axstack 0.24.0 → 0.25.0

package/README.md

@@ -42,9 +42,9 @@ implementation. Research, explanation, and peer review can start directly.
 | Failure mode | How Axstack responds |
 | --- | --- |
 | Wrong thing built | Align rounds clarify the request; every brainstorm runs a light arena across configured families. Use judges only for Rung 2 hard-to-reverse choices. |
-| Nobody really reviewed it | Strict TDD checks behavior first; with the mixed preset, cross-provider review checks the exact revision. |
+| Nobody really reviewed it | Strict TDD checks behavior first; mixed authored review is cross-provider, and mixed peer review uses two isolated Sol-high sessions at the exact revision. |
 | Design rot | The design lens sketches boundaries before a build; Improve surfaces evidenced changes later. |
-| Agents left a mess | T3 makes delegation visible, one writer owns each PR, cleanup stays bounded, and a human merges. |
+| Agents left a mess | T3 makes delegation visible, one writer owns each PR, cleanup stays bounded, and watched own PRs merge under guarded rules. |
 
 ## Quick start
 
@@ -106,7 +106,9 @@ upgrades, conflicts, and uninstalling.
 - Peer PRs receive two independent reviews. Authored changes receive a reviewer
   selected from the author's configured pairing. Reviews bind to exact revisions.
 - Agents keep accepted decisions and evidence for resume. Missing authority,
-  unavailable models, and serious risks surface as holds. The human merges by default.
+  unavailable models, and serious risks surface as holds. For own PRs, automatic
+  merge is the default under the
+  [watch predicate](skills/axstack-watch/SKILL.md#5-state-readiness-precisely).
 
 Choose one explicit preset (each contains all role IDs): [mixed](profiles/presets/mixed.json)
 (recommended), [codex-only](profiles/presets/codex-only.json), or
@@ -122,21 +124,58 @@ pair seats in `mixed` and `codex-only`; `claude-only` records them as absent.
 
 ## Optional PR automation
 
-Manual review works without a schedule. Own open PRs in chat-run mode use a
-bound T3 schedule to resume the driver thread every 10 minutes. Each wake
-checks feedback, base, CI, and approval. Stop and verify deletion of the watch
-when all watched PRs merge or close and release is settled or not applicable, the user cancels,
-or it expires.
+Manual review works without a schedule.
+Every verified own-PR publication arms or joins the driver's chat-run watch,
+subject to explicit stop-after-publication or observation requests.
+Its bound T3 schedule wakes the driver every 10 minutes by default while open PRs stay watched.
+See [Chat-run PR watch](docs/workflows.md#chat-run-pr-watch) for the lifecycle and quiet cadence.
 
 An optional native T3 review manager runs finite peer-review passes every 15
 minutes; the review automation never merges for you. Activation needs live
 host validation. See [PR-manager setup and safety](skills/axstack/references/automations.md).
 
+
+## Automatic merge boundaries
+
+The recorded owning watch thread applies the full predicate in chat-run or
+standalone authorized maintenance, including small and adopted work. Solo mode
+uses current-head-and-base cross-provider review plus diligence; team mode also
+needs a counted collaborator approval. Team bases are documented non-production
+`dev`; solo bases are documented `integration` branches, including `main`.
+Unknown classification means `deploying`. Whole stacks wait for every planned
+member to be published and reviewed.
+
+Cards name missing approval, ineligible bases, exclusions, or `Auto-merge: off`.
+For own integration-base PRs, the card reply authorizes the guarded actor under
+watch §5's exceptions.
+In solo mode the user's merge-card reply authorizes the guarded merge of
+user-written PRs or PRs with unknown or mixed provenance.
+Team replies never replace collaborator approval. Promotion, release,
+deploying-base, and peer PRs are user-merged, as are CI, manifest, merge-authority,
+and non-`clean` revert changes. Test sources stay eligible. See watch §5 for all
+excluded files and guarded merge mechanics. User merges are bottom-up for a stack.
+This policy grants no release, npm publish,
+or host install authority. Preview authority covers only the preview unit and
+its `tailscale serve` route on the VPS.
+
+Excluded: CLI proxy, account pooling, and IP routing; local CI contention handling
+is deferred. Quota-driven scheduling or model routing is excluded. Automatic
+merge of promotion, release, deploying-base, and peer PRs is excluded. Previews
+outside the VPS, public previews, and production data are excluded. Nightly triage
+never sends relay messages.
+
+Accepted risks: two agents can miss the same defect while CI is green; spec
+approval is the user's main checkpoint. A head guard does not atomically guard
+base freshness; the concurrent-merge race is held by the post-merge push-failure
+rule. A watch waking every 10 minutes (60 when quiet) until PRs land has an accepted
+token cost. Preview code runs under the same VPS user as agents and is not isolated;
+tests already do, so the added risk is small.
+
 ## Some notes
 
