@renzrollon/interlock 1.1.1 → 1.2.1

package/lib/limits.mjs

@@ -149,7 +149,43 @@ export const LIMITS = {
    * silent head would make it lie, so the truncation is always stated. Read by
    * `lib/resume-card.mjs`.
    */
-  resumeCardListRows: 40
+  resumeCardListRows: 40,
+
+  /**
+   * Milliseconds a session's launch ledger stays readable (guard-ship-relaunch
+   * design D5). A ledger whose newest launch is older than this reads as absent,
+   * and every ledger write sweeps sibling files past it, so the directory does
+   * not grow one file per session forever and no stale session can deny a live
+   * one. 24 hours is longer than any run `maxRunSteps` and the drivers' runaway
+   * backstop allow, so a live session's launch is never aged out while its run
+   * could still be in flight; it is shorter than the host's transcript
+   * retention, so the directory never outlives the sessions it names. Ageing out
+   * only ever turns a deny into an allow. Read by `lib/launch-ledger.mjs`.
+   */
+  launchLedgerMaxAgeMs: 24 * 60 * 60 * 1000,
+
+  /**
+   * Milliseconds a live ship run may go with no activity the engine reports
+   * (a step, a run agent's request or answer, a turn end, a spawn) before the
+   * ship meter appends `quiet <n> min` to its status line, spinner and pane
+   * (show-quiet-time-and-reset-the-meter-on-clear design D3). Longer than one
+   * model request at the deepest effort ordinarily takes to answer, so a lane
+   * that is thinking is not called quiet on the strength of one slow request;
+   * short enough that a person who looks during a run learns within one wave's
+   * time that nothing has moved. A display threshold with no verdict behind it:
+   * a wrong value costs an early or a late word, never a halt. Read by
+   * `lib/meter-quiet.mjs`, which the hooks module imports.
+   */
+  meterQuietAfterMs: 5 * 60 * 1000,
+
+  /**
+   * Milliseconds between the ship meter's recomputations of the quiet figure: the
+   * period of the one interval the hooks module asks the host for while a run is
+   * live (design D2, D3). The word is in whole minutes, so this keeps the shown
+   * minute at most this stale, at a few hundred dispatches an hour, which is
+   * nothing beside the run's own traffic. Read by `lib/meter-quiet.mjs`.
+   */
+  meterTickMs: 15 * 1000
 }
 
 /**
@@ -205,6 +241,25 @@ export const EVAL_CAPS = {
    */
   shipEvalCostUsd: 20,
 
