axstack 0.27.4 → 0.29.0

package/README.md

@@ -125,7 +125,10 @@ Eligible own PRs use guarded automatic merge; see [merge boundaries, exclusions,
 ## Some notes
 
 - T3 Code is the only supported active runtime. Axstack adds no daemon or runtime
-  database.
+  database. The exception is one opt-in systemd user timer `axstack-default-sync`,
+  running a stateless script that rewrites only T3 `defaultModelSelection.instanceId`.
+  It has no workflow state and launches no agent; see
+  [Host operations](docs/host-operations.md#new-chat-default-sync).
 - The recorded owning watch thread merges eligible own PRs; excluded PRs use a merge card.
 - This is an early project; expect the workflows to evolve.
 

package/docs/concepts.md

@@ -103,6 +103,8 @@ and effort remain fixed. Dispatched roles never fail over mid-thread.
 See [Provider bindings](../skills/axstack/references/t3-runtime.md#preflight-and-binding)
 for schedule rebinding and the [policy carve-out](workflows.md#automatic-merge-boundaries).
 
+The opt-in `sync-default.js` keeps the New-chat default on the same-provider account with the highest elapsed-minus-used pace, switching at a ten-point lead or when the current account is excluded; it preserves the model and project overrides.
+
 ## Account selection environment
 
 `XDG_CACHE_HOME` selects the cache directory; the default is `~/.cache`.

package/docs/host-operations.md

@@ -43,7 +43,10 @@ and save the actual `orchestrator_capabilities` JSON. Missing capability holds
 the affected operation. Provider/model routing, Linear documents through the
 executor MCP, and live schedule behavior need separate preflights.
 
-Installation creates no production schedule and adds no custom scheduler.
+Installation creates no production schedule and never enables a timer.
+Axstack allows one opt-in systemd user timer `axstack-default-sync` as the
+scheduler exception: it runs a stateless script that rewrites only T3
+`defaultModelSelection.instanceId`, has no workflow state and launches no agent.
 Every verified own-PR publication arms or joins the driver's chat-run watch.
 Its bound T3 schedule uses the cadence in [Chat-run watch activation](#chat-run-watch-activation).
 See [Chat-run PR watch](workflows.md#chat-run-pr-watch) for authority, schedule identity and stop conditions.
@@ -153,8 +156,9 @@ user-taken-over threads, uncertain publication, and unknown liveness hold
 retirement. No broad scratch deletion or forced worktree removal applies.
 Manual review and user-driven `axstack-watch` remain outside this schedule.
 Requested peer reviews cover any accessible repository. T3 owns schedules,
-threads, runs, and delegated tasks; Axstack adds no queue engine, scheduler,
-cursor files, or historical runtime fallback.
+threads, runs, and delegated tasks; Axstack adds no queue engine, cursor files,
+or historical runtime fallback. The only scheduler exception is the opt-in
+systemd user timer described in [New-chat default sync](#new-chat-default-sync).
 