 - T3 Code is the only supported active runtime. Axstack adds no daemon or runtime
   database.
-- A human merges by default.
+- The recorded owning watch thread merges eligible own PRs; excluded PRs use a merge card.
 - This is an early project; expect the workflows to evolve.
 
 ## Documentation

package/docs/installation.md

@@ -270,8 +270,9 @@ the affected work. Codex and Claude class resolution reads the saved T3 capabili
 `skills/axstack/scripts/resolve-models.js --provider`; missing or malformed
 catalogs hold. A preset model is used as given; class rows resolve to the newest
 matching catalog ID. Resume retains the recorded snapshot without re-resolution.
-Rejection, timeout, quota, and auth failures hold; no subscription inference,
-quota routing, or alternative-model retry applies.
+Rejection, timeout, quota, and auth failures hold; outside bounded same-provider,
+same-model account selection among one driver's instances via `pick-instance.js`,
+no subscription inference, quota routing, or alternative-model retry applies.
 
 `modeId` and similar permission fields remain conservative declared intent.
 They do not prove effective T3 `runtimeMode`, sandboxing, or permission parity.
@@ -319,10 +320,10 @@ the affected operation. Provider/model routing, Linear documents through the
 executor MCP, and live schedule behavior need separate preflights.
 
 Installation creates no production schedule and adds no custom scheduler.
-Chat-run own-PR watch uses a bound T3 schedule every 10 minutes by default;
-record its ID, driver thread, and expiry. Missing schedule capability holds
-activation. Delete the schedule by its exact ID and verify absence with
-`list_scheduled_tasks` when the watch ends; uncertainty preserves the hold.
+Every verified own-PR publication arms or joins the driver's chat-run watch.
+Its bound T3 schedule resumes the driver every 10 minutes by default while open PRs stay watched.
+See [Chat-run PR watch](workflows.md#chat-run-pr-watch) for authority, schedule identity and stop conditions.
+Missing schedule capability holds activation.
 The optional review manager uses an unbound 15-minute T3 schedule and requires
 its separate native canary before activation. Installed guidance does not prove
 live behavior. See [Review manager](../skills/axstack/references/automations.md).

package/docs/workflows.md

@@ -15,6 +15,21 @@ The directly invoked phase loads the applicable shared references for routing,
 lifecycle, T3 runtime boundaries, role/model/risk contracts, the run record,
 and PR shape.
 
+Before each Claude or Codex dispatch/launch, run
+`bun skills/axstack/scripts/pick-instance.js --provider claude|codex`.
+It prints the enabled same-driver account with the most tier-weighted headroom,
+excluding reached limits or any window at ≥95% usage. Provider, model, class,
+and effort stay fixed. Save `--json` output in private dispatch evidence and
+record its pointer and chosen instanceId. Only error exit 1 permits canonical
+fallback after availability validation. Exit 2 (no eligible provider instances)
+holds the work without fallback. This permits no mid-thread failover.
+`--settings <path>` overrides `~/.t3/userdata/settings.json`.
+Usage is cached for five minutes in `${XDG_CACHE_HOME:-~/.cache}/axstack/usage.json`;
+failed requests use stale usage or a tier-only `unknown` score without cache.
+Codex's plan is unknown until a successful usage response, so its uncached
+failure weight is 1. `AXSTACK_CLAUDE_USAGE_URL` and `AXSTACK_CODEX_USAGE_URL`
+override endpoints for local fixtures; tests use loopback only.
+
 Direct routes need no spec ceremony:
 
