@lesliechan721/aw 0.1.0-beta.8 → 0.1.0-beta.9

package/dist/src/commands/rebuild-command.js

@@ -1,31 +1,62 @@
 import path from 'node:path';
 import fs from 'fs-extra';
-import { probeAgentVersion } from '../utils/agent-version.js';
-import { previewCodexManager, resolveCodexManager, } from '../utils/codex-manager.js';
+import { getCodexOperationRequirement, probeAgentVersion } from '../utils/agent-version.js';
+import { previewCodexManager, resolveCodexOperationConsumer, } from '../utils/codex-manager.js';
 import { createNoopDebugLogger } from '../output/debug-log.js';
 import { createNoopReporter } from '../output/reporter.js';
 import { getDefaultNativeCliRunner } from '../utils/native-cli.js';
 import { readPluginManifest } from '../utils/manifest.js';
-import { resolveAwHome } from '../utils/paths.js';
+import { resolveAwHome, resolveCodexPaths } from '../utils/paths.js';
 import { resolveCliPackageRoot } from '../utils/paths.js';
 import { supportsPlatform } from '../utils/platform-support.js';
-import { hasCodexProjectManagedArtifacts } from '../utils/codex-project-surface.js';
+import { analyzeCodexSurface } from '../utils/codex-surface-analysis.js';
+import { createCodexReconcilePlan, } from '../utils/codex-reconciler.js';
+import { readCodexConfigFile } from '../utils/codex-config.js';
 import { createRebuildActiveStore, executeRebuildOperation, } from './rebuild-operations.js';
-import { assertNoClaudeUnboundNativeNameCollision, codexNativeRemovalRequired, createRebuildIntegration, discoverRebuildTargetNames, inspectNativeMarketplaceRegistrations, } from './rebuild-integration.js';
-import { getNamespacedMarketplaceName } from '../utils/local-marketplace.js';
+import { assertNoClaudeUnboundNativeNameCollision, createRebuildIntegration, discoverRebuildTargetNames, executeCodexReconcileActivations, inspectCodexSharedNativeLive, inspectNativeMarketplaceRegistrations, } from './rebuild-integration.js';
+import { getNamespacedMarketplaceName, readStrictNamespacedMarketplaceRoot, } from '../utils/local-marketplace.js';
 import { formatPluginId, parsePluginId, planPluginSelectorSourceIds, preflightDesiredArtifactCollisions, withResolvedMultiSourceCatalog, } from '../utils/multi-source-catalog.js';
+import { calculateCodexSharedNativePayloadDigest } from '../utils/catalog-digests.js';
 import { resolveCatalogOperationContext, } from '../utils/catalog-operation-context.js';
 import { assertStrictSemVer } from '../utils/manifest.js';
 import { assertCatalogSourceInventoryComplete, canonicalMarketplaceRegistrationNames, inventoryCatalogSourceReferences, } from '../utils/catalog-source-references.js';
 import { resolveEffectivePluginConfig } from '../utils/plugin-config.js';
-import { cleanupCorruptExclusivePluginDirectory, inspectOwnedComponents, } from '../utils/ownership.js';
-import { codexProjectConfigAliasesUserHome, getClaudeHome, getCodexHome, resolveCanonicalRepoProjectKey, resolveRepoRootSync, } from '../utils/state-paths.js';
+import { inspectOwnedComponents, } from '../utils/ownership.js';
+import { codexProjectConfigAliasesUserHome, resolveCanonicalRepoProjectKey, } from '../utils/state-paths.js';
 import { resolvePluginMetaDependencyClosure } from '../utils/plugin-dependencies.js';
+import { readCatalogSourcesConfigSnapshot } from '../utils/catalog-sources.js';
+import { readCatalogStoreEntry } from '../utils/catalog-generation-store.js';
+import { catalogGenerationErrorCode, isOfflineCleanupCatalogGenerationError, } from '../utils/catalog-generation-error.js';
+import { canonicalizePluginIntentState, convergePluginIntentManagedCodexOwnership, createEmptyPluginIntentState, mergePluginIntentRootPlatforms, readPluginIntentState, removePluginIntentRootPlatforms, widenPluginIntentManagedCodexOwnership, writePluginIntentState, } from '../utils/plugin-intent-state.js';
 import { validateCatalogSnapshotPluginEntriesComplete } from '../utils/catalog-snapshot.js';
 import { AwCapabilityUnsupportedError, IMPLEMENTED_AW_CAPABILITIES, } from './aw-capabilities.js';
 import { checkAwCapabilitySupport } from '../utils/manifest.js';
-import { createDependencyOperationPlan, } from './dependency-operation-plan.js';
+import { createDependencyOperationPlan, createDependencyPlacementPlan, } from './dependency-operation-plan.js';
 import { offlineCleanupEvidenceFromInventory, offlineCleanupEvidenceMatches, } from './offline-cleanup-evidence.js';