 ## Review automation
 
@@ -171,3 +175,56 @@ These documents and their source-contract tests define expected decisions.
 Scenario fixtures are behavioral-evaluation inputs, not model-evaluation
 results, and neither form is live proof; activation still requires the native
 canary described by the operational contract.
+
+## New-chat default sync
+
+This opt-in stateless script rewrites only `defaultModelSelection.instanceId`
+in `~/.t3/userdata/settings.json`. It compares enabled accounts of the current
+Claude/Codex driver, without plan weights; it keeps the model, project overrides
+and every other settings byte. It never creates a missing default or refreshes
+OAuth tokens. Unknown usage or a missing reset clock holds the default, unless
+an excluded/unauthorized current account can escape to a known eligible sibling.
+The shared usage cache expires after five minutes; sync refuses stale usage for
+comparison. Any session/weekly window at 95% or a reached limit is excluded.
+
+Preview the decision and save the current instance ID for rollback:
+
+```sh
+bun ~/.agents/skills/axstack/scripts/sync-default.js --dry-run
+```
+
+Exit 0 prints one token-free JSON decision line; dry-run reports the proposed
+change without writing. `--settings <path>` selects a fixture or alternate file.
+`AXSTACK_SYNC_DEFAULT=0` is a no-op. Exit 1 reports malformed settings or a failed
+write. A sibling temp file preserves the settings mode and is fsynced before
+rename. The script checks original bytes immediately before rename and verifies
+bytes afterward. The accepted sub-ms race with an in-app T3 write can still lose
+that edit; a read-back mismatch is logged as an error rather than overwritten.
+
+After recording host-mutation authority, copy the shipped units and enable:
+
+```sh
+mkdir -p ~/.config/systemd/user
+cp ~/.agents/skills/axstack/systemd/axstack-default-sync.service ~/.config/systemd/user/axstack-default-sync.service
+cp ~/.agents/skills/axstack/systemd/axstack-default-sync.timer ~/.config/systemd/user/axstack-default-sync.timer
+systemctl --user daemon-reload
+systemctl --user enable --now axstack-default-sync.timer
+systemctl --user list-timers axstack-default-sync.timer
+journalctl --user -u axstack-default-sync.service
+```
+
+The first tick is about one minute after user-manager startup, then every ten
+minutes. `Persistent=true` is shipped; this monotonic timer does not replay
+missed calendar ticks. For a different skills root or Bun path, override
+`ExecStart`/`Environment` with `systemctl --user edit axstack-default-sync.service`.
+Operation after logout requires an authorized user-manager/linger setup.
+Installation never activates these units.
+
+Disable with `systemctl --user disable --now axstack-default-sync.timer` and
+stop any active one-shot with `systemctl --user stop axstack-default-sync.service`.
+For rollback, then restore the saved default instance through T3 Settings.
+The exclusive sibling directory lock `<settings>.axstack-default-sync.lock`
+prevents overlapping commits; fresh-lock contention prints unchanged/locked.
+A lock older than sixty seconds is treated as stale: the script removes that
+exact empty directory and retries acquisition once, recovering on a later tick
+from a killed writer. If the retry finds a fresh lock, it still prints locked.

package/docs/installation.md

@@ -88,6 +88,17 @@ An offline, Git-less, or failed clone still installs the skills, reports
 See [Account selection environment](concepts.md#account-selection-environment)
 for the picker cache directory and test-only usage endpoint variables.
 
+## Packaged scripts
+
+Run these with Bun from the installed `<skills-dir>/axstack/scripts/` directory:
+`resolve-models.js` (model IDs), `pick-instance.js` (dispatch account),
+`pr-digest.js` (PR discovery), `archive-evidence.js` (evidence archive), and
+`sync-default.js [--settings <path>] [--dry-run]` (New-chat account default).
+`account-usage.js` shares usage retrieval and the five-minute cache between
+picker and sync. The opt-in systemd user unit files ship in `axstack/systemd/`;
+installation copies them as assets and never enables the timer.
+See [Host operations](host-operations.md#new-chat-default-sync) for activation.
+
 ## Role presets
 
 The selected bundle input is one of:
@@ -288,7 +299,11 @@ the user explicitly changes it and accepts the resulting evidence invalidation.
 
 The `mixed` and `claude-only` presets assign `axstack-auditor`,
 `axstack-research-requirements`, `axstack-research-code`, `axstack-research-web`,
-`axstack-explore-execution`, and `axstack-monitor` to the Claude Sonnet class at high effort.
+`axstack-explore-execution` to the Claude Sonnet class at high effort.
+`axstack-explore-codebase` and `axstack-monitor` adopt Haiku 5.5 high with
+`modelClass: haiku` and the exact `model: claude-haiku-5-5` pin.
+Activation requires that exact ID and high effort in saved T3 capabilities;
+missing either holds these roles without substitution, including Haiku 4.5.
 The `codex-only` assignments for these roles are unchanged.
 The three `-sol` pair seats for auditor, research-code, and explore-execution
 use Sol high in `mixed` and `codex-only`; `claude-only` records intentional

package/docs/workflows.md

@@ -124,8 +124,11 @@ role.
 | `claude-only` | Opus medium | Opus medium; Sonnet high | unavailable / Opus xhigh | Sonnet high (Sol absent) |
 
