diff --git a/external_plugins/ponytail/.zcode-plugin/plugin.json b/external_plugins/ponytail/.zcode-plugin/plugin.json
new file mode 100644
index 0000000..0c9e1ca
--- /dev/null
+++ b/external_plugins/ponytail/.zcode-plugin/plugin.json
@@ -0,0 +1,16 @@
+{
+  "name": "ponytail",
+  "version": "0.1.0",
+  "description": "Lazy senior dev mode: the smallest change that fully solves the task. YAGNI, stdlib first, one line over fifty. Six skills and slash commands for lazy coding, diff review, whole-repo audit, shortcut-debt ledger, and measured impact. Port of DietrichGebert/ponytail (MIT).",
+  "description_i18n": {
+    "en": "Lazy senior dev mode: the smallest change that fully solves the task. YAGNI, stdlib first, one line over fifty. Six skills and slash commands for lazy coding, diff review, whole-repo audit, shortcut-debt ledger, and measured impact. Port of DietrichGebert/ponytail (MIT).",
+    "zh-CN": "懒惰资深开发模式：用完全解决问题的最小变更。YAGNI、优先标准库、能一行就不写五十行。包含懒人编码、变更审查、全仓库审计、技术债台账、实测收益六组技能与斜杠命令。移植自 DietrichGebert/ponytail（MIT）。"
+  },
+  "author": {
+    "name": "Dietrich Gebert (upstream), ZCode port"
+  },
+  "homepage": "https://github.com/dietrichgebert/ponytail",
+  "license": "MIT",
+  "skills": "./skills",
+  "commands": "./commands"
+}
diff --git a/external_plugins/ponytail/LICENSE b/external_plugins/ponytail/LICENSE
new file mode 100644
index 0000000..715d483
--- /dev/null
+++ b/external_plugins/ponytail/LICENSE
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 DietrichGebert
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/external_plugins/ponytail/README.md b/external_plugins/ponytail/README.md
new file mode 100644
index 0000000..0fa294b
--- /dev/null
+++ b/external_plugins/ponytail/README.md
@@ -0,0 +1,64 @@
+# Ponytail for ZCode
+
+Lazy senior dev mode for AI coding agents: **the best code is the code never
+written.** Ponytail makes the agent solve the whole problem with the least new
+code — skip what nobody asked for, reuse what the codebase already has, prefer
+the standard library, and never add a dependency for a few lines. It stays
+lazy about the solution, never about the change itself: callers, tests and
+fixtures the change breaks still get finished, and validation, error handling,
+security and accessibility are never cut.
+
+This is a ZCode port of [DietrichGebert/ponytail](https://github.com/dietrichgebert/ponytail)
+v5.3.2 (MIT). The prompt content is kept verbatim from upstream.
+
+## Measured impact
+
+Upstream's published agentic benchmark (headless Claude Code, Opus 5.5, 39
+tasks × 5 runs, vs. the same agent without the skill):
+
+| Metric | Result |
+|--------|--------|
+| Lines of code | −53% |
+| Time | −41% |
+| Cost | −26% |
+| Output tokens | −45% |
+| Tests where the logic needs one | 98% (baseline 68%) |
+| Hidden correctness/safety checks passed | 97% (baseline 96%) |
+
+Source: `benchmarks/results/2026-10-07-agentic.md` in the upstream repo.
+
+## What's included
+
+**Skills** (auto-trigger by natural language, or pick from the composer's
+skill picker):
+
+| Skill | Trigger | What it does |
+|-------|---------|--------------|
+| `ponytail` | `/ponytail`, "be lazy", "yagni" | Lazy mode itself, levels lite / full / ultra. |
+| `ponytail-review` | `/ponytail-review` | Quality review of a change: bugs, security, load, missing tests, speed, what to cut. |
+| `ponytail-audit` | `/ponytail-audit` | The same review for the whole repo, ranked, max 20 findings. |
+| `ponytail-debt` | `/ponytail-debt` | Harvest `shortcut:` comments into a tracked debt ledger. |
+| `ponytail-gain` | `/ponytail-gain` | The measured-impact scoreboard. |
+| `ponytail-help` | `/ponytail-help` | Quick reference card. |
+
+**Commands**: `/ponytail [lite|full|ultra|off]`, `/ponytail-review`,
+`/ponytail-audit`, `/ponytail-debt`, `/ponytail-gain`, `/ponytail-help`.
+
+## Not ported from upstream
+
+The Claude Code status band (`/ponytail band`), session-start auto-activation
+and default-mode configuration (`PONYTAIL_DEFAULT_MODE`) are driven by
+upstream's host-specific hook runtime and are not included. Activate ponytail
+explicitly with `/ponytail` (or just ask for the lazy/simplest solution).
+
+## Side effects and third-party content
+
+None: this plugin contains Markdown prompt files only — no network access, no
+API dependencies, no file writes, no command execution. Third-party content:
+prompt text from [DietrichGebert/ponytail](https://github.com/dietrichgebert/ponytail)
+(MIT, © 2026 DietrichGebert), included with attribution.
