diff --git a/AGENT-EXECUTION.md b/AGENT-EXECUTION.md
index e2113d1e..e94b6d7c 100644
--- a/AGENT-EXECUTION.md
+++ b/AGENT-EXECUTION.md
@@ -7,20 +7,22 @@ parser accepts exactly one `agent-execution` fenced block.
 
 U3's execution controller and U4's project wiring are integrated. This file is
 the execution-routing authority for implementation, repair, test, and review.
-Normal implementation, repair, and test routes stay Cursor, Antigravity
-(`agy`), and PI. Each of those profiles may be attempted up to
-`max_attempts_per_profile`, which is exactly 3 whenever `emergency_profile`
-is configured. Only after those candidates safely exhaust their attempts does
-the enabled emergency `codex` profile run once. Codex remains out of the three
-normal role lists and may also appear in review. `fallback_to_host` is
-`never`: the controller does not emit `host-fallback-authorized` and does not
-increment host fallback authorizations. Safe exhaustion without an emergency
-candidate ends `unavailable` or `blocked`, and that result does not authorize
-the host to write the unit. The legacy value `all-unavailable` remains
-parseable and likewise grants no host write authority. Cursor uses
-`cursor-agent-stable`. `model: auto` makes Cursor receive an explicit
-`--model auto`; the other CLIs omit the model flag and use their configured
-default. Any other value is passed to that CLI as its model selector. The
+Implementation, repair, test, and review all use the candidates Cursor,
+Antigravity (`agy`), PI with GLM (`pi-glm`), PI with MiniMax (`pi`), and
+Codex. Each candidate may be attempted up to `max_attempts_per_profile` (3)
+times on safe recoverable failures (`unavailable`, `failed-clean`); after that
+the controller moves to the next candidate automatically, and the host does
+not ask the user. The order of the non-Codex candidates may differ per role,
+but Codex must stay the last candidate in every role list. There is no
+`emergency_profile`. `fallback_to_host` is `never`: the controller does not
+emit `host-fallback-authorized` and does not increment host fallback
+authorizations. When every candidate is safely exhausted the run ends
+`unavailable` or `blocked`; the host pauses that unit and asks the user
+whether to retry, and does not write the unit. The legacy value
+`all-unavailable` remains parseable and likewise grants no host write
+authority. Cursor uses `cursor-agent-stable`. `model: auto` makes Cursor
+receive an explicit `--model auto`; the other CLIs omit the model flag and use
+their configured default. Any other value is passed to that CLI as its model selector. The
 `integration` block declares the host-exempt paths and the transport, admission,
 and cleanup entry points.
 
@@ -37,13 +39,12 @@ execution:
   summary_bytes: 16384
   raw_output_bytes: 10485760
   max_attempts_per_profile: 3
-  emergency_profile: codex
 
 roles:
-  implementation: [cursor, antigravity, pi]
-  repair: [cursor, antigravity, pi]
-  test: [pi, antigravity, cursor]
-  review: [pi, antigravity, cursor, codex]
+  implementation: [cursor, antigravity, pi-glm, pi, codex]
+  repair: [cursor, antigravity, pi-glm, pi, codex]
+  test: [pi-glm, pi, antigravity, cursor, codex]
+  review: [pi-glm, pi, antigravity, cursor, codex]
 
 profiles:
   cursor:
@@ -55,7 +56,13 @@ profiles:
   antigravity:
     adapter: antigravity
     executable: agy
-    model: auto
+    model: gemini-3.8-flash-high
+    enabled: true
+
+  pi-glm:
+    adapter: pi
+    executable: pi
+    model: zai-coding-cn/glm-5.3-flash
     enabled: true
 
   pi:
@@ -67,7 +74,7 @@ profiles:
   codex:
     adapter: codex
     executable: codex
-    model: auto
+    model: gpt-6.1-sol
     enabled: true
 
 integration:
@@ -92,23 +99,25 @@ section records only this project's choices.
 
