diff --git a/.github/workflows/validate-plugins.yml b/.github/workflows/validate-plugins.yml
index 83015b433..acfe5bbb9 100644
--- a/.github/workflows/validate-plugins.yml
+++ b/.github/workflows/validate-plugins.yml
@@ -6,6 +6,7 @@ on:
       - ".cursor-plugin/marketplace.json"
       - ".claude-plugin/marketplace.json"
       - "**/plugin.json"
+      - ".agents/plugins/marketplace.json"
       - "schemas/**"
       - "pstack/**"
       - "harness/**"
@@ -20,7 +21,7 @@ jobs:
 
       - uses: actions/setup-node@v4
         with:
-          node-version: 22
+          node-version: ">=24.22 <25"
 
       - name: Install dependencies
         run: npm install --no-save ajv ajv-formats fast-check@4.5.3
@@ -28,8 +29,17 @@ jobs:
       - name: Validate plugin definitions
         run: node scripts/validate-plugins.mjs
 
+      - name: Check LStack Codex packaging
+        run: node scripts/configure-lstack-codex.mjs --check
+
       - name: Check generated pstack harness trees
         run: node scripts/generate-pstack-harness-trees.mjs --check
 
+      - name: Test LStack conversation mode hooks
+        run: python3 -m unittest discover -s pstack/hooks/tests
+
+      - name: Test Codex history and worktree audit
+        run: node --test scripts/test/*.test.mjs
+
       - name: Test pstack skill scripts
         run: node --disable-warning=ExperimentalWarning --test pstack/skills/*/scripts/test/*.test.ts
diff --git a/AGENTS.md b/AGENTS.md
new file mode 100644
index 000000000..749ad186e
--- /dev/null
+++ b/AGENTS.md
@@ -0,0 +1,9 @@
+# Maintaining LStack
+
+LStack forks `cursor/plugins` pstack. When updating this fork, fetch `upstream/main` and compare pstack changes against the revisions in `pstack/docs/harness/upstream.json`. Import relevant changes and update that record. Changes to unrelated plugins do not require an import.
+
+The Codex adapter and history helpers incorporate unmerged upstream PR #1143. Fetch its current head when updating those features, review the diff, and record the imported commit. Do not describe the PR as an official release before it merges.
+
+Preserve the role settings in the user's `pstack-models.md`, explicit-request-only Astra use, Korean writing guidance, conversation mode hooks, and bundled `deslop`, `control-cli`, and `control-ui`. Keep the Codex native manifest so hooks remain usable. Generated Claude files must be regenerated rather than edited directly.
+
+Use Node 24.22+ in the 24.x line or Node 26.10+ for compressed-history checks. Run Codex packaging checks, generated-tree checks, hook tests, the Codex history tests, and relevant pstack script tests after changes. These instructions do not authorize delegation.
diff --git a/README.lstack.md b/README.lstack.md
index e3a3e249d..c60677cb9 100644
--- a/README.lstack.md
+++ b/README.lstack.md
@@ -5,11 +5,11 @@
 ## 설치
 
 ```bash
-codex plugin marketplace add LifeMash-hq/LStack
+codex plugin marketplace add LifeMash-app/LStack
 codex plugin add pstack@lifemash
 ```
 
-설치 후 새 Codex 대화에서 스킬을 직접 호출합니다. 자동 실행 훅은 설치하지 않습니다. 원본 스킬 참조를 유지하기 위해 플러그인 식별자는 `pstack`, 표시 이름은 LStack을 사용합니다.
+설치 후 새 Codex 대화에서 스킬을 직접 호출합니다. 원본 스킬 참조를 유지하기 위해 플러그인 식별자는 `pstack`, 표시 이름은 LStack을 사용합니다.
 
 ```text
 $pstack:poteto-mode 이 작업의 관련 코드와 호출 순서를 조사해줘. 파일은 수정하지 마.
@@ -17,6 +17,24 @@ $pstack:poteto-mode 이 작업의 관련 코드와 호출 순서를 조사해줘
 
 동일한 이름의 기존 스킬이 있으면 스킬 선택 목록에서 LStack의 항목을 선택합니다.
 
+## 대화별 Poteto 모드 유지
+
+<mark>**한 번 켜면 현재 대화에서 스킬 이름을 반복해서 입력하지 않아도 됩니다.**</mark> 기본 상태는 꺼짐입니다. 로컬 Codex에서 플러그인 훅을 사용하며, 최초 사용과 훅 정의 변경 시 `/hooks`에서 내용을 검토하고 신뢰해야 합니다.
+
+| 동작 | 입력 |
+| --- | --- |
+| 켜기 | `poteto 모드 켜줘` |
+| 끄기 | `poteto 모드 꺼줘` |
+| 상태 확인 | `poteto 모드 상태` |
+
+입력의 첫 줄을 위 문구로 작성합니다. 다음 줄부터 작업을 적으면 모드 변경과 작업 요청을 함께 처리합니다. 영어 입력은 `poteto mode on`, `poteto mode off`, `poteto mode status`를 사용합니다.
+
+같은 대화를 재개하거나 압축해도 상태를 유지합니다. 새 대화, 대화 분기, `/clear` 후에는 꺼짐으로 시작합니다. 기존 `$pstack:poteto-mode 작업` 호출은 해당 요청에만 적용됩니다.
+
+훅은 매 요청에 짧은 스킬 참조만 전달하고, 모델 호출이나 대화 기록 저장을 하지 않습니다. 모델과 권한 설정은 유지합니다. 클라우드에서 대화를 실행하는 환경은 로컬 플러그인 훅을 지원하지 않으므로 요청마다 스킬을 직접 호출합니다. [Codex 훅 지원 범위](https://learn.chatgpt.com/docs/hooks)
+
+Codex CLI 0.166.0에서는 표준 Agent Plugins 형식의 훅을 로더가 제외합니다. LStack은 훅을 지원하는 `.codex-plugin/plugin.json`으로 설치합니다. Claude용 배포본을 생성하는 공통 매니페스트는 `pstack/plugin.template.json`에 보관합니다.
+
 ## 모델
 
 | 작업 | 모델 | 추론 강도 |
@@ -25,13 +43,39 @@ $pstack:poteto-mode 이 작업의 관련 코드와 호출 순서를 조사해줘
 | 설계와 독립 리뷰, 어려운 디버깅 | GPT-6.1 Sol | high |
 | 명시적으로 요청한 특정 판단 | GPT-6 Astra | low |
 
-Astra는 자동으로 호출하지 않습니다. 메인 대화의 모델 설정은 실행할 때 결정합니다. 플러그인은 메인 모델을 변경하지 않습니다. 역할별 설정과 도구 연결은 [Codex 호환 지침](pstack/docs/harness/codex.md)에 있습니다.
+Astra는 자동으로 호출하지 않습니다. 메인 대화의 모델 설정은 실행할 때 결정하며, 플러그인은 메인 모델을 변경하지 않습니다.
+
+역할별 설정은 `$CODEX_HOME/pstack-models.md`에서 읽으며 기본 위치는 `~/.codex/pstack-models.md`입니다. 파일이 없으면 [LifeMash 기본 설정](pstack/docs/harness/codex/pstack-models.md)을 복사합니다. 기존 파일은 유지하고, `$pstack:setup-pstack`으로 사용 가능한 모델과 추론 강도를 확인한 뒤 변경합니다. `모델@추론강도`를 쓰며 `auto`와 `inherit-parent`는 대화의 설정을 따릅니다. 자세한 연결은 [Codex 호환 지침](pstack/docs/harness/codex.md)에 있습니다.
+
+## 과거 대화와 워크트리 확인
+
+<mark>**`recall`, `reflect`, 작업 인계는 현재 작업 폴더의 Codex 기록을 조회합니다.**</mark> 활성 기록과 보관된 기록을 함께 찾고, 하위 에이전트 기록은 필요할 때 포함합니다. 다른 작업 폴더의 대화 본문은 읽지 않습니다. 워크트리 감사는 최근 작업 기록이 있으면 삭제 가능한 항목에서 제외하며, 직접 삭제하지 않습니다.
+
+```bash
+node pstack/docs/harness/codex/sessions.mjs --cwd "$PWD"
+node pstack/docs/harness/codex/worktree-audit.mjs "$PWD"
+```
+
+압축 기록에는 Node 24.22 이상의 24.x 버전 또는 26.10 이상이 필요합니다. 기본 Node가 오래됐다면 위 명령의 `node`를 `npm exec --yes --package=node@24.22.1 -- node`로 바꿔 실행합니다. 시스템 Node를 변경하지 않습니다.
+
+## pstack 업데이트 반영
+
+<mark>**pstack의 변경은 원본 저장소에서 가져오고, Codex 기능은 PR #1143의 변경도 확인합니다.**</mark> 반영 기준 커밋은 [원본 기록](pstack/docs/harness/upstream.json)에 있습니다. PR #1143은 아직 병합 전이며, LStack은 해당 구현을 가져와 사용합니다. 모델 설정과 Astra 제한, 한국어 작성 규칙, 대화 모드, 추가 세 스킬은 유지합니다.
+
+```bash
+git fetch upstream main
+git fetch upstream refs/pull/1143/head:refs/remotes/upstream/pr-1143
+```
+
+이전 반영 커밋부터의 pstack 변경을 비교해 적용한 뒤 아래 검증을 실행하고 원본 기록을 갱신합니다. 업데이트 확인은 유지보수 시 실행하며 자동 예약 작업을 설치하지 않습니다.
 
 ## 로컬 개발
 