 In `mixed` and `claude-only`, `axstack-auditor`, `axstack-research-requirements`,
-`axstack-research-code`, `axstack-research-web`, `axstack-explore-execution`,
-and `axstack-monitor` use the Claude Sonnet class at high effort. `codex-only` keeps its Codex
+`axstack-research-code`, `axstack-research-web`, and `axstack-explore-execution`
+use the Claude Sonnet class at high effort. `axstack-explore-codebase` and
+`axstack-monitor` adopt Haiku 5.5 high, with class `haiku` and exact pin
+`claude-haiku-5-5`. Missing that ID or high effort in saved T3 capabilities
+holds those roles without substitution. `codex-only` keeps its Codex
 assignments for those roles. Mixed web-google and X retain their source-specific
 Antigravity and Grok routes.
 The new `-sol` auditor, research-code, and explore-execution seats use Sol high

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "axstack",
-  "version": "0.27.4",
+  "version": "0.29.0",
   "description": "Axstack installer and setup CLI: installs owned chat skills and role data, configures supported harness settings, and checks T3 Code capabilities.",
   "keywords": [
     "claude-code",

package/profiles/presets/claude-only.json

@@ -169,8 +169,9 @@
       "provider": "claude",
       "modeId": "bypassPermissions",
       "thinkingOptionId": "high",
-      "notes": "Codebase mapper: explores repository structure and interfaces for research and handoff context. T3 resolves Claude classes from saved capabilities; a Claude rejection holds.",
-      "modelClass": "sonnet"
+      "notes": "Haiku 5.5 high codebase mapper: explores repository structure and interfaces for research and handoff context. T3 uses the exact claude-haiku-5-5 pin from saved capabilities; a Claude rejection holds. Missing model or high effort holds without substitution.",
+      "modelClass": "haiku",
+      "model": "claude-haiku-5-5"
     },
     {
       "id": "axstack-explore-execution",
@@ -196,8 +197,9 @@
       "provider": "claude",
       "modeId": "bypassPermissions",
       "thinkingOptionId": "high",
-      "notes": "Optional Sonnet high independent read-only observer for a standalone PR watch. Reads GitHub, feedback, and checks, persists event IDs, and wakes the owner only for a new actionable event. Never sends, authors, reviews, replies, or acts as either reusable PR manager. Healthy snapshots stay quiet. Chat-run mode: one same-host native read-only observer per Run; fresh finite passes report precise deltas internally to the original Run/driver and may disable/read back only their own automation at verified stop. No repair, dispatch, public notification, or replacement coordinator. Effective scheduled model/effort and wake require live proof. T3 resolves Claude classes from saved capabilities; a Claude rejection holds.",
-      "modelClass": "sonnet"
+      "notes": "Optional independent read-only Haiku 5.5 high observer for a standalone PR watch. Reads GitHub, feedback, and checks, persists event IDs, and wakes the owner only for a new actionable event. Never sends, authors, reviews, replies, or acts as either reusable PR manager. Healthy snapshots stay quiet. Chat-run mode: one same-host native read-only observer per Run; fresh finite passes report precise deltas internally to the original Run/driver and may disable/read back only their own automation at verified stop. No repair, dispatch, public notification, or replacement coordinator. Effective scheduled model/effort and wake require live proof. T3 uses the exact claude-haiku-5-5 pin from saved capabilities; a Claude rejection holds. Missing model or high effort holds without substitution.",
+      "modelClass": "haiku",
+      "model": "claude-haiku-5-5"
     },
     {
       "id": "axstack-auditor",