 - `axstack-research` answers one bounded source-backed question.
@@ -33,7 +48,7 @@ Direct routes need no spec ceremony:
   authorized, proven cleanup to Implement as structure-preserving work through
   independent review.
 - Manual `axstack-review` can inspect existing code at an exact revision within
-  a named scope. Both configured peer reviewers inspect six lenses independently;
+  a named scope. Both configured codebase reviewers inspect six lenses independently;
   the driver reports validated defects and risks, improvement opportunities,
   unverified leads, and `COMPLETE` or `INCOMPLETE` coverage. This report does
   not approve a PR or publish findings.
@@ -78,7 +93,21 @@ starts later for each repository the user names.
    derives one boundary from test-audit PR history, skips open PRs, overlap with
    live T3 thread/run and worktree ownership, unsafe baselines or empty candidate sets,
    and opens at most one independently reviewed test-only PR per week through
-   the driver. Workers never push; the human merges.
+   the driver. Workers never push; the owning watch thread applies the
+   [watch predicate](../skills/axstack-watch/SKILL.md#5-state-readiness-precisely).
+
+## Nightly PR-triage activation
+
+Use the packaged [nightly prompt](../skills/axstack/references/pr-triage-nightly.md)
+and [setup guidance](../skills/axstack/references/automations.md#nightly-pr-triage-setup).
+Read existing schedules before creating the single unbound native T3 schedule
+at 02:00 host time; reuse it instead of creating a duplicate.
+Keep the host timezone, schedule ID, prompt, and repository set in a durable
+activation record outside run records so Close-out preserves them.
+Each pass reports all own open PRs in its own T3 thread, with forge state or
+`UNKNOWN`, PRs inactive for 7 days, and the top three to act on.
+The pass stays read-only and never declares merge-ready.
+This delivery creates no live schedule; source tests do not prove activation.
 
 ## Role presets
 
@@ -91,7 +120,7 @@ role.
 
 | Preset | Author | Ordered peer reviewers | Astra / Opus advisers | Auditor |
 | --- | --- | --- | --- | --- |
-| `mixed` | Sol high | Sol high; Opus medium | Astra high / Opus xhigh | Sonnet high + Sol high |
+| `mixed` | Sol high | Sol high; Sol high | Astra high / Opus xhigh | Sonnet high + Sol high |
 | `codex-only` | Sol high | Sol high; Luna xhigh | Astra high / unavailable | Luna xhigh + Sol high |
 | `claude-only` | Opus medium | Opus medium; Sonnet high | unavailable / Opus xhigh | Sonnet high (Sol absent) |
 
@@ -114,9 +143,12 @@ catalog using `skills/axstack/scripts/resolve-models.js --provider`; missing or
 malformed catalogs hold. Active runs and resume reuse their snapshot after
 later installation changes without re-resolution.
 
-Peer roles keep the stable IDs `axstack-reviewer-primary` and
-`axstack-reviewer-secondary`; their provider/class mappings come only from the
-selected preset.
+Peer roles use the stable IDs `axstack-reviewer-primary` and
+`axstack-reviewer-peer`; their provider/class mappings come only from the
+selected preset. The mixed peer coordinator and review-lane binding
+`axstack-owner` uses Sol high and never reviews. `axstack-reviewer-secondary`
+is used in the authored mapping and, alongside `axstack-reviewer-primary`,
+in codebase findings mode.
 
 The unavailable adviser in each single-provider preset stays explicitly
 `model: null` within that provider's bounds. Installer readiness accepts that
@@ -128,8 +160,9 @@ in saved T3 capabilities. Empty Antigravity catalogs hold. Missing or
 unavailable roles hold only affected work. Requested model, effort, and
 permission values need actual T3 configuration read-back; stored `modeId` is
 neither permission parity nor a sandbox. Rejection, timeout, quota, and auth
-failures hold; no subscription inference, quota routing, or alternative retry
-applies.
+failures hold; outside bounded same-provider, same-model account selection among
+one driver's instances via `pick-instance.js`, no subscription inference, quota
+routing, or alternative retry applies.
 