 ```bash
 node scripts/configure-lstack-codex.mjs --check
 node scripts/generate-pstack-harness-trees.mjs --check
+python3 -m unittest discover -s pstack/hooks/tests
+node --test scripts/test/*.test.mjs
 codex plugin marketplace add "$PWD"
 codex plugin add pstack@lifemash
 ```
diff --git a/harness/pstack/README.md b/harness/pstack/README.md
index 07e17d8a9..40d5a6283 100644
--- a/harness/pstack/README.md
+++ b/harness/pstack/README.md
@@ -1,6 +1,6 @@
 # pstack harness tree
 
-This folder is generated from `pstack/skills`, `pstack/agents`, `pstack/docs/guide`, `pstack/docs/harness/claude-code.md`, `pstack/README.md`, `pstack/LICENSE`, and `pstack/plugin.json`. Do not edit it by hand.
+This folder is generated from `pstack/skills`, `pstack/agents`, `pstack/docs/guide`, `pstack/docs/harness/claude-code.md`, `pstack/README.md`, `pstack/LICENSE`, and `pstack/plugin.template.json`. Do not edit it by hand.
 
 Cursor uses `pstack/` directly, and Claude Code installs `claude-code/`. The tree leaves out the rest of `pstack/`, such as `pstack/automations` and `pstack/assets`. A relative link to a pstack file that the tree leaves out points at that file on GitHub `main` instead.
 
diff --git a/harness/pstack/claude-code/.claude-plugin/plugin.json b/harness/pstack/claude-code/.claude-plugin/plugin.json
index 5f7548ee3..7df458381 100644
--- a/harness/pstack/claude-code/.claude-plugin/plugin.json
+++ b/harness/pstack/claude-code/.claude-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "pstack",
-  "version": "0.15.36-lstack.1",
+  "version": "0.15.36-lstack.3",
   "description": "if you want to go fast, go deep first. pstack helps you write less, but higher quality code. rigorous agent workflows you can parallelize with confidence.",
   "author": {
     "name": "Lauren Tan"
diff --git a/harness/pstack/claude-code/docs/guide/01-setup.md b/harness/pstack/claude-code/docs/guide/01-setup.md
index 2c2ef3413..d1e7f0bea 100644
--- a/harness/pstack/claude-code/docs/guide/01-setup.md
+++ b/harness/pstack/claude-code/docs/guide/01-setup.md
@@ -14,6 +14,17 @@ Cursor confirms the plugin is installed.
 
 In Claude Code, run `/plugin marketplace add cursor/plugins`, then `/plugin install pstack@cursor-plugins`. Claude Code prefixes plugin commands, so each command in this guide takes a `pstack:` prefix there, such as `/pstack:setup-pstack`, which writes its model rule to `~/.claude/rules/pstack-models.md`. The [Claude Code adapter](../harness/claude-code.md) covers the other differences.
 
+For Codex, run these commands in a terminal:
+
+```sh
+codex plugin marketplace add LifeMash-app/LStack
+codex plugin add pstack@lifemash
+```
+
+Start a new Codex chat and run `$pstack:setup-pstack`. Then start a task with `$pstack:poteto-mode` and your goal. Codex reads model choices from `$CODEX_HOME/pstack-models.md`, which defaults to `~/.codex/pstack-models.md`.
+
+The rest of this guide uses Cursor command names and paths. In Codex, use `$pstack:name` and the paths in the [Codex adapter](https://github.com/cursor/plugins/blob/main/pstack/docs/harness/codex.md). Unconfigured roles inherit the chat's model and effort. A budget change does not override inherited choices. Setup offers only models and effort levels the host supports.
+
 ## Pick your models
 
 Run:
diff --git a/harness/pstack/claude-code/plugin.json b/harness/pstack/claude-code/plugin.json
index 5f7548ee3..7df458381 100644
--- a/harness/pstack/claude-code/plugin.json
+++ b/harness/pstack/claude-code/plugin.json
@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "pstack",
-  "version": "0.15.36-lstack.1",
+  "version": "0.15.36-lstack.3",
   "description": "if you want to go fast, go deep first. pstack helps you write less, but higher quality code. rigorous agent workflows you can parallelize with confidence.",
   "author": {
     "name": "Lauren Tan"
diff --git a/harness/pstack/claude-code/skills/poteto-help/SKILL.md b/harness/pstack/claude-code/skills/poteto-help/SKILL.md
index eb0be95dc..7fdfd46df 100644
--- a/harness/pstack/claude-code/skills/poteto-help/SKILL.md
+++ b/harness/pstack/claude-code/skills/poteto-help/SKILL.md
@@ -10,7 +10,7 @@ In Claude Code, read [the Claude Code adapter](../../docs/harness/claude-code.md
 
 Answer the user's question about pstack, hand them a prompt they can send, and link the file the answer came from. For a help question, don't start the work. The user asked how, and a pstack run spends real tokens, so let them send the prompt.
 
-A message that asks for work, such as "use pstack to fix this bug", is not a help question. Read [`poteto-mode`](../poteto-mode/SKILL.md), do the work under it, and mention once that a Custom Mode keeps it on.
+A message that asks for work, such as "use pstack to fix this bug", is not a help question. Read [`poteto-mode`](../poteto-mode/SKILL.md) and do the work under it. In Cursor, mention once that a Custom Mode keeps it on.
 
 This file maps questions to the skills and guide pages that hold the answers. Those files own the details. Read the file you route to before you quote it, and trust it when it disagrees with this map. The links here point into the installed plugin, which the user may not be able to open, so give the user the file's public copy: `https://github.com/cursor/plugins/blob/main/pstack/` followed by its path.
 
@@ -37,7 +37,7 @@ When the model rule is missing and it matters, ask whether the user wants to pic
 
 ## Get set up
 
-1. Install with `/add-plugin pstack` in chat, or from Customize in the sidebar.
+1. Use the installation steps for the user's host in [guide page 1](../../docs/guide/01-setup.md).
 2. Run [`/setup-pstack`](../setup-pstack/SKILL.md). It asks for a reasoning budget, maps a model to each role, and writes a rule. The rule applies to new chats. Then it offers once each to generate a verification skill and a formal verification skill for the project, unless the project already has one.
 3. Start a real task with `/poteto-mode`, a goal, and a check that can pass or fail.
 
@@ -45,15 +45,17 @@ Installing changes nothing until the user invokes a skill. Only `/setup-pstack`
 
 If cost is the worry, say where the tokens go and how to spend fewer. pstack spends extra tokens on subagents and review panels. Rerun `/setup-pstack` and pick a smaller budget or cheaper models. A role set to `auto` or `inherit-parent` runs on the chat's model, which saves tokens when the chat runs on Auto or a cheaper model. A shorter panel list runs fewer subagents, one for each entry. Save `/poteto-mode` for work that needs rigor.
 
-pstack is built for Cursor, and it also installs in Claude Code with `/plugin marketplace add cursor/plugins`, then `/plugin install pstack@cursor-plugins`. There, each command takes a `pstack:` prefix, such as `/pstack:poteto-mode`. The [Claude Code adapter](../../docs/harness/claude-code.md) maps the Cursor names, and a step that needs a Cursor-only feature, such as Bugbot or Automations, is skipped with a one-line note.
+pstack supports Cursor, Claude Code, and Codex. In Claude Code, each command takes a `pstack:` prefix, such as `/pstack:poteto-mode`. The [Claude Code adapter](../../docs/harness/claude-code.md) maps the Cursor names.
 
-Other tools can read the skills, because they use the Agent Skills format. But most workflow skills, including `/poteto-mode`, `/how`, `/why`, and `/teach`, spawn Cursor subagents with per-role models, and Custom Modes and `/loop` are Cursor features, so those parts may not work there.
+In Codex, select the installed pstack skill or use `$pstack:name`, such as `$pstack:poteto-mode`. Read the [Codex adapter](https://github.com/cursor/plugins/blob/main/pstack/docs/harness/codex.md) for tools, model choices, and history. Use the skill for one request, or say `poteto 모드 켜줘` to keep LStack routing on for this conversation. Say `poteto 모드 꺼줘` to turn it off. Cursor Custom Modes and `/loop` do not apply in Codex.
+
+For a step that needs a Cursor-only feature, follow the host adapter's skip rule and report the missing check. Other tools can read the Agent Skills files, but need their own mappings for tools and subagents.
 
 ## Start a task with `/poteto-mode`
 
 `/poteto-mode` matches the task to a playbook, copies the playbook's steps into the todo list, and runs the other skills as the steps need them. A step it skips stays in the list as `skip: <reason>`. A good prompt states the goal and how to tell it's done. It doesn't list skills, because a hand-written sequence tends to drop or reorder steps the playbook would keep. Read [`references/prompting.md`](references/prompting.md) before you help word one. [Guide page 2](../../docs/guide/02-poteto-mode.md) has examples.
 
-Whether `/poteto-mode` stays on depends on how the user starts it:
+In Cursor, whether `/poteto-mode` stays on depends on how the user starts it:
 
 - Enter on `/poteto-mode` attaches the skill to one message. It fades as the chat moves on.
 - Option+Enter on Mac or Alt+Enter on Windows, or Use as Mode from the skill entry, makes it a Custom Mode. It stays in context every turn until the user exits the mode, and it stays out of casual turns.
diff --git a/harness/pstack/claude-code/skills/poteto-mode/SKILL.md b/harness/pstack/claude-code/skills/poteto-mode/SKILL.md
index 3fb1e551f..d10b27209 100644
--- a/harness/pstack/claude-code/skills/poteto-mode/SKILL.md
+++ b/harness/pstack/claude-code/skills/poteto-mode/SKILL.md
@@ -107,10 +107,10 @@ You own every subagent's work. Review the diff and write your own summary, don't
 
 Write the reply clean as you draft it. A cleanup pass after drafting does not remove these patterns.
 
-- **Short declarative sentences.** One thought per sentence, ended with a period.
+- **English prose.** Use short declarative sentences, one thought per sentence, ended with a period. For Korean, follow [the Korean writing rules](references/korean-writing.md) for sentence and paragraph structure instead.
 - **No long-dash character anywhere.** Write a file-list bullet as a sentence ("`main.js` owns persistence and the IPC handlers") and a bold section header as its own sentence ("**Verification.** End to end via CDP").
 - **A colon as a mid-sentence connector is also out** (unslop rule 14). A colon before a list is fine.
-- **Terse is not an excuse to drop content.** Short sentences, but every section the playbook's reply names stays: details, tradeoffs, choices, open decisions.
+- **Terse is not an excuse to drop content.** Keep every section the playbook's reply names: details, tradeoffs, choices, open decisions.
 - **Frame impact for the consumer and the maintainer.** Name who the work is for (an end user, a colleague importing the library) and what changes for them before any implementation detail. Then what the next engineer who owns this code inherits. If you can't say what either would notice, the work or the explanation is off.
 - **Never fabricate a link, citation, or transcript reference.** Link only artifacts you produced or read this session.
 - **Every claim carries its evidence or its label in the same sentence.** Measured, inferred, or guess. A prediction or an unseen cause is a guess. Never hand the human a check you could run.
diff --git a/harness/pstack/claude-code/skills/poteto-mode/references/korean-writing.md b/harness/pstack/claude-code/skills/poteto-mode/references/korean-writing.md
new file mode 100644
index 000000000..88b03105b
--- /dev/null
+++ b/harness/pstack/claude-code/skills/poteto-mode/references/korean-writing.md
@@ -0,0 +1,14 @@
+# 한국어 답변과 문서 작성
+
+한국어에서는 이 지침을 영어의 문장 길이, 연결 방식, 목록 형식 규칙보다 우선합니다. 목표는 문장을 짧게 만드는 것이 아니라 주장과 근거를 분명하게 전달하는 것입니다.
+
+- 이유, 조건, 대조, 결과로 연결된 내용은 연결 어미로 잇고, 서로 독립된 사실은 문장을 나눕니다. 길이나 단어 수만으로 문장을 끊지 않습니다.
+- 한 문장의 연결 어미는 둘 정도를 기준으로 삼습니다. 셋 이상 이어져 읽기 어려우면 관계가 가장 약한 지점에서 나누며, 개수만 맞추려고 자연스러운 문장을 쪼개지 않습니다.
+- 문단 첫 문장에 요지를 두고 뒤에서 근거를 설명하며, 한 문단에는 주제 하나만 둡니다.
+- 같은 종결 어미가 반복되면 내용의 관계에 맞춰 문장 구조를 조정합니다. 반복을 피하려고 주어나 동의어를 억지로 덧붙이지 않습니다.
+- 생략한 주어나 지시어 때문에 대상을 다시 찾아야 한다면 구체적인 이름을 씁니다. 대상이 분명할 때는 같은 주어를 매번 반복하지 않습니다.
+- 목록과 표는 같은 기준으로 비교할 수 있는 병렬 항목에 씁니다. 인과나 순서를 설명하는 내용을 글머리표로 잘게 나누지 않습니다.
+- 긴 대시와 문장 중간의 연결용 콜론을 쓰지 않고, 주장에는 근거나 측정, 추정, 추측의 구분을 같은 문장에 붙입니다. 판단은 명확하게 쓰되 실제 불확실성을 숨기지는 않습니다.
+- 짧게 쓰려고 필요한 세부 사항, 장단점, 남은 결정을 빼지 않습니다.
+
+문장 예시에서 "린트가 이미 이 경우를 막습니다. 그래서 이 주석은 불필요합니다."는 "린트가 이미 이 경우를 막으므로 이 주석은 불필요합니다."로 잇습니다.
diff --git a/harness/pstack/claude-code/skills/technical-writing/SKILL.md b/harness/pstack/claude-code/skills/technical-writing/SKILL.md
index 903d7d6d2..afeef3d1c 100644
--- a/harness/pstack/claude-code/skills/technical-writing/SKILL.md
+++ b/harness/pstack/claude-code/skills/technical-writing/SKILL.md
@@ -10,6 +10,8 @@ In Claude Code, read [the Claude Code adapter](../../docs/harness/claude-code.md
 
 Write so a tired engineer understands on the first read. Apply all four layers.
 
+For Korean prose, [the Korean writing rules](../poteto-mode/references/korean-writing.md) take precedence over the English sentence-length, connective, and list-format rules below.
+
 Three rules sit above the layers:
 
 - **Cut every word that does no work.** If the sentence survives without a word, the word goes. "In order to" is "to". "It is important to note that" is nothing.
diff --git a/harness/pstack/claude-code/skills/unslop/SKILL.md b/harness/pstack/claude-code/skills/unslop/SKILL.md
index 97f5b6412..d075aa4e0 100644
--- a/harness/pstack/claude-code/skills/unslop/SKILL.md
+++ b/harness/pstack/claude-code/skills/unslop/SKILL.md
@@ -54,7 +54,7 @@ Rule numbers are stable ids that other skills cite. A removed rule leaves a gap.
 ### Plain speech
 
 27. **Say what it does, not how it feels.** "the database stays close at hand", "SQL you can read", "types that follow your schema" name a feeling. The fix names the mechanism or a number: "`.toSQL()` returns the exact string sent to the database", "a column rename fails the build". Ask what the sentence tells the reader to do or know, then write that. If you can't restate it as a concrete instruction, fact, or number, cut it. One more check: if the sentence could appear unchanged in another project's docs, it says nothing about this one. Cut it.
-28. **Shorten or split dense sentences.** If the reader has to backtrack to parse a sentence, break it in two or drop clauses. One idea per sentence.
+28. **Shorten or split dense sentences.** If the reader has to backtrack to parse a sentence, break it in two or drop clauses. One idea per sentence. For Korean, apply [the Korean writing rules](../poteto-mode/references/korean-writing.md) instead of mechanically splitting connected ideas.
 29. **Active voice.** Prefer it. Catch "is/are/was/were + past participle" and name the actor: "queries are validated" becomes "the compiler validates queries", "the file is parsed by the loader" becomes "the loader parses the file". Passive is fine only when the actor is unknown or genuinely doesn't matter.
 30. **Cut adverbs, or use a stronger verb.** "runs quickly" becomes "is fast" or the number, and "significantly improves" becomes the measured delta. An adverb propping up a weak verb means the verb is wrong.
 31. **Prefer the plain word.** "utilize" and "leverage" become "use", "facilitate" becomes "help", "numerous" becomes "many", "in the event that" becomes "if". The fancier synonym is rarely clearer.
diff --git a/pstack/.codex-plugin/plugin.json b/pstack/.codex-plugin/plugin.json
index 943a5c155..a54c97a62 100644
--- a/pstack/.codex-plugin/plugin.json
+++ b/pstack/.codex-plugin/plugin.json
@@ -1,12 +1,13 @@
 {
   "name": "pstack",
-  "version": "0.15.36-lstack.1",
+  "version": "0.15.36-lstack.3",
   "description": "LifeMashStack. Upstream pstack workflows adapted for Codex.",
   "author": { "name": "LifeMash" },
-  "homepage": "https://github.com/LifeMash-hq/LStack",
-  "repository": "https://github.com/LifeMash-hq/LStack",
+  "homepage": "https://github.com/LifeMash-app/LStack",
+  "repository": "https://github.com/LifeMash-app/LStack",
   "license": "MIT",