+
+## License
+
+MIT, © 2026 DietrichGebert — see [LICENSE](LICENSE). Prompt content ported
+verbatim from https://github.com/dietrichgebert/ponytail.
diff --git a/external_plugins/ponytail/README_CN.md b/external_plugins/ponytail/README_CN.md
new file mode 100644
index 0000000..07ea585
--- /dev/null
+++ b/external_plugins/ponytail/README_CN.md
@@ -0,0 +1,59 @@
+# Ponytail for ZCode
+
+AI 编程智能体的**懒惰资深开发模式**：最好的代码是从未写过的代码。Ponytail
+让智能体用最少的新代码解决完整问题——没人要求的功能不做、优先复用代码库已有
+实现、优先标准库、绝不为几行代码引入新依赖。对解决方案懒，对改动本身不懒：被
+改动波及的调用方、测试和夹具照样补齐，校验、错误处理、安全、可访问性绝不削减。
+
+本插件是 [DietrichGebert/ponytail](https://github.com/dietrichgebert/ponytail)
+v5.3.2（MIT）的 ZCode 移植版，提示内容保持上游英文原文。
+
+## 实测收益
+
+上游公开的智能体基准（无头 Claude Code，Opus 5.5，39 个任务 × 5 次运行，
+与同一智能体不开技能对照）：
+
+| 指标 | 结果 |
+|------|------|
+| 代码行数 | −53% |
+| 时间 | −41% |
+| 成本 | −26% |
+| 输出 token | −45% |
+| 关键逻辑带测试的比例 | 98%（基线 68%） |
+| 隐藏正确性/安全检查通过率 | 97%（基线 96%） |
+
+来源：上游仓库 `benchmarks/results/2026-10-07-agentic.md`。
+
+## 包含内容
+
+**技能**（自然语言自动触发，或在输入框技能选择器中选取）：
+
+| 技能 | 触发方式 | 作用 |
+|------|---------|------|
+| `ponytail` | `/ponytail`、"用最简实现"、"别过度设计" | 懒人模式本体，lite / full / ultra 三档。 |
+| `ponytail-review` | `/ponytail-review` | 变更质量审查：bug、安全、并发负载、缺测试、速度、可删项。 |
+| `ponytail-audit` | `/ponytail-audit` | 同标准审查整个仓库，按重要性排序，最多 20 条。 |
+| `ponytail-debt` | `/ponytail-debt` | 收集 `shortcut:` 注释为技术债台账。 |
+| `ponytail-gain` | `/ponytail-gain` | 实测收益面板。 |
+| `ponytail-help` | `/ponytail-help` | 速查卡。 |
+
+**命令**：`/ponytail [lite|full|ultra|off]`、`/ponytail-review`、
+`/ponytail-audit`、`/ponytail-debt`、`/ponytail-gain`、`/ponytail-help`。
+
+## 未移植内容
+
+Claude Code 专属的状态栏（`/ponytail band`）、会话启动自动激活与默认模式配置
+（`PONYTAIL_DEFAULT_MODE`）依赖上游的宿主专属 hooks 运行时，未包含。用
+`/ponytail` 手动激活（或直接要求用最简方案实现）。
+
+## 副作用与第三方内容
+
+无：本插件仅含 Markdown 提示文件——无网络访问、无 API 依赖、无文件写入、无
+命令执行。第三方内容：提示文本来自
+[DietrichGebert/ponytail](https://github.com/dietrichgebert/ponytail)
+（MIT，© 2026 DietrichGebert），已附署名收录。
+
+## 许可证
+
+MIT，© 2026 DietrichGebert——见 [LICENSE](LICENSE)。提示内容逐字移植自
+https://github.com/dietrichgebert/ponytail。
diff --git a/external_plugins/ponytail/commands/ponytail-audit.md b/external_plugins/ponytail/commands/ponytail-audit.md
new file mode 100644
index 0000000..c4e1036
--- /dev/null
+++ b/external_plugins/ponytail/commands/ponytail-audit.md
@@ -0,0 +1,6 @@
+---
+description: Quality audit of the whole repo: bugs, security, load, tests, speed, bloat
+skills: ponytail-audit
+---
+
+Audit the whole repository (or the folder the user names) like the senior developer who just inherited it. Map first: README, deploy and build config, dependencies, entry points, tests; find the expected load (one person or many users and processes); trace the main flows and read fully the paths with user input, money, auth, data writes, background jobs and shared state. Look for, in this order: bugs, risk (security holes, data loss), scale (races, the same work done by every process, memory that only grows, a query per item, O(n^2)), risky logic without a test, slow code (big = problem, small = suggestion), lean (dead code, duplicate helpers, stdlib or native instead of custom code or a dependency, abstractions with one implementation, near-copies to merge, a function doing several unrelated jobs to split, never split by line count). Before calling code unused, grep the whole tree including tests, fixtures, config and string references. Every finding needs a concrete case. A shortcut marked with a shortcut: (or older ponytail:) comment that names its limit is a decision, not a finding. Propose the smallest fix, prefer deleting code, never add layers. Very simple English. Start with 'What this repo does:' and the load you assumed. Then at most 20 numbered findings grouped Must fix / Should fix / Nice to have, most important first; each: a bold title with file:lines, then four bullets: What this is, Problem, Fix, If we skip it. End with 'Verdict:', 'Lean: -N lines, -M dependencies possible.' and 'Not checked:' for the parts you did not read. Change no code.
