@lesliechan721/aw 0.1.0-beta.7 → 0.1.0-beta.9

package/dist/src/commands/rebuild-command.js

@@ -1,74 +1,68 @@
 import path from 'node:path';
 import fs from 'fs-extra';
-import { probeAgentVersion } from '../utils/agent-version.js';
+import { getCodexOperationRequirement, probeAgentVersion } from '../utils/agent-version.js';
+import { previewCodexManager, resolveCodexOperationConsumer, } from '../utils/codex-manager.js';
 import { createNoopDebugLogger } from '../output/debug-log.js';
 import { createNoopReporter } from '../output/reporter.js';
 import { getDefaultNativeCliRunner } from '../utils/native-cli.js';
-import { readPluginManifest, resolvePluginsFromCatalog } from '../utils/manifest.js';
-import { resolveAwHome } from '../utils/paths.js';
+import { readPluginManifest } from '../utils/manifest.js';
+import { resolveAwHome, resolveCodexPaths } from '../utils/paths.js';
 import { resolveCliPackageRoot } from '../utils/paths.js';
 import { supportsPlatform } from '../utils/platform-support.js';
-import { hasCodexProjectManagedArtifacts } from '../utils/codex-project-surface.js';
-import { createRebuildActiveStore, executeRebuildOperation, releaseRebuildOperationLease, } from './rebuild-operations.js';
-import { assertNoClaudeUnboundNativeNameCollision, createRebuildIntegration, discoverRebuildTargetNames, inspectNativeMarketplaceRegistrations, } from './rebuild-integration.js';
-import { getNamespacedMarketplaceName } from '../utils/local-marketplace.js';
+import { analyzeCodexSurface } from '../utils/codex-surface-analysis.js';
+import { createCodexReconcilePlan, } from '../utils/codex-reconciler.js';
+import { readCodexConfigFile } from '../utils/codex-config.js';
+import { createRebuildActiveStore, executeRebuildOperation, } from './rebuild-operations.js';
+import { assertNoClaudeUnboundNativeNameCollision, createRebuildIntegration, discoverRebuildTargetNames, executeCodexReconcileActivations, inspectCodexSharedNativeLive, inspectNativeMarketplaceRegistrations, } from './rebuild-integration.js';
+import { getNamespacedMarketplaceName, readStrictNamespacedMarketplaceRoot, } from '../utils/local-marketplace.js';
 import { formatPluginId, parsePluginId, planPluginSelectorSourceIds, preflightDesiredArtifactCollisions, withResolvedMultiSourceCatalog, } from '../utils/multi-source-catalog.js';
+import { calculateCodexSharedNativePayloadDigest } from '../utils/catalog-digests.js';
+import { resolveCatalogOperationContext, } from '../utils/catalog-operation-context.js';
 import { assertStrictSemVer } from '../utils/manifest.js';
 import { assertCatalogSourceInventoryComplete, canonicalMarketplaceRegistrationNames, inventoryCatalogSourceReferences, } from '../utils/catalog-source-references.js';
 import { resolveEffectivePluginConfig } from '../utils/plugin-config.js';
-import { cleanupCorruptExclusivePluginDirectory, inspectOwnedComponents, } from '../utils/ownership.js';
-import { codexProjectConfigAliasesUserHome, getClaudeHome, getCodexHome, resolveCanonicalRepoProjectKey, resolveRepoRootSync, } from '../utils/state-paths.js';
+import { inspectOwnedComponents, } from '../utils/ownership.js';
+import { codexProjectConfigAliasesUserHome, resolveCanonicalRepoProjectKey, } from '../utils/state-paths.js';
 import { resolvePluginMetaDependencyClosure } from '../utils/plugin-dependencies.js';
-import { createDependencyOperationPlan, } from './dependency-operation-plan.js';
-let rebuildCommandTestHooks;
-async function emitRebuildActionEvent(runtime, event) {
-    await Promise.allSettled([
-        Promise.resolve().then(() => runtime.reporter.event(event)),
-        Promise.resolve().then(() => runtime.debugLogger.log(event)),
-    ]);
-}
-async function withRebuildActionEvent(options) {
-    const source = {
-        plugin: options.identity.pluginName,
-        platform: options.identity.platform,
-        scope: options.identity.scope,
-        action: options.command,
-    };
+import { readCatalogSourcesConfigSnapshot } from '../utils/catalog-sources.js';
+import { readCatalogStoreEntry } from '../utils/catalog-generation-store.js';
+import { catalogGenerationErrorCode, isOfflineCleanupCatalogGenerationError, } from '../utils/catalog-generation-error.js';
+import { canonicalizePluginIntentState, convergePluginIntentManagedCodexOwnership, createEmptyPluginIntentState, mergePluginIntentRootPlatforms, readPluginIntentState, removePluginIntentRootPlatforms, widenPluginIntentManagedCodexOwnership, writePluginIntentState, } from '../utils/plugin-intent-state.js';
+import { validateCatalogSnapshotPluginEntriesComplete } from '../utils/catalog-snapshot.js';
+import { AwCapabilityUnsupportedError, IMPLEMENTED_AW_CAPABILITIES, } from './aw-capabilities.js';
+import { checkAwCapabilitySupport } from '../utils/manifest.js';
+import { createDependencyOperationPlan, createDependencyPlacementPlan, } from './dependency-operation-plan.js';
+import { offlineCleanupEvidenceFromInventory, offlineCleanupEvidenceMatches, } from './offline-cleanup-evidence.js';
+async function measureCommandPerformanceStage(runtime, name, operation) {
     const startedAt = Date.now();
-    await emitRebuildActionEvent(options.runtime, {
-        type: 'rebuild:action',
-        source,
-        data: { name: options.name, phase: 'start' },
-    });
-    let result;
+    let phase = 'success';
     try {
-        result = await options.operation();
+        return await operation();
     }
     catch (error) {
-        await emitRebuildActionEvent(options.runtime, {
-            type: 'rebuild:action',
-            source,
+        phase = 'failure';
+        throw error;
+    }
+    finally {
+        await Promise.resolve().then(() => runtime?.debugLogger?.log({
+            type: 'performance:stage',
+            level: 'debug',
+            target: 'debugLog',
+            message: 'Command performance stage completed.',
             data: {
-                name: options.name,
-                phase: 'failure',
+                name,
+                phase,
                 durationMs: Math.max(0, Date.now() - startedAt),
-                message: options.name === 'operation.lock'
-                    ? '获取操作锁失败。'
-                    : '释放操作锁失败。',
             },
-        });
-        throw error;
+        })).catch(() => undefined);
     }
-    await emitRebuildActionEvent(options.runtime, {
-        type: 'rebuild:action',
-        source,
-        data: {
-            name: options.name,
-            phase: 'success',
-            durationMs: Math.max(0, Date.now() - startedAt),
-        },
-    });
-    return result;
+}
+let rebuildCommandTestHooks;
+async function emitRebuildActionEvent(runtime, event) {
+    await Promise.allSettled([
+        Promise.resolve().then(() => runtime.reporter.event(event)),
+        Promise.resolve().then(() => runtime.debugLogger.log(event)),
+    ]);
 }
 export function setRebuildCommandTestHooksForTests(hooks) {
     rebuildCommandTestHooks = hooks;
@@ -76,17 +70,91 @@ export function setRebuildCommandTestHooksForTests(hooks) {
 function selectedPlatforms(selection) {
     return selection === 'both' ? ['codex', 'claude'] : [selection];
 }
+function updateIntentOverrides(options) {
+    const plannedKeys = new Set(options.plan.targets.map((target) => `${target.pluginId}\0${target.platform}`));
+    return canonicalizePluginIntentState({
+        ...options.state,
+        dependencyScopeOverrides: [
+            ...options.state.dependencyScopeOverrides.filter((override) => !plannedKeys.has(`${override.pluginId}\0${override.platform}`)),
+            ...options.plan.scopeOverrides,
+        ],
+    });
+}
+function effectiveDependencyScopeOverrides(options) {
+    const nodeKeys = new Set(options.nodes.map((node) => `${node.pluginId}\0${node.platform}`));
+    const explicitMatches = (pluginId, platform) => options.explicit.some((override) => override.pluginId === pluginId
+        && (override.platform === undefined || override.platform === platform));
+    return [
+        ...options.state.dependencyScopeOverrides.filter((override) => nodeKeys.has(`${override.pluginId}\0${override.platform}`)
+            && !options.ignoredPersistedRootIds?.has(override.pluginId)
+            && !explicitMatches(override.pluginId, override.platform)),
+        ...options.explicit.filter((override) => options.nodes.some((node) => node.pluginId === override.pluginId
+            && (override.platform === undefined || node.platform === override.platform))),
+    ];
+}
+function deriveDesiredIntentState(options) {
+    if (options.reconcileIntentOnly)
+        return options.state;
+    let next = options.state;
+    if (options.command === 'install') {
+        for (const root of options.selectedRoots)
+            next = mergePluginIntentRootPlatforms(next, root);
+        next = updateIntentOverrides({ state: next, plan: options.plan });
+    }
+    else if (options.command === 'uninstall') {
+        for (const root of options.selectedRoots)
+            next = removePluginIntentRootPlatforms(next, root);
+    }
+    return next;
+}
+async function writeDesiredIntentSuperset(options) {
+    const location = { scope: options.scope, cwd: options.cwd, env: options.env };
+    let next = deriveDesiredIntentState({
+        command: options.command,
+        state: await readPluginIntentState(location),
+        selectedRoots: options.selectedRoots,
+        plan: options.plan,
+        reconcileIntentOnly: options.reconcileIntentOnly,
+    });
+    const convergedCodexPluginIds = options.codexPlan?.managedInventory.converged
+        ?? next.managed.codexPluginIds;
+    const superset = options.codexPlan
+        ? widenPluginIntentManagedCodexOwnership(next, options.codexPlan.managedInventory.ownershipSuperset)
+        : next;
+    await writePluginIntentState(location, superset);
+    const writes = [{ location, superset, convergedCodexPluginIds }];
+    if (options.command === 'install' || options.codexPlan) {
+        const otherScope = options.scope === 'user' ? 'project' : 'user';
+        const otherLocation = { scope: otherScope, cwd: options.cwd, env: options.env };
+        let other = await readPluginIntentState(otherLocation);
+        if (options.command === 'install' && !options.reconcileIntentOnly) {
+            for (const root of options.selectedRoots)
+                other = removePluginIntentRootPlatforms(other, root);
+        }
+        const otherConvergedCodexPluginIds = options.codexPlan?.managedInventory.related.converged
+            ?? other.managed.codexPluginIds;
+        const otherSuperset = options.codexPlan
+            ? widenPluginIntentManagedCodexOwnership(other, options.codexPlan.managedInventory.related.ownershipSuperset)
+            : other;
+        await writePluginIntentState(otherLocation, otherSuperset);
+        writes.push({
+            location: otherLocation,
+            superset: otherSuperset,
+            convergedCodexPluginIds: otherConvergedCodexPluginIds,
+        });
+    }
+    return writes;
+}
 function createSyntheticPlugin(pluginName, env) {
     const rootDir = path.join(resolveAwHome(env), 'plugins', pluginName);
     return {
         rootDir,
         manifestPath: path.join(rootDir, '.agents-plugin', 'plugin.json'),
         manifest: {
-            schemaVersion: 1,
+            schemaVersion: 2,
             name: pluginName,
             version: '0.0.0',
             description: 'Cleanup-only target for a plugin missing from the current catalog.',
-            compatibility: { aw: { minVersion: '0.0.0' } },
             marketplace: {
                 category: 'cleanup',
                 strict: true,
@@ -110,17 +178,6 @@ function failedResult(command, identity, message, phase = 'preflight') {
         error: { phase, message },
     };
 }
-function appendOperationReleaseFailure(result, message) {
-    result.actions.push({ name: 'operation.release', status: 'failed' });
-    result.failures.push({ phase: 'operation.release', message });
-    if (result.status === 'failed')
-        return result;
-    return {
-        ...result,
-        status: 'failed',
-        error: { phase: 'operation.release', message },
-    };
-}
 function toTargetResult(result) {
     return {
         target: {
@@ -138,17 +195,17 @@ function toTargetResult(result) {
         ...(result.status === 'failed' ? { message: result.error.message } : {}),
     };
 }
-async function assertAgentVersions(options) {
+async function assertClaudeVersion(options) {
+    if (!options.platforms.includes('claude'))
+        return;
     const failures = [];
-    for (const platform of options.platforms) {
-        const result = await probeAgentVersion(platform, {
-            cwd: options.cwd,
-            env: options.env,
-            runner: options.runtime.nativeCliRunner,
-        });
-        if (result.status !== 'supported')
-            failures.push(result);
-    }
+    const result = await probeAgentVersion('claude', {
+        cwd: options.cwd,
+        env: options.env,
+        runner: options.runtime.nativeCliRunner,
+    });
+    if (result.status !== 'supported')
+        failures.push(result);
     if (failures.length > 0) {
         throw new Error(failures.map((failure) => `${failure.command} 版本检查失败：${failure.details ?? failure.status}；最低版本 ${failure.requiredMinVersion}。`)
             .join('；'));
@@ -177,8 +234,7 @@ async function runSingleSourceRebuildCommand(options) {
         nativeCliRunner: options.runtime?.nativeCliRunner ?? getDefaultNativeCliRunner(),
         reporter: options.runtime?.reporter ?? createNoopReporter(),
         debugLogger: options.runtime?.debugLogger ?? createNoopDebugLogger(),
-        runtimeLeaseHeld: options.runtime?.runtimeLeaseHeld,
-        lifecycleLeaseHeld: options.runtime?.lifecycleLeaseHeld,
+        ...(options.runtime?.codexManager ? { codexManager: options.runtime.codexManager } : {}),
         expectedCatalogConfigDigest: options.runtime?.expectedCatalogConfigDigest,
     };
     const env = runtime.env;
@@ -186,7 +242,23 @@ async function runSingleSourceRebuildCommand(options) {
     const catalog = options.runtime?.catalogResolution;
     if (!catalog)
         throw new Error('Internal error: a resolved catalog source is required.');
-    const catalogPlugins = await resolvePluginsFromCatalog(catalog.rootDir, undefined);
+    const requestedByPlatform = await resolveRequestedNames({
+        command: options.command,
+        pluginNames: options.pluginNames,
+        all: options.all,
+        platforms: selected,
+        scope: options.commandOptions.scope,
+        cwd: options.commandOptions.cwd,
+        env,
+        nativeCliRunner: runtime.nativeCliRunner,
+    });
+    const exactPluginNames = [...new Set([...requestedByPlatform.values()].flat())];
+    const catalogPlugins = options.runtime?.resolvedCatalogPlugins ?? (await Promise.all(exactPluginNames.map(async (pluginName) => {
+        const pluginRoot = path.join(catalog.rootDir, 'plugins', pluginName);
+        return await fs.pathExists(pluginRoot)
+            ? readPluginManifest(pluginRoot, { mode: 'bundle' })
+            : null;
+    }))).filter((plugin) => plugin !== null);
     if (options.runtime?.namespacedSource) {
         for (const plugin of catalogPlugins) {
             plugin.sourceId = options.runtime.namespacedSource.sourceId;
@@ -199,16 +271,6 @@ async function runSingleSourceRebuildCommand(options) {
         }
     }
     const catalogByName = new Map(catalogPlugins.map((plugin) => [plugin.manifest.name, plugin]));
-    const requestedByPlatform = await resolveRequestedNames({
-        command: options.command,
-        pluginNames: options.pluginNames,
-        all: options.all,
-        platforms: selected,
-        scope: options.commandOptions.scope,
-        cwd: options.commandOptions.cwd,
-        env,
-        nativeCliRunner: runtime.nativeCliRunner,
-    });
     if (options.commandOptions.platform === 'both'
         && options.command !== 'cleanup'
         && options.command !== 'uninstall') {
@@ -220,12 +282,14 @@ async function runSingleSourceRebuildCommand(options) {
         }
     }
     const platforms = selected.filter((platform) => (requestedByPlatform.get(platform)?.length ?? 0) > 0);
-    await assertAgentVersions({
-        platforms,
-        cwd: options.commandOptions.cwd,
-        env,
-        runtime,
-    });
+    if (options.runtime?.bypassDependencyPlan) {
+        await assertClaudeVersion({
+            platforms,
+            cwd: options.commandOptions.cwd,
+            env,
+            runtime,
+        });
+    }
     const integration = options.runtime?.preparedTarget
         ? {
             driver: options.runtime.preparedTarget.driver,
@@ -238,7 +302,6 @@ async function runSingleSourceRebuildCommand(options) {
     const activeStore = createRebuildActiveStore({
         env,
         loadPlugin: (bundleRoot) => readPluginManifest(bundleRoot, { mode: 'bundle' }),
-        isLifecycleLeaseHeld: () => runtime.lifecycleLeaseHeld === true,
     });
     const targets = [];
     const results = [];
@@ -286,44 +349,6 @@ async function runSingleSourceRebuildCommand(options) {
                 results.push(failedResult(options.command, identity, 'codexScopePathAlias: Codex project config 与用户配置目录相同。请进入实际项目目录后重试。'));
                 continue;
             }
-            if (currentPlugin
-                && platform === 'codex'
-                && options.commandOptions.scope === 'project'
-                && options.command !== 'cleanup'
-                && options.command !== 'uninstall'
-                && currentPlugin.manifest.apps) {
-                results.push(failedResult(options.command, identity, `${pluginName} 声明了 apps；Codex project scope 不支持 apps。`));
-                continue;
-            }
-            if (currentPlugin
-                && platform === 'codex'
-                && options.commandOptions.scope === 'project'
-                && options.command !== 'cleanup'
-                && options.command !== 'uninstall'
-                && !hasCodexProjectManagedArtifacts(currentPlugin)) {
-                results.push(failedResult(options.command, identity, `${pluginName} 没有 Codex project scope 可生成的 Skills、instructions、roles、MCP、hooks 或 permissions。`));
-                continue;
-            }
-            let operationLock;
-            if (!options.runtime?.operationLeaseHeld) {
-                try {
-                    await rebuildCommandTestHooks?.beforeOperationLockAcquire?.({
-                        command: options.command,