package/profiles/presets/mixed.json

@@ -169,8 +169,9 @@
       "provider": "claude",
       "modeId": "bypassPermissions",
       "thinkingOptionId": "high",
-      "notes": "Codebase mapper: explores repository structure and interfaces for research and handoff context. T3 resolves Claude classes from saved capabilities; a Claude rejection holds.",
-      "modelClass": "sonnet"
+      "notes": "Haiku 5.5 high codebase mapper: explores repository structure and interfaces for research and handoff context. T3 uses the exact claude-haiku-5-5 pin from saved capabilities; a Claude rejection holds. Missing model or high effort holds without substitution.",
+      "modelClass": "haiku",
+      "model": "claude-haiku-5-5"
     },
     {
       "id": "axstack-explore-execution",
@@ -196,8 +197,9 @@
       "provider": "claude",
       "modeId": "bypassPermissions",
       "thinkingOptionId": "high",
-      "notes": "Optional Sonnet high independent read-only observer for a standalone PR watch. Reads GitHub, feedback, and checks, persists event IDs, and wakes the owner only for a new actionable event. Never sends, authors, reviews, replies, or acts as either reusable PR manager. Healthy snapshots stay quiet. Chat-run mode: one same-host native read-only observer per Run; fresh finite passes report precise deltas internally to the original Run/driver and may disable/read back only their own automation at verified stop. No repair, dispatch, public notification, or replacement coordinator. Effective scheduled model/effort and wake require live proof. T3 resolves Claude classes from saved capabilities; a Claude rejection holds.",
-      "modelClass": "sonnet"
+      "notes": "Optional independent read-only Haiku 5.5 high observer for a standalone PR watch. Reads GitHub, feedback, and checks, persists event IDs, and wakes the owner only for a new actionable event. Never sends, authors, reviews, replies, or acts as either reusable PR manager. Healthy snapshots stay quiet. Chat-run mode: one same-host native read-only observer per Run; fresh finite passes report precise deltas internally to the original Run/driver and may disable/read back only their own automation at verified stop. No repair, dispatch, public notification, or replacement coordinator. Effective scheduled model/effort and wake require live proof. T3 uses the exact claude-haiku-5-5 pin from saved capabilities; a Claude rejection holds. Missing model or high effort holds without substitution.",
+      "modelClass": "haiku",
+      "model": "claude-haiku-5-5"
     },
     {
       "id": "axstack-auditor",

package/skills/axstack/references/role-roster.md

@@ -30,8 +30,11 @@
   for every interactive page, bound to the exact bytes and SHA-256.
 - `axstack-auditor`/`axstack-research-requirements`/
   `axstack-research-code`/`axstack-research-web`/
-  `axstack-explore-execution`/`axstack-monitor`:
+  `axstack-explore-execution`:
   `claude/sonnet` high in mixed/claude-only.
+- `axstack-explore-codebase`/`axstack-monitor`: `claude/haiku` high in
+  mixed/claude-only, pinned to `claude-haiku-5-5`. Missing that exact model
+  or high effort holds these roles without substitution.
   `axstack-monitor`: standalone watch never sends; chat-run watch: bounded
   internal reports to its Run and original driver.
 - Sol pairs `axstack-auditor-sol`/`axstack-research-code-sol`/