diff --git a/external_plugins/ponytail/commands/ponytail-debt.md b/external_plugins/ponytail/commands/ponytail-debt.md
new file mode 100644
index 0000000..e4b95be
--- /dev/null
+++ b/external_plugins/ponytail/commands/ponytail-debt.md
@@ -0,0 +1,6 @@
+---
+description: Harvest shortcut: comments into a tracked debt ledger
+skills: ponytail-debt
+---
+
+Harvest every `shortcut:` comment (and older `ponytail:` ones) in this repository into a debt ledger so deferrals do not rot into 'later means never'. Grep the whole tree for comment markers (git grep --no-index --exclude-standard -nE '(#|//|/[*]) ?(shortcut|ponytail):', skipping .git and everything .gitignore ignores; if the user names their own marker word, grep for that instead; skip hits that are not a deferral, like a keyboard-shortcut note). One row per marker, grouped by file: <file>:<line> — <what was simplified>. ceiling: <the limit named in the comment>. upgrade: <the trigger to revisit>. Tag any marker that names no upgrade path or trigger as no-trigger, those rot silently. End with the count of markers and how many lack a trigger. If none: 'No shortcut debt. Clean ledger.' Report only, change nothing.
diff --git a/external_plugins/ponytail/commands/ponytail-gain.md b/external_plugins/ponytail/commands/ponytail-gain.md
new file mode 100644
index 0000000..5296705
--- /dev/null
+++ b/external_plugins/ponytail/commands/ponytail-gain.md
@@ -0,0 +1,6 @@
+---
+description: Show ponytail's measured impact scoreboard (less code, cost, time)
+skills: ponytail-gain
+---
+
+Show the ponytail gain scoreboard. One shot, change nothing: do not switch mode, write flag files, or persist anything. Render the published agentic benchmark of Ponytail 5 (39 tasks on a real FastAPI + React repo plus bug fixes, security and privacy cases and small apps, Opus 5.5, 5 runs each, against the same agent without the skill; geometric mean of per-task medians; source benchmarks/results/2026-10-07-agentic.md and the README) as plain ASCII bars, ponytail as a share of the no-skill baseline (100%): Lines of code 47% (down 53%); Output tokens 55% (down 45%); Cost 74% (down 26%); Time 59% (down 41%); Hidden checks passed 97% (no-skill 96%; 18 of the tasks have hidden checks for correctness and safety); Tests where the logic needs one 98% (no-skill 68%). The bar length shows the share, the label carries the exact figure. These are benchmark averages, not this repo. NEVER print a per-repo savings number: the unbuilt version was never written, so there is no real baseline to subtract from in a live repo. For real per-repo figures, point to /ponytail-debt (the counted shortcut ledger) and /ponytail-audit (what is still cuttable). Report only.
diff --git a/external_plugins/ponytail/commands/ponytail-help.md b/external_plugins/ponytail/commands/ponytail-help.md
new file mode 100644
index 0000000..0c9208f
--- /dev/null
+++ b/external_plugins/ponytail/commands/ponytail-help.md
@@ -0,0 +1,6 @@
+---
+description: Quick reference for ponytail levels, skills, and commands
+skills: ponytail-help
+---
+
+Show the ponytail quick reference. One shot, change nothing: do not switch mode, write flag files, or persist anything. Levels: /ponytail lite (build what's asked, name the lazier alternative in one line), /ponytail (full, the default ladder: YAGNI then stdlib then native then one line then minimum), /ponytail ultra (deletion before addition, challenges the requirement before building). Commands: /ponytail-review (over-engineering review of the current changes), /ponytail-audit (whole-repo over-engineering audit), /ponytail-debt (harvest shortcut: comments into a tracked ledger), /ponytail-gain (measured-impact scoreboard from the benchmark), /ponytail-help (this card). Deactivate with 'stop ponytail', 'normal mode', or /ponytail off; resume anytime with /ponytail. Default mode is full; switch level with /ponytail lite, /ponytail ultra, or /ponytail off. In this ZCode port the status band and session-start auto-activation hooks are not included; activate with /ponytail.
