@lesliechan721/aw 0.1.0-beta.64 → 0.1.0-beta.65

package/dist/src/commands/rebuild-command.js

@@ -16,10 +16,10 @@ import { supportsPlatform } from '../utils/platform-support.js';
 import { analyzeCodexSurface } from '../utils/codex-surface-analysis.js';
 import { buildGeneratedName } from '../generators/shared.js';
 import { createCodexReconcilePlan, } from '../utils/codex-reconciler.js';
-import { readCodexConfigFile } from '../utils/codex-config.js';
+import { parseCodexConfig, readCodexConfigFile } from '../utils/codex-config.js';
 import { isCanonicalCodexMarketplaceRegistration } from '../utils/codex-shared-native.js';
 import { executeRebuildComponentCleanup, executeRebuildOperation, prepareRebuildOperation, } from './rebuild-operations.js';
-import { assertNoClaudeUnboundNativeNameCollision, CodexActivationPostcheckError, createRebuildIntegration, executeCodexReconcileActivations, inspectCodexPluginRegistrationLive, inspectCodexSharedNativeLive, hasPreparedStaticNativeCommandDrift, inspectNativeMarketplaceRegistrations, removeCodexPluginActivation, removeNamespacedMarketplacePluginProjection, postcheckCodexReconcileActivations, } from './rebuild-integration.js';
+import { assertNoClaudeUnboundNativeNameCollision, CodexActivationPostcheckError, createRebuildIntegration, executeCodexReconcileActivations, inspectCodexPluginRegistrationLive, inspectCodexSharedNativeLive, hasPreparedStaticNativeCommandDrift, inspectNativeMarketplaceRegistrations, isNativeActivationOnlyTarget, postcheckCodexReconcileActivations, removeForceCleanupCodexRoleRegistration, } from './rebuild-integration.js';
 import { assertSafeNamespacedMarketplacePluginRoot, getNamespacedMarketplaceName, readStrictNamespacedMarketplaceRoot, } from '../utils/local-marketplace.js';
 import { formatPluginId, parsePluginId, planPluginSelectorSourceIds, preflightDesiredArtifactCollisions, withResolvedMultiSourceCatalog, } from '../utils/multi-source-catalog.js';
 import { calculateCodexNativeRenderPayloadDigest, calculateCodexSharedNativePayloadDigest, } from '../utils/catalog-digests.js';
@@ -27,17 +27,17 @@ import { resolveCatalogOperationContext, } from '../utils/catalog-operation-cont
 import { assertStrictSemVer } from '../utils/manifest.js';
 import { assertCatalogSourceInventoryComplete, canonicalMarketplaceRegistrationNames, inventoryCatalogSourceReferences, } from '../utils/catalog-source-references.js';
 import { sanitizeCatalogSourceErrorMessage } from '../utils/catalog-public-error.js';
-import { inspectPluginConfigResetTarget, readNamespacedPluginConfigStoreIdentity, resetPluginConfigStore, resolvePluginConfigStorePath, resolveEffectivePluginConfig, } from '../utils/plugin-config.js';
+import { readSafeOperationError } from '../utils/safe-operation-diagnostic.js';
+import { inspectPluginConfigResetTarget, readNamespacedPluginConfigStoreIdentity, resolvePluginConfigStorePath, resolveEffectivePluginConfig, } from '../utils/plugin-config.js';
 import { resolveArtifactRenderConfig } from '../utils/artifact-renderer.js';
 import { pluginConfigTargetRenderScopes } from '../utils/plugin-config-impact.js';
 import { inspectOwnedComponents, parseOwnedTextHeader, readSkillOwnerMarker, SKILL_OWNER_MARKER, } from '../utils/ownership.js';
 import { resolveActiveCatalogGeneration, resolveActiveCatalogPluginShallow } from '../utils/catalog-generation-resolver.js';
-import { canonicalizePathThroughExistingAncestorSync, codexProjectConfigAliasesUserHome, getClaudeHome, getCodexHome, resolveCanonicalRepoProjectKey, resolveRepoRootSync, } from '../utils/state-paths.js';
+import { canonicalizePathThroughExistingAncestorSync, codexProjectConfigAliasesUserHome, getClaudeHome, getCodexHome, resolveRepoRootSync, } from '../utils/state-paths.js';
 import { resolvePluginMetaDependencyClosure } from '../utils/plugin-dependencies.js';
 import { readCatalogSourcesConfigSnapshot } from '../utils/catalog-sources.js';
 import { catalogGenerationErrorCode, isOfflineCleanupCatalogGenerationError, } from '../utils/catalog-generation-error.js';
-import { canonicalizePluginIntentState, calculatePluginIntentDigest, createEmptyPluginIntentState, mergePluginIntentRootPlatforms, readPluginIntentState, removePluginIntentRootPlatforms, writePluginIntentState, } from '../utils/plugin-intent-state.js';
-import { assertOperationPlanFingerprint, createBatchIntentCompatiblePlanFingerprint, createOperationPlanConfigDigest, createOperationPlan, } from './operation-plan.js';
+import { assertOperationPlanFingerprint, createOperationPlanConfigDigest, createOperationPlan, } from './operation-plan.js';
 import { validateCatalogSnapshotComplete, validateCatalogSnapshotPluginEntriesComplete, } from '../utils/catalog-snapshot.js';
 import { AwCapabilityUnsupportedError, IMPLEMENTED_AW_CAPABILITIES, } from './aw-capabilities.js';
 import { checkAwCapabilitySupport } from '../utils/manifest.js';
@@ -100,7 +100,7 @@ function assertRebuildCatalogSourceInventoryComplete(inventory, targetScope) {
             || !error.kind.startsWith('config')),
     });
 }
-const MALFORMED_CONFIG_PRESERVED_WARNING = 'pluginConfigPreserved: 目标插件的无效配置文件已保留。可稍后运行 aw config reset 清理。';
+const MALFORMED_CONFIG_PRESERVED_WARNING = 'pluginConfigPreserved: 目标插件的无效配置文件已保留。可稍后运行 aw plugin config reset <source/plugin> --context user 清理。';
 const OBSOLETE_CONTRACTS_CLEANUP_WARNING = 'obsoleteContractsCleanupFailed: Obsolete installation contracts could not be removed.';
 function omitSelectedPluginConfigErrors(inventory, targets) {
     let omitted = false;
@@ -154,7 +154,7 @@ async function selectedProjectCodexSkillReferences(options) {
     return references;
 }
 const cleanupProjectSkillsByInventory = new WeakMap();
-function selectCodexActivationPlans(plans, targetScopes, preservedActivations) {
+function selectCodexActivationPlans(plans, targetScopes, preservedActivations, originalUserActivations) {
     return plans.flatMap((plan) => {
         const includesScope = (pluginId, scope) => targetScopes.has(`${pluginId}\0${scope}`);
         const pluginIds = new Set(plan.desiredTargets.flatMap((target) => ['user', 'project'].some((scope) => includesScope(target.pluginId, scope))
@@ -162,9 +162,21 @@ function selectCodexActivationPlans(plans, targetScopes, preservedActivations) {
             : []));
         if (pluginIds.size === 0)
             return [];
-        const includesActivationAction = (action) => includesScope(action.pluginId, action.scope) || !action.desired;
+        const includesActivationAction = (action) => includesScope(action.pluginId, action.scope);
         const sharedNativeActions = plan.sharedNativeActions.filter((action) => pluginIds.has(action.pluginId));
         const userActions = plan.activationActions.user.filter((action) => pluginIds.has(action.pluginId) && includesActivationAction(action));
+        for (const action of plan.activationActions.user) {
+            if (!originalUserActivations || includesScope(action.pluginId, 'user')
+                || !includesScope(action.pluginId, 'project')
+                || !sharedNativeActions.some((shared) => shared.pluginId === action.pluginId
+                    && (shared.action === 'install' || shared.action === 'replace' || shared.action === 'repair'))) {
+                continue;
+            }
+            const original = originalUserActivations.get(action.codexPluginId) === true;
+            if ((preservedActivations?.user.get(action.codexPluginId) === true) === original)
+                continue;
+            userActions.push({ ...action, action: original ? 'enable' : 'disable', desired: original });
+        }
         const projectActions = plan.activationActions.project.filter((action) => pluginIds.has(action.pluginId) && includesActivationAction(action));
         const desiredTargets = plan.desiredTargets.flatMap((target) => {
             const scopes = target.scopes.filter((scope) => includesScope(target.pluginId, scope));
@@ -188,6 +200,7 @@ function selectCodexActivationPlans(plans, targetScopes, preservedActivations) {
         return [{
                 ...plan,
                 desiredTargets,
+                sharedNativeActions,
                 activationActions: { user: userActions, project: projectActions },
                 extensionWrites: plan.extensionWrites.filter((action) => includesScope(action.pluginId, action.scope)),
                 extensionRemovals: plan.extensionRemovals.filter((action) => includesScope(action.pluginId, action.scope)),
@@ -227,134 +240,20 @@ function failedCodexActivationTargetScopes(options) {
     }
     return failed.size > 0 ? failed : new Set(options.successfulTargetScopes);
 }
-function updateIntentOverrides(options) {
-    const plannedKeys = new Set(options.plan.targets.map((target) => `${target.pluginId}\0${target.platform}`));
-    return canonicalizePluginIntentState({
-        ...options.state,
-        dependencyScopeOverrides: [
-            ...options.state.dependencyScopeOverrides.filter((override) => !plannedKeys.has(`${override.pluginId}\0${override.platform}`)),
-            ...options.plan.scopeOverrides,
-        ],
-    });
-}
 function effectiveDependencyScopeOverrides(options) {
     const nodeKeys = new Set(options.nodes.map((node) => `${node.pluginId}\0${node.platform}`));
     const explicitMatches = (pluginId, platform) => options.explicit.some((override) => override.pluginId === pluginId
         && (override.platform === undefined || override.platform === platform));
     return [
-        ...options.state.dependencyScopeOverrides.filter((override) => nodeKeys.has(`${override.pluginId}\0${override.platform}`)
+        ...(options.state.dependencyScopeOverrides ?? []).filter((override) => nodeKeys.has(`${override.pluginId}\0${override.platform}`)
             && !options.ignoredPersistedRootIds?.has(override.pluginId)
             && !explicitMatches(override.pluginId, override.platform)),
         ...options.explicit.filter((override) => options.nodes.some((node) => node.pluginId === override.pluginId
             && (override.platform === undefined || node.platform === override.platform))),
     ];
 }
-function pruneUnreachableDependencyScopeOverrides(state, catalogEntries) {
-    if (!catalogEntries || state.dependencyScopeOverrides.length === 0)
-        return state;
-    const byId = new Map(catalogEntries.map((entry) => [entry.pluginId, entry]));
-    const reachable = new Set();
-    const visiting = new Set();
-    const visited = new Set();
-    const visit = (pluginId, platform, root) => {
-        const entry = byId.get(pluginId);
-        if (!entry || visiting.has(pluginId))
-            return false;
-        const visitKey = `${pluginId}\0${platform}`;
-        if (visited.has(visitKey)) {
-            if (!root)
-                reachable.add(visitKey);
-            return true;
-        }
-        visiting.add(pluginId);
-        for (const dependencyPluginId of entry.dependencyPluginIds) {
-            if (!visit(dependencyPluginId, platform, false))
-                return false;
-        }
-        visiting.delete(pluginId);
-        visited.add(visitKey);
-        if (!root)
-            reachable.add(visitKey);
-        return true;
-    };
-    for (const root of state.roots) {
-        for (const platform of root.platforms) {
-            visiting.clear();
-            if (!visit(root.pluginId, platform, true))
-                return state;
-        }
-    }
-    return canonicalizePluginIntentState({
-        ...state,
-        dependencyScopeOverrides: state.dependencyScopeOverrides.filter((override) => reachable.has(`${override.pluginId}\0${override.platform}`)),
-    });
-}
-function deriveDesiredIntentState(options) {
-    let next = options.state;
-    if (options.command === 'install') {
-        for (const root of options.selectedRoots)
-            next = mergePluginIntentRootPlatforms(next, root);
-        if (options.selectedRoots.length > 0) {
-            next = updateIntentOverrides({ state: next, plan: options.plan });
-        }
-    }
-    else if (options.command === 'uninstall' || options.command === 'cleanup') {
-        for (const root of options.selectedRoots)
-            next = removePluginIntentRootPlatforms(next, root);
-        if (options.command === 'uninstall') {
-            next = pruneUnreachableDependencyScopeOverrides(next, options.catalogEntries);
-        }
-    }
-    return next;
-}
-function removeSelectedRootPlatformsFromOtherScope(options) {
-    let next = options.state;
-    for (const root of options.selectedRoots) {
-        const platforms = root.platforms.filter((platform) => platform !== 'codex' || !options.preserveCodexRootIds.has(root.pluginId));
-        if (platforms.length > 0) {
-            next = removePluginIntentRootPlatforms(next, { ...root, platforms });
-        }
-    }
-    return next;
-}
-async function writeDesiredIntentSuperset(options) {
-    const location = { scope: options.scope, cwd: options.cwd, env: options.env };
-    let next = deriveDesiredIntentState({
-        command: options.command,
-        state: await readPluginIntentState(location),
-        selectedRoots: options.selectedRoots,
-        plan: options.plan,
-        catalogEntries: options.catalogEntries,
-    });
-    const superset = next;
-    await writePluginIntentState(location, superset);
-    const writes = [{ location, superset }];
-    if (options.command === 'install' || options.codexPlan) {
-        const otherScope = options.scope === 'user' ? 'project' : 'user';
-        const otherLocation = { scope: otherScope, cwd: options.cwd, env: options.env };
-        let other = await readPluginIntentState(otherLocation);
-        if (options.command === 'install' && options.removeOtherScopeRoots !== false) {
-            const protectedOtherRootPlatforms = new Set(options.plan.targets.flatMap((target) => target.relation === 'requested'
-                && (target.requestedScope ?? target.resolvedScope) === otherScope
-                ? [`${target.pluginId}\0${target.platform}`]
-                : []));
-            other = removeSelectedRootPlatformsFromOtherScope({
-                state: other,
-                selectedRoots: options.selectedRoots.flatMap((root) => {
-                    const platforms = root.platforms.filter((platform) => !protectedOtherRootPlatforms.has(`${root.pluginId}\0${platform}`));
-                    return platforms.length > 0 ? [{ ...root, platforms }] : [];
-                }),
-                preserveCodexRootIds: options.preserveOtherCodexScopeRootIds,
-            });
-        }
-        const otherSuperset = other;
-        await writePluginIntentState(otherLocation, otherSuperset);
-        writes.push({
-            location: otherLocation,
-            superset: otherSuperset,
-        });
-    }
-    return writes;
+function nativeDemandDigest(demand) {
+    return `sha256:${crypto.createHash('sha256').update(JSON.stringify(demand)).digest('hex')}`;
 }
 function createSyntheticPlugin(pluginName, env) {
     const rootDir = path.join(resolveAwHome(env), 'plugins', pluginName);
@@ -416,18 +315,6 @@ function toTargetResult(result) {
         } : {}),
     };
 }
-function toRemovedCleanupTargetResult(result) {
-    const target = toTargetResult(result);
-    if (result.status === 'succeeded' || !result.target.pluginId)
-        return target;
-    return {
-        ...target,
-        recoveryActions: [
-            `repair the reported ownership, native CLI, or config path evidence, then run aw cleanup ${result.target.pluginId} --platform both --scope user --yes`,
-            'use cleanup --force only for exclusively owned damaged output, then retry ordinary cleanup',
-        ],
-    };
-}
 async function assertClaudeVersion(options) {
     if (!options.platforms.includes('claude'))
         return;
@@ -454,6 +341,9 @@ async function resolveRequestedNames(options) {
 }
 async function runSingleSourceRebuildCommand(options) {
     const runtime = {
+        preparedArtifactRenderResults: options.runtime?.preparedArtifactRenderResults,
+        signal: options.runtime?.signal,
+        scriptTimeoutMs: options.commandOptions.scriptTimeoutMs,
         env: options.runtime?.env ?? process.env,
         nativeCliRunner: options.runtime?.nativeCliRunner ?? getDefaultNativeCliRunner(),
         reporter: options.runtime?.reporter ?? createNoopReporter(),
@@ -464,6 +354,8 @@ async function runSingleSourceRebuildCommand(options) {
         codexObservationSession: options.runtime?.codexObservationSession,
         preApplyExecutionCache: options.runtime?.preApplyExecutionCache,
         managedCommandProducerCache: options.runtime?.managedCommandProducerCache ?? new Map(),
+        preserveLegacyNativeSkills: options.runtime?.preserveLegacyNativeSkills,
+        nativeActivationOnlyTargets: options.runtime?.nativeActivationOnlyTargets,
         commandResults: options.runtime?.commandResults ?? [],
     };
     const env = runtime.env;
@@ -663,6 +555,35 @@ function toCatalogResolution(source) {
         channel: source.manifest.channel,
     };
 }
+function preparedNativeFootprints(targets) {
+    return targets.flatMap((target) => (target.desiredOwnedComponents ?? target.ownedComponents).flatMap((component) => {
+        let outputPath;
+        if ('path' in component)
+            outputPath = component.path;
+        else if ('locator' in component) {
+            const locator = component.locator;
+            if ('configPath' in locator)
+                outputPath = locator.configPath;
+            else if ('settingsPath' in locator)
+                outputPath = locator.settingsPath;
+            else if ('hooksPath' in locator)
+                outputPath = locator.hooksPath;
+            else if ('marketplaceRoot' in locator)
+                outputPath = locator.marketplaceRoot;
+        }
+        return outputPath ? [{
+                path: path.resolve(outputPath),
+                pluginId: target.identity.pluginId ?? target.identity.pluginName,
+                platform: target.identity.platform,
+                scope: target.identity.scope,
+                shared: component.kind === 'shared-config' || component.kind === 'managed-block',
+                ...(component.kind === 'shared-config'
+                    && (component.locator.kind === 'codex-marketplace'
+                        || component.locator.kind === 'claude-marketplace')
+                    ? { sharedMarketplace: true } : {}),
+            }] : [];
+    }));
+}
 function mergeRebuildCommandResults(results) {
     const rebuildResults = results.flatMap((result) => result.rebuildResults);
     const platforms = [...new Set(results.flatMap((result) => result.platforms))];
@@ -674,9 +595,12 @@ function mergeRebuildCommandResults(results) {
         targetResults: results.flatMap((result) => result.targetResults),
         ...(results.some((result) => result.commandResults?.length) ? { commandResults: results.flatMap((result) => result.commandResults ?? []) } : {}),
         overallState: rebuildResults.every((result) => result.status === 'succeeded')
-            ? 'succeeded'
+            ? results.some((result) => result.overallState === 'partial') ? 'partial' : 'succeeded'
             : rebuildResults.some((result) => result.status === 'succeeded') ? 'partial' : 'failed',
         receiptTargets: results.flatMap((result) => result.receiptTargets),
+        ...(results.some((result) => result.nativeFootprints !== undefined)
+            ? { nativeFootprints: results.flatMap((result) => result.nativeFootprints ?? []) }
+            : {}),
         ...(results.find((result) => result.dependencyPlan)?.dependencyPlan
             ? { dependencyPlan: results.find((result) => result.dependencyPlan).dependencyPlan }
             : {}),
@@ -689,9 +613,6 @@ function mergeRebuildCommandResults(results) {
         ...(results.some((result) => result.offlineCleanupPlans !== undefined)
             ? { offlineCleanupPlans: results.flatMap((result) => result.offlineCleanupPlans ?? []) }
             : {}),
-        ...(results.some((result) => result.removedPluginCleanupIds !== undefined)
-            ? { removedPluginCleanupIds: [...new Set(results.flatMap((result) => result.removedPluginCleanupIds ?? []))] }
-            : {}),
     };
 }
 function reconcileOverallState(targetResults, plan, rebuildResults = []) {
@@ -716,30 +637,6 @@ function reconcileOverallState(targetResults, plan, rebuildResults = []) {
     return completedRequested || completedMutation || observedMutation ? 'partial' : 'failed';
 }
 function createRebuildOperationPlan(options) {
-    const intentChanges = ['user', 'project'].flatMap((scope) => {
-        const selectedRoots = [...new Map(options.dependencyPlan.targets.flatMap((target) => target.relation === 'requested'
-                && (target.requestedScope ?? target.resolvedScope) === scope
-                ? [[target.pluginId, {
-                            pluginId: target.pluginId,
-                            platforms: options.dependencyPlan.targets.flatMap((candidate) => candidate.relation === 'requested'
-                                && candidate.pluginId === target.pluginId
-                                && (candidate.requestedScope ?? candidate.resolvedScope) === scope
-                                ? [candidate.platform]
-                                : []),
-                        }]]
-                : [])).values()];
-        const intentBefore = options.intentBeforeByScope[scope];
-        const intentAfter = deriveDesiredIntentState({
-            command: options.command,
-            state: intentBefore,
-            selectedRoots,
-            plan: options.dependencyPlan,
-            catalogEntries: options.catalogEntries,
-        });
-        const beforeDigest = calculatePluginIntentDigest(intentBefore);
-        const afterDigest = calculatePluginIntentDigest(intentAfter);
-        return beforeDigest === afterDigest ? [] : [{ scope, beforeDigest, afterDigest }];
-    });
     const actions = [
         ...(options.targetActions ?? []),
         ...options.codexPlans.flatMap((plan) => [
@@ -771,7 +668,7 @@ function createRebuildOperationPlan(options) {
         ]),
     ];
     return createOperationPlan({
-        intentChanges,
+        intentChanges: [],
         actions,
         changes: options.dependencyPlan.targets.map((target) => [
             target.pluginId,
@@ -785,10 +682,7 @@ function createRebuildOperationPlan(options) {
                 sourceId: source.sourceId,
                 digest: source.manifestDigest,
             })),
-            intentDigests: ['user', 'project'].map((scope) => ({
-                scope,
-                digest: calculatePluginIntentDigest(options.intentBeforeByScope[scope]),
-            })),
+            intentDigests: [{ scope: options.scope, digest: nativeDemandDigest(options.requirements) }],
             configDigests: options.configDigests,
             targetOwnerFingerprints: options.dependencyPlan.targets.map((target) => ({
                 pluginId: target.pluginId,
@@ -878,18 +772,6 @@ function cleanupIntentTargets(options) {
             }];
     }));
 }
-function cleanupSelectedRoots(targets) {
-    const platformsByPluginId = new Map();
-    for (const target of targets) {