+async function measureCommandPerformanceStage(runtime, name, operation) {
+    const startedAt = Date.now();
+    let phase = 'success';
+    try {
+        return await operation();
+    }
+    catch (error) {
+        phase = 'failure';
+        throw error;
+    }
+    finally {
+        await Promise.resolve().then(() => runtime?.debugLogger?.log({
+            type: 'performance:stage',
+            level: 'debug',
+            target: 'debugLog',
+            message: 'Command performance stage completed.',
+            data: {
+                name,
+                phase,
+                durationMs: Math.max(0, Date.now() - startedAt),
+            },
+        })).catch(() => undefined);
+    }
+}
 let rebuildCommandTestHooks;
 async function emitRebuildActionEvent(runtime, event) {
     await Promise.allSettled([
@@ -39,6 +70,81 @@ export function setRebuildCommandTestHooksForTests(hooks) {
 function selectedPlatforms(selection) {
     return selection === 'both' ? ['codex', 'claude'] : [selection];
 }
+function updateIntentOverrides(options) {
+    const plannedKeys = new Set(options.plan.targets.map((target) => `${target.pluginId}\0${target.platform}`));
+    return canonicalizePluginIntentState({
+        ...options.state,
+        dependencyScopeOverrides: [
+            ...options.state.dependencyScopeOverrides.filter((override) => !plannedKeys.has(`${override.pluginId}\0${override.platform}`)),
+            ...options.plan.scopeOverrides,
+        ],
+    });
+}
+function effectiveDependencyScopeOverrides(options) {
+    const nodeKeys = new Set(options.nodes.map((node) => `${node.pluginId}\0${node.platform}`));
+    const explicitMatches = (pluginId, platform) => options.explicit.some((override) => override.pluginId === pluginId
+        && (override.platform === undefined || override.platform === platform));
+    return [
+        ...options.state.dependencyScopeOverrides.filter((override) => nodeKeys.has(`${override.pluginId}\0${override.platform}`)
+            && !options.ignoredPersistedRootIds?.has(override.pluginId)
+            && !explicitMatches(override.pluginId, override.platform)),
+        ...options.explicit.filter((override) => options.nodes.some((node) => node.pluginId === override.pluginId
+            && (override.platform === undefined || node.platform === override.platform))),
+    ];
+}
+function deriveDesiredIntentState(options) {
+    if (options.reconcileIntentOnly)
+        return options.state;
+    let next = options.state;
+    if (options.command === 'install') {
+        for (const root of options.selectedRoots)
+            next = mergePluginIntentRootPlatforms(next, root);
+        next = updateIntentOverrides({ state: next, plan: options.plan });
+    }
+    else if (options.command === 'uninstall') {
+        for (const root of options.selectedRoots)
+            next = removePluginIntentRootPlatforms(next, root);
+    }
+    return next;
+}
+async function writeDesiredIntentSuperset(options) {
+    const location = { scope: options.scope, cwd: options.cwd, env: options.env };
+    let next = deriveDesiredIntentState({
+        command: options.command,
+        state: await readPluginIntentState(location),
+        selectedRoots: options.selectedRoots,
+        plan: options.plan,
+        reconcileIntentOnly: options.reconcileIntentOnly,
+    });
+    const convergedCodexPluginIds = options.codexPlan?.managedInventory.converged
+        ?? next.managed.codexPluginIds;
+    const superset = options.codexPlan
+        ? widenPluginIntentManagedCodexOwnership(next, options.codexPlan.managedInventory.ownershipSuperset)
+        : next;
+    await writePluginIntentState(location, superset);
+    const writes = [{ location, superset, convergedCodexPluginIds }];
+    if (options.command === 'install' || options.codexPlan) {
+        const otherScope = options.scope === 'user' ? 'project' : 'user';
+        const otherLocation = { scope: otherScope, cwd: options.cwd, env: options.env };
+        let other = await readPluginIntentState(otherLocation);
+        if (options.command === 'install' && !options.reconcileIntentOnly) {
+            for (const root of options.selectedRoots)
+                other = removePluginIntentRootPlatforms(other, root);
+        }
+        const otherConvergedCodexPluginIds = options.codexPlan?.managedInventory.related.converged
+            ?? other.managed.codexPluginIds;
+        const otherSuperset = options.codexPlan