+  /**
+   * US dollars. Ceiling for one invocation of the **cost-per-task sweep**
+   * (`evals/ship/matrix.mjs`): the committed fixtures crossed with model and
+   * effort, each cell run by the control-arm procedure. A different run from the
+   * outcome eval, with its own ceiling, so neither can spend the other's budget.
+   *
+   * Its reader is the sweep, which reads it from `interlock limits --json` before
+   * starting each cell. It is run by hand and gates nothing: no workflow reads
+   * it, and no pull request starts the sweep. The number appears nowhere else.
+   *
+   * Enforced between cells only — a cell in flight is never killed, an unpriced
+   * cell adds nothing to the total, and a sweep that reaches it is partial.
+   *
+   * A first guess in the posture of `shipEvalCostUsd`: twice that ceiling, for a
+   * grid of control-arm cells rather than a handful of full loops, to be tuned
+   * from the dollars the first rows report.
+   */
+  matrixCostUsd: 40,
+
   /**
    * Agent runs per case. Passed as `--runs` by the scheduled full-suite job,
    * which overrides each case's own value: those were chosen for the fast
@@ -285,41 +340,47 @@ export const EVAL_CAPS = {
  * `formatLimits()` below.
  */
 export const MODEL_PRICES = {
-  // A NEW id, not an edit under `anthropic-list-2026-09`. The base rates below
-  // are unchanged, but the table now answers a question the old one could not —
-  // what a cached prefix costs — and a row keyed to the old id was priced by a
-  // table with no cache structure at all. The `b` suffix rather than a new month
-  // because this is a revision of the same published list, not a later one.
-  id: 'anthropic-list-2026-09b',
+  // A NEW id, not an edit under `anthropic-list-2026-09b`. These are the rates
+  // confirmed against the published list in October 2026 — a later list, not a
+  // revision of the September one — so rows recorded under either September id
+  // keep the id, and the meaning, they were written with. The 5.5 models replace
+  // `claude-opus-5` and `claude-sonnet-5` rather than sitting beside them: a row
+  // naming an old model is unpriced under this id, never priced at a guessed rate.
+  id: 'anthropic-list-2026-10',
   perMillionTokens: {
-    'claude-opus-5': { input: 15, output: 75 },
-    'claude-sonnet-5': { input: 3, output: 15 },
+    'claude-opus-5-5': { input: 4, output: 20 },
+    'claude-sonnet-5-5': { input: 2, output: 10 },
     'claude-haiku-4-5': { input: 1, output: 5 }
   },
   /**
-   * What a cached prefix costs, as multipliers on the model's own `input` rate
-   * — the same shape for every model, which is why they are multipliers rather
-   * than a fourth and fifth column per model.
+   * What a cached prefix costs, as multipliers on the model's own `input` rate.
    *
-   * `write` is keyed by LIFETIME TIER and is never flattened: a prefix written
-   * for five minutes and one written for an hour are different prices, and a
-   * total that added them could not be priced back apart. The keys are the tier
-   * names the host's usage envelope reports them under, so a recorded figure
-   * and its multiplier are looked up by the same string.
+   * `read` is keyed by MODEL, by the same ids as `perMillionTokens`, because the
+   * published read multiplier is not one figure: Opus 5.5 reads at 0.05x while
+   * Sonnet 5.5 and Haiku 4.5 read at 0.1x. A model in `perMillionTokens` with no
+   * entry here is unpriced — the pricer never falls back to some other model's
+   * read multiplier.
    *
-   * A read is a tenth of base, which is the whole economic argument: a prefix
-   * that survives to be read costs 10% of what re-sending it costs, and a write
-   * that is never read cost 25% (or 100%) more than not caching at all.
+   * `write` is keyed by LIFETIME TIER, shared across every model the table
+   * prices, and is never flattened: a prefix written for five minutes and one
+   * written for an hour are different prices, and a total that added them could
+   * not be priced back apart. The keys are the tier names the host's usage
+   * envelope reports them under, so a recorded figure and its multiplier are
+   * looked up by the same string.
    *
-   * NO READER IN THIS CHANGE, deliberately (design D9): the figures are recorded
-   * so a dollar number becomes computable, and whether to compute and present one
-   * is a later decision. They live in the table rather than beside it so the two
-   * cannot drift — a run priced against one id and multiplied by a differently
-   * versioned constant is attributable to nothing.
+   * Read by `priceUsage` in `evals/ship/arms.mjs`, by these names
+   * (`cacheMultipliers.read[model]`, `cacheMultipliers.write[tier]`). They live
+   * in the table rather than beside it so the two cannot drift — a run priced
+   * against one id and multiplied by a differently versioned constant is
+   * attributable to nothing.
    */
   cacheMultipliers: {
-    write: { ephemeral_5m: 1.25, ephemeral_1h: 2 },
-    read: 0.1
+    read: {
+      'claude-opus-5-5': 0.05,
+      'claude-sonnet-5-5': 0.1,
+      'claude-haiku-4-5': 0.1
+    },
+    write: { ephemeral_5m: 1.25, ephemeral_1h: 2 }
   }
 }
 