package/skills/axstack/scripts/account-usage.js

@@ -0,0 +1,78 @@
+import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+
+const home = process.env.HOME;
+export const expandHome = (path) => path === '~' ? home : path.startsWith('~/') ? `${home}/${path.slice(2)}` : path;
+export const readJson = (path) => JSON.parse(readFileSync(path, 'utf8'));
+const cacheDir = `${process.env.XDG_CACHE_HOME || `${home}/.cache`}/axstack`;
+const cachePath = `${cacheDir}/usage.json`;
+let cache;
+
+// Keep absolute reset clocks in the shared cache; remaining seconds must age between runs.
+function usageWindows(provider, usage, now) {
+  if (provider === 'claude') return [
+    [usage.five_hour, 18000], [usage.seven_day, 604800],
+  ].map(([window, seconds]) => ({ used: window?.utilization, seconds,
+    resetAt: typeof window?.resets_at === 'string' ? Date.parse(window.resets_at) : null }));
+  return [usage.rate_limit?.primary_window, usage.rate_limit?.secondary_window].map((window) =>
+    window ? { used: window.used_percent, seconds: window.limit_window_seconds,
+      resetAt: Number.isFinite(window.reset_at) ? window.reset_at * 1000
+        : Number.isFinite(window.reset_after_seconds) ? now + window.reset_after_seconds * 1000 : null } : null);
+}
+
+export async function accountUsage(instanceId, instance, provider) {
+  if (!cache) {
+    try { cache = readJson(cachePath); } catch { cache = {}; }
+    if (!cache || typeof cache !== 'object' || Array.isArray(cache)) cache = {};
+  }
+  const config = instance.config ?? {};
+  const dir = expandHome((provider === 'claude' ? config.homePath : config.shadowHomePath || config.homePath)
+    || `${home}/.${provider}`);
+  let credentials;
+  try {
+    credentials = readJson(`${dir}/${provider === 'claude' ? '.credentials.json' : 'auth.json'}`);
+    const valid = provider === 'claude' ? credentials.claudeAiOauth?.accessToken
+      : credentials.tokens?.access_token && credentials.tokens?.account_id;
+    if (!valid) throw new Error();
+  } catch {
+    return { instanceId, state: 'skipped', reason: 'missing credentials' };
+  }
+  const headers = provider === 'claude'
+    ? { authorization: `Bearer ${credentials.claudeAiOauth.accessToken}`,
+      'anthropic-beta': 'oauth-2025-04-20', 'user-agent': 'claude-cli/2.1.0 (external, cli)' }
+    : { authorization: `Bearer ${credentials.tokens.access_token}`,
+      'chatgpt-account-id': credentials.tokens.account_id };
+  const url = provider === 'claude'
+    ? process.env.AXSTACK_CLAUDE_USAGE_URL || 'https://api.anthropic.com/api/oauth/usage'
+    : process.env.AXSTACK_CODEX_USAGE_URL || 'https://chatgpt.com/backend-api/wham/usage';
+  const key = JSON.stringify([provider, dir]);
+  let value = cache[key];
+  if (!Number.isFinite(value?.updatedAt) || !(value.utilization === null || Number.isFinite(value.utilization))
+    || typeof value.limitReached !== 'boolean') value = undefined;
+  let state = 'cached';
+  let unauthorized = false;
+  if (!value || Date.now() - value.updatedAt >= 5 * 60 * 1000) {
+    try {
+      const response = await fetch(url, { headers, signal: AbortSignal.timeout(5000) });
+      if (!response.ok) { unauthorized = response.status === 401 || response.status === 403; throw new Error(); }
+      const usage = await response.json();
+      const windows = provider === 'claude'
+        ? [usage.five_hour?.utilization, usage.seven_day?.utilization]
+        : [usage.rate_limit?.primary_window?.used_percent, usage.rate_limit?.secondary_window?.used_percent];
+      const known = windows.filter((value) => typeof value === 'number' && Number.isFinite(value));
+      value = { updatedAt: Date.now(),
+        tier: provider === 'claude' ? credentials.claudeAiOauth.rateLimitTier : usage.plan_type,
+        utilization: known.length ? Math.max(...known) : null, limitReached: usage.rate_limit?.limit_reached === true,
+        windows: usageWindows(provider, usage, Date.now()) };
+      cache[key] = value;
+      state = 'fresh';
+      try {
+        mkdirSync(cacheDir, { recursive: true, mode: 0o700 });
+        writeFileSync(cachePath, JSON.stringify(cache), { mode: 0o600 });
+      } catch { /* Cache availability must not prevent account selection. */ }
+    } catch {
+      state = value ? 'stale' : 'unknown';
+      value ??= { tier: credentials.claudeAiOauth?.rateLimitTier, utilization: null };
+    }
+  }
+  return { instanceId, ...value, state, unauthorized };
+}

package/skills/axstack/scripts/pick-instance.js

@@ -1,17 +1,10 @@
-import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { accountUsage, expandHome, readJson } from './account-usage.js';
 
 const weights = {
   claude: { default_claude_max_20x: 4, default_claude_max_5x: 1 }, codex: { pro: 4, prolite: 1 },
 };
 const drivers = { claude: 'claudeAgent', codex: 'codex' };
 const home = process.env.HOME;
-const expandHome = (path) => path === '~' ? home : path.startsWith('~/') ? `${home}/${path.slice(2)}` : path;
-const readJson = (path) => JSON.parse(readFileSync(path, 'utf8'));
-const cacheDir = `${process.env.XDG_CACHE_HOME || `${home}/.cache`}/axstack`;
-const cachePath = `${cacheDir}/usage.json`;
-let cache;
-try { cache = readJson(cachePath); } catch { cache = {}; }
-if (!cache || typeof cache !== 'object' || Array.isArray(cache)) cache = {};
 
 function argumentsFrom(args) {
   const options = {};
@@ -30,61 +23,15 @@ function argumentsFrom(args) {
 }
 
