diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md
index f16e665..a980d60 100644
--- a/ARCHITECTURE.md
+++ b/ARCHITECTURE.md
@@ -93,7 +93,7 @@ machine-readable", not for parallelism.
 
 | Component | Trigger | Responsibility | Depends on |
 |---|---|---|---|
-| `session-start.mjs` | `SessionStart` | Reads the Codex model/effort pin; emits the setup question (when armed via `~/.maestro/ask-on-start`); appends a validated `MAESTRO_SESSION_ID` export to `$CLAUDE_ENV_FILE` for session attribution | `~/.codex/config.toml`, `~/.codex/maestro-impl-effort` |
+| `session-start.mjs` | `SessionStart` | Reads the Codex model/effort pin; emits the setup question (when armed via `~/.maestro/ask-on-start`); appends a validated `MAESTRO_SESSION_ID` export to `$CLAUDE_ENV_FILE` for session attribution | `~/.codex/config.toml`, `~/.codex/maestro-impl-effort`, `~/.codex/maestro-impl-model` |
 | `orchestrator-inject.mjs` | `UserPromptSubmit` | Resets the direct-edit authorization flag on new tasks; sets it only on an explicit "edit it yourself"-class imperative; emits the orchestrator/implementer directive only when the prompt carries a code/design signal; intercepts "codex model" setup phrasing | `maestro-policy.mjs`, `~/.maestro/direct-edit/` |
 | `orchestrator-gate.mjs` | `PreToolUse` (`Edit\|Write\|MultiEdit`) | Blocks the orchestrator's direct source edits; allows non-code allowlisted files, anchored scratch/Desktop paths, any path carrying a `.claude` or `.codex` segment (harness exemption — segment-based, not root-anchored), and only a session-scoped, owner-private, exact-content direct-edit flag; refuses overrides inside subagents; fails closed on unreadable payloads | `maestro-policy.mjs`, `~/.maestro/direct-edit/` |
 | `maestro-policy.mjs` | (shared module) | Single source of truth for file classification (non-code extensions/basenames), session-id validation, and direct-edit directive parsing with negation/quote guards | none |
@@ -128,7 +128,7 @@ Layering is strict and directional: `lib-process.sh` → `lib-companion.sh` →
 
 | Component | Role |
 |---|---|
-| `codex-model-select.sh` | Transactionally pins Codex model + debate effort (in `~/.codex/config.toml`) and implementation effort (in `~/.codex/maestro-impl-effort`); serialized by its own lock; `--show`, `--pin`, `--ask-on-start on\|off` |
+| `codex-model-select.sh` | Transactionally pins Codex model + debate effort (in `~/.codex/config.toml`) and implementation effort/model (in `~/.codex/maestro-impl-effort` and `~/.codex/maestro-impl-model`); serialized by its own lock; `--show`, `--pin`, `--ask-on-start on\|off` |
 | `codex-mcp-check.sh` | Reports which MCP servers background Codex jobs inherit from `~/.codex/config.toml`, env keys masked |
 
 ### 2.6 Installer / uninstaller (package entry points)
@@ -143,7 +143,7 @@ Layering is strict and directional: `lib-process.sh` → `lib-companion.sh` →
 | Dependency | Role | Boundary |
 |---|---|---|
 | Claude Code | Host runtime; fires hooks; runs the orchestrator model | Contract: hook JSON payloads on stdin, exit codes |
-| Codex CLI + `openai-codex` plugin (`codex-companion.mjs`) | Executes background agent jobs | Contract: `codex task --background [--write] --model … --effort …`, `status --json`, `cancel`, `result`, `status --all --json`; a **compatibility probe** on `--help` refuses write dispatch if `task` is described without `--write` |
+| Codex CLI + `openai-codex` plugin (`codex-companion.mjs`) | Executes background agent jobs | Contract: `codex task --background [--write] --model … [--effort …]`, `status --json`, `cancel`, `result`, `status --all --json`; wrapper-expressible write efforts use `--effort`, while max/ultra omit it only when identical to the pinned top-level `model_reasoning_effort`; a **compatibility probe** on `--help` refuses write dispatch if `task` is described without `--write` |
 | `~/.codex/config.toml` | Codex configuration: model, reasoning efforts, MCP servers, `web_search` | Parsed as TOML; only true top-level keys are trusted |
 | Git | Repository scope, tree digests (`git hash-object --no-filters`), worktree/submodule discovery | Must be present in the working directory |
 
@@ -203,7 +203,7 @@ kill without a recovery daemon.
 | Session-start preference | `~/.maestro/ask-on-start` | Empty marker file; armed by default on first install, managed by `codex-model-select.sh --ask-on-start on\|off` and removed by uninstall | `install.mjs`, `codex-model-select.sh` | `session-start.mjs`, `uninstall.mjs` |
 | Installer ownership manifest | `~/.maestro/install-manifest.json` | `{ "version": 1, "files": { "<key>": "<sha256>" } }`, `0600` | `install.mjs` | `install.mjs`, `uninstall.mjs` |
 | Session identity | `$CLAUDE_ENV_FILE` | `export MAESTRO_SESSION_ID=<validated id>` appended at session start | `session-start.mjs` | All lease/provenance code via `write_lock_session_id` |
-| Codex pin | `~/.codex/config.toml` (top-level `model`, `model_reasoning_effort`), `~/.codex/maestro-impl-effort` | TOML preamble / single line | `codex-model-select.sh` | `companion_pin`, `session-start.mjs` |
+| Codex pin | `~/.codex/config.toml` (top-level `model`, `model_reasoning_effort`), `~/.codex/maestro-impl-effort`, `~/.codex/maestro-impl-model` | TOML preamble / single line | `codex-model-select.sh` | `companion_pin`, `session-start.mjs` |
 | Hook registrations | `~/.claude/settings.json` | `hooks.<event>` blocks with exact `# maestro-managed:<script>` command markers | `install.mjs` | Claude Code |
 | Backups | `*.maestro.bak` beside settings/config | Byte copy of the pre-merge state | `install.mjs` | Operator, uninstall |
 
@@ -289,7 +289,7 @@ implementer-loop.sh --clear-lease
 implementer-watchdog.sh --file <plan-file> [max_idle] [poll]
 discussion-loop.sh --new "<topic>" [slug]
 discussion-loop.sh --turn <file> [slug] [max_idle] [poll]
-codex-model-select.sh --show | --pin | <model> <debate-effort> [impl-effort] | --ask-on-start on|off|status
+codex-model-select.sh --show | --pin | <model> <debate-effort> [impl-effort] [impl-model] | --ask-on-start on|off|status
 codex-mcp-check.sh
 node install.mjs [--with-workflow]
 node uninstall.mjs
@@ -325,7 +325,10 @@ cancellation (unconfirmed quiescence).
 ### 4.4 Companion transport (Maestro → Codex)
 
 Implemented in `lib-companion.sh` via the plugin's `codex-companion.mjs`:
-`task --background [--write] --model <m> --effort <e> <prompt>`,
+`task --background [--write] --model <m> [--effort <e>] <prompt>`;
+write jobs omit `--effort` only for an exact max/ultra match with the pinned
+top-level `model_reasoning_effort`, otherwise the wrapper-expressible effort is
+passed explicitly.
 `status <job> --json`, `cancel <job>`, `result <job>`, `status --all --json`
 (repository-global writer visibility, parsed strictly, session filter
 deliberately stripped). Jobs are identified as `task-<id>-<id>`.
@@ -377,7 +380,7 @@ agent processes. The "production environment" is:
 macOS (primary) / Linux  ──►  Claude Code (ships Node)  ──►  Codex CLI (ChatGPT login)
      ├── ~/.claude/           hooks/, rules/, skills/, settings.json
      ├── ~/.maestro/          install-manifest, discussions/, direct-edit/, ask-on-start
-     ├── ~/.codex/            config.toml, maestro-impl-effort
+     ├── ~/.codex/            config.toml, maestro-impl-effort, maestro-impl-model
      └── <repo>/.git/         maestro-write.lock/, maestro-provenance.log
 ```
 
@@ -432,7 +435,8 @@ Pull requests and pushes to `main` both trigger it. There is no CD — the
   `task` synopsis lacks `--write` (guards against upstream flag drift).
