axstack 0.24.1 → 0.25.1

package/skills/axstack/references/candidate-publication.md

@@ -45,6 +45,16 @@ remote confirmation. Reviewers inspect a detached immutable checkout of the
 confirmed candidate SHA and pinned base, never only the movable branch name.
 Any author repair creates a new revision and repeats this boundary.
 
+## Revert line
+
+Every own PR description must contain exactly one `Revert` line:
+`Revert: clean` | `Revert: steps: <manual steps>` | `Revert: irreversible: <why>`.
+Use `clean` only when a single `git revert` of the merge commit restores the
+previous behaviour with CI green.
+A `clean` revert leaves no data, schema, config, external, or published effect behind.
+Otherwise use `steps` or `irreversible`.
+Classify every release PR as `irreversible`.
+
 ## Immutable checkout shape
 
 The driver creates the immutable review checkout with `git worktree add --detach <run>/checkouts/<key> <sha>` at the confirmed candidate SHA and pinned base.

package/skills/axstack/references/contracts.md

@@ -40,9 +40,14 @@ the revised scope and plan.
 
 Validate the configured provider and model at actual launch. If it is
 unavailable or exhausted, pause affected work, record the gap, and ask the
-user. Never infer a route from quota state or subscription entitlement. Every
+user. Only same-provider, same-model account selection among instances of one
+driver may use headroom under [Provider bindings](t3-runtime.md#preflight-and-binding).
+An exhausted account with no eligible sibling still holds; dispatched roles never fail over mid-thread.
+Follow [Provider bindings](t3-runtime.md#preflight-and-binding) for driver account re-selection at turn boundaries.
+Never infer any other route from quota state or subscription entitlement. Every
 substitution requires the user's decision: configured alternatives are not
 defaults. Rejection, timeout, quota and auth failures hold affected work.
+Substitution here means changing provider or model, excluding that account selection.
 Read the [T3 runtime boundary](t3-runtime.md) before dispatch, receipt consumption
 or recovery; resolve models from the saved capabilities snapshot and verify
 requested and effective settings separately.
@@ -103,19 +108,17 @@ gate.
 
 ## Authority
 
-- The driver owns run scope, cross-PR coordination, integration, and every
-  selected external-tracker mutation. The checker reports discrepancies only.
-- One T3 host/server owns a run. There is no fixed active-PR count;
-  fanout is dependency- and capacity-driven within configured host resource and
-  spending limits. The driver reduces fanout when the run record shows rework,
-  review backlog, or resource pressure, queues conflicting or dependent work,
-  and uses `gh stack` for dependent PRs. Routine shape, split, fanout, and
-  exception choices are autonomous driver decisions within the approved scope;
-  size alone never requires user approval.
-- Exactly one writer per candidate acts at a time, with one persistent owner
-  accountable for each PR. Each PR carries one theme and a measured size under
-  [PR shape](pr-shape.md). Unknown capacity metrics are reported as unknown,
-  never as a telemetry prerequisite or blocker. Parent changes invalidate
-  affected child evidence, which must be refreshed against the new parent.
-- The human merges by default, bottom-up for a stack. Review approval and
-  reviewer votes never grant mutation or merge authority.
+- The driver owns scope, cross-PR coordination, integration, and every selected
+  external-tracker mutation. Checker reports discrepancies only.
+- One T3 host/server owns a run. No fixed active-PR count; fanout is dependency-
+  and capacity-driven within host resource and spending limits. Reduce fanout for
+  recorded rework, review backlog, or resource pressure. Queue conflicts and
+  dependencies; use `gh stack` for dependent PRs. Routine shape, split, fanout, and
+  exception choices within approved scope are autonomous driver decisions; size alone never
+  requires user approval.
+- Exactly one writer per candidate; one persistent accountable PR owner. Each PR has one theme and measured size under [PR shape](pr-shape.md). Report unknown capacity
+  metrics; never a telemetry prerequisite or blocker. Parent changes invalidate
+  affected child evidence; refresh it against the new parent.
+- Own PRs default to automatic merge under [watch §5](../../axstack-watch/SKILL.md).
+  Review approval and reviewer votes alone never grant mutation or merge authority.
+  User merges are bottom-up for a stack.

package/skills/axstack/references/diligence.md

@@ -7,6 +7,11 @@ It is read-only, never authors or edits, and returns `PASS`, `FINDINGS`, or `UNK
 with locations, observed evidence, and limits. A stale or missing receipt is
 not a pass. Keep its first pass independent of other reviewers and workers.
 