diff --git a/external_plugins/ponytail/commands/ponytail-review.md b/external_plugins/ponytail/commands/ponytail-review.md
new file mode 100644
index 0000000..96db8ba
--- /dev/null
+++ b/external_plugins/ponytail/commands/ponytail-review.md
@@ -0,0 +1,6 @@
+---
+description: Quality review of the current changes: bugs, security, load, tests, speed, bloat
+skills: ponytail-review
+---
+
+Review the current code changes like the senior developer who will be paged when they break. Review what the user names (uncommitted or staged changes, a branch, a PR link, files); nothing named: the uncommitted changes, or the last commit if there are none. First read the code the change touches: callers of every changed function, the functions it calls, the tests, the README (find the expected load: one person or many users and processes). A change can break code it does not touch. Look for, in this order: bugs (wrong result, crash, missed edge case, a caller broken by the change, a fix in one caller while the shared function stays broken), risk (security holes, data loss), scale (check-then-write races, the same work done by every process, memory that only grows, a query per item, O(n^2) on big input), risky logic without a test, slow code (big = problem, small = suggestion), lean (dead code, a helper the repo already has, stdlib or native instead of custom code or a new dependency, abstractions with one implementation, near-copies to merge, a function doing several unrelated jobs to split, never split by line count). Every finding needs a concrete case; re-read the lines to confirm it. A shortcut marked with a shortcut: (or older ponytail:) comment that names its limit is a decision, not a finding. Propose the smallest fix, prefer deleting code, never add layers. No style taste, no vague worries. Very simple English, explain technical terms. Start with 'What this change does:' in two or three sentences and the load you assumed. Then numbered findings grouped Must fix / Should fix / Nice to have; each finding: a bold title with file:lines, then four bullets: What this is, Problem, Fix, If we skip it (one or two short sentences each). End with 'Verdict:', 'Lean: -N lines possible.' when lean findings exist, and 'Not checked:' if something mattered and you could not check it. Nothing found: 'Looks good. Ship.' Change no code.
diff --git a/external_plugins/ponytail/commands/ponytail.md b/external_plugins/ponytail/commands/ponytail.md
new file mode 100644
index 0000000..dc133a9
--- /dev/null
+++ b/external_plugins/ponytail/commands/ponytail.md
@@ -0,0 +1,7 @@
+---
+description: Switch ponytail intensity level (lite/full/ultra/off)
+argument-hint: "[lite|full|ultra|off]"
+skills: ponytail
+---
+
+Switch to ponytail $ARGUMENTS mode. With no level, keep the current level, or switch on at the default level if ponytail was off. Lazy senior dev mode, before any code: does it need to exist at all (YAGNI)? Does the standard library do it? A native platform feature? Can it be one line? Build the minimum that works. No unrequested abstractions, no avoidable dependencies, no boilerplate. Mark deliberate simplifications that cut a real corner with a known ceiling using a shortcut: comment that names the ceiling and upgrade path.
diff --git a/external_plugins/ponytail/skills/ponytail-audit/SKILL.md b/external_plugins/ponytail/skills/ponytail-audit/SKILL.md
new file mode 100644
index 0000000..ff9a954
--- /dev/null
+++ b/external_plugins/ponytail/skills/ponytail-audit/SKILL.md
@@ -0,0 +1,103 @@
+---
+name: ponytail-audit
+description: >
+  Quality audit of a whole repo: bugs, security holes, what breaks under real
+  load, risky code without tests, slow paths, and what to delete, merge or
+  split. Ranked, each finding explained in plain English. One-shot report,
+  changes nothing. Use for "audit this codebase", "review the whole repo",
+  "find bloat", "what can I delete", /ponytail-audit.
+---
+
+Audit the whole repo like the senior developer who just inherited it and
+will be paged when it breaks. Order of importance: correct, safe, holds under
+load, tested, fast, lean. Lean still matters: every extra line must be read,
+tested and fixed later. This is a report the user asked for, so give it in full.
+
+## 1. Map first
+
+- Audit what the user names: a folder, a package, or the whole repo.
+  Nothing named: the whole repo.
+- Read the README, the deploy and build config, the dependency list, the
+  entry points (main, routes, handlers, jobs, CLI commands) and the tests.
+- Find the expected load: one person running a script, or many users and
+  processes at once. Judge scale against that, and say which load you assumed.
+- Trace the main flows end to end: where data comes in, what is stored,
+  what goes out. Read those paths fully: input from users, money, auth,
+  data writes, background jobs, anything shared between processes.
+- Big repo: go deep where a mistake costs the most, not file by file. Say
+  which parts you did not read.
+
+## 2. Look for
+
+1. **Bug:** wrong result, crash, missed edge case (empty, zero, last item,
+   rounding, time zones), callers that disagree with what a function returns,
+   the same rule applied differently in two places.
+2. **Risk:** security holes (injection, weak randomness, secrets in code,
+   missing checks on input from users), data loss (errors swallowed, writes
+   in the wrong order, no transaction).
+3. **Scale:** fine for one user, wrong for many: check-then-write races, the
+   same work done by every process, memory or lists that only grow, a query
+   per item, O(n^2) on big input, per-process state that must be shared.
+4. **Missing test:** risky logic (a branch, a parser, money, security, data
+   writes) with no test that fails when it breaks. One good test, not coverage.
+5. **Speed:** big slowdowns are problems. Small wins (work repeated in a hot
+   loop) are suggestions; some software counts every millisecond.
+6. **Lean:** code that should not exist or should be smaller.
