The agent puts itself back to sleep

A customer signs up at 9pm and points their domain at you. The onboarding agent provisions the container, writes the config, then checks DNS. The record hasn't propagated. It might take an hour; it might take a day.

The agent doesn't poll. It POSTs /api/v1/agent/todos/{id}/snooze on its own onboarding todo with a wake_at of 8am tomorrow and a note: DNS not live yet, resume at verification step. The worker session ends. Nothing runs overnight.

At 8am the todo wakes and the morning cron runs it. The worker reads the note, checks DNS, finds it live, finishes the certificate step, and lands the todo in review. The customer gets their welcome email at 8:04am and never knew there was a wait.

Waiting used to be a retry loop burning a worker; now it's a todo with a wake-up time.