 async function account(instanceId, instance, provider) {
-  const config = instance.config ?? {};
-  const dir = expandHome((provider === 'claude' ? config.homePath : config.shadowHomePath || config.homePath)
-    || `${home}/.${provider}`);
-  let credentials;
-  try {
-    credentials = readJson(`${dir}/${provider === 'claude' ? '.credentials.json' : 'auth.json'}`);
-    const valid = provider === 'claude' ? credentials.claudeAiOauth?.accessToken
-      : credentials.tokens?.access_token && credentials.tokens?.account_id;
-    if (!valid) throw new Error();
-  } catch {
-    return { instanceId, score: null, state: 'skipped', reason: 'missing credentials' };
-  }
-  const headers = provider === 'claude'
-    ? { authorization: `Bearer ${credentials.claudeAiOauth.accessToken}`,
-      'anthropic-beta': 'oauth-2025-04-20', 'user-agent': 'claude-cli/2.1.0 (external, cli)' }
-    : { authorization: `Bearer ${credentials.tokens.access_token}`,
-      'chatgpt-account-id': credentials.tokens.account_id };
-  const url = provider === 'claude'
-    ? process.env.AXSTACK_CLAUDE_USAGE_URL || 'https://api.anthropic.com/api/oauth/usage'
-    : process.env.AXSTACK_CODEX_USAGE_URL || 'https://chatgpt.com/backend-api/wham/usage';
-  const key = JSON.stringify([provider, dir]);
-  let value = cache[key];
-  if (!Number.isFinite(value?.updatedAt) || !(value.utilization === null || Number.isFinite(value.utilization))
-    || typeof value.limitReached !== 'boolean') value = undefined;
-  let state = 'cached';
-  if (!value || Date.now() - value.updatedAt >= 5 * 60 * 1000) {
-    try {
-      const response = await fetch(url, { headers, signal: AbortSignal.timeout(5000) });
-      if (!response.ok) throw new Error();
-      const usage = await response.json();
-      const windows = provider === 'claude'
-        ? [usage.five_hour?.utilization, usage.seven_day?.utilization]
-        : [usage.rate_limit?.primary_window?.used_percent, usage.rate_limit?.secondary_window?.used_percent];
-      const known = windows.filter((value) => typeof value === 'number' && Number.isFinite(value));
-      value = { updatedAt: Date.now(),
-        tier: provider === 'claude' ? credentials.claudeAiOauth.rateLimitTier : usage.plan_type,
-        utilization: known.length ? Math.max(...known) : null, limitReached: usage.rate_limit?.limit_reached === true };
-      cache[key] = value;
-      state = 'fresh';
-      try {
-        mkdirSync(cacheDir, { recursive: true, mode: 0o700 });
-        writeFileSync(cachePath, JSON.stringify(cache), { mode: 0o600 });
-      } catch { /* Cache availability must not prevent account selection. */ }
-    } catch {
-      state = value ? 'stale' : 'unknown';
-      value ??= { tier: credentials.claudeAiOauth?.rateLimitTier, utilization: null };
-    }
-  }
-  const stale = state === 'stale';
+  const value = await accountUsage(instanceId, instance, provider);
+  if (value.state === 'skipped') return { instanceId, score: null, state: value.state, reason: value.reason };
+  const stale = value.state === 'stale';
   if (value.utilization >= 95 || value.limitReached) {
     return { instanceId, score: null, state: 'excluded', stale, reason: 'usage limit' };
   }
   const weight = Object.hasOwn(weights[provider], value.tier) ? weights[provider][value.tier] : 1;
   return { instanceId, score: value.utilization === null ? weight : (100 - value.utilization) * weight,
-    state: value.utilization === null ? 'unknown' : state, stale };
+    state: value.utilization === null ? 'unknown' : value.state, stale };
 }
 
