@phnx-labs/agents-cli 1.22.98 → 1.22.100

package/dist/lib/auth-health.js

@@ -19,7 +19,9 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import { ALL_AGENT_IDS, getAccountInfo } from './agents.js';
-import { getCacheDir } from './state.js';
+import { listNativeAccounts } from './account-registry.js';
+import { readSlots } from './accounts/slots.js';
+import { getCacheDir, readMeta } from './state.js';
 import { probeClaudeStatus, probeDroidStatus, probeKimiStatus, USAGE_HEADLESS_SCOPE_MARKER, readClaudeUsageCache, } from './accounting/usage.js';
 import { getVersionHomePath, listInstalledVersions } from './installations/versions.js';
 import { atomicWriteFileSync, ensureLockTarget, withFileLock } from './fs-atomic.js';
@@ -218,6 +220,71 @@ export function authAccountLabel(info) {
 export function authCacheKey(host, agent, version) {
     return `${host}:${agent}:${version}`;
 }
+/**
+ * Host-independent identity of one probe target — the (agent, version) pair
+ * {@link authCacheKey} is keyed by. The separator cannot appear in either half,
+ * so an agent id can never run into a version the way a `:` join allows.
+ */
+export function authTargetKey(agent, version) {
+    return `${agent}@${version}`;
+}
+/**
+ * The `version` slot an account SLOT occupies in the auth cache and the probe
+ * rows: `slot:<accountId>`. A slot is a HOME-shaped dir, not an installed
+ * version, so it needs its own key or its verdict would collide with (or be
+ * silently dropped in favor of) whichever version home the account's label
+ * happened to match.
+ */
+export function slotAuthVersionKey(accountId) {
+    return `slot:${accountId}`;
+}
+/**
+ * Every registered account's slot on this device (PHNX-3940 T1), as probe
+ * targets. Before this the probe walked `listInstalledVersions` only, so a
+ * slot's verdict was never re-derived after `accounts add/login` wrote it —
+ * a slot re-materialized as `unconfigured` while the device doc was unreadable
+ * stayed MISSING forever even though its login was live. A slot whose dir is
+ * gone is skipped: there is nothing to probe and the row would only say so.
+ */
+export function enumerateSlotInstalls(meta, agentIds) {
+    const byId = new Map(listNativeAccounts(meta).map((account) => [account.id, account]));
+    const out = [];
+    for (const [accountId, slot] of Object.entries(readSlots(meta))) {
+        const account = byId.get(accountId);
+        if (!account || !agentIds.includes(account.agent))
+            continue;
+        if (!fs.existsSync(slot.slotDir))
+            continue;
+        out.push({ agent: account.agent, version: slotAuthVersionKey(accountId), home: slot.slotDir, account: undefined, accountId });
+    }
+    return out;
+}
+/**
+ * Every (agent, version) home the local auth probe covers on this device —
+ * installed version homes plus account slots. {@link probeLocalFleetAuth} probes
+ * exactly this set, so it is also the answer to "which cached rows are still
+ * backed by something on disk" (PHNX-4051).
+ */
+export function enumerateLocalAuthInstalls(meta, agentIds) {
+    const installs = [];
+    for (const agent of agentIds) {
+        for (const version of listInstalledVersions(agent)) {
+            installs.push({ agent, version, home: getVersionHomePath(agent, version), account: undefined });
+        }
+    }
+    for (const slot of enumerateSlotInstalls(meta, agentIds))
+        installs.push(slot);
+    return installs;
+}
+/**
+ * {@link authTargetKey} for every local probe target — what a cached row must
+ * match to still be about this device. A row outside it is an ORPHAN: its home
+ * was uninstalled, so nothing will ever re-probe it and its `checkedAt` is
+ * frozen at whatever the last probe left (PHNX-4051).
+ */
+export function localAuthTargetKeys(agentIds = ALL_AGENT_IDS) {
+    return new Set(enumerateLocalAuthInstalls(readMeta(), agentIds).map((i) => authTargetKey(i.agent, i.version)));
+}
 function cacheFilePath() {
     return path.join(getCacheDir(), '.auth-health.json');
 }
@@ -237,23 +304,34 @@ export function readAuthHealthCache() {
 export function readAuthHealth(host, agent, version) {
     return readAuthHealthCache()[authCacheKey(host, agent, version)] ?? null;
 }
+/**
+ * Split a cache key back into the install it names, for one host. Returns null
+ * for a key that belongs to another host or does not name a known agent — the
+ * one place the `host:agent:version` join is undone.
+ */
+export function parseAuthCacheKey(key, host) {
+    const prefix = `${host}:`;
+    if (!key.startsWith(prefix))
+        return null;
+    const identity = key.slice(prefix.length);
+    const separator = identity.indexOf(':');
+    if (separator <= 0)
+        return null;
+    const agent = identity.slice(0, separator);
+    if (!ALL_AGENT_IDS.includes(agent))
+        return null;
+    return { agent: agent, version: identity.slice(separator + 1) };
+}
 /** Reconstruct one host's published probe rows for a lease waiter/CLI reader. */
 export function readFleetAuthRows(host) {
-    const prefix = `${host}:`;
     const rows = [];
     for (const [key, health] of Object.entries(readAuthHealthCache())) {
-        if (!key.startsWith(prefix))
-            continue;
-        const identity = key.slice(prefix.length);
-        const separator = identity.indexOf(':');
-        if (separator <= 0)