+            ? widenPluginIntentManagedCodexOwnership(other, options.codexPlan.managedInventory.related.ownershipSuperset)
+            : other;
+        await writePluginIntentState(otherLocation, otherSuperset);
+        writes.push({
+            location: otherLocation,
+            superset: otherSuperset,
+            convergedCodexPluginIds: otherConvergedCodexPluginIds,
+        });
+    }
+    return writes;
+}
 function createSyntheticPlugin(pluginName, env) {
     const rootDir = path.join(resolveAwHome(env), 'plugins', pluginName);
     return {
@@ -243,24 +349,6 @@ async function runSingleSourceRebuildCommand(options) {
                 results.push(failedResult(options.command, identity, 'codexScopePathAlias: Codex project config 与用户配置目录相同。请进入实际项目目录后重试。'));
                 continue;
             }
-            if (currentPlugin
-                && platform === 'codex'
-                && options.commandOptions.scope === 'project'
-                && options.command !== 'cleanup'
-                && options.command !== 'uninstall'
-                && currentPlugin.manifest.apps) {
-                results.push(failedResult(options.command, identity, `${pluginName} 声明了 apps；Codex project scope 不支持 apps。`));
-                continue;
-            }
-            if (currentPlugin
-                && platform === 'codex'
-                && options.commandOptions.scope === 'project'
-                && options.command !== 'cleanup'
-                && options.command !== 'uninstall'
-                && !hasCodexProjectManagedArtifacts(currentPlugin)) {
-                results.push(failedResult(options.command, identity, `${pluginName} 没有 Codex project scope 可生成的 Skills、instructions、roles、MCP、hooks 或 permissions。`));
-                continue;
-            }
             let result;
             try {
                 if (options.runtime?.preparedTargetError)
@@ -310,17 +398,6 @@ async function runSingleSourceRebuildCommand(options) {
         }
     }
     const successful = results.filter((result) => result.status === 'succeeded');
-    const artifacts = targets.flatMap((target) => [...target.artifacts]);
-    const nativePlugins = {};
-    for (const result of successful) {
-        const target = targets.find((entry) => entry.identity.pluginName === result.target.pluginName
-            && entry.identity.platform === result.target.platform
-            && entry.identity.scope === result.target.scope);
-        if (target?.requiresNative && options.command !== 'cleanup' && options.command !== 'uninstall') {
-            nativePlugins[result.target.platform] ??= [];
-            nativePlugins[result.target.platform].push(result.target.pluginName);
-        }
-    }
     return {
         platforms,
         plugins: [...new Set(successful.map((result) => result.target.pluginName))],
@@ -328,8 +405,6 @@ async function runSingleSourceRebuildCommand(options) {
         rebuildResults: results,
         targetResults: results.map(toTargetResult),
         overallState: results.every((result) => result.status === 'succeeded') ? 'succeeded' : 'failed',
-        nativePlugins,
-        repoManagedArtifacts: artifacts,
         receiptTargets: results.map((result) => ({
             pluginName: result.target.pluginName,
             ...(result.target.sourceId ? {
@@ -356,14 +431,6 @@ function toCatalogResolution(source) {
 function mergeRebuildCommandResults(results) {
     const rebuildResults = results.flatMap((result) => result.rebuildResults);
     const platforms = [...new Set(results.flatMap((result) => result.platforms))];
-    const nativePlugins = {};
-    for (const result of results) {
-        for (const platform of ['codex', 'claude']) {
-            const names = result.nativePlugins[platform];
-            if (names)
-                nativePlugins[platform] = [...new Set([...(nativePlugins[platform] ?? []), ...names])];
-        }
-    }
     return {
         platforms,
         plugins: [...new Set(results.flatMap((result) => result.plugins))],
@@ -373,8 +440,6 @@ function mergeRebuildCommandResults(results) {
         overallState: rebuildResults.every((result) => result.status === 'succeeded')
             ? 'succeeded'
             : 'failed',
-        nativePlugins,
-        repoManagedArtifacts: [],
         receiptTargets: results.flatMap((result) => result.receiptTargets),
         ...(results.find((result) => result.dependencyPlan)?.dependencyPlan
