[0xacee]

Why this matters: The background session poller runs local history scans and session resets synchronously on Token Spy's asyncio loop. A slow configured local filesystem or reset command stalls unrelated HTTP requests, including health checks and proxy traffic.

Offload the local scan and both reset I/O calls to worker threads while keeping polling order, decisions and cooldown updates on the event loop.

Validation:

• Run the production poller with deliberately blocked local status/reset I/O and issue a real ASGI GET /health on the same event loop.
• Baseline: 2 failed; health only responded after the blocked operation ended. Fixed full Token Spy suite: 24 passed, 1 skipped.
• The regressions assert operation order, not a narrow latency target. A six-second watchdog releases the old implementation so failures finish; every worker is released and joined during cleanup.
• Changed-file Ruff E/F/W and git diff --check pass.

Overlap check: all-state title/file searches. Other event-loop PRs (#3739/#3498/#3350/#2700) affect remote-provider probes. #4569 bounds scanner memory and #4583 binds local reset selection; neither prevents poller I/O from blocking the proxy loop.

AI assistance: implemented and validated with Codex. Review required before merge: independent review of background session operations. Tests simulate stalled I/O; no live agent or remote reset was exercised.

Combined validation: c08b6695ff14 on public-beta base 9fc9f61. Token Spy: 64 passed, 1 skipped, including assessed-target deletion and event-loop responsiveness together.

Merge guidance: tested Token Spy main.py order is #4561, #4569, #4583, #4634, #4640. The #4583/#4634 poller conflict must retain await asyncio.to_thread for status and reset, include_session_id=True on assessment, session_id=status["_reset_session_id"] on deletion, and cooldown updates only after action == "killed".