@@ -337,9 +398,10 @@ export const MODEL_PRICES = {
  * `byTier` maps a lane's hardest tier to a workflow-runtime effort. `null` means
  * "inherit the session default — do not force": tiers 3–4 inherit by policy so
  * the run keeps whatever the session/model default is (xhigh for coding since
- * w16); an untiered lane inherits by fallback. `verify` and `skeptic` pin the
- * inter-wave verify and the review skeptics regardless of any lane tier — the
- * two steps whose whole job is catching what an implementer missed.
+ * w16); an untiered lane inherits by fallback. `verify` pins both verify
+ * checks — the inter-wave one and the final one, which one spawn site emits —
+ * and `skeptic` pins the review skeptics, regardless of any lane tier: the two
+ * steps whose whole job is catching what an implementer missed.
  */
 export const EFFORT = {
   byTier: { 1: 'low', 2: 'low', 3: null, 4: null, 5: 'xhigh' },
@@ -360,8 +422,13 @@ export const EFFORT = {
  * lane (tier 0) uses the tier-1 entry. Tier 4 keeps the old scalar's 4 —
  * cross-file pattern-following is where a fresh context per task still pays.
  * Tier 5 stays at 8. Chain lanes are bounded by this same table: the cap is the
- * entry for the chain's hardest tier, packed next-fit. The values were not
- * retuned when lanes of two or more tasks began dispatching on opus.
+ * entry for the chain's hardest tier, packed next-fit.
+ *
+ * `opusMinTier` is the floor at which a multi-task lane (collision, cohesion or
+ * chain) dispatches on opus. Below it the lane runs on sonnet. Single-task lanes
+ * and solo promotions are not gated by this floor — see `laneModel`. The value
+ * sits next to the cohesion ceiling because both answer "how hard must the work
+ * be before this dial moves."
  *
  * `cohesionMaxTier` is the ceiling for COHESION: path-disjoint components in one
  * dependency layer whose hardest tier is at or below it may be packed into one
@@ -379,7 +446,9 @@ export const EFFORT = {
  */
 export const LANE_CAPS = {
   byTier: { 1: 8, 2: 8, 3: 6, 4: 4, 5: 8 },
-  cohesionMaxTier: 3
+  cohesionMaxTier: 3,
+  /** Hardest-task tier at or above which a multi-task lane dispatches on opus. */
+  opusMinTier: 4
 }
 
 /**
@@ -438,8 +507,18 @@ export function clampParallel(requested) {
   return { value: requested, clamped: false, reason: null }
 }
 
