.env, deps.identityProbeDeps);
+                const presence = selectedHealth
+                    ? selectedHealth.presence(role.identity, await selectedHealth.sample())
+                    : await probeIdentityPresence(role.identity, deps.fetch, resolvedMonitorDeps.env, deps.identityProbeDeps);
+                const identityObservedAt = deps.now();
                 if (presence.state === 'present') {
                     identityObserved = true;
                     identityAbsentSince = undefined;
                 }
                 else if (presence.state === 'absent' && identityObserved) {
-                    identityAbsentSince ??= now;
+                    identityAbsentSince ??= identityObservedAt;
                     // Require a continuous, time-bounded run of authoritative absence.
                     // The first positive observation is the readiness gate: cold harness
                     // starts may spend minutes loading the harness and briefing before the
                     // agent creates/binds its identity, and absence before then is not a
                     // close event. After readiness, debounce a real disappearance.
-                    if (now - identityAbsentSince >= TEMP_IDENTITY_CLOSE_DEBOUNCE_MS) {
+                    if (identityObservedAt - identityAbsentSince >= TEMP_IDENTITY_CLOSE_DEBOUNCE_MS) {
                         retirementReason = 'identity-closed';
                         deps.log(`[${name}] temporary identity '${role.identity}' closed; retiring session and supervisor`);
                         reminderManager?.stop();
@@ -1273,6 +1287,7 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
         };
     }
     finally {
+        selectedHealth?.release();
         reminderManager?.stop();
         managedService.setReminders?.(undefined);
         await managedService.close(layoutRetiring);

package/dist/subscriptions/login.d.ts

@@ -33,6 +33,7 @@ declare abstract class BaseLogin implements LoginHandle {
     readonly provider: SubscriptionProvider;
     readonly owner: string;
     readonly kind: LoginView['kind'];
+    protected readonly changed: () => void;
     readonly loginId: string;
     readonly expiresAt: number;
     state: LoginState;
@@ -42,7 +43,7 @@ declare abstract class BaseLogin implements LoginHandle {
     done: Promise<boolean>;
     protected finish: (ok: boolean) => void;
     private readonly timer;
-    constructor(provider: SubscriptionProvider, owner: string, kind: LoginView['kind'], now?: number);
+    constructor(provider: SubscriptionProvider, owner: string, kind: LoginView['kind'], now?: number, changed?: () => void);
     view(): LoginView;
     abstract submitCode(code: string): void;
     protected abstract stop(): void;
@@ -59,7 +60,7 @@ export declare class ClaudeLogin extends BaseLogin {
     private continued;
     /** Resolves with the CLI exit status once it exits. */
     exited: Promise<number | null>;
-    constructor(owner: string, bins: SubscriptionBinaries, home: string, profileId: string);
+    constructor(owner: string, bins: SubscriptionBinaries, home: string, profileId: string, changed?: () => void);
     submitCode(code: string): void;
     protected stop(): void;
 }
@@ -69,7 +70,7 @@ export declare class CodexDeviceLogin extends BaseLogin {
     private codexLoginId?;
     /** Resolves true when the app-server reports a successful login. */
     completed: Promise<boolean>;
-    constructor(owner: string, bins: SubscriptionBinaries, home: string, profileId: string);
+    constructor(owner: string, bins: SubscriptionBinaries, home: string, profileId: string, changed?: () => void);
     submitCode(): void;
     protected stop(): void;
 }