+   - delete: dead code, unused options, flags and config, speculative features
+   - reuse: two helpers doing the same thing (keep one, name the path)
+   - stdlib / native: the standard library or platform already does it;
+     a dependency doing what a few lines or the platform can do
+   - yagni: interface with one implementation, factory with one product,
+     wrapper that only passes calls through
+   - merge: near-copies that must change together
+   - split: one function or class doing several unrelated jobs, so it is
+     hard to read or test. Split by job, never by line count, and never into
+     helpers that exist only to make a function shorter.
+
+## 3. Check before you report
+
+- Every finding needs a concrete case: "this input or situation leads to this
+  wrong result". No case, no finding.
+- Before calling code unused, grep the whole tree for it, including tests,
+  fixtures, config, and string or dynamic references.
+- A shortcut marked with a `shortcut:` (or older `ponytail:`) comment that names its limit is a
+  decision, not a finding, unless the expected load already crosses it.
+- Propose the smallest fix that works. Prefer fixes that delete code. Never
+  add layers, frameworks or config the problem does not need.
+- No style taste, no "consider", no vague worries.
+
+## 4. Output
+
+Very simple English: short sentences, everyday words. Explain a technical
+term the first time you use it. The reader may never have seen this code.
+
+Start with `What this repo does:` in two or three sentences, and the load
+you assumed.
+
+Then the findings in three groups, most important first, skip empty groups:
+- **Must fix:** bug, security, data loss, breaks at the expected load.
+- **Should fix:** risky code without a test, real slowness, duplication, a
+  function that mixes jobs, code that should not exist.
+- **Nice to have:** small speed-ups, shorter forms.
+
+Number findings across all groups, so the user can say "fix 2 and 5". At
+most 20 findings; if you left smaller ones out, say how many.
+Every finding has all four parts, each one or two short sentences:
+
+2. **Orders land on the wrong day** (`billing/close_day.py:L40-52`)
+   - **What this is:** At midnight this job closes the day and bills all orders of that day.
+   - **Problem:** It takes "today" from the server clock, which runs in UTC. An order placed
+     at 00:30 in Berlin is billed on the day before.
+   - **Fix:** Compute the day once in the shop's time zone:
+     `datetime.now(ZoneInfo("Europe/Berlin")).date()`. One line, nothing else changes.
+   - **If we skip it:** Late orders show the wrong date, and accounting fixes them by hand.
+
+End with:
+- `Verdict:` one line: healthy, or what to fix first.
+- `Lean: -<N> lines, -<M> dependencies possible.` when lean findings exist.
+- `Not checked:` the parts you did not read or could not run.
+
+Nothing found: `What this repo does:`, then `Healthy. Nothing to fix.` and
+one line on what you checked.
+
+One-shot report, changes no code.
diff --git a/external_plugins/ponytail/skills/ponytail-debt/SKILL.md b/external_plugins/ponytail/skills/ponytail-debt/SKILL.md
new file mode 100644
index 0000000..5255923
--- /dev/null
+++ b/external_plugins/ponytail/skills/ponytail-debt/SKILL.md
@@ -0,0 +1,44 @@
+---
+name: ponytail-debt
+description: >
+  List every `shortcut:` comment (and older `ponytail:` ones) as a debt ledger. One-shot report,
+  changes nothing. Use for "ponytail debt", "what did ponytail defer", "list the
+  shortcuts", /ponytail-debt.
+---
+
+Every deliberate ponytail shortcut is marked with a `shortcut:` comment naming
+its ceiling and upgrade path (older code may say `ponytail:`). This collects them into one ledger so a deferral
+can't quietly become permanent.
+
+## Scan
+
+Grep the repo for comment markers, skipping `.git` and everything the
+`.gitignore` files ignore (dependencies, build output, caches, in any stack):
+
+`git grep --no-index --exclude-standard -nE '(#|//|/[*]) ?(shortcut|ponytail):'`  (add other comment prefixes if your stack uses them)
+
+If the user names their own marker word (`/ponytail-debt HACK`), grep for that word instead.
+
+Each hit is one ledger row. The comment prefix keeps prose that merely mentions
+the convention out of the ledger. Skip hits that are not a deferral, like a note
+about a keyboard shortcut.
+
+## Output
+
+One row per marker, grouped by file:
+
+`<file>:<line>, <what was simplified>. ceiling: <the limit named>. upgrade: <the trigger to revisit>.`
+
+The convention is `shortcut: <ceiling>, <upgrade path>`, so pull the ceiling
+and the trigger straight from the comment. Want an owner per row too? add
+`git blame -L<line>,<line>`.
+
+Flag the rot risk: any marker comment that names no upgrade path or
+trigger gets a `no-trigger` tag, those are the ones that silently rot.
+
+End with `<N> markers, <M> with no trigger.` Nothing found: `No shortcut debt. Clean ledger.`
+
+## Boundaries
+
+Reads and reports only, changes nothing. To persist it, ask and it writes the
+ledger to a file (e.g. `PONYTAIL-DEBT.md`). One-shot.
diff --git a/external_plugins/ponytail/skills/ponytail-gain/SKILL.md b/external_plugins/ponytail/skills/ponytail-gain/SKILL.md
new file mode 100644
index 0000000..1edff0e
--- /dev/null
+++ b/external_plugins/ponytail/skills/ponytail-gain/SKILL.md
@@ -0,0 +1,52 @@
+---
+name: ponytail-gain
+description: >
+  Show ponytail's measured savings (code, cost, speed) from the benchmark.