-            continue;
-        const agent = identity.slice(0, separator);
-        if (!ALL_AGENT_IDS.includes(agent))
+        const install = parseAuthCacheKey(key, host);
+        if (!install)
             continue;
         rows.push({
-            agent: agent,
-            version: identity.slice(separator + 1),
+            agent: install.agent,
+            version: install.version,
             account: health.account,
             accountId: health.accountId,
             health,
@@ -277,15 +355,26 @@ export function mergeAuthHealthEntries(current, incoming) {
     }
     return merged;
 }
-/** Merge one or more entries into the cache (best-effort write). */
-export function writeAuthHealthEntries(entries) {
+/**
+ * Merge one or more entries into the cache (best-effort write).
+ *
+ * `drop` removes entries the writer knows are gone — it runs on the PRE-merge
+ * cache, so an incoming row always wins over a drop of the same key and the two
+ * can never fight. Only a writer that knows the full truth for the keys it drops
+ * may pass one (see {@link writeFleetAuthRows}).
+ */
+export function writeAuthHealthEntries(entries, drop) {
     try {
         const target = cacheFilePath();
         ensureLockTarget(target, JSON.stringify({ version: 1, entries: {} }));
         withFileLock(target, () => {
+            let current = readAuthHealthCache();
+            if (drop) {
+                current = Object.fromEntries(Object.entries(current).filter(([key]) => !drop(key)));
+            }
             const merged = {
                 version: 1,
-                entries: mergeAuthHealthEntries(readAuthHealthCache(), entries),
+                entries: mergeAuthHealthEntries(current, entries),
             };
             atomicWriteFileSync(target, JSON.stringify(merged, null, 2));
         });
@@ -410,26 +499,20 @@ export function groupFleetAuthInstalls(installs, isMergeable = () => true) {
  */
 export async function probeLocalFleetAuth(opts) {
     const agentIds = opts?.agents ?? ALL_AGENT_IDS;
-    // Enumerate every install, then resolve its account label. getAccountInfo is a
-    // local credential-file read (no network), so this fan-out is cheap and cannot
-    // contribute to the rate limit the probe grouping below exists to avoid.
-    const installs = [];
-    for (const agent of agentIds) {
-        for (const version of listInstalledVersions(agent)) {
-            installs.push({ agent, version, home: getVersionHomePath(agent, version), info: null, account: undefined });
-        }
-    }
+    // Enumerate every install AND every account slot on this device, then resolve
+    // each one's account label. getAccountInfo is a local credential-file read
+    // (no network), so this fan-out is cheap and cannot contribute to the rate
+    // limit the probe grouping below exists to avoid.
+    const { findNativeAccountByIdentity } = await import('./account-registry.js');
+    const meta = readMeta();
+    const installs = enumerateLocalAuthInstalls(meta, agentIds).map((inst) => ({ ...inst, info: null }));
     await Promise.all(installs.map(async (inst) => {
         inst.info = await getAccountInfo(inst.agent, inst.home).catch(() => null);
         inst.account = authAccountLabel(inst.info);
     }));
-    const [{ readMeta }, { findNativeAccountByIdentity }] = await Promise.all([
-        import('./state.js'),
-        import('./account-registry.js'),
-    ]);
-    const meta = readMeta();
     for (const inst of installs) {
-        inst.accountId = findNativeAccountByIdentity(meta, inst.agent, inst.info)?.id;
+        // A slot already knows its account; a version home is joined by identity.
+        inst.accountId ??= findNativeAccountByIdentity(meta, inst.agent, inst.info)?.id;
     }
     // Probe once per (agent, account) — but only for the network-probing agents
     // that can actually 429; best-effort agents stay per-install (see
@@ -453,11 +536,28 @@ export async function probeLocalFleetAuth(opts) {
     }));
     return perGroup.flat();
 }
-/** Persist a host's probed rows into the cache (keyed by host+agent+version). */
-export function writeFleetAuthRows(host, rows) {
+/**
+ * Persist a host's probed rows into the cache (keyed by host+agent+version).
+ *
+ * `installed` — the {@link authTargetKey} set of homes that still exist on
+ * `host` ({@link localAuthTargetKeys}) — prunes this host's ORPHAN entries: rows
+ * for a version that has since been uninstalled. Nothing re-probes those, so
+ * they never age out on their own; they froze the reuse window permanently false
+ * and kept surfacing in `agents view` / fleet status (PHNX-4051). Only a caller
+ * that enumerated `host`'s real installs may pass it — the `fleet ping` fan-out
+ * writes a PEER's rows and cannot enumerate that box's homes, so it omits it and
+ * merges as before.
+ */
+export function writeFleetAuthRows(host, rows, installed) {
     const entries = {};
     for (const row of rows) {
         entries[authCacheKey(host, row.agent, row.version)] = row.health;
     }
-    writeAuthHealthEntries(entries);
+    const drop = installed
+        ? (key) => {
+            const install = parseAuthCacheKey(key, host);
+            return install != null && !installed.has(authTargetKey(install.agent, install.version));
+        }
+        : undefined;
+    writeAuthHealthEntries(entries, drop);
 }

