pan-wizard 3.27.0 → 3.28.0

package/bin/install.js

@@ -46,7 +46,7 @@ const pkg = require('../package.json');
 // phrased by capability, not by name; these are the "switch to this" examples
 // that keep the advice actionable. Nothing in PAN gates on these values.
 const RECOMMENDED_MODELS = {
-  flagship: 'claude-fable-5',
+  flagship: 'claude-fable-5-1',
   reasoningTier: 'claude-opus-5 / claude-opus-4-8',
 };
 
@@ -565,21 +565,15 @@ function copyCommandsAsUnifiedSkills(srcDir, skillsDir, prefix, pathPrefix, core
       fs.mkdirSync(skillDir, { recursive: true });
 
       let content = fs.readFileSync(srcPath, 'utf8');
-      // Core + agent-definition references → shared .agents/ copies (specific,
-      // before the generic rewrites); everything else .claude-scoped → the
-      // installing runtime. Agent refs point at the canonical reference copies
-      // shipped with the shared core — the runtime's own agents dir may carry
-      // a different format (Codex TOML, Copilot .agent.md).
-      content = content.replace(/~\/\.claude\/pan-wizard-core\//g, `${corePrefix}pan-wizard-core/`);
-      content = content.replace(/\.\/\.claude\/pan-wizard-core\//g, `${corePrefix}pan-wizard-core/`);
-      content = content.replace(/~\/\.claude\/agents\//g, `${corePrefix}pan-wizard-core/agents/`);
-      content = content.replace(/\.\/\.claude\/agents\//g, `${corePrefix}pan-wizard-core/agents/`);
-      content = content.replace(/~\/\.claude\//g, pathPrefix);
-      content = content.replace(/\.\/\.claude\//g, `./${getDirName(runtime)}/`);
-      // Not every runtime puts a `pan-tools` bin on PATH — invoke via node.
-      const panToolsPath = `${corePrefix}pan-wizard-core/bin/pan-tools.cjs`;
-      content = content.replace(/\bpan-tools\b(?=\s+[a-z])/g, `node ${panToolsPath}`);
-      content = processAttribution(content, getCommitAttribution(runtime));
+      // The path rewrite lives in install-lib (rewriteUnifiedSkillCommandContent)
+      // because the Agent Plugins bundle builder runs the SAME function — one
+      // converter, several call sites, never a second copy (ADR-0028, ADR-0045).
+      content = lib.rewriteUnifiedSkillCommandContent(content, {
+        corePrefix,
+        pathPrefix,
+        projectDirPrefix: `./${getDirName(runtime)}/`,
+        attribution: getCommitAttribution(runtime),
+      });
       content = convertClaudeCommandToUnifiedSkill(content, skillName);
 
       fs.writeFileSync(path.join(skillDir, 'SKILL.md'), content);
@@ -670,17 +664,14 @@ function copySharedCore(srcDir, destDir, corePrefix, runtimePathPrefix, runtime)
         recurse(srcPath, destPath);
       } else if (entry.name.endsWith('.md')) {
         try {
-          let content = fs.readFileSync(srcPath, 'utf8');
-          content = content.replace(/~\/\.claude\/pan-wizard-core\//g, `${corePrefix}pan-wizard-core/`);
-          content = content.replace(/\.\/\.claude\/pan-wizard-core\//g, `${corePrefix}pan-wizard-core/`);
-          // Agent-definition refs → the canonical reference copies in the
-          // shared core (runtime agents dirs carry runtime-specific formats).
-          content = content.replace(/~\/\.claude\/agents\//g, `${corePrefix}pan-wizard-core/agents/`);
-          content = content.replace(/\.\/\.claude\/agents\//g, `${corePrefix}pan-wizard-core/agents/`);
-          content = content.replace(/~\/\.claude\//g, runtimePathPrefix);
-          content = content.replace(/\.\/\.claude\//g, `./${dirName}/`);
-          content = processAttribution(content, getCommitAttribution(runtime));
-          content = convertSlashCommandsToCopilotSkillMentions(content);
+          // Shared with the Agent Plugins bundle builder (install-lib) — see
+          // rewriteSharedCoreMarkdown for the rewrite order and rationale.
+          const content = lib.rewriteSharedCoreMarkdown(fs.readFileSync(srcPath, 'utf8'), {
+            corePrefix,
+            pathPrefix: runtimePathPrefix,
+            projectDirPrefix: `./${dirName}/`,
+            attribution: getCommitAttribution(runtime),
+          });
           fs.writeFileSync(destPath, content);
         } catch (err) {
           pushInstallWarning('copySharedCore(md)', destPath, err);
@@ -728,21 +719,13 @@ function stripInternalFromLearningsIndex(indexPath) {
     if (err.code !== 'ENOENT') pushInstallWarning('stripInternalLearnings', 'learnings/index.json', err);
     return;
   }
-  if (!parsed || !Array.isArray(parsed.topics)) return;
-
-  const kept = parsed.topics.filter(t => t && t.scope !== 'internal');
-  if (kept.length === parsed.topics.length) return; // nothing internal to drop
-
-  parsed.topics = kept;
-  if (parsed.totals && typeof parsed.totals === 'object') {
-    parsed.totals.topics = kept.length;
-    parsed.totals.patterns = kept.reduce((n, t) => n + (Array.isArray(t.patterns) ? t.patterns.length : 0), 0);
-    parsed.totals.size_bytes = kept.reduce((n, t) => n + (t.size_bytes || 0), 0);
-    parsed.totals.size_tokens_est = kept.reduce((n, t) => n + (t.size_tokens_est || 0), 0);
-  }
+  // The transform is pure and shared with the bundle builders (install-lib):
+  // null means "not an index" or "nothing internal to drop" — both no-ops here.
+  const stripped = lib.stripInternalLearningsTopics(parsed);
+  if (!stripped) return;
 