             ? { dependencyPlan: results.find((result) => result.dependencyPlan).dependencyPlan }
@@ -382,13 +447,15 @@ function mergeRebuildCommandResults(results) {
         ...(results.find((result) => result.codexManagerPreview)?.codexManagerPreview
             ? { codexManagerPreview: results.find((result) => result.codexManagerPreview).codexManagerPreview }
             : {}),
+        ...(results.some((result) => result.offlineCleanupPlans !== undefined)
+            ? { offlineCleanupPlans: results.flatMap((result) => result.offlineCleanupPlans ?? []) }
+            : {}),
     };
 }
 function leaseSafeRebuildResult(result) {
     const projectPath = (value) => path.basename(value);
     return {
         ...result,
-        repoManagedArtifacts: [],
         rebuildResults: result.rebuildResults.map((entry) => ({
             ...entry,
             target: { ...entry.target, cwd: '.' },
@@ -419,12 +486,18 @@ function projectLegacyTargets(references) {
             return [`${target.pluginName}\0${target.platform}\0${target.scope}`, target];
         })).values()];
 }
-function exclusiveSkillRoot(options) {
-    if (options.scope === 'user') {
-        return path.join(options.platform === 'codex' ? getCodexHome(options.env) : getClaudeHome(options.env), 'skills');
-    }
-    const repoRoot = resolveRepoRootSync(options.cwd);
-    return path.join(repoRoot, options.platform === 'codex' ? '.agents' : '.claude', 'skills');
+function desiredCleanupNoopResult(targets, cwd) {
+    const rebuildResults = targets.map((target) => ({
+        status: 'succeeded', command: 'cleanup', target: { ...target, pluginVersion: 'unavailable', cwd },
+        actions: [], cleanupAttempted: false, removed: [], absent: [], residual: [], quarantined: [], failures: [],
+    }));
+    return {
+        platforms: [...new Set(targets.map((target) => target.platform))],
+        plugins: [...new Set(targets.map((target) => target.pluginName))],
+        warnings: [], rebuildResults,
+        targetResults: rebuildResults.map((result) => ({ target: result.target, action: 'keep', state: 'completed' })),
+        overallState: 'succeeded', receiptTargets: targets,
+    };
 }
 function resolveLiveCleanupTargets(options) {
     const visible = options.references.filter((reference) => (reference.kind === 'namespacedOwner'
@@ -442,6 +515,12 @@ function resolveLiveCleanupTargets(options) {
         const matchesByTarget = new Map();
         for (const reference of visible.filter((entry) => entry.pluginName === parsed.pluginName
             && (parsed.sourceId === undefined || entry.sourceId === parsed.sourceId))) {
+            const lifecycleReference = visible.find((entry) => entry.kind === 'namespacedLifecycle'
+                && entry.sourceId === reference.sourceId
+                && entry.sourceIdentity === reference.sourceIdentity
+                && entry.pluginName === reference.pluginName
+                && entry.platform === reference.platform
+                && entry.scope === reference.scope);
             const liveNames = new Set(options.references.flatMap((candidate) => candidate.sourceId === reference.sourceId
                 && candidate.sourceIdentity === reference.sourceIdentity
                 && candidate.pluginName === reference.pluginName
@@ -480,6 +559,14 @@ function resolveLiveCleanupTargets(options) {
                     ? { nativeRegistration: true }
                     : {}),
                 ...(marketplaceIdentityUnresolved ? { marketplaceIdentityUnresolved: true } : {}),
+                ...(lifecycleReference?.lifecycleMetadataIntegrityDigest
+                    ? {
+                        lifecycleMetadataIntegrityDigest: lifecycleReference.lifecycleMetadataIntegrityDigest,
+                    }
+                    : {}),
+                ...(lifecycleReference?.pluginVersion
+                    ? { lifecyclePluginVersion: lifecycleReference.pluginVersion }
+                    : {}),
             };
             const key = [target.pluginId, target.sourceIdentity, target.platform, target.scope].join('\0');
             const previous = matchesByTarget.get(key);
@@ -500,51 +587,6 @@ function resolveLiveCleanupTargets(options) {
                 ].join('\0'), target])).values()],
     };
 }
-async function discoverDamagedExclusiveCleanupTargets(options) {
-    const parsed = parsePluginId(options.selector);