+Load [Finding severity](../../axstack-review/SKILL.md#finding-severity) for the shared rubric.
+Diligence returns `FINDINGS` for any `medium` or `high` mismatch.
+Diligence returns `PASS` with the low items listed when only low mismatches remain.
+Keep diligence `UNKNOWN` unchanged.
+
 For a PR, compare every changed line with the accepted intent and exclusions:
 is it intended and in scope? Check that no contract, rule, or obligation was
 silently weakened or dropped by rewording. Compare the PR body, commit messages,
@@ -30,5 +35,5 @@ Report an attributed failure with its retained output normally.
 An observed full-suite failure still fails the suite, including when attributed or reported `UNKNOWN`.
 No reruns are required.
 
-`FINDINGS` identifies a mismatch for the driver to resolve at the owning phase;
+`FINDINGS` identifies a medium or high mismatch for the driver to resolve at the owning phase;
 it does not edit the artifact or create another review round by itself.

package/skills/axstack/references/lifecycle.md

@@ -9,9 +9,9 @@ binding state and receipts to exact revisions.
 
 - Driver: current chat; owns scope, decisions, cross-PR dependencies,
   external-tracker mutations, integration.
-- Owner: driver owns loop PRs; `axstack-owner` only for standalone watch/review
-  without live driver. It may perform PR-scoped publication within user authority. Human
-  merge is default.
+- Owner: driver for loop PRs; `axstack-owner` for standalone watch/review without
+  a live driver. PR-scoped publication is within user authority.
+  Own PRs default to automatic merge under watch §5's predicate.
 - Author: exactly one writer per candidate; accepted fixes return there.
   Workers launch no recursive teams.
 - Reviewers: peer = two configured roles with the same brief and isolated first
@@ -121,7 +121,7 @@ The default 24-hour deadline covers standalone task-owned timers. Stop them at
 deadline and preserve remaining work; the review automation has no task-owned
 deadline. Merge-ready requires applicable review receipt(s) and current diligence
 `PASS` at the exact head; CI/tests alone are insufficient. Merge-ready
-differs from merged; human merges.
+differs from merged.
 
 ## Review automation health
 

package/skills/axstack/references/pr-shape.md

@@ -24,6 +24,11 @@ migrations that must change together to stay green and reviewable.
 This is not a folder restriction. Unrelated themes split even under the target.
 Smaller cohesive PRs are encouraged; no padding.
 
+## PR body
+
+Every own PR description must contain exactly one `Revert` line.
+Follow [Revert line](candidate-publication.md#revert-line) for its format and classification.
+
 ## Exception band
 The driver attempts a reasonable split first. If each tried split materially
 compromises atomicity, green state, or independent reviewability, or inseparable

package/skills/axstack/references/pr-triage-nightly.md

@@ -0,0 +1,22 @@
+# Nightly PR-triage prompt
+
+You are a fresh read-only nightly PR-triage pass in your own T3 thread.
+Read-only applies to the forge, and own schedule replacement follows [Provider bindings](t3-runtime.md#preflight-and-binding).
+At pass start, follow [Provider bindings](t3-runtime.md#preflight-and-binding) for your own account and schedule binding.
+Use [Nightly PR-triage setup](automations.md#nightly-pr-triage-setup) for activation.
+Read the durable activation record for the repository set.
+Resolve the user with `gh api user --jq .login`.
+Read all open PRs authored by the user in every repository in the recorded set,
+including all pages.
+
+Report each PR's CI, reviews, mergeable state, and unresolved threads in your
+own T3 thread.
+For each unavailable, failed, or incomplete forge field, report `UNKNOWN`.
+Report incomplete repository or pagination coverage explicitly.
+Flag stale PRs after 7 days of inactivity.
+Report the top three PRs to act on with reasons drawn from the observed state.
+If fewer than three PRs exist, report those available.
+Never declare a PR merge-ready.
+
+Never merge, post comments, change labels, push, send relay messages, dispatch
+work, or launch threads.

