diff --git a/.claude-plugin/marketplace.json b/.claude-plugin/marketplace.json
index bed3419..f2ea3df 100644
--- a/.claude-plugin/marketplace.json
+++ b/.claude-plugin/marketplace.json
@@ -5,7 +5,7 @@
   },
   "metadata": {
     "description": "Pure-Rust Clean Architecture workflow. Six commands (start, fix, plan, ship, review, install-ci) for axum + sqlx + Dioxus 0.7+ + tokio. Always-latest deps, CI audit gate, anti-slop enforced.",
-    "version": "4.1.0"
+    "version": "4.2.0"
   },
   "plugins": [
     {
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 01ed5d9..98b2739 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,25 @@
 
 All notable changes to the code-et plugin will be documented in this file.
 
+## [4.2.0] - 2026-05-10
+
+### Changed — per-task reviewer + review fix-pass moved to Opus 4.7
+
+`/code:ship` now dispatches the per-task reviewer fork and the review fix-pass on `opus` (4.7) instead of `sonnet` (4.6). Implementer stays on Sonnet 4.6.
+
+**Why.** Anthropic's published benchmarks put Opus 4.7 at 87.6% on SWE-bench Verified vs Sonnet 4.6's 79.6% — an 8-point gap. The leverage of that gap is asymmetric across the two roles:
+
+- **Implementer errors** get caught by the reviewer + post-merge audit, so Sonnet's lower ceiling is recovered downstream.
+- **Reviewer errors fail silently** — a missed CRITICAL/HIGH finding ships into the feature branch. The cost of a bad review is much higher than the cost of a bad implementation.
+
+The review fix-pass moves with the reviewer to keep judgment consistent across the find/fix pair.
+
+The principle in `code-et-implementer/CLAUDE.md` updates accordingly: heavy lifting (planning, judgment, **review**) on Opus; routine coding from a complete brief on Sonnet; breadth gathering on Haiku.
+
+### Changed — `/code:fix` effort lowered xhigh → high
+
+`/code:fix` is single-bug intake: scope a bug into a Task Brief, ≤3 file edits. That's "multi-file work with design choices," not "architecture / multi-step coordination." Drops to `high` to match the actual workload. `/code:ship`, `/code:plan`, `/code:start` stay at `xhigh` (orchestrators with cross-cutting decisions).
+
 ## [4.1.0] - 2026-05-07
 
 ### Added — per-task review subagent in `/code:ship`
diff --git a/code-et-implementer/.claude-plugin/plugin.json b/code-et-implementer/.claude-plugin/plugin.json
index c97b0a5..e0a9ede 100644
--- a/code-et-implementer/.claude-plugin/plugin.json
+++ b/code-et-implementer/.claude-plugin/plugin.json
@@ -1,6 +1,6 @@
 {
   "name": "code",
-  "version": "4.1.0",
+  "version": "4.2.0",
   "description": "Pure-Rust Clean Architecture workflow. Six commands: start, fix, plan, ship, review, install-ci. Always-latest deps, CI audit gate, anti-slop enforced.",
   "author": {
     "name": "Kennet Kusk"
diff --git a/code-et-implementer/CLAUDE.md b/code-et-implementer/CLAUDE.md
index 1993468..c25034a 100644
--- a/code-et-implementer/CLAUDE.md
+++ b/code-et-implementer/CLAUDE.md
@@ -54,13 +54,13 @@ Different roles in the workflow run on different models. The `Agent` tool's `mod
 | Role | Model | Where |
 |---|---|---|
 | Orchestrator (`/code:plan`, `/code:ship`) | `opus` (4.7) | Inherited; multi-step coordination + judgment. |
-| Per-task implementer | `sonnet` (4.6) | `/code:ship` — routine vertical-slice coding. |
-| Per-task reviewer | `sonnet` (4.6) | `/code:ship` — diff review via engineering plugin's `code-review` skill (falls back to inline 5-area checklist if the plugin isn't installed). |
-| Per-task review fix-pass | `sonnet` (4.6) | `/code:ship` — apply review findings, no scope expansion. |
+| Per-task implementer | `sonnet` (4.6) | `/code:ship` — routine vertical-slice coding from a complete brief. |
+| Per-task reviewer | `opus` (4.7) | `/code:ship` — diff review via engineering plugin's `code-review` skill (falls back to inline 5-area checklist if the plugin isn't installed). Bugs the reviewer misses fail silently; the 8-pt SWE-bench gap matters here. |
+| Per-task review fix-pass | `opus` (4.7) | `/code:ship` — applies reviewer findings; same model as reviewer for consistent judgment across find/fix. |
 | Post-merge audit fix-pass | `opus` (4.7) | `/code:ship` — judgment on layer slips, dep advisories, test failures. |
 | Explore (breadth searches) | `haiku` (4.5) | `/code:plan`, `/code:fix` — cheap parallel discovery. |
 