-                        identity,
-                    });
-                    operationLock = await withRebuildActionEvent({
-                        runtime,
-                        command: options.command,
-                        identity,
-                        name: 'operation.lock',
-                        operation: () => activeStore.acquireOperation(identity),
-                    });
-                }
-                catch (error) {
-                    results.push(failedResult(options.command, identity, error instanceof Error ? error.message : String(error), 'operation.lock'));
-                    continue;
-                }
-            }
             let result;
             try {
                 if (options.runtime?.preparedTargetError)
@@ -358,49 +383,21 @@ async function runSingleSourceRebuildCommand(options) {
                         ...options.runtime.resolvedReviewEvidenceByPlugin?.[pluginName],
                     });
                 }
-                const { acquireOperation: _acquireOperation, ...operationHeldStore } = activeStore;
                 result = await executeRebuildOperation({
                     command: options.command,
                     target,
                     driver: integration.driver,
-                    activeStore: operationHeldStore,
+                    activeStore,
                     onActionEvent: (event) => emitRebuildActionEvent(runtime, event),
                 });
             }
             catch (error) {
                 result = error.result ?? failedResult(options.command, identity, error instanceof Error ? error.message : String(error), 'preflight');
             }
-            result.actions.unshift({ name: 'operation.lock', status: 'succeeded' });
-            if (operationLock) {
-                try {
-                    await withRebuildActionEvent({
-                        runtime,
-                        command: options.command,
-                        identity,
-                        name: 'operation.release',
-                        operation: () => releaseRebuildOperationLease(operationLock),
-                    });
-                    result.actions.push({ name: 'operation.release', status: 'succeeded' });
-                }
-                catch (error) {
-                    result = appendOperationReleaseFailure(result, error instanceof Error ? error.message : String(error));
-                }
-            }
             results.push(result);
         }
     }
     const successful = results.filter((result) => result.status === 'succeeded');
-    const artifacts = targets.flatMap((target) => [...target.artifacts]);
-    const nativePlugins = {};
-    for (const result of successful) {
-        const target = targets.find((entry) => entry.identity.pluginName === result.target.pluginName
-            && entry.identity.platform === result.target.platform
-            && entry.identity.scope === result.target.scope);
-        if (target?.requiresNative && options.command !== 'cleanup' && options.command !== 'uninstall') {
-            nativePlugins[result.target.platform] ??= [];
-            nativePlugins[result.target.platform].push(result.target.pluginName);
-        }
-    }
     return {
         platforms,
         plugins: [...new Set(successful.map((result) => result.target.pluginName))],
@@ -408,8 +405,6 @@ async function runSingleSourceRebuildCommand(options) {
         rebuildResults: results,
         targetResults: results.map(toTargetResult),
         overallState: results.every((result) => result.status === 'succeeded') ? 'succeeded' : 'failed',
-        nativePlugins,
-        repoManagedArtifacts: artifacts,
         receiptTargets: results.map((result) => ({
             pluginName: result.target.pluginName,
             ...(result.target.sourceId ? {
@@ -431,20 +426,11 @@ function toCatalogResolution(source) {
         source: 'local',
         catalogVersion: source.manifest.catalogVersion,
         channel: source.manifest.channel,
-        minAwVersion: source.manifest.compatibility.aw.minVersion,
     };
 }
 function mergeRebuildCommandResults(results) {
     const rebuildResults = results.flatMap((result) => result.rebuildResults);
     const platforms = [...new Set(results.flatMap((result) => result.platforms))];
-    const nativePlugins = {};
-    for (const result of results) {
-        for (const platform of ['codex', 'claude']) {
-            const names = result.nativePlugins[platform];
-            if (names)
-                nativePlugins[platform] = [...new Set([...(nativePlugins[platform] ?? []), ...names])];
-        }
-    }
     return {
         platforms,
         plugins: [...new Set(results.flatMap((result) => result.plugins))],
@@ -454,19 +440,22 @@ function mergeRebuildCommandResults(results) {
         overallState: rebuildResults.every((result) => result.status === 'succeeded')
             ? 'succeeded'
             : 'failed',
-        nativePlugins,
-        repoManagedArtifacts: [],
         receiptTargets: results.flatMap((result) => result.receiptTargets),
         ...(results.find((result) => result.dependencyPlan)?.dependencyPlan
             ? { dependencyPlan: results.find((result) => result.dependencyPlan).dependencyPlan }
             : {}),
+        ...(results.find((result) => result.codexManagerPreview)?.codexManagerPreview
+            ? { codexManagerPreview: results.find((result) => result.codexManagerPreview).codexManagerPreview }
+            : {}),
+        ...(results.some((result) => result.offlineCleanupPlans !== undefined)
+            ? { offlineCleanupPlans: results.flatMap((result) => result.offlineCleanupPlans ?? []) }
+            : {}),
     };
 }
 function leaseSafeRebuildResult(result) {
     const projectPath = (value) => path.basename(value);
     return {
         ...result,
-        repoManagedArtifacts: [],
         rebuildResults: result.rebuildResults.map((entry) => ({
             ...entry,
             target: { ...entry.target, cwd: '.' },
@@ -497,12 +486,18 @@ function projectLegacyTargets(references) {
             return [`${target.pluginName}\0${target.platform}\0${target.scope}`, target];
         })).values()];
 }
-function exclusiveSkillRoot(options) {
-    if (options.scope === 'user') {
-        return path.join(options.platform === 'codex' ? getCodexHome(options.env) : getClaudeHome(options.env), 'skills');
-    }
-    const repoRoot = resolveRepoRootSync(options.cwd);
-    return path.join(repoRoot, options.platform === 'codex' ? '.agents' : '.claude', 'skills');
+function desiredCleanupNoopResult(targets, cwd) {
+    const rebuildResults = targets.map((target) => ({
+        status: 'succeeded', command: 'cleanup', target: { ...target, pluginVersion: 'unavailable', cwd },
+        actions: [], cleanupAttempted: false, removed: [], absent: [], residual: [], quarantined: [], failures: [],
+    }));
+    return {
+        platforms: [...new Set(targets.map((target) => target.platform))],
+        plugins: [...new Set(targets.map((target) => target.pluginName))],
+        warnings: [], rebuildResults,
+        targetResults: rebuildResults.map((result) => ({ target: result.target, action: 'keep', state: 'completed' })),
+        overallState: 'succeeded', receiptTargets: targets,
+    };
 }
 function resolveLiveCleanupTargets(options) {
     const visible = options.references.filter((reference) => (reference.kind === 'namespacedOwner'
@@ -520,6 +515,12 @@ function resolveLiveCleanupTargets(options) {
         const matchesByTarget = new Map();
         for (const reference of visible.filter((entry) => entry.pluginName === parsed.pluginName
             && (parsed.sourceId === undefined || entry.sourceId === parsed.sourceId))) {
+            const lifecycleReference = visible.find((entry) => entry.kind === 'namespacedLifecycle'
+                && entry.sourceId === reference.sourceId
+                && entry.sourceIdentity === reference.sourceIdentity
+                && entry.pluginName === reference.pluginName
+                && entry.platform === reference.platform
+                && entry.scope === reference.scope);
             const liveNames = new Set(options.references.flatMap((candidate) => candidate.sourceId === reference.sourceId
                 && candidate.sourceIdentity === reference.sourceIdentity
                 && candidate.pluginName === reference.pluginName
@@ -553,7 +554,19 @@ function resolveLiveCleanupTargets(options) {
                 platform: reference.platform,
                 scope: reference.scope,
                 ...(marketplaceName ? { marketplaceName } : {}),
+                ...((liveNames.size === 1
+                    || (marketplaceName !== undefined && unboundNativeNames.has(marketplaceName)))
+                    ? { nativeRegistration: true }
+                    : {}),
                 ...(marketplaceIdentityUnresolved ? { marketplaceIdentityUnresolved: true } : {}),
+                ...(lifecycleReference?.lifecycleMetadataIntegrityDigest
+                    ? {
+                        lifecycleMetadataIntegrityDigest: lifecycleReference.lifecycleMetadataIntegrityDigest,
+                    }
+                    : {}),
+                ...(lifecycleReference?.pluginVersion
+                    ? { lifecyclePluginVersion: lifecycleReference.pluginVersion }
+                    : {}),
             };
             const key = [target.pluginId, target.sourceIdentity, target.platform, target.scope].join('\0');
             const previous = matchesByTarget.get(key);
@@ -574,60 +587,18 @@ function resolveLiveCleanupTargets(options) {
                 ].join('\0'), target])).values()],
     };
 }
-async function discoverDamagedExclusiveCleanupTargets(options) {
-    const parsed = parsePluginId(options.selector);
-    if (!parsed.sourceId)
-        return [];
-    const targets = [];
-    for (const platform of options.platforms) {
-        const root = exclusiveSkillRoot({
-            platform,
-            scope: options.scope,
-            cwd: options.cwd,
-            env: options.env,
-        });
-        const entries = await fs.readdir(root, { withFileTypes: true }).catch(() => []);
-        for (const entry of entries) {
-            if (!entry.isDirectory() || entry.isSymbolicLink())
-                continue;
-            const markerPath = path.join(root, entry.name, '.agent-workflows-owner.json');
-            const markerStats = await fs.lstat(markerPath).catch(() => null);
-            if (!markerStats?.isFile() || markerStats.isSymbolicLink())
-                continue;
-            const raw = await fs.readJson(markerPath).catch(() => null);
-            if (!raw
-                || raw.schemaVersion !== 2
-                || raw.owner !== 'agent-workflows'
-                || raw.sourceId !== parsed.sourceId
-                || raw.plugin !== parsed.pluginName
-                || raw.pluginId !== options.selector
-                || raw.platform !== platform
-                || raw.scope !== options.scope)
-                continue;
-            targets.push({
-                pluginId: options.selector,
-                pluginName: parsed.pluginName,
-                sourceId: parsed.sourceId,
-                sourceIdentity: typeof raw.sourceIdentity === 'string'
-                    && /^sha256:[0-9a-f]{64}$/u.test(raw.sourceIdentity)
-                    ? raw.sourceIdentity
-                    : `sha256:${'0'.repeat(64)}`,
-                platform,
-                scope: raw.scope,
-            });
-        }
-    }
-    return [...new Map(targets.map((target) => [[target.platform, target.scope].join('\0'), target])).values()];
-}
 async function cleanupOfflineOwnedComponents(options) {
     if (options.targets.some((target) => target.marketplaceIdentityUnresolved)) {
         throw namespacedPreflightError('marketplaceIdentityUnavailable: Cannot uniquely recover the native marketplace name from live inventory or a canonical native registration path.', options.targets);
     }
     const results = [];
     const warnings = [];
+    const nativeCliRunner = options.nativeCliRunner ?? getDefaultNativeCliRunner();
+    const codexManager = options.codexManager;
     const context = {
         env: options.env,
-        nativeCliRunner: options.nativeCliRunner ?? getDefaultNativeCliRunner(),
+        nativeCliRunner,
+        ...(codexManager ? { codexManager } : {}),
         reporter: createNoopReporter(),
         debugLogger: createNoopDebugLogger(),
     };
@@ -635,56 +606,36 @@ async function cleanupOfflineOwnedComponents(options) {
     const activeStore = createRebuildActiveStore({
         env: options.env,
         loadPlugin: (bundleRoot) => readPluginManifest(bundleRoot, { mode: 'bundle' }),
-        isLifecycleLeaseHeld: () => context.lifecycleLeaseHeld === true,
     });
     for (const target of options.targets) {
-        const exclusiveRecovery = {
-            removed: [], absent: [], residual: [], quarantined: [], failures: [],
-        };
-        if (options.force) {
-            const root = exclusiveSkillRoot({
-                platform: target.platform,
-                scope: target.scope,
+        const inventoryErrors = (options.inventoryErrors ?? []).filter((error) => error.relevance.global || ((error.relevance.sourceId === undefined || error.relevance.sourceId === target.sourceId)
+            && (error.relevance.pluginName === undefined || error.relevance.pluginName === target.pluginName)
+            && (error.relevance.platform === undefined || error.relevance.platform === target.platform)
+            && (error.relevance.scope === undefined || error.relevance.scope === target.scope)));
+        const evidence = options.evidence?.find((candidate) => candidate.pluginId === target.pluginId
+            && candidate.sourceIdentity === target.sourceIdentity
+            && candidate.platform === target.platform
+            && candidate.scope === target.scope);
+        const activationAction = target.platform === 'codex'
+            ? evidence?.plan.actions.find((action) => action.action === 'removeNativeRegistration'
+                && action.activationScope === target.scope)
+            : undefined;
+        let activationDisposition = 'remove';
+        if (activationAction && target.scope === 'user') {
+            const projectIntent = await readPluginIntentState({
+                scope: 'project',
                 cwd: options.cwd,
                 env: options.env,
             });
-            const entries = await fs.readdir(root, { withFileTypes: true }).catch(() => []);
-            for (const entry of entries) {
-                if (!entry.isDirectory() || entry.isSymbolicLink())
-                    continue;
-                const directory = path.join(root, entry.name);
-                let recovered;
-                try {
-                    recovered = await cleanupCorruptExclusivePluginDirectory({
-                        directory,
-                        allowedRoot: root,
-                        sourceId: target.sourceId,
-                        pluginName: target.pluginName,
-                        platform: target.platform,
-                        scope: target.scope,
-                        ...options.corruptExclusiveDirectoryOperations,
-                    });
-                }
-                catch (error) {
-                    recovered = {
-                        removed: [], absent: [], residual: [directory], quarantined: [],
-                        failures: [{
-                                label: directory,
-                                phase: 'mutation',
-                                message: error instanceof Error ? error.message : String(error),
-                            }],
-                    };
-                }
-                if (recovered) {
-                    exclusiveRecovery.removed.push(...recovered.removed);
-                    exclusiveRecovery.absent.push(...recovered.absent);
-                    exclusiveRecovery.residual.push(...recovered.residual);
-                    exclusiveRecovery.quarantined.push(...recovered.quarantined);
-                    exclusiveRecovery.failures.push(...recovered.failures);
-                }
-            }
+            const remainsDesired = projectIntent.roots.some((root) => root.pluginId === target.pluginId && root.platforms.includes('codex'))
+                || projectIntent.managed.codexPluginIds.includes(activationAction.target);
+            if (remainsDesired)
+                activationDisposition = 'disable';
         }
         const plugin = createSyntheticPlugin(target.pluginName, options.env);
+        if (target.lifecyclePluginVersion) {
+            plugin.manifest.version = target.lifecyclePluginVersion;
+        }
         plugin.sourceId = target.sourceId;
         plugin.sourceIdentity = target.sourceIdentity;
         plugin.pluginId = target.pluginId;
@@ -706,54 +657,46 @@ async function cleanupOfflineOwnedComponents(options) {
                 source: 'local',
                 catalogVersion: '0.0.0',
                 channel: 'beta',
-                minAwVersion: '0.0.0',
             },
-            includeHistoricalLifecycleArtifacts: false,
+            includeHistoricalLifecycleArtifacts: target.lifecycleMetadataIntegrityDigest !== undefined,
+            ...(target.lifecycleMetadataIntegrityDigest
+                ? {
+                    expectedLifecycleMetadataIntegrityDigest: target.lifecycleMetadataIntegrityDigest,
+                }
+                : {}),
+            includeNativeCleanupCandidate: target.nativeRegistration === true,
+            ...(activationAction
+                ? {
+                    codexActivationCleanup: [{
+                            codexPluginId: activationAction.target,
+                            scope: activationAction.activationScope,
+                            disposition: activationDisposition,
+                        }],
+                    preserveCodexSharedNativePayload: true,
+                }
+                : {}),
         });
-        let result;
-        const operationLock = await activeStore.acquireOperation(desired.identity);
-        try {
-            const { acquireOperation: _acquireOperation, ...operationHeldStore } = activeStore;
-            result = await executeRebuildOperation({
-                command: 'cleanup',
-                target: desired,
-                driver: integration.driver,
-                activeStore: operationHeldStore,