 - The model pin is verified against the launched job's recorded
   `request.model`/`request.effort` (`companion_verify_pin`), warning on
-  mismatch.
+  mismatch; an absent/null effort is accepted only for an exact-match write
+  dispatch that omitted the wrapper flag.
 
 **Boundary statement.** The write path is coupled to the companion transport's
 JSON contract: status fields (`phase`, `elapsed`, `progressPreview`,
@@ -599,7 +603,7 @@ flowchart LR
     HOOKS["Maestro hooks & adapters<br/>(installed into ~/.claude)"]
     GIT[("Working tree + .git<br/>lease lock, provenance log)")]
     MAE[("~/.maestro<br/>manifest, discussions, direct-edit")]
-    COD[("~/.codex<br/>config.toml, effort pin")]
+    COD[("~/.codex<br/>config.toml, effort/model pins")]
 
     U --> CC
     CC --> HOOKS
diff --git a/hooks/codex-model-select.sh b/hooks/codex-model-select.sh
index 08f6bfb..f16f21a 100644
--- a/hooks/codex-model-select.sh
+++ b/hooks/codex-model-select.sh
@@ -1,24 +1,26 @@
 #!/usr/bin/env bash
 # Maestro Codex model + debate/implementation effort selector.
 # Pins top-level model settings in ~/.codex/config.toml and keeps the
-# implementation effort in ~/.codex/maestro-impl-effort and the scout pin in
-# ~/.codex/maestro-scout.
+# implementation effort/model in ~/.codex/maestro-impl-effort and
+# ~/.codex/maestro-impl-model, plus the scout pin in ~/.codex/maestro-scout.
 #
 # Usage:
 #   codex-model-select.sh --show
 #   codex-model-select.sh --pin
 #   codex-model-select.sh --scout <model> <effort>
 #   codex-model-select.sh --scout-pin
-#   codex-model-select.sh <model> <debate-effort> [impl-effort]
+#   codex-model-select.sh <model> <debate-effort> [impl-effort] [impl-model]
 #   codex-model-select.sh --ask-on-start on|off|status
 #
 # Debate effort: none | minimal | low | medium | high | xhigh | max | ultra
-# Implementation effort: none | minimal | low | medium | high | xhigh
+# Implementation effort: none | minimal | low | medium | high | xhigh, or
+# max | ultra only when it exactly matches the top-level debate effort.
 # Exit codes: 0 = ok | 3 = bad args, invalid values, or failed publication
 set -uo pipefail
 
 CODEX_CONF="$HOME/.codex/config.toml"
 IMPL_EFFORT_FILE="$HOME/.codex/maestro-impl-effort"
+IMPL_MODEL_FILE="$HOME/.codex/maestro-impl-model"
 SCOUT_FILE="$HOME/.codex/maestro-scout"
 MAESTRO_DIR="$HOME/.maestro"
 ASK_FLAG="$MAESTRO_DIR/ask-on-start"
@@ -122,6 +124,14 @@ valid_impl_effort() {
   esac
 }
 
+impl_effort_acceptable() { # implementation-effort debate-effort
+  valid_impl_effort "$1" && return 0
+  case "$1" in
+    max|ultra) [ "$1" = "$2" ] ;;
+    *) return 1 ;;
+  esac
+}
+
 valid_model() {
   [[ "$1" =~ ^[a-zA-Z0-9._-]+$ ]]
 }
@@ -218,17 +228,41 @@ read_impl_effort() {
   printf -v "$1" '%s' "${VALUE:-medium}"
 }
 
+read_impl_model() {
+  local VALUE=""
+  if [ -f "$IMPL_MODEL_FILE" ]; then
+    IFS= read -r VALUE < "$IMPL_MODEL_FILE" || :
+  fi
+  printf -v "$1" '%s' "$VALUE"
+}
+
 show() {
-  local M E I SM SE
+  local M E I IM SM SE
   read_pin M E || return 3
   read_impl_effort I
+  read_impl_model IM
   echo "model=${M:-(not pinned — Codex default)}"
   if [ -n "$E" ] && ! valid_effort "$E"; then
     echo "effort=$E (invalid)"
   else
     echo "effort=${E:-(not pinned — Codex default)}"
   fi
-  echo "impl-effort=$I"
+  case "$I" in
+    max|ultra)
+      if [ "$I" = "$E" ]; then
+        echo "impl-effort=$I (via top-level config)"
+      else
+        echo "impl-effort=$I (invalid — top-level effort is $E)"
+      fi ;;
+    *) echo "impl-effort=$I" ;;
+  esac
+  if [ -n "$IM" ] && valid_model "$IM"; then
+    echo "impl-model=$IM"
+  elif [ -f "$IMPL_MODEL_FILE" ] && [ -n "$IM" ]; then
+    echo "impl-model=$IM (invalid)"
+  else
+    echo "impl-model=${M:-(not pinned — Codex default)} (inherited)"
+  fi
   if [ ! -f "$SCOUT_FILE" ]; then
     echo "scout=(not pinned — scout dispatch disabled)"
   else
@@ -243,9 +277,10 @@ show() {
 }
 
 pin() {
-  local M E I
+  local M E I IM
   read_pin M E || return 3
   read_impl_effort I
+  read_impl_model IM
   if [ -z "$M" ] || [ -z "$E" ]; then
     echo "SELECT_ERROR: Codex model and effort must both be pinned in the config.toml preamble" >&2
     return 3
@@ -254,11 +289,16 @@ pin() {
     echo "SELECT_ERROR: invalid debate effort '$E' (expected: none | minimal | low | medium | high | xhigh | max | ultra)" >&2
     return 3
   fi
-  if ! valid_impl_effort "$I"; then
-    echo "SELECT_ERROR: invalid implementation effort '$I' (expected: none | minimal | low | medium | high | xhigh; max/ultra are debate-only because the companion wrapper cannot express them for write jobs)" >&2
+  if ! impl_effort_acceptable "$I" "$E"; then
+    echo "SELECT_ERROR: implementation effort '$I' cannot be expressed per write job (the companion accepts none|minimal|low|medium|high|xhigh); max/ultra are usable only when the top-level debate effort is the same value, currently '$E'" >&2
     return 3
   fi
-  printf '%s\t%s\t%s\n' "$M" "$E" "$I"
+  if [ -n "$IM" ] && ! valid_model "$IM"; then
+    echo "SELECT_ERROR: invalid implementation model '$IM' (expected letters, digits, . _ -)" >&2
+    return 3
+  fi
+  [ -n "$IM" ] || IM="$M"
+  printf '%s\t%s\t%s\t%s\n' "$M" "$E" "$I" "$IM"
 }
 
 stat_mode() {
@@ -319,15 +359,19 @@ render_config() { # source destination model effort
   ' "$source" > "$destination"
 }
 
-publish_pin() { # model debate-effort impl-effort
-  local model="$1" effort="$2" impl="$3"
-  local config_source config_tmp impl_tmp config_original impl_original
-  local config_existed=0 impl_existed=0 config_mode=600 impl_mode=600
+publish_pin() { # model debate-effort impl-effort impl-model
+  local model="$1" effort="$2" impl="$3" impl_model="$4"
+  local config_source config_tmp impl_tmp model_tmp
+  local config_original impl_original model_original
+  local config_existed=0 impl_existed=0 model_existed=0
+  local config_mode=600 impl_mode=600 model_mode=600
   mkdir -p "$HOME/.codex" || return 3
   config_tmp="$CODEX_CONF.mtmp.$$"
   impl_tmp="$IMPL_EFFORT_FILE.mtmp.$$"
+  model_tmp="$IMPL_MODEL_FILE.mtmp.$$"
   config_original="$CODEX_CONF.moriginal.$$"
