axstack 0.28.0 → 0.30.0

package/README.md

@@ -126,7 +126,7 @@ Eligible own PRs use guarded automatic merge; see [merge boundaries, exclusions,
 
 - T3 Code is the only supported active runtime. Axstack adds no daemon or runtime
   database. The exception is one opt-in systemd user timer `axstack-default-sync`,
-  running a stateless script that rewrites only T3 `defaultModelSelection.instanceId`.
+  running a stateless script that rewrites only T3 `defaultModelSelection`.
   It has no workflow state and launches no agent; see
   [Host operations](docs/host-operations.md#new-chat-default-sync).
 - The recorded owning watch thread merges eligible own PRs; excluded PRs use a merge card.

package/docs/concepts.md

@@ -103,7 +103,7 @@ and effort remain fixed. Dispatched roles never fail over mid-thread.
 See [Provider bindings](../skills/axstack/references/t3-runtime.md#preflight-and-binding)
 for schedule rebinding and the [policy carve-out](workflows.md#automatic-merge-boundaries).
 
-The opt-in `sync-default.js` keeps the New-chat default on the same-provider account with the highest elapsed-minus-used pace, switching at a ten-point lead or when the current account is excluded; it preserves the model and project overrides.
+The opt-in `sync-default.js` rotates the New-chat default by elapsed-minus-used pace at a ten-point lead or current exclusion. `AXSTACK_SYNC_POOL` enables cross-driver weekly comparison and model/effort selection; without it, only the same-driver account changes.
 
 ## Account selection environment
 

package/docs/host-operations.md

@@ -46,7 +46,7 @@ executor MCP, and live schedule behavior need separate preflights.
 Installation creates no production schedule and never enables a timer.
 Axstack allows one opt-in systemd user timer `axstack-default-sync` as the
 scheduler exception: it runs a stateless script that rewrites only T3
-`defaultModelSelection.instanceId`, has no workflow state and launches no agent.
+`defaultModelSelection`, has no workflow state and launches no agent.
 Every verified own-PR publication arms or joins the driver's chat-run watch.
 Its bound T3 schedule uses the cadence in [Chat-run watch activation](#chat-run-watch-activation).
 See [Chat-run PR watch](workflows.md#chat-run-pr-watch) for authority, schedule identity and stop conditions.
@@ -178,30 +178,34 @@ canary described by the operational contract.
 
 ## New-chat default sync
 
-This opt-in stateless script rewrites only `defaultModelSelection.instanceId`
-in `~/.t3/userdata/settings.json`. It compares enabled accounts of the current
-Claude/Codex driver, without plan weights; it keeps the model, project overrides
-and every other settings byte. It never creates a missing default or refreshes
-OAuth tokens. Unknown usage or a missing reset clock holds the default, unless
-an excluded/unauthorized current account can escape to a known eligible sibling.
-The shared usage cache expires after five minutes; sync refuses stale usage for
-comparison. Any session/weekly window at 95% or a reached limit is excluded.
-
-Preview the decision and save the current instance ID for rollback:
+This opt-in script changes only root `defaultModelSelection` in
+`~/.t3/userdata/settings.json`. Without a pool it changes only the instance
+among enabled accounts of the current Claude/Codex driver.
+`AXSTACK_SYNC_POOL` compares drivers by weekly clocks (>=604800s), without
+plan weights. Rotation needs a ten-point elapsed-minus-used pace lead;
+excluded/unauthorized/skipped current accounts can escape to known candidates.
+Any window at 95% or a reached limit excludes. Non-current absent credentials
+exclude; malformed/unreadable credentials and unknown/stale usage hold.
+Cache expires after five minutes. Missing defaults stay untouched; OAuth tokens
+are never refreshed. Each host's pool uses only enabled, credentialed drivers:
 
 ```sh
-bun ~/.agents/skills/axstack/scripts/sync-default.js --dry-run
+AXSTACK_SYNC_POOL=claudeAgent=claude-opus-5-5,codex=gpt-6.1-sol:xhigh \
+  bun ~/.agents/skills/axstack/scripts/sync-default.js --dry-run
 ```
 