-            });
+        const preserveDamagedLifecycle = inventoryErrors.some((error) => error.kind.startsWith('lifecycle'));
+        const result = await executeRebuildOperation({
+            command: 'cleanup',
+            target: desired,
+            driver: integration.driver,
+            activeStore: preserveDamagedLifecycle
+                ? { ...activeStore, remove: async () => undefined }
+                : activeStore,
+        });
+        if (result.status === 'succeeded' && evidence) {
+            result.removed = [...new Set([
+                    ...result.removed,
+                    ...evidence.plan.actions.flatMap((action) => action.action === 'removeLifecycleSnapshot' ? [action.target] : []),
+                ])];
         }
-        finally {
-            await releaseRebuildOperationLease(operationLock);
-        }
-        const exclusiveResidual = (await Promise.all(exclusiveRecovery.residual.map(async (entry) => await fs.pathExists(entry) ? entry : null))).filter((entry) => entry !== null);
-        const exclusiveQuarantined = (await Promise.all(exclusiveRecovery.quarantined.map(async (entry) => await fs.pathExists(entry) ? entry : null))).filter((entry) => entry !== null);
-        const exclusiveFailures = (await Promise.all(exclusiveRecovery.failures.map(async (failure) => {
-            const residualPath = failure.quarantinePath ?? failure.label;
-            return await fs.pathExists(residualPath) ? failure : null;
-        }))).filter((failure) => failure !== null);
-        const removed = [...new Set([...result.removed, ...exclusiveRecovery.removed])];
-        const absent = [...new Set([...result.absent, ...exclusiveRecovery.absent])]
-            .filter((entry) => !removed.includes(entry));
-        result = {
-            ...result,
-            removed,
-            absent,
-            residual: [...new Set([...result.residual, ...exclusiveResidual])],
-            quarantined: [...new Set([...result.quarantined, ...exclusiveQuarantined])],
-        };
-        if (exclusiveFailures.length > 0) {
-            const failures = exclusiveFailures.map((failure) => ({
-                phase: 'cleanup.owned',
-                label: failure.label,
-                message: `exclusiveRecoveryFailed: ${failure.phase} ${failure.label}: ${failure.message}`,
-            }));
-            const message = failures[0].message;
-            result = {
-                ...result,
-                status: 'failed',
-                actions: [{ name: 'cleanup.owned', status: 'failed' }],
-                failures: [...result.failures, ...failures],
-                error: { phase: 'cleanup.owned', message },
-            };
+        if (inventoryErrors.length > 0) {
+            result.residual = [...new Set([
+                    ...result.residual,
+                    ...inventoryErrors.map((error) => error.location),
+                ])];
+            warnings.push(...inventoryErrors.map((error) => `stateInventoryResidual: ${error.kind}: ${error.message}`));
         }
         results.push(result);
     }
@@ -767,11 +710,10 @@ async function cleanupOfflineOwnedComponents(options) {
     return leaseSafeRebuildResult({
         platforms: [...new Set(results.map((result) => result.target.platform))],
         plugins: results.filter((result) => result.status === 'succeeded').map((result) => result.target.pluginName),
-        warnings,
+        warnings: [...new Set(warnings)],
         rebuildResults: results,
         targetResults: results.map(toTargetResult),
         overallState: results.every((result) => result.status === 'succeeded') ? 'succeeded' : 'failed',
-        nativePlugins: {}, repoManagedArtifacts: [],
         receiptTargets: results.map((result) => ({
             pluginName: result.target.pluginName,
             pluginId: result.target.pluginId,
@@ -779,57 +721,188 @@ async function cleanupOfflineOwnedComponents(options) {
             platform: result.target.platform,
             scope: result.target.scope,
         })),
+        ...(options.evidence ? { offlineCleanupPlans: options.evidence } : {}),
     });
 }
+async function previewOfflineOwnedComponents(options) {
+    if (options.targets.some((target) => target.marketplaceIdentityUnresolved)) {
+        throw namespacedPreflightError('marketplaceIdentityUnavailable: Cannot uniquely recover the native marketplace name from live inventory or a canonical native registration path.', options.targets);
+    }
+    await options.onPreviewStage?.('inventory');
+    const preview = mergeRebuildCommandResults([]);
+    if (options.evidence)
+        preview.offlineCleanupPlans = options.evidence;
+    await options.onPreviewStage?.('dependencyPlan');
+    return preview;
+}
 async function assertOfflineCleanupDependents(options) {
-    const inventory = await inventoryCatalogSourceReferences({
-        cwd: options.cwd,
-        env: options.env,
-        includeHistoricalProjects: true,
+    const inventory = await options.readInventory({
+        cwd: options.cwd, env: options.env, includeHistoricalProjects: true,
     });
     const currentProjectKey = await resolveCanonicalRepoProjectKey(options.cwd);
+    const cleanupIds = new Set(options.targets.map((target) => target.pluginId));
     for (const target of options.targets) {
-        const pluginsRoot = path.join(resolveAwHome(options.env), 'marketplaces', target.sourceId, 'plugins');
-        const entries = await fs.readdir(pluginsRoot, { withFileTypes: true }).catch(() => []);
-        for (const entry of entries) {
-            if (!entry.isDirectory() || entry.name === target.pluginName)
-                continue;
-            const consumer = await readPluginManifest(path.join(pluginsRoot, entry.name), { mode: 'bundle' })
-                .catch(() => null);
+        const consumerNames = [...new Set(inventory.references.flatMap((reference) => (reference.kind === 'namespacedOwner'
+                || reference.kind === 'namespacedMarketplace'
+                || reference.kind === 'namespacedLifecycle')
+                && reference.sourceId === target.sourceId
+                && reference.sourceIdentity === target.sourceIdentity
+                && reference.pluginName
+                && reference.pluginName !== target.pluginName
+                && reference.platform === target.platform
+                && (target.scope === 'user' || reference.scope === 'project')
+                ? [reference.pluginName]
+                : []))];
+        const consumerPlugins = (await Promise.all(consumerNames.map((pluginName) => readOfflinePluginManifestCandidates({
+            target,
+            sourceIdentity: target.sourceIdentity,
+            pluginName,
+            env: options.env,
+            inventory,
+        })))).flat();
+        for (const consumer of consumerPlugins) {
             if (!consumer?.manifest.dependencies?.includes(target.pluginName))
                 continue;
             const consumerId = formatPluginId({ sourceId: target.sourceId, pluginName: consumer.manifest.name });
-            const live = inventory.references.some((reference) => (reference.kind === 'namespacedOwner' || reference.kind === 'namespacedMarketplace')
+            if (cleanupIds.has(consumerId))
+                continue;
+            const live = inventory.references.some((reference) => (reference.kind === 'namespacedOwner'
+                || reference.kind === 'namespacedMarketplace'
+                || reference.kind === 'namespacedLifecycle')
                 && reference.sourceId === target.sourceId
                 && reference.sourceIdentity === target.sourceIdentity
                 && reference.pluginName === consumer.manifest.name
                 && reference.platform === target.platform
                 && (target.scope === 'user' || reference.scope === 'project')
                 && (target.scope === 'user' || reference.projectKey === currentProjectKey));
-            if (live) {
+            if (live)
                 throw namespacedPreflightError(`dependencyStillRequired: ${target.pluginId} is required by ${consumerId}.`, options.targets);
+        }
+    }
+}
+async function readPluginManifestIfPresent(root) {
+    return readPluginManifest(root, { mode: 'bundle' }).catch(() => null);
+}
+async function readOfflinePluginManifestCandidates(options) {
+    const lifecycleRoots = options.inventory.references.flatMap((reference) => reference.kind === 'namespacedLifecycle'
+        && reference.sourceId === options.target.sourceId
+        && reference.sourceIdentity === options.sourceIdentity
+        && reference.pluginName === options.pluginName
+        ? [path.join(reference.location, 'bundle')]
+        : []);
+    const marketplaceRoot = path.join(resolveAwHome(options.env), 'marketplaces', options.target.sourceId);
+    const marketplace = await readStrictNamespacedMarketplaceRoot({
+        rootDir: marketplaceRoot,
+        sourceId: options.target.sourceId,
+    }).catch(() => null);
+    const marketplaceRoots = marketplace?.config.sourceIdentity === options.sourceIdentity
+        ? [marketplaceRoot]
+        : [];
+    const roots = [
+        ...lifecycleRoots,
+        ...marketplaceRoots.map((root) => path.join(root, 'plugins', options.pluginName)),
+    ];
+    const storeRoot = path.join(resolveAwHome(options.env), 'catalog-store');
+    const logicalEntries = await fs.readdir(storeRoot, { withFileTypes: true }).catch(() => []);
+    for (const logicalEntry of logicalEntries) {
+        if (!logicalEntry.isDirectory() || logicalEntry.isSymbolicLink())
+            continue;
+        const logicalRoot = path.join(storeRoot, logicalEntry.name);
+        const snapshotEntries = await fs.readdir(logicalRoot, { withFileTypes: true }).catch(() => []);
+        for (const snapshotEntry of snapshotEntries) {
+            if (!snapshotEntry.isDirectory()
+                || snapshotEntry.isSymbolicLink()
+                || !/^[0-9a-f]{64}$/u.test(snapshotEntry.name))
+                continue;
+            let logicalIdentity;
+            try {
+                logicalIdentity = decodeURIComponent(logicalEntry.name);
+            }
+            catch {
+                continue;
             }
+            const entry = await readCatalogStoreEntry({
+                logicalIdentity,
+                snapshotDigest: `sha256:${snapshotEntry.name}`,
+                env: options.env,
+            }).catch(() => null);
+            if (!entry)
+                continue;
+            const storeAnchor = await readPluginManifestIfPresent(path.join(entry.snapshotRoot, 'plugins', options.target.pluginName));
+            if (!storeAnchor || storeAnchor.manifest.name !== options.target.pluginName)
+                continue;
+            roots.push(path.join(entry.snapshotRoot, 'plugins', options.pluginName));
         }
     }
+    const plugins = await Promise.all([...new Set(roots)].map(readPluginManifestIfPresent));
+    return plugins.filter((plugin) => plugin !== null);
+}
+async function cleanupTargetIsDesired(options) {
+    const pending = options.roots.filter((root) => root.platforms.includes(options.target.platform));
+    const visited = new Set();
+    while (pending.length > 0) {
+        const root = pending.pop();
+        if (visited.has(root.pluginId))
+            continue;
+        visited.add(root.pluginId);
+        if (root.pluginId === options.target.pluginId)
+            return true;
+        const parsed = parsePluginId(root.pluginId);
+        if (parsed.sourceId !== options.target.sourceId)
+            continue;
+        const plugins = await readOfflinePluginManifestCandidates({
+            target: options.target,
+            sourceIdentity: options.target.sourceIdentity,
+            pluginName: parsed.pluginName,
+            env: options.env,
+            inventory: options.inventory,
+        });
+        pending.push(...plugins.flatMap((plugin) => plugin.manifest.dependencies ?? []).map((pluginName) => ({
+            pluginId: formatPluginId({ sourceId: parsed.sourceId, pluginName }),
+            platforms: [options.target.platform],
+        })));
+    }
+    return false;
 }
 export async function runRebuildCommand(options) {
     if (options.runtime?.catalogResolution && options.runtime.bypassDependencyPlan) {
         return runSingleSourceRebuildCommand(options);
     }
     const runtimeEnv = options.runtime?.env ?? process.env;
+    const readInventory = options.runtime?.inventoryCatalogSourceReferences
+        ?? inventoryCatalogSourceReferences;
+    let ordinaryInventory;
+    const readOrdinaryInventory = async () => {
+        ordinaryInventory ??= await measureCommandPerformanceStage(options.runtime, 'inventory', () => readInventory({
+            cwd: options.commandOptions.cwd,
+            env: runtimeEnv,
+            ...(options.command === 'cleanup' && options.all
+                ? { includeOrphanedCodexNativeResidue: true }
+                : {}),
+            ...(options.command === 'cleanup' && !options.all
+                ? {
+                    codexNativeResidueTargets: options.pluginNames.map((selector) => {
+                        const parsed = parsePluginId(selector);
+                        return {
+                            pluginName: parsed.pluginName,
+                            ...(parsed.sourceId ? { sourceId: parsed.sourceId } : {}),
+                        };
+                    }),
+                }
+                : {}),
+        }));
+        return ordinaryInventory;
+    };
     let requestedPluginNames = options.pluginNames;
     const cleanupForce = options.command === 'cleanup'
         && options.commandOptions.force === true;
+    const expectedOfflineCleanup = options.runtime?.expectedOfflineCleanupEvidence;
     let cleanupInventory;
     let cleanupLiveTargets = [];
-    let cleanupHasDamagedExclusiveTarget = false;
     let liveTargets = [];
     let legacyLiveTargets = [];
     if (options.command === 'cleanup' && !options.all) {
-        cleanupInventory = await inventoryCatalogSourceReferences({
-            cwd: options.commandOptions.cwd,
-            env: runtimeEnv,
-        });
+        cleanupInventory = await readOrdinaryInventory();
         const live = resolveLiveCleanupTargets({
             selectors: requestedPluginNames,
             platforms: selectedPlatforms(options.commandOptions.platform),
@@ -838,40 +911,30 @@ export async function runRebuildCommand(options) {
         });
         requestedPluginNames = live.selectors;
         cleanupLiveTargets = live.targets;
-        if (cleanupForce) {
-            const damagedTargets = (await Promise.all(requestedPluginNames.map(async (selector) => parsePluginId(selector).sourceId
-                ? discoverDamagedExclusiveCleanupTargets({
-                    selector,
-                    platforms: selectedPlatforms(options.commandOptions.platform),
-                    scope: options.commandOptions.scope,
-                    cwd: options.commandOptions.cwd,
-                    env: runtimeEnv,
+        if (expectedOfflineCleanup) {
+            const liveTarget = cleanupLiveTargets.find((target) => target.pluginId === expectedOfflineCleanup.pluginId
+                && target.pluginName === expectedOfflineCleanup.pluginName
+                && target.sourceId === expectedOfflineCleanup.sourceId
+                && target.sourceIdentity === expectedOfflineCleanup.sourceIdentity
+                && target.platform === expectedOfflineCleanup.platform
+                && target.scope === expectedOfflineCleanup.scope);
+            const actualOfflineCleanup = liveTarget
+                ? offlineCleanupEvidenceFromInventory({
+                    ...expectedOfflineCleanup,
+                    inventory: cleanupInventory,
                 })
-                : []))).flat();
-            cleanupHasDamagedExclusiveTarget = damagedTargets.length > 0;
-            cleanupLiveTargets = [...new Map([
-                    ...damagedTargets,
-                    ...cleanupLiveTargets,
-                ].map((target) => [[target.pluginId, target.platform, target.scope].join('\0'), target])).values()];
+                : null;
+            if (!liveTarget
+                || !actualOfflineCleanup
+                || !offlineCleanupEvidenceMatches(expectedOfflineCleanup, actualOfflineCleanup)) {
+                throw namespacedPreflightError('operationReviewStale: offline cleanup ownership evidence changed before mutation.', cleanupLiveTargets);
+            }
+            cleanupLiveTargets = [liveTarget];
         }
         liveTargets = cleanupLiveTargets;
     }
-    if (cleanupHasDamagedExclusiveTarget) {
-        return cleanupOfflineOwnedComponents({
-            targets: cleanupLiveTargets,
-            cwd: options.commandOptions.cwd,
-            env: runtimeEnv,
-            force: true,
-            removeObsoleteInstallationContracts: options.runtime?.removeObsoleteInstallationContracts,
-            nativeCliRunner: options.runtime?.nativeCliRunner,
-            corruptExclusiveDirectoryOperations: options.runtime?.corruptExclusiveDirectoryOperations,
-        });
-    }
     if (options.all) {
-        const inventory = await inventoryCatalogSourceReferences({
-            cwd: options.commandOptions.cwd,
-            env: runtimeEnv,
-        });
+        const inventory = await readOrdinaryInventory();
         if (options.command !== 'cleanup')
             assertCatalogSourceInventoryComplete(inventory);
         const requestedPlatforms = new Set(selectedPlatforms(options.commandOptions.platform));
@@ -902,6 +965,10 @@ export async function runRebuildCommand(options) {
                     ].join('\0'), target];
             })).values()];
         liveTargets = projectedTargets;
+        if (options.command === 'cleanup') {
+            cleanupInventory = inventory;
+            cleanupLiveTargets = projectedTargets;
+        }
         const identities = new Map();
         for (const reference of live) {
             if (!reference.sourceIdentity) {
@@ -924,38 +991,184 @@ export async function runRebuildCommand(options) {
         }
         return mergeRebuildCommandResults([]);
     }
+    if (options.command === 'cleanup') {
+        if (cleanupLiveTargets.some((target) => target.marketplaceIdentityUnresolved)) {
+            throw namespacedPreflightError('marketplaceIdentityUnavailable: Cannot uniquely recover the native marketplace name from live inventory or a canonical native registration path.', cleanupLiveTargets);