   impl_original="$IMPL_EFFORT_FILE.moriginal.$$"
+  model_original="$IMPL_MODEL_FILE.moriginal.$$"
 
   if [ -f "$CODEX_CONF" ]; then
     config_existed=1
@@ -348,19 +392,34 @@ publish_pin() { # model debate-effort impl-effort
       return 3
     }
   fi
+  if [ -f "$IMPL_MODEL_FILE" ]; then
+    model_existed=1
+    model_mode=$(stat_mode "$IMPL_MODEL_FILE") || {
+      rm -f "$config_original" "$impl_original"
+      return 3
+    }
+    cp -p "$IMPL_MODEL_FILE" "$model_original" || {
+      rm -f "$config_original" "$impl_original"
+      return 3
+    }
+  fi
 
   if ! render_config "$config_source" "$config_tmp" "$model" "$effort" ||
     ! chmod "$config_mode" "$config_tmp" ||
     ! printf '%s\n' "$impl" > "$impl_tmp" ||
-    ! chmod "$impl_mode" "$impl_tmp"; then
-    rm -f "$config_tmp" "$impl_tmp" "$config_original" "$impl_original"
+    ! chmod "$impl_mode" "$impl_tmp" ||
+    ! printf '%s\n' "$impl_model" > "$model_tmp" ||
+    ! chmod "$model_mode" "$model_tmp"; then
+    rm -f "$config_tmp" "$impl_tmp" "$model_tmp" \
+      "$config_original" "$impl_original" "$model_original"
     echo "SELECT_ERROR: could not stage Codex pin files" >&2
     return 3
   fi
 
   if [ "$config_existed" -eq 1 ] && [ ! -f "$CODEX_CONF.maestro.bak" ]; then
     cp -p "$CODEX_CONF" "$CODEX_CONF.maestro.bak" || {
-      rm -f "$config_tmp" "$impl_tmp" "$config_original" "$impl_original"
+      rm -f "$config_tmp" "$impl_tmp" "$model_tmp" \
+        "$config_original" "$impl_original" "$model_original"
       echo "SELECT_ERROR: could not back up config.toml" >&2
       return 3
     }
@@ -368,7 +427,8 @@ publish_pin() { # model debate-effort impl-effort
   fi
 
   if ! mv -f "$config_tmp" "$CODEX_CONF"; then
-    rm -f "$config_tmp" "$impl_tmp" "$config_original" "$impl_original"
+    rm -f "$config_tmp" "$impl_tmp" "$model_tmp" \
+      "$config_original" "$impl_original" "$model_original"
     echo "SELECT_ERROR: could not publish config.toml" >&2
     return 3
   fi
@@ -379,14 +439,42 @@ publish_pin() { # model debate-effort impl-effort
     else
       rm -f "$CODEX_CONF"
     fi
-    if [ "$impl_existed" -eq 1 ] && [ ! -f "$IMPL_EFFORT_FILE" ]; then
-      cp -p "$impl_original" "$IMPL_EFFORT_FILE" 2>/dev/null || :
+    if [ "$impl_existed" -eq 1 ]; then
+      [ -f "$IMPL_EFFORT_FILE" ] ||
+        cp -p "$impl_original" "$IMPL_EFFORT_FILE" 2>/dev/null || :
+    else
+      rm -f "$IMPL_EFFORT_FILE"
     fi
-    rm -f "$config_tmp" "$impl_tmp" "$config_original" "$impl_original"
+    rm -f "$config_tmp" "$impl_tmp" "$model_tmp" \
+      "$config_original" "$impl_original" "$model_original"
     echo "SELECT_ERROR: could not publish implementation effort; previous pin restored" >&2
     return 3
   fi
-  rm -f "$config_original" "$impl_original"
+  if ! mv -f "$model_tmp" "$IMPL_MODEL_FILE"; then
+    if [ "$config_existed" -eq 1 ]; then
+      mv -f "$config_original" "$CODEX_CONF" 2>/dev/null ||
+        cp -p "$config_original" "$CODEX_CONF" 2>/dev/null || :
+    else
+      rm -f "$CODEX_CONF"
+    fi
+    if [ "$impl_existed" -eq 1 ]; then
+      mv -f "$impl_original" "$IMPL_EFFORT_FILE" 2>/dev/null ||
+        cp -p "$impl_original" "$IMPL_EFFORT_FILE" 2>/dev/null || :
+    else
+      rm -f "$IMPL_EFFORT_FILE"
+    fi
+    if [ "$model_existed" -eq 1 ]; then
+      mv -f "$model_original" "$IMPL_MODEL_FILE" 2>/dev/null ||
+        cp -p "$model_original" "$IMPL_MODEL_FILE" 2>/dev/null || :
+    else
+      rm -f "$IMPL_MODEL_FILE"
+    fi
+    rm -f "$config_tmp" "$impl_tmp" "$model_tmp" \
+      "$config_original" "$impl_original" "$model_original"
+    echo "SELECT_ERROR: could not publish implementation model; previous pin restored" >&2
+    return 3
+  fi
+  rm -f "$config_original" "$impl_original" "$model_original"
   return 0
 }
 
@@ -438,11 +526,15 @@ case "${1:-}" in
     esac
     exit $? ;;
   ""|--help|-h)
-    echo "usage: codex-model-select.sh --show | --pin | --scout <model> <effort> | --scout-pin | <model> <debate-effort> [impl-effort] | --ask-on-start on|off|status" >&2
+    echo "usage: codex-model-select.sh --show | --pin | --scout <model> <effort> | --scout-pin | <model> <debate-effort> [impl-effort] [impl-model] | --ask-on-start on|off|status" >&2
     exit 3 ;;
 esac
 
 pin_lock_acquire || exit 3
+[ "$#" -le 4 ] || {
+  echo "usage: codex-model-select.sh <model> <debate-effort> [impl-effort] [impl-model]" >&2
+  exit 3
+}
 MODEL="${1:-}"
 EFFORT="${2:-}"
 if [ $# -ge 3 ]; then
@@ -450,6 +542,12 @@ if [ $# -ge 3 ]; then
 else
   read_impl_effort IMPL_EFFORT
 fi
+if [ "$#" -eq 4 ]; then
+  IMPL_MODEL="$4"
+else
+  read_impl_model IMPL_MODEL
+  [ -n "$IMPL_MODEL" ] || IMPL_MODEL="$MODEL"
+fi
 
 if ! valid_model "$MODEL"; then
   echo "SELECT_ERROR: invalid model name '$MODEL' (expected e.g. gpt-5.6-sol — letters, digits, . _ -)" >&2
@@ -459,12 +557,16 @@ if ! valid_effort "$EFFORT"; then
   echo "SELECT_ERROR: invalid effort '$EFFORT' (expected: none | minimal | low | medium | high | xhigh | max | ultra)" >&2
   exit 3
 fi
-if ! valid_impl_effort "$IMPL_EFFORT"; then
-  echo "SELECT_ERROR: invalid implementation effort '$IMPL_EFFORT' (expected: none | minimal | low | medium | high | xhigh; max/ultra are debate-only because the companion wrapper cannot express them for write jobs)" >&2
+if ! impl_effort_acceptable "$IMPL_EFFORT" "$EFFORT"; then
+  echo "SELECT_ERROR: implementation effort '$IMPL_EFFORT' cannot be expressed per write job (the companion accepts none|minimal|low|medium|high|xhigh); max/ultra are usable only when the top-level debate effort is the same value, currently '$EFFORT'" >&2
+  exit 3
+fi
+if ! valid_model "$IMPL_MODEL"; then
+  echo "SELECT_ERROR: invalid implementation model '$IMPL_MODEL' (expected letters, digits, . _ -)" >&2
   exit 3
 fi
 
-if ! publish_pin "$MODEL" "$EFFORT" "$IMPL_EFFORT"; then
+if ! publish_pin "$MODEL" "$EFFORT" "$IMPL_EFFORT" "$IMPL_MODEL"; then
   exit 3
 fi
-echo "SELECT: Codex pin updated → model=$MODEL debate-effort=$EFFORT impl-effort=$IMPL_EFFORT (applies from the next dispatch)"