-The principle: heavy lifting (planning, judgment) on Opus; routine coding + diff review on Sonnet; breadth gathering on Haiku.
+The principle: heavy lifting (planning, judgment, review) on Opus; routine coding from a complete brief on Sonnet; breadth gathering on Haiku.
 
 ## Code Standards
 
diff --git a/code-et-implementer/commands/fix.md b/code-et-implementer/commands/fix.md
index f4b0681..4eaa474 100644
--- a/code-et-implementer/commands/fix.md
+++ b/code-et-implementer/commands/fix.md
@@ -2,7 +2,7 @@
 tools: Read, Grep, Glob, Bash, Agent, LSP
 description: "Single-bug intake — scope work into a Task Brief. You implement directly. Generates/updates FILE-REFERENCE.md."
 argument-hint: "[bug description] or 'update' to refresh FILE-REFERENCE.md"
-effort: xhigh
+effort: high
 ---
 
 # Fix — Single-Bug Intake
diff --git a/code-et-implementer/commands/ship.md b/code-et-implementer/commands/ship.md
index 8790443..4f8826b 100644
--- a/code-et-implementer/commands/ship.md
+++ b/code-et-implementer/commands/ship.md
@@ -22,8 +22,8 @@ Every task runs as a forked subagent in its own worktree. Use `Agent` with `isol
 |---|---|---|
 | Orchestrator (this skill) | inherits (Opus 4.7) | Multi-step coordination + decisions on partial failures. |
 | Per-task implementer | `sonnet` (4.6) | Routine vertical-slice coding from a complete brief. |
-| Per-task reviewer fork | `sonnet` (4.6) | Diff review via engineering plugin's `code-review` skill (falls back to inline 5-area checklist). |
-| Per-task review fix-pass | `sonnet` (4.6) | Apply review findings; no scope expansion. |
+| Per-task reviewer fork | `opus` (4.7) | Catching bugs the implementer missed is high-leverage — an 8-pt SWE-bench gap on the reviewer pays for itself. Reviewer errors fail silently; implementer errors get caught downstream. |
+| Per-task review fix-pass | `opus` (4.7) | Applies reviewer findings — same model as the reviewer to keep judgment consistent across the find/fix pair. |
 | Post-merge audit fix-pass | `opus` (4.7) | Judgment call on the audit gate — layer slips, dependency advisories. |
 | Explore (when delegated for breadth) | `haiku` (4.5) | Cheap breadth searches for cold areas. Implementer/reviewer prompt may request this. |
 
@@ -105,9 +105,9 @@ diff="$(git -C <worktree_path> diff $(git merge-base HEAD <subagent_branch>)..<s
 
 Empty diff = implementer didn't write code. Halt that task and surface to the user; do not dispatch a reviewer.
 
-### Step 2 — Dispatch the reviewer (Sonnet 4.6)
+### Step 2 — Dispatch the reviewer (Opus 4.7)
 
-Reviewer is a fork — `Agent(model: "sonnet")` with no `subagent_type` and no `isolation`. It works against the diff payload, not the worktree.
+Reviewer is a fork — `Agent(model: "opus")` with no `subagent_type` and no `isolation`. It works against the diff payload, not the worktree.
 
 If the diff exceeds **1500 lines**, halt this task and surface a "task too large — split or escalate to `/code:review` only" warning instead of dispatching. A vertical slice that big is almost always two slices in disguise.
 
@@ -153,7 +153,7 @@ Drop MEDIUM and LOW findings — those are for `/code:review` to catch later. Do
 
 ### Step 3 — On CRITICAL/HIGH findings, dispatch ONE review fix-pass
 
-Spawn `Agent(subagent_type: "general-purpose", model: "sonnet")` with no isolation. Prompt directs it to operate via `git -C <worktree_path>` and explicit file paths inside `<worktree_path>`:
+Spawn `Agent(subagent_type: "general-purpose", model: "opus")` with no isolation. Prompt directs it to operate via `git -C <worktree_path>` and explicit file paths inside `<worktree_path>`:
 
 ```
 # Review fix-pass for <task-id>