+        }
+        if (cleanupLiveTargets.length === 0) {
+            const configuredSnapshot = await readCatalogSourcesConfigSnapshot(runtimeEnv).catch(() => null);
+            const configuredSources = new Set(configuredSnapshot?.config.sources.map((source) => source.id) ?? []);
+            const requestedPlatforms = selectedPlatforms(options.commandOptions.platform);
+            const primarySource = configuredSnapshot?.config.sources.find((source) => source.primary)?.id;
+            const unresolvedTargets = requestedPluginNames.flatMap((selector) => {
+                const parsed = parsePluginId(selector);
+                const sourceId = parsed.sourceId ?? primarySource;
+                return sourceId ? requestedPlatforms.map((platform) => ({
+                    pluginId: formatPluginId({ sourceId, pluginName: parsed.pluginName }),
+                    pluginName: parsed.pluginName,
+                    sourceId,
+                    sourceIdentity: 'unavailable',
+                    platform,
+                    scope: options.commandOptions.scope,
+                })) : [];
+            });
+            const inventoryError = cleanupInventory?.errors.find((error) => error.relevance.global || unresolvedTargets.some((target) => !error.relevance.global
+                && (error.relevance.sourceId === undefined || error.relevance.sourceId === target.sourceId)
+                && (error.relevance.pluginName === undefined || error.relevance.pluginName === target.pluginName)
+                && (error.relevance.platform === undefined || error.relevance.platform === target.platform)
+                && (error.relevance.scope === undefined
+                    || error.relevance.scope === target.scope
+                    || target.platform === 'codex')));
+            if (inventoryError) {
+                throw namespacedPreflightError(`stateInventoryFailed: ${inventoryError.message}`, unresolvedTargets);
+            }
+            const missingTargets = requestedPluginNames.flatMap((selector) => {
+                const parsed = parsePluginId(selector);
+                return parsed.sourceId && !configuredSources.has(parsed.sourceId)
+                    ? requestedPlatforms.map((platform) => ({
+                        pluginId: selector,
+                        pluginName: parsed.pluginName,
+                        sourceId: parsed.sourceId,
+                        sourceIdentity: 'unavailable',
+                        platform,
+                        scope: options.commandOptions.scope,
+                    }))
+                    : [];
+            });
+            if (missingTargets.length > 0) {
+                throw namespacedPreflightError('sourceMissing: cleanup target source is unavailable.', missingTargets);
+            }
+            const result = mergeRebuildCommandResults([]);
+            if (cleanupForce && !options.runtime?.previewDependencyPlanOnly) {
+                try {
+                    await (options.runtime?.removeObsoleteInstallationContracts ?? fs.remove)(path.join(resolveAwHome(runtimeEnv), 'installation-contracts'));
+                }
+                catch (error) {
+                    result.warnings.push(`obsoleteContractsCleanupFailed: ${error instanceof Error ? error.message : String(error)}`);
+                }
+            }
+            return result;
+        }
+        const configuredSources = await readCatalogSourcesConfigSnapshot(runtimeEnv)
+            .then((snapshot) => new Set(snapshot.config.sources.map((source) => source.id)))
+            .catch(() => new Set());
+        if (!cleanupForce) {
+            await assertOfflineCleanupDependents({
+                targets: cleanupLiveTargets,
+                cwd: options.commandOptions.cwd,
+                env: runtimeEnv,
+                readInventory,
+            });
+        }
+        const desiredIntent = await readPluginIntentState({
+            scope: options.commandOptions.scope,
+            cwd: options.commandOptions.cwd,
+            env: runtimeEnv,
+        });
+        const desiredFlags = await Promise.all(cleanupLiveTargets.map((target) => cleanupTargetIsDesired({
+            target,
+            roots: desiredIntent.roots,
+            inventory: cleanupInventory,
+            env: runtimeEnv,
+        })));
+        const desiredTargets = cleanupLiveTargets.filter((_, index) => desiredFlags[index]);
+        const removalTargets = cleanupLiveTargets.filter((_, index) => !desiredFlags[index]);
+        if (removalTargets.length === 0) {
+            const result = desiredCleanupNoopResult(desiredTargets, options.commandOptions.cwd);
+            if (cleanupForce && !options.runtime?.previewDependencyPlanOnly) {
+                try {
+                    await (options.runtime?.removeObsoleteInstallationContracts ?? fs.remove)(path.join(resolveAwHome(runtimeEnv), 'installation-contracts'));
+                }
+                catch (error) {
+                    result.warnings.push(`obsoleteContractsCleanupFailed: ${error instanceof Error ? error.message : String(error)}`);
+                }
+            }
+            return leaseSafeRebuildResult(result);
+        }
+        const evidence = expectedOfflineCleanup
+            ? [expectedOfflineCleanup]
+            : removalTargets.flatMap((target) => {
+                const value = offlineCleanupEvidenceFromInventory({
+                    reason: configuredSources.has(target.sourceId) ? 'bundleUnavailable' : 'sourceMissing',
+                    pluginId: target.pluginId,
+                    pluginName: target.pluginName,
+                    sourceId: target.sourceId,
+                    sourceIdentity: target.sourceIdentity,
+                    platform: target.platform,
+                    scope: target.scope,
+                    inventory: cleanupInventory,
+                });
+                return value ? [value] : [];
+            });
+        if (options.runtime?.previewDependencyPlanOnly) {
+            const previewResult = await previewOfflineOwnedComponents({
+                targets: removalTargets,
+                evidence,
+                cwd: options.commandOptions.cwd,
+                env: runtimeEnv,
+                onPreviewStage: options.runtime.onPreviewStage,
+            });
+            return desiredTargets.length > 0
+                ? mergeRebuildCommandResults([
+                    desiredCleanupNoopResult(desiredTargets, options.commandOptions.cwd),
+                    previewResult,
+                ])
+                : previewResult;
+        }
+        const cleanupResult = await cleanupOfflineOwnedComponents({
+            targets: removalTargets,
+            evidence,
+            cwd: options.commandOptions.cwd,
+            env: runtimeEnv,
+            inventoryErrors: cleanupInventory.errors,
+            removeObsoleteInstallationContracts: options.runtime?.removeObsoleteInstallationContracts,
+            nativeCliRunner: options.runtime?.nativeCliRunner,
+            codexManager: options.runtime?.codexManager,
+        });
+        return desiredTargets.length > 0
+            ? mergeRebuildCommandResults([
+                desiredCleanupNoopResult(desiredTargets, options.commandOptions.cwd),
+                cleanupResult,
+            ])
+            : cleanupResult;
+    }
     try {
         if (options.runtime?.previewDependencyPlanOnly) {
             await options.runtime.onPreviewStage?.('catalog');
         }
+        if (options.runtime?.catalogBootstrapError !== undefined) {
+            throw options.runtime.catalogBootstrapError;
+        }
+        const catalogOperation = options.runtime?.catalogOperationContext
+            ?? await measureCommandPerformanceStage(options.runtime, 'catalog.load', () => resolveCatalogOperationContext({
+                ...(sourceIds ? { sourceIds } : {}),
+                env: runtimeEnv,
+            }));
+        if (options.runtime?.expectedGenerationSetDigest
+            && catalogOperation?.generationSetDigest !== options.runtime.expectedGenerationSetDigest) {
+            throw new Error('operationReviewStale: Active Catalog generation changed before mutation.');
+        }
         const resolvedResult = await withResolvedMultiSourceCatalog({
             cliVersion: resolveRuntimeCliVersion(),
-            freshnessPolicy: options.command === 'cleanup'
-                ? 'cacheFirst'
-                : options.runtime?.previewDependencyPlanOnly
-                    ? options.runtime.previewCatalogFreshnessPolicy ?? 'requireRemote'
-                    : 'requireRemote',
             ...(sourceIds ? { sourceIds } : {}),
+            ...(catalogOperation ? { operationContext: catalogOperation } : {}),
             env: runtimeEnv,
             consume: async (catalog) => {
                 const failedSources = catalog.sources.filter((source) => source.error);
                 if (failedSources.length > 0) {
                     throw namespacedPreflightError(`Cannot resolve required catalog sources: ${failedSources.map((source) => source.sourceId).join(', ')}.`, liveTargets, legacyLiveTargets);
                 }
-                const available = (await Promise.all(catalog.sources.map(async (item) => {
+                const availableEntries = catalog.sources.flatMap((item) => {
                     const source = item.resolution;
-                    const plugins = await resolvePluginsFromCatalog(source.rootDir, undefined);
-                    return plugins.map((plugin) => {
-                        const pluginId = formatPluginId({ sourceId: source.sourceId, pluginName: plugin.manifest.name });
-                        plugin.sourceId = source.sourceId;
-                        plugin.sourceIdentity = source.sourceIdentity;
-                        plugin.pluginId = pluginId;
-                        return { source, plugin, pluginId };
-                    });
-                }))).flat();
-                const selected = selectors.map((selector, index) => {
-                    const matches = available.filter((entry) => entry.plugin.manifest.name === selector.pluginName
-                        && (selector.sourceId === undefined || entry.source.sourceId === selector.sourceId));
+                    return source.manifest.entries.map((entry) => ({
+                        source,
+                        entry,
+                        pluginId: formatPluginId({ sourceId: source.sourceId, pluginName: entry.name }),
+                    }));
+                });
+                const selectedEntries = selectors.map((selector, index) => {
+                    const matches = availableEntries.filter((candidate) => candidate.entry.name === selector.pluginName
+                        && (selector.sourceId === undefined || candidate.source.sourceId === selector.sourceId));
                     if (matches.length === 0) {
                         throw new Error(`Plugin "${requestedPluginNames[index]}" does not exist in the required catalog source set.`);
                     }
@@ -967,6 +1180,74 @@ export async function runRebuildCommand(options) {
                 const dependencyEnabled = options.command === 'install'
                     || options.command === 'upgrade'
                     || options.command === 'reinstall';
+                const entryClosure = (roots) => {
+                    const result = [];
+                    const seen = new Set();
+                    const visiting = new Set();
+                    const byId = new Map(availableEntries.map((candidate) => [candidate.pluginId, candidate]));
+                    const visit = (candidate) => {
+                        if (seen.has(candidate.pluginId))
+                            return;
+                        if (visiting.has(candidate.pluginId))
+                            throw new Error(`Catalog dependency cycle includes "${candidate.pluginId}".`);
+                        visiting.add(candidate.pluginId);
+                        for (const dependency of candidate.entry.dependencies) {
+                            const dependencyId = formatPluginId({ sourceId: candidate.source.sourceId, pluginName: dependency });
+                            const resolved = byId.get(dependencyId);
+                            if (!resolved)
+                                throw new Error(`Catalog plugin "${candidate.pluginId}" depends on missing plugin "${dependency}".`);
+                            visit(resolved);
+                        }
+                        visiting.delete(candidate.pluginId);
+                        seen.add(candidate.pluginId);
+                        result.push(candidate);
+                    };
+                    for (const root of roots)
+                        visit(root);
+                    return result;
+                };
+                const removalConsumerEntries = options.command === 'cleanup' || options.command === 'uninstall'
+                    ? availableEntries.filter((candidate) => selectedEntries.some((selectedEntry) => candidate.source.sourceId === selectedEntry.source.sourceId
+                        && candidate.entry.dependencies.includes(selectedEntry.entry.name)))
+                    : [];
+                const removalDesiredEntries = options.command === 'cleanup' || options.command === 'uninstall'
+                    ? entryClosure(selectedEntries)
+                    : [];
+                const requiredEntryClosure = dependencyEnabled
+                    ? entryClosure(selectedEntries)
+                    : [...new Map([
+                            ...selectedEntries,
+                            ...removalDesiredEntries,
+                            ...removalConsumerEntries,
+                        ].map((candidate) => [candidate.pluginId, candidate])).values()];
+                if (dependencyEnabled) {
+                    for (const candidate of requiredEntryClosure) {
+                        const requiredCapabilities = candidate.entry.requires.aw.capabilities ?? [];
+                        const support = checkAwCapabilitySupport(requiredCapabilities, IMPLEMENTED_AW_CAPABILITIES);
+                        if (!support.supported) {
+                            throw new AwCapabilityUnsupportedError(candidate.pluginId, support.missing);
+                        }
+                    }
+                    await measureCommandPerformanceStage(options.runtime, 'catalog.validation', async () => {
+                        for (const item of catalog.sources) {
+                            const source = item.resolution;
+                            const names = requiredEntryClosure
+                                .filter((candidate) => candidate.source.sourceId === source.sourceId)
+                                .map((candidate) => candidate.entry.name);
+                            if (names.length > 0) {
+                                await validateCatalogSnapshotPluginEntriesComplete(source.rootDir, names);
+                            }
+                        }
+                    });
+                }
+                const available = await Promise.all(requiredEntryClosure.map(async (candidate) => {
+                    const plugin = await readPluginManifest(path.join(candidate.source.rootDir, 'plugins', candidate.entry.name), { mode: 'bundle' });
+                    plugin.sourceId = candidate.source.sourceId;
+                    plugin.sourceIdentity = candidate.source.sourceIdentity;
+                    plugin.pluginId = candidate.pluginId;
+                    return { source: candidate.source, plugin, pluginId: candidate.pluginId };
+                }));
+                const selected = selectedEntries.map((entry) => available.find((candidate) => candidate.pluginId === entry.pluginId));
                 const selectedIds = new Set(selected.map((entry) => entry.pluginId));
                 const resolveClosureEntries = (rootsBySource) => catalog.sources.flatMap((item) => {
                     const source = item.resolution;
@@ -993,7 +1274,9 @@ export async function runRebuildCommand(options) {
                 }
                 const closureEntries = dependencyEnabled
                     ? [...new Map([...closureEntriesByPlatform.values()].flat().map((entry) => [entry.pluginId, entry])).values()]
-                    : selected;
+                    : options.command === 'cleanup' || options.command === 'uninstall'
+                        ? resolveClosureEntries(selected)
+                        : selected;
                 const rawExecutionSelections = options.all
                     ? liveTargets.flatMap((target) => {
                         const entry = selected.find((candidate) => candidate.pluginId === target.pluginId);
@@ -1034,12 +1317,23 @@ export async function runRebuildCommand(options) {
                 if (options.runtime?.previewDependencyPlanOnly) {
                     await options.runtime.onPreviewStage?.('inventory');
                 }
-                const stateInventory = await inventoryCatalogSourceReferences({
-                    cwd: options.commandOptions.cwd,
-                    env: runtimeEnv,
-                });
+                const stateInventory = await readOrdinaryInventory();
                 if (options.command !== 'cleanup')
                     assertCatalogSourceInventoryComplete(stateInventory);
+                const hasCodexSelection = executionSelections.some((selection) => selection.platform === 'codex');
+                const intentBeforeByScope = hasCodexSelection || dependencyEnabled
+                    ? {
+                        user: await readPluginIntentState({
+                            scope: 'user', cwd: options.commandOptions.cwd, env: runtimeEnv,
+                        }),
+                        project: await readPluginIntentState({
+                            scope: 'project', cwd: options.commandOptions.cwd, env: runtimeEnv,
+                        }),
+                    }
+                    : {
+                        user: createEmptyPluginIntentState(),
+                        project: createEmptyPluginIntentState(),
+                    };
                 const commandProjectKey = await resolveCanonicalRepoProjectKey(options.commandOptions.cwd);
                 const codexScopePathsAlias = codexProjectConfigAliasesUserHome(options.commandOptions.cwd, runtimeEnv);