-Exit 0 prints one token-free JSON decision line; dry-run reports the proposed
-change without writing. `--settings <path>` selects a fixture or alternate file.
-`AXSTACK_SYNC_DEFAULT=0` is a no-op. Exit 1 reports malformed settings or a failed
-write. A sibling temp file preserves the settings mode and is fsynced before
-rename. The script checks original bytes immediately before rename and verifies
-bytes afterward. The accepted sub-ms race with an in-app T3 write can still lose
-that edit; a read-back mismatch is logged as an error rather than overwritten.
+Exit 0 prints one token-free JSON decision with proposed selection; dry-run
+never writes. `--settings <path>` selects another file. Pool entries are
+`driver=model[:effort]`: Claude `effort` or Codex `reasoningEffort` options;
+omitted effort omits options. Rotation writes the full pool selection,
+overwriting manual model/effort picks only then. Pin with `AXSTACK_SYNC_DEFAULT=0`
+or a default driver outside the pool. Exit 1 means invalid pool/settings or write
+failure. Save the full selection for rollback. Other bytes stay intact.
+A fsynced sibling preserves mode; original bytes are checked before rename and
+read back afterward. The accepted sub-ms T3 write race can lose an edit;
+read-back mismatch is an error.
 
-After recording host-mutation authority, copy the shipped units and enable:
+Under host-mutation authority, install and enable:
 
 ```sh
 mkdir -p ~/.config/systemd/user
@@ -213,18 +217,21 @@ systemctl --user list-timers axstack-default-sync.timer
 journalctl --user -u axstack-default-sync.service
 ```
 
-The first tick is about one minute after user-manager startup, then every ten
-minutes. `Persistent=true` is shipped; this monotonic timer does not replay
-missed calendar ticks. For a different skills root or Bun path, override
-`ExecStart`/`Environment` with `systemctl --user edit axstack-default-sync.service`.
-Operation after logout requires an authorized user-manager/linger setup.
-Installation never activates these units.
+The timer starts about one minute after user-manager startup, then every ten
+minutes. Its monotonic `Persistent=true` timer never replays calendar ticks.
+Override Bun/skills paths via `ExecStart`/`Environment` in
+`systemctl --user edit axstack-default-sync.service`. Add the per-host pool:
+
+```ini
+[Service]
+Environment=AXSTACK_SYNC_POOL=claudeAgent=claude-opus-5-5,codex=gpt-6.1-sol:xhigh
+```
+
+Reload after edits. Logout needs authorized linger; installation never activates units.
 
 Disable with `systemctl --user disable --now axstack-default-sync.timer` and
 stop any active one-shot with `systemctl --user stop axstack-default-sync.service`.
-For rollback, then restore the saved default instance through T3 Settings.
-The exclusive sibling directory lock `<settings>.axstack-default-sync.lock`
-prevents overlapping commits; fresh-lock contention prints unchanged/locked.
-A lock older than sixty seconds is treated as stale: the script removes that
-exact empty directory and retries acquisition once, recovering on a later tick
-from a killed writer. If the retry finds a fresh lock, it still prints locked.
+Rollback: remove the pool drop-in, reload, and restore the full selection in T3 Settings.
+The sibling `<settings>.axstack-default-sync.lock` directory prevents overlap
+(unchanged/locked). Empty locks older than sixty seconds are removed and retried
+once; fresh contention reports locked.