+echo "SELECT: Codex pin updated → model=$MODEL debate-effort=$EFFORT impl-effort=$IMPL_EFFORT impl-model=$IMPL_MODEL (applies from the next dispatch)"
diff --git a/hooks/lib-companion.sh b/hooks/lib-companion.sh
index b7024fb..70d0c11 100644
--- a/hooks/lib-companion.sh
+++ b/hooks/lib-companion.sh
@@ -34,6 +34,14 @@ companion_wrapper_accepts_effort() {
   return 1
 }
 
+companion_effort_acceptable() { # candidate top-level-config-effort
+  companion_wrapper_accepts_effort "$1" && return 0
+  case "$1" in
+    max|ultra) [ "$1" = "$2" ] ;;
+    *) return 1 ;;
+  esac
+}
+
 
 companion_version_is_newer() { # candidate current
   awk -v left="$1" -v right="$2" '
@@ -142,32 +150,40 @@ companion_resolve() {
 }
 
 companion_pin() {
-  local here selector pin model efforts debate_effort impl_effort
+  local here selector pin model fields debate_effort impl_effort impl_model
   here=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
   selector="$here/codex-model-select.sh"
   if ! pin=$(bash "$selector" --pin 2>/dev/null); then
-    echo "no Codex model/effort pinned — run: codex-model-select.sh <model> <debate-effort> <impl-effort>" >&2
+    echo "no Codex model/effort pinned — run: codex-model-select.sh <model> <debate-effort> <impl-effort> <impl-model>" >&2
     return 3
   fi
   case "$pin" in
-    *$'\t'*$'\t'*) ;;
+    *$'\t'*$'\t'*$'\t'*) ;;
     *)
-      echo "no Codex model/effort pinned — run: codex-model-select.sh <model> <debate-effort> <impl-effort>" >&2
+      echo "no Codex model/effort pinned — run: codex-model-select.sh <model> <debate-effort> <impl-effort> <impl-model>" >&2
       return 3 ;;
   esac
   model=${pin%%$'\t'*}
-  efforts=${pin#*$'\t'}
-  debate_effort=${efforts%%$'\t'*}
-  impl_effort=${efforts#*$'\t'}
-  if [ -z "$model" ] || [ -z "$debate_effort" ] || [ -z "$impl_effort" ]; then
-    echo "no Codex model/effort pinned — run: codex-model-select.sh <model> <debate-effort> <impl-effort>" >&2
+  fields=${pin#*$'\t'}
+  debate_effort=${fields%%$'\t'*}
+  fields=${fields#*$'\t'}
+  impl_effort=${fields%%$'\t'*}
+  impl_model=${fields#*$'\t'}
+  if [ -z "$model" ] || [ -z "$debate_effort" ] ||
+    [ -z "$impl_effort" ] || [ -z "$impl_model" ]; then
+    echo "no Codex model/effort pinned — run: codex-model-select.sh <model> <debate-effort> <impl-effort> <impl-model>" >&2
     return 3
   fi
-  if ! companion_wrapper_accepts_effort "$impl_effort"; then
-    echo "unsupported implementation effort '$impl_effort' — choose none|minimal|low|medium|high|xhigh; max/ultra are debate-only" >&2
+  if ! companion_effort_acceptable "$impl_effort" "$debate_effort"; then
+    echo "unsupported implementation effort '$impl_effort' — the companion expresses only none|minimal|low|medium|high|xhigh per write job; max/ultra require the top-level debate effort to be the same value (currently '$debate_effort')" >&2
     return 3
   fi
-  printf '%s\t%s\t%s\n' "$model" "$debate_effort" "$impl_effort"
+  case "$impl_model" in
+    *[!a-zA-Z0-9._-]*)
+      echo "unsupported implementation model '$impl_model' — choose letters, digits, . _ -" >&2
+      return 3 ;;
+  esac
+  printf '%s\t%s\t%s\t%s\n' "$model" "$debate_effort" "$impl_effort" "$impl_model"
 }
 
 companion_start() { # companion prompt mode model effort lifecycle job-file stdout stderr
@@ -200,11 +216,14 @@ companion_start() { # companion prompt mode model effort lifecycle job-file stdo
   [ "$mode" = "write" ] && args+=(--write)
   args+=(--model "$MODEL")
   if [ "$mode" = "write" ]; then
-    if ! companion_wrapper_accepts_effort "$EFFORT"; then
+    if companion_wrapper_accepts_effort "$EFFORT"; then
+      args+=(--effort "$EFFORT")
+    elif companion_effort_acceptable "$EFFORT" "${COMPANION_CONFIG_EFFORT:-}"; then
+      progress "CODEX: companion cannot express implementation effort=$EFFORT as a flag; the pinned top-level config value is the same tier and governs this write dispatch"
+    else
       echo "companion cannot express implementation effort=$EFFORT; refusing to silently substitute the debate tier" >&2
       return 3
     fi
-    args+=(--effort "$EFFORT")
   elif companion_wrapper_accepts_effort "$EFFORT"; then
     args+=(--effort "$EFFORT")
   else
@@ -263,6 +282,18 @@ companion_verify_pin() { # companion job model effort lifecycle stdout stderr
     [ "$RECORDED_WRITE" = false ]; then
     return 0
   fi
+  # A write with max/ultra may omit --effort only when the pinned top-level
+  # config carries the identical tier; an absent/null recorded effort is then
+  # the companion's representation of that omitted flag.
+  case "$EXPECTED_EFFORT" in
+    max|ultra)
+      if [ "$RECORDED_MODEL" = "$EXPECTED_MODEL" ] &&
+        [ "$RECORDED_WRITE" = true ] &&
+        [ "${COMPANION_CONFIG_EFFORT:-}" = "$EXPECTED_EFFORT" ] &&
+        { [ -z "$EFFORT_FIELD" ] || [ "$RECORDED_EFFORT" = "null" ]; }; then
+        return 0
+      fi ;;
+  esac
   echo "Codex pin verification warning for $JOB: requested model=$EXPECTED_MODEL effort=$EXPECTED_EFFORT; recorded model=$RECORDED_MODEL effort=$RECORDED_EFFORT" >&2
   return 4
 }
@@ -623,7 +654,7 @@ _companion_turn_cleanup() { # profile-file [retain-job-lock]
 companion_turn() { # mode prompt-file max-idle poll result-file profile-file evidence-file lifecycle
   local mode="${1-}" prompt_file="${2-}" max_idle="${3-}" poll="${4-}"
   local result="${5-}" profile="${6-}" evidence="${7-}" lifecycle="${8-}"
-  local prompt C pin efforts model effort job rc cleanup_rc derived
+  local prompt C pin fields model debate_effort effort impl_model job rc cleanup_rc derived
   local override_model="${MAESTRO_COMPANION_MODEL-}"
   local override_effort="${MAESTRO_COMPANION_EFFORT-}"
   local override_model_set=0 override_effort_set=0
@@ -663,11 +694,19 @@ companion_turn() { # mode prompt-file max-idle poll result-file profile-file evi
   C=$(companion_resolve) || return 3
   pin=$(companion_pin) || return 3
   model=${pin%%$'\t'*}
-  efforts=${pin#*$'\t'}
+  fields=${pin#*$'\t'}
+  debate_effort=${fields%%$'\t'*}
+  # ~/.codex/config.toml carries this top-level value; Codex uses it when a
+  # task omits --effort, and this is the only channel companion_start has for it.