 - Planning, design and implementation plans: Codex or Claude when available,
   in the host or a fresh CLI session. This is a preference, not a routing role.
-- Bounded implementation, repair and test units: the existing normal
-  candidates in the configured role order above. Requested models:
-  - PI: `minimax-cn/MiniMax-M3`, passed as `--model provider/id`. PI
-    actual events have reported `minimax-cn` / `MiniMax-M3` and the local
-    offline catalog lists that profile; each run still records the effective
-    model from that run's events.
+- Bounded implementation, repair, test and review units: the candidates in
+  the configured role order above, with Codex last. Requested models:
   - Cursor: `auto`, passed explicitly as `--model auto` (Cursor Auto).
-  - agy: Gemini 3.8 Flash is requested, but its exact selectable model ID and
-    effective identity are `NOT_VERIFIED` (the `agy` models query needs a
-    login that was not available). The profile therefore stays `model: auto`
-    until an observed model ID exists; do not claim Gemini 3.8 Flash is active.
+  - agy: `gemini-3.8-flash-high`. `agy models` listed it on 2026-10-20 and a
+    one-line smoke run answered; the effective identity is still taken from
+    each run's events.
+  - PI GLM profile (`pi-glm`): `zai-coding-cn/glm-5.3-flash`, passed as
+    `--model provider/id`.
+  - PI MiniMax profile (`pi`): `minimax-cn/MiniMax-M3`, passed as
+    `--model provider/id`. PI actual events have reported `minimax-cn` /
+    `MiniMax-M3` and the local offline catalog lists that profile; each run
+    still records the effective model from that run's events.
+  - Codex: `gpt-6.1-sol`, always the last candidate.
 - Assigning a different candidate or model to a unit needs a concrete,
   task-specific reason recorded in the task record, and stays within the
   existing roles and candidate lists. It is not a silent permission or routing
-  change. Role lists, attempt limits, timeouts, output limits, the single
-  Codex emergency attempt, stage isolation and `fallback_to_host: never` are
-  unchanged by these preferences.
+  change. Role lists, attempt limits, timeouts, output limits, Codex as the
+  last candidate, stage isolation and `fallback_to_host: never` are unchanged
+  by these preferences.
 - A requested model is prompt/config intent. Only the model reported in a
   run's actual event envelope counts as effective; when the CLI does not report
   it, record `not-observable`. Unknown context capacity, a missing agy login
diff --git a/policy/delivery.md b/policy/delivery.md
index 9d5e8b9f..b085efba 100644
--- a/policy/delivery.md
+++ b/policy/delivery.md
@@ -73,18 +73,19 @@
 [AGENT-EXECUTION.md](../AGENT-EXECUTION.md) 为唯一权威；按角色声明的候选顺序在新进程与
 隔离工作区中尝试外部 Agent。不得跨单元复用同一外部进程，也不得 resume 同一次尝试。
 
-实施、修复与测试的正常候选只有 Cursor、Antigravity（`agy`）和 PI。每个候选对安全可恢复失败
-最多 3 次全新尝试：`unavailable`，或外部无副作用已被机制证明的 `failed-clean`。三次仍属这类失败后才进入
-下一候选。单元包的 `network=false` 与 `external_cost=false` 只是声明，不证明外部干净；当前没有强制的
+实施、修复、测试与 Review 的候选为 Cursor、Antigravity（`agy`）、PI（GLM 与 MiniMax 两个档）和
+Codex。每个候选对安全可恢复失败最多 3 次全新尝试：`unavailable`，或外部无副作用已被机制证明的
+`failed-clean`。三次仍属这类失败后由控制器自动进入下一候选，host 不为此询问用户。
+单元包的 `network=false` 与 `external_cost=false` 只是声明，不证明外部干净；当前没有强制的
 网络/外部费用隔离或可信对账，所以已启动的失败尝试即使私有克隆可精确恢复，也记为 `failed-unknown`
-并保留现场。三个正常候选都安全耗尽后，才允许一次全新的 Codex CLI 紧急尝试；这次不按每候选 3 次计算。
-紧急尝试若仍是安全可恢复失败，运行停在 `blocked`。host 不接过该单元继续撰写。
+并保留现场。
 
-Codex 平时只用于规划、方案设计、实施计划，或独立 Review。执行配置没有单独的 plan 角色；
-上述规划与设计工作可以直接使用 Codex CLI。`review` 角色的候选可以包含 Codex，并按该角色自己的
-顺序和尝试上限执行。Codex 不出现在实施、修复、测试的正常候选里；这三个角色上的一次紧急尝试是唯一例外。
+Codex 之外的候选顺序可按角色在 [AGENT-EXECUTION.md](../AGENT-EXECUTION.md) 中调整，但 Codex
+必须是每个角色的最后一个候选，不设单次紧急尝试。全部候选安全耗尽后运行停在 `unavailable` 或
+`blocked`，host 暂停该单元并询问用户是否重试，不接过该单元继续撰写。Codex 另可直接用于规划、
+方案设计、实施计划（执行配置没有单独的 plan 角色）。
 