-/** Human-readable dump, so a skill can show the caps without hardcoding them. */
-export function formatLimits() {
+/**
+ * Human-readable dump, so a skill can show the caps without hardcoding them.
+ *
+ * `runtimeObserved` is the concurrency this machine's runtime will honour as far
+ * as the caller could observe it (`runtimeSlotsOf` in `lib/host/claude-env.mjs`):
+ * an override from the environment, or the vendor default beside the CPU count
+ * that may reduce it. Printed beside the vendor fact, never in place of it, and
+ * read by the caller — this module still reads no environment.
+ *
+ * @param {{runtimeObserved?: {observed: number|null, source: string, cpuCount: number|null, invalid?: string}}} [opts]
+ */
+export function formatLimits({ runtimeObserved } = {}) {
   const rows = [
     ['max parallel agents per batch', LIMITS.maxParallel],
     ['inter-wave fix attempts (per wave)', LIMITS.interWaveFixAttempts],
@@ -455,12 +534,16 @@ export function formatLimits() {
     ['wave handoff budget (chars, per task)', LIMITS.maxHandoffChars],
     ['review policy scan cap (bytes)', LIMITS.maxReviewPolicyBytes],
     ['push timeout (ms)', LIMITS.notifyTimeoutMs],
-    ['resume card list rows (per list)', LIMITS.resumeCardListRows]
+    ['resume card list rows (per list)', LIMITS.resumeCardListRows],
+    ['launch ledger max age (ms)', LIMITS.launchLedgerMaxAgeMs],
+    ['meter quiet after (ms)', LIMITS.meterQuietAfterMs],
+    ['meter tick (ms)', LIMITS.meterTickMs]
   ]
   const evalRows = [
     ['eval smoke cost ceiling (per PR)', `$${EVAL_CAPS.smokeCostUsd}`],
     ['eval full-run cost ceiling (scheduled)', `$${EVAL_CAPS.fullRunCostUsd}`],
     ['eval outcome-run cost ceiling (scheduled)', `$${EVAL_CAPS.shipEvalCostUsd}`],
+    ['eval cost-per-task sweep ceiling (by hand)', `$${EVAL_CAPS.matrixCostUsd}`],
     ['eval runs per case', EVAL_CAPS.runsPerCase],
     ['eval promotion: consecutive qualifying runs', EVAL_CAPS.promotionRuns],
     ['eval promotion: trials per qualifying run', EVAL_CAPS.promotionTrialsPerRun],
@@ -480,11 +563,21 @@ export function formatLimits() {
     // The cache multipliers print beside the base rates for the same reason the
     // base rates print beside the ceiling: they are part of what turns a token
     // count into a dollar figure, and a multiplier nobody can see is a price
-    // written in prose. One row per lifetime tier, because they are never summed.
+    // written in prose. One read row per model, because the read multiplier is
+    // not one figure; one write row per lifetime tier, because they are never
+    // summed. A priced model with no read multiplier prints as `unpriced`, which
+    // is what the pricer makes of it.
+    ...Object.keys(MODEL_PRICES.perMillionTokens)
+      .sort()
+      .map(model => [
+        `cache read multiplier: ${model} (x input)`,
+        typeof MODEL_PRICES.cacheMultipliers.read[model] === 'number'
+          ? MODEL_PRICES.cacheMultipliers.read[model]
+          : 'unpriced'
+      ]),
     ...Object.keys(MODEL_PRICES.cacheMultipliers.write)
       .sort()
-      .map(tier => [`cache write multiplier: ${tier} (x input)`, MODEL_PRICES.cacheMultipliers.write[tier]]),
-    ['cache read multiplier (x input)', MODEL_PRICES.cacheMultipliers.read]
+      .map(tier => [`cache write multiplier: ${tier} (x input)`, MODEL_PRICES.cacheMultipliers.write[tier]])
   ]
   const reportRows = [['report trajectory scan cap', REPORT_CAPS.maxRunsScanned]]
   // One row per tier, rather than a rendered object: an operator reading this
@@ -498,6 +591,7 @@ export function formatLimits() {
     ['lane cap: tier 4 lane', LANE_CAPS.byTier[4]],
     ['lane cap: tier 5 lane', LANE_CAPS.byTier[5]],
     ['cohesion tier ceiling (packs at or below)', LANE_CAPS.cohesionMaxTier],
+    ['multi-task opus floor (hardest tier at or above)', LANE_CAPS.opusMinTier],
     ['solo envelope (max tasks in one lane)', SOLO.maxTasks]
   ]
   // `null` in the tier table means inherit the session default; print it as
@@ -509,7 +603,7 @@ export function formatLimits() {
     ['effort: tier 3 lane', inherit(EFFORT.byTier[3])],
     ['effort: tier 4 lane', inherit(EFFORT.byTier[4])],
     ['effort: tier 5 lane', inherit(EFFORT.byTier[5])],
-    ['effort: inter-wave verify step', EFFORT.verify],
+    ['effort: verify step (inter-wave and final)', EFFORT.verify],
     ['effort: review skeptic step', EFFORT.skeptic]
   ]
   const width = Math.max(
@@ -531,6 +625,20 @@ export function formatLimits() {
     '\n\n' +
     effortRows.map(fmt).join('\n') +
     `\n\nruntime ceilings: ${RUNTIME.maxConcurrentAgents} concurrent, ` +
-    `${RUNTIME.maxAgentsPerRun} agents per run\n`
+    `${RUNTIME.maxAgentsPerRun} agents per run${observedSlots(runtimeObserved)}\n`
   )
 }
+
+/** The observed clause of the runtime-ceilings line, or '' when nothing was observed. */
+function observedSlots(observed) {
+  if (!observed || typeof observed !== 'object') return ''
+  if (observed.source === 'env' && Number.isInteger(observed.observed)) {
+    return ` — observed on this machine: CLAUDE_CODE_WORKFLOW_MAX_CONCURRENT_AGENTS=${observed.observed}`
+  }
+  const machine = Number.isInteger(observed.cpuCount) ? `this ${observed.cpuCount}-CPU machine` : 'this machine'
+  const ignored =
+    typeof observed.invalid === 'string'
+      ? `CLAUDE_CODE_WORKFLOW_MAX_CONCURRENT_AGENTS=${observed.invalid} is not a valid count and is ignored; `
+      : ''
+  return ` — observed on this machine: ${ignored}vendor default, possibly reduced on ${machine}`
+}