 ## T3 runtime boundary
 
@@ -226,8 +259,10 @@ One T3 host/server owns a run, one persistent owner owns each PR, and one
 writer owns each candidate. Fanout has no fixed PR count; it follows real
 dependencies, writer isolation, host capacity, and spending limits. Each PR has
 one theme and a measured size under the shared
-[PR-shape policy](../skills/axstack/references/pr-shape.md). The human merges
-by default; review approval never grants merge authority.
+[PR-shape policy](../skills/axstack/references/pr-shape.md).
+For own PRs, automatic merge is the default under the
+[watch predicate](../skills/axstack-watch/SKILL.md#5-state-readiness-precisely).
+Review approval alone never grants merge authority.
 For the rationale band, the autonomous driver records a cohesion rationale. The exception band
 requires a reasonable split attempt and full exception record. These are
 autonomous driver choices; size alone never requires user approval.
@@ -267,32 +302,94 @@ read-only observer for standalone watches and never sends.
 For authorized engineering delivery, [Autopilot](../skills/axstack/references/autopilot.md)
 continues from Align through the eligible phase sequence in the same chat.
 The human approves substantial specs, release PRs, peer and deploying-base
-merges, and the npm stage. Only the chat-run driver holding the approved ticket
-map may merge its own eligible integration-base PRs under the full
-[watch merge predicate](../skills/axstack-watch/SKILL.md#5-state-readiness-precisely). Managers,
-workers, reviewers, automations, and standalone watches never merge. An open
-hold pauses the run. Implement arms maintain-mode watch
-at its first published PR; release and install run only under recorded per-run
-authority, and Close-out follows their verified receipts.
+merges, and the npm stage. The recorded owning watch thread is the merge actor,
+including `axstack-owner` for standalone authorized maintenance and small or
+adopted work. Apply the full
+[watch merge predicate](../skills/axstack-watch/SKILL.md#5-state-readiness-precisely).
+Managers, workers, reviewers, monitors, and nightly triage never merge.
+Observation-only and peer watches never merge. An open
+hold pauses the run.
+After verified publication readback of every own PR from any Axstack phase,
+the driver arms or joins its chat-run watch in authorized maintain mode.
+Explicit stop-after-publication and observation-only requests still apply.
+Release and install run only under recorded per-run authority.
+Close-out follows their verified receipts and the watch's end.
 
 Use `axstack-watch` chat-run mode to watch every PR raised by this run,
 including later verified publications and PRs explicitly adopted by the driver.
-A bound T3 schedule resumes the driver thread every 10 minutes; record the
-schedule ID and expiry. Each wake reconciles all unsettled dispatch attempts
+A bound T3 schedule resumes the driver thread every 10 minutes by default.
+The run record holds the schedule ID and driver thread.
+Each wake reconciles all unsettled dispatch attempts
 and runs the own-PR maintenance loop: feedback, base movement, required CI,
 and approval. Delegated work follows the T3 runtime contract. There is no
 daemon or polling model between wakes. Independent PRs can repair in parallel
 with one writer per PR; a changed stack ancestor invalidates child evidence.
 An incomplete scan leaves readiness `UNKNOWN`.
 