-    if (!parsed.sourceId)
-        return [];
-    const targets = [];
-    for (const platform of options.platforms) {
-        const root = exclusiveSkillRoot({
-            platform,
-            scope: options.scope,
-            cwd: options.cwd,
-            env: options.env,
-        });
-        const entries = await fs.readdir(root, { withFileTypes: true }).catch(() => []);
-        for (const entry of entries) {
-            if (!entry.isDirectory() || entry.isSymbolicLink())
-                continue;
-            const markerPath = path.join(root, entry.name, '.agent-workflows-owner.json');
-            const markerStats = await fs.lstat(markerPath).catch(() => null);
-            if (!markerStats?.isFile() || markerStats.isSymbolicLink())
-                continue;
-            const raw = await fs.readJson(markerPath).catch(() => null);
-            if (!raw
-                || raw.schemaVersion !== 2
-                || raw.owner !== 'agent-workflows'
-                || raw.sourceId !== parsed.sourceId
-                || raw.plugin !== parsed.pluginName
-                || raw.pluginId !== options.selector
-                || raw.platform !== platform
-                || raw.scope !== options.scope)
-                continue;
-            targets.push({
-                pluginId: options.selector,
-                pluginName: parsed.pluginName,
-                sourceId: parsed.sourceId,
-                sourceIdentity: typeof raw.sourceIdentity === 'string'
-                    && /^sha256:[0-9a-f]{64}$/u.test(raw.sourceIdentity)
-                    ? raw.sourceIdentity
-                    : `sha256:${'0'.repeat(64)}`,
-                platform,
-                scope: raw.scope,
-            });
-        }
-    }
-    return [...new Map(targets.map((target) => [[target.platform, target.scope].join('\0'), target])).values()];
-}
 async function cleanupOfflineOwnedComponents(options) {
     if (options.targets.some((target) => target.marketplaceIdentityUnresolved)) {
         throw namespacedPreflightError('marketplaceIdentityUnavailable: Cannot uniquely recover the native marketplace name from live inventory or a canonical native registration path.', options.targets);
@@ -552,35 +594,7 @@ async function cleanupOfflineOwnedComponents(options) {
     const results = [];
     const warnings = [];
     const nativeCliRunner = options.nativeCliRunner ?? getDefaultNativeCliRunner();
-    let codexManager = options.codexManager;
-    const codexManagerNeedFailures = new Map();
-    if (!codexManager) {
-        const codexManagerRequired = (await Promise.all(options.targets.map(async (target) => {
-            if (target.platform !== 'codex' || target.scope !== 'user')
-                return false;
-            try {
-                return await codexNativeRemovalRequired({
-                    pluginName: target.pluginName,
-                    cwd: options.cwd,
-                    env: options.env,
-                    marketplaceName: target.marketplaceName,
-                    marketplaceRoot: path.join(resolveAwHome(options.env), 'marketplaces', target.sourceId),
-                });
-            }
-            catch (error) {
-                codexManagerNeedFailures.set(target, new Error('codexNativeResidueProbeFailed: Codex native residue was retained because its config or cache evidence could not be read. Repair the damaged Codex weak state, then retry cleanup; you can also upgrade AW or install a compatible official Codex CLI.', { cause: error }));
-                return false;
-            }
-        }))).some(Boolean);
-        if (codexManagerRequired) {
-            codexManager = await (options.codexManagerResolver ?? resolveCodexManager)({
-                cwd: options.cwd,
-                env: options.env,
-                runner: nativeCliRunner,
-                authorizer: options.managedCodexAuthorizer,
-            });
-        }
-    }
+    const codexManager = options.codexManager;
     const context = {
         env: options.env,
         nativeCliRunner,
@@ -594,59 +608,39 @@ async function cleanupOfflineOwnedComponents(options) {
         loadPlugin: (bundleRoot) => readPluginManifest(bundleRoot, { mode: 'bundle' }),
     });
     for (const target of options.targets) {
-        const exclusiveRecovery = {
-            removed: [], absent: [], residual: [], quarantined: [], failures: [],
-        };
-        if (options.force) {