   try {
-    fs.writeFileSync(indexPath, JSON.stringify(parsed, null, 2) + '\n');
+    fs.writeFileSync(indexPath, JSON.stringify(stripped, null, 2) + '\n');
   } catch (err) {
     pushInstallWarning('stripInternalLearnings', 'learnings/index.json', err);
   }
@@ -2230,10 +2213,8 @@ function install(isGlobal, runtime = 'claude') {
         fs.mkdirSync(agentsRefDir, { recursive: true });
         const agentsSrc = path.join(src, 'agents');
         for (const f of fs.readdirSync(agentsSrc).filter(n => n.endsWith('.md'))) {
-          let content = fs.readFileSync(path.join(agentsSrc, f), 'utf8');
-          content = content.replace(/~\/\.claude\/pan-wizard-core\//g, `${corePrefix}pan-wizard-core/`);
-          content = content.replace(/\.\/\.claude\/pan-wizard-core\//g, `${corePrefix}pan-wizard-core/`);
-          content = convertSlashCommandsToCopilotSkillMentions(content);
+          // Shared with the Agent Plugins bundle builder (install-lib).
+          const content = lib.rewriteAgentReferenceCopy(fs.readFileSync(path.join(agentsSrc, f), 'utf8'), corePrefix);
           fs.writeFileSync(path.join(agentsRefDir, f), content);
         }
       } catch (e) {

package/commands/pan/army.md

@@ -92,7 +92,7 @@ Every cap the conductor enforces applies to the campaign, scaled up:
 | `--push` | off | Push approved merges to origin (still human-gated). |
 | `--clean-seal` | off | One clean build + full verification after the last item (commands from config). |
 | `--schedule` | off | Arm a self-resuming campaign at this cadence (`hourly`/`daily`/`weekly`/`Nh`/`Nd`) instead of running once — writes the schedule descriptor (ADR-0034). Pair with `--daily-budget`. |
-| `--daily-budget` | 300 | Per-day point budget for a scheduled campaign. Advisory by default (an indicator of the day's spend); it only pauses the day's run when `budget.enforce`/`enforce_budget` is set. |
+| `--daily-budget` | 300 | Per-day point budget for a scheduled campaign. Advisory by default (an indicator of the day's spend); it only pauses the day's run when `enforce_budget: true` is set by hand in the schedule descriptor (`schedule.json`); no flag or config key sets it. |
 | `--dry-run` | off | Plan + squad delegation preview only; STOP. |
 | `--continue` / `--stop` / `--status` | — | Resume / halt / report from `.planning/orchestration/` + focus-auto state. |
 

package/commands/pan/preview.md

@@ -34,9 +34,9 @@ Consolidates Spec B v1's architect + simulate + predict-milestone into one entry
 **What it does:**
 1. `pan-tools preview phase <N>` returns `{files_mentioned, test_files_mentioned, risk_signals, risk_score, plans[], status}`.
 2. Spawn `pan-previewer` with the payload as `<preview_input>`.
-3. Agent writes `.planning/phases/<N>/preview.md` with files touched / tests at risk / migration steps / risk assessment / bottom line.
+3. Agent writes `.planning/phases/<NN-slug>/preview.md` with files touched / tests at risk / migration steps / risk assessment / bottom line.
 