-        const platforms = platformsByPluginId.get(target.pluginId) ?? new Set();
-        platforms.add(target.platform);
-        platformsByPluginId.set(target.pluginId, platforms);
-    }
-    return [...platformsByPluginId].map(([pluginId, platforms]) => ({
-        pluginId,
-        platforms: [...platforms],
-    }));
-}
 function cleanupIntentResult(target) {
     return {
         status: 'succeeded',
@@ -1113,6 +995,7 @@ async function cleanupOfflineOwnedComponents(options) {
         ...(codexManager ? { codexManager } : {}),
         reporter: createNoopReporter(),
         debugLogger: createNoopDebugLogger(),
+        preserveLegacyNativeSkills: options.preserveLegacyNativeSkills,
     };
     const integration = createRebuildIntegration({ context });
     for (const target of options.targets) {
@@ -1125,14 +1008,11 @@ async function cleanupOfflineOwnedComponents(options) {
                 && candidate.sourceIdentity === target.sourceIdentity
                 && candidate.platform === target.platform
                 && candidate.scope === target.scope);
-            const activationAction = target.platform === 'codex' && !options.removedPluginWhole
+            const activationAction = target.platform === 'codex'
                 ? evidence?.plan.actions.find((action) => action.action === 'removeNativeRegistration'
                     && action.activationScope === target.scope)
                 : undefined;
-            let activationDisposition = 'remove';
-            if (activationAction && target.scope === 'user') {
-                activationDisposition = 'disable';
-            }
+            const activationDisposition = 'disable';
             const plugin = createSyntheticPlugin(target.pluginName, options.env);
             plugin.sourceId = target.sourceId;
             plugin.sourceIdentity = target.sourceIdentity;
@@ -1156,8 +1036,7 @@ async function cleanupOfflineOwnedComponents(options) {
                     catalogVersion: '0.0.0',
                     channel: 'beta',
                 },
-                includeNativeCleanupCandidate: target.nativeRegistration === true,
-                ...(options.removedPluginWhole ? { removedPluginWhole: true } : {}),
+                includeNativeCleanupCandidate: false,
                 ...(activationAction
                     ? {
                         codexActivationCleanup: [{
@@ -1168,6 +1047,15 @@ async function cleanupOfflineOwnedComponents(options) {
                     }
                     : {}),
             });
+            const sharedNativeComponent = (component) => component.kind === 'native-plugin'
+                || (component.kind === 'shared-config'
+                    && component.identity.artifactKey.startsWith('marketplace-'));
+            desired.requiresNative = false;
+            desired.writeNativeRequired = false;
+            desired.ownedComponents = desired.ownedComponents.filter((component) => !sharedNativeComponent(component));
+            desired.desiredOwnedComponents = desired.desiredOwnedComponents?.filter((component) => !sharedNativeComponent(component));
+            desired.optionalOwnedComponents = desired.optionalOwnedComponents?.filter((component) => !sharedNativeComponent(component));
+            desired.operationActions = desired.operationActions?.filter((action) => action.kind !== 'removeNativeRegistration');
             const unplannedCandidates = evidence
                 ? desired.ownedComponents.filter((component) => !cleanupComponentAuthorized(component, evidence))
                 : [];
@@ -1183,19 +1071,17 @@ async function cleanupOfflineOwnedComponents(options) {
                 desired.desiredOwnedComponents = desired.desiredOwnedComponents?.filter(authorized);
                 desired.optionalOwnedComponents = desired.optionalOwnedComponents?.filter(authorized);
                 desired.artifacts = desired.artifacts.filter((artifact) => cleanupPathAuthorized(artifact.path, evidence));
-                const nativeAuthorized = evidence.plan.actions.some((action) => action.action === 'removeNativeRegistration');
-                desired.requiresNative &&= nativeAuthorized;
-                desired.writeNativeRequired &&= nativeAuthorized;
+                desired.requiresNative = false;
+                desired.writeNativeRequired = false;
                 desired.operationActions = desired.operationActions?.filter((action) => {
                     if (action.kind === 'removeOwnedArtifact') {
                         return cleanupPathAuthorized(action.path, evidence);
                     }
-                    if (action.kind === 'removeNativeRegistration') {
-                        return evidence.plan.actions.some((planned) => planned.action === 'removeNativeRegistration'
-                            && planned.target === action.registration);
+                    if (action.kind === 'setActivation') {
+                        return Boolean(activationAction
+                            && action.scope === target.scope
+                            && action.registration === activationAction.target);
                     }
-                    if (action.kind === 'setActivation')
-                        return nativeAuthorized;
                     if (action.kind === 'retainManagedCommandPackage')
                         return true;
                     return false;
@@ -1296,45 +1182,42 @@ async function previewOfflineOwnedComponents(options) {
     await options.onPreviewStage?.('dependencyPlan');
     return preview;
 }
-function createOfflineCleanupOperationPlan(evidence, intent, warnings = [], retainedPackages = []) {
-    const beforeDigest = intent ? calculatePluginIntentDigest(intent.before) : undefined;
-    const afterDigest = intent ? calculatePluginIntentDigest(intent.after) : undefined;
-    const removesIntent = (target) => intent !== undefined
-        && intent.before.roots.some((root) => root.pluginId === target.pluginId && root.platforms.includes(target.platform))
-        && !intent.after.roots.some((root) => root.pluginId === target.pluginId && root.platforms.includes(target.platform));
+function createOfflineCleanupOperationPlan(evidence, requirements, warnings = [], retainedPackages = []) {
     return createOperationPlan({
-        intentChanges: intent && beforeDigest !== afterDigest
-            ? [{ scope: intent.scope, beforeDigest: beforeDigest, afterDigest: afterDigest }]
-            : [],
-        actions: [...retainedPackages, ...evidence.flatMap((target) => target.plan.actions.map((action) => action.action === 'removeNativeRegistration'
-                ? {
-                    kind: 'removeNativeRegistration',
-                    pluginId: target.pluginId,
-                    platform: target.platform,
-                    scope: target.scope,
-                    registration: action.target,
-                }
-                : {
-                    kind: 'removeOwnedArtifact',
-                    pluginId: target.pluginId,
-                    platform: target.platform,
-                    scope: target.scope,
-                    path: action.target,
-                    ownerFingerprint: target.targetFingerprint,
-                }))],
-        changes: [
-            ...evidence.flatMap((target) => removesIntent(target)
-                ? [`${target.pluginId}:${target.platform}:${target.scope}:removeIntent`]
-                : []),
-            ...evidence.flatMap((target) => target.plan.actions.map((action) => `${target.pluginId}:${target.platform}:${target.scope}:${action.action}:${action.target}`)),
-        ],
+        intentChanges: [],
+        actions: [...retainedPackages, ...evidence.flatMap((target) => target.plan.actions.flatMap((action) => action.action === 'removeOwnedOutput'
+                ? [{
+                        kind: 'removeOwnedArtifact',
+                        pluginId: target.pluginId,
+                        platform: target.platform,
+                        scope: target.scope,
+                        path: action.kind === 'namespacedOwner' && path.basename(action.target) === SKILL_OWNER_MARKER
+                            ? path.dirname(action.target) : action.target,
+                        ownerFingerprint: target.targetFingerprint,
+                    }]
+                : action.activationScope === target.scope
+                    ? [{
+                            kind: 'setActivation',
+                            pluginId: target.pluginId,
+                            platform: 'codex',
+                            scope: target.scope,
+                            enabled: false,
+                        }]
+                    : []))],
+        changes: evidence.flatMap((target) => target.plan.actions.flatMap((action) => action.action === 'removeOwnedOutput'
+            ? [`${target.pluginId}:${target.platform}:${target.scope}:${action.action}:${action.target}`]
+            : action.activationScope === target.scope
+                ? [`${target.pluginId}:${target.platform}:${target.scope}:setActivation:false:${action.target}`]
+                : [])),
         warnings: [...warnings],
         evidence: {
             catalogDigests: evidence.map((target) => ({
                 sourceId: target.sourceId,
                 digest: target.sourceIdentity,
             })),
-            intentDigests: intent ? [{ scope: intent.scope, digest: beforeDigest }] : [],
+            intentDigests: requirements
+                ? [{ scope: requirements.scope, digest: nativeDemandDigest(requirements.view) }]
+                : [],
             configDigests: [],
             targetOwnerFingerprints: evidence.map((target) => ({
                 pluginId: target.pluginId,
@@ -1596,24 +1479,14 @@ async function removedProjectionTreeFingerprint(root) {
     };
     return removedCleanupDigest(await visit(root));
 }
-function removeRemovedPluginIntent(state, pluginIds) {
-    return canonicalizePluginIntentState({
-        ...state,
-        roots: state.roots.filter((root) => !pluginIds.has(root.pluginId)),
-        dependencyScopeOverrides: state.dependencyScopeOverrides.filter((override) => !pluginIds.has(override.pluginId)),
-    });
-}
-async function inspectRemovedPluginConfig(options) {
+export async function inspectRemovedPluginConfig(options) {
     const inspection = await inspectPluginConfigResetTarget(options);
     if (inspection.kind !== 'regularFile')
         return inspection;
     try {
         const identity = await readNamespacedPluginConfigStoreIdentity(options);
-        if (identity && (options.scope === 'user'
-            ? identity.binding.kind !== 'source'
-                || identity.binding.sourceIdentity !== options.sourceIdentity
-            : identity.binding.kind !== 'catalog'
-                || identity.binding.logicalIdentity !== options.logicalIdentity)) {
+        if (identity && (identity.binding.kind !== 'source'
+            || identity.binding.sourceIdentity !== options.sourceIdentity)) {
             return { ...inspection, conflict: 'removedPluginConfigIdentityConflict: saved config binding differs from the Active source.' };
         }
     }
@@ -1638,7 +1511,7 @@ async function inspectRemovedPluginConfig(options) {
     }
     return inspection;
 }
-async function inspectRemovedPluginCleanup(options) {
+export async function inspectRemovedPluginCleanup(options) {
     const parsed = parsePluginId(options.pluginId);
     if (!parsed.sourceId)
         return null;
@@ -1705,7 +1578,7 @@ async function inspectRemovedPluginCleanup(options) {
     const activationScopes = [];
     if (marketplaceName) {
         const inspectedPaths = new Set();
-        for (const scope of ['user', 'project']) {
+        for (const scope of [options.scope]) {
             const configPath = resolveCodexPaths(options.cwd, scope, options.env).configTomlPath;
             if (inspectedPaths.has(path.resolve(configPath)))
                 continue;
@@ -1737,7 +1610,7 @@ async function inspectRemovedPluginCleanup(options) {
                 env: options.env,
                 nativeCliRunner: options.nativeCliRunner,
                 manager: options.codexManager,
-                scope: 'both',
+                scope: options.scope,
             });
             nativeState = observed.observation.state === 'observed'
                 ? observed.observation.value === 'installed' ? 'installed' : 'absent'
@@ -1758,7 +1631,7 @@ async function inspectRemovedPluginCleanup(options) {
         blockers.push('removedPluginNativeOwnershipUnavailable: native evidence remains without a valid AW marketplace root.');
     }
     const configTargets = [];
-    for (const scope of ['user', 'project']) {
+    for (const scope of [options.scope]) {
         try {
             const inspected = await inspectRemovedPluginConfig({
                 sourceId: parsed.sourceId,
@@ -1817,7 +1690,7 @@ async function inspectRemovedPluginCleanup(options) {
     });
     const evidence = [];
     for (const platform of ['codex', 'claude']) {
-        for (const scope of ['user', 'project']) {
+        for (const scope of [options.scope]) {
             const base = offlineCleanupEvidenceFromInventory({
                 reason: 'bundleUnavailable',
                 pluginId,
@@ -1835,27 +1708,11 @@ async function inspectRemovedPluginCleanup(options) {
                 platform,
                 scope,
             });
-            const actions = base.plan.actions.flatMap((action) => {
-                if (platform === 'codex' && action.action === 'removeNativeRegistration')
-                    return [];
-                if (platform === 'claude' && action.action === 'removeNativeRegistration') {
-                    return root && projectionOwnershipVerified && !claudeNativeCleanupBlocked
-                        && registration?.claude === 'canonical'
-                        && marketplaceName && action.kind === 'namespacedMarketplace'
-                        ? [{ ...action, target: `${parsed.pluginName}@${marketplaceName}` }]
-                        : [];
-                }
-                return [action];
-            });
-            if (platform === 'codex' && scope === 'user' && nativeState === 'installed'
-                && marketplaceName && nativeOwnershipVerified && projectionPathSafe) {
-                actions.push({
-                    action: 'removeNativeRegistration',
-                    kind: 'namespacedMarketplace',
-                    target: `${parsed.pluginName}@${marketplaceName}`,
-                    marketplaceName,
-                });
-            }
+            const actions = base.plan.actions.filter((action) => action.action !== 'removeNativeRegistration'
+                || (platform === 'codex'
+                    && nativeOwnershipVerified
+                    && projectionPathSafe
+                    && action.activationScope === scope));
             const safeActions = ownershipConflict ? [] : actions;
             const enrichedActions = await Promise.all(safeActions.map(async (action) => action.action === 'removeOwnedOutput'
                 ? { ...action, pathEvidence: await removedProjectionTreeFingerprint(action.target.split('#', 1)[0]) }
@@ -1887,441 +1744,131 @@ async function inspectRemovedPluginCleanup(options) {
         blockers,
     };
 }
-function createRemovedPluginCleanupOperationPlan(options) {
-    const actions = [];
-    const changes = [];
-    for (const target of options.targets) {
-        for (const scope of ['user', 'project']) {
-            const before = options.intents[scope].before;
-            const after = options.intents[scope].after;
-            if (calculatePluginIntentDigest(before) !== calculatePluginIntentDigest(after)
-                && (before.roots.some((root) => root.pluginId === target.pluginId)
-                    || before.dependencyScopeOverrides.some((override) => override.pluginId === target.pluginId))) {
-                changes.push(`${target.pluginId}:${scope}:removeIntentAndOverrides`);
-            }
-        }
-        for (const evidence of target.evidence) {
-            for (const action of evidence.plan.actions) {
-                actions.push(action.action === 'removeNativeRegistration'
-                    ? {
-                        kind: 'removeNativeRegistration',
-                        pluginId: target.pluginId,
-                        platform: evidence.platform,
-                        scope: evidence.scope,
-                        registration: action.target,
-                    }
-                    : {
-                        kind: 'removeOwnedArtifact',
-                        pluginId: target.pluginId,
-                        platform: evidence.platform,
-                        scope: evidence.scope,
-                        path: action.target,
-                        ownerFingerprint: evidence.targetFingerprint,
-                    });
-                changes.push(`${target.pluginId}:${evidence.platform}:${evidence.scope}:${action.action}:${action.target}`);
-            }
-        }
-        for (const config of target.configTargets.filter((entry) => entry.kind !== 'absent')) {
-            if (config.kind === 'directory' || config.kind === 'special'
-                || target.blockers.some((blocker) => blocker.startsWith(`${config.scope}: removedPluginConfigIdentityConflict`))) {
-                continue;
-            }
-            actions.push({
-                kind: 'removePluginConfig',
-                pluginId: target.pluginId,
-                platform: 'codex',
-                scope: config.scope,
-                path: resolvePluginConfigStorePath({
-                    sourceId: target.sourceId,
-                    pluginName: target.pluginName,
-                    scope: config.scope,
-                    cwd: options.cwd,
-                    env: options.env,
-                }),
-                fingerprint: config.fingerprint,
-            });
-            changes.push(`${target.pluginId}:${config.scope}:removeSavedConfig:${config.kind}:${config.fingerprint}`);
-        }
-        for (const activation of target.activationScopes) {
-            changes.push(`${target.pluginId}:codex:${activation.scope}:activationEvidence:${activation.enabled}`);
-            if (!target.nativeOwnershipVerified || target.nativeState === 'unknown')
-                continue;
-            actions.push({
-                kind: 'removeActivation',
-                pluginId: target.pluginId,
-                platform: 'codex',
-                scope: activation.scope,
-                registration: `${target.pluginName}@${target.marketplaceName}`,
-            });
-            changes.push(`${target.pluginId}:codex:${activation.scope}:removeActivation`);
-        }
-        changes.push(`${target.pluginId}:projectionEvidence:${target.projectionFingerprint}`);
-        if (target.projectionPresent && target.projectionOwnershipVerified
-            && target.nativeState !== 'unknown'
-            && (target.nativeOwnershipVerified || target.activationScopes.length === 0)) {
-            actions.push({
-                kind: 'removeMarketplaceProjection',
-                pluginId: target.pluginId,
-                platform: 'codex',
-                scope: 'user',
-                marketplaceRoot: target.marketplaceRoot,
-            });
-            changes.push(`${target.pluginId}:removeMarketplaceProjection`);
-        }
-        changes.push(`${target.pluginId}:nativeObservation:${target.nativeState}:${target.nativeObservationFingerprint}:${target.marketplaceEvidenceFingerprint}`);
-    }
-    const warnings = options.targets.flatMap((target) => [
-        `removedPluginCleanupScope: ${target.pluginId} 清理范围为 Codex 和 Claude 的用户及当前项目，包含两处保存设置。`,
-        `removedPluginCleanupSharedNativeImpact: ${target.pluginId} 的 Codex 共享原生包卸载后，其他项目可能无法继续使用；其他项目的本地记录不会修改。`,
-        ...target.blockers,
-    ]);
-    return createOperationPlan({
-        intentChanges: ['user', 'project'].flatMap((scope) => {
-            const beforeDigest = calculatePluginIntentDigest(options.intents[scope].before);
-            const afterDigest = calculatePluginIntentDigest(options.intents[scope].after);
-            return beforeDigest === afterDigest ? [] : [{ scope, beforeDigest, afterDigest }];
-        }),
-        actions,
-        changes,
-        warnings,
-        evidence: {
-            catalogDigests: options.targets.map((target) => ({
-                sourceId: target.sourceId,
-                digest: removedCleanupDigest({
-                    sourceIdentity: target.sourceIdentity,
-                    logicalIdentity: target.logicalIdentity,
-                    snapshotDigest: target.snapshotDigest,
-                }),
-            })),
-            intentDigests: ['user', 'project'].map((scope) => ({
-                scope,
-                digest: calculatePluginIntentDigest(options.intents[scope].before),
-            })),
-            configDigests: options.targets.flatMap((target) => target.configTargets.map((config) => ({
-                pluginId: target.pluginId,
-                scope: config.scope,
-                digest: config.fingerprint,
-            }))),
-            targetOwnerFingerprints: options.targets.flatMap((target) => target.evidence.map((evidence) => ({
-                pluginId: target.pluginId,
-                platform: evidence.platform,
-                scope: evidence.scope,
-                fingerprint: evidence.targetFingerprint,
-            }))),
-        },
-    });
-}
-function combineCleanupOperationPlans(plans) {
-    return createOperationPlan({
-        intentChanges: plans.flatMap((plan) => plan.intentChanges),
-        actions: plans.flatMap((plan) => plan.actions),
-        changes: plans.flatMap((plan) => plan.changes),
-        warnings: plans.flatMap((plan) => plan.warnings),
-        evidence: {
-            catalogDigests: plans.flatMap((plan) => plan.evidence.catalogDigests),
-            intentDigests: plans.flatMap((plan) => plan.evidence.intentDigests),
-            configDigests: plans.flatMap((plan) => plan.evidence.configDigests),
-            targetOwnerFingerprints: plans.flatMap((plan) => plan.evidence.targetOwnerFingerprints),
-        },
+export async function executeRemovedPluginOutputCleanup(options) {
+    const selected = options.selectedTargets.filter((target) => target.pluginId === options.target.pluginId && target.scope === options.context.scope);
+    const retainedPackages = await discoverRetainedManagedCommandPackages({
+        selectors: [{ sourceId: options.target.sourceId, pluginName: options.target.pluginName }],
+        scope: options.context.scope,
+        cwd: options.context.executionCwd,
+        env: options.context.env,
     });
-}
-async function unavailableRemovedCleanupWarnings(options) {
-    const warnings = [];
-    for (const pluginId of options.pluginIds) {
-        const parsed = parsePluginId(pluginId);
-        if (!parsed.sourceId)
-            continue;
-        try {
-            await resolveActiveCatalogGeneration({ sourceId: parsed.sourceId, env: options.env });
-            continue;
-        }
-        catch {
-            // Only a healthy Active generation can prove that a plugin entry was deleted.