package/lib/meter-quiet.mjs

@@ -0,0 +1,45 @@
+// The ship meter's quiet figure (show-quiet-time-and-reset-the-meter-on-clear
+// design D3): how long a live run has gone without activity, and the word the
+// meter shows once that reaches the published threshold.
+//
+// Pure and Node-free: `hooks/mod.mjs` imports it inside the engine, where there
+// is no Node, and `test/spine/mod-pins.test.mjs` walks the import. The two
+// numbers are `interlock limits`'s; neither this file nor the hooks module
+// restates them. The word names no cause: a run waiting on a plan window and a
+// run that hung read the same here, and the person tells them apart from the
+// windows the pane lists beside it.
+
+import { LIMITS } from './limits.mjs'
+
+const MINUTE_MS = 60 * 1000
+
+/** The period of the meter's interval, in milliseconds. */
+export const TICK_MS = LIMITS.meterTickMs
+
+/**
+ * Milliseconds from the last activity to now, never negative (a clock that went
+ * backwards reads as no wait). `null` unless both are finite numbers: a time
+ * the module could not read is no figure, never a guessed one.
+ *
+ * @param {unknown} lastActivityAt milliseconds since the epoch, or null
+ * @param {unknown} now milliseconds since the epoch, or null
+ * @returns {number|null}
+ */
+export function quietMs(lastActivityAt, now) {
+  if (!Number.isFinite(lastActivityAt) || !Number.isFinite(now)) return null
+  return Math.max(0, now - lastActivityAt)
+}
+
+/**
+ * `quiet <n> min` once `ms` reaches the threshold, `<n>` the whole minutes and
+ * `<1` under one; `null` below it, or for no figure.
+ *
+ * @param {number|null} ms what `quietMs` returned
+ * @param {number} [afterMs] the threshold; the published one unless a test names another
+ * @returns {string|null}
+ */
+export function quietWord(ms, afterMs = LIMITS.meterQuietAfterMs) {
+  if (!Number.isFinite(ms) || ms < afterMs) return null
+  const minutes = Math.floor(ms / MINUTE_MS)
+  return `quiet ${minutes < 1 ? '<1' : minutes} min`
+}

package/lib/notify-defaults.mjs

@@ -0,0 +1,6 @@
+// The server used when an operator names a topic and no server.
+// One spelling, imported by the transport, the doctor and the CLI help,
+// so those three cannot drift.
+
+/** The public server, used when no server was configured. */
+export const DEFAULT_NTFY_URL = 'https://ntfy.sh'

package/lib/notify.mjs

@@ -1,6 +1,6 @@
-// The one network call this CLI ever makes: a push to ntfy.sh (or a
-// self-hosted server) so a ship run that stops while nobody is watching can
-// still reach someone.
+// The one network call this CLI ever makes: a push to the configured server
+// (the public default, or a server the operator named) so a ship run that
+// stops while nobody is watching can still reach someone.
 //
 // Three properties are load-bearing, and every one of them exists because
 // this module is the CLI's only exception to "no network":
@@ -11,8 +11,8 @@
 //      so there is no settings file this module could misread in the first
 //      place.
 //
-//   2. THE TOPIC NEVER LEAVES. The topic is the only auth ntfy.sh has on a
-//      public server; it is a capability, not a label. `readNotifyConfig`
+//   2. THE TOPIC NEVER LEAVES. The topic is the only auth the public server
+//      has; it is a capability, not a label. `readNotifyConfig`
 //      never echoes it, `sanitizeReason` strips it (and the server URL) from
 //      every failure reason before that reason reaches a summary line, a
 //      receipt event or the trajectory, because a `fetch` failure's own
@@ -29,15 +29,23 @@
 // design D1, D2, D4, D5, D14 (add-harden-unattended-ship-runs).
 
 import { LIMITS } from './limits.mjs'
+import { DEFAULT_NTFY_URL } from './notify-defaults.mjs'
 
-/** Where the topic is read from. Set by the operator, never by the repo. */
+export { DEFAULT_NTFY_URL }
+
+/** Where the topic is read from. Chosen by the operator, never by the repo. */
 export const NOTIFY_TOPIC_ENV = 'INTERLOCK_NTFY_TOPIC'
 
-/** Where a self-hosted server is read from. Unset means the public default. */
+/** Where a self-hosted server is read from. Absent means the public default. */
 export const NOTIFY_URL_ENV = 'INTERLOCK_NTFY_URL'
 
-/** The public ntfy server, used when `NOTIFY_URL_ENV` is unset. */
-export const DEFAULT_NTFY_URL = 'https://ntfy.sh'
+/**
+ * Plugin options the host injects into a hook process, from `userConfig`
+ * `ntfy_topic` and `ntfy_url`. Preferred over the shell variables when present,
+ * so a value the operator typed into the plugin is the one that is shared.
+ */
+export const NOTIFY_TOPIC_OPTION = 'CLAUDE_PLUGIN_OPTION_NTFY_TOPIC'
+export const NOTIFY_URL_OPTION = 'CLAUDE_PLUGIN_OPTION_NTFY_URL'
 
 function messageOf(err) {
   return (err && err.message) || String(err)
@@ -60,26 +68,34 @@ function urlShapeInvalid(url) {
   }
 }
 