+  COMPANION_CONFIG_EFFORT="$debate_effort"
+  fields=${fields#*$'\t'}
+  effort=${fields%%$'\t'*}
+  impl_model=${fields#*$'\t'}
   if [ "$mode" = write ]; then
-    effort=${efforts#*$'\t'}
+    model=$impl_model
   else
-    effort=${efforts%%$'\t'*}
+    fields=${pin#*$'\t'}
+    effort=${fields%%$'\t'*}
   fi
   [ "${MAESTRO_COMPANION_MODEL+x}" = x ] && override_model_set=1
   [ "${MAESTRO_COMPANION_EFFORT+x}" = x ] && override_effort_set=1
diff --git a/hooks/orchestrator-inject.mjs b/hooks/orchestrator-inject.mjs
index cb32daa..b2bf1d5 100644
--- a/hooks/orchestrator-inject.mjs
+++ b/hooks/orchestrator-inject.mjs
@@ -97,13 +97,17 @@ if (directiveOpensGate(prompt)) {
 // it before the code-signal logic so "codex model" never triggers the work loop.
 if (/(codex (model|settings|effort|config)|pick (the )?codex|change codex|set codex)/i.test(prompt)) {
   process.stdout.write(
-    'CODEX MODEL SETUP — ask the user for the Codex model and separate role-specific efforts.\n' +
+    'CODEX MODEL SETUP — ask the user for the debate model, implementation model, and separate role-specific efforts.\n' +
     'Show current settings first:  bash ~/.claude/hooks/codex-model-select.sh --show\n' +
     'Debate effort governs read-only discussions; implementation effort governs write jobs.\n' +
-    'minimal/low = quick mechanics, medium = default, high = delicate work; max/ultra are\n' +
-    'debate-only because the companion cannot express them for write jobs.\n' +
-    'Apply their picks:  bash ~/.claude/hooks/codex-model-select.sh <model> <debate-effort> <impl-effort>\n' +
-    'and confirm all three values in one line.'
+    'Implementation model — default: gpt-5.6-luna at effort max.\n' +
+    'Alternatives: gpt-5.6-sol at low | medium | high; gpt-5.6-luna at xhigh;\n' +
+    "gpt-5.6-terra at xhigh or max. Availability depends on the user's ChatGPT plan.\n" +
+    'Debate default stays: model gpt-5.6-sol, effort max.\n' +
+    'max/ultra work on the implementation side only when the debate effort is the same value —\n' +
+    'the companion cannot pass them as a per-job flag, so the pinned top-level config value is what delivers that tier.\n' +
+    'Apply their picks:  bash ~/.claude/hooks/codex-model-select.sh <model> <debate-effort> <impl-effort> <impl-model>\n' +
+    'and confirm all four values in one line.'
   );
   process.exit(0);
 }
diff --git a/hooks/session-start.mjs b/hooks/session-start.mjs
index 62ea310..bb59afa 100644
--- a/hooks/session-start.mjs
+++ b/hooks/session-start.mjs
@@ -14,6 +14,7 @@ try { payload = JSON.parse(fs.readFileSync(0, 'utf8')); } catch {}
 const HOME = os.homedir();
 const CONF = path.join(HOME, '.codex', 'config.toml');
 const IMPL_EFFORT = path.join(HOME, '.codex', 'maestro-impl-effort');
+const IMPL_MODEL = path.join(HOME, '.codex', 'maestro-impl-model');
 const SCOUT_PIN = path.join(HOME, '.codex', 'maestro-scout');
 const ASK = path.join(HOME, '.maestro', 'ask-on-start');
 
@@ -30,6 +31,15 @@ const debateEffort = pinnedDebateEffort || '(Codex default — not pinned)';
 const hasDispatchPin = Boolean(pinnedModel && pinnedDebateEffort);
 let implEffort = 'medium';
 try { implEffort = fs.readFileSync(IMPL_EFFORT, 'utf8').trim() || 'medium'; } catch {}
+let implModel = model;
+let hasImplModelPin = false;
+try {
+  const candidate = fs.readFileSync(IMPL_MODEL, 'utf8').trim();
+  if (/^[a-zA-Z0-9._-]+$/.test(candidate)) {
+    implModel = candidate;
+    hasImplModelPin = true;
+  }
+} catch {}
 let scout = 'unpinned';
 try {
   const pin = fs.readFileSync(SCOUT_PIN, 'utf8');
@@ -58,22 +68,25 @@ if (armed && source !== 'resume') {
     'Show the current pin first:\n' +
     '  bash ~/.claude/hooks/codex-model-select.sh --show\n' +
     'Then use the AskUserQuestion tool as an interactive picker, not a prose question, to ask:\n' +
-    `  1) Codex model for this session — current: ${model}. Availability depends on the user's\n` +
-    '     ChatGPT plan (e.g. gpt-5.6-sol if the plan reaches it).\n' +
+    `  1) Debate model for this session — current: ${model}.\n` +
     `  2) Debate/design effort — current: ${debateEffort}.\n` +
     `  3) Implementation effort — current: ${implEffort}.\n` +
-    'The real tiers are: none | minimal | low | medium | high | xhigh | max | ultra.\n' +
-    'max and ultra are available for debate/design only because the companion wrapper cannot\n' +
-    'express them as an explicit per-job implementation effort.\n' +
-    'Then apply their picks:  bash ~/.claude/hooks/codex-model-select.sh <model> <debate-effort> <impl-effort>\n' +
-    'and confirm the new settings in one line. “Keep current” is valid only when the current pin is\n' +
+    `  4) Implementation model — current: ${implModel}.\n` +
+    'Implementation model — default: gpt-5.6-luna at effort max.\n' +
+    'Alternatives: gpt-5.6-sol at low | medium | high; gpt-5.6-luna at xhigh;\n' +
+    "gpt-5.6-terra at xhigh or max. Availability depends on the user's ChatGPT plan.\n" +
+    'Debate default stays: model gpt-5.6-sol, effort max.\n' +
+    'max/ultra work on the implementation side only when the debate effort is the same value —\n' +
+    'the companion cannot pass them as a per-job flag, so the pinned top-level config value is what delivers that tier.\n' +
+    'Then apply their picks:  bash ~/.claude/hooks/codex-model-select.sh <model> <debate-effort> <impl-effort> <impl-model>\n' +
+    'and confirm all four settings in one line. “Keep current” is valid only when the current pin is\n' +
     (hasDispatchPin
       ? 'complete; if the user declines or skips, preserve it and proceed.\n'
       : 'NOT complete: explain that Maestro cannot dispatch Codex until values are selected; do not claim setup succeeded.\n')
   );
 } else {
   process.stdout.write(
-    `Maestro: Codex pin is model=${model}, debate-effort=${debateEffort}, impl-effort=${implEffort}, scout=${scout}. ` +
+    `Maestro: Codex pin is model=${model}, debate-effort=${debateEffort}, impl-effort=${implEffort}, impl-model=${implModel}${hasImplModelPin ? '' : ' (inherited)'}, scout=${scout}. ` +
     'Say "codex model" to change it before starting work' +
     (armed
       ? '.'
diff --git a/rules/orchestrator-implementer.md b/rules/orchestrator-implementer.md
index ac09658..0082356 100644
--- a/rules/orchestrator-implementer.md
+++ b/rules/orchestrator-implementer.md
@@ -5,14 +5,16 @@
 
 ## Codex model & effort
 
-At session start a hook asks which Codex model and role-specific reasoning efforts to use (or shows the current pin). Discussion and implementation share the model but keep separate effort tiers. Mid-session, the user can say "codex model" to change them; apply with:
+At session start a hook asks which Codex models and role-specific reasoning efforts to use (or shows the current pin). Discussion and implementation each carry their own model and their own effort tier. Mid-session, the user can say "codex model" to change them; apply with:
 
 ```
 bash ~/.claude/hooks/codex-model-select.sh --show
-bash ~/.claude/hooks/codex-model-select.sh <model> <debate-effort> <impl-effort>
+bash ~/.claude/hooks/codex-model-select.sh <model> <debate-effort> <impl-effort> <impl-model>
 ```
 
-Effort guide: minimal/low for quick mechanical work, medium for default implementation, and **high for architecture debates, delicate refactors, and final-review judgment**. Debate effort may also use max/ultra through top-level Codex config; implementation effort is limited to none/minimal/low/medium/high/xhigh because the companion must express it explicitly per write job. Never accept a silent fallback from an unsupported implementation tier. Model availability depends on the user's ChatGPT plan; the script validates the name's shape only, and Codex itself rejects a model it cannot reach. “Keep current” is usable only when `--pin` succeeds; a fresh unpinned install cannot dispatch until the user selects values.