   "skills": "./skills/",
+  "hooks": "./hooks/hooks.json",
   "interface": {
     "displayName": "LStack (LifeMashStack)",
     "shortDescription": "pstack engineering workflows for Codex",
diff --git a/pstack/.cursor-plugin/plugin.json b/pstack/.cursor-plugin/plugin.json
index 810749dd9..81884d637 100644
--- a/pstack/.cursor-plugin/plugin.json
+++ b/pstack/.cursor-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
 	"name": "pstack",
 	"displayName": "pstack",
-	"version": "0.15.36-lstack.1",
+	"version": "0.15.36-lstack.2",
 	"description": "if you want to go fast, go deep first. pstack helps you write less, but higher quality code. rigorous agent workflows you can parallelize with confidence.",
 	"author": {
 		"name": "Lauren Tan"
diff --git a/pstack/docs/guide/01-setup.md b/pstack/docs/guide/01-setup.md
index 2c2ef3413..2bae61904 100644
--- a/pstack/docs/guide/01-setup.md
+++ b/pstack/docs/guide/01-setup.md
@@ -14,6 +14,17 @@ Cursor confirms the plugin is installed.
 
 In Claude Code, run `/plugin marketplace add cursor/plugins`, then `/plugin install pstack@cursor-plugins`. Claude Code prefixes plugin commands, so each command in this guide takes a `pstack:` prefix there, such as `/pstack:setup-pstack`, which writes its model rule to `~/.claude/rules/pstack-models.md`. The [Claude Code adapter](../harness/claude-code.md) covers the other differences.
 
+For Codex, run these commands in a terminal:
+
+```sh
+codex plugin marketplace add LifeMash-app/LStack
+codex plugin add pstack@lifemash
+```
+
+Start a new Codex chat and run `$pstack:setup-pstack`. Then start a task with `$pstack:poteto-mode` and your goal. Codex reads model choices from `$CODEX_HOME/pstack-models.md`, which defaults to `~/.codex/pstack-models.md`.
+
+The rest of this guide uses Cursor command names and paths. In Codex, use `$pstack:name` and the paths in the [Codex adapter](../harness/codex.md). Unconfigured roles inherit the chat's model and effort. A budget change does not override inherited choices. Setup offers only models and effort levels the host supports.
+
 ## Pick your models
 
 Run:
diff --git a/pstack/docs/harness/codex.md b/pstack/docs/harness/codex.md
index f78511b3c..c5c45bffd 100644
--- a/pstack/docs/harness/codex.md
+++ b/pstack/docs/harness/codex.md
@@ -1,53 +1,135 @@
 # LStack in Codex
 
-Read once per task. These mappings replace Cursor-specific instructions in the bundled skills and their references. Keep the playbook steps. `<pstack>` is this plugin's root, two directories above this file.
+pstack skills use Cursor names. In Codex, read this file once per session. Apply these mappings wherever a skill or its references use those names. `<pstack>` is the installed folder that contains `skills/` and `docs/`. Use the tools and argument schemas exposed in the current session. Clients can expose different tools.
 
-## Tools
+## Tools and invocation
 
-| Upstream name | Codex operation |
+| Cursor | Codex |
 | --- | --- |
-| `Read`, `Grep`, `Glob`, `Bash`, file edits | Available file and shell tools. Search with `rg`; edit with the patch tool. |
-| `AskQuestion` | Available user-input tool, or a question in the conversation. |
-| Todolist, `TodoWrite` | Available plan tool, or a short tracked list when absent. |
-| `/name`, the **name** skill | Read `<pstack>/skills/<name>/SKILL.md`. User invocation is `$pstack:name`. |
-| `Task`, `generalPurpose` | Available native agent spawn tool. Use only its actual schema. |
-| `poteto-agent`, `comment-sicko` | Pass the corresponding `<pstack>/agents/<name>.md` instructions and absolute skill paths to a native agent. Do not assume a custom agent type is registered. |
-| `run_in_background`, `resume`, `file_attachments` | Native agents run asynchronously. Use native wait/message/resume operations when supported; put file paths in the brief. |
-| `readonly: true` | Give a read-only brief. This does not create a separate sandbox. |
-| `environment: "cloud"`, `cloud_base_branch` | A separate local worktree at the specified base. Create it before spawning and give its absolute path to the agent. |
+| `Task` | The available `spawn_agent` tool. It may be in a `collaboration` namespace. |
+| `AskQuestion` | Use the available structured question tool. `request_user_input_async` allows independent work while the answer is pending. Use `request_user_input` only in modes that expose it. Otherwise ask in your reply. |
+| Open a todolist | Use `update_plan` when exposed. Otherwise keep the playbook checklist in the conversation and update it at each phase. A goal is not a todo list. |
+| Run another pstack skill (`/name` or "the **name** skill") | Read `<pstack>/skills/<name>/SKILL.md` directly and follow it. Most pstack skills intentionally stay out of implicit discovery. When addressing the user, tell them to select the installed pstack skill in the composer or invoke it with `$pstack:name`, not a Cursor slash command. |
+| `Read`, `Grep`, `Glob`, `Bash` | Use the session's file and shell tools. Use `rg` for searches. |
+| `create-skill`, `deslop`, `control-cli`, `control-ui` | Use the corresponding installed skill or native tool when available. `deslop`, `control-cli`, and `control-ui` are bundled at `<pstack>/skills/<name>/SKILL.md`. `create-skill` maps to the installed `skill-creator` skill. Run CLI checks through the shell. Drive UI with the exposed browser or computer tools. Clean up code directly when there is no matching skill. Report any required live check that cannot run. |
 
-Repository instructions govern delegation. Without authorization or agent tools, carry out the same investigation, implementation, and review steps sequentially yourself and report that independent review did not run. Do not bypass this fallback through a second Codex CLI or an external model API. Parallel writers need separate worktrees or disjoint file ownership.
+The package generates `agents/openai.yaml` from each skill's `disable-model-invocation` flag. Explicit selection loads the skill. Read sibling skills by their packaged paths, even when they are absent from the automatic catalog. Explicit `poteto-mode` invocation applies to the current request. LStack also supports conversation persistence through the hooks described below. Cursor Custom Modes do not apply in Codex.
 
-## Models
+When creating or updating a skill, including `automate-me`'s `<handle>-mode`, translate its invocation policy too. In that skill's `agents/openai.yaml`, set `policy.allow_implicit_invocation` to the inverse of `disable-model-invocation`. Preserve other existing fields. Frontmatter alone does not express Codex's documented invocation policy. For an explicit-only mode, write:
 
-Replace all upstream role defaults, model pools, budget ladders, and model-family fallback rules with these settings. Do not read or write `pstack-models.mdc` in Codex.
+```yaml
+policy:
+  allow_implicit_invocation: false
+```
+
+## Subagents
+
+| Cursor | Codex |
+| --- | --- |
+| `subagent_type: generalPurpose` | Use the default general-purpose agent. Omit Cursor's `subagent_type`. |
+| `poteto-agent` | Spawn a delegate whose brief includes the absolute paths to this adapter and `<pstack>/skills/poteto-mode/SKILL.md`, and tells it to read both before working. These plugin Markdown files do not register a Codex agent type. |
+| `comment-sicko` | Spawn a reviewer with the scoped diff and the absolute paths to this adapter and `<pstack>/agents/comment-sicko.md`. |
+| `readonly: true` | Give a read-only brief and verify the working tree afterward. A brief does not change permissions. Retain the session's sandbox and approval controls. |
+| `readonly: false` | Use the normal delegate with the parent's permissions. |
+| `environment: "cloud"`, `environment: "local"` | Codex delegates share the filesystem. Give concurrent writers separate worktrees or disjoint output directories. Omit the Cursor fields. |
+| `cloud_base_branch` | Put the exact starting branch or commit and the worktree path in the delegate's brief. |
+| `run_in_background: true` | Omit. Spawned agents already run alongside the parent. |
+| `resume` | Use `followup_task` or `resume_agent` when offered. Preserve the skill's restrictions on reusing a delegate. |
+| `file_attachments` | Put absolute file paths in the brief. |
+
+Use the returned agent identifier with the session's send, wait, and follow-up tools. `wait_agent` can report mailbox updates. Read the delivered messages to get the answer. A timeout is not completion. Use `close_agent` only when it exists. After a capacity error, wait for existing work. Do not retry with a different model. On hosts without a close tool, completion does not necessarily free a slot.
 
-| Role | Model | Reasoning effort |
-| --- | --- | --- |
-| Ordinary exploration, implementation, synthesis, prose | `gpt-6.1-sol` | `medium` |
-| Architecture, independent review, difficult debugging | `gpt-6.1-sol` | `high` |
-| One specific judgment explicitly requested from Astra | `gpt-6-astra` | `low` |
+When selecting another model or effort requires a fresh context, use the spawn tool's fresh-context option (`fork_turns: "none"` on hosts that expose it) and supply the task, paths, and relevant constraints explicitly. Full-history forks may inherit model and effort and reject overrides.
 
-Astra is never an automatic fallback, panel member, or cross-judge. An authorized Astra consultation receives only the question and necessary code/evidence, defaults to one call, and does not delegate or retry automatically. Sol handles follow-up implementation.
+Current Codex releases enable subagents by default. Local clients can disable them with `agents.enabled = false`. If no spawn tool is available, report that limitation. Independent tasks can run sequentially, but a required independent review remains unverified until another agent or reviewer performs it. Do not count the parent's own second pass as independent review.
+
+Repository instructions govern delegation. Without authorization, perform the same steps sequentially and report that independent review did not run. Do not bypass this through another Codex CLI or external model API.
+
+## Models and effort
+
+| Cursor | Codex |
+| --- | --- |
+| `pstack-models.mdc`, `~/.cursor/rules/pstack-models.mdc` | Read `$CODEX_HOME/pstack-models.md` (default `~/.codex/pstack-models.md`) when a skill selects models. Codex does not automatically load this file. |
+| An unconfigured `claude-*`, `grok-*`, or `gpt-*` default | Inherit the parent. A Cursor model slug is not evidence that Codex can run it. |
+| `auto` or `inherit-parent` | Omit model and effort overrides. Each panel entry represents one independent agent. |
+| A configured Codex model | Pass it only if the current spawn tool and available model inventory support it. |
+| `<model>@<effort>` | Pass the model and supported `reasoning_effort` separately. |
 
-Use actual spawn model/effort settings or a configured custom agent. Do not encode reasoning effort in the model name or claim that prose changes the running model. When changing a child's model, use a fresh context if required by the spawn tool and supply a self-contained brief. If the requested settings are unavailable, inherit the parent, report the actual fallback, and do not probe other expensive models. The main chat retains its launch settings; the plugin cannot change them.
+Keep role names identical to `setup-pstack`. For a bare model name, preserve the session effort when the host exposes and accepts it. Otherwise explain that the host chooses the effort. An optional `default effort` row applies to real model entries without an `@effort` suffix. A value of `session` means the parent's effort. Keep configured Codex model names. If the host rejects a model, report the rejection. Use a confirmed available model only under the workflow's fallback rule. Otherwise inherit the parent and disclose the substitution.
 
-For `arena`, `architect`, and `interrogate`, keep the requested perspectives using Sol at the role's effort. This is independent same-model review, not multi-model review. Arena's different-family judge is skipped unless the user explicitly requests Astra. A sequential pass is not an independent review.
+Repeated models provide independent reviewers, but not model diversity. GPT models belong to the same family for Arena's cross-judge rule. When no different-family model is available, follow Arena's documented skip path and report the missing cross-judge. Another provider's CLI needs separate access and authorization.
 
-## Paths and capabilities
+### LifeMash defaults and Astra limit
 
-Use the installed `<pstack>` paths instead of searching `~/.cursor/plugins/`. Codex plugin metadata is `<pstack>/.codex-plugin/plugin.json`. Project skill paths are `.agents/skills/`; project instructions are `AGENTS.md`. Do not write Cursor or Claude configuration from Codex.
+The [initial model sheet](codex/pstack-models.md) preserves LifeMash's current choices. When installing for LifeMash and the user has not created a sheet, copy it to `$CODEX_HOME/pstack-models.md`. Preserve an existing sheet. Read it when selecting delegates; this file does not change the main chat's running model or effort.
 
-For history, use a supported session-history tool scoped to the current project, or user-supplied transcripts. Do not guess Cursor transcript paths in Codex.
+Astra is only for one specific judgment explicitly requested by the user. It is never an automatic fallback, panel member, or cross-judge, even if a sheet lists it. An authorized consultation defaults to one call at `low`, receives only necessary evidence, and does not delegate or retry automatically. Sol performs follow-up implementation. If the model is unavailable, inherit the parent and report the actual fallback; do not probe expensive alternatives.
 
-For built-in PR actions, use the available forge connector or CLI. Existing Bugbot comments can be read as ordinary PR reviews. Cursor cloud control, automations, and Cursor-specific script commands are unavailable. Skip an optional step with a reason; if required evidence depends on it, report the missing capability rather than claiming completion. A long-running request does not create a background monitor by itself.
+### setup-pstack
 
-`deslop`, `control-cli`, and `control-ui` are bundled in `<pstack>/skills/`. Read those local skills when a playbook references them, including references naming `cursor-team-kit`. They are instructions, not installed runtimes; use available terminal/browser tools or the project's existing harness. Report a missing capability when it prevents verification. Cursor's built-in `create-skill` maps to the available `skill-creator` skill.
+Follow the skill's steps with these substitutions:
 
-## setup-pstack
+- **Detect:** inventory the models and effort levels the current spawn tool accepts. If no reliable inventory is exposed, offer `inherit-parent` and `auto`. Ask for model choices only when needed. Do not persist guessed slugs.
+- **Load:** read the Codex sheet above, not a Cursor rule. Use its existing role values and budget as the starting point. Preserve its `default effort` setting when present.
+- **Defaults:** map each unconfigured role to `inherit-parent`. Keep the number of entries in default panels. Explain that inherited entries follow the session's model and effort, so changing the budget does not override those entries.
+- **Budget and confirm:** show every role, model, effort, and panel size before writing. For a real model, store `<model>@<effort>` when an effort is chosen. Offer only supported levels and keep an inheritance choice for effort.
+- **Write:** write the confirmed rows and budget to the Codex sheet, with no Cursor frontmatter. Change only that file. Do not put model preferences in `AGENTS.md`, `CLAUDE.md`, or `config.toml`.
+- **Confirm:** the next model-selecting pstack skill reads the sheet. Continue the optional verification-skill offers using the Codex paths below.
 