+function trimmed(source, name) {
+  if (!source || typeof source[name] !== 'string') return ''
+  return source[name].trim()
+}
+
 /**
- * Read push configuration from the environment. Never the tree — `INTERLOCK_
- * NTFY_TOPIC` and `INTERLOCK_NTFY_URL` are the whole of it (design D2).
+ * Read push configuration. Never the tree. A plugin option the host injected
+ * wins over the shell variable of the same meaning, and an absent topic is
+ * unconfigured rather than an error (design D2). The shell variables remain
+ * the channel for a terminal, CI, and any host that does not inject options.
  *
- * @param {object} env  environment to read (injected in tests; `process.env` at call sites)
+ * @param {object} source  values to read (injected in tests; the process values at call sites)
  * @returns {{topic: string, url: string} | {topic: null} | {invalid: string}}
  *   `{ topic: null }` when push is simply unconfigured — not an error, the
  *   default and by far the common case. `{ invalid: '<VAR>' }` names the
  *   offending variable and never its value.
  */
-export function readNotifyConfig(env) {
-  const rawTopic = env && typeof env[NOTIFY_TOPIC_ENV] === 'string' ? env[NOTIFY_TOPIC_ENV].trim() : ''
+export function readNotifyConfig(source) {
+  const optionTopic = trimmed(source, NOTIFY_TOPIC_OPTION)
+  const shellTopic = trimmed(source, NOTIFY_TOPIC_ENV)
+  const rawTopic = optionTopic || shellTopic
   if (!rawTopic) return { topic: null }
-  if (topicShapeInvalid(rawTopic)) return { invalid: NOTIFY_TOPIC_ENV }
+  if (topicShapeInvalid(rawTopic)) return { invalid: optionTopic ? NOTIFY_TOPIC_OPTION : NOTIFY_TOPIC_ENV }
 
-  const rawUrl =
-    env && typeof env[NOTIFY_URL_ENV] === 'string' && env[NOTIFY_URL_ENV].trim()
-      ? env[NOTIFY_URL_ENV].trim()
-      : DEFAULT_NTFY_URL
-  if (urlShapeInvalid(rawUrl)) return { invalid: NOTIFY_URL_ENV }
+  const optionUrl = trimmed(source, NOTIFY_URL_OPTION)
+  const shellUrl = trimmed(source, NOTIFY_URL_ENV)
+  const rawUrl = optionUrl || shellUrl || DEFAULT_NTFY_URL
+  if (urlShapeInvalid(rawUrl)) return { invalid: optionUrl ? NOTIFY_URL_OPTION : NOTIFY_URL_ENV }
 
   return { topic: rawTopic, url: rawUrl }
 }
@@ -156,10 +172,10 @@ export function sanitizeReason(reason, { topic, url } = {}) {
  * all: EVERY headline this module sends contains an em dash (`SHIP COMPLETE —
  * <change>`), HTTP header values are ByteStrings, and Node's `fetch` throws
  * `Cannot convert argument to a ByteString` rather than transmitting one. So
- * a non-ASCII value is sent as an RFC 2047 base64 encoded-word, which ntfy
- * documents as the supported encoding for exactly this case (docs.ntfy.sh
- * §Publish → "ntfy supports UTF-8 in HTTP headers, but not every library or
- * programming language does", checked 2026-09-07).
+ * a non-ASCII value is sent as an RFC 2047 base64 encoded-word, which the
+ * server's publish documentation names as the supported encoding for exactly
+ * this case ("UTF-8 in HTTP headers" is not accepted by every client,
+ * checked 2026-09-07).
  *
  * A pure-ASCII value is passed through untouched, so the common `interlock
  * notify --title` case stays readable on the wire.
@@ -175,7 +191,7 @@ export function encodeHeaderValue(value) {
 }
 
 /**
- * Post one ntfy message. Never throws: every failure mode — invalid
+ * Post one message. Never throws: every failure mode — invalid
  * configuration, a non-2xx status, a network error, the timeout — resolves
  * to `{ sent: false, reason }`, sanitized, so the caller can always print
  * something and never has to catch anything.