-显式 fail-stop 立即停止整次运行，不重试、不换候选、不启动紧急尝试：`failed-unknown`、
+显式 fail-stop 立即停止整次运行，不重试、不换候选：`failed-unknown`、
 `scope-expansion`、`blocked`、`cancelled`、无效配置、未对账的 Git 状态与安全失败。总超时，
 以及 stdin/stdout/stderr 都没有活动的空闲超时，归入 `failed-unknown`。
 
@@ -123,7 +124,7 @@ host 可以直接编写并提交的豁免只有 `.task/**`、`docs/superpowers/s
 `docs/superpowers/plans/**`。除此之外，host 不直接撰写实施单元。
 
 安全耗尽不发出 `host-fallback-authorized`，`host_fallback_authorizations` 保持为 0。
-未配置紧急候选时终态为 unavailable 或 blocked，不授权 host 撰写实施单元。现行
+安全耗尽的终态为 unavailable 或 blocked，不授权 host 撰写实施单元。现行
 [AGENT-EXECUTION.md](../AGENT-EXECUTION.md) 的 `fallback_to_host` 是 `never`。旧值
 `all-unavailable` 仍可解析，但同样不产生 host 撰写授权。已归档任务卡里的旧表述保持原样，
 不改写成现行规则。
diff --git a/policy/governance.md b/policy/governance.md
index 3fe29728..d34465f7 100644
--- a/policy/governance.md
+++ b/policy/governance.md
@@ -11,12 +11,12 @@
 ### Agent 实施收据与来源
 
 每次外部实施尝试须在任务卡「Agent 实施收据」记录：配置摘要（`AGENT-EXECUTION.md` digest）、
-角色、声明候选顺序、attempt、CLI/模型、终态、transport、fallback（只表示该行是否为 Codex
-紧急尝试），以及源码外原始收据路径。初始生成状态为 `NOT_RUN`。原始事件流与超限输出保留在
+角色、声明候选顺序、attempt、CLI/模型、终态、transport、fallback（是否为应急尝试；现行配置无
+应急档，恒为否），以及源码外原始收据路径。初始生成状态为 `NOT_RUN`。原始事件流与超限输出保留在
 源码外；未知终态（`failed-unknown`）与 `scope-expansion` 的隔离工作区须保留待对账，不得静默丢弃。
 清理须有精确恢复或保留现场的可复核证据。
 
-候选、尝试上限、Codex 紧急尝试、fallback、fail-stop、尝试结束条件，以及 transport/admit
+候选、尝试上限、fallback、fail-stop、尝试结束条件，以及 transport/admit
 与 host 豁免路径，以[迭代交付](delivery.md#agent-实施单元与主模型职责)为唯一权威。
 