package/skills/axstack/references/preview.md

@@ -0,0 +1,53 @@
+# PR previews
+
+Only the PR owner runs this procedure for private previews over the tailnet.
+The tailnet is the user's private Tailscale network.
+Preview authority covers only the preview unit and its `tailscale serve` route on the VPS.
+This procedure grants no release, npm publish, or host install authority.
+A later release run under `AGENTS.md` needs its own recorded authority.
+
+## Decide
+
+Start a preview only when the run's T3 host is the VPS.
+On any other host, record "no preview: run host is not the VPS" and continue.
+For each own PR, the owner decides whether a preview makes sense.
+Require both a runnable dev-server command documented in the base branch's `AGENTS.md` or README and a user-visible change in the PR.
+Read the command only from the base.
+Never read the command from the PR head.
+If either requirement is missing, record "no preview".
+
+Report missing systemd user lingering or Tailscale operator rights as "no preview".
+Never change systemd user lingering or Tailscale operator rights.
+Never change unrelated host services or configuration.
+Run at most two previews per host.
+A third preview waits until a slot frees.
+
+## Start and record
+
+The owner starts the preview from an isolated checkout of the PR head as a systemd user unit.
+Set `RuntimeMaxSec=4h`, `MemoryMax=2G`, and `CPUQuota=200%`.
+Use only repository-documented dev or test environment sources.
+Never use production secrets for a preview in any repository.
+After start, confirm the process listens only on loopback.
+After start, confirm the `tailscale serve` target is `127.0.0.1:<port>`.
+If either loopback check fails, tear down and record "no preview: not loopback-only".
+Never use Tailscale Funnel.
+
+Record `Preview: <url> @ <served-sha>` in the run record and the driver thread.
+Label it as the served revision, distinct from the PR head SHA.
+Put the Preview line and any "preview queued" note in the PR description only for private repositories.
+After each restart or teardown, update or remove the Preview line and any "preview queued" note in the private PR description.
+Update or remove the run-record and driver-thread preview records after each restart or teardown.
+
+The `axstack-ui-verifier` can use the preview URL.
+A preview never replaces UI verification.
+Follow [UI verification](ui-verification.md) for the independent rendered pass.
+
+## Restart and teardown
+
+When the PR head changes, restart the preview on the new head.
+Run teardown when the PR merges or closes, the watch ends, or the time limit stops the unit.
+Use `ExecStopPost` to remove the route when the time limit stops the unit.
+At teardown, remove both the unit and its `tailscale serve` route.
+Read back the absence of both the unit and its `tailscale serve` route.
+If teardown fails, hold and record a receipt.

package/skills/axstack/references/review-manager-prompt.md

@@ -1,12 +1,15 @@
 # Review manager prompt
 
+At pass start, follow [Provider bindings](t3-runtime.md#preflight-and-binding) for own account selection.
+
 You are a fresh finite T3 review-manager pass in project `axstack-review-lane`
 on the VPS's existing `axatbhardwaj/axstack` clone. Fetch first; this unbound
 pass worktree starts from `origin/main`. Enter through installed `axstack-review`,
 which loads `../axstack/references/automations.md` relatively. Read that contract
-and [T3 runtime](t3-runtime.md). Verify your configuration against the recorded
-`axstack-owner` binding before admission. Reconcile the whole lane, discover
-all eligible peer-review events and admit within measured host capacity.
+and [T3 runtime](t3-runtime.md). Reconcile lane ownership and duplicate status,
+then follow [Provider bindings](t3-runtime.md#preflight-and-binding) for shared schedule
+recreation and recorded instance update before verifying the recorded `axstack-owner`
+binding before admission. Discover all eligible peer-review events and admit within measured host capacity.
 Use host-clone detached per-PR checkouts; preserve exact ownership and receipts.
 Retire settled predecessors, report retained worktree count, and disable the
 schedule and hold past its authorized limit. Save and read back continuity at

package/skills/axstack/references/role-roster.md

@@ -2,7 +2,11 @@
 
 - Chat drives (no role ID); `axstack-owner` owns one PR and
   `axstack-author` its sole writer.
-- `axstack-reviewer-primary` and `axstack-reviewer-secondary` are the ordered
+  For own PRs, automatic merge is the default under the
+  [watch predicate](../../axstack-watch/SKILL.md#5-state-readiness-precisely).
+  Only the recorded owning watch thread merges, including `axstack-owner`
+  for authorized standalone maintenance. Other roles never acquire merge authority.
+- `axstack-reviewer-primary` and `axstack-reviewer-peer` are the ordered
   peer pair. Peer review uses both; authored review uses this table:
 
   | Preset | Author class | Reviewer (class/effort) |

package/skills/axstack/references/routing.md

@@ -10,6 +10,9 @@ Presets: `mixed`, `codex-only`, `claude-only`. For new runs, use
 skills root, or an explicit user selection in the run record. Missing or contradictory sources are
 a setup gap: hold. Never infer from live profiles, harness,
 tools, credentials, quota, subscription, or default to `mixed`.
+Only same-provider, same-model account selection among instances of one driver
+may use headroom under [Provider bindings](t3-runtime.md#preflight-and-binding);
+provider/model substitution still requires the user's decision.
 