-**Output:** `.planning/phases/<N>/preview.md`
+**Output:** `.planning/phases/<NN-slug>/preview.md`
 
 ### `phases` — Cross-phase dependency graph
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pan-wizard",
-  "version": "3.27.0",
+  "version": "3.28.0",
   "description": "Command a bot army for your codebase: a reasoning-tier Mission Control delegates whole-project goals to specialist squads and ships behind a human merge gate. Five AI CLIs, zero context rot.",
   "bin": {
     "pan-wizard": "bin/install.js"
@@ -70,6 +70,9 @@
     "test:e2e": "node scripts/run-tests.cjs tests/scenarios",
     "test:vscode": "npx playwright test --config tests/e2e/playwright.config.mjs",
     "test:watch": "node scripts/run-tests.cjs --watch tests tests/scenarios",
-    "build:plugin": "node scripts/build-plugin.js"
+    "build:plugin": "node scripts/build-plugin.js",
+    "build:agent-plugin": "node scripts/build-agent-plugin.js",
+    "harness": "node harness/src/run.cjs --tier 0",
+    "harness:model": "node harness/src/run.cjs --tier 2"
   }
 }

package/pan-wizard-core/bin/lib/constants.cjs

@@ -687,6 +687,27 @@ const REFLECTION_THRESHOLD = {
   enable_on_tiers: ['reasoning'],
 };
 
+/**
+ * Markers of a `.planning/` tree written by ANOTHER tool. gsd-core (open-gsd/gsd-core,
+ * the continuation of Get Shit Done) uses the same directory name and the same uppercase
+ * core files PAN's pre-v2.2 layout used, so hygiene's legacy-filename rename would rename
+ * another tool's state. These are POSITIVE markers PAN never writes — files, directories,
+ * and gsd-core's flat dotted config keys (PAN nests `workflow: {}`). Source: gsd-core
+ * docs/USER-GUIDE.md, read 2026-09-10. Consumed by foreign-planning.cjs (reality check R15).
+ */
+const FOREIGN_PLANNING_MARKERS = Object.freeze({
+  gsd: Object.freeze({
+    tool: 'gsd-core',
+    files: Object.freeze(['HANDOFF.json', '.gsd-allow-shrink']),
+    dirs: Object.freeze(['forensics', 'threads', 'seeds', 'ui-reviews', 'sketches', 'spikes', 'onboarding']),
+    configKeys: Object.freeze([
+      'workflow.discuss_mode', 'workflow.context_coverage_gate', 'workflow.ui_phase', 'workflow.ui_safety_gate',
+      'workflow.skip_discuss', 'workflow.drift_action', 'workflow.drift_threshold', 'plan_review.source_grounding',
+      'graphify.enabled', 'intel.enabled', 'hooks.workflow_guard', 'dynamic_routing', 'resolve_model_ids',
+    ]),
+  }),
+});
+
 module.exports = {
   // Directories
   PLANNING_DIR,
@@ -765,6 +786,7 @@ module.exports = {
   COMPLEX_FILE_THRESHOLD,
   CHARS_PER_TOKEN,
   HEALTH_STATUS,
+  FOREIGN_PLANNING_MARKERS,
   MAX_JSON_SIZE,
   PROGRESS_BAR_WIDTH,
   MAX_SLUG_LENGTH,