package/docs/installation.md

@@ -93,7 +93,7 @@ for the picker cache directory and test-only usage endpoint variables.
 Run these with Bun from the installed `<skills-dir>/axstack/scripts/` directory:
 `resolve-models.js` (model IDs), `pick-instance.js` (dispatch account),
 `pr-digest.js` (PR discovery), `archive-evidence.js` (evidence archive), and
-`sync-default.js [--settings <path>] [--dry-run]` (New-chat account default).
+`sync-default.js [--settings <path>] [--dry-run]` (New-chat default; `AXSTACK_SYNC_POOL` opts into cross-driver rotation).
 `account-usage.js` shares usage retrieval and the five-minute cache between
 picker and sync. The opt-in systemd user unit files ship in `axstack/systemd/`;
 installation copies them as assets and never enables the timer.
@@ -299,7 +299,11 @@ the user explicitly changes it and accepts the resulting evidence invalidation.
 
 The `mixed` and `claude-only` presets assign `axstack-auditor`,
 `axstack-research-requirements`, `axstack-research-code`, `axstack-research-web`,
-`axstack-explore-execution`, and `axstack-monitor` to the Claude Sonnet class at high effort.
+`axstack-explore-execution` to the Claude Sonnet class at high effort.
+`axstack-explore-codebase` and `axstack-monitor` adopt Haiku 5.5 high with
+`modelClass: haiku` and the exact `model: claude-haiku-5-5` pin.
+Activation requires that exact ID and high effort in saved T3 capabilities;
+missing either holds these roles without substitution, including Haiku 4.5.
 The `codex-only` assignments for these roles are unchanged.
 The three `-sol` pair seats for auditor, research-code, and explore-execution
 use Sol high in `mixed` and `codex-only`; `claude-only` records intentional

package/docs/workflows.md

@@ -124,8 +124,11 @@ role.
 | `claude-only` | Opus medium | Opus medium; Sonnet high | unavailable / Opus xhigh | Sonnet high (Sol absent) |
 
 In `mixed` and `claude-only`, `axstack-auditor`, `axstack-research-requirements`,
-`axstack-research-code`, `axstack-research-web`, `axstack-explore-execution`,
-and `axstack-monitor` use the Claude Sonnet class at high effort. `codex-only` keeps its Codex
+`axstack-research-code`, `axstack-research-web`, and `axstack-explore-execution`
+use the Claude Sonnet class at high effort. `axstack-explore-codebase` and
+`axstack-monitor` adopt Haiku 5.5 high, with class `haiku` and exact pin
+`claude-haiku-5-5`. Missing that ID or high effort in saved T3 capabilities
+holds those roles without substitution. `codex-only` keeps its Codex
 assignments for those roles. Mixed web-google and X retain their source-specific
 Antigravity and Grok routes.
 The new `-sol` auditor, research-code, and explore-execution seats use Sol high

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "axstack",
-  "version": "0.28.0",
+  "version": "0.30.0",
   "description": "Axstack installer and setup CLI: installs owned chat skills and role data, configures supported harness settings, and checks T3 Code capabilities.",
   "keywords": [
     "claude-code",

