@phnx-labs/agents-cli 1.22.117 → 1.22.118

package/dist/lib/daemon/supervisor.js

@@ -1,53 +1,53 @@
 /**
- * ServiceSupervisor (RUSH-3193 P1).
+ * ServiceSupervisor (RUSH-3193 P1, PHNX-4116).
  *
  * Owns the timer for every registered `PeriodicService`, replacing the bare
- * `setInterval` closures in `runDaemon()`. Two failure modes motivated it,
- * both observed in production:
+ * `setInterval` closures in `runDaemon()`. Two failure modes motivated it, both
+ * observed in production, and each is now handled without ever leaving a service
+ * silently dark:
  *
  *  - A throw escaping a tick's local try/catch used to hit the process-wide
- *    `uncaughtException` handler and `process.exit(1)` the whole daemon,
- *    taking every OTHER service down with it. Here, a tick failure is caught
- *    per-service and never propagates past `runTick`.
- *  - A tick that hangs on an unbounded await (SSH, keychain) used to latch its
- *    local in-flight guard `true` forever, silently freezing that one service
- *    for the daemon's life (observed ~51h). Here, every tick races a
- *    `deadlineMs` timeout; when the deadline wins, the service is ABANDONED
- *    (PHNX-3608): its `AbortSignal` is aborted so a cooperating tick can unwind
- *    its own I/O, the in-flight guard is released immediately, and the backoff
- *    restart is scheduled right away — it is NOT gated on the runaway promise
- *    settling. An earlier revision kept the guard held until the real promise
- *    settled, which meant a tick that never settles parked the service forever
- *    and blocked backoff restart, `daemon services restart`, and SIGHUP reload —
- *    the exact 12h-usage-dark class this exists to prevent. The orphaned promise
- *    is drained separately in the background; `finishTick` is version-guarded so
- *    its late settlement can never disturb the fresh tick the restart started.
+ *    `uncaughtException` handler and `process.exit(1)` the whole daemon, taking
+ *    every OTHER service down with it. Here a thrown tick is caught per-service,
+ *    recorded via `recordFailure`, and the service keeps ticking on its own
+ *    interval — a throw is recoverable, so it is retried in place on the next
+ *    tick and no sibling is disturbed.
+ *  - A tick that HANGS on an unbounded await (SSH, keychain) used to latch its
+ *    in-flight guard `true` forever, silently freezing that one service for the
+ *    daemon's life (observed ~51h). A hang cannot be retried in-process — the
+ *    promise may never settle — so when a tick (or a `start()`/`restart()`
+ *    lifecycle call) BREACHES its deadline the supervisor records the cause,
+ *    flushes it to disk, and EXITS the process (code 70). systemd
+ *    (`Restart=always`, `RestartSec=30`, `StartLimitIntervalSec=0`) and launchd
+ *    (`KeepAlive` + `ThrottleInterval=30`) restart the daemon within ~30s and the
+ *    wedged service comes back healthy with it.
  *
- * Repeated failures (thrown or timed-out) open a circuit breaker: the service
- * is parked (its timer stopped) and retried on exponential backoff via its own
- * `restart()`, while every sibling service keeps ticking on its own timer,
- * unaffected. `start()`/`stop()`/`restart()` are themselves bounded by
- * {@link ServiceSupervisorOptions.lifecycleDeadlineMs} so a wedged bind or close
- * cannot stall daemon startup or shutdown.
+ * This is the PHNX-4116 model: there is NO `parked` state and NO in-process
+ * backoff restart. A supervised service is `idle` before start, `running` while
+ * ticking, or `stopped` after a live disable / shutdown — a hang is not a fourth
+ * state to sit in, it is a reason to hand the daemon back to its OS supervisor,
+ * which is what actually "just works" like systemd/launchd. `start()`/`stop()`/
+ * `restart()` stay bounded by {@link ServiceSupervisorOptions.lifecycleDeadlineMs}
+ * so a wedged bind or close cannot stall daemon startup or shutdown; a start /
+ * restart lifecycle breach exits the same way a tick breach does.