package/pan-wizard-core/bin/lib/context-budget.cjs

@@ -71,6 +71,66 @@ function estimateRelevanceRatio(text) {
  * @param {string} cwd - Project root directory
  * @param {boolean} raw - If true, output human-readable string
  */
+// ─── Prompt-cache lifetime signal (2026-09, ADR-0044 follow-up) ─────────────
+//
+// Claude Code decides the prompt-cache lifetime per request bucket: the main
+// conversation can get one hour on a subscription, but EVERYTHING ELSE —
+// subagents, workflows, forks — gets five minutes unless `subagentPromptCacheTtl`
+// (≥2.1.242) says otherwise. Every PAN agent is a subagent. So a phase whose
+// agents are spaced more than five minutes apart re-writes the same cached
+// context block each time, and ADR-0044 measured that block as the bulk of PAN's
+// token traffic. This assessor reads the cost ledger for exactly that signature:
+// a cache WRITE that follows an idle gap of five to sixty minutes — a miss the
+// one-hour lifetime would have turned into a hit. It recommends the setting only
+// when the pattern recurs, because one-hour writes bill at 2× base input against
+// 1.25× for five-minute writes: the longer lifetime pays off once a block is read
+// twice inside the hour, and costs more on bursts that never idle.
+
+const TTL_SHORT_MIN = 5;     // the default subagent lifetime, in minutes
+const TTL_LONG_MIN = 60;     // the lifetime the setting buys
+const TTL_MIN_WRITE_TOKENS = 1000;  // ignore trivial writes (a few tokens of tool results)
+const TTL_RECOMMEND_AT = 2;  // recurrence, not a single event, earns the recommendation
+
+/**
+ * Pure. Scan ledger records (oldest first by `ts`) for cache writes that follow
+ * an idle gap in (TTL_SHORT_MIN, TTL_LONG_MIN] — writes the one-hour lifetime
+ * would have avoided. Records without a parseable `ts`, and records flagged
+ * suspect by the caller (pass them pre-filtered), are ignored.
+ *
+ * @param {Array<object>} records - cost ledger rows ({ts, cache_write_tokens, …})
+ * @param {{minWriteTokens?:number, recommendAt?:number}} [opts]
+ * @returns {{records_considered:number, writes_after_short_idle:number, tokens_after_short_idle:number, writes_after_long_idle:number, recommend:boolean, setting:string, advice:string|null}}
+ */
+function assessCacheTtl(records, opts = {}) {
+  const minWrite = opts.minWriteTokens ?? TTL_MIN_WRITE_TOKENS;
+  const recommendAt = opts.recommendAt ?? TTL_RECOMMEND_AT;
+  const rows = (Array.isArray(records) ? records : [])
+    .map(r => ({ t: r && r.ts ? new Date(r.ts).getTime() : NaN, w: Number(r && r.cache_write_tokens) || 0 }))
+    .filter(r => Number.isFinite(r.t))
+    .sort((a, b) => a.t - b.t);
+  let shortIdle = 0; let shortIdleTokens = 0; let longIdle = 0;
+  for (let i = 1; i < rows.length; i++) {
+    if (rows[i].w < minWrite) continue;
+    const gapMin = (rows[i].t - rows[i - 1].t) / 60000;
+    if (gapMin > TTL_SHORT_MIN && gapMin <= TTL_LONG_MIN) { shortIdle++; shortIdleTokens += rows[i].w; }
+    else if (gapMin > TTL_LONG_MIN) longIdle++;
+  }
+  const recommend = shortIdle >= recommendAt;
+  const setting = 'subagentPromptCacheTtl';
+  const advice = recommend
+    ? `${shortIdle} cache writes followed an idle gap of ${TTL_SHORT_MIN}–${TTL_LONG_MIN} min (~${shortIdleTokens.toLocaleString()} tokens re-written): subagents get the five-minute cache lifetime by default — set \`${setting}: "1h"\` in a Claude Code settings file. One-hour writes bill at 2× base input against 1.25×, so this pays off once a block is read twice within the hour.`
+    : null;
+  return {
+    records_considered: rows.length,
+    writes_after_short_idle: shortIdle,
+    tokens_after_short_idle: shortIdleTokens,
+    writes_after_long_idle: longIdle,
+    recommend,
+    setting,
+    advice,
+  };
+}
+
 function cmdContextBudget(cwd, raw) {
   const planDir = planningPath(cwd);
   if (!fileAccessible(planDir)) {
@@ -204,6 +264,14 @@ function cmdContextBudget(cwd, raw) {
         : `cached context is re-read on every agent call; largest file ${largest[0].path} (~${largest[0].tokens} tokens)`
           + (largest[0].path.endsWith('state.md') ? ' — run `pan-tools state compact`' : '');
 
+    // Lifetime signal from the ledger (suspect rows excluded — they carry
+    // poisoned counters, not real writes). Absent ledger → zero rows, no advice.
+    let ttl = null;
+    try {
+      const { readRecords, isSuspectRecord } = require('./cost.cjs');
+      ttl = assessCacheTtl(readRecords(cwd).filter(r => !isSuspectRecord(r)));
+    } catch { ttl = null; }
+
     cache = {
       block_count: cached.blocks.length,
       block_paths: cached.blocks.map(b => b.path),
@@ -216,6 +284,7 @@ function cmdContextBudget(cwd, raw) {
       crit_tokens: CACHE_BLOCK_CRIT_TOKENS,
       file_warn_tokens: CACHE_FILE_WARN_TOKENS,
       advice,
+      ttl,
       sha: cached.sha,
     };
   } catch {
@@ -275,4 +344,5 @@ module.exports = {
   cmdContextBudget,
   estimateTokens,
   estimateRelevanceRatio,
+  assessCacheTtl,
 };