-The watch lasts until all member PRs merge or close and release is settled or
-not applicable, the user cancels, or its wake expires. Delete the schedule by
+The chat-run watch never expires or waits for re-authorization while PRs remain open.
+The chat-run watch ends only when all watched PRs merge or close, launched work
+is settled, and release is settled or not applicable, or the user cancels.
+A required PR closed without merging keeps its decision hold and wake.
+Follow [Chat-run watch runtime](../skills/axstack-watch/references/watch-runtime.md#chat-run-watch)
+for native lifetime re-arming and quiet cadence changes on the recorded schedule ID.
+Delete the schedule by
 its recorded ID and verify absence through `list_scheduled_tasks`; uncertain
 deletion preserves the hold. Settlement and run archive are separate driver
 steps. Implementation candidates are published and read back before independent
 authored review. Adopted own-PR maintenance receives independent exact-local-SHA
-review before driver publication and remote readback. The human merges by
-default. Installed instructions do not prove scheduled observation or driver wake.
+review before driver publication and remote readback. Watch §5 governs merges. Installed instructions do not prove scheduled observation or driver wake.
+
+
+## Automatic merge boundaries
+
+Solo approval is current-head-and-base cross-provider authored-review `APPROVE`
+plus diligence `PASS`. The reviewer differs from every receipt-recorded provider
+that authored or repaired `merge-base..head` commits. Team approval also needs a
+counted non-author collaborator review at the current head. Axstack automation
+votes never count. Unknown or mixed provenance and manually authored PRs need a
+merge card. New heads need fresh authored review, diligence, and CI. A collaborator
+approval carries over only across an unchanged stable patch-id rebase, recorded
+for both heads, while the forge still counts it.
+
+Team auto-merge targets only documented non-production `dev`; solo targets `main`
+or another documented `integration` base. Unknown classification means
+`deploying`. Re-read approval mode and classification before merging and on resume.
+For a stack, only the bottom base must qualify; every upper base is its next-lower
+branch at the reviewed head. Every planned member must be published and satisfy
+the remaining terms and exclusions. Never retarget reviewed members for eligibility.
+
+Merge cards report cases that fail approval, base, exclusion, or `Auto-merge: off`
+rules. On own integration-base PRs, a user card reply permits the guarded actor to
+merge, subject to watch §5's exceptions.
+In solo mode the user's merge-card reply authorizes the guarded merge of
+user-written PRs or PRs with unknown or mixed provenance.
+In team mode it clears only an ineligible base, auto-merge turned off, and an open
+human or bot comment; it never replaces collaborator approval. CI and manifest changes,
+merge-authority text and non-`clean` revert PRs are user-merged on
+the forge. Promotion, release, deploying-base, and peer PRs are also user-merged.
+Test sources stay eligible; `.github/`, workflow-invoked paths, manifests and
+lockfiles, runner config, branch protection and rulesets, `CODEOWNERS`, and
+merge-authority text are excluded from auto-merge. Non-agent comments hold it
+until human clearance under the packaged comment rules. The revert gate reads the declaration starting
+with `Revert:` at line start; a quoted format inside a bullet is not a declaration.
+
+User merges are bottom-up for a stack.
+This policy grants no release, npm publish, or host install
+authority. Preview authority covers only the preview unit and its `tailscale
+serve` route on the VPS.
+
+Excluded: CLI proxy, account pooling, and IP routing; local CI contention handling
+is deferred. Quota-driven scheduling or model routing is excluded. Automatic
+merge of promotion, release, deploying-base, and peer PRs is excluded. Previews
+outside the VPS, public previews, and production data are excluded. Nightly triage
+never sends relay messages.
+
+Accepted risks: two agents can miss the same defect while CI is green; spec
+approval is the user's main checkpoint. A head guard does not atomically guard
+base freshness; the concurrent-merge race is held by the post-merge push-failure
+rule. A watch waking every 10 minutes (60 when quiet) until PRs land has an accepted
+token cost. Preview code runs under the same VPS user as agents and is not isolated;
+tests already do, so the added risk is small.
 
 ## Optional native peer-review automation
 
@@ -331,7 +428,7 @@ cursor files, or historical runtime fallback.
 
 The review manager uses one short packaged prompt that loads the current
 relative contract and invokes `axstack-review`. Bounded jobs publish ordinary
-exact-head review verdicts; the human merges. Manual adopted-PR maintenance
+exact-head review verdicts; peer PRs are merged by the user. Manual adopted-PR maintenance
 uses `axstack-watch` with local-SHA review before authorized publication.
 Exceptional security, permanent-on-chain, or architectural decisions remain actionable in GitHub or a durable user-owned conversation
 after the manager session ends, with an authorized deduplicated Telegram notification.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "axstack",
-  "version": "0.24.0",
+  "version": "0.25.0",
   "description": "Axstack installer and setup CLI: installs owned chat skills and role data, configures supported harness settings, and checks T3 Code capabilities.",
   "keywords": [
     "claude-code",