 ## 启动与恢复
diff --git a/policy/tool-adaptation-matrix.md b/policy/tool-adaptation-matrix.md
index 88ddb3b5..edf51366 100644
--- a/policy/tool-adaptation-matrix.md
+++ b/policy/tool-adaptation-matrix.md
@@ -14,7 +14,7 @@
 | A5 回收 | 本地命令检查；写者退出须可证明，无法证明时才请求 owner 决策 | 登记根目录、锁/操作状态、父子仓与唯一文件、合入核验 | `tests/test_task.py` |
 | A6 秘密 | 本地脱敏及 CI 获取边界；权限与宿主隔离另验 | 命令/输出/摘要脱敏，凭据不持久写 Git 配置 | `tests/test_evidence.py`、`tests/test_ci_credentials.py` |
 | A7 证据 | 本地 SELF 收据；外部来源独立核验 | 首次捕获、完整脱敏输出/摘要、对象记录、原样导入 | `tests/test_evidence.py`；CI/审阅链接另核 |
-| A8 阶段记录与迭代 | goal-first + agent-per-unit（AGENT-EXECUTION.md）；模板默认连续执行，仅真实决策点需人工，没有全流程授权强制；实施/修复/测试仅 Cursor、agy、PI，每候选对安全可恢复失败最多 3 次全新尝试，全部安全耗尽后一次 Codex CLI 紧急尝试；Codex 平时仅规划、设计、计划或独立 Review；显式 fail-stop 立即停止；不限制推理时长、工具次数、规划方式或首次写文件时间；集成经成功 transport 的 agent-exec apply，或 pre-commit admit 精确内容来源；host 豁免仅为 .task/** 与 docs/superpowers/specs/**、plans/**；host 不直接实施；fallback_to_host 为 never；安全耗尽不发出 host-fallback-authorized，终态为 unavailable 或 blocked | policy/delivery.md、AGENT-EXECUTION.md；任务卡分别记录阶段状态、决策点、Agent 实施收据（配置摘要/角色/候选/attempt/CLI-模型/终态/transport/紧急尝试/源码外路径）、Review、冲突、当前 HEAD 的 CI 和合入；post-merge 默认仅提示 | `tests/test_task.py` 核对 goal-first/agent-per-unit 模板、正常路由、尝试上限、fail-stop、空闲超时与 apply/admit 来源表述，及钩子不自动写入；`scripts/agent-exec validate`（CI）与 parser·adapter·controller 假 CLI 契约（Development-Manager internal/agentexec 测试，经 deps/development-manager 钉住）为本地 SELF 强制行为；已安装 provider/model 身份待 U5，远端平台准入为 GATE；智能体核对授权范围、实施单元边界、Review、冲突及匹配 HEAD 的 CI/平台准入 |
+| A8 阶段记录与迭代 | goal-first + agent-per-unit（AGENT-EXECUTION.md）；模板默认连续执行，仅真实决策点需人工，没有全流程授权强制；实施/修复/测试/Review 候选为 Cursor、agy、PI（GLM、MiniMax）与最后的 Codex，每候选对安全可恢复失败最多 3 次全新尝试并自动换候选，全部安全耗尽后暂停询问用户是否重试；显式 fail-stop 立即停止；不限制推理时长、工具次数、规划方式或首次写文件时间；集成经成功 transport 的 agent-exec apply，或 pre-commit admit 精确内容来源；host 豁免仅为 .task/** 与 docs/superpowers/specs/**、plans/**；host 不直接实施；fallback_to_host 为 never；安全耗尽不发出 host-fallback-authorized，终态为 unavailable 或 blocked | policy/delivery.md、AGENT-EXECUTION.md；任务卡分别记录阶段状态、决策点、Agent 实施收据（配置摘要/角色/候选/attempt/CLI-模型/终态/transport/fallback/源码外路径）、Review、冲突、当前 HEAD 的 CI 和合入；post-merge 默认仅提示 | `tests/test_task.py` 核对 goal-first/agent-per-unit 模板、正常路由、尝试上限、fail-stop、空闲超时与 apply/admit 来源表述，及钩子不自动写入；`scripts/agent-exec validate`（CI）与 parser·adapter·controller 假 CLI 契约（Development-Manager internal/agentexec 测试，经 deps/development-manager 钉住）为本地 SELF 强制行为；已安装 provider/model 身份待 U5，远端平台准入为 GATE；智能体核对授权范围、实施单元边界、Review、冲突及匹配 HEAD 的 CI/平台准入 |
 | A9 长期方向与后续任务 | manual；模板不校验规划有效性或自动调度任务 | policy/delivery.md；PROJECT.md 提供规划入口，任务卡关联规划/里程碑并记录下一步建议 | `tests/test_task.py` 核对生成字段与未授权默认值；智能体核对当前规划、进展、重复任务和建议依据，新任务仍不自动获得授权 |
 | A10 交付窗口 | manual；无自动互斥或接管 | [合入调度](delivery.md#合入调度)与 #518：同一目标一个最终窗口，等待分支不追 main；轮到后同步、固定、验证并由智能体合入 | 每个实际 PR 核对窗口记录、精确 HEAD 三项 GATE、Review 和合入后 main；不要求额外试行或全写者审计 |
 | A11 固定后证据 | manual 选择源码外位置；工具捕获绝对未用路径/原始输出；无 OS 冻结 | policy/governance.md；RECEIPT 捕获，后续授权闭合再原样导入 | `tests/test_evidence.py` 固定对象、权限、覆盖拒绝、原样导入与幂等 |