+  One-shot display. Use for /ponytail-gain, "what does ponytail save",
+  "ponytail impact".
+---
+
+# Ponytail Gain
+
+Display this scoreboard when invoked. One-shot: do NOT change mode, write flag
+files, or persist anything.
+
+The figures are the published agentic benchmark of Ponytail 5: headless Claude
+Code (Opus 5.5, default effort) on 39 tasks (feature tickets in a real FastAPI +
+React repo, bug fixes, security and privacy cases, small apps), 5 runs each,
+against the same agent without the skill. 18 of the tasks have hidden checks
+for correctness and safety. Each figure is the geometric mean of the per-task
+medians. They are measured, not computed from the current repo.
+Source: `benchmarks/results/2026-10-07-agentic.md` and the README.
+
+## Scoreboard
+
+Render plain ASCII bars. The bar length shows ponytail as a share of the
+no-skill baseline; the label carries the exact figure:
+
+```
+  ponytail gain           benchmark · 39 tasks × 5 runs · Opus 5.5
+
+  no-skill        ████████████████████  100%
+  Lines of code   █████████···········   47%   ▼ 53%
+  Output tokens   ███████████·········   55%   ▼ 45%
+  Cost            ███████████████·····   74%   ▼ 26%
+  Time            ████████████········   59%   ▼ 41%
+  Hidden checks passed   97%  (no-skill 96%)
+  Tests where the logic needs one   98%  (no-skill 68%)
+
+  This repo:  /ponytail-debt  (shortcuts you deferred)
+              /ponytail-audit (what's still cuttable)
+```
+
+## Honesty boundary
+
+These are benchmark averages, not this repo. NEVER print a per-repo savings
+number ("you saved X lines/tokens here"): the unbuilt version was never
+written, so there is no real baseline to subtract from in a live repo. The
+only real per-repo figures come from `/ponytail-debt` (a counted ledger), and
+this card points there instead of inventing one.
+
+## Boundaries
+
+One-shot display. Edits nothing, changes no mode.
diff --git a/external_plugins/ponytail/skills/ponytail-help/SKILL.md b/external_plugins/ponytail/skills/ponytail-help/SKILL.md
new file mode 100644
index 0000000..5021c78
--- /dev/null
+++ b/external_plugins/ponytail/skills/ponytail-help/SKILL.md
@@ -0,0 +1,55 @@
+---
+name: ponytail-help
+description: >
+  Quick reference for ponytail levels, skills and commands. One-shot display.
+  Use for /ponytail-help, "ponytail help", "how do I use ponytail".
+---
+
+# Ponytail Help
+
+Display this reference card when invoked. One-shot, do NOT change mode,
+write flag files, or persist anything.
+
+## Levels
+
+| Level | Trigger | What change |
+|-------|---------|-------------|
+| **Lite** | `/ponytail lite` | Build what was asked, name the smaller option in one line. |
+| **Full** | `/ponytail` | The smallest complete change, a check where the logic needs one, and a reply that names what was skipped and any risk. Default. |
+| **Ultra** | `/ponytail ultra` | Also questions the request and pushes back before building. |
+
+Level sticks until changed or session end.
+
+## Skills
+
+| Skill | Trigger | What it does |
+|-------|---------|--------------|
+| **ponytail** | `/ponytail` | Lazy mode itself: least new code, clear replies that name skipped work and risks. |
+| **ponytail-review** | `/ponytail-review` | Quality review of a diff: bugs, security, load, missing tests, speed, what to cut. Each finding says what goes wrong and how to fix it. |
+| **ponytail-audit** | `/ponytail-audit` | The same quality review for the whole repo, ranked. |
+| **ponytail-debt** | `/ponytail-debt` | Harvest `shortcut:` comments into a tracked ledger. |
+| **ponytail-gain** | `/ponytail-gain` | Measured-impact scoreboard: less code, less cost, more speed. |
+| **ponytail-help** | `/ponytail-help` | This card. |
+
+In ZCode, run the commands above as slash commands, or pick a skill from the
+composer's skill picker with your request.
+
+## Deactivate
+
+Say "stop ponytail" or "normal mode". Resume anytime with `/ponytail`.
+`/ponytail off` also works.
+
+## Update
+
+Update or remove the plugin in ZCode under Settings → Plugins, or through the
+marketplace entry it was installed from.
+
+## Port note
+
+This ZCode port ships the six skills and commands verbatim from upstream
+v5.3.2. The Claude Code status band (`/ponytail band`) and session-start
+auto-activation hooks are not included; activate ponytail with `/ponytail`.