package/pan-wizard-core/bin/lib/cost.cjs

@@ -47,19 +47,39 @@ const TOKENS_FILE = 'tokens.jsonl';
  * Override per-model in config.json → cost.rates.
  */
 const DEFAULT_RATES = {
-  // Anthropic — verified against platform pricing 2026-08. Opus 4.6+/Opus 5 are
+  // Anthropic — verified against platform pricing 2026-09-10. Opus 4.6+/Opus 5 are
   // $5/$25 (the old $15/$75 Opus pricing ended with the 4.5 generation). Cache
-  // rates follow Anthropic's convention: read ≈ 0.1× input, write ≈ 1.25× input.
+  // rates follow Anthropic's convention: read ≈ 0.1× input, write ≈ 1.25× input —
+  // EXCEPT Fable 5.1, whose cache reads bill at 0.025× input ($0.25). Fable 5.1
+  // needs its own row: without it the family-prefix fallback priced its reads at
+  // the Fable 5 rate, 4× too high on the model the `fable`/`best` aliases resolve to
+  // (model-config, read 2026-09-10: neither Fable model is any plan's default), and
+  // cached re-reads are the bulk of PAN's traffic (ADR-0044).
+  'claude-fable-5-1':   { input: 10.0, output: 50.0, cache_read: 0.25, cache_write: 12.5 },
   'claude-fable-5':     { input: 10.0, output: 50.0, cache_read: 1.0,  cache_write: 12.5 },
+  // Mythos 5.1 / Mythos 5 (limited availability) — platform.claude.com/docs/en/about-claude/pricing,
+  // read 2026-09-10: $10/$50; the page's cache footnote names Fable 5.1 AND Mythos 5.1 as
+  // the two models whose cache reads bill at 0.025× input; Mythos 5 follows the 0.1× rule.
+  // Added for reality check R7: resolveRate returned null for both ids.
+  'claude-mythos-5-1':  { input: 10.0, output: 50.0, cache_read: 0.25, cache_write: 12.5 },
+  'claude-mythos-5':    { input: 10.0, output: 50.0, cache_read: 1.0,  cache_write: 12.5 },
   'claude-opus-5':      { input: 5.0,  output: 25.0, cache_read: 0.5,  cache_write: 6.25 },
   'claude-opus-4-8':    { input: 5.0,  output: 25.0, cache_read: 0.5,  cache_write: 6.25 },
   'claude-opus-4-7':    { input: 5.0,  output: 25.0, cache_read: 0.5,  cache_write: 6.25 },
   'claude-opus-4-6':    { input: 5.0,  output: 25.0, cache_read: 0.5,  cache_write: 6.25 },
-  // Sonnet 5 standard is $3/$15; a launch promo runs $2/$10 through 2026-08-31.
-  // We track the stable post-promo rate (the table is indicative; the staleness
-  // checker flags it for re-verification).
-  'claude-sonnet-5':    { input: 3.0,  output: 15.0, cache_read: 0.3,  cache_write: 3.75 },
+  // Opus 4.5 (dated id claude-opus-4-5-20251101) — same pricing page, read 2026-09-10:
+  // $5/$25/$0.50/$6.25. Without this row the dated id had no family prefix to land on
+  // and priced as null (R7).
+  'claude-opus-4-5':    { input: 5.0,  output: 25.0, cache_read: 0.5,  cache_write: 6.25 },
+  // Sonnet 5 is $2/$10: the launch price announced as introductory through
+  // 2026-08-31 was made permanent and the scheduled rise to $3/$15 cancelled
+  // (pricing page, read 2026-09-10). Lesson: never write down a pre-announced
+  // price — this row carried the future rate for a month and over-billed by half.
+  'claude-sonnet-5':    { input: 2.0,  output: 10.0, cache_read: 0.20, cache_write: 2.50 },
   'claude-sonnet-4-6':  { input: 3.0,  output: 15.0, cache_read: 0.3,  cache_write: 3.75 },
+  // Sonnet 4.5 (dated id claude-sonnet-4-5-20250929) — pricing page, read 2026-09-10:
+  // $3/$15/$0.30/$3.75 (the pre-Sonnet-5 rate; Sonnet 5 is $2/$10). R7.
+  'claude-sonnet-4-5':  { input: 3.0,  output: 15.0, cache_read: 0.3,  cache_write: 3.75 },
   'claude-haiku-4-5':   { input: 1.0,  output: 5.0,  cache_read: 0.1,  cache_write: 1.25 },
 
   // OpenAI — verified against published pricing 2026-08. Prompt caching is a 90%
@@ -106,6 +126,83 @@ function familyPrefixRate(rates, model) {
   return families.length > 0 ? rates[families[0]] : null;
 }
 