 try {

package/skills/axstack/scripts/sync-default.js

@@ -0,0 +1,149 @@
+import * as fs from 'node:fs';
+import { accountUsage, expandHome } from './account-usage.js';
+
+const drivers = { claudeAgent: 'claude', codex: 'codex' };
+const candidates = (settings) => Object.entries(settings.providerInstances).filter(([, instance]) =>
+  instance.enabled && instance.driver === settings.providerInstances[settings.defaultModelSelection.instanceId]?.driver);
+
+export function decide(settings, usage, now) {
+  const from = settings.defaultModelSelection?.instanceId ?? null;
+  const result = { action: 'unchanged', reason: 'unmanaged', from, to: from, instances: [] };
+  const driver = settings.providerInstances?.[from]?.driver;
+  if (!Object.hasOwn(drivers, driver)) return result;
+  result.instances = candidates(settings).map(([instanceId]) => {
+    const account = usage.find((entry) => entry.instanceId === instanceId);
+    const window = driver === 'claudeAgent' ? account?.windows?.[1]
+      : account?.windows?.[1] ?? account?.windows?.[0];
+    const excluded = account?.utilization >= 95 || account?.limitReached
+      || (instanceId === from && (account?.unauthorized || account?.state === 'skipped'));
+    const known = account && ['fresh', 'cached'].includes(account.state)
+      && Number.isFinite(account.updatedAt) && now - account.updatedAt < 300000
+      && Number.isFinite(window?.used) && Number.isFinite(window?.seconds) && window.seconds > 0
+      && Number.isFinite(window?.resetAt) && window.resetAt > now;
+    return { instanceId, state: excluded ? 'excluded' : known ? 'eligible' : 'unknown',
+      pace: known ? 100 * (1 - (window.resetAt - now) / (window.seconds * 1000)) - window.used : null };
+  });
+  const current = result.instances.find((entry) => entry.instanceId === from);
+  const best = result.instances.filter((entry) => entry.state === 'eligible').sort((a, b) => b.pace - a.pace)[0];
+  const excluded = !current || current.state === 'excluded';
+  if (excluded && best) return { ...result, action: 'updated', reason: 'current-excluded', to: best.instanceId };
+  if (result.instances.some((entry) => entry.state === 'unknown')) return { ...result, reason: 'unknown' };
+  if (!best) return { ...result, reason: 'no-eligible' };
+  if (best.instanceId !== from && best.pace - current.pace >= 10) {
+    return { ...result, action: 'updated', reason: 'pace', to: best.instanceId };
+  }
+  return { ...result, reason: 'margin' };
+}
+
+// Locate only the root selection's instance string, leaving every other byte intact.
+function selectionBytes(original, instanceId) {
+  const tokens = [...original.matchAll(/"(?:\\.|[^"\\])*"|[{}\[\]:,]|[^\s{}\[\]:,]+/g)];
+  let depth = 0;
+  let selectionDepth = 0;
+  for (let i = 0; i < tokens.length; i++) {
+    const token = tokens[i][0];
+    if (depth === 1 && token.startsWith('"') && JSON.parse(token) === 'defaultModelSelection'
+      && tokens[i + 1]?.[0] === ':' && tokens[i + 2]?.[0] === '{') selectionDepth = depth + 1;
+    if (selectionDepth && depth === selectionDepth && token.startsWith('"') && JSON.parse(token) === 'instanceId'
+      && tokens[i + 1]?.[0] === ':') {
+      const value = tokens[i + 2];
+      return original.slice(0, value.index) + JSON.stringify(instanceId) + original.slice(value.index + value[0].length);
+    }
+    if (token === '{' || token === '[') depth++;
+    if (token === '}' || token === ']') { if (depth === selectionDepth) selectionDepth = 0; depth--; }
+  }
+  throw new Error('missing instance string');
+}
+
+function deepEqual(a, b) {
+  if (a === b) return true;
+  if (!a || !b || typeof a !== 'object' || typeof b !== 'object' || Array.isArray(a) !== Array.isArray(b)) return false;
+  const keys = Object.keys(a);
+  return keys.length === Object.keys(b).length && keys.every((key) => Object.hasOwn(b, key) && deepEqual(a[key], b[key]));
+}
+
+export function commit(path, originalBytes, nextBytes) {
+  const original = JSON.parse(originalBytes);
+  const next = JSON.parse(nextBytes);
+  const from = original.defaultModelSelection?.instanceId;
+  const to = next.defaultModelSelection?.instanceId;
+  if (typeof from !== 'string' || typeof to !== 'string') throw new Error('invalid instance string');
+  original.defaultModelSelection.instanceId = to;