package/lib/plan-fingerprint.mjs

@@ -36,6 +36,7 @@ import { dirname, join } from 'node:path'
 
 import { inspectChange, normalizeTaskMarkers, taskMatchesId } from './artifacts.mjs'
 import { LIMITS, LANE_CAPS, SOLO } from './limits.mjs'
+import { laneEffort, laneModel, laneTier } from './waves.mjs'
 
 /**
  * The shape of the plan this reader understands.
@@ -44,15 +45,18 @@ import { LIMITS, LANE_CAPS, SOLO } from './limits.mjs'
  * and still be shaped for a reader that no longer exists. `/1` was the plan
  * whose batches held tasks; `/2` is the plan whose batches hold lanes; `/3` is
  * the plan that carries a mode and whose lanes may be cohesion folds; `/4`
- * fuses serial single-lane batches into chain lanes. A stored plan carrying
- * another version is not reused however well its inputs match.
+ * fuses serial single-lane batches into chain lanes; `/5` routes a multi-task
+ * lane's model by the opus floor (`LANE_CAPS.opusMinTier`). A stored plan
+ * carrying another version is not reused however well its inputs match.
  *
- * The bump is what forces a `/3` plan to be rebuilt rather than reused. A `/3`
+ * The bump is what forces an older plan to be rebuilt rather than reused. A `/3`
  * plan's inputs can match perfectly and it will still hold one agent per serial
  * batch — reusing it would silently keep the old shape while the run believed
- * it had chain lanes.
+ * it had chain lanes. A `/4` plan's lane report names opus for every multi-task
+ * lane, while dispatch now derives sonnet for one below the floor — reusing it
+ * would leave the report and the spawn disagreeing under `PLAN REUSED`.
  */
-export const PLAN_FORMAT = 'interlock.ship-plan/4'
+export const PLAN_FORMAT = 'interlock.ship-plan/5'
 
 /** Where the plan and its fingerprint live — machine-local and gitignored. */
 export const PLAN_PATH = '.claude/ship/plan.json'
@@ -159,10 +163,31 @@ function capsOf(opts = {}) {
     redWave,
     laneCaps: { ...LANE_CAPS.byTier },
     cohesionMaxTier: LANE_CAPS.cohesionMaxTier,
+    // Not a shape cap, but the plan's lane report records each multi-task
+    // lane's model, and dispatch re-derives it from this floor. A plan built
+    // under another floor would be reused with a report naming the old model.
+    opusMinTier: LANE_CAPS.opusMinTier,
     soloMaxTasks: SOLO.maxTasks
   }
 }
 
+/** A fingerprint's artifact digests as one comparable line; `null` when absent. */
+function inputsLine(inputs) {
+  return Array.isArray(inputs) ? inputs.map(i => `${i && i.path} ${i && i.sha256}`).join('\n') : null
+}
+
+/** The caps a stored fingerprint and a fresh one disagree on, as `name a → b`. */
+function capsChanged(stored, current) {
+  const changed = []
+  const line = v => (v && typeof v === 'object' ? laneCapsLine(v) : String(v))
+  for (const key of ['maxParallel', 'mode', 'redWave', 'laneCaps', 'cohesionMaxTier', 'opusMinTier', 'soloMaxTasks']) {
+    const was = stored[key] ?? null
+    const now = current[key] ?? null
+    if (line(was) !== line(now)) changed.push(`${key} ${line(was)} → ${line(now)}`)
+  }
+  return changed
+}
+
 /** `1:8 2:8 3:6 4:4 5:8` — the tier table as one stable, sorted line. */
 function laneCapsLine(table) {
   return Object.keys(table)
@@ -229,6 +254,7 @@ export function computeFingerprint(root = '.', change, opts = {}) {
       `mode ${caps.mode}`,
       `lane-caps ${laneCapsLine(caps.laneCaps)}`,
       `cohesion-max-tier ${caps.cohesionMaxTier}`,
+      `opus-min-tier ${caps.opusMinTier}`,
       `solo-max-tasks ${caps.soloMaxTasks}`,
       // OMITTED ENTIRELY when there is no red wave, for the same reason `edges`
       // is: a plan built without a TDD shape must hash exactly as it did before
@@ -391,11 +417,18 @@ export function checkPlanReuse(root = '.', change, opts = {}) {
       )
     }
     if (stored.hash !== current.hash) {
-      return noReuse(
-        REUSE_MISMATCH,
-        `the change's artifacts have been edited since the plan was built`,
-        { ...paths, stored, current }
-      )
+      // A cap that moved is named rather than reported as an edit: retuning
+      // `interlock limits` re-plans every stored change, and "the artifacts have
+      // been edited" would send the operator looking for an edit nobody made.
+      // Both are said when both are true; with neither identified, the edit is
+      // the explanation that was always given.
+      const caps = capsChanged(stored, current)
+      const edited = !caps.length || inputsLine(stored.inputs) !== inputsLine(current.inputs)
+      const reasons = [
+        ...(caps.length ? [`the caps the plan was built under have changed (${caps.join('; ')})`] : []),
+        ...(edited ? [`the change's artifacts have been edited since the plan was built`] : [])
+      ]
+      return noReuse(REUSE_MISMATCH, reasons.join(', and '), { ...paths, stored, current })
     }
 