-In Codex, report the current model/effort when observable and explain the role settings above, then stop. Do not follow the Cursor setup steps or install hooks. To start a chat with the baseline settings, the user can run:
+## Paths and history
 
-```bash
-codex --model gpt-6.1-sol -c 'model_reasoning_effort="medium"'
+| Cursor | Codex |
+| --- | --- |
+| `.cursor/skills/`, `~/.cursor/skills/` | `.agents/skills/`, `~/.agents/skills/` for project and personal skills. |
+| `~/.cursor/plugins/`, `.cursor-plugin/plugin.json` | Use the installed `<pstack>` path supplied by the skill catalog. The generated package has `plugin.json` and a `.codex-plugin/plugin.json` compatibility manifest. |
+| `.cursor/rules/`, always-applied rules | Project or personal `AGENTS.md`. The separate model sheet above is the exception. |
+| `https://github.com/cursor/plugins/blob/main/pstack/<path>` | Read `<pstack>/<path>` when packaged. Give the public URL to the user when they need a link. |
+| `~/.cursor/projects/<slug>/agent-transcripts/` | Use a history tool scoped to the requested chat when available. For local rollouts, use the helper below to select this workspace's sessions before reading their contents. |
+
+For compressed history, use Node 24.22 or a later 24.x release, or Node 26.10 or newer. Check `node --version` first. If the default runtime is older, run these helpers with `npm exec --yes --package=node@24.22.1 -- node <script> <arguments>` instead; this uses a cached runtime without changing the system Node installation. Older decoders can silently accept truncated Zstd data. The helpers reject compressed files on those runtimes.
+
+For `recall`, `reflect`, `automate-me`, and session pickup, list matching local sessions with:
+
+```sh
+node <pstack>/docs/harness/codex/sessions.mjs --cwd <absolute-workspace-path>
 ```
+
+The helper reads metadata from `.jsonl` and compressed `.jsonl.zst` files under `sessions/` and `archived_sessions/`. Both directories are under `$CODEX_HOME`, which defaults to `~/.codex`. It lists matching top-level chats newest first. `--cwd` requires an exact workspace match. It does not include chats started in subdirectories or other workspaces.
+
+The helper reads the metadata line of every rollout under both directories, including rollouts from other workspaces. One empty or malformed rollout fails the whole listing. The error names the file. With the user's approval, move or repair that file. Otherwise pass `--home <codex-home>` to read a copy of the history that excludes it. Then run the command again. The helper does not skip the file. A skipped rollout can hide history.
+
+Use `--include-subagents` when the task needs delegate history. The result labels those sessions with `isSubagent` and `parentId`. Use `--id <session-id>` to select a known chat, including a subagent. To read the selected rollout as plain JSONL, run:
+
+```sh
+node <pstack>/docs/harness/codex/sessions.mjs --cwd <absolute-workspace-path> --id <session-id> --read
+```
+
+This command also decodes compressed rollouts. It reads message contents only after selection. If a conversation is ephemeral or unavailable locally, use the current conversation or the session digest that the skill permits. Do not substitute another workspace's history.
+
+The bundled `worktree-audit.sh` reads Cursor history only. For a Codex worktree cleanup, use the Codex wrapper instead:
+
+```sh
+node <pstack>/docs/harness/codex/worktree-audit.mjs [-b <base-ref>] <repo-path>
+```
+
+The wrapper retains the shared audit's worktree and PR checks. It counts sessions started in each worktree or a subdirectory. For recent sessions linked to the repository, including delegates, it also checks stored messages for the worktree path. This catches work done outside a session's starting directory.
+
+Both audits treat activity less than five elapsed days old as recent and display dates in local time. When the wrapper finds recent activity, it keeps that worktree out of the `safe` bucket. Ephemeral sessions and work absent from stored rollouts remain unverified. Follow the cleanup playbook's inspection and approval steps. An audit error leaves cleanup unverified. The audit does not delete worktrees.
+
+## Cursor-only features
+
+Cursor Automations, routine webhooks, and Cursor cloud-agent dashboards have no direct Codex equivalent. Mark the affected step `Skipped in Codex: <step>. <reason>.` and continue independent steps. A step that depends on the missing result remains blocked. Use Codex automations only when the user requests one and the host exposes a suitable tool.
+
+Bugbot findings on a GitHub PR are normal review threads. Read them through the forge CLI. If no Bugbot check exists, omit steps that start or await it and report that omission. Retain the workflow's own review and verification requirements. For a built-in PR tool, use the forge command the workflow gives, subject to the user's authorization.
+
+Codex keeps its own permission and approval rules. A missing driver, unsupported feature, or declined operation is not permission to weaken a required check or claim it passed.
+
+The mappings follow the current [Codex subagent documentation](https://learn.chatgpt.com/docs/agent-configuration/subagents), [skill documentation](https://learn.chatgpt.com/docs/build-skills), and [plugin packaging documentation](https://developers.openai.com/plugins/build/plugins). The active tool schema controls when a client's capabilities differ.
+
+## Conversation mode
+
+Trusted local Codex hooks recognize `poteto 모드 켜줘`, `poteto 모드 꺼줘`, and `poteto 모드 상태` on the first line of a prompt. English equivalents are `poteto mode on`, `poteto mode off`, and `poteto mode status`. A task may follow on later lines. A control-only message acknowledges the state without starting a playbook.
+
+The hook keeps an enabled marker per conversation under `PLUGIN_DATA` and provides a short skill reference each turn and after compaction. A resumed conversation keeps its state; a new conversation, fork, or clear starts off. Ordinary `$pstack:poteto-mode <task>` remains a one-turn invocation. Hook context reporting ON is evidence of persistence; without it, do not claim the mode is saved. The mode does not change model settings or permissions.
+
+Plugin hooks require native trust through `/hooks`. Local plugin hooks do not run with cloud orchestration. When unavailable, use explicit per-request invocation and report that persistence is unavailable.
diff --git a/pstack/docs/harness/codex/pstack-models.md b/pstack/docs/harness/codex/pstack-models.md
new file mode 100644
index 000000000..86a33ca1f
--- /dev/null
+++ b/pstack/docs/harness/codex/pstack-models.md
@@ -0,0 +1,24 @@
+# LifeMash pstack model configuration
+
+# Role values use model@effort. auto and inherit-parent follow the session.
+# Panel entries each run one delegate, subject to repository authorization.
+# Astra requires an explicit user request under the Codex adapter's limit.
+# budget: small (medium)
+default effort: medium
+feature, refactoring: gpt-6.1-sol@medium
+bug-fix: gpt-6.1-sol@medium
+perf-issue: gpt-6.1-sol@medium
+hillclimb: gpt-6.1-sol@medium
+judgment and prose: gpt-6.1-sol@medium
+hardest tasks: gpt-6.1-sol@high
+how explorer: gpt-6.1-sol@medium
+how explainer: gpt-6.1-sol@medium
+why investigators: gpt-6.1-sol@medium
+why synthesizer: gpt-6.1-sol@medium
+reflect tooling: gpt-6.1-sol@medium
+reflect judgment, divergent, synthesizer: gpt-6.1-sol@high
+arena runners: gpt-6.1-sol@high, gpt-6.1-sol@high
+arena cross-judge pool: inherit-parent
+swarm workers: gpt-6.1-sol@medium
+architect runners: gpt-6.1-sol@high, gpt-6.1-sol@high
+interrogate reviewers: gpt-6.1-sol@high, gpt-6.1-sol@high
diff --git a/pstack/docs/harness/codex/sessions.mjs b/pstack/docs/harness/codex/sessions.mjs
new file mode 100644
index 000000000..4a49b1474
--- /dev/null
+++ b/pstack/docs/harness/codex/sessions.mjs
@@ -0,0 +1,121 @@
+#!/usr/bin/env node
+
+import { createReadStream, existsSync, realpathSync } from "node:fs";
+import { once } from "node:events";
+import { readdir, stat } from "node:fs/promises";
+import { homedir } from "node:os";
+import { isAbsolute, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { parseArgs } from "node:util";
+import * as zlib from "node:zlib";
+
+async function* rollouts(directory) {
+  let entries;
+  try {
+    entries = await readdir(directory, { withFileTypes: true });
+  } catch (error) {
+    if (error.code === "ENOENT") return;
+    throw error;
+  }
+  for (const entry of entries) {
+    const path = join(directory, entry.name);
+    if (entry.isDirectory()) yield* rollouts(path);
+    else if (entry.isFile() && /\.jsonl(?:\.zst)?$/.test(entry.name)) yield path;
+  }
+}
+
+export async function* readRollout(path) {
+  const compressed = path.endsWith(".zst");
+  const [major, minor] = process.versions.node.split(".").map(Number);
+  const safeZstd = (major === 24 && minor >= 22) || (major === 26 && minor >= 10) || major > 26;
+  if (compressed && (!safeZstd || typeof zlib.createZstdDecompress !== "function")) {
+    throw new Error(`Compressed Codex history requires Node.js 24.22+ (24.x) or 26.10+; ${process.versions.node} may silently omit Zstd frames or accept truncated data`);
+  }
+  const source = createReadStream(path);
+  const decoded = compressed ? zlib.createZstdDecompress({ rejectGarbageAfterEnd: true }) : source;
+  if (compressed) {
+    source.on("error", (error) => decoded.destroy(error));
+    source.pipe(decoded);
+  }
+  decoded.setEncoding("utf8");
+  try {
+    for await (const chunk of decoded) yield chunk;
+  } catch (error) {
+    throw new Error(`Cannot read Codex rollout ${path}: ${error.message}`);
+  } finally {
+    source.destroy();
+    if (decoded !== source) decoded.destroy();
+  }
+}
+
+export async function* rolloutLines(path) {
+  let pending = "";
+  for await (const chunk of readRollout(path)) {
+    pending += chunk;
+    let newline;
+    while ((newline = pending.indexOf("\n")) !== -1) {
+      yield pending.slice(0, newline);
+      pending = pending.slice(newline + 1);
+    }
+  }
+  if (pending) yield pending;
+}
+
+async function sessionMetadata(path) {
+  for await (const line of rolloutLines(path)) {
+    let entry;
+    try {
+      entry = JSON.parse(line);
+    } catch {
+      throw new Error(`Invalid Codex session metadata: ${path}`);
+    }
+    const payload = entry?.payload;
+    if (entry?.type !== "session_meta" || typeof payload?.id !== "string" ||
+        typeof payload?.cwd !== "string" || !isAbsolute(payload.cwd)) {
+      throw new Error(`Invalid Codex session metadata: ${path}`);
+    }
+    const subagent = payload.source?.subagent;
+    const parentId = payload.parent_thread_id ?? subagent?.thread_spawn?.parent_thread_id;
+    const { mtimeMs } = await stat(path);
+    return {
+      id: payload.id, cwd: resolve(payload.cwd), path, modifiedAt: mtimeMs,
+      isSubagent: payload.source === "subagent" || subagent !== undefined,
+      parentId: typeof parentId === "string" ? parentId : null,
+    };
+  }
+  throw new Error(`Empty Codex rollout: ${path}`);
+}
+
+export async function readSessions(home = process.env.CODEX_HOME || join(homedir(), ".codex")) {
+  const sessions = [];
+  for (const directory of ["sessions", "archived_sessions"]) {
+    for await (const path of rollouts(join(home, directory))) sessions.push(await sessionMetadata(path));
+  }
+  return sessions.sort((a, b) => b.modifiedAt - a.modifiedAt || a.path.localeCompare(b.path));
+}
+
+if (process.argv[1] && existsSync(process.argv[1]) && realpathSync(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  try {
+    const { values } = parseArgs({ options: {
+      cwd: { type: "string" }, id: { type: "string" }, home: { type: "string" },
+      read: { type: "boolean" }, "include-subagents": { type: "boolean" },
+    } });
+    if (!values.cwd || !isAbsolute(values.cwd)) throw new Error("--cwd requires an absolute workspace path");
+    if (values.read && !values.id) throw new Error("--read requires --id and --cwd");
+    const sessions = await readSessions(values.home);
+    const matching = sessions.filter((session) => session.cwd === resolve(values.cwd) &&
+      (!values.id || session.id === values.id) &&
+      (values.id || values["include-subagents"] || !session.isSubagent));
+    if (values.read) {
+      if (!matching.length) throw new Error("No matching Codex session in the requested workspace");
+      for await (const chunk of readRollout(matching[0].path)) {
+        if (!process.stdout.write(chunk)) await once(process.stdout, "drain");
+      }
+    } else {
+      console.log(JSON.stringify(matching, null, 2));
+    }
+  } catch (error) {
+    console.error(error.message);
+    process.exitCode = 1;
+  }
+}
diff --git a/pstack/docs/harness/codex/worktree-audit.mjs b/pstack/docs/harness/codex/worktree-audit.mjs
new file mode 100644
index 000000000..9367a16e0
--- /dev/null
+++ b/pstack/docs/harness/codex/worktree-audit.mjs
@@ -0,0 +1,124 @@
+#!/usr/bin/env node
+
+import { execFileSync } from "node:child_process";
+import { existsSync, realpathSync } from "node:fs";
+import { realpath } from "node:fs/promises";
+import { join, resolve, sep } from "node:path";
+import { fileURLToPath } from "node:url";
+import { parseArgs } from "node:util";
+import { readSessions, rolloutLines } from "./sessions.mjs";
+
+const within = (cwd, root) => cwd === root || cwd.startsWith(join(root, sep));
+const recent = (modifiedAt, now) =>
+  Math.trunc((Math.floor(now / 1000) - Math.floor(modifiedAt / 1000)) / 86400) <= 4;
+
+async function canonical(path) {
+  const absolute = resolve(path);
+  try {
+    return await realpath(absolute);
+  } catch (error) {
+    if (error.code === "ENOENT") return absolute;
+    throw error;
+  }
+}
+
+function mentionsWorktree(value, paths) {
+  if (typeof value === "string") {
+    for (const path of paths) {
+      for (let index = value.indexOf(path); index !== -1; index = value.indexOf(path, index + 1)) {
+        const end = index + path.length;
+        const next = value[end];
+        if (next === undefined || /[\s/"'`;|&<>)\\]/.test(next)) return true;
+      }
+    }
+    return false;
+  }
+  return value !== null && typeof value === "object" &&
+    Object.values(value).some((child) => mentionsWorktree(child, paths));
+}
+
+export async function includeCodexActivity(output, sessions, now = Date.now(), repository) {
+  const newestFirst = (await Promise.all(sessions.map(async (session) => ({
+    ...session, cwd: await canonical(session.cwd),
+  })))).sort((a, b) => b.modifiedAt - a.modifiedAt);
+  const lines = output.split("\n");
+  const rows = [];
+  for (const [index, line] of lines.entries()) {
+    if (!line || line.startsWith("#") || line.startsWith("SIZE\t")) continue;
+    const fields = line.split("\t");
+    if (fields.length !== 9) throw new Error("Unexpected worktree audit row; cleanup is unverified");
+    const worktree = await canonical(fields[8]);
+    const paths = [...new Set([resolve(fields[8]), worktree].flatMap((path) =>
+      [path, JSON.stringify(path).slice(1, -1)]))];
+    rows.push({ fields, worktree, paths, index, session: newestFirst.find(({ cwd }) => within(cwd, worktree)) });
+  }
+  const roots = rows.map(({ worktree }) => worktree);
+  if (repository) roots.push(await canonical(repository));
+  const scoped = new Set(newestFirst.filter(({ cwd }) => roots.some((root) => within(cwd, root))));
+  const children = new Map();
+  for (const session of newestFirst) {
+    if (!session.parentId) continue;
+    if (!children.has(session.parentId)) children.set(session.parentId, []);
+    children.get(session.parentId).push(session);
+  }
+  for (const session of scoped) {
+    for (const child of children.get(session.id) || []) scoped.add(child);
+  }
+  for (const session of newestFirst) {
+    if (!scoped.has(session) || !recent(session.modifiedAt, now)) continue;