                 const selectedLegacy = selectedLegacyLiveReferences(stateInventory.references, new Set(executionSelections.map((selection) => selection.platform)), options.commandOptions.scope);
@@ -1121,22 +1415,33 @@ export async function runRebuildCommand(options) {
                     nativeCliRunner: options.runtime?.nativeCliRunner ?? getDefaultNativeCliRunner(),
                     reporter: options.runtime?.reporter ?? createNoopReporter(),
                     debugLogger: options.runtime?.debugLogger ?? createNoopDebugLogger(),
-                    runtimeLeaseHeld: options.runtime?.runtimeLeaseHeld,
-                    lifecycleLeaseHeld: options.runtime?.lifecycleLeaseHeld,
                     expectedCatalogConfigDigest: catalog.configDigest,
                 };
                 const inspection = createRebuildIntegration({
                     context: executionContext,
                     scriptTimeoutMs: options.commandOptions.scriptTimeoutMs,
                 });
-                const createPlan = async (preparedInventory) => {
-                    const inventory = preparedInventory ?? await inventoryCatalogSourceReferences({
-                        cwd: options.commandOptions.cwd,
-                        env: runtimeEnv,
-                    });
+                const selectedRootsForPlan = (plan) => [...new Map(plan.targets.flatMap((target) => target.relation === 'requested'
+                        ? [[target.pluginId, {
+                                    pluginId: target.pluginId,
+                                    platforms: plan.targets.flatMap((candidate) => candidate.relation === 'requested'
+                                        && candidate.pluginId === target.pluginId
+                                        ? [candidate.platform]
+                                        : []),
+                                }]]
+                        : [])).values()];
+                const createPlan = async (inventory) => {
                     if (options.command !== 'cleanup')
                         assertCatalogSourceInventoryComplete(inventory);
+                    const codexActivationSnapshots = executionSelections.some((selection) => selection.platform === 'codex')
+                        ? Object.fromEntries(await Promise.all(['user', 'project'].map(async (scope) => [
+                            scope,
+                            (await readCodexConfigFile(resolveCodexPaths(options.commandOptions.cwd, scope, runtimeEnv).configTomlPath)).snapshot,
+                        ])))
+                        : undefined;
                     const targets = [];
+                    const placementNodes = [];
+                    const blockingTargets = new Map();
                     for (const [order, { entry, platform }] of executionSelections.entries()) {
                         const relation = selectedIds.has(entry.pluginId) ? 'requested' : 'dependency';
                         let resolvedScope = options.commandOptions.scope;
@@ -1172,8 +1477,8 @@ export async function runRebuildCommand(options) {
                             const hasUnexpectedPresent = result.components.some((entry) => entry.state === 'present' && !required.has(entry.component) && !optional.has(entry.component));
                             const hasPartial = result.components.some((entry) => entry.state === 'partial');
                             const hasAnyPresent = result.components.some((entry) => entry.state === 'present');
-                            const state = !hasAnyPresent
-                                && result.components.every((entry) => entry.state === 'absent')
+                            const hasAnyOwned = hasAnyPresent || hasPartial;
+                            const state = !hasAnyOwned
                                 ? 'absent'
                                 : hasPartial || hasUnexpectedPresent || !presentRequired
                                     ? 'partial'
@@ -1189,26 +1494,90 @@ export async function runRebuildCommand(options) {
                                 ? Promise.resolve({ state: 'absent', components: [], errors: [] })
                                 : inspectScope(otherScope),
                         ]);
-                        let state = requestedInspection.state;
+                        const surface = platform === 'codex'
+                            ? analyzeCodexSurface(entry.plugin.manifest)
+                            : undefined;
+                        const codexPluginId = `${entry.plugin.manifest.name}@${marketplaceNameFor(entry, platform, resolvedScope)}`;
+                        const placementState = (inspected, scope) => {
+                            if (platform !== 'codex'
+                                || surface?.classification !== 'native'
+                                || options.command === 'cleanup'
+                                || options.command === 'uninstall')
+                                return inspected.state;
+                            const nativePresent = inspected.components.some((component) => component.component.kind === 'native-plugin' && component.state === 'present');
+                            return nativePresent
+                                && codexActivationSnapshots?.[scope].plugins[codexPluginId]?.enabled === true
+                                ? 'present'
+                                : 'absent';
+                        };
+                        const requestedPlacementState = placementState(requestedInspection, options.commandOptions.scope);
+                        let otherPlacementState = placementState(otherInspection, otherScope);
+                        if (surface?.classification === 'native'
+                            && requestedPlacementState === 'present'
+                            && otherPlacementState === 'present') {
+                            otherPlacementState = 'absent';
+                        }
+                        const allowedScopes = platform === 'codex'
+                            ? [
+                                ...(surface?.ok ? ['user'] : []),
+                                ...(surface?.ok && !codexScopePathsAlias ? ['project'] : []),
+                            ]
+                            : ['project', 'user'];
+                        if (allowedScopes.length === 0)
+                            allowedScopes.push(options.commandOptions.scope);
+                        placementNodes.push({
+                            pluginId: entry.pluginId,
+                            pluginName: entry.plugin.manifest.name,
+                            platform,
+                            relation,
+                            depth: order,
+                            allowedScopes,
+                            current: {
+                                project: options.commandOptions.scope === 'project'
+                                    ? requestedPlacementState
+                                    : otherPlacementState,
+                                user: options.commandOptions.scope === 'user'
+                                    ? requestedPlacementState
+                                    : otherPlacementState,
+                            },
+                        });
+                        let state = requestedPlacementState;
                         let action = relation === 'requested'
                             ? options.command
                             : options.command === 'reinstall' ? 'reinstall' : 'upgrade';
                         let errorCode;
                         const hasForeignCollision = [...requestedInspection.components, ...otherInspection.components]
-                            .some((component) => component.diagnostic?.includes('foreign collision'));
+                            .some((component) => component.collision !== undefined);
                         if (dependencyEnabled && hasForeignCollision) {
                             action = 'block';
                             errorCode = 'artifactCollision';
                         }
+                        else if (dependencyEnabled
+                            && platform === 'codex'
+                            && relation === 'requested'
+                            && surface?.scopeOverlap === 'aw-owned-conflict'
+                            && options.runtime?.reconcileIntentOnly !== true
+                            && !(options.command === 'install'
+                                && intentBeforeByScope[otherScope].roots.some((root) => root.pluginId === entry.pluginId && root.platforms.includes(platform)))
+                            && otherInspection.components.some((component) => component.state !== 'absent'
+                                && component.component.kind !== 'native-plugin'
+                                && !component.component.identity.artifactKey.startsWith('activation-')
+                                && !component.component.identity.artifactKey.startsWith('marketplace-'))) {
+                            action = 'block';
+                            errorCode = 'codexExtensionScopeConflict';
+                        }
                         else if (dependencyEnabled && relation === 'requested'
                             && (requestedInspection.state === 'error'
-                                || (requestedInspection.state === 'partial' && options.command !== 'reinstall'))) {
+                                || (requestedInspection.state === 'partial'
+                                    && platform !== 'codex'
+                                    && options.command !== 'reinstall'
+                                    && options.command !== 'cleanup'))) {
                             action = 'block';
                             errorCode = 'dependencyNotReady';
                         }
                         if (!hasForeignCollision && relation === 'dependency'
-                            && requestedInspection.state === 'present'
-                            && otherInspection.state === 'present') {
+                            && requestedPlacementState === 'present'
+                            && otherPlacementState === 'present') {
                             action = 'block';
                             state = 'partial';
                             errorCode = 'dependencyScopeConflict';
@@ -1221,24 +1590,26 @@ export async function runRebuildCommand(options) {
                         }
                         else if (!hasForeignCollision && relation === 'dependency'
                             && options.commandOptions.scope === 'project'
-                            && (otherInspection.state === 'partial' || otherInspection.state === 'error')) {
+                            && (otherPlacementState === 'partial' || otherPlacementState === 'error')) {
                             resolvedScope = 'user';
-                            state = otherInspection.state;
-                            if (otherInspection.state === 'error') {
+                            state = otherPlacementState;
+                            if (otherPlacementState === 'error') {
                                 action = 'block';
                                 errorCode = 'dependencyNotReady';
                             }
                         }
                         else if (!hasForeignCollision && relation === 'dependency'
                             && options.commandOptions.scope === 'user'
-                            && otherInspection.state !== 'absent') {
+                            && otherPlacementState !== 'absent') {
                             action = 'block';
                             errorCode = 'dependencyScopeTooNarrow';
                         }
                         const resolvedInspection = resolvedScope === options.commandOptions.scope
                             ? requestedInspection
                             : otherInspection;
-                        state = resolvedInspection.state;
+                        state = resolvedScope === options.commandOptions.scope
+                            ? requestedPlacementState
+                            : otherPlacementState;
                         if (!hasForeignCollision && !errorCode
                             && relation === 'dependency' && options.command === 'install') {
                             action = state === 'present' ? 'keep' : state === 'partial' ? 'reinstall' : 'install';
@@ -1249,13 +1620,6 @@ export async function runRebuildCommand(options) {
                             state = resolvedInspection.state;
                             errorCode ??= 'dependencyNotReady';
                         }
-                        if (!hasForeignCollision && relation === 'dependency'
-                            && platform === 'codex'
-                            && resolvedScope === 'project'
-                            && (entry.plugin.manifest.apps || !hasCodexProjectManagedArtifacts(entry.plugin))) {
-                            action = 'block';
-                            errorCode = 'dependencyTargetUnsupported';
-                        }
                         if (entry.plugin.manifest.config?.schema
                             && (action === 'install' || action === 'upgrade' || action === 'reinstall')) {
                             const effective = await resolveEffectivePluginConfig({
@@ -1278,6 +1642,12 @@ export async function runRebuildCommand(options) {
                             action = 'block';
                             errorCode = 'codexScopePathAlias';
                         }
+                        if (dependencyEnabled && platform === 'codex' && !surface?.ok) {
+                            action = 'block';
+                            errorCode = surface?.errorCode ?? 'codexNativeKindUnsupported';
+                        }
+                        if (errorCode)
+                            blockingTargets.set(`${entry.pluginId}\0${platform}`, errorCode);
                         targets.push({
                             pluginId: entry.pluginId,
                             pluginName: entry.plugin.manifest.name,
@@ -1295,6 +1665,46 @@ export async function runRebuildCommand(options) {
                             ...(errorCode ? { errorCode } : {}),
                         });
                     }
+                    if (dependencyEnabled) {
+                        const placement = createDependencyPlacementPlan({
+                            requestedPluginIds: selected.map((entry) => entry.pluginId),
+                            nodes: placementNodes,
+                            roots: placementNodes.flatMap((node) => selectedIds.has(node.pluginId)
+                                ? [{ pluginId: node.pluginId, platform: node.platform, scope: options.commandOptions.scope }]
+                                : []),
+                            dependencyEdges: closureEntries.flatMap((entry) => (entry.plugin.manifest.dependencies ?? []).flatMap((dependency) => {
+                                const dependencyId = formatPluginId({
+                                    sourceId: entry.source.sourceId,
+                                    pluginName: dependency,
+                                });
+                                return ['codex', 'claude'].flatMap((platform) => placementNodes.some((node) => node.pluginId === entry.pluginId && node.platform === platform)
+                                    && placementNodes.some((node) => node.pluginId === dependencyId && node.platform === platform)
+                                    ? [{ from: entry.pluginId, to: dependencyId, platform }]
+                                    : []);
+                            })),
+                            scopeOverrides: effectiveDependencyScopeOverrides({
+                                state: intentBeforeByScope[options.commandOptions.scope],
+                                explicit: options.commandOptions
+                                    .dependencyScopeOverrides ?? [],
+                                nodes: placementNodes,
+                                ignoredPersistedRootIds: selectedIds,
+                            }),
+                            operation: options.command,
+                        });
+                        return createDependencyOperationPlan({
+                            requestedPluginIds: placement.requestedPluginIds,
+                            resolvedPluginIds: placement.resolvedPluginIds,
+                            dependencyEdges: placement.dependencyEdges,
+                            scopeOverrides: placement.scopeOverrides,
+                            claimRoots: placement.claimRoots,
+                            targets: placement.targets.map((target) => {
+                                const errorCode = blockingTargets.get(`${target.pluginId}\0${target.platform}`);
+                                return errorCode
+                                    ? { ...target, action: 'block', errorCode }
+                                    : target;
+                            }),
+                        });
+                    }
                     return createDependencyOperationPlan({
                         requestedPluginIds: selected.map((entry) => entry.pluginId),
                         resolvedPluginIds: closureEntries.map((entry) => entry.pluginId),
@@ -1305,11 +1715,302 @@ export async function runRebuildCommand(options) {
                         targets,
                     });
                 };
+                const createCodexPlans = async (plan, activationSupport = 'observed') => {
+                    const codexTargets = plan.targets.filter((target) => target.platform === 'codex');
+                    const selectedRoots = selectedRootsForPlan(plan);
+                    const currentScope = options.commandOptions.scope;
+                    const otherScope = currentScope === 'user' ? 'project' : 'user';
+                    const reconciledCodexTargets = codexTargets;
+                    if (reconciledCodexTargets.length === 0)
+                        return [];
+                    const beforeByScope = intentBeforeByScope;
+                    const afterByScope = {
+                        user: beforeByScope.user,
+                        project: beforeByScope.project,
+                    };
+                    afterByScope[currentScope] = deriveDesiredIntentState({
+                        command: options.command,
+                        state: beforeByScope[currentScope],