  */
-import { recordSubsystemOk, recordSubsystemError, recordSubsystemState } from '../daemon-health.js';
+import { recordSubsystemOk, recordSubsystemError, recordSubsystemState, recordDaemonRestart } from '../daemon-health.js';
 import { isPeriodicService } from './service.js';
-const DEFAULT_PARK_AFTER_FAILURES = 3;
-const DEFAULT_BACKOFF_BASE_MS = 5_000;
-const DEFAULT_BACKOFF_MAX_MS = 5 * 60_000;
+/**
+ * Exit code the supervisor uses when a deadline breach hands the daemon back to
+ * its OS supervisor for a restart. 70 (`EX_SOFTWARE`) marks an internal software
+ * fault, distinct from a clean shutdown (0) or a config error.
+ */
+const DEADLINE_EXIT_CODE = 70;
 const DEFAULT_LIFECYCLE_DEADLINE_MS = 30_000;
 export class ServiceSupervisor {
     registry = new Map();
     ctx = null;
-    parkAfterFailures;
-    backoffBaseMs;
-    backoffMaxMs;
     lifecycleDeadlineMs;
+    exit;
     constructor(opts = {}) {
-        this.parkAfterFailures = opts.parkAfterFailures ?? DEFAULT_PARK_AFTER_FAILURES;
-        this.backoffBaseMs = opts.backoffBaseMs ?? DEFAULT_BACKOFF_BASE_MS;
-        this.backoffMaxMs = opts.backoffMaxMs ?? DEFAULT_BACKOFF_MAX_MS;
         this.lifecycleDeadlineMs = opts.lifecycleDeadlineMs ?? DEFAULT_LIFECYCLE_DEADLINE_MS;
+        this.exit = opts.exit ?? ((code) => process.exit(code));
     }
     /**
      * Race `op` against a deadline. On breach the returned promise rejects with a
@@ -85,7 +85,6 @@ export class ServiceSupervisor {
             state: options.enabled === false ? 'stopped' : 'idle',
             lastRunMs: 0,
             consecutiveFailures: 0,
-            restartAttempts: 0,
             inFlight: false,
             everStarted: false,
             idleWaiters: [],
@@ -117,7 +116,11 @@ export class ServiceSupervisor {
         for (const id of this.registry.keys())
             await this.stopOne(id, true);
     }
-    /** Force one service to restart right now, outside its normal backoff schedule. Drives `agents daemon services restart <id>` (RUSH-3193 P4). */
+    /**
+     * Force one service to restart right now — drives `agents daemon services
+     * restart <id>` (RUSH-3193 P4). A plain stop + start, with no intermediate
+     * `parked` state (PHNX-4116).
+     */
     async restartOne(id) {
         const entry = this.registry.get(id);
         if (!entry)
@@ -125,26 +128,8 @@ export class ServiceSupervisor {
         if (entry.inFlight) {
             throw new Error(`service '${id}' cannot restart while a tick is still in flight`);
         }
-        // A live periodic service already owns an interval. attemptRestart() installs
-        // a fresh one after restart, so leaving the existing handles alive would
-        // multiply the tick rate on every operator-requested restart.
-        if (entry.timer) {
-            clearInterval(entry.timer);
-            entry.timer = undefined;
-        }
-        if (entry.startupTimer) {
-            clearTimeout(entry.startupTimer);
-            entry.startupTimer = undefined;
-        }
-        if (entry.restartTimer) {
-            clearTimeout(entry.restartTimer);
-            entry.restartTimer = undefined;
-        }
-        // Block a timer callback already queued in this event-loop turn while the
-        // service tears down and starts again.
