feat(server): collect runtimes after one idle hour with optional provider vetoes

Keep callers resident while local or remote finish notification intent remains outstanding. Daemon-owned work determines baseline eligibility; provider checks add optional vetoes. Own the idle clock and sweep lifecycle in one cleanup module while the manager retains guarded closure.

docs/agent-lifecycle.md

@@ -25,16 +25,25 @@ Reload releases the old runtime before resuming its durable session: an idle pro
 still own an exclusive writer. A close failure retains that runtime for cleanup and blocks the
 replacement. Once closure succeeds, a failed resume leaves the durable agent closed and retryable.
 
-Idle resumable runtimes are collected after 30 minutes without activity, checked once a minute.
+Idle resumable runtimes are collected after one hour without activity, checked once a minute.
 Collection releases the process and preserves the agent record, conversation, relationships, and
 provider session. The next prompt resumes that session. Set `agents.idleRuntimeCleanup: false` in
 host config to disable automatic collection; this setting takes effect at daemon startup.
 
 Foreground runs, permissions and responses, queued deliveries, lifecycle operations, and working
-managed or native descendants prevent collection. An idle managed child can still own background
-work. Each provider must positively permit shutdown through `canStopRuntime()`; missing methods,
-failed probes, and probe timeouts retain ownership. Once protected work finishes, a fresh idle
-period starts. There is no deadline that overrides a provider veto.
+managed or native descendants prevent collection. Outstanding local or remote finish subscriptions
+also protect their caller, including registration, recovery and notification dispatch acknowledgment.
+An idle managed child can still own background work.
+
+The daemon baseline always applies. An optional provider `canStopRuntime()` adds a veto: false,
+errors and timeouts retain ownership, while true cannot override daemon blockers. Without a provider
+check, the baseline decides collection after the same one-hour idle period. Once protected work
+finishes, a fresh idle hour starts. There is no deadline that overrides a veto.
+
+The `idle-runtime-cleanup/` module owns the clocks, eligibility policy and sweep lifetime.
+AgentManager supplies captured runtime capabilities and owns atomic revalidation and shutdown.
+Finish subscriptions expose caller protection through their public capability; the collector never
+reads their watches or durable records.
 
 The collector rechecks daemon state after asynchronous probes and event draining, in the existing
 close/load lifecycle lane. A prompt admitted before closure prevents collection. A prompt arriving
@@ -56,10 +65,10 @@ Provider checks follow the signals their runtimes expose:
   injection, and admitted or scheduled continuations that can re-wake the session. Older OMP
   runtimes without either field stay resident. These signals are not an inventory of arbitrary
   processes.
-- ACP has no complete signal for agent-owned background work, so its adapters stay resident.
+- ACP has no provider safety check, so its adapters use baseline-only collection.
 
 These checks do not discover arbitrary detached processes or work hidden by third-party
-extensions. A provider plugin opts in through the [runtime safety contract](../public-docs/plugins/providers.md#permit-idle-runtime-cleanup).
+extensions. A provider plugin adds its own veto through the [runtime safety contract](../public-docs/plugins/providers.md#permit-idle-runtime-cleanup).
 
 A provider runtime can still die on its own — crash, OOM kill, host suspend. Work the agent parked
 inside that process dies with it: Claude Code's background Bash shells, `Monitor` watches, and

docs/plugins.md

@@ -498,7 +498,7 @@ Validate and apply it inside the provider; core does not know your option shape.
 See [provider options](custom-providers.md#provider-options) for configuration and
 merge semantics.
 
-Providers opt in to idle runtime collection through the per-session
+Providers add an optional veto to daemon baseline cleanup through the per-session
 [runtime safety query](../public-docs/plugins/providers.md#permit-idle-runtime-cleanup).
 The daemon calls the same `AgentSession.canStopRuntime()` interface for built-ins and plugins;
 the plugin bridge transports that query through the existing provider request/event protocol.