+    const candidates = rows.filter((row) => !row.session || row.session.modifiedAt < session.modifiedAt);
+    if (!candidates.length) continue;
+    for await (const line of rolloutLines(session.path)) {
+      let entry;
+      try { entry = JSON.parse(line); } catch {
+        throw new Error(`Invalid Codex rollout during worktree audit: ${session.path}`);
+      }
+      for (let i = candidates.length - 1; i >= 0; i--) {
+        if (mentionsWorktree(entry, candidates[i].paths)) {
+          candidates[i].session = session;
+          candidates.splice(i, 1);
+        }
+      }
+      if (!candidates.length) break;
+    }
+  }
+  for (const { fields, index, session } of rows) {
+    if (!session) continue;
+    const date = new Date(session.modifiedAt);
+    const day = [date.getFullYear(), String(date.getMonth() + 1).padStart(2, "0"),
+      String(date.getDate()).padStart(2, "0")].join("-");
+    if (fields[6] === "-" || day > fields[6]) fields[6] = day;
+    if (recent(session.modifiedAt, now) && ["safe", "review"].includes(fields[7])) {
+      fields[7] = "verify-recent-chat";
+    }
+    lines[index] = fields.join("\t");
+  }
+  return lines.join("\n");
+}
+
+if (process.argv[1] && existsSync(process.argv[1]) && realpathSync(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  try {
+    const { values, positionals } = parseArgs({ allowPositionals: true, options: {
+      home: { type: "string" }, base: { type: "string", short: "b" },
+      help: { type: "boolean", short: "h" },
+    } });
+    if (positionals.length > 1) throw new Error("Expected at most one repository path");
+    const script = fileURLToPath(new URL("../../../skills/poteto-mode/scripts/worktree-audit.sh", import.meta.url));
+    const args = values.help ? ["--help"] : [
+      ...(values.base ? ["-b", values.base] : []), ...positionals,
+    ];
+    const output = execFileSync("bash", [script, ...args], {
+      encoding: "utf8", stdio: ["ignore", "pipe", "inherit"], maxBuffer: 16 * 1024 * 1024,
+    });
+    if (values.help) {
+      process.stdout.write(output + "\nCodex history: --home <codex-home> overrides CODEX_HOME.\n");
+    } else {
+      const worktrees = execFileSync("git", ["-C", positionals[0] || process.cwd(), "worktree", "list", "--porcelain"], { encoding: "utf8" });
+      const main = worktrees.split("\n").find((line) => line.startsWith("worktree ")).slice("worktree ".length);
+      process.stdout.write(await includeCodexActivity(output, await readSessions(values.home), Date.now(), main));
+    }
+  } catch (error) {
+    console.error(error.message);
+    process.exitCode = 1;
+  }
+}
diff --git a/pstack/docs/harness/upstream.json b/pstack/docs/harness/upstream.json
new file mode 100644
index 000000000..d257c58c3
--- /dev/null
+++ b/pstack/docs/harness/upstream.json
@@ -0,0 +1,7 @@
+{
+  "repository": "https://github.com/cursor/plugins",
+  "main": "bb68f2365eceafa0cb2d253112f675acf5f144cc",
+  "pstackVersion": "0.15.36",
+  "codexPullRequest": 1143,
+  "codexCommit": "1937543ca806041f6a9111aa97961e5bd274b7d6"
+}
diff --git a/pstack/hooks/hooks.json b/pstack/hooks/hooks.json
new file mode 100644
index 000000000..513600913
--- /dev/null
+++ b/pstack/hooks/hooks.json
@@ -0,0 +1,28 @@
+{
+  "hooks": {
+    "SessionStart": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "python3 \"${PLUGIN_ROOT}/hooks/poteto_mode.py\"",
+            "timeout": 5,
+            "additionalContextLimit": 300
+          }
+        ]
+      }
+    ],
+    "UserPromptSubmit": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "python3 \"${PLUGIN_ROOT}/hooks/poteto_mode.py\"",
+            "timeout": 5,
+            "additionalContextLimit": 300
+          }
+        ]
+      }
+    ]
+  }
+}
diff --git a/pstack/hooks/poteto_mode.py b/pstack/hooks/poteto_mode.py
new file mode 100644
index 000000000..032e0f256
--- /dev/null
+++ b/pstack/hooks/poteto_mode.py
@@ -0,0 +1,78 @@
+import hashlib
+import json
+import os
+from pathlib import Path
+import re
+import sys
+
+
+COMMAND = re.compile(
+    r"(?:poteto\s*(?:mode|모드)|포테토\s*모드|\$pstack:poteto-mode)"
+    r"\s+(on|off|status|켜줘|꺼줘|상태)[.!]?",
+    re.IGNORECASE,
+)
+ACTIONS = {"on": "on", "켜줘": "on", "off": "off", "꺼줘": "off", "status": "status", "상태": "status"}
+
+
+def emit(event_name, context, status=None):
+    output = {"hookSpecificOutput": {"hookEventName": event_name, "additionalContext": context}}
+    if status:
+        output["systemMessage"] = status
+    print(json.dumps(output, ensure_ascii=False))
+
+
+def handle(event):
+    event_name = event.get("hook_event_name")
+    if event_name not in ("SessionStart", "UserPromptSubmit"):
+        return
+    prompt = event.get("prompt", "")
+    if not isinstance(prompt, str):
+        return
+    lines = prompt.strip().splitlines()
+    match = COMMAND.fullmatch(lines[0].strip()) if lines and event_name == "UserPromptSubmit" else None
+    action = ACTIONS[match.group(1).lower()] if match else None
+    session_id = event.get("session_id")
+    data_dir = os.environ.get("PLUGIN_DATA")
+    if not isinstance(session_id, str) or not session_id.strip() or not data_dir:
+        if action:
+            emit(event_name, "LStack session persistence is unavailable. Do not claim the mode is saved; use current-turn-only behavior.", "Poteto 모드 상태를 저장할 수 없습니다.")
+        return
+    key = hashlib.sha256(session_id.encode()).hexdigest()
+    marker = Path(data_dir) / "poteto-mode" / f"{key}.enabled"
+    try:
+        if event_name == "SessionStart" and event.get("source") in ("clear", "fork"):
+            marker.unlink(missing_ok=True)
+        if action == "on":
+            marker.parent.mkdir(parents=True, exist_ok=True)
+            marker.touch(mode=0o600)
+        elif action == "off":
+            marker.unlink(missing_ok=True)
+        enabled = marker.is_file()
+    except OSError:
+        emit(event_name, "LStack could not access its session state. Do not claim persistence; use current-turn-only behavior.", "Poteto 모드 상태를 확인하거나 저장하지 못했습니다.")
+        return
+    restoring = event_name == "SessionStart" and event.get("source") in ("resume", "compact", "clear", "fork")
+    if not enabled and action is None and not restoring:
+        return
+    if enabled:
+        skill = Path(__file__).resolve().parent.parent / "skills" / "poteto-mode" / "SKILL.md"
+        context = f"LStack Poteto Mode is ON for this conversation. Follow {skill} for this request. Reuse it if already loaded; read it again after compaction. This does not change permissions or model settings."
+    else:
+        context = "LStack Poteto Mode is OFF for this conversation. Do not continue persistent Poteto routing. Explicit skill invocations still apply to their request."
+    if action and not any(line.strip() for line in lines[1:]):
+        context += " This is only a mode-control request; acknowledge the state without starting a work playbook."
+    status = f"Poteto 모드 {'켜짐' if enabled else '꺼짐'}" if action else None
+    emit(event_name, context, status)
+
+
+def main():
+    try:
+        event = json.load(sys.stdin)
+    except (json.JSONDecodeError, UnicodeError):
+        return
+    if isinstance(event, dict):
+        handle(event)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/pstack/hooks/tests/test_poteto_mode.py b/pstack/hooks/tests/test_poteto_mode.py
new file mode 100644
index 000000000..106603113
--- /dev/null
+++ b/pstack/hooks/tests/test_poteto_mode.py
@@ -0,0 +1,141 @@
+import json
+import os
+from pathlib import Path
+import shutil
+import subprocess
+import tempfile
+import unittest
+
+
+ROOT = Path(__file__).resolve().parents[2]
+
+
+class PotetoModeTest(unittest.TestCase):
+    def setUp(self):
+        self.scratch = tempfile.TemporaryDirectory(prefix="lstack-mode-")
+        self.addCleanup(self.scratch.cleanup)
+        self.root = Path(self.scratch.name)
+        self.data = self.root / "data"
+        self.env = {**os.environ, "PLUGIN_ROOT": str(ROOT), "PLUGIN_DATA": str(self.data)}
+
+    def hook(self, prompt="", session="chat-a", event="UserPromptSubmit", source=None, env=None):
+        payload = {"hook_event_name": event, "session_id": session, "prompt": prompt}
+        if source:
+            payload["source"] = source
+        manifest = json.loads((ROOT / "hooks/hooks.json").read_text())
+        command = manifest["hooks"][event][0]["hooks"][0]["command"]
+        result = subprocess.run(command, shell=True, input=json.dumps(payload), text=True, capture_output=True, env=env or self.env, check=True)
+        self.assertEqual(result.stderr, "")
+        return json.loads(result.stdout) if result.stdout else None
+
+    def context(self, result):
+        return result["hookSpecificOutput"]["additionalContext"]
+
+    def test_new_conversation_is_off_and_does_not_create_state(self):
+        self.assertIsNone(self.hook("관련 코드를 조사해줘"))
+        self.assertFalse(self.data.exists())
+
+    def test_enable_persists_for_followup_without_repeating_the_command(self):
+        self.assertIn("켜짐", self.hook("poteto 모드 켜줘")["systemMessage"])
+        result = self.hook("이제 구현해줘")
+        self.assertIn("is ON", self.context(result))
+        self.assertIn(str(ROOT / "skills/poteto-mode/SKILL.md"), self.context(result))
+        self.assertNotIn("systemMessage", result)
+        self.assertNotIn("mode-control request", self.context(result))
+
+    def test_off_stops_followup_routing(self):
+        self.hook("poteto mode on")
+        self.assertIn("is OFF", self.context(self.hook("poteto 모드 꺼줘")))
+        self.assertIsNone(self.hook("다음 작업을 해줘"))
+
+    def test_sessions_are_independent(self):
+        self.hook("포테토 모드 켜줘", session="chat-a")
+        self.assertIsNone(self.hook("구현해줘", session="chat-b"))
+        self.hook("poteto mode on", session="chat-b")
+        self.hook("poteto mode off", session="chat-a")
+        self.assertIn("is ON", self.context(self.hook("구현해줘", session="chat-b")))
+
+    def test_resume_and_compaction_restore_the_same_conversation(self):
+        self.hook("poteto mode on")
+        for source in ("resume", "compact"):
+            with self.subTest(source=source):
+                result = self.hook(event="SessionStart", source=source)
+                self.assertEqual(result["hookSpecificOutput"]["hookEventName"], "SessionStart")
+                self.assertIn("is ON", self.context(result))
+
+    def test_new_fork_is_off_and_parent_stays_on(self):
+        self.hook("poteto mode on", session="parent")
+        self.assertIn("is OFF", self.context(self.hook(session="child", event="SessionStart", source="fork")))
+        self.assertIsNone(self.hook("작업해줘", session="child"))
+        self.assertIn("is ON", self.context(self.hook("작업해줘", session="parent")))
+
+    def test_clear_resets_the_conversation(self):
+        self.hook("poteto mode on")
+        self.assertIn("is OFF", self.context(self.hook(event="SessionStart", source="clear")))
+        self.assertIsNone(self.hook("구현해줘"))
+
+    def test_disabled_resume_and_compaction_override_earlier_mode_context(self):
+        self.hook("poteto mode on")
+        self.hook("poteto mode off")
+        for source in ("resume", "compact"):
+            with self.subTest(source=source):
+                self.assertIn("is OFF", self.context(self.hook(event="SessionStart", source=source)))
+
+    def test_repeated_on_and_off_are_idempotent(self):
+        for _ in range(2):
+            self.assertIn("켜짐", self.hook("poteto mode on")["systemMessage"])
+        self.assertEqual(len(list(self.data.rglob("*.enabled"))), 1)
+        for _ in range(2):
+            self.assertIn("꺼짐", self.hook("poteto mode off")["systemMessage"])
+        self.assertIsNone(self.hook("작업해줘"))
+
+    def test_status_observes_without_enabling(self):
+        self.assertIn("꺼짐", self.hook("poteto 모드 상태")["systemMessage"])
+        self.assertFalse(self.data.exists())
+        self.hook("poteto mode on")
+        self.assertIn("켜짐", self.hook("$pstack:poteto-mode status")["systemMessage"])
+        self.assertIn("is ON", self.context(self.hook("작업해줘")))
+
+    def test_command_only_acknowledges_but_command_with_task_runs_the_task(self):
+        self.assertIn("mode-control request", self.context(self.hook("poteto mode on")))
+        self.assertNotIn("mode-control request", self.context(self.hook("poteto mode on\n\n버그를 수정해줘")))
+
+    def test_mentions_quotes_and_one_shot_invocation_do_not_enable_persistence(self):
+        for prompt in ('"poteto mode on"', "```text\npoteto mode on\n```", "poteto 모드 켜줘라는 문구를 설명해줘", "$pstack:poteto-mode 버그를 수정해줘"):
+            with self.subTest(prompt=prompt):
+                self.assertIsNone(self.hook(prompt))
+                self.assertIsNone(self.hook("다음 작업"))
+
+    def test_missing_identity_or_data_reports_current_turn_only(self):
+        self.assertIn("current-turn-only", self.context(self.hook("poteto mode on", session=None)))
+        env = dict(self.env)
+        env.pop("PLUGIN_DATA")
+        self.assertIn("current-turn-only", self.context(self.hook("poteto mode on", env=env)))
+        self.assertFalse(self.data.exists())
+
+    def test_unwritable_state_does_not_claim_the_mode_was_saved(self):
+        self.data.write_text("not a directory")
+        result = self.hook("poteto mode on")
+        self.assertIn("current-turn-only", self.context(result))
+        self.assertNotIn("켜짐", result["systemMessage"])
+
+    def test_hook_command_supports_plugin_paths_with_spaces(self):
+        plugin = self.root / "plugin with spaces"
+        shutil.copytree(ROOT / "hooks", plugin / "hooks")
+        env = {**self.env, "PLUGIN_ROOT": str(plugin)}
+        self.assertIn(str(plugin / "skills/poteto-mode/SKILL.md"), self.context(self.hook("poteto mode on", env=env)))
+
+    def test_malformed_input_does_not_mutate_state(self):
+        for payload in ("{", "[]", '{"hook_event_name":"SessionStart","session_id":[]}'):
+            result = subprocess.run(["python3", str(ROOT / "hooks/poteto_mode.py")], input=payload, text=True, capture_output=True, env=self.env)
+            self.assertEqual(result.returncode, 0)
+            self.assertEqual(result.stdout, "")
+        self.assertFalse(self.data.exists())
+
+    def test_large_prompts_only_receive_a_short_skill_reference(self):
+        self.hook("poteto mode on")
+        self.assertLess(len(self.context(self.hook("작업 " * 10000))), 1000)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/pstack/plugin.json b/pstack/plugin.template.json
similarity index 59%
rename from pstack/plugin.json
rename to pstack/plugin.template.json
index 075405e6a..7df458381 100644
--- a/pstack/plugin.json
+++ b/pstack/plugin.template.json
@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "pstack",
-  "version": "0.15.36-lstack.1",
+  "version": "0.15.36-lstack.3",
   "description": "if you want to go fast, go deep first. pstack helps you write less, but higher quality code. rigorous agent workflows you can parallelize with confidence.",
   "author": {
     "name": "Lauren Tan"
@@ -9,17 +9,6 @@
   "homepage": "https://github.com/cursor/plugins/tree/main/pstack",
   "repository": "https://github.com/cursor/plugins",
   "license": "MIT",
-  "extensions": {
-    "com.openai": {
-      "interface": {
-        "displayName": "LStack (LifeMashStack)",
-        "shortDescription": "pstack engineering workflows for Codex",
-        "developerName": "LifeMash, based on Lauren Tan's pstack",
-        "category": "Developer Tools",
-        "defaultPrompt": ["Use $pstack:poteto-mode for this task."]
-      }
-    }
-  },
   "keywords": [
     "pstack",
     "poteto-mode",
diff --git a/pstack/skills/poteto-help/SKILL.md b/pstack/skills/poteto-help/SKILL.md
index 4c198e433..b12f22c85 100644
--- a/pstack/skills/poteto-help/SKILL.md
+++ b/pstack/skills/poteto-help/SKILL.md
@@ -10,7 +10,7 @@ In Codex, first read [the Codex adapter](../../docs/harness/codex.md) once per t
 