+// ─── Claude Code `modelPricing` as a rate source (2026-09) ──────────────────
+//
+// Claude Code ≥2.1.243 lets an organisation pin contracted per-model rates in
+// MANAGED settings — `modelPricing: { "<modelId>": { inputCostPer1MTokens,
+// outputCostPer1MTokens } }` (settings-reference, read 2026-09-10) — and prices
+// its own /usage with them. Honouring the same block keeps PAN's ledger on the
+// numbers the organisation actually pays. The shape carries no cache fields, so
+// cache rates are DERIVED: the family's own multipliers when DEFAULT_RATES knows
+// the family (Fable 5.1 reads bill at 0.025× input, not 0.1×), otherwise the
+// Anthropic convention (read 0.1×, write 1.25×).
+
+const round6 = (n) => Number(n.toFixed(6));
+
+function ratesFromModelPricing(modelPricing) {
+  const out = {};
+  if (!modelPricing || typeof modelPricing !== 'object' || Array.isArray(modelPricing)) return out;
+  for (const [id, p] of Object.entries(modelPricing)) {
+    if (!p || typeof p !== 'object') continue;
+    const input = Number(p.inputCostPer1MTokens);
+    const output = Number(p.outputCostPer1MTokens);
+    if (!Number.isFinite(input) || !Number.isFinite(output) || input < 0 || output < 0) continue;
+    const fam = DEFAULT_RATES[id] || familyPrefixRate(DEFAULT_RATES, id);
+    const readMult = fam && fam.input > 0 ? fam.cache_read / fam.input : 0.1;
+    const writeMult = fam && fam.input > 0 ? fam.cache_write / fam.input : 1.25;
+    out[id] = { input, output, cache_read: round6(input * readMult), cache_write: round6(input * writeMult) };
+  }
+  return out;
+}
+
+// Where Claude Code reads managed settings (code.claude.com/docs/en/managed-settings,
+// read 2026-09-10): macOS `/Library/Application Support/ClaudeCode`, Linux and WSL
+// `/etc/claude-code`, Windows `C:\Program Files\ClaudeCode`. Claude Code does NOT
+// read the legacy Windows path `C:\ProgramData\ClaudeCode` — so neither does PAN.
+// `managed-settings.json` is merged first, then every `*.json` in
+// `managed-settings.d/` in alphabetical order (hidden files skipped), later
+// files winning. `PAN_MANAGED_SETTINGS_DIR` redirects the lookup (tests, and
+// hosts that relocate the directory).
+function managedSettingsDir(platform = process.platform, env = process.env) {
+  if (env.PAN_MANAGED_SETTINGS_DIR) return env.PAN_MANAGED_SETTINGS_DIR;
+  // `path.win32.join`, not `path.join`: the platform is an argument, so a POSIX
+  // host asked for the win32 directory must still get backslashes. On Windows the
+  // two are the same function.
+  if (platform === 'win32') return path.win32.join(env.ProgramFiles || 'C:\\Program Files', 'ClaudeCode');
+  if (platform === 'darwin') return '/Library/Application Support/ClaudeCode';
+  return '/etc/claude-code';
+}
+
+function loadManagedModelPricing(dir = managedSettingsDir()) {
+  const files = [path.join(dir, 'managed-settings.json')];
+  try {
+    const dropIns = path.join(dir, 'managed-settings.d');
+    files.push(...fs.readdirSync(dropIns)
+      .filter(f => !f.startsWith('.') && f.endsWith('.json'))
+      .sort()
+      .map(f => path.join(dropIns, f)));
+  } catch { /* no drop-in directory */ }
+  let merged = null;
+  for (const f of files) {
+    let parsed;
+    try { parsed = JSON.parse(fs.readFileSync(f, 'utf8')); } catch { continue; }
+    const mp = parsed && typeof parsed === 'object' ? parsed.modelPricing : null;
+    if (mp && typeof mp === 'object' && !Array.isArray(mp)) merged = { ...(merged || {}), ...mp };
+  }
+  return merged;
+}
+
+// The rate table a cost computation actually sees. Precedence, highest first:
+//   1. `.planning/config.json → cost.rates` — PAN's explicit per-project override
+//   2. managed `modelPricing` — the organisation's contracted rates
+//   3. DEFAULT_RATES — resolveRate's own fallback when neither names the model
+// Returns undefined (not {}) when nothing overrides, so callers keep the exact
+// pre-2026-09 behaviour of passing no config rates.
+function effectiveRates(config, managedPricing = loadManagedModelPricing()) {
+  const rates = { ...ratesFromModelPricing(managedPricing), ...(config?.cost?.rates || {}) };
+  return Object.keys(rates).length > 0 ? rates : undefined;
+}
+
 function resolveRate(model, tier, configRates) {
   // Config overrides win over the built-in table — including for versioned ids.
   // Without the family-prefix pass here, a cost.rates override keyed on a family
@@ -187,7 +284,7 @@ function appendRecord(cwd, rec) {
   // time, so the two producers priced identical tokens differently.
   normalized.cost_usd = typeof rec.cost_usd === 'number'
     ? rec.cost_usd
-    : computeCost(normalized, loadConfig(cwd)?.cost?.rates);
+    : computeCost(normalized, effectiveRates(loadConfig(cwd)));
 
   try {
     fs.mkdirSync(metricsDir(cwd), { recursive: true });
@@ -256,7 +353,7 @@ function aggregate(cwd, opts) {
   const since = opts?.since ? new Date(opts.since).getTime() : null;
   const until = opts?.until ? new Date(opts.until).getTime() : null;
   const config = loadConfig(cwd);
-  const configRates = config?.cost?.rates;
+  const configRates = effectiveRates(config);
 
   const filtered = records.filter(r => {
     if (!r.ts) return true;
@@ -442,7 +539,7 @@ function cmdCostClear(cwd, raw) {
 // Bump this whenever the table is re-verified; `models check` flags the table
 // once it is older than RATES_STALE_AFTER_DAYS (provider prices move faster
 // than PAN releases do).
-const RATES_VERIFIED_AT = '2026-08-03';
+const RATES_VERIFIED_AT = '2026-09-10';
 const RATES_STALE_AFTER_DAYS = 180;
 const RATE_TIERS = ['reasoning', 'mid', 'fast'];
 