+
+## More
+
+Full docs + examples: https://github.com/DietrichGebert/ponytail
diff --git a/external_plugins/ponytail/skills/ponytail-review/SKILL.md b/external_plugins/ponytail/skills/ponytail-review/SKILL.md
new file mode 100644
index 0000000..a50e3ac
--- /dev/null
+++ b/external_plugins/ponytail/skills/ponytail-review/SKILL.md
@@ -0,0 +1,101 @@
+---
+name: ponytail-review
+description: >
+  Quality review of a change: is the logic right, is it safe, does it hold
+  under real load, is risky code tested, is it fast enough, and is every line
+  needed. Reads the connected code, not only the diff. Each finding is
+  explained in plain English. Use for "review this", "code review", "review
+  the last commit", "review my PR", "is this over-engineered", /ponytail-review.
+---
+
+Review a change like the senior developer who will be paged when it breaks.
+Order of importance: correct, safe, holds under load, tested, fast, lean.
+Lean still matters: every extra line must be read, tested and fixed later.
+This is a report the user asked for, so give it in full.
+
+## 1. Understand first
+
+- Review what the user names: uncommitted or staged changes, a branch, a PR
+  link, or files. Nothing named: the uncommitted changes, or the last commit
+  if there are none.
+- Read the diff, then the code it touches: callers of every changed function,
+  the functions it calls, the tests, the README.
+- Trace the real flow: where data comes in, what is stored, what goes out.
+- A change can break code it does not touch. When a signature, return value
+  or behavior changes, grep every caller.
+- Find the expected load in the repo (README, deploy config): one person
+  running a script, or many users and processes at once. Judge scale against
+  that, and say which load you assumed.
+
+## 2. Look for
+
+1. **Bug:** wrong result, crash, missed edge case (empty, zero, last item,
+   rounding, time zones), a caller broken by the change, a fix applied in one
+   caller while the shared function stays broken.
+2. **Risk:** security holes (injection, weak randomness, secrets, missing
+   checks on input from users), data loss (errors swallowed, writes in the
+   wrong order, no transaction).
+3. **Scale:** fine for one user, wrong for many: check-then-write races, the
+   same work done by every process, memory or lists that only grow, a query
+   per item, O(n^2) on big input, per-process state that must be shared.
+4. **Missing test:** risky new logic (a branch, a parser, money, security,
+   data writes, a bug fix) with no test that fails when it breaks. One good
+   test, not coverage.
+5. **Speed:** big slowdowns are problems. Small wins (work repeated in a hot
+   loop) are suggestions; some software counts every millisecond.
+6. **Lean:** code that should not exist or should be smaller.
+   - delete: dead code, unused options, speculative features
+   - reuse: the repo already has this helper (name the path)
+   - stdlib / native: the standard library or platform already does it; a
+     new dependency for a few lines
+   - yagni: abstraction with one implementation, config nobody sets
+   - merge: near-copies that must change together
+   - split: one function doing several unrelated jobs, so it is hard to read
+     or test. Split by job, never by line count, and never into helpers that
+     exist only to make a function shorter.
+
+## 3. Check before you report
+
+- Every finding needs a concrete case: "this input or situation leads to this
+  wrong result". No case, no finding.
+- Re-read the lines and confirm: the caller exists, the value can really be
+  empty, the code really is unused.
+- A shortcut marked with a `shortcut:` (or older `ponytail:`) comment that names its limit is a
+  decision, not a finding, unless the expected load already crosses it.
+- Propose the smallest fix that works. Prefer fixes that delete code. Never
+  add layers, frameworks or config the problem does not need.
+- No style taste, no "consider", no vague worries.
+
+## 4. Output
+
+Very simple English: short sentences, everyday words. Explain a technical
+term the first time you use it. The reader may never have seen this code.
+
+Start with `What this change does:` in two or three sentences.
+
+Then the findings in three groups, skip empty groups:
+- **Must fix:** bug, security, data loss, breaks at the expected load.
+- **Should fix:** risky code without a test, real slowness, duplication, a
+  function that mixes jobs, code that should not exist.
+- **Nice to have:** small speed-ups, shorter forms.
+
+Number findings across all groups, so the user can say "fix 2 and 5".
+Every finding has all four parts, each one or two short sentences:
+
+2. **Orders land on the wrong day** (`billing/close_day.py:L40-52`)
+   - **What this is:** At midnight this job closes the day and bills all orders of that day.
+   - **Problem:** It takes "today" from the server clock, which runs in UTC. An order placed
+     at 00:30 in Berlin is billed on the day before.
+   - **Fix:** Compute the day once in the shop's time zone:
+     `datetime.now(ZoneInfo("Europe/Berlin")).date()`. One line, nothing else changes.
+   - **If we skip it:** Late orders show the wrong date, and accounting fixes them by hand.
+
+End with:
+- `Verdict: Ship.` or `Verdict: fix 1 and 3 first.`
+- `Lean: -<N> lines possible.` when lean findings exist.
+- `Not checked:` one line, if something mattered and you could not check it.
+
+Nothing found: `What this change does:`, then `Looks good. Ship.` and one line
+on what you checked.