+Name `<impl-model>` explicitly. Omitting it keeps an existing implementation pin, but on a fresh unpinned install it silently inherits `<model>`, which is not the intended implementation default.
+
+Effort guide: minimal/low for quick mechanical work, medium for default implementation, and **high for architecture debates, delicate refactors, and final-review judgment**. Debate effort may also use max/ultra through top-level Codex config; implementation effort uses none/minimal/low/medium/high/xhigh per write job, while max/ultra are allowed only when the implementation effort exactly matches the pinned top-level debate effort and the companion omits the per-job flag. Never accept a silent fallback from an unsupported implementation tier. Model availability depends on the user's ChatGPT plan; the script validates the name's shape only, and Codex itself rejects a model it cannot reach. “Keep current” is usable only when `--pin` succeeds; a fresh unpinned install cannot dispatch until the user selects values.
 
 ## Dispatch
 
diff --git a/tests/bounded-calls.sh b/tests/bounded-calls.sh
index 125ad14..156aa73 100755
--- a/tests/bounded-calls.sh
+++ b/tests/bounded-calls.sh
@@ -89,7 +89,7 @@ t0c_failed_started_publication_cancels_job() (
   local evidence="$TEST_ROOT/publication-failure.evidence"
   local calls="$TEST_ROOT/publication-failure.calls" rc
   companion_resolve() { printf '%s' "$FIXTURE"; }
-  companion_pin() { printf 'gpt-5.6-sol\thigh\thigh\n'; }
+  companion_pin() { printf 'gpt-5.6-sol\thigh\thigh\tgpt-5.6-luna-max\n'; }
   reject_started() {
     [ "$1" != started ]
   }
@@ -108,6 +108,87 @@ t0c_failed_started_publication_cancels_job() (
     { echo "profile omitted publication failure"; return 1; }
 )
 
+t0e_role_dispatch_uses_pinned_models() (
+  local read_prompt="$TEST_ROOT/model-routing-read.prompt"
+  local read_result="$TEST_ROOT/model-routing-read.result"
+  local read_profile="$TEST_ROOT/model-routing-read.profile"
+  local read_evidence="$TEST_ROOT/model-routing-read.evidence"
+  local read_argv="$TEST_ROOT/model-routing-read.argv"
+  local write_prompt="$TEST_ROOT/model-routing-write.prompt"
+  local write_result="$TEST_ROOT/model-routing-write.result"
+  local write_profile="$TEST_ROOT/model-routing-write.profile"
+  local write_evidence="$TEST_ROOT/model-routing-write.evidence"
+  local write_argv="$TEST_ROOT/model-routing-write.argv" rc
+  companion_resolve() { printf '%s' "$FIXTURE"; }
+  companion_pin() { printf 'gpt-5.6-sol\thigh\thigh\tgpt-5.6-luna-max\n'; }
+  write_lifecycle() { return 0; }
+  printf 'read objective\n' > "$read_prompt"
+  export MAESTRO_TEST_ARGV="$read_argv"
+  companion_turn read "$read_prompt" 2 1 "$read_result" "$read_profile" \
+    "$read_evidence" :
+  rc=$?
+  [ "$rc" -eq 0 ] || { echo "read dispatch rc=$rc"; return 1; }
+  grep -Fq '"--model","gpt-5.6-sol"' "$read_argv" ||
+    { echo "read dispatch used the implementation model: $(cat "$read_argv")"; return 1; }
+  printf 'write objective\n' > "$write_prompt"
+  export MAESTRO_TEST_ARGV="$write_argv"
+  companion_turn write "$write_prompt" 2 1 "$write_result" "$write_profile" \
+    "$write_evidence" write_lifecycle
+  rc=$?
+  [ "$rc" -eq 0 ] || { echo "write dispatch rc=$rc"; return 1; }
+  grep -Fq '"--model","gpt-5.6-luna-max"' "$write_argv" ||
+    { echo "write dispatch used the debate model: $(cat "$write_argv")"; return 1; }
+  grep -Fq '"--effort","high"' "$write_argv" ||
+    { echo "write dispatch omitted explicit high effort: $(cat "$write_argv")"; return 1; }
+)
+
+t0f_matching_top_level_effort_omits_write_flag() (
+  local argv="$TEST_ROOT/max-write.argv" calls="$TEST_ROOT/max-write.calls"
+  local job_file="$TEST_ROOT/max-write.job" out="$TEST_ROOT/max-write.stdout"
+  local err="$TEST_ROOT/max-write.stderr" warning="$TEST_ROOT/max-write.warning"
+  local output job rc
+  : > "$calls"
+  export MAESTRO_TEST_ARGV="$argv" MAESTRO_TEST_CALL_LOG="$calls"
+  export COMPANION_CONFIG_EFFORT=max
+  output=$(companion_start "$FIXTURE" objective write \
+    gpt-5.6-luna max : "$job_file" "$out" "$err" 3>&1 2>&1)
+  rc=$?
+  [ "$rc" -eq 0 ] || { echo "matching max write rc=$rc output=$output"; return 1; }
+  [ -s "$argv" ] || { echo "matching max write did not launch a task"; return 1; }
+  ! grep -Fq '"--effort"' "$argv" ||
+    { echo "matching max write passed an effort flag: $(cat "$argv")"; return 1; }
+  grep -q '^task ' "$calls" || { echo "matching max write did not launch a task"; return 1; }
+  case "$output" in
+    *'CODEX: companion cannot express implementation effort=max as a flag; the pinned top-level config value is the same tier and governs this write dispatch'*) ;;
+    *) echo "matching max progress missing: $output"; return 1 ;;
+  esac
+  job=$(cat "$job_file")
+  companion_verify_pin "$FIXTURE" "$job" gpt-5.6-luna max : "$out" "$err"
+  rc=$?
+  [ "$rc" -eq 0 ] || { echo "matching max pin verification rc=$rc"; return 1; }
+  export COMPANION_CONFIG_EFFORT=high
+  companion_verify_pin "$FIXTURE" "$job" gpt-5.6-luna max : "$out" "$err" \
+    2> "$warning"
+  rc=$?
+  [ "$rc" -eq 4 ] || { echo "mismatched max pin verification rc=$rc"; return 1; }
+  grep -Fq "Codex pin verification warning for $job" "$warning" ||
+    { echo "mismatched max pin verification warning missing: $(cat "$warning")"; return 1; }
+)
+
+t0g_mismatched_top_level_effort_refuses_write() (
+  local argv="$TEST_ROOT/mismatch-write.argv" calls="$TEST_ROOT/mismatch-write.calls"
+  local job_file="$TEST_ROOT/mismatch-write.job" out="$TEST_ROOT/mismatch-write.stdout"
+  local err="$TEST_ROOT/mismatch-write.stderr" output rc
+  : > "$calls"
+  export MAESTRO_TEST_ARGV="$argv" MAESTRO_TEST_CALL_LOG="$calls"
+  output=$(COMPANION_CONFIG_EFFORT=high companion_start "$FIXTURE" objective write \
+    gpt-5.6-luna max : "$job_file" "$out" "$err" 3>&1 2>&1)
+  rc=$?