 At start, snapshot all role IDs from installed `skills/axstack/roles.json`,
 including provider/modelClass/model/mode/effort and intentional absences.
@@ -35,6 +38,8 @@ An unavailable provider, model, role, mode or effort holds that role with no sub
 Preset changes apply to new runs only; an active run keeps its snapshot.
 Replacing a session needs an explicit user decision and revalidation.
 Timeout, quota, auth and rejection hold affected work.
+An exhausted account with no eligible sibling still holds; dispatched roles never fail over mid-thread.
+Follow [Provider bindings](t3-runtime.md#preflight-and-binding) for driver account re-selection at turn boundaries.
 [Model discipline](contracts.md#model-discipline) governs optional seats,
 auditor preflight, and required holds; [Role roster](role-roster.md) governs
 single-provider absence and mixed Codex+Claude fan-out.
@@ -102,8 +107,8 @@ reason in the run record, or in the brief for tiny direct work.
   issue plus explicit acceptance checks and exclusions, snapshots it once, and
   proceeds. No prior snapshot, spec, tickets, or second approval is required; do not route
   to `axstack-align` solely because the snapshot is not yet written. Strict TDD,
-  mode-specific review, model, risk, and human-merge
-  contracts still apply.
+  mode-specific review, model, risk, and merge-authority contracts still apply.
+  Own PRs default to automatic merge under watch §5 predicate.
 - **Unclear:** clarify via `axstack-align` or a bounded question, then
   classify small or substantial; it does not force substantial-work paperwork.
   [Design lens](design-lens.md) Rung 1 is Unclear; use `axstack-align`.

package/skills/axstack/references/run-record.md

@@ -97,7 +97,9 @@ send, or watch can be looked up before any retry.
 Resume from compact pointers to commands or evidence, not copied transcripts.
 For chat-run watch, record the bound T3 schedule and scheduledTaskId,
 member PR publication/adoption receipts, exact driver threadId/runId, observation/report
-IDs, disposition, wake and stop receipts in this same record. The driver alone writes it; a later same-Run publication joins the membership only after remote readback. Reconcile named threads/runs, revisions, PR state, watches, and deliveries before
+IDs, disposition, wake and stop receipts in this same record.
+Record the chat-run watch cadence, last PR event, native schedule lifetime, and re-arm receipts.
+The driver alone writes it; a later same-Run publication joins the membership only after remote readback. Reconcile named threads/runs, revisions, PR state, watches, and deliveries before
 creating or redelivering anything. Outside the bounded driver-start orphan
 sweep, touch only this run; no unscoped global sweep, runtime database, or
 scheduler follows from the record.
@@ -185,6 +187,7 @@ Source base: <exact revision or source identity>
 IDs: <projectId + driver threadId/runId + dispatch identity receipt pointers>
 Runtime: <host + T3 version + installed Axstack SHA + capabilities JSON path>
 Schedules: <scheduledTaskIds of every watch and manager schedule>
+Watch: <member publication/adoption receipts + cadence + last PR event + native lifetime + update/re-arm/stop receipts>
 Worktrees in other repositories: <per-run repository and worktree IDs or none>
 Evidence: <check/review/submission/audit receipt pointers>
 Pending: <launch/acceptance/external receipts + scheduledTaskIds + runIds + deadline>

package/skills/axstack/references/t3-runtime.md

@@ -16,8 +16,66 @@ preset and stable role IDs, requested provider/model/class/mode/effort, resolved
 ID, source and time once. Resume preserves that snapshot with no re-resolution;
 changes require the user's explicit decision. Bundled presets are setup inputs.
 