package/profiles/presets/claude-only.json

@@ -169,8 +169,9 @@
       "provider": "claude",
       "modeId": "bypassPermissions",
       "thinkingOptionId": "high",
-      "notes": "Codebase mapper: explores repository structure and interfaces for research and handoff context. T3 resolves Claude classes from saved capabilities; a Claude rejection holds.",
-      "modelClass": "sonnet"
+      "notes": "Haiku 5.5 high codebase mapper: explores repository structure and interfaces for research and handoff context. T3 uses the exact claude-haiku-5-5 pin from saved capabilities; a Claude rejection holds. Missing model or high effort holds without substitution.",
+      "modelClass": "haiku",
+      "model": "claude-haiku-5-5"
     },
     {
       "id": "axstack-explore-execution",
@@ -196,8 +197,9 @@
       "provider": "claude",
       "modeId": "bypassPermissions",
       "thinkingOptionId": "high",
-      "notes": "Optional Sonnet high independent read-only observer for a standalone PR watch. Reads GitHub, feedback, and checks, persists event IDs, and wakes the owner only for a new actionable event. Never sends, authors, reviews, replies, or acts as either reusable PR manager. Healthy snapshots stay quiet. Chat-run mode: one same-host native read-only observer per Run; fresh finite passes report precise deltas internally to the original Run/driver and may disable/read back only their own automation at verified stop. No repair, dispatch, public notification, or replacement coordinator. Effective scheduled model/effort and wake require live proof. T3 resolves Claude classes from saved capabilities; a Claude rejection holds.",
-      "modelClass": "sonnet"
+      "notes": "Optional independent read-only Haiku 5.5 high observer for a standalone PR watch. Reads GitHub, feedback, and checks, persists event IDs, and wakes the owner only for a new actionable event. Never sends, authors, reviews, replies, or acts as either reusable PR manager. Healthy snapshots stay quiet. Chat-run mode: one same-host native read-only observer per Run; fresh finite passes report precise deltas internally to the original Run/driver and may disable/read back only their own automation at verified stop. No repair, dispatch, public notification, or replacement coordinator. Effective scheduled model/effort and wake require live proof. T3 uses the exact claude-haiku-5-5 pin from saved capabilities; a Claude rejection holds. Missing model or high effort holds without substitution.",
+      "modelClass": "haiku",
+      "model": "claude-haiku-5-5"
     },
     {
       "id": "axstack-auditor",

package/profiles/presets/mixed.json

@@ -169,8 +169,9 @@
       "provider": "claude",
       "modeId": "bypassPermissions",
       "thinkingOptionId": "high",
-      "notes": "Codebase mapper: explores repository structure and interfaces for research and handoff context. T3 resolves Claude classes from saved capabilities; a Claude rejection holds.",
-      "modelClass": "sonnet"
+      "notes": "Haiku 5.5 high codebase mapper: explores repository structure and interfaces for research and handoff context. T3 uses the exact claude-haiku-5-5 pin from saved capabilities; a Claude rejection holds. Missing model or high effort holds without substitution.",
+      "modelClass": "haiku",
+      "model": "claude-haiku-5-5"
     },
     {
       "id": "axstack-explore-execution",
@@ -196,8 +197,9 @@
       "provider": "claude",
       "modeId": "bypassPermissions",
       "thinkingOptionId": "high",
-      "notes": "Optional Sonnet high independent read-only observer for a standalone PR watch. Reads GitHub, feedback, and checks, persists event IDs, and wakes the owner only for a new actionable event. Never sends, authors, reviews, replies, or acts as either reusable PR manager. Healthy snapshots stay quiet. Chat-run mode: one same-host native read-only observer per Run; fresh finite passes report precise deltas internally to the original Run/driver and may disable/read back only their own automation at verified stop. No repair, dispatch, public notification, or replacement coordinator. Effective scheduled model/effort and wake require live proof. T3 resolves Claude classes from saved capabilities; a Claude rejection holds.",
-      "modelClass": "sonnet"
+      "notes": "Optional independent read-only Haiku 5.5 high observer for a standalone PR watch. Reads GitHub, feedback, and checks, persists event IDs, and wakes the owner only for a new actionable event. Never sends, authors, reviews, replies, or acts as either reusable PR manager. Healthy snapshots stay quiet. Chat-run mode: one same-host native read-only observer per Run; fresh finite passes report precise deltas internally to the original Run/driver and may disable/read back only their own automation at verified stop. No repair, dispatch, public notification, or replacement coordinator. Effective scheduled model/effort and wake require live proof. T3 uses the exact claude-haiku-5-5 pin from saved capabilities; a Claude rejection holds. Missing model or high effort holds without substitution.",
+      "modelClass": "haiku",
+      "model": "claude-haiku-5-5"
     },
     {
       "id": "axstack-auditor",