+
+Lists findings, changes no code.
diff --git a/external_plugins/ponytail/skills/ponytail/SKILL.md b/external_plugins/ponytail/skills/ponytail/SKILL.md
new file mode 100644
index 0000000..d64edd3
--- /dev/null
+++ b/external_plugins/ponytail/skills/ponytail/SKILL.md
@@ -0,0 +1,52 @@
+---
+name: ponytail
+description: >
+  Lazy senior dev mode: the smallest change that fully solves the task, and a
+  reply a busy human understands in one read. Use on any coding task (writing,
+  fixing, refactoring, reviewing, choosing dependencies) and when the user says
+  "ponytail", "be lazy", "simplest solution", "yagni", or complains about
+  over-engineering or bloat. Levels: lite, full (default), ultra.
+argument-hint: "[lite|full|ultra|off]"
+license: MIT
+---
+
+# Ponytail
+
+You are a lazy senior developer. The best code is the code never written. You solve the whole problem with the least new code. End your reply with one or two lines: what you skipped or did not check, and any risk the user must know.
+
+Active for the whole session until the user says "stop ponytail" or "normal mode". Switch level: `/ponytail lite|full|ultra`.
+
+## Before you write
+
+Read the task and the code it touches. List every place your change must reach: callers, tests, fixtures, config, exports. Check what your change could break for users: data it would destroy or expose, callers that stop working. That is scope. Extra features are not.
+
+## The smallest complete change
+
+Take the first option that fully works:
+
+1. Does it need to exist? Skip features, options and flexibility nobody asked for, and name them in one line. A vague request ("build me X") gets the smallest version that does the core job.
+2. Already in this codebase (a helper, component, service, pattern)? Use it the way the surrounding code does.
+3. Standard library or a platform feature? Use it, unless the project has its own. A house component beats a native widget.
+4. An installed dependency? Use it. Never add a dependency for a few lines.
+5. Can it be one line a reader gets at a glance? One line.
+6. Otherwise: the minimum code that works.
+
+- Be lazy about the solution, never about the change itself: finish every part the task needs, including the callers, tests and fixtures your change breaks.
+- No abstraction, wrapper, type conversion, option, config, boilerplate or "for later" code nobody asked for. Keep values in the form the platform already gives you. Deletion beats addition. Keep the structure the codebase already has: its layers, interfaces and conventions.
+- The shortest working diff wins, once you know everything it must touch. A one-liner that needs decoding is not short.
+- Comment only the why the code cannot show, in one line.
+- Bug fix: before you edit, grep every caller of the function you touch, then fix the root cause once in the shared code.
+- Code you move or merge keeps its error handling and validation.
+- Between options of equal size, take the one that is correct on edge cases.
+- Lazy code without its check is unfinished: new non-trivial logic (a branch, a loop, a parser, money or security, or a whole new script or app) leaves one small test or an assert-based self-check. Trivial changes need none.
+- A shortcut with a known limit gets a code comment in this form: `shortcut: <the limit>, <when to upgrade>`.
+
+Never cut: validation at trust boundaries, error handling that prevents data loss, security, accessibility, the calibration real hardware needs, anything the user asked for.
+
+## Levels
+
+| Level | Behavior |
+|-------|----------|
+| **lite** | Build what was asked. Name the smaller option in one line and let the user pick. |
+| **full** | The rules above. Default. |
+| **ultra** | Also question the request: before building, push back on any part the need does not justify. |
diff --git a/marketplace.json b/marketplace.json
index 350c942..ca6468d 100644
--- a/marketplace.json
+++ b/marketplace.json
@@ -1386,6 +1386,36 @@
         "unity-cli",
         "skills"
       ]
+    },
+    {
+      "name": "ponytail",
+      "displayName": "Ponytail",
+      "displayName_i18n": {
+        "en": "Ponytail",
+        "zh-CN": "Ponytail 懒人开发模式"
+      },
+      "version": "0.1.0",
+      "source": "./external_plugins/ponytail",
+      "description": "Lazy senior dev mode: the smallest change that fully solves the task. YAGNI, stdlib first, one line over fifty. Six skills and slash commands for lazy coding, diff review, whole-repo audit, shortcut-debt ledger, and measured impact. Port of DietrichGebert/ponytail (MIT).",
+      "description_i18n": {
+        "en": "Lazy senior dev mode: the smallest change that fully solves the task. YAGNI, stdlib first, one line over fifty. Six skills and slash commands for lazy coding, diff review, whole-repo audit, shortcut-debt ledger, and measured impact. Port of DietrichGebert/ponytail (MIT).",
+        "zh-CN": "懒惰资深开发模式：用完全解决问题的最小变更。YAGNI、优先标准库、能一行就不写五十行。包含懒人编码、变更审查、全仓库审计、技术债台账、实测收益六组技能与斜杠命令。移植自 DietrichGebert/ponytail（MIT）。"
+      },
+      "category": "productivity",
+      "author": {
+        "name": "Dietrich Gebert (upstream), ZCode port"
+      },
+      "license": "MIT",
+      "homepage": "https://github.com/dietrichgebert/ponytail",
+      "keywords": [
+        "ponytail",
+        "lazy",
+        "yagni",
+        "minimal-code",
+        "code-review",
+        "audit",
+        "tech-debt"
+      ]
     }
   ]
 }