     return {
@@ -465,9 +498,44 @@ export function narrowPlan(plan, isComplete) {
   const laneCount = all.reduce((n, w) => n + w.batches.reduce((m, b) => m + b.length, 0), 0)
   const taskCount = all.reduce((n, w) => n + w.taskCount, 0)
 
+  // The lane report is re-derived from the lanes that will dispatch, by the same
+  // functions dispatch reads. Copied through, it would keep a dropped task's id,
+  // and a two-task lane narrowed to one would still be listed under the model of
+  // a pair while its spawn asks for the remaining task's own model.
+  const report = {}
+  if (Array.isArray(plan.lanes)) {
+    const byId = new Map()
+    for (const wave of all) {
+      for (const batch of wave.batches) for (const lane of batch) for (const t of lane) byId.set(t.id, t)
+    }
+    const lanes = []
+    for (const entry of plan.lanes) {
+      const tasks = (Array.isArray(entry && entry.ids) ? entry.ids : []).map(id => byId.get(id)).filter(Boolean)
+      // A lane of one is not a fold, and the planner does not list it.
+      if (tasks.length < 2) continue
+      lanes.push({
+        ...entry,
+        ids: tasks.map(t => t.id),
+        tier: laneTier(tasks),
+        model: laneModel(tasks),
+        effort: laneEffort(tasks)
+      })
+    }
+    report.lanes = lanes
+    if (Array.isArray(plan.effort)) {
+      report.effort = lanes.map(l => ({
+        ids: l.ids,
+        tier: l.tier,
+        effort: l.effort,
+        inherited: l.effort !== null ? null : l.tier >= 1 && l.tier <= 5 ? 'policy' : 'fallback'
+      }))
+    }
+  }
+
   return {
     plan: {
       ...plan,
+      ...report,
       waves,
       testWave,
       waveCount: waves.length,
@@ -560,7 +628,8 @@ export function formatFingerprint(fp) {
   )
   lines.push(
     `  lane-caps ${laneCapsLine(fp.laneCaps || LANE_CAPS.byTier)}, ` +
-      `cohesion-max-tier ${fp.cohesionMaxTier}, solo-max-tasks ${fp.soloMaxTasks}`
+      `cohesion-max-tier ${fp.cohesionMaxTier}, opus-min-tier ${fp.opusMinTier}, ` +
+      `solo-max-tasks ${fp.soloMaxTasks}`
   )
   if (fp.edges) lines.push(`  ${fp.edges}`)
   for (const i of fp.inputs || []) {

package/lib/prompts/implementer.mjs

@@ -130,7 +130,7 @@ export function assembleImplementerPrompt({ change, lane, task, previousHandoffs
     `- Do not fix unrelated problems you notice; report them instead.\n` +
     `- Run typecheck and lint on what you changed.\n` +
     `- Do not commit, and do not edit tasks.md — the orchestrator owns both.\n` +
-    `- If .claude/graph/graph.json exists, interlock-graph query / consumers before grep.\n` +
+    `- Run interlock-graph query / consumers before grep; if it reports no graph, grep.\n` +
     `- Locate (graph or grep) then Read spans. Do not re-read a file unless it changed.\n` +
     `- Return the schema only. No narrative.\n` +
     (tier <= 2