diff --git a/cc-ci-plan/launch-report.py b/cc-ci-plan/launch-report.py
index c55c3ef..dcaadb0 100755
--- a/cc-ci-plan/launch-report.py
+++ b/cc-ci-plan/launch-report.py
@@ -13,7 +13,8 @@ Usage:
   launch-report.py status         show session state
 
 Env: REPORT_BACKEND (default opencode), REPORT_MODEL (default tracks tier),
-     LOOP_TIER / REPORT_TIER (default 'zen'; 'go' or 'zen'; only for opencode),
+     LOOP_TIER / REPORT_TIER (default 'go' — the only tier with a key on this host; ZEN
+     models are dead here; 'go' or 'zen'; only for opencode),
      OPENCODE_SHARE (1=attach web server + public --share link), REPORT_SESSION, REPORT_DIR.
 """
 import os, subprocess, sys, time
@@ -24,9 +25,9 @@ SESSION = os.environ.get("REPORT_SESSION", "cc-ci-report")
 WORKDIR = os.environ.get("REPORT_DIR", "/srv/cc-ci")
 LOG_DIR = os.environ.get("LOG_DIR", "/srv/cc-ci/.cc-ci-logs")
 BACKEND = os.environ.get("REPORT_BACKEND", "opencode")
-TIER = os.environ.get("LOOP_TIER", os.environ.get("REPORT_TIER", "zen"))
+TIER = os.environ.get("LOOP_TIER", os.environ.get("REPORT_TIER", "go"))
 _TIER_MODEL = {"go": "opencode-go/glm-5.2", "zen": "opencode/glm-5.2"}
-_DEFAULT_MODEL = _TIER_MODEL.get(TIER, _TIER_MODEL["zen"]) if BACKEND == "opencode" else "opus"
+_DEFAULT_MODEL = _TIER_MODEL.get(TIER, _TIER_MODEL["go"]) if BACKEND == "opencode" else "opus"
 MODEL   = os.environ.get("REPORT_MODEL", _DEFAULT_MODEL)
 CLAUDE_BIN   = os.environ.get("CLAUDE_BIN", "claude")
 CLAUDE_FLAGS = os.environ.get("CLAUDE_FLAGS", "--dangerously-skip-permissions")
diff --git a/cc-ci-plan/launch-upgrader.py b/cc-ci-plan/launch-upgrader.py
index 2336c18..0f48fe0 100644
--- a/cc-ci-plan/launch-upgrader.py
+++ b/cc-ci-plan/launch-upgrader.py
@@ -44,11 +44,13 @@ WORKDIR = os.environ.get("UPGRADER_DIR",     "/srv/cc-ci")
 LOG_DIR = os.environ.get("LOG_DIR",          "/srv/cc-ci/.cc-ci-logs")
 
 # LOOP_BACKEND / LOOP_MODEL take precedence (unified control from the operator).
-# LOOP_TIER selects the OpenCode subscription: "zen" (default) or "go". Go hit a monthly
-# usage limit; ZEN is the working alternative. Set LOOP_TIER=go when the Go limit resets.
+# LOOP_TIER selects the OpenCode subscription: "go" (DEFAULT — the only tier with a key on
+# this host) or "zen" (opt-in on a host that has a ZEN key). ZEN models are DEAD here — the
+# endpoint errors server-side, and env loss in the tmux→agent→launch-report chain is exactly
+# how it silently ate the 2026-09-18 weekly report. Never default back to zen.
 # Only affects the opencode backend; claude ignores the tier.
 BACKEND = os.environ.get("LOOP_BACKEND", os.environ.get("UPGRADER_BACKEND", "opencode"))
-TIER = os.environ.get("LOOP_TIER", os.environ.get("UPGRADER_TIER", "zen"))
+TIER = os.environ.get("LOOP_TIER", os.environ.get("UPGRADER_TIER", "go"))
 _TIER_CFG = {
     "go":  {"model": "opencode-go/glm-5.2", "endpoint": "https://opencode.ai/zen/go/v1/chat/completions",
             "auth": "opencode-go", "label": "OpenCode Go"},
@@ -58,7 +60,7 @@ _TIER_CFG = {
 if BACKEND == "opencode" and TIER not in _TIER_CFG:
     print(f"[upgrader] ERROR: unknown LOOP_TIER '{TIER}' — use 'go' or 'zen'", flush=True)
     sys.exit(1)
-_tier = _TIER_CFG.get(TIER, _TIER_CFG["zen"])
+_tier = _TIER_CFG.get(TIER, _TIER_CFG["go"])
 _DEFAULT_MODEL = _tier["model"] if BACKEND == "opencode" else "sonnet"
 MODEL   = os.environ.get("LOOP_MODEL",   os.environ.get("UPGRADER_MODEL",   _DEFAULT_MODEL))
 
diff --git a/nix/modules/cc-ci.nix b/nix/modules/cc-ci.nix
index a170ff4..d42936e 100644
--- a/nix/modules/cc-ci.nix
+++ b/nix/modules/cc-ci.nix
@@ -92,15 +92,13 @@
       User = "loops"; Group = "users";
       WorkingDirectory = "/srv/cc-ci";
       # Optional per-run overrides for backend/model (LOOP_BACKEND, LOOP_MODEL, OPENCODE_SHARE,
-      # UPGRADER_ARGS, …). The leading "-" makes it optional: absent file → claude/sonnet defaults.
-      # Current config (as of 2026-08-16): the upgrader + report run on tinfoil/deepseek-v4-pro
-      # (LOOP_MODEL + REPORT_MODEL in the env file); the hourly SUPERVISOR stays on glm-5.2
-      # (SUPERVISOR_MODEL defaults to opencode-go/glm-5.2 in launch-supervisor.py, NOT overridden
-      # here). Subagents bind deepseek via the cc-ci repo's opencode config. LOOP_TIER=zen is kept
-      # so the tier check passes; the watchdog's usage-limit probe sends the deepseek model name to
-      # the zen endpoint, which returns 200 (not 429) → resume immediately (correct: tinfoil has no
-      # rolling usage limit to wait out). No rebuild needed to switch — the env file is read at each
-      # timer fire. Holds no secrets (the tinfoil API key lives in the opencode config / auth.json).
+      # UPGRADER_ARGS, …). The leading "-" makes it optional: absent file → the in-code defaults,
+      # which are opencode + LOOP_TIER=go (the only tier with a key on this host; ZEN models are
+      # dead here — the in-code default is 'go' for exactly that reason, see launch-upgrader.py).
+      # Current config: LOOP_TIER=go with LOOP_MODEL / REPORT_MODEL / SUPERVISOR_MODEL all
+      # opencode-go/glm-5.3-flash (upgrader, report, supervisor). Subagents bind deepseek via the
+      # cc-ci repo's opencode config. No rebuild needed to switch — the env file is read at each
+      # timer fire. Holds no secrets (the API key lives in the opencode config / auth.json).
       EnvironmentFile = "-/srv/cc-ci/upgrader.env";
     };
     environment = { HOME = "/home/loops"; };