+                        selectedRoots,
+                        plan,
+                        reconcileIntentOnly: options.runtime?.reconcileIntentOnly,
+                    });
+                    if (options.command === 'install' && options.runtime?.reconcileIntentOnly !== true) {
+                        let other = afterByScope[otherScope];
+                        for (const root of selectedRoots)
+                            other = removePluginIntentRootPlatforms(other, root);
+                        afterByScope[otherScope] = other;
+                    }
+                    const desiredScopesForEntry = (entry) => {
+                        const scopes = new Set();
+                        for (const intentScope of ['user', 'project']) {
+                            const intent = afterByScope[intentScope];
+                            for (const root of intent.roots.filter((candidate) => candidate.platforms.includes('codex'))) {
+                                const rootEntry = available.find((candidate) => candidate.pluginId === root.pluginId);
+                                if (!rootEntry || rootEntry.source.sourceId !== entry.source.sourceId)
+                                    continue;
+                                const sourcePlugins = available
+                                    .filter((candidate) => candidate.source.sourceId === entry.source.sourceId)
+                                    .map((candidate) => candidate.plugin);
+                                let closure;
+                                try {
+                                    closure = resolvePluginMetaDependencyClosure(sourcePlugins, [rootEntry.plugin.manifest.name]);
+                                }
+                                catch {
+                                    closure = [rootEntry.plugin];
+                                }
+                                if (!closure.some((plugin) => plugin.manifest.name === entry.plugin.manifest.name)) {
+                                    continue;
+                                }
+                                const currentPlannedScope = intentScope === currentScope
+                                    && selectedRoots.some((selectedRoot) => selectedRoot.pluginId === root.pluginId)
+                                    ? plan.targets.find((target) => target.pluginId === entry.pluginId && target.platform === 'codex')?.resolvedScope
+                                    : undefined;
+                                const override = intent.dependencyScopeOverrides.find((candidate) => candidate.pluginId === entry.pluginId && candidate.platform === 'codex');
+                                const reusedUserDependency = intentScope === 'project'
+                                    && root.pluginId !== entry.pluginId
+                                    && scopes.has('user');
+                                scopes.add(currentPlannedScope
+                                    ?? override?.scope
+                                    ?? (reusedUserDependency ? 'user' : intentScope));
+                            }
+                        }
+                        return [...scopes].sort();
+                    };
+                    const intentScopesForEntry = (entry) => {
+                        const scopes = new Set();
+                        for (const intentScope of ['user', 'project']) {
+                            for (const root of afterByScope[intentScope].roots.filter((candidate) => candidate.platforms.includes('codex'))) {
+                                const rootEntry = available.find((candidate) => candidate.pluginId === root.pluginId);
+                                if (!rootEntry || rootEntry.source.sourceId !== entry.source.sourceId)
+                                    continue;
+                                const sourcePlugins = available
+                                    .filter((candidate) => candidate.source.sourceId === entry.source.sourceId)
+                                    .map((candidate) => candidate.plugin);
+                                let closure;
+                                try {
+                                    closure = resolvePluginMetaDependencyClosure(sourcePlugins, [rootEntry.plugin.manifest.name]);
+                                }
+                                catch {
+                                    closure = [rootEntry.plugin];
+                                }
+                                if (closure.some((plugin) => plugin.manifest.name === entry.plugin.manifest.name)) {
+                                    scopes.add(intentScope);
+                                }
+                            }
+                        }
+                        return [...scopes].sort();
+                    };
+                    const inspectBothScopes = options.command !== 'cleanup' && options.command !== 'uninstall';
+                    const readActivationConfig = async (scope) => {
+                        return readCodexConfigFile(resolveCodexPaths(options.commandOptions.cwd, scope, runtimeEnv).configTomlPath);
+                    };
+                    const [userConfig, projectConfig] = await Promise.all([
+                        readActivationConfig('user'),
+                        readActivationConfig('project'),
+                    ]);
+                    const catalogClosure = [];
+                    const liveEvidence = [];
+                    for (const planned of reconciledCodexTargets) {
+                        const entry = available.find((candidate) => candidate.pluginId === planned.pluginId);
+                        const surface = analyzeCodexSurface(entry.plugin.manifest);
+                        const marketplaceName = marketplaceNameFor(entry, 'codex', planned.resolvedScope);
+                        const codexPluginId = `${entry.plugin.manifest.name}@${marketplaceName}`;
+                        const contentDigest = await calculateCodexSharedNativePayloadDigest(entry.plugin.rootDir);
+                        const desiredScopes = desiredScopesForEntry(entry);
+                        catalogClosure.push({
+                            pluginId: entry.pluginId,
+                            pluginName: entry.plugin.manifest.name,
+                            codexPluginId,
+                            version: entry.plugin.manifest.version,
+                            payloadDigest: contentDigest,
+                            relation: planned.relation,
+                            resolvedScope: planned.resolvedScope,
+                            desiredScopes,
+                            intentScopes: intentScopesForEntry(entry),
+                            surface,
+                        });
+                        const managedBefore = beforeByScope.user.managed.codexPluginIds.includes(codexPluginId)
+                            || beforeByScope.project.managed.codexPluginIds.includes(codexPluginId);
+                        const sharedInspection = surface.nativeKinds.length > 0
+                            ? await inspectCodexSharedNativeLive({
+                                pluginName: entry.plugin.manifest.name,
+                                desiredVersion: entry.plugin.manifest.version,
+                                expectedPayloadDigest: contentDigest,
+                                cwd: options.commandOptions.cwd,
+                                env: runtimeEnv,
+                                managedByCurrentIntent: managedBefore,
+                                marketplaceName,
+                                marketplaceRoot: path.join(resolveAwHome(runtimeEnv), 'marketplaces', entry.source.sourceId),
+                            })
+                            : undefined;
+                        const sharedNative = sharedInspection?.sharedNative
+                            ?? { state: 'absent', nativeAction: 'install' };
+                        const projectionEntries = [];
+                        const extensions = [];
+                        for (const scope of (inspectBothScopes
+                            ? ['user', 'project']
+                            : [currentScope])) {
+                            const desired = await inspection.buildTarget({
+                                sourceId: entry.source.sourceId,
+                                sourceIdentity: entry.source.sourceIdentity,
+                                pluginId: entry.pluginId,
+                                marketplaceName,
+                                marketplaceRoot: path.join(resolveAwHome(runtimeEnv), 'marketplaces', entry.source.sourceId),
+                                plugin: entry.plugin,
+                                platform: 'codex',
+                                scope,
+                                cwd: options.commandOptions.cwd,
+                                command: options.command,
+                                catalog: toCatalogResolution(entry.source),
+                                includeHistoricalLifecycleArtifacts: false,
+                                readOnlyInspectionPlan: true,
+                            });
+                            const inspected = await inspectOwnedComponents({
+                                components: desired.ownedComponents,
+                                nativeProbe: inspection.driver.probeNative,
+                                verifyHealth: true,
+                            });
+                            const projected = inspected.components.filter((component) => component.component.kind !== 'native-plugin'
+                                && !component.component.identity.artifactKey.startsWith('activation-')
+                                && !component.component.identity.artifactKey.startsWith('marketplace-'));
+                            projectionEntries.push(...projected.map((component) => ({
+                                scope,
+                                artifactKey: component.component.identity.artifactKey,
+                                state: component.state,
+                                collision: component.collision?.reason,
+                            })));
+                            const projectionState = projected.some((component) => component.collision)
+                                ? planned.action === 'block' ? 'absent' : 'foreign'
+                                : projected.some((component) => component.state === 'partial'
+                                    || component.state === 'error')
+                                    ? 'drifted'
+                                    : projected.some((component) => component.state === 'present')
+                                        ? 'present'
+                                        : 'absent';
+                            for (const component of surface.components.filter((candidate) => candidate.owner === 'aw')) {
+                                extensions.push({ componentKey: component.key, scope, state: projectionState });
+                            }
+                        }
+                        liveEvidence.push({
+                            codexPluginId,
+                            sharedNative,
+                            ...(sharedInspection?.actualPayloadDigest
+                                ? { sharedNativePayloadDigest: sharedInspection.actualPayloadDigest }
+                                : {}),
+                            ...(sharedInspection?.payloadPath
+                                ? { sharedNativePayloadPath: sharedInspection.payloadPath }
+                                : {}),
+                            ...(sharedNative.state === 'corrupt' ? { repairableSharedNative: true } : {}),
+                            activations: {
+                                user: userConfig?.snapshot.plugins[codexPluginId]?.enabled,
+                                project: projectConfig?.snapshot.plugins[codexPluginId]?.enabled,
+                            },
+                            extensions,
+                            projectionDigest: JSON.stringify(projectionEntries.sort((left, right) => `${left.scope}\0${left.artifactKey}`.localeCompare(`${right.scope}\0${right.artifactKey}`, 'en'))),
+                        });
+                    }
+                    return [createCodexReconcilePlan({
+                            scope: currentScope,
+                            cwd: options.commandOptions.cwd,
+                            operation: options.runtime?.reconcileIntentOnly ? 'sync' : options.command,
+                            intentBefore: beforeByScope[currentScope],
+                            intentAfter: afterByScope[currentScope],
+                            relatedIntentBefore: beforeByScope[otherScope],
+                            relatedIntentAfter: afterByScope[otherScope],
+                            catalogClosure,
+                            liveEvidence,
+                            activationSupport,
+                        })];
+                };
+                const operationNeedsNativeCli = async (platform, plan) => {
+                    for (const { entry, platform: selectedPlatform } of executionSelections) {
+                        if (selectedPlatform !== platform)
+                            continue;
+                        const planned = plan?.targets.find((target) => target.pluginId === entry.pluginId && target.platform === selectedPlatform);
+                        if (dependencyEnabled && (!planned
+                            || planned.action === 'keep'
+                            || planned.action === 'block'))
+                            continue;
+                        const scope = planned?.resolvedScope ?? options.commandOptions.scope;
+                        const marketplaceName = marketplaceNameFor(entry, selectedPlatform, scope);
+                        entry.plugin.marketplaceName = marketplaceName;
+                        const marketplaceRoot = path.join(resolveAwHome(runtimeEnv), 'marketplaces', entry.source.sourceId);
+                        if (!dependencyEnabled && selectedPlatform === 'codex') {
+                            continue;
+                        }
+                        const target = await inspection.buildTarget({
+                            sourceId: entry.source.sourceId,
+                            sourceIdentity: entry.source.sourceIdentity,
+                            pluginId: entry.pluginId,
+                            marketplaceName,
+                            marketplaceRoot,
+                            plugin: entry.plugin,
+                            platform: selectedPlatform,
+                            scope,
+                            cwd: options.commandOptions.cwd,
+                            command: dependencyEnabled
+                                ? planned.action
+                                : options.command,
+                            catalog: toCatalogResolution(entry.source),
+                            includeHistoricalLifecycleArtifacts: false,
+                            readOnlyInspectionPlan: true,
+                        });
+                        if (dependencyEnabled && (target.writeNativeRequired ?? target.requiresNative))
+                            return true;
+                        const nativeComponents = target.ownedComponents.filter((component) => component.kind === 'native-plugin'
+                            || (component.kind === 'shared-config'
+                                && component.identity.artifactKey.startsWith('marketplace-')));
+                        if (nativeComponents.length === 0)
+                            continue;
+                        const nativeInspection = await inspectOwnedComponents({
+                            components: nativeComponents,
+                            nativeProbe: inspection.driver.probeNative,
+                        });
+                        if (nativeInspection.components.some((component) => component.state === 'present' || component.state === 'partial')) {
+                            return true;
+                        }
+                    }
+                    return false;
+                };
                 if (options.runtime?.previewDependencyPlanOnly) {
                     await options.runtime.onPreviewStage?.('dependencyPlan');
-                    const initialPlan = await createPlan(stateInventory);
+                    const initialPlan = dependencyEnabled
+                        ? await measureCommandPerformanceStage(options.runtime, 'dependency.plan', () => createPlan(stateInventory))
+                        : undefined;
+                    const provisionalCodexPlans = initialPlan ? await createCodexPlans(initialPlan) : [];
+                    const previewNeedsNativeMaterialization = provisionalCodexPlans.some((plan) => plan.sharedNativeActions.some((action) => action.action === 'install'
+                        || action.action === 'replace'
+                        || action.action === 'repair'));
+                    const previewActivationOnlyProject = !previewNeedsNativeMaterialization
+                        && provisionalCodexPlans.some((plan) => plan.requirement.requiresProjectPluginContract
+                            && plan.postcheck.plugins.length > 0);
+                    const previewConsumer = previewActivationOnlyProject
+                        ? await (options.runtime?.codexOperationConsumerResolver ?? resolveCodexOperationConsumer)({
+                            cwd: options.commandOptions.cwd,
+                            env: runtimeEnv,
+                            runner: options.runtime?.nativeCliRunner ?? getDefaultNativeCliRunner(),
+                            operationRequirement: getCodexOperationRequirement('project'),
+                            requiresNativeMaterialization: false,
+                        })
+                        : undefined;
+                    const initialCodexPlans = initialPlan && previewConsumer?.support === 'assumed'
+                        ? await createCodexPlans(initialPlan, 'assumed')
+                        : provisionalCodexPlans;
                     const preview = mergeRebuildCommandResults([]);
-                    preview.dependencyPlan = initialPlan;
+                    if (initialPlan)
+                        preview.dependencyPlan = initialPlan;
+                    if (initialCodexPlans.length > 0)