package/dist/lib/browser/arc-discovery.d.ts

@@ -1,7 +1,7 @@
 export interface ArcSpace {
     /** Stable UUID used for every native operation. */
     id: string;
-    /** Display-only title. */
+    /** Display-only title; empty when the Space is untitled. Never part of identity. */
     title: string;
 }
 export interface ArcProfile {

package/dist/lib/browser/arc-discovery.js

@@ -65,6 +65,13 @@ function parseProfileId(value, spaceId) {
     }
     return profileId;
 }
+function parseTitle(value, spaceId) {
+    if (value === undefined || value === null)
+        return '';
+    if (typeof value === 'string')
+        return value;
+    return { error: `Arc Space ${JSON.stringify(spaceId)} has a non-text title` };
+}
 export function parseSidebarSpaces(sidebarPath) {
     let parsed;
     try {
@@ -101,9 +108,12 @@ export function parseSidebarSpaces(sidebarPath) {
             if (typeof value.id !== 'string' || value.id !== encodedId) {
                 return { error: `Arc Space key ${JSON.stringify(encodedId)} does not match its stable id` };
             }
-            if (typeof value.title !== 'string') {
-                return { error: `Arc Space ${JSON.stringify(encodedId)} has no title` };
-            }
+            // Identity is the stable id and the profile binding. The title is
+            // display-only: Arc omits it for an untitled Space, which must still be
+            // listed (as `arc-space`) instead of taking every other Space down.
+            const title = parseTitle(value.title, encodedId);
+            if (typeof title !== 'string')
+                return title;
             if (ids.has(encodedId)) {
                 return { error: `Arc Space ${JSON.stringify(encodedId)} appears more than once` };
             }
@@ -111,7 +121,7 @@ export function parseSidebarSpaces(sidebarPath) {
             if (typeof profileId !== 'string')
                 return profileId;
             ids.add(encodedId);
-            spaces.push({ id: encodedId, title: value.title, profileId });
+            spaces.push({ id: encodedId, title, profileId });
         }
     }
     return spaces;