+  if (!deepEqual(original, next)) throw new Error('refusing non-instanceId change');
+  if (from === to) return 'unchanged';
+  const lock = `${path}.axstack-default-sync.lock`;
+  try { fs.mkdirSync(lock, { mode: 0o700 }); }
+  catch (error) {
+    if (error.code !== 'EEXIST') throw error;
+    if (Date.now() - fs.lstatSync(lock).mtimeMs <= 60000) return 'locked';
+    fs.rmdirSync(lock);
+    try { fs.mkdirSync(lock, { mode: 0o700 }); }
+    catch (retryError) { if (retryError.code === 'EEXIST') return 'locked'; throw retryError; }
+  }
+  let temp;
+  let fd;
+  try {
+    const info = fs.lstatSync(path);
+    if (!info.isFile() || info.isSymbolicLink()) throw new Error('settings must be a regular file');
+    const sibling = `${path}.axstack-default-sync-${crypto.randomUUID()}.tmp`;
+    fd = fs.openSync(sibling, 'wx', info.mode & 0o7777);
+    temp = sibling;
+    fs.fchmodSync(fd, info.mode & 0o7777);
+    fs.writeFileSync(fd, nextBytes);
+    fs.fsyncSync(fd);
+    fs.closeSync(fd);
+    fd = undefined;
+    // This is the final operation before rename; the remaining sub-ms race is accepted.
+    if (!fs.readFileSync(path).equals(Buffer.from(originalBytes))) return 'concurrent-edit';
+    fs.renameSync(temp, path);
+    temp = undefined;
+    if (!fs.readFileSync(path).equals(Buffer.from(nextBytes))) throw new Error('read-back mismatch');
+    return 'updated';
+  } finally {
+    try { if (fd !== undefined) fs.closeSync(fd); }
+    finally {
+      try { if (temp) fs.unlinkSync(temp); }
+      finally { fs.rmdirSync(lock); }
+    }
+  }
+}
+
+async function main() {
+  if (process.env.AXSTACK_SYNC_DEFAULT === '0') {
+    console.log(JSON.stringify({ action: 'unchanged', reason: 'disabled', from: null, to: null, instances: [] }));
+    return;
+  }
+  let path = `${process.env.HOME}/.t3/userdata/settings.json`;
+  let dryRun = false;
+  const args = process.argv.slice(2);
+  const seen = new Set();
+  for (let i = 0; i < args.length; i++) {
+    if (seen.has(args[i])) throw new Error('duplicate flag');
+    seen.add(args[i]);
+    if (args[i] === '--dry-run') dryRun = true;
+    else if (args[i] === '--settings' && args[i + 1] && !args[i + 1].startsWith('--')) path = args[++i];
+    else throw new Error('expected [--settings path] [--dry-run]');
+  }
+  path = expandHome(path);
+  const original = fs.readFileSync(path, 'utf8');
+  const settings = JSON.parse(original);
+  if (!settings || typeof settings !== 'object' || Array.isArray(settings)
+    || (Object.hasOwn(settings, 'providerInstances') && (!settings.providerInstances
+      || typeof settings.providerInstances !== 'object' || Array.isArray(settings.providerInstances)))) throw new Error('invalid settings');
+  const driver = settings.providerInstances?.[settings.defaultModelSelection?.instanceId]?.driver;
+  const provider = Object.hasOwn(drivers, driver) ? drivers[driver] : null;
+  const usage = [];
+  if (provider) for (const [id, instance] of candidates(settings)) usage.push(await accountUsage(id, instance, provider));
+  let decision = decide(settings, usage, Date.now());
+  if (decision.action === 'updated' && !dryRun) {
+    const reason = commit(path, original, selectionBytes(original, decision.to));
+    if (reason !== 'updated') decision = { ...decision, action: 'unchanged', reason, to: decision.from };
+  }
+  console.log(JSON.stringify(decision));
+}
+
+if (import.meta.main) main().catch((error) => {
+  console.error(error.message === 'read-back mismatch' ? 'default sync failed: read-back mismatch'
+    : 'default sync failed: invalid input/settings or failed write');
+  process.exitCode = 1;
+});

package/skills/axstack/systemd/axstack-default-sync.service

@@ -0,0 +1,8 @@
+[Unit]
+Description=Keep the T3 New-chat default on the most abundant account
+
+[Service]
+Type=oneshot
+Environment=PATH=%h/.bun/bin:/usr/local/bin:/usr/bin:/bin
+UMask=0077
+ExecStart=/usr/bin/env bun %h/.agents/skills/axstack/scripts/sync-default.js

package/skills/axstack/systemd/axstack-default-sync.timer

@@ -0,0 +1,11 @@
+[Unit]
+Description=Refresh the T3 New-chat account default every ten minutes
+
+[Timer]
+OnStartupSec=1min
+OnUnitActiveSec=10min
+Persistent=true
+Unit=axstack-default-sync.service
+
+[Install]
+WantedBy=timers.target