 Answer the user's question about pstack, hand them a prompt they can send, and link the file the answer came from. For a help question, don't start the work. The user asked how, and a pstack run spends real tokens, so let them send the prompt.
 
-A message that asks for work, such as "use pstack to fix this bug", is not a help question. Read [`poteto-mode`](../poteto-mode/SKILL.md), do the work under it, and mention once that a Custom Mode keeps it on.
+A message that asks for work, such as "use pstack to fix this bug", is not a help question. Read [`poteto-mode`](../poteto-mode/SKILL.md) and do the work under it. In Cursor, mention once that a Custom Mode keeps it on.
 
 This file maps questions to the skills and guide pages that hold the answers. Those files own the details. Read the file you route to before you quote it, and trust it when it disagrees with this map. The links here point into the installed plugin, which the user may not be able to open, so give the user the file's public copy: `https://github.com/cursor/plugins/blob/main/pstack/` followed by its path.
 
@@ -37,7 +37,7 @@ When the model rule is missing and it matters, ask whether the user wants to pic
 
 ## Get set up
 
-1. Install with `/add-plugin pstack` in chat, or from Customize in the sidebar.
+1. Use the installation steps for the user's host in [guide page 1](../../docs/guide/01-setup.md).
 2. Run [`/setup-pstack`](../setup-pstack/SKILL.md). It asks for a reasoning budget, maps a model to each role, and writes a rule. The rule applies to new chats. Then it offers once each to generate a verification skill and a formal verification skill for the project, unless the project already has one.
 3. Start a real task with `/poteto-mode`, a goal, and a check that can pass or fail.
 
@@ -45,15 +45,17 @@ Installing changes nothing until the user invokes a skill. Only `/setup-pstack`
 
 If cost is the worry, say where the tokens go and how to spend fewer. pstack spends extra tokens on subagents and review panels. Rerun `/setup-pstack` and pick a smaller budget or cheaper models. A role set to `auto` or `inherit-parent` runs on the chat's model, which saves tokens when the chat runs on Auto or a cheaper model. A shorter panel list runs fewer subagents, one for each entry. Save `/poteto-mode` for work that needs rigor.
 
-pstack is built for Cursor, and it also installs in Claude Code with `/plugin marketplace add cursor/plugins`, then `/plugin install pstack@cursor-plugins`. There, each command takes a `pstack:` prefix, such as `/pstack:poteto-mode`. The [Claude Code adapter](../../docs/harness/claude-code.md) maps the Cursor names, and a step that needs a Cursor-only feature, such as Bugbot or Automations, is skipped with a one-line note.
+pstack supports Cursor, Claude Code, and Codex. In Claude Code, each command takes a `pstack:` prefix, such as `/pstack:poteto-mode`. The [Claude Code adapter](../../docs/harness/claude-code.md) maps the Cursor names.
 
-Other tools can read the skills, because they use the Agent Skills format. But most workflow skills, including `/poteto-mode`, `/how`, `/why`, and `/teach`, spawn Cursor subagents with per-role models, and Custom Modes and `/loop` are Cursor features, so those parts may not work there.
+In Codex, select the installed pstack skill or use `$pstack:name`, such as `$pstack:poteto-mode`. Read the [Codex adapter](../../docs/harness/codex.md) for tools, model choices, and history. Use the skill for one request, or say `poteto 모드 켜줘` to keep LStack routing on for this conversation. Say `poteto 모드 꺼줘` to turn it off. Cursor Custom Modes and `/loop` do not apply in Codex.
+
+For a step that needs a Cursor-only feature, follow the host adapter's skip rule and report the missing check. Other tools can read the Agent Skills files, but need their own mappings for tools and subagents.
 
 ## Start a task with `/poteto-mode`
 
 `/poteto-mode` matches the task to a playbook, copies the playbook's steps into the todo list, and runs the other skills as the steps need them. A step it skips stays in the list as `skip: <reason>`. A good prompt states the goal and how to tell it's done. It doesn't list skills, because a hand-written sequence tends to drop or reorder steps the playbook would keep. Read [`references/prompting.md`](references/prompting.md) before you help word one. [Guide page 2](../../docs/guide/02-poteto-mode.md) has examples.
 
-Whether `/poteto-mode` stays on depends on how the user starts it:
+In Cursor, whether `/poteto-mode` stays on depends on how the user starts it:
 
 - Enter on `/poteto-mode` attaches the skill to one message. It fades as the chat moves on.
 - Option+Enter on Mac or Alt+Enter on Windows, or Use as Mode from the skill entry, makes it a Custom Mode. It stays in context every turn until the user exits the mode, and it stays out of casual turns.
diff --git a/pstack/skills/poteto-mode/SKILL.md b/pstack/skills/poteto-mode/SKILL.md
index 661aece61..eb6a761c9 100644
--- a/pstack/skills/poteto-mode/SKILL.md
+++ b/pstack/skills/poteto-mode/SKILL.md
@@ -107,10 +107,10 @@ You own every subagent's work. Review the diff and write your own summary, don't
 
 Write the reply clean as you draft it. A cleanup pass after drafting does not remove these patterns.
 
-- **Short declarative sentences.** One thought per sentence, ended with a period.
+- **English prose.** Use short declarative sentences, one thought per sentence, ended with a period. For Korean, follow [the Korean writing rules](references/korean-writing.md) for sentence and paragraph structure instead.
 - **No long-dash character anywhere.** Write a file-list bullet as a sentence ("`main.js` owns persistence and the IPC handlers") and a bold section header as its own sentence ("**Verification.** End to end via CDP").
 - **A colon as a mid-sentence connector is also out** (unslop rule 14). A colon before a list is fine.
-- **Terse is not an excuse to drop content.** Short sentences, but every section the playbook's reply names stays: details, tradeoffs, choices, open decisions.
+- **Terse is not an excuse to drop content.** Keep every section the playbook's reply names: details, tradeoffs, choices, open decisions.
 - **Frame impact for the consumer and the maintainer.** Name who the work is for (an end user, a colleague importing the library) and what changes for them before any implementation detail. Then what the next engineer who owns this code inherits. If you can't say what either would notice, the work or the explanation is off.
 - **Never fabricate a link, citation, or transcript reference.** Link only artifacts you produced or read this session.
 - **Every claim carries its evidence or its label in the same sentence.** Measured, inferred, or guess. A prediction or an unseen cause is a guess. Never hand the human a check you could run.
diff --git a/pstack/skills/poteto-mode/references/korean-writing.md b/pstack/skills/poteto-mode/references/korean-writing.md
new file mode 100644
index 000000000..88b03105b
--- /dev/null
+++ b/pstack/skills/poteto-mode/references/korean-writing.md
@@ -0,0 +1,14 @@
+# 한국어 답변과 문서 작성
+
+한국어에서는 이 지침을 영어의 문장 길이, 연결 방식, 목록 형식 규칙보다 우선합니다. 목표는 문장을 짧게 만드는 것이 아니라 주장과 근거를 분명하게 전달하는 것입니다.
+
+- 이유, 조건, 대조, 결과로 연결된 내용은 연결 어미로 잇고, 서로 독립된 사실은 문장을 나눕니다. 길이나 단어 수만으로 문장을 끊지 않습니다.
+- 한 문장의 연결 어미는 둘 정도를 기준으로 삼습니다. 셋 이상 이어져 읽기 어려우면 관계가 가장 약한 지점에서 나누며, 개수만 맞추려고 자연스러운 문장을 쪼개지 않습니다.
+- 문단 첫 문장에 요지를 두고 뒤에서 근거를 설명하며, 한 문단에는 주제 하나만 둡니다.
+- 같은 종결 어미가 반복되면 내용의 관계에 맞춰 문장 구조를 조정합니다. 반복을 피하려고 주어나 동의어를 억지로 덧붙이지 않습니다.
+- 생략한 주어나 지시어 때문에 대상을 다시 찾아야 한다면 구체적인 이름을 씁니다. 대상이 분명할 때는 같은 주어를 매번 반복하지 않습니다.
+- 목록과 표는 같은 기준으로 비교할 수 있는 병렬 항목에 씁니다. 인과나 순서를 설명하는 내용을 글머리표로 잘게 나누지 않습니다.
+- 긴 대시와 문장 중간의 연결용 콜론을 쓰지 않고, 주장에는 근거나 측정, 추정, 추측의 구분을 같은 문장에 붙입니다. 판단은 명확하게 쓰되 실제 불확실성을 숨기지는 않습니다.
+- 짧게 쓰려고 필요한 세부 사항, 장단점, 남은 결정을 빼지 않습니다.
+
+문장 예시에서 "린트가 이미 이 경우를 막습니다. 그래서 이 주석은 불필요합니다."는 "린트가 이미 이 경우를 막으므로 이 주석은 불필요합니다."로 잇습니다.
diff --git a/pstack/skills/technical-writing/SKILL.md b/pstack/skills/technical-writing/SKILL.md
index 0acae4218..ae4cb98a7 100644
--- a/pstack/skills/technical-writing/SKILL.md
+++ b/pstack/skills/technical-writing/SKILL.md
@@ -10,6 +10,8 @@ In Codex, first read [the Codex adapter](../../docs/harness/codex.md) once per t
 
 Write so a tired engineer understands on the first read. Apply all four layers.
 
+For Korean prose, [the Korean writing rules](../poteto-mode/references/korean-writing.md) take precedence over the English sentence-length, connective, and list-format rules below.
+
 Three rules sit above the layers:
 
 - **Cut every word that does no work.** If the sentence survives without a word, the word goes. "In order to" is "to". "It is important to note that" is nothing.
diff --git a/pstack/skills/unslop/SKILL.md b/pstack/skills/unslop/SKILL.md
index 97f5b6412..d075aa4e0 100644
--- a/pstack/skills/unslop/SKILL.md
+++ b/pstack/skills/unslop/SKILL.md
@@ -54,7 +54,7 @@ Rule numbers are stable ids that other skills cite. A removed rule leaves a gap.
 ### Plain speech
 
 27. **Say what it does, not how it feels.** "the database stays close at hand", "SQL you can read", "types that follow your schema" name a feeling. The fix names the mechanism or a number: "`.toSQL()` returns the exact string sent to the database", "a column rename fails the build". Ask what the sentence tells the reader to do or know, then write that. If you can't restate it as a concrete instruction, fact, or number, cut it. One more check: if the sentence could appear unchanged in another project's docs, it says nothing about this one. Cut it.
-28. **Shorten or split dense sentences.** If the reader has to backtrack to parse a sentence, break it in two or drop clauses. One idea per sentence.
+28. **Shorten or split dense sentences.** If the reader has to backtrack to parse a sentence, break it in two or drop clauses. One idea per sentence. For Korean, apply [the Korean writing rules](../poteto-mode/references/korean-writing.md) instead of mechanically splitting connected ideas.
 29. **Active voice.** Prefer it. Catch "is/are/was/were + past participle" and name the actor: "queries are validated" becomes "the compiler validates queries", "the file is parsed by the loader" becomes "the loader parses the file". Passive is fine only when the actor is unknown or genuinely doesn't matter.
 30. **Cut adverbs, or use a stronger verb.** "runs quickly" becomes "is fast" or the number, and "significantly improves" becomes the measured delta. An adverb propping up a weak verb means the verb is wrong.
 31. **Prefer the plain word.** "utilize" and "leverage" become "use", "facilitate" becomes "help", "numerous" becomes "many", "in the event that" becomes "if". The fancier synonym is rarely clearer.
diff --git a/scripts/configure-lstack-codex.mjs b/scripts/configure-lstack-codex.mjs
index 53346e716..2a2e79975 100644
--- a/scripts/configure-lstack-codex.mjs
+++ b/scripts/configure-lstack-codex.mjs
@@ -42,5 +42,9 @@ if (!existsSync(join(root, "pstack", "docs", "harness", "codex.md"))) throw new
 const marketplace = JSON.parse(readFileSync(join(root, ".agents", "plugins", "marketplace.json"), "utf8"));
 const manifest = JSON.parse(readFileSync(join(root, "pstack", ".codex-plugin", "plugin.json"), "utf8"));
 if (marketplace.plugins[0].name !== manifest.name || manifest.skills !== "./skills/") throw new Error("Codex plugin registration mismatch");
+if (manifest.hooks) {
+  if (existsSync(join(root, "pstack", "plugin.json"))) throw new Error("Codex 0.166.0 skips Agent Plugins hooks; keep the shared manifest in plugin.template.json");
+  if (!existsSync(join(root, "pstack", manifest.hooks))) throw new Error("Missing Codex hook configuration");
+}
 console.log(`${count} skills ${check ? "checked" : "configured"}; ${errors} errors`);
 process.exitCode = errors ? 1 : 0;
diff --git a/scripts/generate-pstack-harness-trees.mjs b/scripts/generate-pstack-harness-trees.mjs
index d4fa0fc6c..778269b51 100644
--- a/scripts/generate-pstack-harness-trees.mjs
+++ b/scripts/generate-pstack-harness-trees.mjs
@@ -18,7 +18,7 @@ const GITHUB = "https://github.com/cursor/plugins";
 const LINK = /\]\(([^)\s]+)\)/g;
 const README = `# pstack harness tree
 
-This folder is generated from \`pstack/skills\`, \`pstack/agents\`, \`pstack/${GUIDE}\`, \`pstack/${ADAPTER}\`, \`pstack/README.md\`, \`pstack/LICENSE\`, and \`pstack/plugin.json\`. Do not edit it by hand.
+This folder is generated from \`pstack/skills\`, \`pstack/agents\`, \`pstack/${GUIDE}\`, \`pstack/${ADAPTER}\`, \`pstack/README.md\`, \`pstack/LICENSE\`, and \`pstack/plugin.template.json\`. Do not edit it by hand.
 
 Cursor uses \`pstack/\` directly, and Claude Code installs \`${TREE}/\`. The tree leaves out the rest of \`pstack/\`, such as \`pstack/automations\` and \`pstack/assets\`. A relative link to a pstack file that the tree leaves out points at that file on GitHub \`main\` instead.
 