+  [ "$rc" -ne 0 ] || { echo "mismatched max write was accepted: $output"; return 1; }
+  ! grep -q '^task ' "$calls" || { echo "mismatched max write launched a task"; return 1; }
+  [ ! -e "$argv" ] || { echo "mismatched max write produced task argv"; return 1; }
+)
+
 t0d_read_interrupt_never_cancels_unknown_writer() (
   local evidence="$TEST_ROOT/read-interrupt.evidence"
   local calls="$TEST_ROOT/read-interrupt.calls"
@@ -503,6 +584,9 @@ printf '=== Bounded companion calls verification ===\n'
 check t0_process_module_contract "deep process module owns bounded output and rc"
 check t0b_companion_module_contract "companion interface requires an explicit mode"
 check t0c_failed_started_publication_cancels_job "failed launch publication cancels the unpublished job"
+check t0e_role_dispatch_uses_pinned_models "read and write dispatches use their pinned models"
+check t0f_matching_top_level_effort_omits_write_flag "matching top-level effort omits the write effort flag"
+check t0g_mismatched_top_level_effort_refuses_write "mismatched top-level effort refuses the write dispatch"
 check t0d_read_interrupt_never_cancels_unknown_writer "read interrupt never cancels an unknown writer"
 check t1_hanging_status_is_bounded "hanging status honors the companion timeout"
 check t2_timeout_reaps_process_group "timeout returns 125 and reaps the process group"
diff --git a/tests/fixtures/fake-companion.mjs b/tests/fixtures/fake-companion.mjs
index ec63226..502bbae 100644
--- a/tests/fixtures/fake-companion.mjs
+++ b/tests/fixtures/fake-companion.mjs
@@ -27,6 +27,24 @@ function nextSequenceValue(file, fallback) {
   return values[0];
 }
 
+function readRecordedArgv() {
+  if (!process.env.MAESTRO_TEST_ARGV) return null;
+  try {
+    const argv = JSON.parse(fs.readFileSync(process.env.MAESTRO_TEST_ARGV, "utf8"));
+    return Array.isArray(argv) ? argv : null;
+  } catch {
+    return null;
+  }
+}
+
+function requestedFlag(name, fallback, argv = readRecordedArgv()) {
+  if (!Array.isArray(argv)) return fallback;
+  const index = argv.indexOf(name);
+  return index >= 0 && typeof argv[index + 1] === "string"
+    ? argv[index + 1]
+    : null;
+}
+
 if (command === "--help") {
   appendCall("--help");
   const delay = Number(process.env.MAESTRO_TEST_HELP_DELAY ?? "0");
@@ -130,13 +148,20 @@ if (command === "status" && args.at(-1) === "--json") {
         process.env.MAESTRO_TEST_JOB_PHASE_FILE,
         process.env.MAESTRO_TEST_JOB_PHASE ?? "completed"
       );
+  const recordedArgv = readRecordedArgv();
+  const requestedModel = requestedFlag("--model", "gpt-5.6-sol", recordedArgv);
+  const requestedEffort = requestedFlag("--effort", "high", recordedArgv);
+  const request = { model: requestedModel, effort: requestedEffort };
+  if (Array.isArray(recordedArgv)) {
+    request.write = recordedArgv.includes("--write");
+  }
   const job = {
     id: args[0],
     status,
     phase: status === "running" ? "running" : "done",
     elapsed: "1s",
     progressPreview: [],
-    request: { model: "gpt-5.6-sol", effort: "high" }
+    request
   };
   if (process.env.MAESTRO_TEST_LOGFILE) {
     job.logFile = process.env.MAESTRO_TEST_LOGFILE;
diff --git a/tests/model-selector.sh b/tests/model-selector.sh
index b19d3b2..f605661 100644
--- a/tests/model-selector.sh
+++ b/tests/model-selector.sh
@@ -47,7 +47,7 @@ EOF
   printf '%s\n' "$nested" | grep -qx '  model = "nested-model"' || { echo "nested model changed: $nested"; return 1; }
   printf '%s\n' "$nested" | grep -qx '  model_reasoning_effort = "low"' || { echo "nested effort changed: $nested"; return 1; }
   [ "$(cat "$impl")" = low ] || { echo "implementation effort not updated"; return 1; }
-  [ "$(HOME="$home" bash "$SELECTOR" --pin)" = $'gpt-5.6-sol\thigh\tlow' ] ||
+  [ "$(HOME="$home" bash "$SELECTOR" --pin)" = $'gpt-5.6-sol\thigh\tlow\tgpt-5.6-sol' ] ||
     { echo "--pin disagrees with written values"; return 1; }
 }
 
@@ -95,17 +95,17 @@ EOF
 
 t4_rejects_unexpressible_implementation_effort() {
   local home config impl output rc
-  home=$(new_home reject-impl-ultra)
+  home=$(new_home reject-impl-max)
   config="$home/.codex/config.toml"
   impl="$home/.codex/maestro-impl-effort"
   printf 'model = "old-model"\nmodel_reasoning_effort = "medium"\n' > "$config"
   printf 'medium\n' > "$impl"
   cp "$config" "$home/config.before"
   cp "$impl" "$home/impl.before"
-  output=$(HOME="$home" bash "$SELECTOR" new-model high ultra 2>&1); rc=$?
+  output=$(HOME="$home" bash "$SELECTOR" new-model high max 2>&1); rc=$?
   [ "$rc" -eq 3 ] || { echo "rc=$rc want 3: $output"; return 1; }
-  case "$output" in *'implementation effort'*'none | minimal | low | medium | high | xhigh'*) ;; *)
-    echo "rejection did not explain wrapper-supported implementation tiers: $output"; return 1 ;; esac
+  [ "$output" = "SELECT_ERROR: implementation effort 'max' cannot be expressed per write job (the companion accepts none|minimal|low|medium|high|xhigh); max/ultra are usable only when the top-level debate effort is the same value, currently 'high'" ] ||
+    { echo "unexpected rejection: $output"; return 1; }
   cmp -s "$config" "$home/config.before" || { echo "config changed after rejected implementation effort"; return 1; }
   cmp -s "$impl" "$home/impl.before" || { echo "implementation file changed after rejection"; return 1; }
 }
@@ -148,7 +148,144 @@ EOF
   [ "$a_rc" -eq 0 ] && [ "$b_rc" -eq 0 ] ||
     { echo "selector rc values A=$a_rc B=$b_rc; A=$(cat "$home/a.out") B=$(cat "$home/b.out")"; return 1; }
   final=$(HOME="$home" bash "$SELECTOR" --pin) || return 1
-  [ "$final" = $'model-b\tlow\tlow' ] || { echo "concurrent final pin is torn or reordered: $final"; return 1; }
+  [ "$final" = $'model-b\tlow\tlow\tmodel-a' ] || { echo "concurrent final pin is torn or reordered: $final"; return 1; }
+}
+
+t6_publishes_and_shows_implementation_model() {
+  local home config impl output pin show
+  home=$(new_home impl-model)
+  config="$home/.codex/config.toml"
+  impl="$home/.codex/maestro-impl-effort"
+  printf 'model = "old-model"\nmodel_reasoning_effort = "medium"\n' > "$config"
+  printf 'medium\n' > "$impl"
+  output=$(HOME="$home" bash "$SELECTOR" gpt-5.6-sol max xhigh gpt-5.6-luna-max 2>&1) ||
+    { echo "selector failed: $output"; return 1; }
+  pin=$(HOME="$home" bash "$SELECTOR" --pin) || return 1
+  [ "$pin" = $'gpt-5.6-sol\tmax\txhigh\tgpt-5.6-luna-max' ] ||
+    { echo "pin=$pin"; return 1; }
+  show=$(HOME="$home" bash "$SELECTOR" --show) || return 1
+  case "$show" in *'impl-model=gpt-5.6-luna-max'*) ;; *)
+    echo "show omitted implementation model: $show"; return 1 ;; esac
+}
+
+t7_missing_implementation_model_is_inherited() {
+  local home config impl pin show
+  home=$(new_home inherited)
+  config="$home/.codex/config.toml"
+  impl="$home/.codex/maestro-impl-effort"
+  printf 'model = "gpt-5.6-sol"\nmodel_reasoning_effort = "high"\n' > "$config"
+  printf 'high\n' > "$impl"
+  pin=$(HOME="$home" bash "$SELECTOR" --pin) || return 1
+  [ "$pin" = $'gpt-5.6-sol\thigh\thigh\tgpt-5.6-sol' ] ||
+    { echo "inherited pin=$pin"; return 1; }
+  show=$(HOME="$home" bash "$SELECTOR" --show) || return 1
+  case "$show" in *'impl-model=gpt-5.6-sol (inherited)'*) ;; *)
+    echo "show omitted inherited marker: $show"; return 1 ;; esac
+}
+
+t8_corrupt_implementation_model_fails_pin() {
+  local home config impl output rc
+  home=$(new_home corrupt-impl-model)
+  config="$home/.codex/config.toml"
+  impl="$home/.codex/maestro-impl-effort"
+  printf 'model = "gpt-5.6-sol"\nmodel_reasoning_effort = "high"\n' > "$config"
+  printf 'high\n' > "$impl"
+  printf 'bad model!\n' > "$home/.codex/maestro-impl-model"
+  output=$(HOME="$home" bash "$SELECTOR" --pin 2>&1); rc=$?