-        }
-        let hasConfig = false;
-        for (const scope of ['user', 'project']) {
-            try {
-                hasConfig ||= (await inspectPluginConfigResetTarget({
-                    sourceId: parsed.sourceId,
-                    pluginName: parsed.pluginName,
-                    scope,
-                    cwd: options.cwd,
-                    env: options.env,
-                })).exists;
-            }
-            catch {
-                hasConfig = true;
+    const retainedActions = retainedPackages.map((entry) => ({
+        ...entry, kind: 'retainManagedCommandPackage', pluginId: options.target.pluginId,
+        scope: entry.producer.scope,
+    }));
+    const withRetainedPackages = (result, operationPlan = createOfflineCleanupOperationPlan([], undefined, [], retainedActions)) => {
+        result.operationPlan = operationPlan;
+        const commandResults = [...new Map([
+                ...retainedPackages.map(retainedManagedCommandPackageResult), ...(result.commandResults ?? []),
+            ].map((entry) => [JSON.stringify(entry.producer), entry])).values()];
+        if (commandResults.length > 0) {
+            result.commandResults = commandResults;
+            if (result.overallState === 'succeeded' && commandResults.some((entry) => entry.state !== 'completed')) {
+                result.overallState = 'partial';
             }
         }
-        if (!hasConfig && !options.inventory.references.some((reference) => reference.sourceId === parsed.sourceId && reference.pluginName === parsed.pluginName)) {
-            continue;
-        }
-        warnings.push(`removedPluginCleanupNotPerformed: ${pluginId} has no healthy local Active source, so whole-plugin cleanup was not performed and saved settings may remain. Restore the source, run aw catalog source sync ${parsed.sourceId}, then retry ordinary cleanup.`);
-    }
-    return warnings;
-}
-async function executeRemovedPluginCleanup(options) {
-    const results = [];
-    const warnings = [...options.operationPlan.warnings];
-    const targetIdentity = (target, scope = 'user') => ({
-        pluginId: target.pluginId,
-        pluginName: target.pluginName,
-        sourceId: target.sourceId,
-        sourceIdentity: target.sourceIdentity,
-        pluginVersion: '0.0.0',
-        platform: 'codex',
-        scope,
-        cwd: options.cwd,
+        return result;
+    };
+    if (selected.length === 0)
+        return withRetainedPackages(mergeRebuildCommandResults([]));
+    const inventoryReader = options.runtime?.inventoryCatalogSourceReferences
+        ?? inventoryCatalogSourceReferences;
+    const inventory = await inventoryReader({
+        cwd: options.context.executionCwd,
+        env: options.context.env,
+        scope: options.context.scope,
+        includeProjectAgentSkills: true,
     });
-    let intentChanged = false;
-    for (const scope of ['user', 'project']) {
-        if (calculatePluginIntentDigest(options.intents[scope].before)
-            === calculatePluginIntentDigest(options.intents[scope].after))
-            continue;
-        try {
-            await (options.runtime?.writePluginIntentState ?? writePluginIntentState)({
-                scope, cwd: options.cwd, env: options.env,
-            }, options.intents[scope].after);
-            intentChanged = true;
-            for (const target of options.targets) {
-                if (!options.intents[scope].before.roots.some((root) => root.pluginId === target.pluginId)
-                    && !options.intents[scope].before.dependencyScopeOverrides.some((override) => override.pluginId === target.pluginId))
-                    continue;
-                const result = cleanupIntentResult({
-                    pluginId: target.pluginId,
-                    pluginName: target.pluginName,
-                    sourceId: target.sourceId,
-                    sourceIdentity: target.sourceIdentity,
-                    platform: 'codex',
-                    scope,
-                });
-                result.removed.push(`pluginIntent:${scope}`);
-                results.push(result);
-            }
-        }
-        catch (error) {
-            const message = `removedPluginIntentWriteFailed: ${scope}: ${error instanceof Error ? error.message : String(error)}. Retry cleanup.`;
-            results.push(...options.targets.map((target) => failedResult('cleanup', targetIdentity(target, scope), message)));
-            return {
-                platforms: ['codex', 'claude'],
-                plugins: [],
-                warnings: [...warnings, message],
-                rebuildResults: results,
-                targetResults: results.map(toRemovedCleanupTargetResult),
-                overallState: intentChanged ? 'partial' : 'failed',
-                receiptTargets: results.map((result) => result.target),
-                removedPluginCleanupIds: options.targets.map((target) => target.pluginId),
-                operationPlan: options.operationPlan,
-            };
-        }
-    }
-    let codexManager = options.runtime?.codexManager;
-    if (!codexManager && options.targets.some((target) => target.nativeState === 'installed')) {
-        try {
-            if (options.runtime?.codexManagerResolver) {
-                codexManager = await options.runtime.codexManagerResolver({
-                    cwd: options.cwd,
-                    env: options.env,
-                    runner: options.runtime.nativeCliRunner ?? getDefaultNativeCliRunner(),
-                    authorizer: options.runtime.managedCodexAuthorizer,
-                    operationRequirement: getCodexOperationRequirement('project'),
-                });
-            }
-            else {
-                const consumer = await (options.runtime?.codexOperationConsumerResolver
-                    ?? resolveCodexOperationConsumer)({
-                    cwd: options.cwd,
-                    env: options.env,
-                    runner: options.runtime?.nativeCliRunner ?? getDefaultNativeCliRunner(),
-                    authorizer: options.runtime?.managedCodexAuthorizer,
-                    operationRequirement: getCodexOperationRequirement('project'),
-                    requiresNativeMaterialization: true,
-                });
-                if (consumer.support !== 'observed') {
-                    throw new Error('Codex native removal requires an observed official CLI consumer.');
-                }
-                codexManager = consumer.manager;
-            }
-        }
-        catch (error) {
-            warnings.push(`removedPluginCodexManagerUnavailable: ${error instanceof Error ? error.message : String(error)}`);
-        }
+    const current = await inspectRemovedPluginCleanup({
+        pluginId: options.target.pluginId,
+        scope: options.context.scope,
+        inventory,
+        cwd: options.context.executionCwd,
+        env: options.context.env,
+        nativeCliRunner: options.runtime?.nativeCliRunner ?? getDefaultNativeCliRunner(),
+        codexManager: options.runtime?.codexManager,
+    });
+    if (!current || current.sourceIdentity !== options.target.sourceIdentity
+        || current.projectionFingerprint !== options.target.projectionFingerprint
+        || current.evidence.some((entry) => {
+            const expected = options.target.evidence.find((candidate) => candidate.platform === entry.platform && candidate.scope === entry.scope);
+            return !expected || !offlineCleanupEvidenceMatches(expected, entry);
+        })) {
+        throw new Error('operationReviewStale: removed plugin ownership or output changed before cleanup.');
     }
-    const ownedTargets = options.targets.flatMap((target) => target.evidence
-        .filter((entry) => entry.plan.actions.length > 0)
-        .map((entry) => ({
-        pluginId: target.pluginId,
-        pluginName: target.pluginName,
-        sourceId: target.sourceId,
-        sourceIdentity: target.sourceIdentity,
+    const evidence = current.evidence.filter((entry) => selected.some((target) => target.platform === entry.platform && target.scope === entry.scope));
+    const targets = evidence.map((entry) => ({
+        pluginId: current.pluginId,
+        pluginName: current.pluginName,
+        sourceId: current.sourceId,
+        sourceIdentity: current.sourceIdentity,
         platform: entry.platform,
         scope: entry.scope,
-        ...(target.marketplaceName ? { marketplaceName: target.marketplaceName } : {}),
-        nativeRegistration: entry.plan.actions.some((action) => action.action === 'removeNativeRegistration'),
-    })));
-    if (ownedTargets.length > 0) {
-        const owned = await cleanupOfflineOwnedComponents({
-            targets: ownedTargets,
-            evidence: options.targets.flatMap((target) => target.evidence),
-            inventoryErrors: options.inventory.errors.filter((error) => !error.kind.startsWith('config')),
-            cwd: options.cwd,
-            env: options.env,
+        ...(current.marketplaceName ? { marketplaceName: current.marketplaceName } : {}),
+        nativeRegistration: entry.platform === 'codex',
+    }));
+    const operationPlan = await withNativeToolRemovalImpact(createOfflineCleanupOperationPlan(evidence, undefined, [], retainedActions), options.context.env);
+    if (options.runtime?.expectedPlanFingerprint) {
+        assertOperationPlanFingerprint(options.runtime.expectedPlanFingerprint, operationPlan);
+    }
+    const result = options.runtime?.previewOperationPlan
+        ? await previewOfflineOwnedComponents({
+            targets,
+            evidence,
+            cwd: options.context.executionCwd,
+            env: options.context.env,
+            nativeCliRunner: options.runtime?.nativeCliRunner,
+            codexManagerPreviewer: options.runtime?.codexManagerPreviewer,
+            onPreviewStage: options.runtime?.onPreviewStage,
+        })
+        : await cleanupOfflineOwnedComponents({
+            targets,
+            evidence,
+            inventoryErrors: inventory.errors.filter((error) => !error.kind.startsWith('config')),
+            cwd: options.context.executionCwd,
+            env: options.context.env,
             nativeCliRunner: options.runtime?.nativeCliRunner,
-            ...(codexManager ? { codexManager } : {}),
+            codexManager: options.runtime?.codexManager,
             executeCleanupOperation: options.runtime?.executeCleanupOperation,
-            removeObsoleteInstallationContracts: async () => undefined,
-            removedPluginWhole: true,
-        });
-        results.push(...owned.rebuildResults);
-        warnings.push(...owned.warnings);
-    }
-    for (const target of options.targets) {
-        for (const config of target.configTargets.filter((entry) => entry.kind !== 'absent')) {
-            if (config.kind === 'directory' || config.kind === 'special'
-                || target.blockers.some((blocker) => blocker.startsWith(`${config.scope}: removedPluginConfigIdentityConflict`))) {
-                continue;
-            }
-            try {
-                const receipt = await resetPluginConfigStore({
-                    sourceId: target.sourceId,
-                    sourceIdentity: target.sourceIdentity,
-                    pluginName: target.pluginName,
-                    scope: config.scope,
-                    cwd: options.cwd,
-                    env: options.env,
-                });
-                const result = cleanupIntentResult({
-                    pluginId: target.pluginId,
-                    pluginName: target.pluginName,
-                    sourceId: target.sourceId,
-                    sourceIdentity: target.sourceIdentity,
-                    platform: 'codex',
-                    scope: config.scope,
-                });
-                if (receipt.deleted)
-                    result.removed.push(`${config.scope}/plugin-config/${target.sourceId}/${target.pluginName}`);
-                results.push(result);
-            }
-            catch (error) {
-                results.push(failedResult('cleanup', targetIdentity(target, config.scope), `removedPluginConfigResetFailed: ${error instanceof Error ? error.message : String(error)}. Retry cleanup.`, 'cleanup.owned'));
-            }
-        }
-        let nativeAbsent = target.nativeState === 'absent';
-        if (target.marketplaceName && target.nativeState !== 'unbound') {
-            try {
-                const observed = await inspectCodexPluginRegistrationLive({
-                    pluginId: `${target.pluginName}@${target.marketplaceName}`,
-                    cwd: options.cwd,
-                    env: options.env,
-                    nativeCliRunner: options.runtime?.nativeCliRunner ?? getDefaultNativeCliRunner(),
-                    ...(codexManager ? { manager: codexManager } : {}),
-                    scope: 'both',
-                });
-                nativeAbsent = observed.observation.state === 'observed'
-                    && observed.observation.value === 'absent';
-            }
-            catch {
-                nativeAbsent = false;
-            }
-        }
-        if (!nativeAbsent && (target.nativeState === 'installed' || target.nativeState === 'unknown')) {
-            results.push(failedResult('cleanup', targetIdentity(target), 'removedPluginNativeResidual: official Codex list did not confirm absent. Retry ordinary cleanup.', 'cleanup.owned'));
-        }
-        if (nativeAbsent && target.marketplaceName && target.nativeOwnershipVerified) {
-            for (const activation of target.activationScopes) {
-                try {
-                    await removeCodexPluginActivation({
-                        configPath: resolveCodexPaths(options.cwd, activation.scope, options.env).configTomlPath,
-                        codexPluginId: `${target.pluginName}@${target.marketplaceName}`,
-                    });
-                    const result = cleanupIntentResult({
-                        pluginId: target.pluginId,
-                        pluginName: target.pluginName,
-                        sourceId: target.sourceId,
-                        sourceIdentity: target.sourceIdentity,
-                        platform: 'codex',
-                        scope: activation.scope,
-                    });
-                    result.removed.push(`codexActivation:${activation.scope}`);
-                    results.push(result);
-                }
-                catch (error) {
-                    results.push(failedResult('cleanup', targetIdentity(target, activation.scope), `removedPluginActivationFailed: ${error instanceof Error ? error.message : String(error)}`, 'cleanup.owned'));
-                }
-            }
-        }
-        const claudeNativeFailed = results.some((result) => result.target.pluginId === target.pluginId
-            && result.target.platform === 'claude' && result.status === 'failed');
-        if (target.projectionPresent && target.projectionOwnershipVerified
-            && nativeAbsent && !claudeNativeFailed && !target.claudeNativeCleanupBlocked
-            && (target.nativeOwnershipVerified || target.activationScopes.length === 0)) {
-            try {
-                await removeNamespacedMarketplacePluginProjection({
-                    rootDir: target.marketplaceRoot,
-                    sourceId: target.sourceId,
-                    sourceIdentity: target.sourceIdentity,
-                    pluginName: target.pluginName,
-                    env: options.env,
-                });
-                const result = cleanupIntentResult({
-                    pluginId: target.pluginId,
-                    pluginName: target.pluginName,
-                    sourceId: target.sourceId,
-                    sourceIdentity: target.sourceIdentity,
-                    platform: 'codex',
-                    scope: 'user',
-                });
-                result.removed.push('marketplaceProjection');
-                results.push(result);
-            }
-            catch (error) {
-                results.push(failedResult('cleanup', targetIdentity(target), `removedPluginMarketplaceProjectionFailed: ${error instanceof Error ? error.message : String(error)}`, 'cleanup.owned'));
-            }
-        }
-        for (const blocker of target.blockers) {
-            results.push(failedResult('cleanup', targetIdentity(target), blocker));
-        }
-    }
-    const afterInventory = await options.readInventory({ cwd: options.cwd, env: options.env });
-    for (const target of options.targets) {
-        const after = await inspectRemovedPluginCleanup({
-            pluginId: target.pluginId,
-            inventory: afterInventory,
-            cwd: options.cwd,
-            env: options.env,
-            nativeCliRunner: options.runtime?.nativeCliRunner ?? getDefaultNativeCliRunner(),
-            ...(codexManager ? { codexManager } : {}),
+            preserveLegacyNativeSkills: options.runtime?.preserveLegacyNativeSkills,
+            removeObsoleteInstallationContracts: options.runtime?.removeObsoleteInstallationContracts,
         });
-        if (after && (after.configTargets.some((config) => config.kind !== 'absent')
-            || after.activationScopes.length > 0
-            || after.projectionPresent
-            || after.nativeState === 'installed'
-            || after.nativeState === 'unknown'
-            || after.evidence.some((entry) => entry.plan.actions.length > 0)
-            || after.blockers.length > 0)) {
-            results.push(failedResult('cleanup', targetIdentity(target), 'removedPluginCleanupResidual: some exact targets remain. Retry ordinary cleanup or repair the reported evidence.', 'cleanup.owned'));
-        }
+    withRetainedPackages(result, operationPlan);
+    const residual = [
+        ...current.blockers.filter((blocker) => !blocker.includes('Config')),
+        ...(current.nativeState === 'installed' || current.nativeState === 'unknown'
+            ? ['sharedNativePreserved: Codex package remains available to other scopes.'] : []),
+        ...(current.projectionPresent ? ['sharedMarketplaceProjectionPreserved'] : []),
+    ];
+    if (residual.length > 0) {
+        result.warnings.push(...residual);
+        if (result.overallState === 'succeeded')
+            result.overallState = 'partial';
     }
-    const hasFailure = results.some((result) => result.status === 'failed');
-    const hasSuccess = intentChanged || results.some((result) => result.status === 'succeeded'
-        && result.removed.length > 0);
-    return {
-        platforms: ['codex', 'claude'],
-        plugins: hasFailure ? [] : options.targets.map((target) => target.pluginName),
-        warnings: [...new Set(warnings)],
-        rebuildResults: results,
-        targetResults: results.map(toRemovedCleanupTargetResult),
-        overallState: hasFailure ? hasSuccess ? 'partial' : 'failed' : 'succeeded',
-        receiptTargets: results.map((result) => result.target),
-        removedPluginCleanupIds: options.targets.map((target) => target.pluginId),
-        operationPlan: options.operationPlan,
-    };
+    return result;
 }
 async function runRebuildCommandInSession(options) {
-    const runtimeEnv = options.runtime?.env ?? process.env;
+    const executionInput = options.runtime?.executionInput;
+    if (!executionInput || executionInput.context.scope !== options.commandOptions.scope
+        || executionInput.preserveOtherObservedTargets !== true) {
+        throw new Error('nativeExecutionInputRequired: Native execution requires an explicit matching scope context and complete demand.');
+    }
+    if (executionInput.selectedTargets.length === 0)
+        return mergeRebuildCommandResults([]);
+    if (executionInput.selectedTargets.some((target) => target.scope !== executionInput.context.scope)) {
+        throw new Error('nativeExecutionTargetScopeInvalid: Selected targets must use the execution context scope.');
+    }
+    const requestedPlatforms = selectedPlatforms(options.commandOptions.platform);
+    if (executionInput.selectedTargets.some((target) => !requestedPlatforms.includes(target.platform))) {
+        throw new Error('nativeExecutionTargetPlatformInvalid: Selected targets must use a requested platform.');
+    }
+    const selectedExecutionTarget = (target) => executionInput.selectedTargets.some((selected) => selected.pluginId === target.pluginId && selected.platform === target.platform && selected.scope === target.scope);
+    const runtimeEnv = executionInput.context.env;
     const retainSelectors = options.command === 'cleanup' ? options.pluginNames.map(parsePluginId) : [];
     const primarySourceId = retainSelectors.some((selector) => !selector.sourceId)
-        ? (await readCatalogSourcesConfigSnapshot(runtimeEnv)).config.sources.find((source) => source.primary)?.id
+        ? await readCatalogSourcesConfigSnapshot(runtimeEnv)
+            .then((snapshot) => snapshot.config.sources.find((source) => source.primary)?.id)
+            .catch(() => undefined)
         : undefined;
     const retainedPackages = options.command === 'cleanup'
         ? await discoverRetainedManagedCommandPackages({ selectors: retainSelectors.map((selector) => ({ ...selector, sourceId: selector.sourceId ?? primarySourceId })), all: options.all, scope: options.commandOptions.scope, cwd: options.commandOptions.cwd, env: runtimeEnv })
@@ -2335,6 +1882,7 @@ async function runRebuildCommandInSession(options) {
             const inventory = await readInventory({
                 cwd: options.commandOptions.cwd,
                 env: runtimeEnv,
+                scope: options.commandOptions.scope,
             });
             if (options.command !== 'cleanup'
                 || options.commandOptions.scope !== 'project'
@@ -2369,13 +1917,7 @@ async function runRebuildCommandInSession(options) {
     let requestedPluginNames = options.pluginNames;
     const cleanupForce = options.command === 'cleanup'
         && options.commandOptions.force === true;
-    const cleanupIntentBefore = options.command === 'cleanup'
-        ? await readPluginIntentState({
-            scope: options.commandOptions.scope,
-            cwd: options.commandOptions.cwd,
-            env: runtimeEnv,
-        })
-        : undefined;
+    const cleanupRequirements = options.command === 'cleanup' ? executionInput.requirements : undefined;
     const expectedOfflineCleanup = options.runtime?.expectedOfflineCleanupEvidence;
     let cleanupInventory;
     let cleanupLiveTargets = [];
@@ -2391,7 +1933,7 @@ async function runRebuildCommandInSession(options) {
             references: cleanupInventory.references,
         });
         requestedPluginNames = live.selectors;
-        cleanupLiveTargets = live.targets;
+        cleanupLiveTargets = live.targets.filter(selectedExecutionTarget);
         if (expectedOfflineCleanup
             && expectedOfflineCleanup.forceExclusive !== true
             && expectedOfflineCleanup.plan.actions.length > 0) {
@@ -2456,7 +1998,7 @@ async function runRebuildCommandInSession(options) {
         liveTargets = projectedTargets;
         if (options.command === 'cleanup') {
             cleanupInventory = inventory;
-            cleanupLiveTargets = projectedTargets;
+            cleanupLiveTargets = projectedTargets.filter(selectedExecutionTarget);
         }
         const identities = new Set();
         for (const reference of live) {
@@ -2464,14 +2006,13 @@ async function runRebuildCommandInSession(options) {
             identities.add(pluginId);
         }
         if (options.command === 'cleanup') {
-            for (const root of cleanupIntentBefore.roots)
+            for (const root of cleanupRequirements.roots)
                 identities.add(root.pluginId);
         }
         requestedPluginNames = [...identities];
     }
     let cleanupTargets = [];
     let cleanupUnavailableWarnings = [];
-    let cleanupIntentAfter;
     let cleanupSelectionErrors = [];
     if (options.command === 'cleanup') {
         const primarySourceId = cleanupForce
@@ -2480,7 +2021,7 @@ async function runRebuildCommandInSession(options) {
                 .catch(() => undefined)
             : undefined;
         const intentTargets = cleanupIntentTargets({
-            state: cleanupIntentBefore,
+            state: cleanupRequirements,
             selectors: options.pluginNames,
             platforms: selectedPlatforms(options.commandOptions.platform),
             scope: options.commandOptions.scope,
@@ -2507,17 +2048,11 @@ async function runRebuildCommandInSession(options) {
         cleanupTargets = [...new Map([...damagedTargets, ...intentTargets, ...cleanupLiveTargets].map((target) => [
                 `${target.pluginId}\0${target.platform}\0${target.scope}`,
                 target,
-            ])).values()];
+            ])).values()].filter(selectedExecutionTarget);
         requestedPluginNames = [...new Set([
                 ...requestedPluginNames,
                 ...cleanupTargets.map((target) => target.pluginId),
             ])];
-        cleanupIntentAfter = deriveDesiredIntentState({