@@ -137,11 +137,7 @@ function render() {
   }
   files.set("LICENSE", file(join(PSTACK, "LICENSE")));
   files.set("LICENSE-cursor-team-kit", file(join(PSTACK, "LICENSE-cursor-team-kit")));
-  const manifest = JSON.parse(readFileSync(join(PSTACK, "plugin.json"), "utf8"));
-  if (manifest.extensions) {
-    delete manifest.extensions["com.openai"];
-    if (Object.keys(manifest.extensions).length === 0) delete manifest.extensions;
-  }
+  const manifest = JSON.parse(readFileSync(join(PSTACK, "plugin.template.json"), "utf8"));
   for (const path of MANIFESTS) files.set(path, { bytes: Buffer.from(`${JSON.stringify(manifest, null, 2)}\n`), executable: false });
   for (const [path, entry] of files) {
     if (!path.endsWith(".md")) continue;
diff --git a/scripts/test/pstack-codex-history.test.mjs b/scripts/test/pstack-codex-history.test.mjs
new file mode 100644
index 000000000..7223904e3
--- /dev/null
+++ b/scripts/test/pstack-codex-history.test.mjs
@@ -0,0 +1,434 @@
+import assert from "node:assert/strict";
+import { mkdirSync, mkdtempSync, realpathSync, rmSync, symlinkSync, unlinkSync, utimesSync, writeFileSync } from "node:fs";
+import { randomBytes } from "node:crypto";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import { spawnSync } from "node:child_process";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { test } from "node:test";
+import { zstdCompressSync } from "node:zlib";
+import { readSessions } from "../../pstack/docs/harness/codex/sessions.mjs";
+import { includeCodexActivity } from "../../pstack/docs/harness/codex/worktree-audit.mjs";
+
+// Expected last-chat dates are UTC days. The local-time test sets its own TZ.
+process.env.TZ = "UTC";
+
+const pstack = fileURLToPath(new URL("../../pstack", import.meta.url));
+const cli = join(pstack, "docs/harness/codex/sessions.mjs");
+const auditCli = join(pstack, "docs/harness/codex/worktree-audit.mjs");
+const helpFooter = /\S[\s\S]*\nCodex history: --home <codex-home> overrides CODEX_HOME\.\n$/;
+
+function fixture(t) {
+  const root = realpathSync(mkdtempSync(join(tmpdir(), "pstack-codex-history-")));
+  t.after(() => rmSync(root, { recursive: true, force: true }));
+  const workspace = join(root, "workspace with spaces");
+  const rollout = (relative, id, cwd, modifiedAt, { body = "not JSON; message bodies must not be parsed\n", source = "cli", meta = {} } = {}) => {
+    const path = join(root, relative);
+    mkdirSync(dirname(path), { recursive: true });
+    const content = JSON.stringify({ type: "session_meta", payload: { id, cwd, source, ...meta } }) + "\n" + body;
+    writeFileSync(path, path.endsWith(".zst") ? zstdCompressSync(content) : content);
+    utimesSync(path, modifiedAt / 1000, modifiedAt / 1000);
+    return path;
+  };
+  const run = (...args) => spawnSync(process.execPath, [cli, "--home", root, ...args], { encoding: "utf8", maxBuffer: 4 * 1024 * 1024 });
+  return { root, workspace, rollout, run };
+}
+
+test("session lookup scopes active and archived history to the exact workspace", (t) => {
+  const f = fixture(t);
+  const active = f.rollout("sessions/2026/10/01/active.jsonl", "active", f.workspace, 1000);
+  const archived = f.rollout("archived_sessions/archived.jsonl", "archived", f.workspace, 2000);
+  f.rollout("sessions/unrelated.jsonl", "unrelated", f.workspace + "-other", 3000);
+  f.rollout("sessions/subfolder.jsonl", "subfolder", join(f.workspace, "nested-project"), 4000);
+  const result = f.run("--cwd", f.workspace);
+  assert.equal(result.status, 0, result.stderr);
+  assert.deepEqual(JSON.parse(result.stdout).map(({ id, path }) => ({ id, path })), [
+    { id: "archived", path: archived }, { id: "active", path: active },
+  ]);
+  assert.deepEqual(JSON.parse(f.run("--cwd", f.workspace, "--id", "active").stdout).map(({ id }) => id), ["active"]);
+  assert.deepEqual(JSON.parse(f.run("--cwd", f.workspace, "--id", "unrelated").stdout), []);
+});
+
+test("missing history is empty but malformed metadata fails the lookup", async (t) => {
+  const f = fixture(t);
+  assert.deepEqual(await readSessions(f.root), []);
+  const path = f.rollout("sessions/broken.jsonl", "broken", f.workspace, 1000);
+  writeFileSync(path, JSON.stringify({ type: "session_meta", payload: { id: "broken" } }) + "\n");
+  const result = f.run("--cwd", f.workspace);
+  assert.equal(result.status, 1);
+  assert.match(result.stderr, /Invalid Codex session metadata/);
+  assert.equal(result.stdout, "");
+  assert.equal(f.run("--cwd", "relative/path").status, 1);
+});
+
+test("both CLIs run when invoked through a symlinked install path", (t) => {
+  const f = fixture(t);
+  const link = join(f.root, "pstack-link");
+  symlinkSync(pstack, link);
+  const via = (script, ...args) =>
+    spawnSync(process.execPath, [join(link, "docs/harness/codex", script), ...args], { encoding: "utf8" });
+  const rejected = via("sessions.mjs", "--cwd", "relative");
+  assert.equal(rejected.status, 1);
+  assert.match(rejected.stderr, /--cwd requires an absolute workspace path/);
+  f.rollout("sessions/linked.jsonl", "linked", f.workspace, 1000);
+  const listed = via("sessions.mjs", "--home", f.root, "--cwd", f.workspace);
+  assert.equal(listed.status, 0, listed.stderr);
+  assert.deepEqual(JSON.parse(listed.stdout).map(({ id }) => id), ["linked"]);
+  const help = via("worktree-audit.mjs", "--help");
+  assert.equal(help.status, 0, help.stderr);
+  assert.match(help.stdout, helpFooter);
+});
+
+test("both helpers import as libraries when the process argument is not a file", () => {
+  const source = `const { readSessions } = await import(${JSON.stringify(pathToFileURL(cli).href)});
+const { includeCodexActivity } = await import(${JSON.stringify(pathToFileURL(auditCli).href)});
+console.log(typeof readSessions, typeof includeCodexActivity);`;
+  const result = spawnSync(process.execPath, ["--input-type=module", "-e", source, "missing-argument"], { encoding: "utf8" });
+  assert.equal(result.status, 0, result.stderr);
+  assert.equal(result.stdout, "function function\n");
+});
+
+test("history defaults to CODEX_HOME when --home is absent", (t) => {
+  const f = fixture(t);
+  f.rollout("sessions/home.jsonl", "home", f.workspace, 1000);
+  const run = (env, ...args) =>
+    spawnSync(process.execPath, [cli, "--cwd", f.workspace, ...args], { encoding: "utf8", env: { ...process.env, ...env } });
+  const defaulted = run({ CODEX_HOME: f.root });
+  assert.equal(defaulted.status, 0, defaulted.stderr);
+  assert.deepEqual(JSON.parse(defaulted.stdout).map(({ id }) => id), ["home"]);
+  assert.deepEqual(JSON.parse(run({ CODEX_HOME: join(f.root, "elsewhere") }).stdout), []);
+  assert.deepEqual(JSON.parse(run({ CODEX_HOME: join(f.root, "elsewhere") }, "--home", f.root).stdout).map(({ id }) => id), ["home"]);
+});
+
+test("compressed active and archived rollouts are listed and read only after exact workspace selection", (t) => {
+  const f = fixture(t);
+  const body = JSON.stringify({ type: "event_msg", payload: { message: "selected transcript" } }) + "\n";
+  f.rollout("sessions/active.jsonl.zst", "active", f.workspace, 1000, { body });
+  f.rollout("archived_sessions/archived.jsonl.zst", "archived", f.workspace, 2000, { body });
+  f.rollout("sessions/other.jsonl.zst", "other", f.workspace + "-other", 3000, { body: "private-unrelated-sentinel\n" });
+  const listed = f.run("--cwd", f.workspace);
+  assert.equal(listed.status, 0, listed.stderr);
+  assert.deepEqual(JSON.parse(listed.stdout).map(({ id }) => id), ["archived", "active"]);
+  const selected = f.run("--cwd", f.workspace, "--id", "active", "--read");
+  assert.equal(selected.status, 0, selected.stderr);
+  assert.equal(JSON.parse(selected.stdout.split("\n")[0]).payload.id, "active");
+  assert.ok(selected.stdout.endsWith(body));
+  assert.ok(!selected.stdout.includes("private-unrelated-sentinel"));
+  const denied = f.run("--cwd", f.workspace, "--id", "other", "--read");
+  assert.equal(denied.status, 1);
+  assert.equal(denied.stdout, "");
+  assert.match(denied.stderr, /No matching Codex session/);
+  assert.equal(f.run("--cwd", f.workspace, "--read").status, 1);
+});
+
+test("reading concatenated Zstd frames returns the complete selected transcript exactly", (t) => {
+  const f = fixture(t);
+  const path = f.rollout("sessions/frames.jsonl.zst", "frames", f.workspace, 1000);
+  const first = JSON.stringify({ type: "session_meta", payload: { id: "frames", cwd: f.workspace } }) + "\n";
+  const second = JSON.stringify({ type: "event_msg", payload: { message: "second frame" } }) + "\n";
+  const third = JSON.stringify({ type: "event_msg", payload: { message: "third frame" } }) + "\n";
+  writeFileSync(path, Buffer.concat([first, second, third].map((content) => zstdCompressSync(content))));
+  const result = f.run("--cwd", f.workspace, "--id", "frames", "--read");
+  assert.equal(result.status, 0, result.stderr);
+  assert.equal(result.stdout, first + second + third);
+});
+
+const spawnedBy = (parentId) => ({ subagent: { thread_spawn: { parent_thread_id: parentId, depth: 1 } } });
+
+test("history lists omit subagents by default while explicit inclusion and id selection preserve lineage", (t) => {
+  const f = fixture(t);
+  f.rollout("sessions/parent.jsonl", "parent", f.workspace, 1000);
+  f.rollout("sessions/child.jsonl.zst", "child", f.workspace, 2000, { source: spawnedBy("parent"), body: "child transcript\n" });
+  f.rollout("sessions/guardian.jsonl", "guardian", f.workspace, 3000, {
+    source: { subagent: { other: "guardian" } }, meta: { parent_thread_id: "parent" },
+  });
+  assert.deepEqual(JSON.parse(f.run("--cwd", f.workspace).stdout).map(({ id }) => id), ["parent"]);
+  const all = JSON.parse(f.run("--cwd", f.workspace, "--include-subagents").stdout);
+  assert.deepEqual(all.map(({ id, isSubagent, parentId }) => ({ id, isSubagent, parentId })), [
+    { id: "guardian", isSubagent: true, parentId: "parent" },
+    { id: "child", isSubagent: true, parentId: "parent" },
+    { id: "parent", isSubagent: false, parentId: null },
+  ]);
+  const child = f.run("--cwd", f.workspace, "--id", "child", "--read");
+  assert.equal(child.status, 0, child.stderr);
+  assert.ok(child.stdout.endsWith("child transcript\n"));
+});
+
+test("corrupt and truncated compressed history fails visibly without unhandled stream errors", (t) => {
+  const f = fixture(t);
+  const path = f.rollout("sessions/broken.jsonl.zst", "broken", f.workspace, 1000);
+  writeFileSync(path, "not a zstd stream");
+  const corrupt = f.run("--cwd", f.workspace);
+  assert.equal(corrupt.status, 1);
+  assert.equal(corrupt.stdout, "");
+  assert.match(corrupt.stderr, /Cannot read Codex rollout/);
+  assert.doesNotMatch(corrupt.stderr, /Unhandled|unhandled|node:events/);
+  const content = JSON.stringify({ type: "session_meta", payload: { id: "broken", cwd: f.workspace } }) + "\n" +
+    JSON.stringify({ type: "event_msg", payload: { message: randomBytes(200000).toString("hex") } }) + "\n";
+  writeFileSync(path, zstdCompressSync(content).subarray(0, -10));
+  const truncated = f.run("--cwd", f.workspace, "--id", "broken", "--read");
+  assert.equal(truncated.status, 1);
+  assert.match(truncated.stderr, /Cannot read Codex rollout/);
+  assert.doesNotMatch(truncated.stderr, /Unhandled|unhandled|node:events/);
+});
+
+test("compressed transcript reads reject incomplete later frames and short trailing input", (t) => {
+  const f = fixture(t);
+  const path = f.rollout("sessions/trailing.jsonl.zst", "trailing", f.workspace, 1000);
+  const first = zstdCompressSync(JSON.stringify({ type: "session_meta", payload: { id: "trailing", cwd: f.workspace } }) + "\n");
+  const second = zstdCompressSync(JSON.stringify({ type: "event_msg", payload: { message: "unfinished frame" } }) + "\n");
+  const cases = [
+    { label: "incomplete frame header", tail: second.subarray(0, 5) },
+    { label: "incomplete frame content", tail: second.subarray(0, -1) },
+    ...[1, 2, 3].flatMap((length) => [
+      { label: `garbage tail length ${length}`, tail: Buffer.alloc(length, 0x7f) },
+      { label: `partial frame magic length ${length}`, tail: second.subarray(0, length) },
+    ]),
+  ];
+  for (const { label, tail } of cases) {
+    writeFileSync(path, Buffer.concat([first, tail]));
+    const result = f.run("--cwd", f.workspace, "--id", "trailing", "--read");
+    assert.equal(result.status, 1, label);
+    assert.match(result.stderr, /Cannot read Codex rollout/, label);
+    assert.doesNotMatch(result.stderr, /Unhandled|unhandled|node:events/, label);
+  }
+});
+
+test("unsupported native runtimes reject compressed history before reading while plain history remains readable", (t) => {
+  const f = fixture(t);
+  const path = f.rollout("sessions/plain.jsonl", "plain", f.workspace, 1000, { body: "plain history\n" });
+  const versions = ["22.15.0", "22.23.4", "23.11.0", "24.19.0", "24.20.0", "24.21.0", "25.9.0", "26.5.0", "26.6.0", "26.9.0"];
+  const code = `import { readRollout } from ${JSON.stringify(new URL("../../pstack/docs/harness/codex/sessions.mjs", import.meta.url).href)};
+    const results = [];
+    for (const version of ${JSON.stringify(versions)}) {
+      Object.defineProperty(process.versions, 'node', {value:version,configurable:true});
+      let plain = '';
+      for await (const chunk of readRollout(${JSON.stringify(path)})) plain += chunk;
+      let error;
+      try {
+        for await (const chunk of readRollout(${JSON.stringify(join(f.root, "must-not-be-opened.jsonl.zst"))})) {}
+      } catch (caught) { error = caught.message; }
+      results.push({version,plain,error});
+    }