@@ -460,7 +557,9 @@ function checkRatesStaleness(now = new Date()) {
 }
 
 function cmdModelsCheck(raw) {
-  const result = checkRatesStaleness();
+  // Surface the managed rates too: an organisation that pins `modelPricing`
+  // should be able to see that PAN found the block, not infer it from totals.
+  const result = { ...checkRatesStaleness(), managed_model_pricing: Object.keys(loadManagedModelPricing() || {}) };
   const human = result.stale
     ? `Rate table verified ${result.rates_verified_at} (${result.age_days} days ago) — STALE: re-verify provider pricing and bump RATES_VERIFIED_AT in cost.cjs`
     : `Rate table verified ${result.rates_verified_at} (${result.age_days} days ago) — OK`;
@@ -476,6 +575,10 @@ module.exports = {
   renderTable,
   renderChart,
   resolveRate,
+  ratesFromModelPricing,
+  managedSettingsDir,
+  loadManagedModelPricing,
+  effectiveRates,
   checkRatesStaleness,
   cmdCostReport,
   cmdCostAppend,

package/pan-wizard-core/bin/lib/foreign-planning.cjs

@@ -0,0 +1,56 @@
+'use strict';
+/**
+ * Foreign planning-tree detection (reality check RC17 / plan item R15, 2026-09-10).
+ *
+ * gsd-core (open-gsd/gsd-core, the continuation of Get Shit Done) writes a `.planning/`
+ * directory with the same core files PAN's pre-v2.2 layout used — STATE.md, ROADMAP.md,
+ * PROJECT.md, REQUIREMENTS.md, MILESTONES.md in uppercase. To PAN's hygiene those read
+ * as LEGACY PAN files, and `hygiene clean --apply` would rename another tool's state.
+ * `validate health` would call the tree broken; `init new-project` would scaffold PAN
+ * files into it. This module answers one question — does this tree belong to another
+ * tool? — from POSITIVE markers PAN never writes (FOREIGN_PLANNING_MARKERS in
+ * constants.cjs, sourced from gsd-core's docs/USER-GUIDE.md, read 2026-09-10).
+ *
+ * Rule: foreign when any marker FILE exists, or at least two marker DIRECTORIES exist,
+ * or config.json carries any of the tool's flat dotted keys (PAN nests `workflow: {}`;
+ * gsd-core writes `"workflow.discuss_mode"`). An unreadable config.json is not evidence.
+ * Returns { tool, key, evidence[] } or null. Never throws.
+ */
+const fs = require('fs');
+const path = require('path');
+const { FOREIGN_PLANNING_MARKERS } = require('./constants.cjs');
+const { planningPath } = require('./utils.cjs');
+
+function detectForeignPlanningTree(planningDir) {
+  let entries;
+  try { entries = fs.readdirSync(planningDir, { withFileTypes: true }); } catch { return null; }
+  const names = new Set(entries.map(e => e.name));
+  const dirs = new Set(entries.filter(e => e.isDirectory()).map(e => e.name));
+  let cfg = null;
+  if (names.has('config.json')) {
+    try {
+      const parsed = JSON.parse(fs.readFileSync(path.join(planningDir, 'config.json'), 'utf8'));
+      if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) cfg = parsed;
+    } catch { cfg = null; }
+  }
+  for (const [key, m] of Object.entries(FOREIGN_PLANNING_MARKERS)) {
+    const fileHits = m.files.filter(f => names.has(f));
+    const dirHits = m.dirs.filter(d => dirs.has(d));
+    const configHits = cfg ? m.configKeys.filter(k => Object.prototype.hasOwnProperty.call(cfg, k)) : [];
+    if (fileHits.length > 0 || dirHits.length >= 2 || configHits.length > 0) {
+      return {
+        tool: m.tool,
+        key,
+        evidence: [...fileHits, ...dirHits.map(d => d + '/'), ...configHits.map(k => 'config.json:' + k)],
+      };
+    }
+  }
+  return null;
+}
+
+/** Same check, addressed by project cwd (honours --planning-dir / --track). */
+function detectForeignPlanningTreeAt(cwd) {
+  return detectForeignPlanningTree(planningPath(cwd));
+}
+
+module.exports = { detectForeignPlanningTree, detectForeignPlanningTreeAt };

package/pan-wizard-core/bin/lib/hygiene.cjs

@@ -40,8 +40,10 @@ const {
   STATE_FILE,
 } = require('./constants.cjs');
 const { planningPath, planningRel } = require('./utils.cjs');
+const { detectForeignPlanningTree } = require('./foreign-planning.cjs');
 const { listMemoryAgents, readMemory, compactMemory } = require('./memory.cjs');
 const { readRecords, isSuspectRecord, METRICS_DIR, TOKENS_FILE } = require('./cost.cjs');
+const { assessCacheTtl } = require('./context-budget.cjs');
 const { planningRootRel, planningRoots, withPlanningRoot, describePlanningRoot, TRACKS_DIR } = require('./planning-root.cjs');
 