package/dist/lib/daemon/auth-sync-service.d.ts

@@ -1,10 +1,27 @@
 /**
  * Reserved `auth` bundle fleet sync as a `PeriodicService` (PHNX-2371).
  *
- * Each daemon publishes a safe readiness verdict to the fleet-shared user repo,
- * then runs the same serialized, timeout-bounded git exchange as usage sync.
- * One deterministic ready device asynchronously provisions peers whose delivered
- * verdict says `missing`; the secret never enters Git.
+ * This tick owns only the NON-git duties of auth sync: it materializes worker
+ * slots from durable keys already on the box, then (on the elected headed
+ * publisher) provisions peers whose LAST-DELIVERED verdict says `missing` by
+ * pushing the credential over SSH. The secret never enters Git.
+ *
+ * It no longer runs its own `syncFleetSharedStateRepo` (PHNX-4051). The verdict
+ * this tick's decisions read is published and delivered by the single git
+ * committer, the usage-sync tick — folding both publishes into one caller is
+ * what stops the two ticks (30 s apart) from contending for the one shared-repo
+ * lock and starving the usage snapshot workers depend on. This tick keeps its
+ * own deadline and circuit breaker, so a hung peer SSH push parks only auth-sync
+ * and never the usage delivery. The pushes read the peer verdicts the last
+ * usage-sync exchange wrote into the local checkout; they are idempotent
+ * (push only when a peer is missing a key), so acting on at-most-one-tick-old
+ * data converges exactly as the in-tick exchange did. To keep "at-most-one-tick-
+ * old" true, the pushes are gated on the exchange's freshness marker
+ * (`readLastSuccessfulExchangeMs`): when the last usage-sync exchange is missing
+ * or older than one usage-sync tick interval (`USAGE_SYNC_TICK_MS`, the
+ * producer's cadence — not this service's own `AUTH_SYNC_TICK_MS`), this tick
+ * skips the pushes and WARNs instead of acting on peer state that may no longer
+ * hold.
  */
 import { BasePeriodicService, type DaemonContext } from './service.js';
 import type { DaemonServiceId } from '../daemon-services.js';