-        entry.state = 'parked';
-        recordSubsystemState(id, 'parked');
-        await this.attemptRestart(id);
+        await this.stopOne(id, false);
+        await this.startOne(id);
     }
     /** Whether `id` has a lifecycle owner on this supervisor, running or stopped. */
     isRegistered(id) {
@@ -156,8 +141,7 @@ export class ServiceSupervisor {
     }
     /**
      * Resolve when the service's current tick has really settled. Daemon control
-     * edges use this to queue a requested live transition without polling or
-     * treating a deadline race as cancellation.
+     * edges use this to queue a requested live transition without polling.
      */
     async awaitIdle(id) {
         const entry = this.registry.get(id);
@@ -165,11 +149,10 @@ export class ServiceSupervisor {
             throw new Error(`service '${id}' is not registered`);
         // Resolve from clearInFlight (which also flips `inFlight` false) rather than
         // from the tick promise directly: awaiting the tick promise resumed this
-        // caller on a shorter microtask chain than the tick's own finally→finishTick,
-        // so a queued `.then(stop)` could run before `inFlight` was cleared and
-        // `stop()` would throw "cannot stop while a tick is still in flight"
-        // (PHNX-3608 — the SIGHUP live-disable regression). Waiting on the guard
-        // itself makes the ordering deterministic.
+        // caller on a shorter microtask chain than the tick's own finally, so a
+        // queued `.then(stop)` could run before `inFlight` was cleared and `stop()`
+        // would throw "cannot stop while a tick is still in flight" (PHNX-3608 — the
+        // SIGHUP live-disable regression). Waiting on the guard makes it deterministic.
         if (!entry.inFlight)
             return;
         await new Promise((resolve) => { entry.idleWaiters.push(resolve); });
@@ -229,11 +212,10 @@ export class ServiceSupervisor {
             await this.withDeadline(() => entry.service.start(ctx), this.lifecycleDeadlineMs, `service '${id}' start`);
         }
         catch (err) {
-            // A thrown OR wedged start() parks the service and retries on backoff,
-            // rather than propagating out of startAll() and stalling the boot of
-            // every service after it (PHNX-3608).
-            this.recordFailure(entry, id, err);
-            this.park(id);
+            // A thrown OR wedged start()/restart() cannot leave the service silently
+            // dark, and there is no `parked` state to fall back to (PHNX-4116): record
+            // the cause and exit so systemd/launchd restart the whole daemon and retry.
+            this.exitForRestart(id, err);
             return;
         }
         entry.everStarted = true;
@@ -273,14 +255,18 @@ export class ServiceSupervisor {
             clearInterval(entry.timer);
             entry.timer = undefined;
         }
-        if (entry.restartTimer) {
-            clearTimeout(entry.restartTimer);
-            entry.restartTimer = undefined;
-        }
         if (entry.startupTimer) {
             clearTimeout(entry.startupTimer);
             entry.startupTimer = undefined;
         }
+        // Cancel the in-flight tick's deadline timer too — leaving it armed lets it
+        // fire `exitForRestart` mid-shutdown if the hung tick ignores the abort
+        // below (PHNX-4116). The `state === 'stopped'` guard in `runTick` is the
+        // belt to this braces.
+        if (entry.deadlineTimer) {
+            clearTimeout(entry.deadlineTimer);
+            entry.deadlineTimer = undefined;
+        }
         entry.state = 'stopped';
         recordSubsystemState(id, 'stopped');
         // Signal any in-flight tick to unwind — a cooperating tick threads this into
@@ -315,16 +301,16 @@ export class ServiceSupervisor {
         entry.timer = setInterval(() => { void this.runTick(id); }, entry.service.intervalMs);
     }
     /**
-     * Run one tick under a hard deadline (PHNX-3608). The tick receives an
-     * `AbortSignal` that is aborted when the deadline elapses, so a cooperating
-     * tick can bound its own I/O and unwind. The deadline itself is still enforced
-     * with `Promise.race` — JS cannot forcibly cancel an arbitrary await — but on
-     * a breach the service is ABANDONED, not parked-and-held: the in-flight guard
-     * is released immediately and the backoff restart is scheduled right away
-     * (via `park()`), so a tick that never settles can no longer wedge backoff,
-     * `daemon services restart`, or SIGHUP reload. The runaway promise drains in
-     * the background; `finishTick` is version-guarded on `activeTick`, so its late
-     * settlement can never disturb the fresh tick a restart has since started.