package/profiles/presets/claude-only.json

@@ -52,7 +52,16 @@
       "provider": "claude",
       "modeId": "bypassPermissions",
       "thinkingOptionId": "high",
-      "notes": "Secondary reviewer in the ordered claude-only peer pair: Opus medium followed by Sonnet high. Eligible authored reviewer for an Opus-authored candidate. Never author or owner; review exact SHA and base across all six angles and acceptance. Peer first pass stays isolated. T3 resolves Claude classes from saved capabilities; a Claude rejection holds.",
+      "notes": "Eligible authored reviewer for an Opus-authored candidate. Never author or owner; review exact SHA and base across all six angles and acceptance. T3 resolves Claude classes from saved capabilities; a Claude rejection holds.",
+      "modelClass": "sonnet"
+    },
+    {
+      "id": "axstack-reviewer-peer",
+      "name": "Axstack reviewer (peer)",
+      "provider": "claude",
+      "modeId": "bypassPermissions",
+      "thinkingOptionId": "high",
+      "notes": "Second reviewer in the ordered claude-only peer pair: Opus medium followed by Sonnet high. Never author or owner; review exact SHA and base across all six angles and acceptance. Peer first pass stays isolated. T3 resolves Claude classes from saved capabilities; a Claude rejection holds.",
       "modelClass": "sonnet"
     },
     {

package/profiles/presets/codex-only.json

@@ -52,7 +52,16 @@
       "provider": "codex",
       "modeId": "full-access",
       "thinkingOptionId": "xhigh",
-      "notes": "Secondary reviewer in the ordered codex-only peer pair: Sol high followed by Luna xhigh. Eligible authored reviewer for a Sol-authored candidate. Never author or owner; review exact SHA and base across all six angles and acceptance. Peer first pass stays isolated.",
+      "notes": "Eligible authored reviewer for a Sol-authored candidate. Never author or owner; review exact SHA and base across all six angles and acceptance.",
+      "modelClass": "luna"
+    },
+    {
+      "id": "axstack-reviewer-peer",
+      "name": "Axstack reviewer (peer)",
+      "provider": "codex",
+      "modeId": "full-access",
+      "thinkingOptionId": "xhigh",
+      "notes": "Second reviewer in the ordered codex-only peer pair: Sol high followed by Luna xhigh. Never author or owner; review exact SHA and base across all six angles and acceptance. Peer first pass stays isolated.",
       "modelClass": "luna"
     },
     {

package/profiles/presets/mixed.json

@@ -22,11 +22,11 @@
     {
       "id": "axstack-owner",
       "name": "Axstack PR owner",
-      "provider": "claude",
-      "modeId": "bypassPermissions",
-      "thinkingOptionId": "medium",
-      "notes": "Persistent PR owner: one owner per PR, accountable for candidate, fixes, verification evidence, and monitoring. May delegate coding but never edits a worker-owned candidate concurrently. Launches eligible independent reviewers. T3 resolves Claude classes from saved capabilities; a Claude rejection holds.",
-      "modelClass": "opus"
+      "provider": "codex",
+      "modeId": "full-access",
+      "thinkingOptionId": "high",
+      "notes": "Persistent PR owner: one owner per PR, accountable for candidate, fixes, verification evidence, and monitoring. May delegate coding but never edits a worker-owned candidate concurrently. Launches eligible independent reviewers. Peer coordinator and review-lane binding; never reviews.",
+      "modelClass": "sol"
     },
     {
       "id": "axstack-author",
@@ -43,7 +43,7 @@
       "provider": "codex",
       "modeId": "full-access",
       "thinkingOptionId": "high",
-      "notes": "Primary reviewer in the ordered mixed peer pair: Sol high followed by Opus medium. Eligible authored reviewer for an Opus-authored candidate. Never author or owner; review exact SHA and base across all six angles and acceptance. Peer first pass stays isolated.",
+      "notes": "Primary reviewer in the ordered mixed peer pair: Sol high followed by Sol high. Eligible authored reviewer for an Opus-authored candidate. Never author or owner; review exact SHA and base across all six angles and acceptance. Peer first pass stays isolated.",
       "modelClass": "sol"
     },
     {
@@ -52,9 +52,18 @@
       "provider": "claude",
       "modeId": "bypassPermissions",
       "thinkingOptionId": "medium",
-      "notes": "Secondary reviewer in the ordered mixed peer pair: Sol high followed by Opus medium. Eligible authored reviewer for a Sol-authored candidate. Never author or owner; review exact SHA and base across all six angles and acceptance. Peer first pass stays isolated. T3 resolves Claude classes from saved capabilities; a Claude rejection holds.",
+      "notes": "Eligible authored reviewer for a Sol-authored candidate. Never author or owner; review exact SHA and base across all six angles and acceptance. T3 resolves Claude classes from saved capabilities; a Claude rejection holds.",
       "modelClass": "opus"
     },
+    {
+      "id": "axstack-reviewer-peer",
+      "name": "Axstack reviewer (peer)",
+      "provider": "codex",
+      "modeId": "full-access",
+      "thinkingOptionId": "high",
+      "notes": "Second reviewer in the ordered mixed peer pair: Sol high followed by Sol high. Never author or owner; review exact SHA and base across all six angles and acceptance. Peer first pass stays isolated.",
+      "modelClass": "sol"
+    },
     {
       "id": "axstack-diligence",
       "name": "Axstack diligence checker",