-            command: 'cleanup',
-            state: cleanupIntentBefore,
-            selectedRoots: cleanupSelectedRoots(cleanupTargets),
-            plan: { requestedPluginIds: [], resolvedPluginIds: [], dependencyEdges: [], targets: [], scopeOverrides: [] },
-        });
         const filtered = omitSelectedPluginConfigErrors(cleanupInventory, cleanupTargets);
         cleanupInventory = filtered.inventory;
         malformedSelectedConfigPreserved ||= filtered.omitted;
@@ -2532,171 +2067,18 @@ async function runRebuildCommandInSession(options) {
     const selectors = requestedPluginNames.map(parsePluginId);
     const sourceIds = planPluginSelectorSourceIds(selectors);
     if (options.all && selectors.length === 0 && options.command !== 'cleanup') {
-        if (legacyLiveTargets.length > 0) {
-            throw namespacedPreflightError(`legacyStateUnsupported: legacy live runtime state exists for ${legacyLiveTargets.map((target) => `${target.pluginName}:${target.platform}/${target.scope}`).join(', ')}.`, [], legacyLiveTargets);
-        }
-        return mergeRebuildCommandResults([]);
-    }
-    if (options.command === 'cleanup') {
-        if (!cleanupForce) {
-            const exactIds = [...new Set(requestedPluginNames.flatMap((selector) => {
-                    const parsed = parsePluginId(selector);
-                    return parsed.sourceId ? [formatPluginId(parsed)] : [];
-                }))];
-            const projectSkills = await selectedProjectCodexSkillReferences({
-                cwd: options.commandOptions.cwd,
-            });
-            const fullInventory = {
-                ...cleanupInventory,
-                references: [...new Map([...cleanupInventory.references, ...projectSkills].map((reference) => [[
-                            reference.kind,
-                            reference.location,
-                            reference.sourceId ?? '',
-                            reference.pluginName ?? '',
-                            reference.platform ?? '',
-                            reference.scope ?? '',
-                        ].join('\0'), reference])).values()],
-            };
-            const removed = (await Promise.all(exactIds.map((pluginId) => inspectRemovedPluginCleanup({
-                pluginId,
-                inventory: fullInventory,
-                cwd: options.commandOptions.cwd,
-                env: runtimeEnv,
-                nativeCliRunner: options.runtime?.nativeCliRunner ?? getDefaultNativeCliRunner(),
-                codexManager: options.runtime?.codexManager,
-            })))).filter((target) => target !== null);
-            cleanupUnavailableWarnings = await unavailableRemovedCleanupWarnings({
-                pluginIds: exactIds.filter((pluginId) => !removed.some((target) => target.pluginId === pluginId)),
-                inventory: fullInventory,
-                cwd: options.commandOptions.cwd,
-                env: runtimeEnv,
-            });
-            if (removed.length > 0) {
-                const removedIds = new Set(removed.map((target) => target.pluginId));
-                const intents = {
-                    user: {
-                        before: await readPluginIntentState({
-                            scope: 'user', cwd: options.commandOptions.cwd, env: runtimeEnv,
-                        }),
-                        after: createEmptyPluginIntentState(),
-                    },
-                    project: {
-                        before: await readPluginIntentState({
-                            scope: 'project', cwd: options.commandOptions.cwd, env: runtimeEnv,
-                        }),
-                        after: createEmptyPluginIntentState(),
-                    },
-                };
-                intents.user.after = removeRemovedPluginIntent(intents.user.before, removedIds);
-                intents.project.after = removeRemovedPluginIntent(intents.project.before, removedIds);
-                const removedPlan = await withNativeToolRemovalImpact(createRemovedPluginCleanupOperationPlan({
-                    targets: removed,
-                    intents,
-                    cwd: options.commandOptions.cwd,
-                    env: runtimeEnv,
-                }), runtimeEnv);
-                const remaining = exactIds.filter((pluginId) => !removedIds.has(pluginId));
-                const normalOptions = {
-                    ...options,
-                    all: false,
-                    pluginNames: remaining,
-                    runtime: {
-                        ...options.runtime,
-                        expectedPlanFingerprint: undefined,
-                        expectedOfflineCleanupEvidence: undefined,
-                    },
-                };
-                const normalPreview = remaining.length > 0
-                    ? await runRebuildCommandInSession({
-                        ...normalOptions,
-                        runtime: { ...normalOptions.runtime, previewOperationPlan: true },
-                    })
-                    : undefined;
-                const operationPlan = normalPreview?.operationPlan
-                    ? combineCleanupOperationPlans([removedPlan, normalPreview.operationPlan])
-                    : removedPlan;
-                if (options.runtime?.expectedPlanFingerprint) {
-                    assertOperationPlanFingerprint(options.runtime.expectedPlanFingerprint, operationPlan);
-                }
-                if (options.runtime?.previewOperationPlan) {
-                    const preview = normalPreview ?? mergeRebuildCommandResults([]);
-                    preview.removedPluginCleanupIds = [...removedIds];
-                    preview.operationPlan = operationPlan;
-                    preview.warnings = [...new Set([...preview.warnings, ...removedPlan.warnings])];
-                    return preview;
-                }
-                assertNativeToolChangeAuthorization(operationPlan, options);
-                if (options.commandOptions.yes !== true
-                    && !(options.runtime?.preApplyConfirmed === true
-                        && options.runtime.expectedPlanFingerprint !== undefined)) {
-                    throw new Error('removedPluginCleanupAuthorizationRequired: deleted-plugin cleanup covers Codex and Claude in user and current-project scopes, removes saved settings and the shared Codex native package, and may affect other projects. Use --yes or accept the full Review.');
-                }
-                const removedResult = await executeRemovedPluginCleanup({
-                    targets: removed,
-                    intents,
-                    inventory: fullInventory,
-                    cwd: options.commandOptions.cwd,
-                    env: runtimeEnv,
-                    runtime: options.runtime,
-                    readInventory,
-                    operationPlan: removedPlan,
-                });
-                let normalResult;
-                if (remaining.length > 0) {
-                    try {
-                        for (const scope of ['user', 'project']) {
-                            const actual = await readPluginIntentState({ scope, cwd: options.commandOptions.cwd, env: runtimeEnv });
-                            if (calculatePluginIntentDigest(actual) !== calculatePluginIntentDigest(intents[scope].after)) {
-                                throw new Error('operationPlanStale: installation intent changed beyond the reviewed deleted-plugin cleanup.');
-                            }
-                        }
-                        const currentNormalPreview = await runRebuildCommandInSession({
-                            ...normalOptions,
-                            runtime: { ...normalOptions.runtime, previewOperationPlan: true },
-                        });
-                        if (!normalPreview?.operationPlan || !currentNormalPreview.operationPlan
-                            || createBatchIntentCompatiblePlanFingerprint(normalPreview.operationPlan)
-                                !== createBatchIntentCompatiblePlanFingerprint(currentNormalPreview.operationPlan)) {
-                            throw new Error('operationPlanStale: the remaining cleanup actions changed after the reviewed deleted-plugin cleanup.');
-                        }
-                        normalResult = await runRebuildCommandInSession({
-                            ...normalOptions,
-                            runtime: { ...normalOptions.runtime, expectedPlanFingerprint: currentNormalPreview.operationPlan.planFingerprint },
-                        });
-                    }
-                    catch (error) {
-                        const message = error instanceof Error ? error.message : String(error);
-                        const failures = (normalPreview?.receiptTargets ?? []).map((target) => failedResult('cleanup', {
-                            ...target, cwd: options.commandOptions.cwd, pluginVersion: 'unavailable',
-                        }, message));
-                        normalResult = { ...mergeRebuildCommandResults([]), overallState: 'failed', warnings: [message],
-                            platforms: normalPreview?.platforms ?? [], rebuildResults: failures,
-                            targetResults: failures.map(toTargetResult), receiptTargets: failures.map((failure) => failure.target) };
-                    }
-                }
-                const combined = normalResult
-                    ? mergeRebuildCommandResults([removedResult, normalResult])
-                    : removedResult;
-                combined.operationPlan = operationPlan;
-                combined.removedPluginCleanupIds = [...removedIds];
-                combined.warnings = [...new Set([...combined.warnings, ...operationPlan.warnings])];
-                combined.overallState = [removedResult, normalResult].filter(Boolean).every((result) => result?.overallState === 'succeeded')
-                    ? 'succeeded'
-                    : [removedResult, normalResult].filter(Boolean).some((result) => result?.overallState === 'succeeded' || result?.overallState === 'partial')
-                        ? 'partial' : 'failed';
-                return combined;
-            }
+        if (legacyLiveTargets.length > 0) {
+            throw namespacedPreflightError(`legacyStateUnsupported: legacy live runtime state exists for ${legacyLiveTargets.map((target) => `${target.pluginName}:${target.platform}/${target.scope}`).join(', ')}.`, [], legacyLiveTargets);
         }
+        return mergeRebuildCommandResults([]);
+    }
+    if (options.command === 'cleanup') {
         if (!cleanupForce
             && cleanupTargets.length === 0
             && cleanupSelectionErrors.length === 0
             && legacyLiveTargets.length === 0) {
             const result = mergeRebuildCommandResults([]);
-            const operationPlan = await withNativeToolRemovalImpact(createOfflineCleanupOperationPlan([], {
-                scope: options.commandOptions.scope,
-                before: cleanupIntentBefore,
-                after: cleanupIntentAfter,
-            }, [...cleanupInventoryWarnings(cleanupInventory, []), ...cleanupUnavailableWarnings], retainedPackageActions), runtimeEnv);
+            const operationPlan = await withNativeToolRemovalImpact(createOfflineCleanupOperationPlan([], { scope: options.commandOptions.scope, view: cleanupRequirements }, [...cleanupInventoryWarnings(cleanupInventory, []), ...cleanupUnavailableWarnings], retainedPackageActions), runtimeEnv);
             if (options.runtime?.expectedPlanFingerprint) {
                 assertOperationPlanFingerprint(options.runtime.expectedPlanFingerprint, operationPlan);
             }
@@ -2744,6 +2126,8 @@ async function runRebuildCommandInSession(options) {
                 damagedOnly: cleanupLiveTargets.length > 0,
             })));
             const forcePlan = await mergeForceCleanupPlans(livePlan, ...supplementAttempts.flatMap((attempt) => attempt.status === 'fulfilled' ? [attempt.value] : []));
+            forcePlan.targets = forcePlan.targets.filter((target) => selectedExecutionTarget(target.identity));
+            forcePlan.evidence = forcePlan.evidence.filter(selectedExecutionTarget);
             const forceCleanupTargets = [...new Map([
                     ...cleanupTargets,
                     ...forcePlan.targets.map((target) => ({
@@ -2786,11 +2170,7 @@ async function runRebuildCommandInSession(options) {
                 && candidate.platform === target.platform
                 && candidate.scope === target.scope)
                 ?? intentOnlyOfflineCleanupEvidence(target));
-            const operationPlan = await withNativeToolRemovalImpact(createOfflineCleanupOperationPlan(forceEvidence, {
-                scope: options.commandOptions.scope,
-                before: cleanupIntentBefore,
-                after: cleanupIntentAfter,
-            }, cleanupInventoryWarnings(cleanupInventory, forceCleanupTargets), retainedPackageActions), runtimeEnv);
+            const operationPlan = await withNativeToolRemovalImpact(createOfflineCleanupOperationPlan(forceEvidence, { scope: options.commandOptions.scope, view: cleanupRequirements }, cleanupInventoryWarnings(cleanupInventory, forceCleanupTargets), retainedPackageActions), runtimeEnv);
             if (options.runtime?.expectedPlanFingerprint) {
                 assertOperationPlanFingerprint(options.runtime.expectedPlanFingerprint, operationPlan);
             }
@@ -2807,14 +2187,6 @@ async function runRebuildCommandInSession(options) {
                 };
             }
             assertNativeToolChangeAuthorization(operationPlan, options);
-            if (calculatePluginIntentDigest(cleanupIntentBefore)
-                !== calculatePluginIntentDigest(cleanupIntentAfter)) {
-                await (options.runtime?.writePluginIntentState ?? writePluginIntentState)({
-                    scope: options.commandOptions.scope,
-                    cwd: options.commandOptions.cwd,
-                    env: runtimeEnv,
-                }, cleanupIntentAfter);
-            }
             const forceResults = await Promise.all(forcePlan.targets.map(async (target) => {
                 const integration = createRebuildIntegration({
                     context: {
@@ -2824,7 +2196,16 @@ async function runRebuildCommandInSession(options) {
                         debugLogger: options.runtime?.debugLogger ?? createNoopDebugLogger(),
                     },
                 });
-                const { finalizeCleanup: _finalizeCleanup, ...pathOnlyDriver } = integration.driver;
+                const { finalizeCleanup: _finalizeCleanup, ...driver } = integration.driver;
+                const pathOnlyDriver = {
+                    ...driver,
+                    beforeCleanupMutation: async (component) => {
+                        await driver.beforeCleanupMutation?.(component);
+                        await removeForceCleanupCodexRoleRegistration({
+                            component, cwd: options.commandOptions.cwd, env: runtimeEnv,
+                        });
+                    },
+                };
                 const result = await (options.runtime?.executeCleanupOperation ?? executeRebuildOperation)({
                     command: 'cleanup', target, driver: pathOnlyDriver,
                 });
@@ -2880,9 +2261,8 @@ async function runRebuildCommandInSession(options) {
                 targetResults: allResults.map(toTargetResult),
                 overallState: allResults.every((entry) => entry.status === 'succeeded')
                     ? 'succeeded'
-                    : operationPlan.intentChanges.length > 0
-                        || allResults.some((entry) => entry.status === 'succeeded'
-                            || entry.actions.some((action) => action.status === 'succeeded'))
+                    : allResults.some((entry) => entry.status === 'succeeded'
+                        || entry.actions.some((action) => action.status === 'succeeded'))
                         ? 'partial' : 'failed',
                 receiptTargets: allResults.map((entry) => entry.target),
                 offlineCleanupPlans: forceEvidence,
@@ -2891,11 +2271,7 @@ async function runRebuildCommandInSession(options) {
         }
         if (cleanupTargets.length === 0) {
             const result = mergeRebuildCommandResults([]);
-            const operationPlan = await withNativeToolRemovalImpact(createOfflineCleanupOperationPlan([], {
-                scope: options.commandOptions.scope,
-                before: cleanupIntentBefore,
-                after: cleanupIntentAfter,
-            }, [...cleanupInventoryWarnings(cleanupInventory, []), ...cleanupUnavailableWarnings], retainedPackageActions), runtimeEnv);
+            const operationPlan = await withNativeToolRemovalImpact(createOfflineCleanupOperationPlan([], { scope: options.commandOptions.scope, view: cleanupRequirements }, [...cleanupInventoryWarnings(cleanupInventory, []), ...cleanupUnavailableWarnings], retainedPackageActions), runtimeEnv);
             if (options.runtime?.expectedPlanFingerprint) {
                 assertOperationPlanFingerprint(options.runtime.expectedPlanFingerprint, operationPlan);
             }
@@ -2924,7 +2300,9 @@ async function runRebuildCommandInSession(options) {
                     sourceIdentity: target.sourceIdentity,
                     platform: target.platform,
                     scope: target.scope,
-                    inventory: cleanupInventory,
+                    inventory: options.runtime?.preserveLegacyNativeSkills
+                        ? { ...cleanupInventory, references: cleanupInventory.references.filter((reference) => path.basename(reference.location) !== SKILL_OWNER_MARKER) }
+                        : cleanupInventory,
                 });
                 return value ? [value] : [];
             });
@@ -2932,11 +2310,7 @@ async function runRebuildCommandInSession(options) {
             && candidate.platform === target.platform
             && candidate.scope === target.scope)
             ?? intentOnlyOfflineCleanupEvidence(target));
-        const operationPlan = await withNativeToolRemovalImpact(createOfflineCleanupOperationPlan(evidence, {
-            scope: options.commandOptions.scope,
-            before: cleanupIntentBefore,
-            after: cleanupIntentAfter,
-        }, [...cleanupInventoryWarnings(cleanupInventory, cleanupTargets), ...cleanupUnavailableWarnings], retainedPackageActions), runtimeEnv);
+        const operationPlan = await withNativeToolRemovalImpact(createOfflineCleanupOperationPlan(evidence, { scope: options.commandOptions.scope, view: cleanupRequirements }, [...cleanupInventoryWarnings(cleanupInventory, cleanupTargets), ...cleanupUnavailableWarnings], retainedPackageActions), runtimeEnv);
         if (options.runtime?.expectedPlanFingerprint) {
             assertOperationPlanFingerprint(options.runtime.expectedPlanFingerprint, operationPlan);
         }
@@ -2952,14 +2326,6 @@ async function runRebuildCommandInSession(options) {
             return previewResult;
         }
         assertNativeToolChangeAuthorization(operationPlan, options);
-        if (calculatePluginIntentDigest(cleanupIntentBefore)
-            !== calculatePluginIntentDigest(cleanupIntentAfter)) {
-            await (options.runtime?.writePluginIntentState ?? writePluginIntentState)({
-                scope: options.commandOptions.scope,
-                cwd: options.commandOptions.cwd,
-                env: runtimeEnv,
-            }, cleanupIntentAfter);
-        }
         const cleanupResult = await cleanupOfflineOwnedComponents({
             targets: cleanupLiveTargets,
             evidence,
@@ -2970,6 +2336,7 @@ async function runRebuildCommandInSession(options) {
             nativeCliRunner: options.runtime?.nativeCliRunner,
             codexManager: options.runtime?.codexManager,
             executeCleanupOperation: options.runtime?.executeCleanupOperation,
+            preserveLegacyNativeSkills: options.runtime?.preserveLegacyNativeSkills,
         });
         const liveKeys = new Set(cleanupLiveTargets.map((target) => `${target.pluginId}\0${target.platform}\0${target.scope}`));
         const intentOnlyResults = cleanupTargets
@@ -2989,11 +2356,8 @@ async function runRebuildCommandInSession(options) {
         cleanupResult.platforms = [...new Set([...cleanupResult.platforms, ...intentOnlyResults.map((result) => result.target.platform)])];
         cleanupResult.plugins = [...new Set([...cleanupResult.plugins, ...intentOnlyResults.map((result) => result.target.pluginName)])];
         cleanupResult.operationPlan = operationPlan;
-        if (cleanupResult.overallState === 'failed'
-            && operationPlan.intentChanges.length > 0)
-            cleanupResult.overallState = 'partial';
-        else if (intentOnlyResults.some((result) => result.status === 'failed')) {
-            cleanupResult.overallState = operationPlan.intentChanges.length > 0 ? 'partial' : 'failed';
+        if (intentOnlyResults.some((result) => result.status === 'failed')) {
+            cleanupResult.overallState = 'failed';
         }
         if (malformedSelectedConfigPreserved) {
             cleanupResult.warnings.push(MALFORMED_CONFIG_PRESERVED_WARNING);
@@ -3046,6 +2410,10 @@ async function runRebuildCommandInSession(options) {
                     }
                     return matches[0];
                 });
+                const requestedIds = new Set(selectedEntries.map((entry) => entry.pluginId));
+                if (executionInput.selectedTargets.some((target) => !requestedIds.has(target.pluginId))) {
+                    throw new Error('nativeExecutionTargetOutsideRequest: selected target must match a requested plugin.');
+                }
                 if (options.command === 'uninstall' || (options.command === 'cleanup' && options.all)) {
                     await measureCommandPerformanceStage(options.runtime, 'catalog.validation', async () => {
                         const selectedSources = new Map(selectedEntries.map((candidate) => [
@@ -3057,17 +2425,9 @@ async function runRebuildCommandInSession(options) {
                         }
                     });
                 }
-                const intentCatalogEntries = availableEntries.map((candidate) => ({
-                    pluginId: candidate.pluginId,
-                    dependencyPluginIds: candidate.entry.dependencies.map((dependency) => formatPluginId({
-                        sourceId: candidate.source.sourceId,
-                        pluginName: dependency,
-                    })),
-                }));
                 const dependencyEnabled = options.command === 'install'
                     || options.command === 'sync'
                     || options.command === 'reinstall';
-                const intentCommand = options.taskTargets ? 'install' : options.command;
                 const entryClosure = (roots) => {
                     const result = [];
                     const seen = new Set();
@@ -3138,9 +2498,20 @@ async function runRebuildCommandInSession(options) {
                 }));
                 const selected = selectedEntries.map((entry) => available.find((candidate) => candidate.pluginId === entry.pluginId));
                 const selectedIds = new Set(selected.map((entry) => entry.pluginId));
-                const preserveOtherCodexScopeRootIds = new Set(selected.flatMap((entry) => analyzeCodexSurface(entry.plugin.manifest).scopeOverlap === 'native-compatible'
-                    ? [entry.pluginId]
-                    : []));
+                const codexDemandRootsFor = (entry) => requirements.roots.filter((root) => {
+                    if (!root.platforms.includes('codex'))
+                        return false;
+                    const rootEntry = availableEntries.find((candidate) => candidate.pluginId === root.pluginId);
+                    if (!rootEntry || rootEntry.source.sourceId !== entry.source.sourceId)
+                        return false;
+                    try {
+                        return entryClosure([rootEntry]).some((candidate) => candidate.pluginId === entry.pluginId);
+                    }
+                    catch {
+                        return rootEntry.pluginId === entry.pluginId;
+                    }
+                });
+                const selectedCodexRoot = (pluginId) => executionInput.selectedTargets.some((target) => target.pluginId === pluginId && target.platform === 'codex');
                 const resolveClosureEntries = (rootsBySource) => catalog.sources.flatMap((item) => {
                     const source = item.resolution;
                     const roots = rootsBySource
@@ -3157,12 +2528,13 @@ async function runRebuildCommandInSession(options) {
                 });
                 const closureEntriesByPlatform = new Map();
                 if (dependencyEnabled) {
-                    const selectedTaskPlatforms = options.taskTargets
-                        ? [...new Set(options.taskTargets.map((target) => target.platform))]