 /** Runtime config dirs a PAN install can live in, relative to project root. */
@@ -456,6 +458,17 @@ function checkCachedContext(cwd) {
       `~${fmtTokens(tokens)} tokens re-read on every agent call (warn ${fmtTokens(CACHE_FILE_WARN_TOKENS)})${suffix}`,
       fix));
   }
+
+  // Lifetime signal (ADR-0046 D5): the ledger shows cache WRITES that followed
+  // an idle gap of five to sixty minutes — misses a one-hour subagent cache
+  // lifetime would have turned into hits. Informational and never fixable: the
+  // remedy is a Claude Code setting the user weighs against the 2× write price.
+  try {
+    const ttl = assessCacheTtl(readRecords(cwd).filter(r => !isSuspectRecord(r)));
+    if (ttl.recommend) {
+      findings.push(mkFinding('cache-context', 'info', planningRel(path.join(METRICS_DIR, TOKENS_FILE)), ttl.advice, null));
+    }
+  } catch { /* no ledger, or unreadable — nothing to say */ }
   return { findings };
 }
 
@@ -517,6 +530,18 @@ function checkPlanningFragment(cwd) {
  */
 function scanOneRoot(cwd, root, opts) {
   return withPlanningRoot(root.rel, () => {
+    // A .planning/ written by ANOTHER tool (gsd-core shares the directory name and
+    // PAN's pre-v2.2 uppercase file names) must never be "repaired": the legacy
+    // rename would rename its state files. One warn finding, nothing fixable, and
+    // none of the per-tree checks run on it. Reality check R15.
+    const foreign = detectForeignPlanningTree(planningPath(cwd));
+    if (foreign) {
+      const f = mkFinding('foreign-planning-tree', 'warn', planningRel(),
+        `planning tree belongs to ${foreign.tool} (${foreign.evidence.join(', ')}) — PAN will not rename or repair its files; run PAN with --planning-dir to give it a tree of its own (ADR-0043)`,
+        null);
+      f.track = root.name;
+      return { findings: [f], planning_exists: true };
+    }
     const fragment = checkPlanningFragment(cwd);
     const findings = [
       ...fragment.findings,
@@ -594,6 +619,12 @@ function applyFix(cwd, finding) {
   try {
     switch (fix.action) {
       case 'rename-lowercase': {
+        // Defence in depth for R15: the scan never emits this fix for a foreign tree,
+        // but a stale findings list or a hand-built one must not rename another
+        // tool's files either.
+        if (detectForeignPlanningTree(path.dirname(abs))) {
+          return { applied: false, detail: 'refused: this planning tree belongs to another tool (see the foreign-planning-tree finding)' };
+        }
         // Two-step rename: Windows treats case-only renames inconsistently
         // across fs layers, so hop through a temp name.
         const dir = path.dirname(abs);

package/pan-wizard-core/bin/lib/init.cjs

@@ -10,6 +10,7 @@ const { planningPath, phasesPath, filterPlanFiles, filterSummaryFiles, classifyP
 const { classifyPlanTier } = require('./phase.cjs');
 const { extractFrontmatter } = require('./frontmatter.cjs');
 const { detectLanguages } = require('./codebase.cjs');
+const { detectForeignPlanningTreeAt } = require('./foreign-planning.cjs');
 const { planningRootRel, describePlanningRoot, planningRoots, withPlanningRoot } = require('./planning-root.cjs');
 
 // ---- Git helpers ----
@@ -282,6 +283,13 @@ function cmdInitPlanPhase(cwd, phase, raw) {
  * @returns {void}
  */
 function cmdInitNewProject(cwd, raw) {
+  // Never scaffold PAN's files into a .planning/ another tool owns (R15). The error
+  // key carries the exit code; the fix is a separate tree via --planning-dir.
+  const foreign = detectForeignPlanningTreeAt(cwd);
+  if (foreign) {
+    output({ error: `planning tree belongs to ${foreign.tool}`, evidence: foreign.evidence, fix: 'Run PAN with --planning-dir <dir> to use a separate tree (ADR-0043)' }, raw);
+    return;
+  }
   const config = loadConfig(cwd);
 
   // Detect Brave Search API key availability