package/skills/axstack/references/automations.md

@@ -7,6 +7,25 @@ For optional weekly test audits, use the separate packaged
 [Weekly test-audit prompt](test-audit-weekly.md).
 The native canary below is also required before weekly activation.
 
+For nightly read-only PR reports, use the separate packaged
+[Nightly PR-triage prompt](pr-triage-nightly.md).
+
+## Nightly PR-triage setup
+
+Follow the weekly test-audit pattern for an unbound native schedule.
+Before creating a schedule, read existing schedules with `list_scheduled_tasks`.
+Reuse the existing triage schedule for the recorded repository set.
+Never create a duplicate triage schedule.
+Use one native T3 `schedule_task`, unbound, nightly at 02:00 host time, with
+`fixed_time`, `timeOfDay:"02:00"`, and `bindToCurrentThread:false`.
+Supply the packaged triage prompt and the durable activation record's location.
+Record the host timezone, schedule ID, prompt, and repository set in a durable
+activation record outside any run records, such as
+`~/.local/share/axstack/pr-triage/activation.md`.
+Preserve the activation record and schedule through Close-out.
+Each scheduled pass reports in its own T3 thread under the read-only prompt.
+Source checks do not prove live schedule delivery or report coverage.
+
 ## Topology and schedules
 
 The T3 project `axstack-review-lane` uses the VPS's existing
@@ -34,7 +53,7 @@ T3 sessions are exempt from Claude trust preflight.
 
 ## Session admission
 
-Perform guarded predecessor retirement in [Finite-session teardown](#finite-session-teardown).
+The owner-of-record performs guarded retirement in [Finite-session teardown](#finite-session-teardown).
 Lane identity requires exact thread/run identity, never a title or directory-name
 guess; never infer lane ownership from an empty local workspace.
 Reconcile saved state, current GitHub state, and native T3 threads, runs,
@@ -54,8 +73,36 @@ events and the unserved count. If a duplicate finds a stalled owner idle at its
 prompt with a final turn lacking a completion receipt for more than five
 minutes (nudged or not), record it in that private note and send one deduplicated
 notification under the recorded `Notification policy`.
-Unknown liveness blocks admission and shared-record writes; it does not
-permit takeover or cleanup. Preserve user-taken-over threads.
+A **wedged lane pass**, whether owner, successor or duplicate, has a non-terminal
+run with more than 60 minutes of verified inactivity across its thread, all its
+runs, delegated tasks and descendant threads, and is free of `user_takeover`.
+A user-taken-over descendant holds recovery and excludes its pass from the
+wedged category, and is never interrupted.
+A live pass has a non-terminal run and is not wedged.
+Exactly one successor recovers a wedged owner or resumes an interrupted takeover:
+the earliest-started live pass, selected by native run start
+ordering; missing or tied ordering evidence holds admission and recovery.
+The successor interrupts the owner and its descendant threads with
+`t3_thread_interrupt`, naming each exact `runId` and a stable `clientRequestId`
+per run, and reads back terminal state for the whole tree
+before recording the takeover in continuity and becoming owner.
+If a successor wedges between interrupt and takeover, the next elected live pass
+interrupts the wedged successor and its tree with `t3_thread_interrupt` at each
+exact `runId` using the same per-run procedure, and reads back terminal state for
+that whole tree before recording any takeover, then resumes recovery from terminal readback
+of the interrupted owner, which is
+excluded from the potentially-live-owner hold.
+The owner-of-record, including a successor immediately after takeover, interrupts
+wedged non-owner passes (duplicates or failed successors) using the same exact-run
+procedure and terminal readback, then retires them under Finite-session teardown.
+Before any admission, the successor reconciles the previous owner's in-flight
+jobs from GitHub and evidence. Only a verdict already published and read back
+counts as served. Otherwise the event is unserved/`INCOMPLETE` and re-eligible.
+A failed interrupt or unverified terminal state keeps the existing hold plus
+one deduplicated notification under the recorded `Notification policy`.
+Outside the wedged-pass recovery above, unknown liveness blocks admission,
+shared-record writes, takeover and cleanup, including when activity is recent.
+Preserve user-taken-over threads.
 This is prompt policy, not an atomic lock: the overlap canary must demonstrate
 one admission owner before activation. Count all unsettled PR jobs and descendants.
 