+                    const selectionTargets = executionInput.selectedTargets;
+                    const selectedTaskPlatforms = selectionTargets
+                        ? [...new Set(selectionTargets.map((target) => target.platform))]
                         : selectedPlatforms(options.commandOptions.platform);
                     for (const platform of selectedTaskPlatforms) {
-                        const platformRoots = options.taskTargets
-                            ? selected.filter((entry) => options.taskTargets.some((target) => target.pluginId === entry.pluginId && target.platform === platform))
+                        const platformRoots = selectionTargets
+                            ? selected.filter((entry) => selectionTargets.some((target) => target.pluginId === entry.pluginId && target.platform === platform))
                             : options.commandOptions.platform === 'both'
                                 ? selected.filter((entry) => supportsPlatform(entry.plugin.manifest, platform))
                                 : selected;
@@ -3174,59 +2546,37 @@ async function runRebuildCommandInSession(options) {
                     : options.command === 'cleanup'
                         ? resolveClosureEntries(selected)
                         : selected;
-                const taskRootsByTarget = new Map();
-                for (const target of options.taskTargets ?? []) {
-                    const key = `${target.pluginId}\0${target.platform}`;
-                    taskRootsByTarget.set(key, [...(taskRootsByTarget.get(key) ?? []), target]);
+                const rawExecutionSelections = executionInput.selectedTargets.flatMap((target) => {
+                    const root = selected.find((entry) => entry.pluginId === target.pluginId);
+                    if (!root)
+                        return [];
+                    return (dependencyEnabled ? resolveClosureEntries([root]) : [root]).map((entry) => ({
+                        entry, platform: target.platform,
+                        ...(entry.pluginId === root.pluginId ? { requestedScope: target.scope } : {}),
+                        requestedMethod: options.taskTargets?.find((candidate) => candidate.pluginId === entry.pluginId
+                            && candidate.platform === target.platform)?.method
+                            ?? options.taskRepairTargets?.find((candidate) => candidate.pluginId === entry.pluginId
+                                && candidate.platform === target.platform)?.method,
+                    }));
+                });
+                const normalizedExecutionSelections = [...new Map(rawExecutionSelections.map((selection) => [[
+                            selection.entry.pluginId,
+                            selection.entry.source.sourceIdentity,
+                            selection.platform,
+                        ].join('\0'), selection])).values()];
+                if (dependencyEnabled) {
+                    const ordered = new Map();
+                    for (const [platform, closure] of closureEntriesByPlatform) {
+                        for (const entry of closure) {
+                            const selection = normalizedExecutionSelections.find((candidate) => candidate.entry.pluginId === entry.pluginId && candidate.platform === platform);
+                            if (selection)
+                                ordered.set(`${entry.pluginId}\0${platform}`, selection);
+                        }
+                    }
+                    normalizedExecutionSelections.splice(0, normalizedExecutionSelections.length, ...ordered.values());
                 }
-                const rawExecutionSelections = options.taskTargets
-                    ? options.taskTargets.flatMap((root) => {
-                        const rootEntry = selected.find((entry) => entry.pluginId === root.pluginId);
-                        return resolveClosureEntries([rootEntry]).flatMap((entry) => {
-                            const exactRoots = taskRootsByTarget.get(`${entry.pluginId}\0${root.platform}`) ?? [];
-                            if (exactRoots.length > 0) {
-                                return exactRoots.map((exactRoot) => ({
-                                    entry,
-                                    platform: root.platform,
-                                    requestedScope: exactRoot.scope,
-                                    requestedMethod: exactRoot.method,
-                                }));
-                            }
-                            return [{
-                                    entry,
-                                    platform: root.platform,
-                                    requestedMethod: options.taskRepairTargets?.find((target) => target.pluginId === entry.pluginId
-                                        && target.platform === root.platform)?.method,
-                                }];
-                        });
-                    })
-                    : options.all
-                        ? liveTargets.flatMap((target) => {
-                            const entry = selected.find((candidate) => candidate.pluginId === target.pluginId);
-                            if (target.sourceIdentity !== 'unavailable'
-                                && entry.source.sourceIdentity !== target.sourceIdentity) {
-                                throw namespacedPreflightError(`sourceChanged: ${target.pluginId} live target has a different source identity.`, liveTargets, legacyLiveTargets);
-                            }
-                            const sourcePlugins = available
-                                .filter((candidate) => candidate.source.sourceId === entry.source.sourceId)
-                                .map((candidate) => candidate.plugin);
-                            return (options.command === 'uninstall'
-                                ? [entry.plugin]
-                                : resolvePluginMetaDependencyClosure(sourcePlugins, [entry.plugin.manifest.name])).map((plugin) => ({
-                                entry: available.find((candidate) => candidate.source.sourceId === entry.source.sourceId
-                                    && candidate.plugin.manifest.name === plugin.manifest.name),
-                                platform: target.platform,
-                            }));
-                        })
-                        : selectedPlatforms(options.commandOptions.platform).flatMap((platform) => (dependencyEnabled ? closureEntriesByPlatform.get(platform) ?? [] : closureEntries)
-                            .flatMap((entry) => options.command !== 'cleanup'
-                            && options.command !== 'uninstall'
-                            && options.commandOptions.platform === 'both'
-                            && !supportsPlatform(entry.plugin.manifest, platform)
-                            ? []
-                            : [{ entry, platform }]));
                 const taskSelectionMethods = new Map();
-                for (const selection of rawExecutionSelections) {
+                for (const selection of normalizedExecutionSelections) {
                     if (!selection.requestedMethod)
                         continue;
                     const key = [
@@ -3240,18 +2590,11 @@ async function runRebuildCommandInSession(options) {
                     }
                     taskSelectionMethods.set(key, selection.requestedMethod);
                 }
-                let executionSelections = [...new Map(rawExecutionSelections.map((selection) => [[
-                            selection.entry.pluginId,
-                            selection.entry.source.sourceIdentity,
-                            selection.platform,
-                            selection.requestedScope ?? '',
-                        ].join('\0'), selection])).values()];
+                let executionSelections = normalizedExecutionSelections;
                 const planTargetFor = (plan, selection) => plan.targets.find((target) => target.pluginId === selection.entry.pluginId
                     && target.platform === selection.platform
-                    && (!options.taskTargets
-                        || (selection.requestedScope === undefined
-                            ? target.relation === 'dependency'
-                            : target.requestedScope === selection.requestedScope)));
+                    && (selection.requestedScope === undefined
+                        || target.requestedScope === selection.requestedScope));
                 const executionKey = (selection, plan) => {
                     const target = planTargetFor(plan, selection);
                     return [
@@ -3340,22 +2683,9 @@ async function runRebuildCommandInSession(options) {
                 if (checked.omitted)
                     stateInventory.errors = checked.inventory.errors;
                 assertWriteInventoryComplete(checked.inventory);
-                const hasCodexSelection = executionSelections.some((selection) => selection.platform === 'codex');
-                const intentBeforeByScope = hasCodexSelection || dependencyEnabled
-                    ? {
-                        user: await readPluginIntentState({
-                            scope: 'user', cwd: options.commandOptions.cwd, env: runtimeEnv,
-                        }),
-                        project: await readPluginIntentState({
-                            scope: 'project', cwd: options.commandOptions.cwd, env: runtimeEnv,
-                        }),
-                    }
-                    : {
-                        user: createEmptyPluginIntentState(),
-                        project: createEmptyPluginIntentState(),
-                    };
-                const commandProjectKey = await resolveCanonicalRepoProjectKey(options.commandOptions.cwd);
-                const codexScopePathsAlias = codexProjectConfigAliasesUserHome(options.commandOptions.cwd, runtimeEnv);
+                const requirements = executionInput.requirements;
+                const commandProjectKey = executionInput.context.projectRoot ?? executionInput.context.executionCwd;
+                const codexScopePathsAlias = options.commandOptions.scope === 'project' && codexProjectConfigAliasesUserHome(options.commandOptions.cwd, runtimeEnv);
                 const selectedLegacy = selectedLegacyLiveReferences(stateInventory.references, new Set(executionSelections.map((selection) => selection.platform)), options.commandOptions.scope);
                 const legacy = options.all
                     ? selectedLegacy
@@ -3431,24 +2761,17 @@ async function runRebuildCommandInSession(options) {
                     return marketplaceName;
                 };
                 const codexObservationScopeByMarketplace = new Map();
-                const projectIntentPluginIds = new Set();
-                for (const root of intentBeforeByScope.project.roots.filter((candidate) => candidate.platforms.includes('codex'))) {
-                    const rootEntry = availableEntries.find((candidate) => candidate.pluginId === root.pluginId);
-                    if (!rootEntry)
-                        continue;
-                    for (const candidate of entryClosure([rootEntry])) {
-                        projectIntentPluginIds.add(candidate.pluginId);
-                    }
-                }
-                const projectCodexConfig = await readCodexConfigFile(resolveCodexPaths(options.commandOptions.cwd, 'project', runtimeEnv).configTomlPath);
+                const projectCodexConfig = options.commandOptions.scope === 'project'
+                    ? await readCodexConfigFile(resolveCodexPaths(options.commandOptions.cwd, 'project', runtimeEnv).configTomlPath)
+                    : undefined;
                 for (const { entry, platform } of executionSelections) {
                     if (platform !== 'codex')
                         continue;
                     const marketplaceName = marketplaceNameFor(entry, platform, options.commandOptions.scope);
                     const codexPluginId = `${entry.plugin.manifest.name}@${marketplaceName}`;
                     const requiredScope = options.commandOptions.scope === 'project'
-                        || projectIntentPluginIds.has(entry.pluginId)
-                        || Object.hasOwn(projectCodexConfig.snapshot.plugins, codexPluginId)
+                        || (projectCodexConfig !== undefined
+                            && Object.hasOwn(projectCodexConfig.snapshot.plugins, codexPluginId))
                         ? 'both'
                         : 'user';
                     if (requiredScope === 'both'
@@ -3457,6 +2780,10 @@ async function runRebuildCommandInSession(options) {
                     }
                 }
                 const executionContext = {
+                    preparedArtifactRenderResults: options.runtime?.preparedArtifactRenderResults,
+                    signal: options.runtime?.signal,
+                    referencePlugins: options.runtime?.referencePlugins,
+                    scriptTimeoutMs: options.commandOptions.scriptTimeoutMs,
                     env: runtimeEnv,
                     nativeCliRunner: options.runtime?.nativeCliRunner ?? getDefaultNativeCliRunner(),
                     codexManager: options.runtime?.codexManager,
@@ -3467,92 +2794,14 @@ async function runRebuildCommandInSession(options) {
                     codexObservationScopeByMarketplace,
                     preApplyExecutionCache: options.runtime?.preApplyExecutionCache,
                     managedCommandProducerCache: options.runtime?.managedCommandProducerCache,
+                    preserveLegacyNativeSkills: options.runtime?.preserveLegacyNativeSkills,
+                    nativeActivationOnlyTargets: options.runtime?.nativeActivationOnlyTargets,
                     commandResults: options.runtime?.commandResults,
                 };
                 const inspection = createRebuildIntegration({
                     context: executionContext,
                     scriptTimeoutMs: options.commandOptions.scriptTimeoutMs,
                 });
-                const selectedRootsForScope = (plan, scope) => [...new Map(plan.targets.flatMap((target) => target.relation === 'requested'
-                        && (target.requestedScope ?? target.resolvedScope) === scope
-                        ? [[target.pluginId, {
-                                    pluginId: target.pluginId,
-                                    platforms: plan.targets.flatMap((candidate) => candidate.relation === 'requested'
-                                        && candidate.pluginId === target.pluginId
-                                        && (candidate.requestedScope ?? candidate.resolvedScope) === scope
-                                        ? [candidate.platform]
-                                        : []),
-                                }]]
-                        : [])).values()];
-                const intentPlanForPreparedRoots = (plan, preparedKeys, scope) => {
-                    const retainedRootKeys = new Set(plan.targets.flatMap((target) => target.relation === 'requested'
-                        && (target.requestedScope ?? target.resolvedScope) === scope
-                        && preparedKeys.has([
-                            target.pluginId,
-                            target.platform,
-                            target.requestedScope ?? target.resolvedScope,
-                        ].join('\0'))
-                        ? [[
-                                target.pluginId,
-                                target.platform,
-                                target.requestedScope ?? target.resolvedScope,
-                            ].join('\0')]
-                        : []));
-                    const closureKeys = new Set(retainedRootKeys);
-                    const pending = [...closureKeys];
-                    while (pending.length > 0) {
-                        const consumerKey = pending.pop();
-                        const consumer = plan.targets.find((target) => [
-                            target.pluginId,
-                            target.platform,
-                            target.requestedScope ?? target.resolvedScope,
-                        ].join('\0') === consumerKey);
-                        if (!consumer)
-                            continue;
-                        for (const dependency of plan.targets.filter((target) => (target.requiredByTargets ?? []).some((requiredBy) => requiredBy.pluginId === consumer.pluginId
-                            && requiredBy.platform === consumer.platform
-                            && requiredBy.scope === (consumer.requestedScope ?? consumer.resolvedScope)))) {
-                            const dependencyKey = [
-                                dependency.pluginId,
-                                dependency.platform,
-                                dependency.requestedScope ?? dependency.resolvedScope,
-                            ].join('\0');
-                            if (closureKeys.has(dependencyKey))
-                                continue;
-                            closureKeys.add(dependencyKey);
-                            pending.push(dependencyKey);
-                        }
-                    }
-                    return {
-                        plan: {
-                            ...plan,
-                            requestedPluginIds: plan.requestedPluginIds.filter((pluginId) => plan.targets.some((target) => target.pluginId === pluginId
-                                && retainedRootKeys.has([target.pluginId, target.platform,
-                                    target.requestedScope ?? target.resolvedScope].join('\0')))),
-                            resolvedPluginIds: plan.resolvedPluginIds.filter((pluginId) => plan.targets.some((target) => target.pluginId === pluginId
-                                && closureKeys.has([target.pluginId, target.platform,
-                                    target.requestedScope ?? target.resolvedScope].join('\0')))),
-                            dependencyEdges: plan.dependencyEdges.filter((edge) => plan.targets.some((target) => target.pluginId === edge.from
-                                && target.platform === edge.platform
-                                && closureKeys.has([target.pluginId, target.platform,
-                                    target.requestedScope ?? target.resolvedScope].join('\0')))
-                                && plan.targets.some((target) => target.pluginId === edge.to
-                                    && target.platform === edge.platform
-                                    && closureKeys.has([target.pluginId, target.platform,
-                                        target.requestedScope ?? target.resolvedScope].join('\0')))),
-                            scopeOverrides: plan.scopeOverrides.filter((override) => plan.targets.some((target) => target.pluginId === override.pluginId
-                                && target.platform === override.platform
-                                && closureKeys.has([target.pluginId, target.platform,
-                                    target.requestedScope ?? target.resolvedScope].join('\0')))),
-                            targets: plan.targets.filter((target) => closureKeys.has([target.pluginId, target.platform,
-                                target.requestedScope ?? target.resolvedScope].join('\0'))),
-                        },
-                        selectedRoots: selectedRootsForScope(plan, scope).flatMap((root) => {
-                            const platforms = root.platforms.filter((platform) => retainedRootKeys.has([root.pluginId, platform, scope].join('\0')));
-                            return platforms.length > 0 ? [{ ...root, platforms }] : [];
-                        }),
-                    };
-                };
                 let plannedCodexRegistrations = new Map();
                 let plannedOwnedTextTargets = new Map();
                 let plannedSkillMarkerTargets = new Map();
@@ -3594,7 +2843,10 @@ async function runRebuildCommandInSession(options) {
                     const blockingTargets = new Map();
                     const actualStates = new Map();
                     const loadPlacementCodexConfigs = async () => {
-                        const [user, project] = await Promise.all(['user', 'project'].map((scope) => readCodexConfigFile(resolveCodexPaths(options.commandOptions.cwd, scope, runtimeEnv).configTomlPath)));
+                        const user = await readCodexConfigFile(resolveCodexPaths(options.commandOptions.cwd, 'user', runtimeEnv).configTomlPath);
+                        const project = options.commandOptions.scope === 'project'
+                            ? await readCodexConfigFile(resolveCodexPaths(options.commandOptions.cwd, 'project', runtimeEnv).configTomlPath)
+                            : { content: '', snapshot: parseCodexConfig('') };
                         return { user, project };
                     };
                     let placementCodexConfigs;
@@ -3604,11 +2856,16 @@ async function runRebuildCommandInSession(options) {
                     };
                     for (const [order, selection] of executionSelections.entries()) {
                         const { entry, platform } = selection;
-                        const relation = options.taskTargets
-                            ? selection.requestedScope !== undefined ? 'requested' : 'dependency'
-                            : selectedIds.has(entry.pluginId) ? 'requested' : 'dependency';
+                        const relation = executionInput.selectedTargets.some((target) => target.pluginId === entry.pluginId && target.platform === platform)
+                            ? 'requested' : 'dependency';
                         const requestedScope = selection.requestedScope ?? options.commandOptions.scope;
                         const requestedMethod = selection.requestedMethod ?? options.command;
+                        const activationOnly = isNativeActivationOnlyTarget(executionContext, {
+                            pluginId: entry.pluginId, platform, scope: requestedScope,
+                        });
+                        const otherScopeRetires = options.runtime?.previewOperationPlan === true
+                            && options.runtime.nativePlannedRetirements?.some((target) => target.pluginId === entry.pluginId && target.platform === platform
+                                && target.scope !== requestedScope) === true;
                         let resolvedScope = requestedScope;
                         const inspectScope = async (scope) => {
                             const marketplaceName = marketplaceNameFor(entry, platform, scope);
@@ -3677,9 +2934,11 @@ async function runRebuildCommandInSession(options) {
                         const otherScope = resolvedScope === 'user' ? 'project' : 'user';
                         const [requestedInspection, otherInspection] = await Promise.all([
                             inspectScope(resolvedScope),
-                            platform === 'codex' && codexScopePathsAlias && resolvedScope === 'user'
-                                ? Promise.resolve({ state: 'absent', components: [], errors: [] })
-                                : inspectScope(otherScope),
+                            options.commandOptions.scope === 'user'
+                                ? Promise.resolve({ state: 'partial', components: [], errors: [] })
+                                : platform === 'codex' && codexScopePathsAlias && resolvedScope === 'user'
+                                    ? Promise.resolve({ state: 'absent', components: [], errors: [] })
+                                    : inspectScope(otherScope),
                         ]);
                         const surface = platform === 'codex'
                             ? analyzeCodexSurface(entry.plugin.manifest)
@@ -3743,9 +3002,6 @@ async function runRebuildCommandInSession(options) {
                             : ['project', 'user'];
                         if (allowedScopes.length === 0)
                             allowedScopes.push(requestedScope);
-                        const hasWiderDesiredRoot = relation === 'dependency'
-                            && requestedScope === 'project'
-                            && intentBeforeByScope.user.roots.some((root) => root.pluginId === entry.pluginId && root.platforms.includes(platform));
                         if (!placementNodes.some((node) => node.pluginId === entry.pluginId && node.platform === platform)) {
                             placementNodes.push({
                                 pluginId: entry.pluginId,
@@ -3754,16 +3010,6 @@ async function runRebuildCommandInSession(options) {
                                 relation,
                                 depth: order,
                                 allowedScopes,
-                                ...(relation === 'dependency'
