[ancongui]

The factory floor currently has to treat a recorded running task as unknown. This change retains short-lived observations only while the current Engine owns the exact run, task, attempt, native intent, latest plan and frozen scope. The dashboard reads those observations in its existing authorized snapshot; missing, expired, replaced or unsupported observations stay unknown. Its existing renderer can use the observed counts and earliest expiry without inventing activity from stored task status.

A positive observation establishes Engine-stage ownership, not remote model, provider or runner CPU liveness. Worker liveness remains explicitly unavailable. The existing execution snapshot is a durable canonical-user grant, not the original browser session: logout alone does not cancel the job or withdraw that grant. Current execution identity/required project permission/administrator checks govern the stage; dashboard readers independently require their current native session and read grants. The architecture and operator guide describe this separation. SCM-delegated and personal-token execution actors are not promoted into supported execution identities. Personal read tokens retain only their existing selected-project/run observations and current authority checks.

The native pyfly service uses one bulk heartbeat per Engine, SQL-clock expiry and fenced compare-and-set writes. Observation failure cannot replay a task or change its outcome. Nested cleanup preserves credential-scope closure, ownership release, real caller cancellation and the undrained-consumer hold. The heartbeat/staleness/sample settings affect telemetry, not a job deadline or execution grant. The schema 32-to-33 migration adds only its observation table, preserving retained rows. Existing admission/runtime material prefixes are preserved and the two new implementation modules are appended; this PR registers no coding profile or new authority.

Validation:

• 172 predecessor component host cases pass. After normal integration with current main and pyfly 26.10.22, 71 joint observation/recovery cases pass with socket, HTTP, process and SQL effects at zero and models disabled. Full mypy checks 420 modules; the changed fixtures pass Ruff and formatting.
• Twelve distinct cases pass on actual local PostgreSQL 17 with native pyfly 26.10.7 and the existing Agentic 26.10.1 runtime. They cover ownership renewal/end/takeover, stale scope/actor/attempt/plan/fence/expiry, cancellation, reader visibility, dashboard positives/receipts, selected-project PAT reads/refusals and a populated exact historical schema32 migration with every old table's rows unchanged.
• The first native batch recorded eleven passes and one fixture failure: its token iat used a datetime where the native model requires a float. A test-only successor uses .timestamp(); only that failed case was rerun in a fresh cluster and passed. Production source is byte-identical between these cuts. Both clusters drained, their data was preserved, and temporary credentials were removed. No broad predecessor acceptance is substituted for these actual checks.

This focused PR targets main after normal integration of merged #89, including its pyfly 26.10.22 pin and corrected Studio tests. The earlier hosted head exposed thirteen failures in fixtures that bypass Engine construction and omitted its optional observer; those fixtures now initialize the same None default as the production constructor. Recovery assertions remain unchanged. Fresh current-head CI is required before merge. It changes no AI model selection, runtime dependency pins, Koinon integration, actor snapshot formats, execution grants or Original CRM data/services. Its observation table is a new durable entity; it does not query the runner controller's private schema. Component acceptance remains separate from installed-product integration, hosted CI, release publication and registered coding qualification.