package/skills/axstack/references/contracts.md

@@ -48,6 +48,8 @@ Never infer any other route from quota state or subscription entitlement. Every
 substitution requires the user's decision: configured alternatives are not
 defaults. Rejection, timeout, quota and auth failures hold affected work.
 Substitution here means changing provider or model, excluding that account selection.
+Exception: opt-in default sync can change only the New-chat default within the user-configured pool.
+Running threads, dispatched roles, schedules and roles.json keep existing rules.
 Read the [T3 runtime boundary](t3-runtime.md) before dispatch, receipt consumption
 or recovery; resolve models from the saved capabilities snapshot and verify
 requested and effective settings separately.

package/skills/axstack/references/role-roster.md

@@ -30,8 +30,11 @@
   for every interactive page, bound to the exact bytes and SHA-256.
 - `axstack-auditor`/`axstack-research-requirements`/
   `axstack-research-code`/`axstack-research-web`/
-  `axstack-explore-execution`/`axstack-monitor`:
+  `axstack-explore-execution`:
   `claude/sonnet` high in mixed/claude-only.
+- `axstack-explore-codebase`/`axstack-monitor`: `claude/haiku` high in
+  mixed/claude-only, pinned to `claude-haiku-5-5`. Missing that exact model
+  or high effort holds these roles without substitution.
   `axstack-monitor`: standalone watch never sends; chat-run watch: bounded
   internal reports to its Run and original driver.
 - Sol pairs `axstack-auditor-sol`/`axstack-research-code-sol`/

package/skills/axstack/scripts/account-usage.js

@@ -33,8 +33,9 @@ export async function accountUsage(instanceId, instance, provider) {
     const valid = provider === 'claude' ? credentials.claudeAiOauth?.accessToken
       : credentials.tokens?.access_token && credentials.tokens?.account_id;
     if (!valid) throw new Error();
-  } catch {
-    return { instanceId, state: 'skipped', reason: 'missing credentials' };
+  } catch (error) {
+    return { instanceId, state: 'skipped', reason: 'missing credentials',
+      credentialsAbsent: error.code === 'ENOENT' };
   }
   const headers = provider === 'claude'
     ? { authorization: `Bearer ${credentials.claudeAiOauth.accessToken}`,

package/skills/axstack/scripts/sync-default.js

@@ -2,55 +2,86 @@ import * as fs from 'node:fs';
 import { accountUsage, expandHome } from './account-usage.js';
 
 const drivers = { claudeAgent: 'claude', codex: 'codex' };
-const candidates = (settings) => Object.entries(settings.providerInstances).filter(([, instance]) =>
-  instance.enabled && instance.driver === settings.providerInstances[settings.defaultModelSelection.instanceId]?.driver);
+function parsePool(value) {
+  if (!value) return null;
+  const pool = {};
+  for (const entry of value.split(',')) {
+    const match = /^(claudeAgent|codex)=([^:,=\s]+)(?::([a-z]+))?$/.exec(entry);
+    if (!match || Object.hasOwn(pool, match[1])) throw new Error('invalid pool');
+    const [, driver, model, effort] = match;
+    pool[driver] = { model, ...(effort && { options: [
+      { id: driver === 'codex' ? 'reasoningEffort' : 'effort', value: effort },
+    ] }) };
+  }
+  return pool;
+}
+const candidates = (settings, pool) => Object.entries(settings.providerInstances ?? {}).filter(([, instance]) =>
+  instance.enabled && Object.hasOwn(pool, instance.driver));
 