-Provider bindings must map codex→`codex`, claude→`claudeAgent`, grok→`grok`,
-antigravity→`antigravity`. Map `modeId` to `runtimeMode:full-access` and effort
+Provider bindings must map grok→`grok` and antigravity→`antigravity`, with
+canonical error-exit fallbacks codex→`codex` and claude→`claudeAgent`.
+At each dispatch or launch, claude and codex must bind to the instanceId printed
+by `scripts/pick-instance.js --provider <provider>`.
+For dispatched roles, only error exit 1 permits fallback to the canonical instance after validating availability.
+Exit 2 (no eligible provider instances) must hold the work without fallback.
+Record the chosen instanceId and a pointer to saved `--json` output in the dispatch record.
+Only same-provider, same-model account selection among instances of one driver
+is permitted, with provider, model, class and effort rules required to remain unchanged.
+An exhausted account with no eligible sibling must hold.
+Dispatched roles never fail over mid-thread.
+
+When the driver starts or resumes a run and at the start of every run-watch wake,
+it runs `scripts/pick-instance.js --provider <its own provider> --json`.
+Read its current binding with `t3_thread_configuration` and save picker JSON in private run evidence.
+If the driver's own current instance is `excluded` for a usage limit and an eligible
+same-provider sibling exists, it must switch itself via `t3_thread_configure` to the
+chosen sibling instance, keeping the same provider, model and effort/options, then continue.
+The driver must record from/to instance, a pointer to saved picker JSON and UTC time in `progress.md`.
+If the driver's own current instance is eligible, it must stay despite headroom differences.
+On exit 2 (no eligible sibling), the driver must hold under the existing rule.
+On error exit 1, the driver must keep its current instance.
+Driver account re-selection must configure only the calling thread and only at a turn boundary.
+A turn already paused by a usage limit cannot self-recover.
+The next wake or user message runs this check.
+
+Driver self-switching is required from v0.25.1.
+T3 scheduled tasks retain the creation-time instanceId for wakes and fresh-thread
+passes regardless of the calling thread's current binding.
+The driver must arm a run watch only after picking its account: `pick-instance.js` before `schedule_task`.
+On a driver self-switch, delete and recreate its armed bound run watch with the
+same prompt, cadence and binding on the new instance.
+
+Every scheduled automation pass runs `scripts/pick-instance.js --provider <its own provider> --json`
+at pass start, including fresh-thread review-manager passes.
+Scheduled passes follow the driver's eligibility and stay rules: an eligible own instance stays,
+exit 1 keeps the current instance and exit 2 holds.
+If a scheduled pass's own current instance is `excluded` and an eligible same-provider sibling exists,
+it must switch itself via `t3_thread_configure` to the chosen sibling instance,
+keeping the same provider, model and effort/options.
+On a scheduled pass self-switch in a review-manager lane, only the owner-of-record, after lane reconciliation
+and the duplicate check, must delete and recreate its own schedule with the same
+prompt, cadence and binding on the chosen instance.
+On any other scheduled pass self-switch, delete and recreate its own schedule with
+the same prompt, cadence and binding on the chosen instance only after `list_scheduled_tasks`
+confirms no replacement for that schedule on the chosen instance already exists.
+If a replacement for that schedule on the chosen instance already exists, any other scheduled pass must skip recreation.
+For a review-manager self-switch, only the owner-of-record must update the recorded
+`axstack-owner` binding's instanceId to the chosen instance after verifying unchanged
+provider/model/effort/options with `t3_thread_configuration` and attaching the picker
+switch receipt, before the admission binding comparison.
+For each schedule replacement, read back old absence and new presence using `list_scheduled_tasks`.
+For each schedule replacement, record old/new scheduledTaskId, from/to instance,
+picker JSON pointer and UTC time in the `progress.md` or durable activation/continuity record.
+Retain the recorded schedule's title and enabled state and use a fresh stable creation `clientRequestId`.
+An uncertain replacement holds affected work: preserve its native receipts for reconciliation.
+A scheduled pass already running on an exhausted account cannot recover.
+Account switches must happen before exhaustion at the picker's near-limit cutoff.
+
+Map `modeId` to `runtimeMode:full-access` and effort
 to `options:[{id,value}]`. Stored permission intent is neither effective parity
 nor a security boundary.
 
@@ -27,6 +85,7 @@ A preset model must be used as given.
 codex `gpt-<N>-<class>`, claude `claude-<class>-<N>-<N>`. Use
 `scripts/resolve-models.js --provider` with the saved capabilities JSON path;
 a missing or malformed catalog holds resolution.
+Model catalog resolution retains the canonical instance IDs above.
 
 A `model:null` role lacking a class must use the first model listed for its
 provider in saved capabilities only for grok and antigravity (launch-by-agent-id
@@ -40,6 +99,8 @@ absence and must hold; never use a provider default for that role.
 
 An unavailable provider, model, role, mode or effort must hold that role with
 no substitution. Auth, quota, timeout and rejection do not select an alternative.
+Here alternative means a provider or model substitution, excluding the bounded
+same-provider, same-model account selection above.
 Intentional absent seats remain recorded absences; availability is runtime proof.
 
