[AlexNegrescu26]

Why

omp config set stores any string. A wrong model selector or an unknown @role alias in modelRoles or task.agentModelOverrides only fails when a spawn runs. setup-pstack left the check, the merge and the idempotence to the agent's prose.

What changed

• New setup-pstack/scripts/apply-models.mjs checks every selector and effort against omp models --json, then writes the three pstack_* aliases and their agent mappings. It supports --show and --dry-run.
• setup-pstack/SKILL.md steps 4 to 6 call the script. Steps 1 to 3, 7 and 8 and the ownership contract are unchanged.
• The gate checks the script is wired in, and CI runs its tests.

Scope

• It writes nothing when any check fails, and it never touches an entry pstack does not own.
• It reports one model family as information. It never asks for a second family.
• It does not pick models. The agent still detects the roster and asks you.

Tradeoffs

I did not take dsebban/skills' apply-models.mjs. It validates @role aliases against a fixed list of omp roles and rejects this port's pstack_* aliases.

Blast Radius

It affects only /skill:setup-pstack. A marketplace install has no scripts/ folder until the next release.

Verification

• bun test plugins/pstack/skills/setup-pstack/scripts passes, 11 tests against a stub omp. Each test fails when the behaviour it names breaks.
• In a throwaway PI_CODING_AGENT_DIR on omp 18.12.6, a real apply wrote both records, a rerun reported no change, and a nonexistent selector and an unsupported effort were refused with omp config get unchanged.
• check-port.sh and test-gate-mutations.sh pass.