-export function decide(settings, usage, now) {
+export function decide(settings, usage, now, pool = null) {
   const from = settings.defaultModelSelection?.instanceId ?? null;
   const result = { action: 'unchanged', reason: 'unmanaged', from, to: from, instances: [] };
   const driver = settings.providerInstances?.[from]?.driver;
-  if (!Object.hasOwn(drivers, driver)) return result;
-  result.instances = candidates(settings).map(([instanceId]) => {
+  const pooled = pool !== null;
+  pool ??= { [driver]: null };
+  if (!Object.hasOwn(drivers, driver) || !Object.hasOwn(pool, driver)) return result;
+  const updated = (best, reason) => ({ ...result, action: 'updated', reason, to: best.instanceId,
+    selection: pooled ? { instanceId: best.instanceId, ...pool[settings.providerInstances[best.instanceId].driver] }
+      : { ...settings.defaultModelSelection, instanceId: best.instanceId } });
+  result.instances = candidates(settings, pool).map(([instanceId, instance]) => {
     const account = usage.find((entry) => entry.instanceId === instanceId);
-    const window = driver === 'claudeAgent' ? account?.windows?.[1]
+    const window = instance.driver === 'claudeAgent' ? account?.windows?.[1]
       : account?.windows?.[1] ?? account?.windows?.[0];
-    const excluded = account?.utilization >= 95 || account?.limitReached
+    const excluded = account?.utilization >= 95 || account?.limitReached || account?.credentialsAbsent
       || (instanceId === from && (account?.unauthorized || account?.state === 'skipped'));
     const known = account && ['fresh', 'cached'].includes(account.state)
       && Number.isFinite(account.updatedAt) && now - account.updatedAt < 300000
       && Number.isFinite(window?.used) && Number.isFinite(window?.seconds) && window.seconds > 0
-      && Number.isFinite(window?.resetAt) && window.resetAt > now;
+      && Number.isFinite(window?.resetAt) && window.resetAt > now
+      && (!pooled || window.seconds >= 604800);
     return { instanceId, state: excluded ? 'excluded' : known ? 'eligible' : 'unknown',
       pace: known ? 100 * (1 - (window.resetAt - now) / (window.seconds * 1000)) - window.used : null };
   });
   const current = result.instances.find((entry) => entry.instanceId === from);
   const best = result.instances.filter((entry) => entry.state === 'eligible').sort((a, b) => b.pace - a.pace)[0];
   const excluded = !current || current.state === 'excluded';
-  if (excluded && best) return { ...result, action: 'updated', reason: 'current-excluded', to: best.instanceId };
+  if (excluded && best) return updated(best, 'current-excluded');
   if (result.instances.some((entry) => entry.state === 'unknown')) return { ...result, reason: 'unknown' };
   if (!best) return { ...result, reason: 'no-eligible' };
   if (best.instanceId !== from && best.pace - current.pace >= 10) {
-    return { ...result, action: 'updated', reason: 'pace', to: best.instanceId };
+    return updated(best, 'pace');
   }
   return { ...result, reason: 'margin' };
 }
 