package/dist/lib/daemon/auth-sync-service.js

@@ -1,12 +1,30 @@
 /**
  * Reserved `auth` bundle fleet sync as a `PeriodicService` (PHNX-2371).
  *
- * Each daemon publishes a safe readiness verdict to the fleet-shared user repo,
- * then runs the same serialized, timeout-bounded git exchange as usage sync.
- * One deterministic ready device asynchronously provisions peers whose delivered
- * verdict says `missing`; the secret never enters Git.
+ * This tick owns only the NON-git duties of auth sync: it materializes worker
+ * slots from durable keys already on the box, then (on the elected headed
+ * publisher) provisions peers whose LAST-DELIVERED verdict says `missing` by
+ * pushing the credential over SSH. The secret never enters Git.
+ *
+ * It no longer runs its own `syncFleetSharedStateRepo` (PHNX-4051). The verdict
+ * this tick's decisions read is published and delivered by the single git
+ * committer, the usage-sync tick — folding both publishes into one caller is
+ * what stops the two ticks (30 s apart) from contending for the one shared-repo
+ * lock and starving the usage snapshot workers depend on. This tick keeps its
+ * own deadline and circuit breaker, so a hung peer SSH push parks only auth-sync
+ * and never the usage delivery. The pushes read the peer verdicts the last
+ * usage-sync exchange wrote into the local checkout; they are idempotent
+ * (push only when a peer is missing a key), so acting on at-most-one-tick-old
+ * data converges exactly as the in-tick exchange did. To keep "at-most-one-tick-
+ * old" true, the pushes are gated on the exchange's freshness marker
+ * (`readLastSuccessfulExchangeMs`): when the last usage-sync exchange is missing
+ * or older than one usage-sync tick interval (`USAGE_SYNC_TICK_MS`, the
+ * producer's cadence — not this service's own `AUTH_SYNC_TICK_MS`), this tick
+ * skips the pushes and WARNs instead of acting on peer state that may no longer
+ * hold.
  */
 import { BasePeriodicService } from './service.js';
+import { USAGE_SYNC_TICK_MS } from './usage-sync-service.js';
 const AUTH_SYNC_TICK_MS = 15 * 60_000;
 const AUTH_SYNC_DEADLINE_MS = 2 * 60_000;
 const AUTH_SYNC_KICKOFF_MS = 60_000;
@@ -22,13 +40,14 @@ export class AuthSyncService extends BasePeriodicService {
         // Nothing to release — the supervisor's timer teardown is the only cleanup.
     }
     async onTick(ctx) {
-        const { publishReservedAuthVerdict, reconcileLocalWorkerSlots, syncReservedAuthBundle, syncReservedStores, } = await import('../secrets-policy.js');
+        const { reconcileLocalWorkerSlots, syncReservedAuthBundle, syncReservedStores, } = await import('../secrets-policy.js');
         // Worker-side slot materialization FIRST (PHNX-3940 T6): for each registered
         // account whose durable key is already on this box, create the HOME-shaped
         // slot the picker and spawn read. It touches only local state — the registry
-        // copy and the file-backed store — so it never waits on the git exchange
-        // below. It used to sit after `if (!transport.success) return`, so a single
-        // `git rebase timed out` postponed every slot on the box by another tick.
+        // copy and the file-backed store — so it never waits on any git exchange. It
+        // used to sit after this tick's own `if (!transport.success) return`, so a
+        // single `git rebase timed out` postponed every slot on the box by another
+        // tick; that exchange has since moved to the usage-sync tick (PHNX-4051).
         // Self-gated on device role: a headed box returns immediately.
         try {
             const slots = reconcileLocalWorkerSlots();
@@ -48,20 +67,29 @@ export class AuthSyncService extends BasePeriodicService {
         catch (err) {
             ctx.log('WARN', `auth-sync: worker slot reconcile: ${err.message}`);
         }
-        const published = await publishReservedAuthVerdict();
-        if (published.error)
-            ctx.log('WARN', `auth-sync: verdict: ${published.error}`);
-        const { syncFleetSharedStateRepo } = await import('../fleet-shared-repo-sync.js');
-        const transport = await syncFleetSharedStateRepo();
-        if (transport.skipped)
-            ctx.log('WARN', `auth-sync: ${transport.skipped}`);
-        if (transport.error)
-            ctx.log('WARN', `auth-sync: shared-store transport: ${transport.error}`);
-        if (transport.untrackedBackedUp?.length) {
-            ctx.log('WARN', `auth-sync: backed up ${transport.untrackedBackedUp.length} untracked shared-store collision(s) to ${transport.untrackedBackupDir}: ${transport.untrackedBackedUp.join(', ')}`);
-        }
-        if (!transport.success)
+        // The verdict this tick's pushes read is published by the usage-sync tick,
+        // the single git committer (PHNX-4051), and delivered into the local checkout
+        // by its exchange. The pushes below act on that last-delivered peer state, so
+        // they are only sound while that state is fresh. Gate them on the exchange's
+        // freshness: if the last successful usage-sync exchange is missing or older
+        // than one tick interval, the delivered peer verdicts may be stale — a peer
+        // that already received the key still reads `missing`, or a cleared `missing`
+        // still reads stale — so skip the pushes and WARN rather than pushing off it.
+        // The worker-slot reconcile above is NOT gated: it reads only local durable
+        // keys, never delivered peer verdicts.
+        const { readLastSuccessfulExchangeMs } = await import('../fleet-shared-repo-sync.js');
+        const lastExchangeMs = readLastSuccessfulExchangeMs();
+        const ageMs = lastExchangeMs === null ? null : Date.now() - lastExchangeMs;
+        // The threshold is the PRODUCER's cadence (USAGE_SYNC_TICK_MS), not this
+        // service's own AUTH_SYNC_TICK_MS: the delivered peer verdicts are refreshed
+        // once per usage-sync exchange, so "stale" is measured against that tick, not
+        // this one. The two constants are equal today, but sourcing it here keeps the
+        // gate tracking the usage-sync cadence if either is ever retuned alone.
+        if (ageMs === null || ageMs > USAGE_SYNC_TICK_MS) {
+            const age = ageMs === null ? 'never completed' : `last completed ${Math.round(ageMs / 1000)}s ago`;
+            ctx.log('WARN', `auth-sync: skipping credential push — usage-sync exchange ${age} (need one within ${Math.round(USAGE_SYNC_TICK_MS / 1000)}s); peer verdicts may be stale`);
             return;
+        }
         const result = await syncReservedAuthBundle();
         if (result.pushed.length > 0) {
             ctx.log('INFO', `auth-sync: pushed auth to ${result.pushed.join(', ')}`);