+  [ "$rc" -eq 3 ] || { echo "rc=$rc want 3: $output"; return 1; }
+  case "$output" in *'SELECT_ERROR:'*"invalid implementation model"*) ;; *)
+    echo "corrupt model error missing: $output"; return 1 ;; esac
+}
+
+t9_three_argument_repin_preserves_implementation_model() {
+  local home config impl model pin output
+  home=$(new_home preserve-impl-model)
+  config="$home/.codex/config.toml"
+  impl="$home/.codex/maestro-impl-effort"
+  model="$home/.codex/maestro-impl-model"
+  printf 'model = "old-model"\nmodel_reasoning_effort = "medium"\n' > "$config"
+  printf 'medium\n' > "$impl"
+  printf 'gpt-5.6-luna-max\n' > "$model"
+  output=$(HOME="$home" bash "$SELECTOR" gpt-5.6-sol high low 2>&1) ||
+    { echo "selector failed: $output"; return 1; }
+  pin=$(HOME="$home" bash "$SELECTOR" --pin) || return 1
+  [ "$pin" = $'gpt-5.6-sol\thigh\tlow\tgpt-5.6-luna-max' ] ||
+    { echo "three-argument repin changed implementation model: $pin"; return 1; }
+}
+
+t10_failed_implementation_model_publish_rolls_back_all_files() {
+  local home config impl model shim real_mv output rc
+  home=$(new_home rollback-impl-model)
+  config="$home/.codex/config.toml"
+  impl="$home/.codex/maestro-impl-effort"
+  model="$home/.codex/maestro-impl-model"
+  shim="$home/shim"
+  real_mv=$(command -v mv)
+  mkdir -p "$shim"
+  printf 'model = "old-model"\nmodel_reasoning_effort = "medium"\n' > "$config"
+  printf 'medium\n' > "$impl"
+  printf 'old-impl-model\n' > "$model"
+  cp "$config" "$home/config.before"
+  cp "$impl" "$home/impl.before"
+  cp "$model" "$home/model.before"
+  cat > "$shim/mv" <<EOF
+#!/usr/bin/env bash
+last="\${!#}"
+if [ "\$last" = "$model" ] && [ ! -e "$home/failed-once" ]; then
+  : > "$home/failed-once"
+  exit 1
+fi
+exec "$real_mv" "\$@"
+EOF
+  chmod +x "$shim/mv"
+  output=$(HOME="$home" PATH="$shim:$PATH" bash "$SELECTOR" new-model high low new-impl-model 2>&1); rc=$?
+  [ "$rc" -ne 0 ] || { echo "failed publish returned success: $output"; return 1; }
+  case "$output" in *'implementation model'*'previous pin restored'*) ;; *)
+    echo "model publication error missing: $output"; return 1 ;; esac
+  cmp -s "$config" "$home/config.before" || { echo "config was not rolled back"; return 1; }
+  cmp -s "$impl" "$home/impl.before" || { echo "impl effort was not rolled back"; return 1; }
+  cmp -s "$model" "$home/model.before" || { echo "impl model was not rolled back"; return 1; }
+}
+
+t11_matching_top_level_max_is_valid() {
+  local home config impl output pin show
+  home=$(new_home matching-top-level-max)
+  config="$home/.codex/config.toml"
+  impl="$home/.codex/maestro-impl-effort"
+  printf 'model = "old-model"\nmodel_reasoning_effort = "medium"\n' > "$config"
+  printf 'medium\n' > "$impl"
+  output=$(HOME="$home" bash "$SELECTOR" gpt-5.6-luna max max 2>&1) ||
+    { echo "selector rejected exact max match: $output"; return 1; }
+  pin=$(HOME="$home" bash "$SELECTOR" --pin) || return 1
+  [ "$pin" = $'gpt-5.6-luna\tmax\tmax\tgpt-5.6-luna' ] ||
+    { echo "pin=$pin"; return 1; }
+  show=$(HOME="$home" bash "$SELECTOR" --show) || return 1
+  case "$show" in *'impl-effort=max (via top-level config)'*) ;; *)
+    echo "show omitted exact-match diagnostic: $show"; return 1 ;; esac
+}
+
+t12_stored_mismatched_max_fails_pin() {
+  local home output show rc
+  home=$(new_home stored-mismatched-max)
+  printf 'model = "gpt-5.6-sol"\nmodel_reasoning_effort = "high"\n' > "$home/.codex/config.toml"
+  printf 'max\n' > "$home/.codex/maestro-impl-effort"
+  output=$(HOME="$home" bash "$SELECTOR" --pin 2>&1); rc=$?
+  [ "$rc" -eq 3 ] || { echo "rc=$rc want 3: $output"; return 1; }
+  [ "$output" = "SELECT_ERROR: implementation effort 'max' cannot be expressed per write job (the companion accepts none|minimal|low|medium|high|xhigh); max/ultra are usable only when the top-level debate effort is the same value, currently 'high'" ] ||
+    { echo "unexpected stored-pin rejection: $output"; return 1; }
+  show=$(HOME="$home" bash "$SELECTOR" --show) || return 1
+  case "$show" in *'impl-effort=max (invalid — top-level effort is high)'*) ;; *)
+    echo "show omitted mismatch diagnostic: $show"; return 1 ;; esac
+}
+
+t13_scout_keeps_strict_effort_cap() {
+  local home output rc
+  home=$(new_home scout-strict-cap)
+  output=$(HOME="$home" bash "$SELECTOR" --scout gpt-5.6-luna max 2>&1); rc=$?
+  [ "$rc" -eq 3 ] || { echo "rc=$rc want 3: $output"; return 1; }
+  [ "$output" = "SELECT_ERROR: invalid scout effort 'max' (expected: none | minimal | low | medium | high | xhigh)" ] ||
+    { echo "scout cap changed: $output"; return 1; }
+  [ ! -e "$home/.codex/maestro-scout" ] || { echo "scout pin was written"; return 1; }
 }
 
 check() {
@@ -162,5 +299,13 @@ check t2_indented_table_is_not_top_level_pin "indented table keys cannot fake a
 check t3_failed_publish_rolls_back_both_files "failed second publish rolls back both files"
 check t4_rejects_unexpressible_implementation_effort "selector rejects implementation effort the wrapper cannot express"
 check t5_concurrent_selection_cannot_publish_torn_pin "concurrent selectors cannot publish a torn model/effort tuple"
+check t6_publishes_and_shows_implementation_model "selector publishes and shows the implementation model"
+check t7_missing_implementation_model_is_inherited "missing implementation model inherits the debate model"
+check t8_corrupt_implementation_model_fails_pin "corrupt implementation model fails closed"
+check t9_three_argument_repin_preserves_implementation_model "three-argument repin preserves the implementation model"
+check t10_failed_implementation_model_publish_rolls_back_all_files "failed implementation model publication rolls back all files"
+check t11_matching_top_level_max_is_valid "matching top-level max implementation effort is valid"
+check t12_stored_mismatched_max_fails_pin "stored mismatched max implementation effort fails pin"
+check t13_scout_keeps_strict_effort_cap "scout keeps the strict wrapper effort cap"
 printf '\n=== %d passed, %d failed ===\n' "$PASS" "$FAIL"
 [ "$FAIL" -eq 0 ]