+     * Run one tick under a hard deadline (PHNX-3608, PHNX-4116). The tick receives
+     * an `AbortSignal` that is aborted when the deadline elapses, so a cooperating
+     * tick can bound its own I/O and unwind. The deadline itself is enforced with
+     * `Promise.race` — JS cannot forcibly cancel an arbitrary await.
+     *
+     * A tick that THROWS is recoverable: it is recorded and the interval keeps
+     * firing, so the service retries on its next tick. A tick that BREACHES its
+     * deadline is a hang that can never be retried in-process (the promise may
+     * never settle), so the supervisor exits the process (`exitForRestart`) and
+     * lets systemd/launchd restart the whole daemon.
      */
     async runTick(id) {
         const entry = this.registry.get(id);
@@ -339,13 +325,12 @@ export class ServiceSupervisor {
         entry.inFlight = true;
         const controller = new AbortController();
         entry.activeController = controller;
-        let deadlineTimer;
         let timedOut = false;
         const tickPromise = periodicService.tick(ctx, controller.signal);
         entry.activeTick = tickPromise;
         try {
             const deadline = new Promise((_, reject) => {
-                deadlineTimer = setTimeout(() => {
+                entry.deadlineTimer = setTimeout(() => {
                     timedOut = true;
                     reject(new Error(`tick exceeded deadline of ${periodicService.deadlineMs}ms`));
                 }, periodicService.deadlineMs);
@@ -357,88 +342,38 @@ export class ServiceSupervisor {
             recordSubsystemOk(id);
         }
         catch (err) {
-            this.recordFailure(entry, id, err);
-            if (timedOut || entry.consecutiveFailures >= this.parkAfterFailures)
-                this.park(id);
-        }
-        finally {
-            if (deadlineTimer)
-                clearTimeout(deadlineTimer);
-            if (timedOut) {
-                // Abandon the runaway tick: abort its signal so a cooperating tick can
-                // unwind, then release the in-flight guard NOW so the backoff restart
-                // park() scheduled is not blocked on a promise that may never settle.
-                // The real promise is drained separately and its result discarded — the
-                // version-guarded finishTick keeps that late settlement from touching a
-                // restart's fresh tick.
+            // A stopped service must never exit the process: `stopOne` may have
+            // force-stopped this tick (aborting its signal) while the deadline timer
+            // was still armed, and a hang that ignored the abort would otherwise let
+            // that timer fire `exitForRestart` mid-shutdown — wrong exit code, a
+            // spurious restart-ledger entry, and `handleShutdown` cleanup skipped
+            // (PHNX-4116). This is the belt to `stopOne`'s clearTimeout braces. Read
+            // the state fresh: `stopOne` mutated it across the `await` above, past the
+            // narrowing the top-of-function `state !== 'running'` guard applied.
+            const stoppedDuringTick = this.registry.get(id)?.state === 'stopped';
+            if (timedOut && !stoppedDuringTick) {
+                // Abort the runaway tick's signal so a cooperating tick can unwind, then
+                // hand the daemon back to its OS supervisor: a hang has no in-process
+                // recovery (PHNX-4116). `exitForRestart` calls `process.exit`, so nothing
+                // below runs in production; the injected test exit returns, and the
+                // `finally` still releases the in-flight guard.
                 controller.abort();
-                entry.activeTick = undefined;
-                entry.activeController = undefined;
-                this.clearInFlight(entry);
-                // Re-read the entry so its `state` is the full union, not the `'running'`
-                // narrowing from this function's entry-guard — park() set it to 'parked'.