package/dist/lib/daemon/usage-sync-service.d.ts

@@ -2,19 +2,38 @@
  * Fleet shared-state sync as a `PeriodicService` (PHNX-3392 usage-sync,
  * PHNX-3792 session mirror).
  *
- * This is the one tick that owns the bounded Git exchange over the fleet-synced
+ * This is the ONE tick that owns the bounded Git exchange over the fleet-synced
  * user repo, so every non-secret daemon-state field rides it rather than opening
  * a second committer. Each tick: (1) publishes this box's own fields into its
  * conflict-free `devices/<device>/daemon-state.json` — a headed box's Claude
- * usage snapshot, and EVERY box's lightweight session digests (PHNX-3792);
- * (2) runs one serialized, timeout-bounded commit/rebase/push; (3) consumes the
- * peer fields the exchange delivered — a worker merges usage newest-wins, and
- * every non-worker box folds peers' session digests into its local index so the
- * picker renders remote-host previews inline. No tick opens a device-to-device
- * SSH mesh.
+ * usage snapshot, EVERY box's lightweight session digests (PHNX-3792), and the
+ * reserved-auth readiness verdict (PHNX-4051, folded in from the auth-sync tick
+ * so a single caller holds the shared-repo lock per tick); (2) runs one
+ * serialized, timeout-bounded commit/rebase/push; (3) consumes the peer fields
+ * the exchange delivered — a worker merges usage newest-wins, and every
+ * non-worker box folds peers' session digests into its local index so the picker
+ * renders remote-host previews inline. No tick opens a device-to-device SSH mesh.
+ *
+ * Why the auth verdict publishes here (PHNX-4051): auth-sync used to run its OWN
+ * `syncFleetSharedStateRepo`, so on every box two ticks 30 s apart contended for
+ * the one `proper-lockfile` lock (20×100 ms ≈ 2 s of retries) while a real
+ * fetch/rebase/push on a drifted repo runs far longer — the usage tick then
+ * failed with "Lock file is already being held" (zion logged it 95× in 24 h) and
+ * workers never received a fresh usage snapshot, which the 40-min placement gate
+ * turned into "no ready device". Folding the auth verdict into this single
+ * committer removes the second caller entirely. Auth-sync keeps its non-git
+ * duties (worker-slot reconcile + the credential SSH pushes) under its own
+ * deadline and circuit breaker.
  */
 import { BasePeriodicService, type DaemonContext } from './service.js';
 import type { DaemonServiceId } from '../daemon-services.js';
+/**
+ * The usage-sync tick cadence. Exported because auth-sync's credential-push
+ * freshness gate is the CONSUMER of this producer's cadence: it skips the
+ * pushes when the last exchange is older than one usage-sync interval, so it
+ * must track this constant rather than its own equal-by-coincidence literal.
+ */
+export declare const USAGE_SYNC_TICK_MS: number;
 export declare class UsageSyncService extends BasePeriodicService {
     readonly id: DaemonServiceId;
     readonly intervalMs: number;