 Codex effort must use option ID `reasoningEffort`.
@@ -234,4 +295,8 @@ The boundary must provide no Axstack daemon, DB, lock or scheduler. Native T3
 schedules supply wakes; Axstack maintains prose records, not a runtime state
 engine. Private evidence requires explicit publication authority before sharing;
 receipts confer no merge, release, publication, model-substitution, host-mutation
-or expanded scope authority. Human merges by default.
+or expanded scope authority.
+For own PRs, automatic merge is the default under the
+[watch predicate](../../axstack-watch/SKILL.md#5-state-readiness-precisely).
+The recorded owning watch thread merges; a missing or idle owner requires
+lifecycle reconciliation and explicit transfer first.

package/skills/axstack/references/test-audit-weekly.md

@@ -1,5 +1,7 @@
 # Weekly test-audit prompt
 
+At pass start, follow [Provider bindings](t3-runtime.md#preflight-and-binding) for account selection and schedule recreation.
+
 You are a fresh finite weekly test-audit session in this repository's dedicated
 T3 project worktree. Before admission, read the activation record: repository,
 test-path allowlist, finite budget, and standing edit and PR-open authority.
@@ -54,7 +56,8 @@ Keep one writer and private revision-bound receipts; workers never push.
 Obtain independent review using Implement's configured authored-review roles and
 verify the exact candidate's checks before publication. The driver uses
 `gh stack` and opens at most one test-audit PR per week after independent review;
-the human merges.
+for own PRs, automatic merge is the default under the
+[watch predicate](../../axstack-watch/SKILL.md#5-state-readiness-precisely).
 
 Notify only under the run's Notification policy: a decision park, merge-ready
 (within the run's milestone cap), or serious-risk hold; never progress or

package/skills/axstack/references/ui-verification.md

@@ -6,6 +6,8 @@ run's role snapshot. Give it the exact build, URL, or artifact and the private
 dispatch's evidence folder. The verifier is read-only: it never edits source.
 The PR writer remains the sole writer.
 
+Before using a PR preview URL, the UI verifier must read [PR previews](preview.md).
+
 The sole author browser exception is archify `finalize` as a headless build gate.
 Keep finalize outputs only in the private evidence folder.
 Never replace the verifier's rendered pass with finalize.

