feat(account-health): reconcile remote bind state and ignore stale runtime reports

Track an authRevision per local record so a fresh bind cancels in-flight
probes, sync server-confirmed health back into the desktop cache via
reconcileTrackedAccountRemoteState, include verified_at in the upsert
signature, and drop runtime health reports older than the stored
verified_at on the server side.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

server/internal/tenant/app/desktop_account_service.go

@@ -504,6 +504,9 @@ func (s *DesktopAccountService) applyRuntimeHealth(ctx context.Context, workspac
 		if !ok {
 			continue
 		}
+		if !shouldApplyDesktopAccountRuntimeHealth(items[index], report) {
+			continue
+		}
 
 		health := effectiveDesktopAccountRuntimeHealth(report)
 		authState := report.AuthState
@@ -523,6 +526,13 @@ func (s *DesktopAccountService) applyRuntimeHealth(ctx context.Context, workspac
 	}
 }
 
+func shouldApplyDesktopAccountRuntimeHealth(item DesktopAccountView, report bufferedDesktopAccountHealthReport) bool {
+	if item.VerifiedAt == nil {
+		return true
+	}
+	return !report.CheckedAt.Before(*item.VerifiedAt)
+}
+
 func effectiveDesktopAccountRuntimeHealth(report bufferedDesktopAccountHealthReport) string {
 	authState := strings.TrimSpace(report.AuthState)
 	probeState := strings.TrimSpace(report.ProbeState)

server/internal/tenant/app/desktop_account_service_test.go

@@ -117,3 +117,43 @@ func TestBuildDesktopAccountView_FallsBackToStoredClientWhenNoPresence(t *testin
 	}
 	assert.Equal(t, &lastSeen, view.ClientLastSeenAt)
 }
+
+func TestShouldApplyDesktopAccountRuntimeHealth_IgnoresReportOlderThanVerifiedAt(t *testing.T) {
+	verifiedAt := time.Date(2026, 4, 30, 9, 30, 0, 0, time.UTC)
+	reportCheckedAt := verifiedAt.Add(-time.Minute)
+
+	shouldApply := shouldApplyDesktopAccountRuntimeHealth(
+		DesktopAccountView{
+			ID:         uuid.NewString(),
+			Health:     "live",
+			VerifiedAt: &verifiedAt,
+		},
+		bufferedDesktopAccountHealthReport{
+			Health:    "expired",
+			AuthState: "expired",
+			CheckedAt: reportCheckedAt,
+		},
+	)
+
+	assert.False(t, shouldApply)
+}
+
+func TestShouldApplyDesktopAccountRuntimeHealth_AppliesReportAfterVerifiedAt(t *testing.T) {
+	verifiedAt := time.Date(2026, 4, 30, 9, 30, 0, 0, time.UTC)
+	reportCheckedAt := verifiedAt.Add(time.Minute)
+
+	shouldApply := shouldApplyDesktopAccountRuntimeHealth(
+		DesktopAccountView{
+			ID:         uuid.NewString(),
+			Health:     "live",
+			VerifiedAt: &verifiedAt,
+		},
+		bufferedDesktopAccountHealthReport{
+			Health:    "expired",
+			AuthState: "expired",
+			CheckedAt: reportCheckedAt,
+		},
+	)
+
+	assert.True(t, shouldApply)
+}