package/dist/lib/daemon/usage-sync-service.js

@@ -2,19 +2,37 @@
  * Fleet shared-state sync as a `PeriodicService` (PHNX-3392 usage-sync,
  * PHNX-3792 session mirror).
  *
- * This is the one tick that owns the bounded Git exchange over the fleet-synced
+ * This is the ONE tick that owns the bounded Git exchange over the fleet-synced
  * user repo, so every non-secret daemon-state field rides it rather than opening
  * a second committer. Each tick: (1) publishes this box's own fields into its
  * conflict-free `devices/<device>/daemon-state.json` — a headed box's Claude
- * usage snapshot, and EVERY box's lightweight session digests (PHNX-3792);
- * (2) runs one serialized, timeout-bounded commit/rebase/push; (3) consumes the
- * peer fields the exchange delivered — a worker merges usage newest-wins, and
- * every non-worker box folds peers' session digests into its local index so the
- * picker renders remote-host previews inline. No tick opens a device-to-device
- * SSH mesh.
+ * usage snapshot, EVERY box's lightweight session digests (PHNX-3792), and the
+ * reserved-auth readiness verdict (PHNX-4051, folded in from the auth-sync tick
+ * so a single caller holds the shared-repo lock per tick); (2) runs one
+ * serialized, timeout-bounded commit/rebase/push; (3) consumes the peer fields
+ * the exchange delivered — a worker merges usage newest-wins, and every
+ * non-worker box folds peers' session digests into its local index so the picker
+ * renders remote-host previews inline. No tick opens a device-to-device SSH mesh.
+ *
+ * Why the auth verdict publishes here (PHNX-4051): auth-sync used to run its OWN
+ * `syncFleetSharedStateRepo`, so on every box two ticks 30 s apart contended for
+ * the one `proper-lockfile` lock (20×100 ms ≈ 2 s of retries) while a real
+ * fetch/rebase/push on a drifted repo runs far longer — the usage tick then
+ * failed with "Lock file is already being held" (zion logged it 95× in 24 h) and
+ * workers never received a fresh usage snapshot, which the 40-min placement gate
+ * turned into "no ready device". Folding the auth verdict into this single
+ * committer removes the second caller entirely. Auth-sync keeps its non-git
+ * duties (worker-slot reconcile + the credential SSH pushes) under its own
+ * deadline and circuit breaker.
  */
 import { BasePeriodicService } from './service.js';
-const USAGE_SYNC_TICK_MS = 15 * 60_000;
+/**
+ * The usage-sync tick cadence. Exported because auth-sync's credential-push
+ * freshness gate is the CONSUMER of this producer's cadence: it skips the
+ * pushes when the last exchange is older than one usage-sync interval, so it
+ * must track this constant rather than its own equal-by-coincidence literal.
+ */
+export const USAGE_SYNC_TICK_MS = 15 * 60_000;
 const USAGE_SYNC_DEADLINE_MS = 2 * 60_000;
 const USAGE_SYNC_KICKOFF_MS = 90_000;
 export class UsageSyncService extends BasePeriodicService {
@@ -54,6 +72,15 @@ export class UsageSyncService extends BasePeriodicService {
             ctx.log('INFO', `session-mirror: published ${mirrored.count} session digest(s)`);
         if (mirrored.error)
             ctx.log('WARN', `session-mirror: publish: ${mirrored.error}`);
+        // The reserved-auth readiness verdict rides this single git exchange too
+        // (PHNX-4051): it is a conflict-free field in the same owned daemon-state
+        // file, so publishing it here — instead of from a second committer in
+        // auth-sync — is what keeps exactly one caller of syncFleetSharedStateRepo on
+        // the periodic path.
+        const { publishReservedAuthVerdict } = await import('../secrets-policy.js');
+        const authVerdict = await publishReservedAuthVerdict();
+        if (authVerdict.error)
+            ctx.log('WARN', `usage-sync: auth verdict: ${authVerdict.error}`);
         const { syncFleetSharedStateRepo } = await import('../fleet-shared-repo-sync.js');
         const transport = await syncFleetSharedStateRepo();
         if (transport.skipped)