+                        preview.codexReconcilePlans = initialCodexPlans;
+                    if (initialCodexPlans.some((plan) => plan.sharedNativeActions.some((action) => action.action === 'install'
+                        || action.action === 'replace'
+                        || action.action === 'repair'))) {
+                        preview.codexManagerPreview = await (options.runtime.codexManagerPreviewer ?? previewCodexManager)({
+                            cwd: options.commandOptions.cwd,
+                            env: runtimeEnv,
+                            runner: options.runtime?.nativeCliRunner,
+                        });
+                    }
                     return preview;
                 }
                 for (const { entry, platform } of executionSelections.filter((selection) => selectedIds.has(selection.entry.pluginId))) {
@@ -1326,6 +2027,9 @@ export async function runRebuildCommand(options) {
                             cwd: options.commandOptions.cwd,
                         },
                         configDigest: catalog.configDigest,
+                        ...(catalogOperation
+                            ? { generationSetDigest: catalogOperation.generationSetDigest }
+                            : {}),
                         sourceId: entry.source.sourceId,
                         sourceIdentity: entry.source.sourceIdentity,
                         resolvedCommit: entry.source.resolvedCommit,
@@ -1334,7 +2038,62 @@ export async function runRebuildCommand(options) {
                         contentDigest: entry.source.manifest.entries.find((candidate) => candidate.name === entry.plugin.manifest.name)?.contentDigest,
                     });
                 }
-                const lockedPlan = await createPlan();
+                const lockedPlan = await measureCommandPerformanceStage(options.runtime, 'dependency.plan', () => createPlan(stateInventory));
+                const provisionalLockedCodexPlans = await createCodexPlans(lockedPlan);
+                const codexManagerRequired = provisionalLockedCodexPlans.some((plan) => plan.sharedNativeActions.some((action) => action.action === 'install'
+                    || action.action === 'replace'
+                    || action.action === 'repair'));
+                const activationOnlyProjectOperation = !codexManagerRequired
+                    && provisionalLockedCodexPlans.some((plan) => plan.requirement.requiresProjectPluginContract
+                        && plan.postcheck.plugins.length > 0);
+                const activationConsumer = activationOnlyProjectOperation
+                    ? await (options.runtime?.codexOperationConsumerResolver ?? resolveCodexOperationConsumer)({
+                        cwd: options.commandOptions.cwd,
+                        env: runtimeEnv,
+                        runner: executionContext.nativeCliRunner,
+                        operationRequirement: getCodexOperationRequirement('project'),
+                        requiresNativeMaterialization: false,
+                    })
+                    : undefined;
+                const lockedCodexPlans = activationConsumer?.support === 'assumed'
+                    ? await createCodexPlans(lockedPlan, 'assumed')
+                    : provisionalLockedCodexPlans;
+                if (activationConsumer?.support === 'observed') {
+                    executionContext.codexManager = activationConsumer.manager;
+                }
+                if (options.runtime?.expectedOperationDependencyPlan
+                    && JSON.stringify(lockedPlan) !== JSON.stringify(options.runtime.expectedOperationDependencyPlan)) {
+                    throw namespacedPreflightError('operationReviewStale: dependency plan changed before mutation.', preflightTargets);
+                }
+                if (options.runtime?.expectedCodexReconcilePlans
+                    && JSON.stringify(lockedCodexPlans) !== JSON.stringify(options.runtime.expectedCodexReconcilePlans)) {
+                    throw namespacedPreflightError('operationReviewStale: Codex reconciliation evidence or plan changed before mutation.', preflightTargets);
+                }
+                if (options.runtime?.directCli
+                    && options.commandOptions.yes !== true
+                    && (options.command === 'install'
+                        || options.command === 'upgrade'
+                        || options.command === 'reinstall')) {
+                    const sharedNativeImpact = lockedCodexPlans.some((plan) => plan.review.requiresConfirmation);
+                    if (sharedNativeImpact) {
+                        throw namespacedPreflightError('sharedNativeImpactAuthorizationRequired: Replacing or force-reinstalling shared Codex native state requires --yes.', preflightTargets);
+                    }
+                }
+                let desiredIntent;
+                if (options.runtime?.awHomeMutationToken
+                    && !lockedPlan.targets.some((target) => target.action === 'block')) {
+                    const selectedRoots = selectedRootsForPlan(lockedPlan);
+                    desiredIntent = await writeDesiredIntentSuperset({
+                        command: options.command,
+                        cwd: options.commandOptions.cwd,
+                        scope: options.commandOptions.scope,
+                        selectedRoots,
+                        plan: lockedPlan,
+                        codexPlan: lockedCodexPlans[0],
+                        reconcileIntentOnly: options.runtime?.reconcileIntentOnly,
+                        env: runtimeEnv,
+                    });
+                }
                 for (const pluginName of new Set(lockedPlan.targets.flatMap((target) => target.platform === 'claude'
                     && (target.action === 'install'
                         || target.action === 'upgrade'
@@ -1347,29 +2106,76 @@ export async function runRebuildCommand(options) {
                         env: runtimeEnv,
                     });
                 }
-                await assertAgentVersions({
-                    platforms: [...new Set(executionSelections.flatMap(({ entry, platform }) => supportsPlatform(entry.plugin.manifest, platform) ? [platform] : []))],
+                const claudeCliRequired = await operationNeedsNativeCli('claude', lockedPlan);
+                const codexUserActivationDesired = new Set(lockedCodexPlans.flatMap((plan) => plan.activationActions.user.flatMap((action) => action.desired ? [action.codexPluginId] : [])));
+                executionContext.codexUserActivationDesired = codexUserActivationDesired;
+                if (codexManagerRequired) {
+                    const codexRequirementScope = lockedCodexPlans.some((plan) => plan.requirement.requiresProjectPluginContract)
+                        ? 'project'
+                        : 'user';
+                    if (options.runtime?.codexManagerResolver && codexManagerRequired) {
+                        executionContext.codexManager = await options.runtime.codexManagerResolver({
+                            cwd: options.commandOptions.cwd,
+                            env: runtimeEnv,
+                            runner: executionContext.nativeCliRunner,
+                            authorizer: options.runtime?.managedCodexAuthorizer,
+                            operationRequirement: getCodexOperationRequirement(codexRequirementScope),
+                        });
+                    }
+                    else {
+                        const consumer = await (options.runtime?.codexOperationConsumerResolver ?? resolveCodexOperationConsumer)({
+                            cwd: options.commandOptions.cwd,
+                            env: runtimeEnv,
+                            runner: executionContext.nativeCliRunner,
+                            authorizer: options.runtime?.managedCodexAuthorizer,
+                            operationRequirement: getCodexOperationRequirement(codexRequirementScope),
+                            requiresNativeMaterialization: codexManagerRequired,
+                        });
+                        if (consumer.support !== 'observed') {
+                            throw new Error('Codex native materialization requires an observed CLI consumer.');
+                        }
+                        executionContext.codexManager = consumer.manager;
+                    }
+                }
+                await assertClaudeVersion({
+                    platforms: claudeCliRequired ? ['claude'] : [],
                     cwd: options.commandOptions.cwd,
                     env: runtimeEnv,
-                    runtime: {
-                        env: runtimeEnv,
-                        nativeCliRunner: options.runtime?.nativeCliRunner ?? getDefaultNativeCliRunner(),
-                        reporter: options.runtime?.reporter ?? createNoopReporter(),
-                        debugLogger: options.runtime?.debugLogger ?? createNoopDebugLogger(),
-                    },
+                    runtime: executionContext,
+                });
+                const executionIntegration = createRebuildIntegration({
+                    context: executionContext,
+                    scriptTimeoutMs: options.commandOptions.scriptTimeoutMs,
                 });
                 const preparedTargets = new Map();
                 const preparedTargetErrors = new Map();
                 const lockedCollisionSelections = [];
                 for (const { entry, platform } of executionSelections) {
                     const planned = lockedPlan.targets.find((candidate) => candidate.pluginId === entry.pluginId && candidate.platform === platform);
+                    const desiredCleanup = platform === 'codex'
+                        && options.command === 'cleanup'
+                        && lockedCodexPlans.some((plan) => plan.desiredTargets.some((target) => target.pluginId === entry.pluginId && target.scopes.includes(planned.resolvedScope)));
+                    const reconcileObsolete = platform === 'codex'
+                        && options.runtime?.reconcileIntentOnly === true
+                        && lockedCodexPlans.some((plan) => plan.desiredTargets.some((target) => target.pluginId === entry.pluginId && !target.scopes.includes(planned.resolvedScope)));
+                    if (reconcileObsolete)
+                        continue;
                     if (planned.action !== 'install'
                         && planned.action !== 'upgrade'
-                        && planned.action !== 'reinstall')
+                        && planned.action !== 'reinstall'
+                        && planned.action !== 'move'
+                        && !desiredCleanup)
                         continue;
+                    const buildCommand = desiredCleanup
+                        ? 'install'
+                        : planned.action === 'move'
+                            ? 'install'
+                            : planned.relation === 'dependency'
+                                ? planned.action
+                                : options.command;
                     const marketplaceName = marketplaceNameFor(entry, platform, planned.resolvedScope);
                     try {
-                        const target = await inspection.buildTarget({
+                        const target = await measureCommandPerformanceStage(options.runtime, 'target.build', () => executionIntegration.buildTarget({
                             sourceId: entry.source.sourceId,
                             sourceIdentity: entry.source.sourceIdentity,
                             pluginId: entry.pluginId,
@@ -1379,21 +2185,27 @@ export async function runRebuildCommand(options) {
                             platform,
                             scope: planned.resolvedScope,
                             cwd: options.commandOptions.cwd,
-                            command: planned.relation === 'dependency' ? planned.action : options.command,
+                            command: buildCommand,
                             catalog: toCatalogResolution(entry.source),
                             includeHistoricalLifecycleArtifacts: true,
-                        });
+                        }));
+                        if (platform === 'codex') {
+                            const plannedNative = lockedCodexPlans.flatMap((plan) => plan.sharedNativeActions).find((action) => action.pluginId === entry.pluginId);
+                            if (plannedNative) {
+                                target.writeNativeRequired = plannedNative.action === 'install'
+                                    || plannedNative.action === 'replace'
+                                    || plannedNative.action === 'repair';
+                            }
+                        }
                         preparedTargets.set(`${entry.pluginId}\0${platform}`, {
                             target,
-                            driver: inspection.driver,
+                            driver: executionIntegration.driver,
                             context: executionContext,
                         });
-                        if (selectedIds.has(entry.pluginId)) {
-                            await rebuildCommandTestHooks?.afterTargetBuilt?.({
-                                command: options.command,
-                                identity: target.identity,
-                            });
-                        }
+                        await rebuildCommandTestHooks?.afterTargetBuilt?.({
+                            command: options.command,
+                            identity: target.identity,
+                        });
                         lockedCollisionSelections.push({
                             pluginId: entry.pluginId,
                             targetKey: `${platform}/${target.identity.scope}`,
@@ -1416,8 +2228,10 @@ export async function runRebuildCommand(options) {
                     throw namespacedPreflightError(`artifactCollision: ${lockedCollisions.map((collision) => `${collision.targetKey} (${collision.pluginIds.join(', ')})`).join('; ')}`, preflightTargets);
                 }
                 const removalRequiredConsumers = new Map();
-                if ((options.command === 'cleanup' && !cleanupForce) || options.command === 'uninstall') {
-                    const removalStateInventory = await inventoryCatalogSourceReferences({
+                if ((options.command === 'cleanup' && !cleanupForce)
+                    || options.command === 'uninstall'
+                    || options.runtime?.reconcileIntentOnly === true) {
+                    const removalStateInventory = await readInventory({
                         cwd: options.commandOptions.cwd,
                         env: runtimeEnv,
                         includeHistoricalProjects: true,
@@ -1560,6 +2374,32 @@ export async function runRebuildCommand(options) {
                         scope: planned.resolvedScope,
                         cwd: options.commandOptions.cwd,
                     };
+                    const codexReconcilePlan = platform === 'codex'
+                        ? lockedCodexPlans.find((plan) => plan.desiredTargets.some((target) => target.pluginId === entry.pluginId))
+                        : undefined;
+                    const desiredInCurrentScope = codexReconcilePlan?.desiredTargets.some((target) => target.pluginId === entry.pluginId && target.scopes.includes(planned.resolvedScope)) === true;
+                    const reconcileObsolete = platform === 'codex'
+                        && options.runtime?.reconcileIntentOnly === true
+                        && !desiredInCurrentScope;
+                    const desiredCleanupMutation = codexReconcilePlan !== undefined && (codexReconcilePlan.sharedNativeActions.some((action) => action.pluginId === entry.pluginId
+                        && (action.action === 'install'
+                            || action.action === 'replace'
+                            || action.action === 'repair'))
+                        || [...codexReconcilePlan.activationActions.user,
+                            ...codexReconcilePlan.activationActions.project].some((action) => action.pluginId === entry.pluginId && action.action !== 'none')
+                        || [...codexReconcilePlan.extensionWrites,
+                            ...codexReconcilePlan.extensionRemovals].some((action) => action.pluginId === entry.pluginId));
+                    const plannedNativeAction = codexReconcilePlan?.sharedNativeActions.find((action) => action.pluginId === entry.pluginId);
+                    const hasCodexExtensionMutation = codexReconcilePlan !== undefined
+                        && [...codexReconcilePlan.extensionWrites, ...codexReconcilePlan.extensionRemovals]
+                            .some((action) => action.pluginId === entry.pluginId);
+                    const reconcileActivationOnly = platform === 'codex'
+                        && plannedNativeAction !== undefined
+                        && (plannedNativeAction.action === 'reuse'
+                            || plannedNativeAction.action === 'claim'
+                            || plannedNativeAction.action === 'none')
+                        && !hasCodexExtensionMutation
+                        && entry.plugin.manifest.scripts?.lifecycle?.uninstall === undefined;
                     if (failedDependency || failedConsumer || planned.action === 'block') {
                         const code = failedConsumer
                             ? 'dependencyStillRequired'
@@ -1583,7 +2423,7 @@ export async function runRebuildCommand(options) {
                                     errorCode: code,
                                     message,
                                 }],
-                            overallState: 'failed', nativePlugins: {}, repoManagedArtifacts: [],
+                            overallState: 'failed',
                             receiptTargets: [{
                                     pluginName: identity.pluginName, pluginId: identity.pluginId,
                                     sourceId: identity.sourceId, platform, scope: planned.resolvedScope,
@@ -1592,7 +2432,68 @@ export async function runRebuildCommand(options) {
                         dependencyStates.set(`${entry.pluginId}\0${platform}`, failedDependency || failedConsumer ? 'skipped' : 'failed');
                         continue;
                     }
-                    if (planned.action === 'keep') {