-                                    && requestedScope === 'project'
-                                    && (otherPlacementState === 'present' || hasWiderDesiredRoot)
-                                    ? {
-                                        preferredScope: 'user',
-                                        ...(otherPlacementState === 'present'
-                                            ? { preferredScopeReason: 'existingWiderTarget' }
-                                            : {}),
-                                    }
-                                    : {}),
                             });
                         }
                         let state = requestedPlacementState;
@@ -3773,13 +3019,20 @@ async function runRebuildCommandInSession(options) {
                                 : requestedMethod === 'reinstall' ? 'reinstall' : 'install'
                             : requestedMethod === 'reinstall' ? 'reinstall' : 'install';
                         let errorCode;
-                        if (dependencyEnabled
+                        if (!dependencyEnabled && platform === 'codex'
+                            && relation === 'requested'
+                            && codexDemandRootsFor(entry).some((root) => !selectedCodexRoot(root.pluginId))) {
+                            action = 'block';
+                            errorCode = 'dependencyStillRequired';
+                        }
+                        else if (dependencyEnabled
                             && platform === 'codex'
                             && relation === 'requested'
+                            && !activationOnly
+                            && !otherScopeRetires
                             && surface?.scopeOverlap === 'aw-owned-conflict'
-                            && options.command !== 'sync'
-                            && !(options.command === 'install'
-                                && intentBeforeByScope[otherScope].roots.some((root) => root.pluginId === entry.pluginId && root.platforms.includes(platform)))
+                            && options.command !== 'cleanup'
+                            && options.command !== 'uninstall'
                             && otherInspection.components.some((component) => component.state !== 'absent'
                                 && component.component.kind !== 'native-plugin'
                                 && !component.component.identity.artifactKey.startsWith('activation-')
@@ -3790,6 +3043,7 @@ async function runRebuildCommandInSession(options) {
                         else if (dependencyEnabled && relation === 'requested'
                             && (requestedInspection.state === 'error'
                                 || (requestedInspection.state === 'partial'
+                                    && !activationOnly
                                     && platform !== 'codex'
                                     && requestedMethod !== 'reinstall'
                                     && options.command !== 'cleanup'))) {
@@ -3797,34 +3051,33 @@ async function runRebuildCommandInSession(options) {
                             errorCode = 'dependencyNotReady';
                         }
                         if (relation === 'dependency'
-                            && requestedPlacementState === 'present'
-                            && otherPlacementState === 'present') {
-                            action = 'block';
-                            state = 'partial';
-                            errorCode = 'dependencyScopeConflict';
-                        }
-                        else if (relation === 'dependency'
-                            && requestedScope === 'project'
-                            && otherInspection.state === 'present') {
-                            resolvedScope = 'user';
-                            state = 'present';
-                        }
-                        else if (relation === 'dependency'
-                            && requestedScope === 'project'
-                            && (otherPlacementState === 'partial' || otherPlacementState === 'error')) {
-                            resolvedScope = 'user';
-                            state = otherPlacementState;
-                            if (otherPlacementState === 'error') {
-                                action = 'block';
-                                errorCode = 'dependencyNotReady';
-                            }
-                        }
-                        else if (relation === 'dependency'
                             && requestedScope === 'user'
                             && otherPlacementState === 'error') {
                             action = 'block';
                             errorCode = 'dependencyNotReady';
                         }
+                        const dependencyScopeOverride = relation === 'dependency'
+                            ? [
+                                ...(options.commandOptions.dependencyScopeOverrides ?? []),
+                                ...(requirements.dependencyScopeOverrides ?? []),
+                            ].find((override) => override.pluginId === entry.pluginId
+                                && (override.platform === undefined || override.platform === platform))
+                            : undefined;
+                        if (dependencyEnabled && relation === 'dependency' && platform === 'codex'
+                            && !activationOnly
+                            && !otherScopeRetires
+                            && surface?.scopeOverlap === 'aw-owned-conflict'
+                            && (dependencyScopeOverride?.scope ?? requestedScope) === requestedScope
+                            && !(requestedScope === 'project'
+                                && dependencyScopeOverride?.scope === 'project'
+                                && otherPlacementState === 'present')
+                            && otherInspection.components.some((component) => component.state !== 'absent'
+                                && component.component.kind !== 'native-plugin'
+                                && !component.component.identity.artifactKey.startsWith('activation-')
+                                && !component.component.identity.artifactKey.startsWith('marketplace-'))) {
+                            action = 'block';
+                            errorCode = 'codexExtensionScopeConflict';
+                        }
                         const resolvedInspection = resolvedScope === requestedScope
                             ? requestedInspection
                             : otherInspection;
@@ -3871,6 +3124,7 @@ async function runRebuildCommandInSession(options) {
                                 manifest: entry.plugin.manifest,
                                 referencePlugins: options.runtime?.referencePlugins,
                                 scope,
+                                platform,
                                 cwd: options.commandOptions.cwd,
                                 env: runtimeEnv,
                             })));
@@ -3913,21 +3167,11 @@ async function runRebuildCommandInSession(options) {
                         const placement = createDependencyPlacementPlan({
                             requestedPluginIds: selected.map((entry) => entry.pluginId),
                             nodes: placementNodes,
-                            roots: options.taskTargets
-                                ? executionSelections.flatMap((selection) => selection.requestedScope
-                                    ? [{
-                                            pluginId: selection.entry.pluginId,
-                                            platform: selection.platform,
-                                            scope: selection.requestedScope,
-                                        }]
-                                    : [])
-                                : placementNodes.flatMap((node) => selectedIds.has(node.pluginId)
-                                    ? [{
-                                            pluginId: node.pluginId,
-                                            platform: node.platform,
-                                            scope: options.commandOptions.scope,
-                                        }]
-                                    : []),
+                            roots: executionInput.selectedTargets.map((target) => ({
+                                pluginId: target.pluginId,
+                                platform: target.platform,
+                                scope: target.scope,
+                            })),
                             dependencyEdges: closureEntries.flatMap((entry) => (entry.plugin.manifest.dependencies ?? []).flatMap((dependency) => {
                                 const dependencyId = formatPluginId({
                                     sourceId: entry.source.sourceId,
@@ -3939,13 +3183,17 @@ async function runRebuildCommandInSession(options) {
                                     : []);
                             })),
                             scopeOverrides: effectiveDependencyScopeOverrides({
-                                state: intentBeforeByScope[options.commandOptions.scope],
+                                state: requirements,
                                 explicit: options.commandOptions
                                     .dependencyScopeOverrides ?? [],
                                 nodes: placementNodes,
                                 ignoredPersistedRootIds: selectedIds,
                             }),
                         });
+                        if (options.commandOptions.scope === 'user'
+                            && placement.targets.some((target) => target.resolvedScope === 'project')) {
+                            throw new Error('nativeUserProjectPlacementUnsupported: User execution cannot use project output.');
+                        }
                         for (const repairTarget of options.taskRepairTargets ?? []) {
                             if (!placement.targets.some((target) => target.pluginId === repairTarget.pluginId
                                 && target.platform === repairTarget.platform)) {
@@ -3970,34 +3218,21 @@ async function runRebuildCommandInSession(options) {
                                     ?? options.taskRepairTargets?.find((candidate) => candidate.pluginId === target.pluginId
                                         && candidate.platform === target.platform)?.method
                                     ?? options.command;
-                                const otherScope = target.resolvedScope === 'user' ? 'project' : 'user';
-                                const otherState = actualStates.get(`${target.pluginId}\0${target.platform}\0${otherScope}`);
-                                const movesExistingPlacement = target.relation === 'dependency'
-                                    && target.resolvedScope === 'user'
-                                    && (state === 'absent' || state === 'partial')
-                                    && (otherState === 'present' || otherState === 'partial');
-                                const preservesWiderPlacement = target.relation === 'dependency'
-                                    && target.resolvedScope === 'project'
-                                    && (state === 'absent' || state === 'partial')
-                                    && (otherState === 'present' || otherState === 'partial');
                                 const action = errorCode
                                     ? 'block'
                                     : options.command === 'cleanup' || options.command === 'uninstall'
                                         ? 'keep'
-                                        : movesExistingPlacement
-                                            ? 'move'
-                                            : target.relation === 'dependency' && state === 'present'
-                                                ? 'keep'
-                                                : state === 'partial' || requestedMethod === 'reinstall'
-                                                    ? 'reinstall'
-                                                    : 'install';
+                                        : target.relation === 'dependency' && state === 'present'
+                                            ? 'keep'
+                                            : state === 'partial' || requestedMethod === 'reinstall'
+                                                ? 'reinstall'
+                                                : 'install';
                                 return {
                                     ...prior,
                                     scope: targetScope,
                                     state,
                                     action,
                                     ...(errorCode ? { errorCode } : {}),
-                                    ...(preservesWiderPlacement ? { preservedScope: 'user' } : {}),
                                 };
                             }),
                         });
@@ -4014,10 +3249,12 @@ async function runRebuildCommandInSession(options) {
                     });
                     return createReconcileOperationPlan({ placement: directPlacement, actual: targets });
                 };
+                const isHealthyWiderDependency = (target) => target.relation === 'dependency'
+                    && target.resolvedScope !== options.commandOptions.scope
+                    && target.action === 'keep';
                 const createCodexPlans = async (plan, activationSupport = 'observed', codexManager) => {
                     const codexTargets = plan.targets.filter((target) => target.platform === 'codex');
                     const currentScope = options.commandOptions.scope;
-                    const otherScope = currentScope === 'user' ? 'project' : 'user';
                     const reconciledCodexTargetsByPlugin = new Map();
                     for (const target of codexTargets) {
                         if (!reconciledCodexTargetsByPlugin.has(target.pluginId)
@@ -4028,99 +3265,22 @@ async function runRebuildCommandInSession(options) {
                     const reconciledCodexTargets = [...reconciledCodexTargetsByPlugin.values()];
                     if (reconciledCodexTargets.length === 0)
                         return [];
-                    const beforeByScope = intentBeforeByScope;
-                    const afterByScope = {
-                        user: beforeByScope.user,
-                        project: beforeByScope.project,
-                    };
-                    for (const scope of ['user', 'project']) {
-                        const selectedRoots = selectedRootsForScope(plan, scope);
-                        afterByScope[scope] = deriveDesiredIntentState({
-                            command: intentCommand,
-                            state: beforeByScope[scope],
-                            selectedRoots,
-                            plan,
-                            catalogEntries: intentCatalogEntries,
-                        });
-                    }
-                    if (options.command === 'install') {
-                        for (const scope of ['user', 'project']) {
-                            const relatedScope = scope === 'user' ? 'project' : 'user';
-                            const protectedRoots = new Set(selectedRootsForScope(plan, relatedScope)
-                                .flatMap((root) => root.platforms.map((platform) => `${root.pluginId}\0${platform}`)));
-                            const selectedRoots = selectedRootsForScope(plan, scope).flatMap((root) => {
-                                const platforms = root.platforms.filter((platform) => !protectedRoots.has(`${root.pluginId}\0${platform}`));
-                                return platforms.length > 0 ? [{ ...root, platforms }] : [];
-                            });
-                            afterByScope[relatedScope] = removeSelectedRootPlatformsFromOtherScope({
-                                state: afterByScope[relatedScope],
-                                selectedRoots,
-                                preserveCodexRootIds: preserveOtherCodexScopeRootIds,
-                            });
-                        }
-                    }
                     const desiredScopesForEntry = (entry) => {
-                        const scopes = new Set();
-                        for (const intentScope of ['user', 'project']) {
-                            const intent = afterByScope[intentScope];
-                            for (const root of intent.roots.filter((candidate) => candidate.platforms.includes('codex'))) {
-                                const rootEntry = availableEntries.find((candidate) => candidate.pluginId === root.pluginId);
-                                if (!rootEntry || rootEntry.source.sourceId !== entry.source.sourceId)
-                                    continue;
-                                let closure;
-                                try {
-                                    closure = entryClosure([rootEntry]);
-                                }
-                                catch {
-                                    closure = [rootEntry];
-                                }
-                                if (!closure.some((candidate) => candidate.pluginId === entry.pluginId)) {
-                                    continue;
-                                }
-                                const currentPlannedScope = selectedRootsForScope(plan, intentScope)
-                                    .some((selectedRoot) => selectedRoot.pluginId === root.pluginId)
-                                    ? plan.targets.find((target) => target.pluginId === entry.pluginId
-                                        && target.platform === 'codex'
-                                        && (target.relation === 'dependency'
-                                            || target.requestedScope === intentScope))?.resolvedScope
-                                    : undefined;
-                                const override = intent.dependencyScopeOverrides.find((candidate) => candidate.pluginId === entry.pluginId && candidate.platform === 'codex');
-                                const reusedUserDependency = intentScope === 'project'
-                                    && root.pluginId !== entry.pluginId
-                                    && scopes.has('user');
-                                scopes.add(currentPlannedScope
-                                    ?? override?.scope
-                                    ?? (reusedUserDependency ? 'user' : intentScope));
-                            }
-                        }
-                        return [...scopes].sort();
-                    };
-                    const intentScopesForEntry = (entry) => {
-                        const scopes = new Set();
-                        for (const intentScope of ['user', 'project']) {
-                            for (const root of afterByScope[intentScope].roots.filter((candidate) => candidate.platforms.includes('codex'))) {
-                                const rootEntry = availableEntries.find((candidate) => candidate.pluginId === root.pluginId);
-                                if (!rootEntry || rootEntry.source.sourceId !== entry.source.sourceId)
-                                    continue;
-                                let closure;
-                                try {
-                                    closure = entryClosure([rootEntry]);
-                                }
-                                catch {
-                                    closure = [rootEntry];
-                                }
-                                if (closure.some((candidate) => candidate.pluginId === entry.pluginId)) {
-                                    scopes.add(intentScope);
-                                }
-                            }
-                        }
-                        return [...scopes].sort();
+                        const roots = codexDemandRootsFor(entry);
+                        const protectedRoot = roots.some((root) => !selectedCodexRoot(root.pluginId));
+                        const selectedForRemoval = selectedCodexRoot(entry.pluginId);
+                        if ((options.command === 'cleanup' || options.command === 'uninstall')
+                            && (roots.length === 0 || (selectedForRemoval && !protectedRoot)))
+                            return [];
+                        const planned = plan.targets.find((target) => target.pluginId === entry.pluginId && target.platform === 'codex');
+                        return [planned?.resolvedScope ?? currentScope];
                     };
-                    const inspectBothScopes = options.command !== 'cleanup' && options.command !== 'uninstall';
-                    const [userConfig, projectConfig] = await Promise.all([
-                        readCodexConfigFile(resolveCodexPaths(options.commandOptions.cwd, 'user', runtimeEnv).configTomlPath),
-                        readCodexConfigFile(resolveCodexPaths(options.commandOptions.cwd, 'project', runtimeEnv).configTomlPath),
-                    ]);
+                    const intentScopesForEntry = (entry) => codexDemandRootsFor(entry).length > 0 ? [currentScope] : [];
+                    const inspectBothScopes = currentScope === 'project';
+                    const userConfig = await readCodexConfigFile(resolveCodexPaths(options.commandOptions.cwd, 'user', runtimeEnv).configTomlPath);
+                    const projectConfig = currentScope === 'project'
+                        ? await readCodexConfigFile(resolveCodexPaths(options.commandOptions.cwd, 'project', runtimeEnv).configTomlPath)
+                        : { content: '', snapshot: parseCodexConfig('') };
                     const catalogClosure = [];
                     const liveEvidence = [];
                     const desiredScopesByPluginId = new Map();
@@ -4142,12 +3302,22 @@ async function runRebuildCommandInSession(options) {
                     }
                     for (const planned of reconciledCodexTargets) {
                         const entry = available.find((candidate) => candidate.pluginId === planned.pluginId);
-                        const surface = analyzeCodexSurface(entry.plugin.manifest);
+                        const activationOnly = isNativeActivationOnlyTarget(executionContext, {
+                            pluginId: entry.pluginId, platform: 'codex', scope: planned.resolvedScope,
+                        });
+                        const declaredSurface = analyzeCodexSurface(entry.plugin.manifest);
+                        const surface = activationOnly ? {
+                            ...declaredSurface,
+                            components: declaredSurface.components.filter((component) => component.owner === 'codex-native'),
+                            extensionKinds: [],
+                            classification: 'native',
+                            deliveryOwner: 'codex-native',
+                            scopeOverlap: 'native-compatible',
+                        } : declaredSurface;
                         const marketplaceName = marketplaceNameFor(entry, 'codex', planned.resolvedScope);
                         const codexPluginId = `${entry.plugin.manifest.name}@${marketplaceName}`;
                         const hasNativeRenderTargets = (entry.plugin.manifest.artifacts?.targets ?? []).some((target) => target.platform === 'codex'
-                            && target.target === 'codex.skill'
-                            && target.delivery?.mode === 'codex-native');
+                            && target.target === 'codex.skill');
                         const staticContentDigest = hasNativeRenderTargets
                             ? undefined
                             : await calculateCodexSharedNativePayloadDigest(entry.plugin.rootDir);
@@ -4190,11 +3360,21 @@ async function runRebuildCommandInSession(options) {
                             resolvedScope: planned.resolvedScope,
                             desiredScopes,
                             intentScopes,
+                            executionScopes: [...new Set(codexTargets.filter((target) => target.pluginId === entry.pluginId).map((target) => target.resolvedScope))],
                             surface,
                         });
                         let sharedNative = sharedInspection?.sharedNative
                             ?? { state: 'unobserved' };
-                        if (options.command === 'sync' && sharedNative.state === 'usable'
+                        if (activationOnly && sharedNative.state !== 'usable') {
+                            if (options.runtime?.previewOperationPlan && sharedNative.state !== 'blocked') {
+                                // The joint request can establish its User provider before this target executes.