+    console.log(JSON.stringify(results));`;
+  const result = spawnSync(process.execPath, ["--input-type=module", "-e", code], { encoding: "utf8" });
+  assert.equal(result.status, 0, result.stderr);
+  const results = JSON.parse(result.stdout);
+  assert.deepEqual(results.map(({ version }) => version), versions);
+  for (const { plain, error } of results) {
+    assert.ok(plain.endsWith("plain history\n"));
+    assert.match(error, /requires Node\.js 24\.22\+ \(24\.x\) or 26\.10\+/);
+    assert.doesNotMatch(error, /ENOENT/);
+  }
+});
+
+const row = (path, bucket = "safe", last = "-") => `1M\t9d\tYES\tclean\tpushed\t#1/merged\t${last}\t${bucket}\t${path}`;
+
+test("recent Codex activity prevents cleanup without overriding work or PR holds", async (t) => {
+  const f = fixture(t);
+  const now = Date.parse("2026-10-30T12:00:00Z");
+  const paths = ["/work/safe", "/work/review", "/work/wip", "/work/pr", "/work/old", "/work/unknown"];
+  const buckets = ["safe", "review", "hold-wip", "hold-open-pr", "safe", "safe"];
+  const output = "# base: main\nSIZE\tAGE\tMERGED\tDIRTY\tREMOTE\tPR\tLAST_CHAT\tBUCKET\tWORKTREE\n" +
+    paths.map((path, i) => row(path, buckets[i])).join("\n") + "\n";
+  paths.slice(0, 5).forEach((cwd, i) => f.rollout(`sessions/${i}.jsonl`, String(i), cwd,
+    now - (i === 4 ? 5 : 1) * 86400000, { body: "" }));
+  const result = (await includeCodexActivity(output, await readSessions(f.root), now))
+    .trimEnd().split("\n").slice(2).map((line) => line.split("\t"));
+  assert.deepEqual(result.map((fields) => fields[7]), ["verify-recent-chat", "verify-recent-chat", "hold-wip", "hold-open-pr", "safe", "safe"]);
+  assert.deepEqual(result.map((fields) => fields[6]), ["2026-10-29", "2026-10-29", "2026-10-29", "2026-10-29", "2026-10-25", "-"]);
+  assert.deepEqual(result.map((fields) => fields[8]), paths);
+});
+
+test("activity uses the newest matching session and the shared audit five-day cutoff", async () => {
+  const now = Date.parse("2026-10-30T12:00:00Z");
+  const sessions = [
+    { cwd: "/work/repo", modifiedAt: now - 9 * 86400000 },
+    { cwd: "/work/repo", modifiedAt: now - 5 * 86400000 + 1000 },
+    { cwd: "/work/older", modifiedAt: now - 5 * 86400000 },
+  ];
+  assert.match(await includeCodexActivity(row("/work/repo"), sessions, now), /\tverify-recent-chat\t/);
+  assert.match(await includeCodexActivity(row("/work/older"), sessions, now), /\tsafe\t/);
+  assert.match(await includeCodexActivity(row("/work/repo", "safe", "2026-10-30"), sessions, now), /\t2026-10-30\tverify-recent-chat\t/);
+  assert.match(await includeCodexActivity(row("/work/repo"), [{ cwd: "/work/repo", modifiedAt: now - 4.5 * 86400000 }], now), /\tverify-recent-chat\t/);
+  await assert.rejects(includeCodexActivity("unexpected output", sessions, now), /cleanup is unverified/);
+});
+
+test("activity in a worktree subdirectory protects its root without matching sibling prefixes", async (t) => {
+  const f = fixture(t);
+  const now = Date.parse("2026-10-30T12:00:00Z");
+  const metadata = [
+    { cwd: "/work/feature", modifiedAt: now - 9 * 86400000 },
+    { cwd: "/work/feature/apps/web", modifiedAt: now - 86400000 },
+    { cwd: "/work/feature-other", modifiedAt: now },
+    { cwd: "/work/sibling-other/apps", modifiedAt: now },
+  ];
+  metadata.forEach(({ cwd, modifiedAt }, i) => f.rollout(`sessions/${i}.jsonl`, String(i), cwd, modifiedAt, { body: "" }));
+  const output = [row("/work/feature"), row("/work/sibling")].join("\n");
+  const result = (await includeCodexActivity(output, await readSessions(f.root), now)).split("\n");
+  assert.equal(result[0], row("/work/feature", "verify-recent-chat", "2026-10-29"));
+  assert.equal(result[1], row("/work/sibling"));
+});
+
+test("recent repository and delegated sessions protect mentioned worktrees without reading unrelated or old bodies", async (t) => {
+  const f = fixture(t);
+  const now = Date.parse("2026-10-30T12:00:00Z");
+  const worktree = '/work/feature "quoted" \\ literal';
+  const sibling = "/work/sibling";
+  const childWorktree = "/work/child";
+  const body = JSON.stringify({ type: "response_item", payload: {
+    type: "function_call", name: "exec_command",
+    arguments: JSON.stringify({ workdir: worktree, cmd: `echo ${sibling}-other/file` }),
+  } }) + "\n";
+  f.rollout("sessions/parent.jsonl.zst", "parent", f.workspace, now - 86400000, { body });
+  f.rollout("sessions/child.jsonl", "child", "/elsewhere", now - 1000, {
+    source: spawnedBy("parent"), body: JSON.stringify({ payload: { cwd: childWorktree } }) + "\n",
+  });
+  f.rollout("sessions/unrelated.jsonl", "unrelated", "/unrelated", now);
+  f.rollout("sessions/old.jsonl", "old", f.workspace, now - 5 * 86400000);
+  const output = [row(worktree), row(childWorktree), row(sibling)].join("\n");
+  const result = (await includeCodexActivity(output, await readSessions(f.root), now, f.workspace)).split("\n");
+  assert.equal(result[0], row(worktree, "verify-recent-chat", "2026-10-29"));
+  assert.equal(result[1], row(childWorktree, "verify-recent-chat", "2026-10-30"));
+  assert.equal(result[2], row(sibling));
+});
+
+test("custom tool JavaScript inputs protect literal and escaped paths without matching sibling prefixes", async (t) => {
+  const f = fixture(t);
+  const now = Date.parse("2026-10-30T12:00:00Z");
+  const plain = "/work/plain";
+  const escaped = '/work/feature "quoted" \\ literal';
+  const sibling = '/work/sibling "quoted" \\ literal';
+  const body = [plain, escaped, sibling + "-other"].map((workdir) => JSON.stringify({
+    type: "response_item", payload: {
+      type: "custom_tool_call", name: "functions.exec",
+      input: "const result = await tools.exec_command(" + JSON.stringify({ workdir, cmd: "pwd" }) + ");",
+    },
+  })).join("\n") + "\n";
+  f.rollout("sessions/parent.jsonl", "parent", f.workspace, now, { body });
+  const output = [row(plain), row(escaped), row(sibling)].join("\n");
+  const result = (await includeCodexActivity(output, await readSessions(f.root), now, f.workspace)).split("\n");
+  assert.equal(result[0], row(plain, "verify-recent-chat", "2026-10-30"));
+  assert.equal(result[1], row(escaped, "verify-recent-chat", "2026-10-30"));
+  assert.equal(result[2], row(sibling));
+});
+
+test("escaped newlines and tabs after a worktree path count as mentions without matching sibling prefixes", async (t) => {
+  const f = fixture(t);
+  const now = Date.parse("2026-10-30T12:00:00Z");
+  const body = JSON.stringify({ type: "response_item", payload: {
+    type: "function_call", name: "exec_command",
+    arguments: JSON.stringify({ cmd: "cd /work/newline\nnpm test\ncd /work/tab\tls\ncd /work/sibling-other\nls" }),
+  } }) + "\n";
+  f.rollout("sessions/parent.jsonl", "parent", f.workspace, now, { body });
+  const output = [row("/work/newline"), row("/work/tab"), row("/work/sibling")].join("\n");
+  const result = (await includeCodexActivity(output, await readSessions(f.root), now, f.workspace)).split("\n");
+  assert.equal(result[0], row("/work/newline", "verify-recent-chat", "2026-10-30"));
+  assert.equal(result[1], row("/work/tab", "verify-recent-chat", "2026-10-30"));
+  assert.equal(result[2], row("/work/sibling"));
+});
+
+test("audit canonicalizes existing cwd aliases and repository scope without changing output or history selection", async (t) => {
+  const f = fixture(t);
+  const now = Date.parse("2026-10-30T12:00:00Z");
+  const repository = join(f.root, "repo");
+  const worktree = join(f.root, "worktree");
+  const mentioned = join(f.root, "mentioned-worktree");
+  const repositoryAlias = join(f.root, "repo-alias");
+  const worktreeAlias = join(f.root, "worktree-alias");
+  for (const path of [repository, worktree, mentioned]) mkdirSync(path);
+  symlinkSync(repository, repositoryAlias);
+  symlinkSync(worktree, worktreeAlias);
+  f.rollout("sessions/direct.jsonl", "direct", worktreeAlias, now - 86400000, { body: "" });
+  f.rollout("sessions/parent.jsonl", "parent", repositoryAlias, now, {
+    body: JSON.stringify({ payload: { workdir: mentioned } }) + "\n",
+  });
+  const sessions = await readSessions(f.root);
+  const output = [row(worktree), row(mentioned)].join("\n");
+  const result = (await includeCodexActivity(output, sessions, now, repository)).split("\n");
+  assert.equal(result[0], row(worktree, "verify-recent-chat", "2026-10-29"));
+  assert.equal(result[1], row(mentioned, "verify-recent-chat", "2026-10-30"));
+  assert.equal(await includeCodexActivity(row(worktreeAlias), sessions, now, repository),
+    row(worktreeAlias, "verify-recent-chat", "2026-10-29"));
+  assert.deepEqual(JSON.parse(f.run("--cwd", worktree).stdout), []);
+  assert.deepEqual(JSON.parse(f.run("--cwd", worktreeAlias).stdout).map(({ id }) => id), ["direct"]);
+});
+
+test("audit retains missing historical paths but propagates other canonicalization failures", async (t) => {
+  const f = fixture(t);
+  const now = Date.now();
+  const missing = join(f.root, "removed-worktree");
+  assert.match(await includeCodexActivity(row(missing), [{ cwd: missing, modifiedAt: now }], now), /\tverify-recent-chat\t/);
+  const loop = join(f.root, "symlink-loop");
+  symlinkSync(loop, loop);
+  await assert.rejects(includeCodexActivity(row(missing), [{ cwd: loop, modifiedAt: now }], now), { code: "ELOOP" });
+});
+
+test("unreadable and malformed recent scoped rollouts leave worktree cleanup unverified", async (t) => {
+  const f = fixture(t);
+  const now = Date.now();
+  const path = f.rollout("sessions/recent.jsonl", "recent", f.workspace, now);
+  const sessions = await readSessions(f.root);
+  await assert.rejects(includeCodexActivity(row("/work/feature"), sessions, now, f.workspace), /Invalid Codex rollout during worktree audit/);
+  unlinkSync(path);
+  await assert.rejects(includeCodexActivity(row("/work/feature"), sessions, now, f.workspace), /Cannot read Codex rollout/);
+});
+
+test("needed audit scans reject incomplete event frames instead of reporting a safe worktree", async (t) => {
+  const f = fixture(t);
+  const now = Date.now();
+  const worktree = "/work/feature";
+  const path = f.rollout("sessions/incomplete.jsonl.zst", "incomplete", f.workspace, now);
+  const metadata = zstdCompressSync(JSON.stringify({ type: "session_meta", payload: { id: "incomplete", cwd: f.workspace } }) + "\n");
+  const event = zstdCompressSync(JSON.stringify({ type: "response_item", payload: { workdir: worktree } }) + "\n");
+  writeFileSync(path, Buffer.concat([metadata, event.subarray(0, 5)]));
+  const sessions = [{ id: "incomplete", cwd: f.workspace, path, modifiedAt: now }];
+  await assert.rejects(includeCodexActivity(row(worktree), sessions, now, f.workspace), /Cannot read Codex rollout/);
+});
+
+test("last-chat dates use the same local timezone as the shared shell audit", () => {
+  const code = `import { includeCodexActivity } from ${JSON.stringify(new URL("../../pstack/docs/harness/codex/worktree-audit.mjs", import.meta.url).href)};
+    console.log(await includeCodexActivity(${JSON.stringify(row("/work/repo"))}, [{cwd:'/work/repo',modifiedAt:Date.parse('2026-10-29T23:30:00Z')}], Date.parse('2026-10-30T12:00:00Z')));`;
+  const result = spawnSync(process.execPath, ["--input-type=module", "-e", code], {
+    encoding: "utf8", env: { ...process.env, TZ: "Europe/Zurich" },
+  });
+  assert.equal(result.status, 0, result.stderr);
+  assert.equal(result.stdout.trim(), row("/work/repo", "verify-recent-chat", "2026-10-30"));
+});
+
+test("worktree audit CLI uses injected history and protects delegated work in a real repository", (t) => {
+  const f = fixture(t);
+  const repository = join(f.root, "repo");
+  const worktree = join(f.root, "feature");
+  const bin = join(f.root, "bin");
+  mkdirSync(repository);
+  mkdirSync(bin);
+  for (const name of ["gh", "origin"]) writeFileSync(join(bin, name), "#!/bin/sh\nexit 1\n", { mode: 0o755 });
+  const env = { ...process.env, PATH: `${bin}:${process.env.PATH}`, GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: "/dev/null" };
+  const git = (...args) => {
+    const result = spawnSync("git", ["-C", repository, ...args], { env, encoding: "utf8" });
+    assert.equal(result.status, 0, result.stdout + result.stderr);
+  };
+  git("init", "--initial-branch=main");
+  git("-c", "user.name=Fixture", "-c", "user.email=fixture@example.invalid", "-c", "core.hooksPath=/dev/null", "commit", "--allow-empty", "-m", "fixture");
+  git("worktree", "add", "--detach", worktree, "main");
+  const body = JSON.stringify({ type: "response_item", payload: {
+    type: "function_call", arguments: JSON.stringify({ workdir: worktree, cmd: "pwd" }),
+  } }) + "\n";
+  f.rollout("sessions/delegated.jsonl.zst", "delegated", repository, Date.now(), { source: spawnedBy("parent"), body });
+  const run = (...args) => spawnSync(process.execPath, [auditCli, "--home", f.root, ...args], { env, encoding: "utf8" });
+  const result = run("-b", "main", repository);
+  assert.equal(result.status, 0, result.stderr);
+  const fields = result.stdout.trim().split("\n").at(-1).split("\t");
+  assert.equal(fields[7], "verify-recent-chat");
+  assert.equal(fields[8], worktree);
+  const help = run("--help");
+  assert.equal(help.status, 0, help.stderr);
+  assert.match(help.stdout, helpFooter);
+  const bad = f.rollout("sessions/broken.jsonl.zst", "broken", repository, Date.now());
+  writeFileSync(bad, "bad compressed data");
+  const failed = run("-b", "main", repository);
+  assert.equal(failed.status, 1);
+  assert.equal(failed.stdout, "");
+  assert.match(failed.stderr, /Cannot read Codex rollout/);
+});