package/skills/axstack/scripts/pick-instance.js

@@ -0,0 +1,110 @@
+import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+
+const weights = {
+  claude: { default_claude_max_20x: 4, default_claude_max_5x: 1 }, codex: { pro: 4, prolite: 1 },
+};
+const drivers = { claude: 'claudeAgent', codex: 'codex' };
+const home = process.env.HOME;
+const expandHome = (path) => path === '~' ? home : path.startsWith('~/') ? `${home}/${path.slice(2)}` : path;
+const readJson = (path) => JSON.parse(readFileSync(path, 'utf8'));
+const cacheDir = `${process.env.XDG_CACHE_HOME || `${home}/.cache`}/axstack`;
+const cachePath = `${cacheDir}/usage.json`;
+let cache;
+try { cache = readJson(cachePath); } catch { cache = {}; }
+if (!cache || typeof cache !== 'object' || Array.isArray(cache)) cache = {};
+
+function argumentsFrom(args) {
+  const options = {};
+  for (let i = 0; i < args.length; i++) {
+    const flag = args[i];
+    if (flag === '--json' && !options.json) { options.json = true; continue; }
+    if (!['--provider', '--settings'].includes(flag) || flag.slice(2) in options) {
+      throw new Error('expected --provider claude|codex [--settings path] [--json]');
+    }
+    const value = args[++i];
+    if (!value || value.startsWith('--')) throw new Error('missing argument value');
+    options[flag.slice(2)] = value;
+  }
+  if (!Object.hasOwn(drivers, options.provider)) throw new Error('expected --provider claude|codex');
+  return options;
+}
+
+async function account(instanceId, instance, provider) {
+  const config = instance.config ?? {};
+  const dir = expandHome((provider === 'claude' ? config.homePath : config.shadowHomePath || config.homePath)
+    || `${home}/.${provider}`);
+  let credentials;
+  try {
+    credentials = readJson(`${dir}/${provider === 'claude' ? '.credentials.json' : 'auth.json'}`);
+    const valid = provider === 'claude' ? credentials.claudeAiOauth?.accessToken
+      : credentials.tokens?.access_token && credentials.tokens?.account_id;
+    if (!valid) throw new Error();
+  } catch {
+    return { instanceId, score: null, state: 'skipped', reason: 'missing credentials' };
+  }
+  const headers = provider === 'claude'
+    ? { authorization: `Bearer ${credentials.claudeAiOauth.accessToken}`,
+      'anthropic-beta': 'oauth-2025-04-20', 'user-agent': 'claude-cli/2.1.0 (external, cli)' }
+    : { authorization: `Bearer ${credentials.tokens.access_token}`,
+      'chatgpt-account-id': credentials.tokens.account_id };
+  const url = provider === 'claude'
+    ? process.env.AXSTACK_CLAUDE_USAGE_URL || 'https://api.anthropic.com/api/oauth/usage'
+    : process.env.AXSTACK_CODEX_USAGE_URL || 'https://chatgpt.com/backend-api/wham/usage';
+  const key = JSON.stringify([provider, dir]);
+  let value = cache[key];
+  if (!Number.isFinite(value?.updatedAt) || !(value.utilization === null || Number.isFinite(value.utilization))
+    || typeof value.limitReached !== 'boolean') value = undefined;
+  let state = 'cached';
+  if (!value || Date.now() - value.updatedAt >= 5 * 60 * 1000) {
+    try {
+      const response = await fetch(url, { headers, signal: AbortSignal.timeout(5000) });
+      if (!response.ok) throw new Error();
+      const usage = await response.json();
+      const windows = provider === 'claude'
+        ? [usage.five_hour?.utilization, usage.seven_day?.utilization]
+        : [usage.rate_limit?.primary_window?.used_percent, usage.rate_limit?.secondary_window?.used_percent];
+      const known = windows.filter((value) => typeof value === 'number' && Number.isFinite(value));
+      value = { updatedAt: Date.now(),
+        tier: provider === 'claude' ? credentials.claudeAiOauth.rateLimitTier : usage.plan_type,
+        utilization: known.length ? Math.max(...known) : null, limitReached: usage.rate_limit?.limit_reached === true };
+      cache[key] = value;
+      state = 'fresh';
+      try {
+        mkdirSync(cacheDir, { recursive: true, mode: 0o700 });
+        writeFileSync(cachePath, JSON.stringify(cache), { mode: 0o600 });
+      } catch { /* Cache availability must not prevent account selection. */ }
+    } catch {
+      state = value ? 'stale' : 'unknown';
+      value ??= { tier: credentials.claudeAiOauth?.rateLimitTier, utilization: null };
+    }
+  }
+  const stale = state === 'stale';
+  if (value.utilization >= 95 || value.limitReached) {
+    return { instanceId, score: null, state: 'excluded', stale, reason: 'usage limit' };
+  }
+  const weight = Object.hasOwn(weights[provider], value.tier) ? weights[provider][value.tier] : 1;
+  return { instanceId, score: value.utilization === null ? weight : (100 - value.utilization) * weight,
+    state: value.utilization === null ? 'unknown' : state, stale };
+}
+
+try {
+  const options = argumentsFrom(process.argv.slice(2));
+  const settings = readJson(expandHome(options.settings || `${home}/.t3/userdata/settings.json`));
+  if (!settings?.providerInstances || typeof settings.providerInstances !== 'object'
+    || Array.isArray(settings.providerInstances)) throw new Error();
+  const instances = [];
+  for (const [instanceId, instance] of Object.entries(settings.providerInstances).filter(([, instance]) =>
+    instance.enabled && instance.driver === drivers[options.provider])) {
+    instances.push(await account(instanceId, instance, options.provider));
+  }
+  const chosen = instances.filter((instance) => instance.score !== null).sort((a, b) => b.score - a.score)[0];
+  if (!chosen) {
+    console.error('account selection hold: no eligible provider instances');
+    process.exitCode = 2;
+  } else {
+    console.log(options.json ? JSON.stringify({ chosenInstanceId: chosen.instanceId, instances }) : chosen.instanceId);
+  }
+} catch {
+  console.error('account selection failed: invalid input/settings or unexpected error');
+  process.exitCode = 1;
+}

package/skills/axstack-audit/SKILL.md

@@ -42,8 +42,10 @@ If the base auditor is unlaunchable (preflight rejection, no Dispatch started),
 record `auditor: UNKNOWN (unlaunchable)` with the attempted route and error as
 the archive receipt; archive the run. A launched auditor Dispatch must settle
 normally. There is no substitution for the base auditor.
-The user-chosen improvement mode is a tested, independently reviewed PR that a
-human merges.
+The user-chosen improvement mode is a tested, independently reviewed PR.
+For own PRs, automatic merge is the default under the
+[watch predicate](../axstack-watch/SKILL.md#5-state-readiness-precisely).
+The auditor never merges.
 