+                                sharedNative = { state: 'usable' };
+                            }
+                            else {
+                                throw new Error('nativeActivationOnlyRequiresHealthySharedPackage: the shared Native package must be current and owned before scope activation.');
+                            }
+                        }
+                        if (!activationOnly && options.command === 'sync' && sharedNative.state === 'usable'
                             && await hasPreparedStaticNativeCommandDrift({ plugin: entry.plugin,
                                 cwd: options.commandOptions.cwd, env: runtimeEnv, context: executionContext,
                                 marketplaceRoot: path.join(resolveAwHome(runtimeEnv), 'marketplaces', entry.source.sourceId) })) {
@@ -4282,50 +3462,11 @@ async function runRebuildCommandInSession(options) {
                         scope: currentScope,
                         cwd: options.commandOptions.cwd,
                         operation: options.command,
-                        intentBefore: beforeByScope[currentScope],
-                        intentAfter: afterByScope[currentScope],
-                        relatedIntentBefore: beforeByScope[otherScope],
-                        relatedIntentAfter: afterByScope[otherScope],
                         catalogClosure,
                         liveEvidence,
                         activationSupport,
                     });
-                    const preservedScopes = new Map(plan.targets.flatMap((target) => target.platform === 'codex' && target.preservedScope
-                        ? [[target.pluginId, target.preservedScope]]
-                        : []));
-                    if (preservedScopes.size === 0)
-                        return [codexPlan];
-                    const preservedNativePluginIds = new Set(catalogClosure.flatMap((target) => (options.command === 'install' || options.command === 'reinstall')
-                        && preservedScopes.get(target.pluginId) === 'user'
-                        && liveEvidence.find((evidence) => evidence.codexPluginId === target.codexPluginId)?.activations.user === true
-                        ? [target.pluginId]
-                        : []));
-                    const preservedCodexIds = new Set(codexPlan.sharedNativeActions.flatMap((action) => preservedNativePluginIds.has(action.pluginId) ? [action.codexPluginId] : []));
-                    return [{
-                            ...codexPlan,
-                            desiredTargets: codexPlan.desiredTargets.map((target) => {
-                                const preservedScope = preservedNativePluginIds.has(target.pluginId)
-                                    ? preservedScopes.get(target.pluginId)
-                                    : undefined;
-                                return preservedScope
-                                    ? { ...target, scopes: [...new Set([...target.scopes, preservedScope])].sort() }
-                                    : target;
-                            }),
-                            activationActions: {
-                                user: codexPlan.activationActions.user.map((action) => preservedNativePluginIds.has(action.pluginId)
-                                    ? { ...action, action: 'none', desired: true }
-                                    : action),
-                                project: codexPlan.activationActions.project,
-                            },
-                            extensionRemovals: codexPlan.extensionRemovals.filter((action) => preservedScopes.get(action.pluginId) !== action.scope),
-                            staleActivationRemovals: codexPlan.staleActivationRemovals.filter((action) => !(action.scope === 'user' && preservedCodexIds.has(action.codexPluginId))),
-                            postcheck: {
-                                ...codexPlan.postcheck,
-                                plugins: codexPlan.postcheck.plugins.map((plugin) => preservedNativePluginIds.has(plugin.pluginId)
-                                    ? { ...plugin, expectedUserEnabled: true }
-                                    : plugin),
-                            },
-                        }];
+                    return [codexPlan];
                 };
                 const operationNeedsNativeCli = async (platform, plan) => {
                     for (const { entry, platform: selectedPlatform } of executionSelections) {
@@ -4354,9 +3495,7 @@ async function runRebuildCommandInSession(options) {
                             scope,
                             cwd: options.commandOptions.cwd,
                             command: dependencyEnabled
-                                ? planned.action === 'move'
-                                    ? planned.state === 'partial' ? 'reinstall' : 'install'
-                                    : planned.action
+                                ? planned.action
                                 : options.command,
                             catalog: toCatalogResolution(entry.source),
                             readOnlyInspectionPlan: true,
@@ -4394,27 +3533,19 @@ async function runRebuildCommandInSession(options) {
                         const key = executionKey(selection, plan);
                         if (planned.action === 'block')
                             continue;
-                        const desiredCleanup = platform === 'codex'
-                            && options.command === 'cleanup'
-                            && codexPlans.some((codexPlan) => codexPlan.desiredTargets.some((target) => target.pluginId === entry.pluginId && target.scopes.includes(planned.resolvedScope)));
-                        const reconcileObsolete = platform === 'codex'
-                            && options.command === 'sync'
-                            && codexPlans.some((codexPlan) => codexPlan.desiredTargets.some((target) => target.pluginId === entry.pluginId && !target.scopes.includes(planned.resolvedScope)));
-                        const buildCommand = reconcileObsolete
-                            ? 'cleanup'
-                            : desiredCleanup || planned.action === 'move'
-                                ? planned.state === 'partial' ? 'reinstall' : 'install'
-                                : planned.relation === 'dependency'
-                                    && (planned.action === 'install' || planned.action === 'reinstall')
-                                    ? planned.action
-                                    : selection.requestedMethod ?? options.command;
+                        const buildCommand = planned.relation === 'dependency'
+                            && (planned.action === 'install' || planned.action === 'reinstall')
+                            ? planned.action
+                            : selection.requestedMethod ?? options.command;
                         const plannedNative = platform === 'codex'
                             ? codexPlans.flatMap((codexPlan) => codexPlan.sharedNativeActions).find((action) => action.pluginId === entry.pluginId)
                             : undefined;
                         const codexNativeStillDesired = platform === 'codex'
                             && codexPlans.some((codexPlan) => codexPlan.desiredTargets.some((target) => target.pluginId === entry.pluginId && target.scopes.length > 0));
                         const preserveSharedNative = plannedNative?.action === 'reuse'
-                            || (plannedNative?.action === 'none' && codexNativeStillDesired);
+                            || (plannedNative?.action === 'none' && codexNativeStillDesired)
+                            || options.command === 'cleanup'
+                            || options.command === 'uninstall';
                         const marketplaceName = marketplaceNameFor(entry, platform, planned.resolvedScope);
                         try {
                             const target = await measureCommandPerformanceStage(options.runtime, 'target.build', () => integration.buildTarget({
@@ -4429,6 +3560,10 @@ async function runRebuildCommandInSession(options) {
                                 cwd: options.commandOptions.cwd,
                                 command: buildCommand,
                                 catalog: toCatalogResolution(entry.source),
+                                ...(platform === 'codex'
+                                    && (buildCommand === 'cleanup' || buildCommand === 'uninstall')
+                                    ? { includeNativeCleanupCandidate: false }
+                                    : {}),
                             }));
                             if (plannedNative) {
                                 const writesSharedNative = plannedNative.action === 'install'
@@ -4459,12 +3594,9 @@ async function runRebuildCommandInSession(options) {
                                 target.codexNativeObservationExpectation = preserveSharedNative && hasExtensionMutation
                                     ? (plannedNative.action === 'reuse' ? 'installed' : 'observed')
                                     : undefined;
-                                const removesSharedNative = !writesSharedNative
-                                    && !preserveSharedNative
-                                    && (buildCommand === 'cleanup' || buildCommand === 'uninstall');
                                 target.codexNativeSensitivePreflightRequired = preserveSharedNative
                                     && hasActivationMutation;
-                                if (!writesSharedNative && !removesSharedNative) {
+                                if (!writesSharedNative) {
                                     const isSharedNativeComponent = (component) => component.kind === 'native-plugin'
                                         || (component.kind === 'shared-config'
                                             && component.identity.artifactKey.startsWith('marketplace-'));
@@ -4501,6 +3633,10 @@ async function runRebuildCommandInSession(options) {
                             });
                         }
                         catch (error) {
+                            options.runtime?.signal?.throwIfAborted();
+                            if (error instanceof Error && error.name === 'AbortError'
+                                || readSafeOperationError(error))
+                                throw error;
                             preparedTargetErrors.set(key, error);
                         }
                     }
@@ -4520,15 +3656,15 @@ async function runRebuildCommandInSession(options) {
                             for (const scope of pluginConfigTargetRenderScopes(entry.plugin, {
                                 pluginName: entry.plugin.manifest.name, platform: selection.platform, scope: planned.resolvedScope,
                             }))
-                                configTargets.set(`${entry.pluginId}\0${scope}`, { entry, scope });
+                                configTargets.set(`${entry.pluginId}\0${selection.platform}\0${scope}`, { entry, scope, platform: selection.platform });
                             for (const action of preparedTargets.get(executionKey(selection, plan)).target.operationActions ?? []) {
                                 if (action.kind === 'runPreApply' && action.pluginId === entry.pluginId) {
-                                    configTargets.set(`${entry.pluginId}\0${action.scope}`, { entry, scope: action.scope });
+                                    configTargets.set(`${entry.pluginId}\0${selection.platform}\0${action.scope}`, { entry, scope: action.scope, platform: selection.platform });
                                 }
                             }
                         }
                     }
-                    const configDigests = await Promise.all([...configTargets.values()].map(async ({ entry, scope, }) => {
+                    const configDigests = await Promise.all([...configTargets.values()].map(async ({ entry, scope, platform, }) => {
                         const effective = await resolveEffectivePluginConfig({
                             sourceId: entry.source.sourceId,
                             sourceIdentity: entry.source.sourceIdentity,
@@ -4537,12 +3673,14 @@ async function runRebuildCommandInSession(options) {
                             manifest: entry.plugin.manifest,
                             referencePlugins: options.runtime?.referencePlugins,
                             targetScope: scope,
+                            platform,
                             cwd: options.commandOptions.cwd,
                             env: runtimeEnv,
                         });
                         return createOperationPlanConfigDigest({
                             pluginId: entry.pluginId,
                             scope,
+                            platform,
                             effectiveValues: effective.values,
                         });
                     }));
@@ -4562,7 +3700,8 @@ async function runRebuildCommandInSession(options) {
                     preview.preApplyAuthorization = executionSelections.flatMap((selection) => {
                         const { entry, platform } = selection;
                         const planned = planTargetFor(authorizationPlan, selection);
-                        if (!planned || planned.action === 'block' || !entry.plugin.manifest.scripts?.preApply) {
+                        if (!planned || planned.action === 'block' || isHealthyWiderDependency(planned)
+                            || !entry.plugin.manifest.scripts?.preApply) {
                             return [];
                         }
                         const relation = planned.relation === 'requested'
@@ -4609,15 +3748,15 @@ async function runRebuildCommandInSession(options) {
                     const previewPreparation = await prepareRenderedTargets(initialPlan, initialCodexPlans, false);
                     const preview = mergeRebuildCommandResults([]);
                     preview.dependencyPlan = initialPlan;
+                    preview.nativeFootprints = preparedNativeFootprints([...previewPreparation.preparedTargets.values()].map((entry) => entry.target));
                     preview.operationPlan = await withNativeToolRemovalImpact(createRebuildOperationPlan({
-                        command: intentCommand,
                         dependencyPlan: initialPlan,
                         codexPlans: initialCodexPlans,
                         targetActions: previewPreparation.targetActions,
                         catalogSources: catalog.sources.flatMap((source) => source.resolution ? [source.resolution] : []),
-                        intentBeforeByScope,
+                        requirements,
+                        scope: options.commandOptions.scope,
                         configDigests: previewPreparation.configDigests,
-                        catalogEntries: intentCatalogEntries,
                     }), runtimeEnv);
                     if (initialCodexPlans.length > 0)
                         preview.codexReconcilePlans = initialCodexPlans;
@@ -4666,7 +3805,8 @@ async function runRebuildCommandInSession(options) {
                 const preApplyRequired = lifecycleCommand && executionSelections.some(({ entry, platform }) => entry.plugin.manifest.scripts?.preApply !== undefined
                     && lockedPlan.targets.some((target) => target.pluginId === entry.pluginId
                         && target.platform === platform
-                        && target.action !== 'block'));
+                        && target.action !== 'block'
+                        && !isHealthyWiderDependency(target)));
                 if (preApplyRequired
                     && options.commandOptions.yes !== true
                     && options.runtime?.preApplyConfirmed !== true) {
@@ -4679,14 +3819,13 @@ async function runRebuildCommandInSession(options) {
                 let lockedCodexPlans = provisionalLockedCodexPlans;
                 let lockedPreparation = await prepareRenderedTargets(lockedPlan, lockedCodexPlans, true);
                 let lockedOperationPlan = await withNativeToolRemovalImpact(createRebuildOperationPlan({
-                    command: intentCommand,
                     dependencyPlan: lockedPlan,
                     codexPlans: lockedCodexPlans,
                     targetActions: lockedPreparation.targetActions,
                     catalogSources: catalog.sources.flatMap((source) => source.resolution ? [source.resolution] : []),
-                    intentBeforeByScope,
+                    requirements,
+                    scope: options.commandOptions.scope,
                     configDigests: lockedPreparation.configDigests,
-                    catalogEntries: intentCatalogEntries,
                 }), runtimeEnv);
                 if (options.runtime?.expectedPlanFingerprint) {
                     try {
@@ -4708,19 +3847,13 @@ async function runRebuildCommandInSession(options) {
                 const operationPreparations = new Map();
                 const operationPreparationFailures = new Map();
                 const executionCommandFor = (selection) => {
-                    const { entry, platform } = selection;
                     const planned = planTargetFor(lockedPlan, selection);
-                    const desiredInCurrentScope = platform === 'codex'
-                        && lockedCodexPlans.some((codexPlan) => codexPlan.desiredTargets.some((target) => target.pluginId === entry.pluginId && target.scopes.includes(planned.resolvedScope)));
-                    if (platform === 'codex' && options.command === 'sync' && !desiredInCurrentScope) {
-                        return 'cleanup';
-                    }
-                    if (platform === 'codex' && options.command === 'cleanup' && desiredInCurrentScope) {
+                    if (isNativeActivationOnlyTarget(executionContext, {
+                        pluginId: selection.entry.pluginId,
+                        platform: selection.platform,
+                        scope: planned.resolvedScope,
+                    }))
                         return 'install';
-                    }
-                    if (planned.action === 'move') {
-                        return planned.state === 'partial' ? 'reinstall' : 'install';
-                    }
                     if (planned.relation === 'dependency'
                         && (planned.action === 'install' || planned.action === 'reinstall')) {
                         return planned.action;
@@ -4739,9 +3872,10 @@ async function runRebuildCommandInSession(options) {
                     for (const selection of executionSelections) {
                         const { entry, platform } = selection;
                         const key = executionKey(selection, lockedPlan);
+                        const planned = planTargetFor(lockedPlan, selection);
                         if (preparationOptions.eligibleKeys
                             && !preparationOptions.eligibleKeys.has(key)) {
-                            states.set(key, 'skipped');
+                            states.set(key, isHealthyWiderDependency(planned) ? 'ready' : 'skipped');
                             continue;
                         }
                         const directDependencyFailed = (entry.plugin.manifest.dependencies ?? []).some((pluginName) => {
@@ -4754,11 +3888,14 @@ async function runRebuildCommandInSession(options) {
                             const state = dependency ? states.get(planExecutionKey(dependency)) : undefined;
                             return state === 'failed' || state === 'skipped';
                         });
-                        const planned = planTargetFor(lockedPlan, selection);
                         if (directDependencyFailed || planned.action === 'block') {
                             states.set(key, 'skipped');
                             continue;
                         }
+                        if (isHealthyWiderDependency(planned)) {
+                            states.set(key, 'ready');
+                            continue;
+                        }
                         const preparationError = lockedPreparation.preparedTargetErrors.get(key);
                         const prepared = lockedPreparation.preparedTargets.get(key);
                         if (preparationError || !prepared) {
@@ -4943,14 +4080,13 @@ async function runRebuildCommandInSession(options) {
                     lockedPreparation.integration.setNativeMarketplaceEligibleTargets(eligibleTargets);
                 }
                 lockedOperationPlan = await withNativeToolRemovalImpact(createRebuildOperationPlan({
-                    command: intentCommand,
                     dependencyPlan: lockedPlan,
                     codexPlans: lockedCodexPlans,
                     targetActions: lockedPreparation.targetActions,
                     catalogSources: catalog.sources.flatMap((source) => source.resolution ? [source.resolution] : []),
-                    intentBeforeByScope,
+                    requirements,
+                    scope: options.commandOptions.scope,
                     configDigests: lockedPreparation.configDigests,
-                    catalogEntries: intentCatalogEntries,
                 }), runtimeEnv);
                 if (options.runtime?.expectedPlanFingerprint) {
                     assertOperationPlanFingerprint(options.runtime.expectedPlanFingerprint, lockedOperationPlan);
@@ -4962,7 +4098,9 @@ async function runRebuildCommandInSession(options) {
                     && lockedCodexPlans.some((plan) => plan.review.requiresConfirmation)) {
                     throw namespacedPreflightError('sharedNativeImpactAuthorizationRequired: Replacing or force-reinstalling shared Codex native state requires --yes.', preflightTargets);
                 }
-                if (!executionContext.codexManager) {
+                if (options.command !== 'cleanup'
+                    && options.command !== 'uninstall'
+                    && !executionContext.codexManager) {
                     const removalTargets = [];
                     for (const [key, prepared] of lockedPreparation.preparedTargets) {
                         const target = prepared.target;
@@ -5027,47 +4165,6 @@ async function runRebuildCommandInSession(options) {
                         }
                     }
                 }
-                if (options.runtime?.awHomeMutationToken) {
-                    if (lifecycleCommand) {
-                        const preparedKeys = new Set(operationPreparations.keys());
-                        for (const scope of ['user', 'project']) {
-                            const intentSelection = intentPlanForPreparedRoots(lockedPlan, preparedKeys, scope);
-                            if (intentSelection.selectedRoots.length > 0) {
-                                await writeDesiredIntentSuperset({
-                                    command: intentCommand,
-                                    removeOtherScopeRoots: !options.taskTargets,
-                                    cwd: options.commandOptions.cwd,
-                                    scope,
-                                    selectedRoots: intentSelection.selectedRoots,
-                                    plan: intentSelection.plan,
-                                    codexPlan: lockedCodexPlans[0],
-                                    preserveOtherCodexScopeRootIds,
-                                    catalogEntries: intentCatalogEntries,
-                                    env: runtimeEnv,
-                                });
-                            }
-                        }
-                    }
-                    else {
-                        for (const scope of ['user', 'project']) {
-                            const selectedRoots = selectedRootsForScope(lockedPlan, scope);
-                            if (selectedRoots.length === 0)
-                                continue;
-                            await writeDesiredIntentSuperset({
-                                command: intentCommand,
-                                removeOtherScopeRoots: !options.taskTargets,
-                                cwd: options.commandOptions.cwd,
-                                scope,
-                                selectedRoots,
-                                plan: lockedPlan,
-                                codexPlan: lockedCodexPlans[0],
-                                preserveOtherCodexScopeRootIds,
-                                catalogEntries: intentCatalogEntries,
-                                env: runtimeEnv,
-                            });
-                        }
-                    }
-                }
                 for (const pluginName of new Set(lockedPlan.targets.flatMap((target) => target.platform === 'claude'
                     && (target.action === 'install'
                         || target.action === 'reinstall')
@@ -5082,6 +4179,11 @@ async function runRebuildCommandInSession(options) {
                 const claudeCliRequired = await operationNeedsNativeCli('claude', lockedPlan);
                 const codexUserActivationDesired = new Set(lockedCodexPlans.flatMap((plan) => plan.activationActions.user.flatMap((action) => action.desired ? [action.codexPluginId] : [])));
                 executionContext.codexUserActivationDesired = codexUserActivationDesired;
+                const originalUserActivations = options.commandOptions.scope === 'project'
+                    && lockedCodexPlans.length > 0
+                    ? new Map(Object.entries((await readCodexConfigFile(resolveCodexPaths(options.commandOptions.cwd, 'user', runtimeEnv).configTomlPath)).snapshot.plugins)
+                        .map(([pluginId, activation]) => [pluginId, activation.enabled === true]))
+                    : undefined;
                 await assertClaudeVersion({
                     platforms: claudeCliRequired ? ['claude'] : [],
                     cwd: options.commandOptions.cwd,
@@ -5097,6 +4199,7 @@ async function runRebuildCommandInSession(options) {
                     const removalStateInventory = await readInventory({
                         cwd: options.commandOptions.cwd,
                         env: runtimeEnv,
+                        scope: options.commandOptions.scope,
                     });
                     if (options.command !== 'cleanup') {
                         const checked = options.command === 'uninstall'
@@ -5225,6 +4328,14 @@ async function runRebuildCommandInSession(options) {
                 }
                 const results = [];
                 const dependencyStates = new Map();
+                const nativeTargetExecution = lifecycleCommand ? options.runtime?.nativeTargetExecution : undefined;
+                const recordTargetCommands = (commands) => {
+                    executionContext.commandResults ??= [];
+                    for (const result of commands) {
+                        if (!executionContext.commandResults.some((entry) => JSON.stringify(entry) === JSON.stringify(result)))
+                            executionContext.commandResults.push(result);
+                    }
+                };
                 for (const selection of executionSelections) {
                     const { entry, platform } = selection;
                     const planned = planTargetFor(lockedPlan, selection);
@@ -5256,18 +4367,6 @@ async function runRebuildCommandInSession(options) {
                     const codexReconcilePlan = platform === 'codex'
                         ? lockedCodexPlans.find((plan) => plan.desiredTargets.some((target) => target.pluginId === entry.pluginId))
                         : undefined;
-                    const desiredInCurrentScope = codexReconcilePlan?.desiredTargets.some((target) => target.pluginId === entry.pluginId && target.scopes.includes(planned.resolvedScope)) === true;
-                    const reconcileObsolete = platform === 'codex'
-                        && options.command === 'sync'
-                        && !desiredInCurrentScope;