+                    if (reconcileActivationOnly) {
+                        const preparedError = preparedTargetErrors.get(`${entry.pluginId}\0${platform}`);
+                        if (preparedError) {
+                            const message = preparedError instanceof Error
+                                ? preparedError.message
+                                : String(preparedError);
+                            const result = failedResult(options.command, identity, message);
+                            results.push({
+                                platforms: [platform], plugins: [], warnings: [], rebuildResults: [result],
+                                targetResults: [{
+                                        target: identity,
+                                        action: planned.action,
+                                        state: 'failed',
+                                        errorCode: message.split(':', 1)[0] ?? 'targetPreparationFailed',
+                                        message,
+                                    }],
+                                overallState: 'failed',
+                                receiptTargets: [{
+                                        pluginName: identity.pluginName, pluginId: identity.pluginId,
+                                        sourceId: identity.sourceId, platform, scope: planned.resolvedScope,
+                                    }],
+                            });
+                            dependencyStates.set(`${entry.pluginId}\0${platform}`, 'failed');
+                            continue;
+                        }
+                        const result = {
+                            status: 'succeeded', command: options.command, target: identity, actions: [],
+                            cleanupAttempted: false, removed: [], absent: [], residual: [], quarantined: [], failures: [],
+                        };
+                        results.push({
+                            platforms: [platform], plugins: [identity.pluginName], warnings: [], rebuildResults: [result],
+                            targetResults: [{ target: identity, action: planned.action, state: 'completed' }],
+                            overallState: 'succeeded',
+                            receiptTargets: [{
+                                    pluginName: identity.pluginName, pluginId: identity.pluginId,
+                                    sourceId: identity.sourceId, platform, scope: planned.resolvedScope,
+                                }],
+                        });
+                        dependencyStates.set(`${entry.pluginId}\0${platform}`, 'completed');
+                        continue;
+                    }
+                    if (platform === 'codex'
+                        && desiredInCurrentScope
+                        && (options.command === 'uninstall'
+                            || (options.command === 'cleanup' && !desiredCleanupMutation))) {
+                        const result = {
+                            status: 'succeeded', command: options.command, target: identity, actions: [],
+                            cleanupAttempted: false, removed: [], absent: [], residual: [], quarantined: [], failures: [],
+                        };
+                        results.push({
+                            platforms: [platform], plugins: [identity.pluginName], warnings: [], rebuildResults: [result],
+                            targetResults: [{ target: identity, action: 'keep', state: 'completed' }],
+                            overallState: 'succeeded',
+                            receiptTargets: [{
+                                    pluginName: identity.pluginName, pluginId: identity.pluginId,
+                                    sourceId: identity.sourceId, platform, scope: planned.resolvedScope,
+                                }],
+                        });
+                        dependencyStates.set(`${entry.pluginId}\0${platform}`, 'kept');
+                        continue;
+                    }
+                    if (planned.action === 'keep' && !reconcileObsolete) {
                         const result = {
                             status: 'succeeded', command: options.command, target: identity, actions: [],
                             cleanupAttempted: false, removed: [], absent: [], residual: [], quarantined: [], failures: [],
@@ -1600,7 +2501,7 @@ export async function runRebuildCommand(options) {
                         results.push({
                             platforms: [platform], plugins: [identity.pluginName], warnings: [], rebuildResults: [result],
                             targetResults: [{ target: identity, action: 'keep', state: 'completed' }],
-                            overallState: 'succeeded', nativePlugins: {}, repoManagedArtifacts: [],
+                            overallState: 'succeeded',
                             receiptTargets: [{
                                     pluginName: identity.pluginName, pluginId: identity.pluginId,
                                     sourceId: identity.sourceId, platform, scope: planned.resolvedScope,
@@ -1617,20 +2518,34 @@ export async function runRebuildCommand(options) {
                         marketplaceRoot: path.join(resolveAwHome(runtimeEnv), 'marketplaces', entry.source.sourceId),
                     };
                     entry.plugin.marketplaceName = marketplaceName;
+                    const reconcileDesiredCleanup = platform === 'codex'
+                        && options.command === 'cleanup'
+                        && desiredInCurrentScope;
                     const executionResult = await runSingleSourceRebuildCommand({
                         ...options,
-                        command: planned.relation === 'dependency'
-                            ? planned.action
-                            : options.command,
+                        command: reconcileObsolete
+                            ? 'cleanup'
+                            : reconcileDesiredCleanup
+                                ? 'install'
+                                : planned.action === 'move'
+                                    ? 'install'
+                                    : planned.relation === 'dependency'
+                                        ? planned.action
+                                        : options.command,
                         pluginNames: [entry.plugin.manifest.name],
                         all: false,
                         commandOptions: { ...options.commandOptions, platform, scope: planned.resolvedScope },
                         runtime: {
                             ...options.runtime,
                             env: runtimeEnv,
+                            ...(executionContext.codexManager
+                                ? { codexManager: executionContext.codexManager }
+                                : {}),
                             catalogResolution: toCatalogResolution(entry.source),
+                            resolvedCatalogPlugins: available
+                                .filter((candidate) => candidate.source.sourceId === entry.source.sourceId)
+                                .map((candidate) => candidate.plugin),
                             namespacedSource,
-                            operationLeaseHeld: true,
                             dependencyReviewPreflightHandled: true,
                             targetBuiltHookHandled: true,
                             preparedTarget: preparedTargets.get(`${entry.pluginId}\0${platform}`),
@@ -1639,6 +2554,9 @@ export async function runRebuildCommand(options) {
                             resolvedReviewEvidenceByPlugin: {
                                 [entry.plugin.manifest.name]: {
                                     configDigest: catalog.configDigest,
+                                    ...(catalogOperation
+                                        ? { generationSetDigest: catalogOperation.generationSetDigest }
+                                        : {}),
                                     sourceId: entry.source.sourceId,
                                     sourceIdentity: entry.source.sourceIdentity,
                                     resolvedCommit: entry.source.resolvedCommit,
@@ -1649,15 +2567,119 @@ export async function runRebuildCommand(options) {
                             },
                         },
                     });
+                    if (reconcileDesiredCleanup) {
+                        for (const result of executionResult.rebuildResults)
+                            result.command = 'cleanup';
+                        for (const result of executionResult.targetResults)
+                            result.action = 'cleanup';
+                    }
                     results.push(executionResult);
                     dependencyStates.set(`${entry.pluginId}\0${platform}`, executionResult.overallState === 'succeeded' ? 'completed' : 'failed');
                 }
+                if (lockedCodexPlans.length > 0
+                    && mergeRebuildCommandResults(results).overallState === 'succeeded') {
+                    try {
+                        await executeCodexReconcileActivations({
+                            plans: lockedCodexPlans,
+                            cwd: options.commandOptions.cwd,
+                            env: runtimeEnv,
+                            manager: executionContext.codexManager,
+                            runner: executionContext.nativeCliRunner,
+                        });
+                    }
+                    catch (error) {
+                        const selection = executionSelections.find((candidate) => candidate.platform === 'codex');
+                        if (!selection)
+                            throw error;
+                        const planned = lockedPlan.targets.find((target) => target.pluginId === selection.entry.pluginId && target.platform === 'codex');
+                        const identity = {
+                            sourceId: selection.entry.source.sourceId,
+                            sourceIdentity: selection.entry.source.sourceIdentity,
+                            pluginId: selection.entry.pluginId,
+                            pluginName: selection.entry.plugin.manifest.name,
+                            pluginVersion: selection.entry.plugin.manifest.version,
+                            platform: 'codex',
+                            scope: planned.resolvedScope,
+                            cwd: options.commandOptions.cwd,
+                        };
+                        const message = error instanceof Error ? error.message : String(error);
+                        const failed = failedResult(options.command, identity, message, 'postcheck.inspect');
+                        results.push({
+                            platforms: ['codex'],
+                            plugins: [],
+                            warnings: [],
+                            rebuildResults: [failed],
+                            targetResults: [{
+                                    target: identity,
+                                    action: options.command,
+                                    state: 'failed',
+                                    errorCode: message.split(':', 1)[0] ?? 'codexActivationPostcheckFailed',
+                                    message,
+                                }],
+                            overallState: 'failed',
+                            receiptTargets: [{
+                                    pluginName: identity.pluginName,
+                                    pluginId: identity.pluginId,
+                                    sourceId: identity.sourceId,
+                                    platform: 'codex',
+                                    scope: identity.scope,
+                                }],
+                        });
+                    }
+                }
+                if (options.command === 'install'
+                    && mergeRebuildCommandResults(results).overallState === 'succeeded') {
+                    for (const { entry, platform } of executionSelections) {
+                        const planned = lockedPlan.targets.find((target) => target.pluginId === entry.pluginId && target.platform === platform);
+                        if (planned.action !== 'move'
+                            || dependencyStates.get(`${entry.pluginId}\0${platform}`) !== 'completed')
+                            continue;
+                        const previousScope = planned.resolvedScope === 'user' ? 'project' : 'user';
+                        const marketplaceName = marketplaceNameFor(entry, platform, previousScope);
+                        entry.plugin.marketplaceName = marketplaceName;
+                        const migration = await runSingleSourceRebuildCommand({
+                            command: 'cleanup',
+                            pluginNames: [entry.plugin.manifest.name],
+                            commandOptions: { ...options.commandOptions, platform, scope: previousScope },
+                            runtime: {
+                                ...options.runtime,
+                                env: runtimeEnv,
+                                ...(executionContext.codexManager
+                                    ? { codexManager: executionContext.codexManager }
+                                    : {}),
+                                catalogResolution: toCatalogResolution(entry.source),
+                                resolvedCatalogPlugins: available
+                                    .filter((candidate) => candidate.source.sourceId === entry.source.sourceId)
+                                    .map((candidate) => candidate.plugin),
+                                namespacedSource: {
+                                    sourceId: entry.source.sourceId,
+                                    sourceIdentity: entry.source.sourceIdentity,
+                                    marketplaceName,
+                                    marketplaceRoot: path.join(resolveAwHome(runtimeEnv), 'marketplaces', entry.source.sourceId),
+                                },
+                                dependencyReviewPreflightHandled: true,
+                                bypassDependencyPlan: true,
+                            },
+                        });
+                        results.push(migration);
+                        if (migration.overallState !== 'succeeded') {
+                            dependencyStates.set(`${entry.pluginId}\0${platform}`, 'failed');
+                        }
+                    }
+                }
                 const merged = mergeRebuildCommandResults(results);
                 merged.dependencyPlan = lockedPlan;
+                if (lockedCodexPlans.length > 0)
+                    merged.codexReconcilePlans = lockedCodexPlans;
+                if (desiredIntent && merged.overallState === 'succeeded') {
+                    for (const intent of desiredIntent) {
+                        await writePluginIntentState(intent.location, convergePluginIntentManagedCodexOwnership(intent.superset, intent.convergedCodexPluginIds));
+                    }
+                }
                 return leaseSafeRebuildResult(merged);
             },
         });
-        if (cleanupForce) {
+        if (cleanupForce && !options.runtime?.previewDependencyPlanOnly) {
             try {
                 await (options.runtime?.removeObsoleteInstallationContracts ?? fs.remove)(path.join(resolveAwHome(runtimeEnv), 'installation-contracts'));
             }
@@ -1672,37 +2694,16 @@ export async function runRebuildCommand(options) {
             const projected = error;
             error = namespacedPreflightError(error instanceof Error ? error.message : String(error), projected.namespacedTargets ?? liveTargets, projected.legacyTargets ?? legacyLiveTargets);
         }
-        if (options.command !== 'cleanup' && options.command !== 'uninstall')
+        if (options.command !== 'uninstall')
             throw error;
         const message = error instanceof Error ? error.message : String(error);
-        const catalogUnavailable = message.startsWith('Cannot resolve required catalog sources:')
-            || message.includes('does not exist in the required catalog source set')
-            || (message.includes('Catalog source') && message.includes('does not exist'));
-        if (options.command === 'cleanup'
-            && (catalogUnavailable || message.includes('sourceChanged'))
-            && cleanupInventory
-            && cleanupLiveTargets.length > 0) {
-            if (!cleanupForce) {
-                await assertOfflineCleanupDependents({
-                    targets: cleanupLiveTargets,
-                    cwd: options.commandOptions.cwd,
-                    env: runtimeEnv,
-                });
-            }
-            return cleanupOfflineOwnedComponents({
-                targets: cleanupLiveTargets,
-                cwd: options.commandOptions.cwd,
-                env: runtimeEnv,
-                force: cleanupForce,
-                removeObsoleteInstallationContracts: options.runtime?.removeObsoleteInstallationContracts,
-                nativeCliRunner: options.runtime?.nativeCliRunner,
-                corruptExclusiveDirectoryOperations: options.runtime?.corruptExclusiveDirectoryOperations,
-            });
-        }
+        const catalogUnavailable = isOfflineCleanupCatalogGenerationError(error)
+            || message.startsWith('Cannot resolve required catalog sources:')
+            || message.includes('does not exist in the required catalog source set');
         if (options.command === 'uninstall' && catalogUnavailable) {
             throw namespacedPreflightError(`catalogSourceUnavailable: ${message} Restore the source to run lifecycle uninstall, or use cleanup; use cleanup --force only for exclusively owned damaged output.`, liveTargets, legacyLiveTargets);
         }
-        if ((message.includes('Catalog source') && message.includes('does not exist'))
+        if (catalogGenerationErrorCode(error) === 'catalogGenerationSourceMissing'
             || message.includes('does not exist in the required catalog source set')) {
             throw namespacedPreflightError(`sourceMissing: ${message} Run cleanup for owner recovery, or cleanup --force for an exclusively owned damaged target.`, liveTargets, legacyLiveTargets);
         }