 Act as a non-author, read-only reader of the run. The assigned audit artifact is
 `audit.md`, the only writable output. Make no edits to product, skills,
@@ -151,7 +153,7 @@ Each proposal names:
 4. a regression scenario first, followed by an unchanged holdout evaluation;
 5. a cost and quality comparison when those values were measured; and
 6. the authorized delivery path: the auditor suggests, the driver arranges an
-   author and independent review, a reviewed PR is proposed, and a human merges.
+   author and independent review, a reviewed PR is proposed, and the owning watch thread applies watch §5, including its user-merge exclusions.
 
 Keep evaluation data, candidate changes, and validation separate. This is an
 original Axstack workflow with no outside dependency or extra framework to

package/skills/axstack-implement/SKILL.md

@@ -189,6 +189,10 @@ The author stops at that receipt and does not push. The driver reconciles it,
 uses `gh stack` to publish, confirms remote readback, and continues the loop
 without editing the candidate. No step grants merge authority.
 
+Every own PR description must contain exactly one `Revert` line.
+Follow [Revert line](../axstack/references/candidate-publication.md#revert-line)
+for its format and classification.
+
 ## 6. Loop until merge-ready
 
 Inputs are one snapshotted small-change intent or an approved spec and ticket
@@ -202,6 +206,8 @@ For each PR:
 
 1. Dispatch `axstack-author` under §§3-5 and consume its strict-TDD receipt.
 2. Publish through candidate-publication and read back the exact SHA.
+   For each own PR, the owner must follow [PR previews](../axstack/references/preview.md)
+   to decide whether a preview makes sense.
 3. Dispatch and consume the authored-mode `axstack-review` selected from actual
    author provenance. State the author's actual provider and model from the
    T3 launch receipt in the review dispatch brief; a `Claude-Session`
@@ -239,9 +245,10 @@ For each PR:
    `repairs` once and counts once toward the third-round hold.
 
 The T3 run watch reconciles every unsettled dispatch attempt; the bounded
-forge check wait is the only other implementation wait. The eligible run arms
-one maintain-mode chat-run watch at its first published PR; that watch owns its
-bound 10-minute T3 schedule wake.
+forge check wait is the only other implementation wait.
+After verified readback of every own PR publication, the driver arms or joins
+its maintain-mode chat-run watch under [Autopilot](../axstack/references/autopilot.md).
+That watch owns the bound T3 schedule wake; its runtime sets the cadence.
 A turn with unsettled launched threads must end only under the bound-watch rule in the T3 runtime contract.
 With settled threads, end a turn only when every required PR is `merge-ready` or `held`. Under the recorded Notification policy,
 `axstack-relay` sends only a serious risk immediately, a genuine blocked
@@ -253,13 +260,21 @@ Only the bounded categories—user-decision holds (including spec approval),
 serious-risk holds, and at most two merge-ready/merged milestones per run—may
 be relayed under the recorded Notification policy.
 
-Merge-ready opens the merge boundary. Only the chat-run driver holding the
-approved ticket map is the merge actor for own PRs inside the approved ticket
-map (run-created or explicitly adopted into it) when they target an
-`integration` base. Apply `axstack-watch` §5's merge card and
-full predicate; an approval alone never grants merge authority. A peer PR or
-`deploying` base waits for the user to merge, in either approval mode. A
-manager, worker, reviewer, automation, or standalone watch must never merge.
+Merge-ready opens the merge boundary.
+For own PRs, automatic merge is the default under the
+[watch predicate](../axstack-watch/SKILL.md#5-state-readiness-precisely).
+The merge actor is the recorded owning watch thread (`axstack-owner` for
+standalone authorized maintenance), including small and adopted work.
+Missing or idle ownership follows lifecycle reconciliation and explicit transfer first.
+Apply `axstack-watch` §5's merge card and full predicate; an approval alone
+never grants merge authority.
+A peer PR or `deploying` base waits for the user to merge, in either approval mode.
+User merges are bottom-up for a stack.
+A manager, worker, reviewer, monitor, or nightly triage must never merge.
+Observation-only and peer watches never merge.
+Watch §5 owns provider provenance, approval carryover, eligible bases, every
+planned stack member's publication, exclusions, and card-reply exceptions.
+This policy grants no release, npm publish, or host install authority.
 Re-read every predicate term under watch §5 before merging. Confirm merge
 commits are allowed, `delete_branch_on_merge` is false, and the base has no
 merge queue; otherwise hold for the user. For a singleton, use