-                const current = this.registry.get(id);
-                if (current && current.state === 'parked' && !current.restartTimer)
-                    this.scheduleRestart(id);
-                void tickPromise.then(() => undefined, () => undefined);
-            }
-            else {
-                this.finishTick(id, tickPromise);
+                this.exitForRestart(id, err);
+                return;
             }
+            // A throw is recoverable — record it and keep ticking on the next interval.
+            // A deadline breach of an already-stopped service is intentionally dropped.
+            if (!timedOut)
+                this.recordFailure(entry, id, err);
         }
-    }
-    park(id) {
-        const entry = this.registry.get(id);
-        if (!entry || entry.state === 'parked' || entry.state === 'stopped')
-            return;
-        entry.state = 'parked';
-        recordSubsystemState(id, 'parked');
-        if (entry.timer) {
-            clearInterval(entry.timer);
-            entry.timer = undefined;
-        }
-        this.ctx?.log('WARN', `service '${id}' parked after ${entry.consecutiveFailures} consecutive failure(s)`);
-        if (!entry.inFlight)
-            this.scheduleRestart(id);
-    }
-    scheduleRestart(id) {
-        const entry = this.registry.get(id);
-        if (!entry)
-            return;
-        const delay = Math.min(this.backoffMaxMs, this.backoffBaseMs * 2 ** entry.restartAttempts);
-        entry.restartAttempts += 1;
-        entry.restartTimer = setTimeout(() => { void this.attemptRestart(id); }, delay);
-    }
-    async attemptRestart(id) {
-        const entry = this.registry.get(id);
-        const ctx = this.ctx;
-        if (!entry || !ctx || entry.state === 'stopped')
-            return;
-        try {
-            // A wedged restart() must not silently stall the circuit breaker — bound
-            // it and treat a breach as another failed restart, retried on backoff.
-            await this.withDeadline(() => entry.service.restart(), this.lifecycleDeadlineMs, `service '${id}' restart`);
-            entry.everStarted = true; // restart() is stop()+start() on the service — a successful one means it is running again and owes a stop() at shutdown.
-            entry.state = 'running';
-            recordSubsystemState(id, 'running');
-            entry.consecutiveFailures = 0;
-            entry.restartAttempts = 0;
-            entry.lastError = undefined;
-            if (isPeriodicService(entry.service)) {
-                this.scheduleTimer(id);
-                void this.runTick(id);
-            }
-            else {
-                entry.lastRunMs = Date.now();
+        finally {
+            if (entry.deadlineTimer) {
+                clearTimeout(entry.deadlineTimer);
+                entry.deadlineTimer = undefined;
             }
-            recordSubsystemOk(id);
-            ctx.log('INFO', `service '${id}' restarted`);
-        }
-        catch (err) {
-            this.recordFailure(entry, id, err);
-            entry.state = 'parked';
-            recordSubsystemState(id, 'parked');
-            this.scheduleRestart(id);
+            entry.activeTick = undefined;
+            entry.activeController = undefined;
+            this.clearInFlight(entry);
         }
     }
     recordFailure(entry, id, err) {
@@ -448,14 +383,44 @@ export class ServiceSupervisor {
         recordSubsystemError(id, message);
         this.ctx?.log('WARN', `service '${id}' failed: ${message}`);
     }
-    finishTick(id, tickPromise) {
+    /**
+     * Record a deadline breach durably and exit the process so systemd/launchd
+     * restart the whole daemon (PHNX-4116). `recordSubsystemError` writes
+     * `health.json` synchronously (atomic write under a file lock), so the cause is
+     * on disk before we exit; `recordDaemonRestart` appends to the restart ledger
+     * `agents daemon status` reads for "restarts in the last 24h". Every timer is
+     * frozen first so no further tick fires between this decision and process death
+     * — and so an injected test `exit` (which does not actually exit) still observes
+     * exactly one call.