package/dist/lib/daemon-ticks.d.ts

@@ -36,11 +36,28 @@ export declare function isFreshFleetAuthSnapshot(value: {
  * publishes every tick — it does not ride that endpoint.
  */
 /**
- * True when every cached auth row was probed within {@link AUTH_PROBE_MAX_AGE_MS}
- * — i.e. reusing them would not let a verdict get staler than one probe window.
- * Empty cache is never fresh (nothing to reuse). Pure — unit-tested.
+ * The cached rows still backed by a home on this device, by `authTargetKey`.
+ *
+ * A row for an uninstalled version is an ORPHAN: the probe enumerates installed
+ * homes + account slots, so nothing re-probes it and its `checkedAt` is frozen
+ * at whatever the last probe left. Pure — unit-tested.
+ */
+export declare function installedAuthRows(authRows: readonly AuthProbeRow[], installedTargets: ReadonlySet<string>): AuthProbeRow[];
+/**
+ * True when every cached auth row FOR AN INSTALLED HOME was probed within
+ * {@link AUTH_PROBE_MAX_AGE_MS} — i.e. reusing them would not let a verdict get
+ * staler than one probe window. No installed row is never fresh (nothing to
+ * reuse). Pure — unit-tested.
+ *
+ * Orphan rows are excluded rather than counted stale (PHNX-4051). Counting them
+ * made this permanently false on any box that had ever uninstalled a version:
+ * the orphan can never be re-probed, so the tick live-probed the rate-limited
+ * `/api/oauth/usage` for every account every 3 minutes, re-arming the per-account
+ * 429 backoff and parking the usage refresher — the RUSH-2998 failure the reuse
+ * window exists to prevent. Observed on yosemite-m0 (rows dated Sep 2 / Sep 6 for
+ * uninstalled Claude versions).
  */
-export declare function isCachedFleetAuthProbeFresh(authRows: AuthProbeRow[], now: number, maxAgeMs?: number): boolean;
+export declare function isCachedFleetAuthProbeFresh(authRows: readonly AuthProbeRow[], now: number, installedTargets: ReadonlySet<string>, maxAgeMs?: number): boolean;
 /**
  * Whether the tick may reuse the cached auth verdict instead of re-probing the
  * rate-limited endpoint. `force` (an on-demand `agents devices ping`) ALWAYS
@@ -49,7 +66,7 @@ export declare function isCachedFleetAuthProbeFresh(authRows: AuthProbeRow[], no
  * revoked account (the second `runFleetPing` call site, RUSH-2998). Pure —
  * unit-tested so that inversion cannot regress unnoticed.
  */
-export declare function shouldReuseCachedAuthProbe(force: boolean, cached: AuthProbeRow[], now: number, maxAgeMs?: number): boolean;
+export declare function shouldReuseCachedAuthProbe(force: boolean, cached: readonly AuthProbeRow[], now: number, installedTargets: ReadonlySet<string>, maxAgeMs?: number): boolean;
 /**
  * Fleet cache warm: publish THIS host's row for the caches `agents fleet
  * status` / `agents devices list` read (PUBLISH-OWN / READ-UNION, RUSH-2061).