-// Locate only the root selection's instance string, leaving every other byte intact.
-function selectionBytes(original, instanceId) {
+// Preserve the instance-only edit when the rest of the selection is already identical.
+function selectionBytes(original, selection) {
+  const previous = JSON.parse(original).defaultModelSelection;
+  const instanceOnly = deepEqual({ ...previous, instanceId: selection.instanceId }, selection);
+  let start;
   const tokens = [...original.matchAll(/"(?:\\.|[^"\\])*"|[{}\[\]:,]|[^\s{}\[\]:,]+/g)];
   let depth = 0;
   let selectionDepth = 0;
   for (let i = 0; i < tokens.length; i++) {
     const token = tokens[i][0];
     if (depth === 1 && token.startsWith('"') && JSON.parse(token) === 'defaultModelSelection'
-      && tokens[i + 1]?.[0] === ':' && tokens[i + 2]?.[0] === '{') selectionDepth = depth + 1;
-    if (selectionDepth && depth === selectionDepth && token.startsWith('"') && JSON.parse(token) === 'instanceId'
+      && tokens[i + 1]?.[0] === ':' && tokens[i + 2]?.[0] === '{') {
+      selectionDepth = depth + 1;
+      start = tokens[i + 2].index;
+    }
+    if (instanceOnly && selectionDepth && depth === selectionDepth && token.startsWith('"') && JSON.parse(token) === 'instanceId'
       && tokens[i + 1]?.[0] === ':') {
       const value = tokens[i + 2];
-      return original.slice(0, value.index) + JSON.stringify(instanceId) + original.slice(value.index + value[0].length);
+      return original.slice(0, value.index) + JSON.stringify(selection.instanceId) + original.slice(value.index + value[0].length);
     }
     if (token === '{' || token === '[') depth++;
-    if (token === '}' || token === ']') { if (depth === selectionDepth) selectionDepth = 0; depth--; }
+    if (token === '}' || token === ']') {
+      if (depth === selectionDepth) {
+        if (!instanceOnly) return original.slice(0, start) + JSON.stringify(selection) + original.slice(tokens[i].index + 1);
+        selectionDepth = 0;
+      }
+      depth--;
+    }
   }
   throw new Error('missing instance string');
 }
@@ -62,15 +93,18 @@ function deepEqual(a, b) {
   return keys.length === Object.keys(b).length && keys.every((key) => Object.hasOwn(b, key) && deepEqual(a[key], b[key]));
 }
 
-export function commit(path, originalBytes, nextBytes) {
+export function commit(path, originalBytes, nextBytes, selection) {
   const original = JSON.parse(originalBytes);
   const next = JSON.parse(nextBytes);
   const from = original.defaultModelSelection?.instanceId;
   const to = next.defaultModelSelection?.instanceId;
   if (typeof from !== 'string' || typeof to !== 'string') throw new Error('invalid instance string');
-  original.defaultModelSelection.instanceId = to;
-  if (!deepEqual(original, next)) throw new Error('refusing non-instanceId change');
-  if (from === to) return 'unchanged';
+  selection ??= { ...original.defaultModelSelection, instanceId: to };
+  if (!deepEqual(next.defaultModelSelection, selection)) throw new Error('refusing undecided selection');
+  const unchanged = deepEqual(original.defaultModelSelection, selection);
+  original.defaultModelSelection = selection;
+  if (!deepEqual(original, next)) throw new Error('refusing change outside defaultModelSelection');
+  if (unchanged) return 'unchanged';
   const lock = `${path}.axstack-default-sync.lock`;
   try { fs.mkdirSync(lock, { mode: 0o700 }); }
   catch (error) {
@@ -131,12 +165,16 @@ async function main() {
     || (Object.hasOwn(settings, 'providerInstances') && (!settings.providerInstances
       || typeof settings.providerInstances !== 'object' || Array.isArray(settings.providerInstances)))) throw new Error('invalid settings');
   const driver = settings.providerInstances?.[settings.defaultModelSelection?.instanceId]?.driver;
-  const provider = Object.hasOwn(drivers, driver) ? drivers[driver] : null;
+  const pool = parsePool(process.env.AXSTACK_SYNC_POOL);
   const usage = [];
-  if (provider) for (const [id, instance] of candidates(settings)) usage.push(await accountUsage(id, instance, provider));
-  let decision = decide(settings, usage, Date.now());
+  if (Object.hasOwn(drivers, driver) && (!pool || Object.hasOwn(pool, driver))) {
+    for (const [id, instance] of candidates(settings, pool ?? { [driver]: null })) {
+      usage.push(await accountUsage(id, instance, drivers[instance.driver]));
+    }
+  }
+  let decision = decide(settings, usage, Date.now(), pool);
   if (decision.action === 'updated' && !dryRun) {
-    const reason = commit(path, original, selectionBytes(original, decision.to));
+    const reason = commit(path, original, selectionBytes(original, decision.selection), decision.selection);
     if (reason !== 'updated') decision = { ...decision, action: 'unchanged', reason, to: decision.from };
   }
   console.log(JSON.stringify(decision));