-                    const desiredCleanupMutation = codexReconcilePlan !== undefined && (codexReconcilePlan.sharedNativeActions.some((action) => action.pluginId === entry.pluginId
-                        && (action.action === 'install'
-                            || action.action === 'replace'
-                            || action.action === 'repair'))
-                        || [...codexReconcilePlan.activationActions.user,
-                            ...codexReconcilePlan.activationActions.project].some((action) => action.pluginId === entry.pluginId && action.action !== 'none')
-                        || [...codexReconcilePlan.extensionWrites,
-                            ...codexReconcilePlan.extensionRemovals].some((action) => action.pluginId === entry.pluginId));
                     const plannedNativeAction = codexReconcilePlan?.sharedNativeActions.find((action) => action.pluginId === entry.pluginId);
                     const hasCodexExtensionMutation = codexReconcilePlan !== undefined
                         && [...codexReconcilePlan.extensionWrites, ...codexReconcilePlan.extensionRemovals]
@@ -5282,17 +4381,20 @@ async function runRebuildCommandInSession(options) {
                         const code = failedConsumer
                             ? 'dependencyStillRequired'
                             : failedDependency ? 'dependencyInstallFailed' : planned.errorCode ?? 'dependencyNotReady';
+                        recordTargetCommands(nativeTargetExecution?.blocked?.(identity, code) ?? []);
                         const message = `${code}: ${failedConsumer
                             ? `${entry.pluginId} retained because consumer ${failedConsumer.split('\0', 1)[0]} was not removed.`
                             : failedDependency
                                 ? `${entry.pluginId} requires failed dependency ${failedDependency}.`
                                 : code === 'exclusiveOwnerEvidenceInvalid'
-                                    ? `${entry.pluginId} has damaged or missing exclusive owner evidence. Run aw cleanup ${entry.pluginId} --platform ${platform} --scope ${planned.resolvedScope} --force, then run aw reinstall ${entry.pluginId} --platform ${platform} --scope ${planned.resolvedScope}.`
+                                    ? `${entry.pluginId} has damaged or missing exclusive owner evidence. Run aw plugin cleanup ${entry.pluginId} --target ${platform} --scope ${planned.resolvedScope} --force, then run aw plugin sync ${entry.pluginId} --target ${platform} --context ${planned.resolvedScope} --rebuild.`
                                     : code === 'artifactCollision'
                                         ? `${entry.pluginId} has foreign-owned output. Remove or relocate it, then run cleanup and reinstall.`
                                         : code === 'dependencyNotReady'
                                             ? `${entry.pluginId} live state is unreadable. Run cleanup, then reinstall.`
-                                            : `${entry.pluginId} dependency preflight is blocked.`}`;
+                                            : code === 'dependencyStillRequired'
+                                                ? `${entry.pluginId} remains required by an unselected declared root.`
+                                                : `${entry.pluginId} dependency preflight is blocked.`}`;
                         const result = failedResult(requestedMethod, identity, message);
                         results.push({
                             platforms: [platform], plugins: [], warnings: [], rebuildResults: [result],
@@ -5304,8 +4406,8 @@ async function runRebuildCommandInSession(options) {
                                     message,
                                     ...(code === 'exclusiveOwnerEvidenceInvalid' ? {
                                         recoveryActions: [
-                                            `run aw cleanup ${entry.pluginId} --platform ${platform} --scope ${planned.resolvedScope} --force`,
-                                            `then run aw reinstall ${entry.pluginId} --platform ${platform} --scope ${planned.resolvedScope}`,
+                                            `run aw plugin cleanup ${entry.pluginId} --target ${platform} --scope ${planned.resolvedScope} --force`,
+                                            `then run aw plugin sync ${entry.pluginId} --target ${platform} --context ${planned.resolvedScope} --rebuild`,
                                         ],
                                     } : {}),
                                 }],
@@ -5318,9 +4420,23 @@ async function runRebuildCommandInSession(options) {
                         dependencyStates.set(key, failedDependency || failedConsumer ? 'skipped' : 'failed');
                         continue;
                     }
+                    if (isHealthyWiderDependency(planned)) {
+                        results.push({
+                            platforms: [platform], plugins: [identity.pluginName], warnings: [], rebuildResults: [],
+                            targetResults: [{ target: identity, action: 'keep', state: 'completed' }],
+                            overallState: 'succeeded',
+                            receiptTargets: [{
+                                    pluginName: identity.pluginName, pluginId: identity.pluginId,
+                                    sourceId: identity.sourceId, platform, scope: planned.resolvedScope,
+                                }],
+                        });
+                        dependencyStates.set(key, 'kept');
+                        continue;
+                    }
                     const operationPreparationFailure = operationPreparationFailures.get(key);
                     if (operationPreparationFailure) {
                         const targetResult = toTargetResult(operationPreparationFailure);
+                        recordTargetCommands(nativeTargetExecution?.blocked?.(identity, targetResult.errorCode ?? 'targetPreparationFailed') ?? []);
                         results.push({
                             platforms: [platform],
                             plugins: [],
@@ -5339,6 +4455,37 @@ async function runRebuildCommandInSession(options) {
                         dependencyStates.set(key, 'failed');
                         continue;
                     }
+                    if (nativeTargetExecution) {
+                        let packageFailure;
+                        try {
+                            const commands = await nativeTargetExecution.beforeApply(identity);
+                            recordTargetCommands(commands);
+                            if (commands.some((result) => result.state !== 'completed')) {
+                                packageFailure = 'commandPackageProviderNotSatisfied';
+                            }
+                        }
+                        catch (error) {
+                            executionContext.signal?.throwIfAborted();
+                            if (error instanceof Error && error.name === 'AbortError')
+                                throw error;
+                            packageFailure = 'commandPackageApplyFailed';
+                            recordTargetCommands(nativeTargetExecution.blocked?.(identity, packageFailure) ?? []);
+                        }
+                        if (packageFailure) {
+                            const result = failedResult(requestedMethod, identity, `${packageFailure}: ${entry.pluginId} requires a completed command package provider.`);
+                            results.push({
+                                platforms: [platform], plugins: [], warnings: [], rebuildResults: [result],
+                                targetResults: [{ ...toTargetResult(result), action: planned.action }],
+                                overallState: 'failed',
+                                receiptTargets: [{
+                                        pluginName: identity.pluginName, pluginId: identity.pluginId,
+                                        sourceId: identity.sourceId, platform, scope: planned.resolvedScope,
+                                    }],
+                            });
+                            dependencyStates.set(key, 'failed');
+                            continue;
+                        }
+                    }
                     if (reconcileActivationOnly) {
                         const preparedError = preparedTargetErrors.get(key);
                         if (preparedError) {
@@ -5368,11 +4515,10 @@ async function runRebuildCommandInSession(options) {
                             ?? [];
                         const preparedTarget = preparedTargets.get(key)?.target;
                         let result;
-                        if (preparedTarget) {
+                        if (preparedTarget && executionContext.preserveLegacyNativeSkills !== true) {
                             const nativeSkillKeys = new Set((entry.plugin.manifest.artifacts?.targets ?? [])
                                 .filter((target) => target.platform === 'codex'
-                                && target.target === 'codex.skill'
-                                && target.delivery?.mode === 'codex-native')
+                                && target.target === 'codex.skill')
                                 .map((target) => target.skillKey));
                             const marketplaceRoot = preparedTarget.identity.marketplaceRoot;
                             const legacyNativeSkills = preparedTarget.ownedComponents.filter((component) => component.kind === 'skill-directory'
@@ -5405,7 +4551,14 @@ async function runRebuildCommandInSession(options) {
                             plugins: result.status === 'succeeded' ? [identity.pluginName] : [],
                             warnings: result.failures.map((failure) => failure.message),
                             rebuildResults: [result],
-                            targetResults: [{ ...toTargetResult(result), action: planned.action }],
+                            targetResults: [{
+                                    ...toTargetResult(result),
+                                    action: result.status === 'succeeded' && result.removed.length === 0
+                                        && codexReconcilePlan
+                                        && [...codexReconcilePlan.activationActions.user,
+                                            ...codexReconcilePlan.activationActions.project].every((action) => action.pluginId !== entry.pluginId || action.action === 'none')
+                                        ? 'keep' : planned.action,
+                                }],
                             overallState: result.status === 'succeeded' ? 'succeeded' : 'failed',
                             receiptTargets: [{
                                     pluginName: identity.pluginName, pluginId: identity.pluginId,
@@ -5415,28 +4568,8 @@ async function runRebuildCommandInSession(options) {
                         dependencyStates.set(key, result.status === 'succeeded' ? 'completed' : 'failed');
                         continue;
                     }
-                    if (platform === 'codex'
-                        && desiredInCurrentScope
-                        && (options.command === 'uninstall'
-                            || (options.command === 'cleanup' && !desiredCleanupMutation))) {
-                        const result = {
-                            status: 'succeeded', command: options.command, target: identity, actions: [],
-                            cleanupAttempted: false, removed: [], absent: [], residual: [], quarantined: [], failures: [],
-                        };
-                        results.push({
-                            platforms: [platform], plugins: [identity.pluginName], warnings: [], rebuildResults: [result],
-                            targetResults: [{ target: identity, action: 'keep', state: 'completed' }],
-                            overallState: 'succeeded',
-                            receiptTargets: [{
-                                    pluginName: identity.pluginName, pluginId: identity.pluginId,
-                                    sourceId: identity.sourceId, platform, scope: planned.resolvedScope,
-                                }],
-                        });
-                        dependencyStates.set(key, 'kept');
-                        continue;
-                    }
                     if (planned.action === 'keep'
-                        && !reconcileObsolete
+                        && !(preparedTargets.get(key)?.target.writeNativeRequired ?? false)
                         && options.command !== 'cleanup'
                         && options.command !== 'uninstall') {
                         const preparedError = preparedTargetErrors.get(key);
@@ -5491,20 +4624,12 @@ async function runRebuildCommandInSession(options) {
                         marketplaceRoot: path.join(resolveAwHome(runtimeEnv), 'marketplaces', entry.source.sourceId),
                     };
                     entry.plugin.marketplaceName = marketplaceName;
-                    const reconcileDesiredCleanup = platform === 'codex'
-                        && options.command === 'cleanup'
-                        && desiredInCurrentScope;
                     const executionResult = await runSingleSourceRebuildCommand({
                         ...options,
-                        command: reconcileObsolete
-                            ? 'cleanup'
-                            : reconcileDesiredCleanup
-                                ? 'install'
-                                : planned.action === 'move'
-                                    ? planned.state === 'partial' ? 'reinstall' : 'install'
-                                    : planned.relation === 'dependency'
-                                        ? planned.action
-                                        : requestedMethod,
+                        command: isNativeActivationOnlyTarget(executionContext, identity) ? 'install'
+                            : planned.relation === 'dependency' && planned.action !== 'keep'
+                                ? planned.action
+                                : requestedMethod,
                         pluginNames: [entry.plugin.manifest.name],
                         all: false,
                         commandOptions: { ...options.commandOptions, platform, scope: planned.resolvedScope },
@@ -5543,15 +4668,8 @@ async function runRebuildCommandInSession(options) {
                             operationPreparation: operationPreparations.get(key),
                             integration: lockedPreparation.integration,
                             preparationError: preparedTargetErrors.get(key),
-                            skipPreApply: reconcileDesiredCleanup,
                         },
                     });
-                    if (reconcileDesiredCleanup) {
-                        for (const result of executionResult.rebuildResults)
-                            result.command = 'cleanup';
-                        for (const result of executionResult.targetResults)
-                            result.action = 'cleanup';
-                    }
                     results.push(executionResult);
                     dependencyStates.set(key, executionResult.overallState === 'succeeded' ? 'completed' : 'failed');
                 }
@@ -5634,17 +4752,17 @@ async function runRebuildCommandInSession(options) {
                         || dependencyStates.get(executionKey(selection, lockedPlan)) === 'kept')
                     ? [`${selection.entry.pluginId}\0${planTargetFor(lockedPlan, selection).resolvedScope}`]
                     : []));
-                const [activationUserBefore, activationProjectBefore] = await Promise.all([
-                    readCodexConfigFile(resolveCodexPaths(options.commandOptions.cwd, 'user', runtimeEnv).configTomlPath),
-                    readCodexConfigFile(resolveCodexPaths(options.commandOptions.cwd, 'project', runtimeEnv).configTomlPath),
-                ]);
+                const activationUserBefore = await readCodexConfigFile(resolveCodexPaths(options.commandOptions.cwd, 'user', runtimeEnv).configTomlPath);
+                const activationProjectBefore = options.commandOptions.scope === 'project'
+                    ? await readCodexConfigFile(resolveCodexPaths(options.commandOptions.cwd, 'project', runtimeEnv).configTomlPath)
+                    : undefined;
                 const preservedActivations = {
                     user: new Map(Object.entries(activationUserBefore.snapshot.plugins)
                         .map(([pluginId, activation]) => [pluginId, activation.enabled === true])),
-                    project: new Map(Object.entries(activationProjectBefore.snapshot.plugins)
+                    project: new Map(Object.entries(activationProjectBefore?.snapshot.plugins ?? {})
                         .map(([pluginId, activation]) => [pluginId, activation.enabled === true])),
                 };
-                const activationPlans = selectCodexActivationPlans(lockedCodexPlans, successfulCodexTargetScopes, preservedActivations);
+                const activationPlans = selectCodexActivationPlans(lockedCodexPlans, successfulCodexTargetScopes, preservedActivations, originalUserActivations);
                 if (activationPlans.length > 0
                     || lockedPreparation.integration.driver.completePostchecks) {
                     let activationError;
@@ -5691,7 +4809,7 @@ async function runRebuildCommandInSession(options) {
                     if (!activationError && activationPlans.length > 0) {
                         const postcheckTargetScopes = new Set([...successfulCodexTargetScopes]
                             .filter((key) => !failedCodexTargetScopes.has(key)));
-                        const postcheckPlans = selectCodexActivationPlans(activationPlans, postcheckTargetScopes, preservedActivations);
+                        const postcheckPlans = selectCodexActivationPlans(activationPlans, postcheckTargetScopes, preservedActivations, originalUserActivations);
                         try {
                             await postcheckCodexReconcileActivations({
                                 plans: postcheckPlans,
@@ -5773,7 +4891,7 @@ async function runRebuildCommandInSession(options) {
                                 identity,
                                 message,
                                 recoveryActions: [
-                                    `run aw sync --all --platform codex --scope ${planned.resolvedScope}`,
+                                    `run aw plugin sync ${selection.entry.pluginId} --target codex --context ${planned.resolvedScope}`,
                                 ],
                             })) {
                                 failedCodexTargetScopes.add(targetScopeKey);
@@ -5783,78 +4901,6 @@ async function runRebuildCommandInSession(options) {
                         }
                     }
                 }
-                for (const result of results) {
-                    result.targetResults = result.targetResults.map((target) => {
-                        if (target.state !== 'completed')
-                            return target;
-                        const planned = lockedPlan.targets.find((candidate) => candidate.pluginId === target.target.pluginId
-                            && candidate.platform === target.target.platform
-                            && candidate.resolvedScope === target.target.scope);
-                        if (!planned?.preservedScope)
-                            return target;
-                        return {
-                            ...target,
-                            recoveryActions: [
-                                `remove every direct and indirect dependent of ${planned.pluginId} in consumer-first order; if dependencyStillRequired is reported, handle the other reported dependents first`,
-                                `then run aw cleanup ${planned.pluginId} --platform ${planned.platform} --scope ${planned.preservedScope}`,
-                                `then reinstall every removed root at its original platform and scope, selecting --dependency-scope ${planned.pluginId}#${planned.platform}=${planned.resolvedScope} during each install`,
-                            ],
-                        };
-                    });
-                }
-                if (options.command === 'install' || options.command === 'sync') {
-                    for (const selection of executionSelections) {
-                        const { entry, platform } = selection;
-                        const planned = planTargetFor(lockedPlan, selection);
-                        const key = executionKey(selection, lockedPlan);
-                        if (dependencyStates.get(key) !== 'completed')
-                            continue;
-                        const previousScope = planned.resolvedScope === 'user' ? 'project' : 'user';
-                        const removesPreviousScope = planned.resolvedScope === 'user'
-                            && (planned.action === 'move'
-                                || platform === 'codex' && lockedCodexPlans.some((plan) => plan.extensionRemovals.some((action) => action.pluginId === entry.pluginId && action.scope === previousScope)));
-                        if (!removesPreviousScope) {
-                            continue;
-                        }
-                        const marketplaceName = marketplaceNameFor(entry, platform, previousScope);
-                        entry.plugin.marketplaceName = marketplaceName;
-                        const migration = await runSingleSourceRebuildCommand({
-                            command: 'cleanup',
-                            pluginNames: [entry.plugin.manifest.name],
-                            commandOptions: { ...options.commandOptions, platform, scope: previousScope },
-                            runtime: {
-                                ...options.runtime,
-                                env: runtimeEnv,
-                                ...(executionContext.codexManager
-                                    ? { codexManager: executionContext.codexManager }
-                                    : {}),
-                                catalogResolution: toCatalogResolution(entry.source),
-                                resolvedCatalogPlugins: available
-                                    .filter((candidate) => candidate.source.sourceId === entry.source.sourceId)
-                                    .map((candidate) => candidate.plugin),
-                                namespacedSource: {
-                                    sourceId: entry.source.sourceId,
-                                    sourceIdentity: entry.source.sourceIdentity,
-                                    logicalIdentity: entry.source.logicalIdentity,
-                                    marketplaceName,
-                                    marketplaceRoot: path.join(resolveAwHome(runtimeEnv), 'marketplaces', entry.source.sourceId),
-                                },
-                            },
-                            execution: { reviewCompleted: true },
-                        });
-                        results.push({
-                            ...migration,
-                            targetResults: migration.targetResults.map((target) => ({
-                                ...target,
-                                relation: planned.relation,
-                                requiredBy: planned.requiredBy,
-                            })),
-                        });
-                        if (migration.overallState !== 'succeeded') {
-                            dependencyStates.set(key, 'failed');
-                        }
-                    }
-                }
                 const merged = mergeRebuildCommandResults(results);
                 if (malformedSelectedConfigPreserved) {
                     merged.warnings.push(MALFORMED_CONFIG_PRESERVED_WARNING);
@@ -5864,6 +4910,7 @@ async function runRebuildCommandInSession(options) {
                 if (lockedCodexPlans.length > 0)
                     merged.codexReconcilePlans = lockedCodexPlans;
                 merged.operationPlan = lockedOperationPlan;
+                merged.nativeFootprints = preparedNativeFootprints([...lockedPreparation.preparedTargets.values()].map((entry) => entry.target));
                 return leaseSafeRebuildResult(merged);
             },
         });
@@ -5899,6 +4946,10 @@ async function runRebuildCommandInSession(options) {
     }
 }
 export async function runRebuildCommand(options) {
+    const executionInput = options.runtime?.executionInput;
+    if (!executionInput) {
+        throw new Error('nativeExecutionInputRequired: Native execution requires an explicit scope context and complete demand.');
+    }
     const commandResults = options.runtime?.commandResults ?? [];
     options = { ...options, runtime: { ...options.runtime, commandResults, managedCommandProducerCache: options.runtime?.managedCommandProducerCache ?? new Map() } };
     const withCommands = (result) => {
@@ -5915,20 +4966,25 @@ export async function runRebuildCommand(options) {
         const failed = commands.some((entry) => entry.state !== 'completed');
         return { ...result, commandResults: commands, overallState: failed ? result.targetResults.some((entry) => entry.state === 'completed') || commands.some((entry) => entry.state === 'completed') ? 'partial' : 'failed' : result.overallState };
     };
-    if (options.runtime?.codexObservationSession) {
-        return withCommands(await runRebuildCommandInSession(options));
+    const scopedOptions = {
+        ...options,
+        commandOptions: { ...options.commandOptions, cwd: executionInput.context.executionCwd },
+        runtime: { ...options.runtime, env: executionInput.context.env },
+    };
+    if (scopedOptions.runtime?.codexObservationSession) {
+        return withCommands(await runRebuildCommandInSession(scopedOptions));
     }
-    const env = options.runtime?.env ?? process.env;
+    const env = executionInput.context.env;
     const session = await createCodexNativeObservationSession({
-        exactCwd: options.commandOptions.cwd,
+        exactCwd: executionInput.context.executionCwd,
         env,
-        runner: options.runtime?.nativeCliRunner ?? getDefaultNativeCliRunner(),
-        manager: options.runtime?.codexManager,
+        runner: scopedOptions.runtime?.nativeCliRunner ?? getDefaultNativeCliRunner(),
+        manager: scopedOptions.runtime?.codexManager,
     });
     try {
         return withCommands(await runRebuildCommandInSession({
-            ...options,
-            runtime: { ...options.runtime, codexObservationSession: session },
+            ...scopedOptions,
+            runtime: { ...scopedOptions.runtime, codexObservationSession: session },
         }));
     }
     finally {
@@ -5982,6 +5038,12 @@ export async function runRebuildTaskCommand(targets, options, runtime = {}) {
     const repairTargets = deduplicate(normalizedRepairs);
     const commandOptions = { ...options };
     delete commandOptions.repairTargets;
+    if (!runtime.executionInput) {
+        throw new Error('nativeExecutionInputRequired: rebuild tasks require a scope context and complete demand.');
+    }
+    if (normalized.some((target) => target.scope !== runtime.executionInput.context.scope)) {
+        throw new Error('nativeExecutionTargetScopeInvalid: rebuild tasks cannot mix scopes.');
+    }
     return runRebuildCommand({
         command: 'sync',
         pluginNames: [...new Set(normalized.map((target) => target.pluginId))],
@@ -5990,7 +5052,13 @@ export async function runRebuildTaskCommand(targets, options, runtime = {}) {
             platform: 'both',
             scope: normalized[0].scope,
         },
-        runtime,
+        runtime: {
+            ...runtime,
+            executionInput: {
+                ...runtime.executionInput,
+                selectedTargets: normalized.map(({ pluginId, platform, scope }) => ({ pluginId, platform, scope })),
+            },
+        },
         taskTargets: normalized,
         taskRepairTargets: repairTargets,
     });