+     */
+    exitForRestart(id, err) {
+        const cause = err instanceof Error ? err.message : String(err);
         const entry = this.registry.get(id);
-        if (!entry || entry.activeTick !== tickPromise)
-            return;
-        entry.activeTick = undefined;
-        entry.activeController = undefined;
-        this.clearInFlight(entry);
-        if (entry.state === 'parked' && !entry.restartTimer)
-            this.scheduleRestart(id);
+        if (entry) {
+            entry.consecutiveFailures += 1;
+            entry.lastError = cause;
+        }
+        recordSubsystemError(id, cause);
+        recordDaemonRestart(id, cause);
+        this.ctx?.log('ERROR', `service '${id}' breached its deadline (${cause}); exiting (code ${DEADLINE_EXIT_CODE}) for a supervised restart`);
+        this.freezeTimers();
+        this.exit(DEADLINE_EXIT_CODE);
+    }
+    /** Clear every service's interval / startup timer — the process is exiting. */
+    freezeTimers() {
+        for (const entry of this.registry.values()) {
+            if (entry.timer) {
+                clearInterval(entry.timer);
+                entry.timer = undefined;
+            }
+            if (entry.startupTimer) {
+                clearTimeout(entry.startupTimer);
+                entry.startupTimer = undefined;
+            }
+            if (entry.deadlineTimer) {
+                clearTimeout(entry.deadlineTimer);
+                entry.deadlineTimer = undefined;
+            }
+        }
     }
 }

package/dist/lib/daemon/testdata/process-view-start.js

@@ -18,7 +18,10 @@ fs.writeFileSync(path.join(process.env.HOME, 'test-child.pid'), String(started.p
 try {
     if (!cold)
         assert.ok(fs.existsSync(path.join(getDaemonDir(), 'health.json')), 'ordinary launcher publishes health before daemon starts');
-    const socket = path.join(getCacheDir(), 'helpers', 'browser', 'browser.sock');
+    // Daemon-liveness socket: the browser IPC socket left with the standalone
+    // browser CLI (PHNX-4101), so this waits on the feed-stream hub socket the
+    // daemon binds unconditionally on boot.
+    const socket = path.join(getCacheDir(), 'helpers', 'feed', 'feed-stream.sock');
     let ready = false;
     for (let i = 0; i < 80 && !ready; i++) {
         ready = await new Promise(resolve => {
@@ -31,7 +34,7 @@ try {
         if (!ready)
             await new Promise(resolve => setTimeout(resolve, 100));
     }
-    assert.ok(ready, 'ordinary fresh-home daemon must serve its actual browser socket');
+    assert.ok(ready, 'ordinary fresh-home daemon must serve its feed-stream hub socket');
     assert.equal(fs.readFileSync(path.join(getDaemonDir(), 'daemon.pid'), 'utf8').trim(), String(started.pid));
     const owner = JSON.parse(fs.readFileSync(path.join(getTerminalsDir(), 'process-view.json'), 'utf8'));
     assert.equal(owner.pidNamespace, fs.readlinkSync('/proc/self/ns/pid'));

package/dist/lib/daemon/usage-sync-service.d.ts

@@ -1,29 +1,24 @@
 /**
- * Fleet shared-state sync as a `PeriodicService` (PHNX-3392 usage-sync,
- * PHNX-3792 session mirror).
+ * Fleet state exchange as a `PeriodicService` (PHNX-3392 usage-sync,
+ * PHNX-3792 session mirror, PHNX-4051 auth verdict, PHNX-4116 SSH transport).
