diff --git a/README.md b/README.md
index 4422c69..79bd8bb 100644
--- a/README.md
+++ b/README.md
@@ -222,10 +222,10 @@ secrets do not get spread around. `/secrets/README.txt` lists each file and its
 | runtime path → `/secrets/files/…` | what | source |
 |---|---|---|
 | `/srv/cc-ci/.testenv` → `cc-ci.testenv` | `GITEA_PASSWORD` (autonomic-bot: PR/API calls), `DOCKERHUB_USERNAME/TOKEN` (harness image pulls). Nothing else: no tailscale key, no third-party model API keys (opencode's own auth is `opencode-auth.json`; add `TINFOIL_API_KEY` back only if `LOOP_MODEL` moves to a tinfoil model). | old host's copy minus the tailscale line; fresh: create each credential |
-| `/srv/cc-ci/upgrader.env` (not a secret, lives in the checkout) | `LOOP_TIER`, `LOOP_MODEL`, `REPORT_MODEL` for the weekly run | old host, or copy the example in `AGENTS.md` |
+| `/srv/cc-ci/upgrader.env` (not a secret, lives in the checkout) | `LOOP_TIER`, `LOOP_MODEL`, `REPORT_MODEL`, `SUPERVISOR_MODEL` for the weekly run. This host is on the **OpenCode Go subscription** (`LOOP_TIER=go`, `opencode-go/…` models); the ZEN tier is pay-as-you-go credit and its key is not on this host | old host, or copy the example in `AGENTS.md` |
 | `~loops/.ssh/cc-ci-local-ed25519` (+`.pub`) → same names | `ssh cc-ci` as root — to loopback on this host. **Generated on the host**, its pub in `nix/hosts/cc-ci/ssh-keys` | `ssh-keygen -t ed25519 -C cc-ci-loops-to-root@cc-ci` as loops |
 | `~loops/.ssh/autonomic-bot-cc-ci-ed25519` (+`.pub`) → same names | pushes recipe branches / PRs as `autonomic-bot`; root's ssh config points at the same file to clone the private cc-ci-secrets submodule. **Generated on the host** and registered on the bot's Gitea account (`POST /api/v1/user/keys` with the bot password) | `ssh-keygen -t ed25519 -C autonomic-bot@cc-ci-host` as loops |
-| `~loops/.local/share/opencode/auth.json` → `opencode-auth.json`; `~loops/.config/opencode/opencode.jsonc` (config, not secret) | opencode provider auth + config — the orchestrator AND the weekly upgrader are opencode agents; there is no Claude on this host | old host; fresh: `opencode auth login` as loops |
+| `~loops/.local/share/opencode/auth.json` → `opencode-auth.json`; `~loops/.config/opencode/opencode.jsonc` (config, not secret — it must contain NO inline `apiKey`) | opencode provider auth + config. Exactly ONE provider, `opencode-go` — the orchestrator AND the weekly upgrader are opencode agents; there is no Claude on this host | old host; fresh: `opencode auth login` as loops |
 | `/etc/nginx/oc-htpasswd` (root:nginx; the bcrypt line only — the plaintext stays with the operator, not on the host) | basic auth for the opencode UI (`https://oc.ci.commoninternet.net`, via traefik); **nginx refuses to start without it**, and its config check runs as the `nginx` user, so `root:nginx 0640` (the `nginx` group exists after the first rebuild — fix ownership then and `systemctl restart nginx`) | old host (`/secrets/files/oc-basic-auth.txt` has the plaintext), or a new `oc:<bcrypt>` line via `mkpasswd -m bcrypt` |
 
 `~loops/.ssh/config` is written by the activation script on first rebuild (`Host cc-ci` →
diff --git a/cc-ci-plan/agents.toml b/cc-ci-plan/agents.toml
index bdd0719..85371eb 100644
--- a/cc-ci-plan/agents.toml
+++ b/cc-ci-plan/agents.toml
@@ -53,8 +53,8 @@ log_dir = "/srv/cc-ci/.cc-ci-logs"
 [[agent]]
 name    = "orchestrator"       # tmux session: cc-ci-orchestrator
 kind    = "persistent"
-backend = "opencode"           # operator 2026-09-07 (evening): NO Claude on the cc-ci host — the
-model   = "opencode/glm-5.2"   # orchestrator is an opencode agent, steered via the opencode web UI
+backend = "opencode"              # operator 2026-09-07 (evening): NO Claude on the cc-ci host — the
+model   = "opencode-go/glm-5.2"   # orchestrator is an opencode agent, steered via the opencode web UI
                                # (https://oc.ci.commoninternet.net). Claude sessions live on notplants-orchestrator.
 resume  = false                # opencode backend has no --resume equivalent (fresh session each launch)
 watch   = "heal"               # restart if dead / FATAL / backend-mismatch; never stall-reboot