@@ -132,7 +179,9 @@ under [T3 runtime](t3-runtime.md). For a worker's own brief question, confirm th
 brief once.
 A second brief ask follows the five-minute stop rule, never an open-ended hold.
 An idle final turn without a valid completion
-receipt is incomplete, not successful. A started coordinator waiting on its
+receipt is incomplete, not successful. A wait with more than 60 minutes of
+verified inactivity across its whole tree is a wedge, not a running wait.
+A started coordinator waiting on its
 reviewers (a live reviewer task or running wait) is not idle and is never
 stopped for waiting. Reconcile terminal failure and all descendants before
 recording an event unserved and re-admissible.
@@ -238,7 +287,11 @@ private or local artifacts. Write the local HTML copy under the established
 
 No manager, coordinator, or worker may merge, close, force-push, rebase,
 restack, broaden scope, or mutate a PR branch. Human merge remains the
-boundary.
+boundary for peer PRs.
+User merges are bottom-up for a stack.
+For own PRs, automatic merge is the default under the
+[watch predicate](../../axstack-watch/SKILL.md#5-state-readiness-precisely);
+this manager never becomes that watch's merge actor.
 
 ## Exceptional decisions and notifications
 
@@ -260,16 +313,21 @@ or separate model gate.
 
 ## Finite-session teardown
 
-Each pass retires settled predecessor passes and reports the retained worktree
-count. Retirement requires terminal run evidence and settled descendants,
+Only the owner-of-record pass retires settled predecessor passes and qualifying
+terminal duplicates, including duplicates newer than the owner and immediately
+after successor takeover.
+Qualifying duplicates have a terminal run, no descendants and only their own pass note.
+Each pass reports the retained worktree count.
+Retirement requires terminal run evidence and settled descendants,
 durable continuity, evidence read-back and verified salvage where needed;
 follow [Workspace hygiene](workspace-hygiene.md) and [T3 runtime](t3-runtime.md).
 Then run the driver-start orphan sweep under Workspace hygiene; the sweep is
 silent when nothing was removed. Record sweep results and holds in continuity's
 Open holds table.
 The orphan sweep covers the run record's repositories plus registered repositories on this host.
-`t3_thread_organize` settle/archive changes metadata only; exact guarded Git
-worktree removal remains separate. Unknown, active or user-taken-over threads,
+Retirement settles duplicate threads with `t3_thread_organize` (settle/archive
+changes metadata only) before separate guarded Git worktree removal.
+Unknown, active or user-taken-over threads,
 ambiguous publication and failed salvage stay preserved.
 
 A review-manager pass may retire a predecessor pass's local `t3code/*` branch
@@ -295,7 +353,8 @@ removal, not settled execution capacity. The next pass retires this settled pass
 
 The canary runs two overlapping `run_scheduled_task_now` passes and proves one
 admission owner per PR. The canary reviews or correctly no-ops one real PR event.
-The canary reconciles a killed predecessor.
+The canary reconciles a killed predecessor and demonstrates wedged-pass recovery:
+exactly one successor interrupts and retires a wedged predecessor.
 With a temporary limit equal to the current count, the canary disables the
 schedule and verifies that the following interval creates zero new pass worktrees.
 The previous review-manager automation is disabled, never deleted, only after all four T3 canary checks pass.