  *
- * This is the ONE tick that owns the bounded Git exchange over the fleet-synced
- * user repo, so every non-secret daemon-state field rides it rather than opening
- * a second committer. Each tick: (1) publishes this box's own fields into its
- * conflict-free `devices/<device>/daemon-state.json` — a headed box's Claude
- * usage snapshot, EVERY box's lightweight session digests (PHNX-3792), and the
- * reserved-auth readiness verdict (PHNX-4051, folded in from the auth-sync tick
- * so a single caller holds the shared-repo lock per tick); (2) runs one
- * serialized, timeout-bounded commit/rebase/push; (3) consumes the peer fields
- * the exchange delivered — a worker merges usage newest-wins, and every
- * non-worker box folds peers' session digests into its local index so the picker
- * renders remote-host previews inline. No tick opens a device-to-device SSH mesh.
+ * Each tick: (1) refreshes every field this box owns in its own
+ * `devices/<device>/daemon-state.json` — a headed box's Claude usage snapshot,
+ * EVERY box's lightweight session digests, and the reserved-auth readiness
+ * verdict; (2) on a headed box (`personal`/`desktop`) only, dials every dialable
+ * peer in parallel with `agents __usage-ingest --reply`, sending that envelope
+ * on stdin and storing each peer's reply as `devices/<peer>/daemon-state.json`
+ * stamped `receivedAt` (`exchangeFleetStateWithPeers`); (3) folds the peers'
+ * session digests into the local index so the picker renders remote-host
+ * previews inline. A worker never initiates: its state leaves the box only as
+ * the reply to a headed peer's dial, and a headed peer's usage rows arrive on
+ * that same dial.
  *
- * Why the auth verdict publishes here (PHNX-4051): auth-sync used to run its OWN
- * `syncFleetSharedStateRepo`, so on every box two ticks 30 s apart contended for
- * the one `proper-lockfile` lock (20×100 ms ≈ 2 s of retries) while a real
- * fetch/rebase/push on a drifted repo runs far longer — the usage tick then
- * failed with "Lock file is already being held" (zion logged it 95× in 24 h) and
- * workers never received a fresh usage snapshot, which the 40-min placement gate
- * turned into "no ready device". Folding the auth verdict into this single
- * committer removes the second caller entirely. Auth-sync keeps its non-git
- * duties (worker-slot reconcile + the credential SSH pushes) under its own
- * deadline and circuit breaker.
+ * There is no git in this tick. The exchange used to be a commit/rebase/push of
+ * the fleet-synced user repo, which needed a cross-process lock, a 45 s
+ * process-tree deadline, an 8-minute kickoff offset from auth-sync to dodge that
+ * lock, and untracked-collision backups — and still wedged every clone behind a
+ * bloated remote. Peers that time out are skipped this tick; none blocks another.
  */
 import { BasePeriodicService, type DaemonContext } from './service.js';
 import type { DaemonServiceId } from '../daemon-services.js';
@@ -36,17 +31,13 @@ import type { DaemonServiceId } from '../daemon-services.js';
  * second literal, so the two files can't drift out of sync with each other.
  */
 export declare const USAGE_SYNC_TICK_MS: number;
-/**
- * Offset from auth-sync's 60s kickoff so the two never contend for the
- * shared-repo lock. Auth fires at T+1m, T+16m, …; usage at T+8m, T+23m, …
- * The git exchange deadline is 45s, so a 7-minute gap is the whole point.
- */
-export declare const USAGE_SYNC_KICKOFF_MS: number;
+/** Let the daemon's registry/device probes settle before the first fan-out. */
+export declare const USAGE_SYNC_KICKOFF_MS = 90000;
 export declare class UsageSyncService extends BasePeriodicService {
     readonly id: DaemonServiceId;
     readonly intervalMs: number;
     readonly deadlineMs: number;
-    readonly startupDelayMs: number;
+    readonly startupDelayMs = 90000;
     protected onStart(_ctx: DaemonContext): Promise<void>;
     protected onStop(): Promise<void>;
     protected onTick(ctx: DaemonContext): Promise<void>;