-            const root = exclusiveSkillRoot({
-                platform: target.platform,
-                scope: target.scope,
+        const inventoryErrors = (options.inventoryErrors ?? []).filter((error) => error.relevance.global || ((error.relevance.sourceId === undefined || error.relevance.sourceId === target.sourceId)
+            && (error.relevance.pluginName === undefined || error.relevance.pluginName === target.pluginName)
+            && (error.relevance.platform === undefined || error.relevance.platform === target.platform)
+            && (error.relevance.scope === undefined || error.relevance.scope === target.scope)));
+        const evidence = options.evidence?.find((candidate) => candidate.pluginId === target.pluginId
+            && candidate.sourceIdentity === target.sourceIdentity
+            && candidate.platform === target.platform
+            && candidate.scope === target.scope);
+        const activationAction = target.platform === 'codex'
+            ? evidence?.plan.actions.find((action) => action.action === 'removeNativeRegistration'
+                && action.activationScope === target.scope)
+            : undefined;
+        let activationDisposition = 'remove';
+        if (activationAction && target.scope === 'user') {
+            const projectIntent = await readPluginIntentState({
+                scope: 'project',
                 cwd: options.cwd,
                 env: options.env,
             });
-            const entries = await fs.readdir(root, { withFileTypes: true }).catch(() => []);
-            for (const entry of entries) {
-                if (!entry.isDirectory() || entry.isSymbolicLink())
-                    continue;
-                const directory = path.join(root, entry.name);
-                let recovered;
-                try {
-                    recovered = await cleanupCorruptExclusivePluginDirectory({
-                        directory,
-                        allowedRoot: root,
-                        sourceId: target.sourceId,
-                        pluginName: target.pluginName,
-                        platform: target.platform,
-                        scope: target.scope,
-                        ...options.corruptExclusiveDirectoryOperations,
-                    });
-                }
-                catch (error) {
-                    recovered = {
-                        removed: [], absent: [], residual: [directory], quarantined: [],
-                        failures: [{
-                                label: directory,
-                                phase: 'mutation',
-                                message: error instanceof Error ? error.message : String(error),
-                            }],
-                    };
-                }
-                if (recovered) {
-                    exclusiveRecovery.removed.push(...recovered.removed);
-                    exclusiveRecovery.absent.push(...recovered.absent);
-                    exclusiveRecovery.residual.push(...recovered.residual);
-                    exclusiveRecovery.quarantined.push(...recovered.quarantined);
-                    exclusiveRecovery.failures.push(...recovered.failures);
-                }
-            }
+            const remainsDesired = projectIntent.roots.some((root) => root.pluginId === target.pluginId && root.platforms.includes('codex'))
+                || projectIntent.managed.codexPluginIds.includes(activationAction.target);
+            if (remainsDesired)
+                activationDisposition = 'disable';
         }
         const plugin = createSyntheticPlugin(target.pluginName, options.env);
+        if (target.lifecyclePluginVersion) {
+            plugin.manifest.version = target.lifecyclePluginVersion;
+        }
         plugin.sourceId = target.sourceId;
         plugin.sourceIdentity = target.sourceIdentity;
         plugin.pluginId = target.pluginId;
         const marketplaceName = target.marketplaceName ?? 'aw';
         plugin.marketplaceName = marketplaceName;
-        const codexManagerNeedFailure = codexManagerNeedFailures.get(target);
         const desired = await integration.buildTarget({
             sourceId: target.sourceId,
             sourceIdentity: target.sourceIdentity,
@@ -664,68 +658,45 @@ async function cleanupOfflineOwnedComponents(options) {
                 catalogVersion: '0.0.0',
                 channel: 'beta',
             },
-            includeHistoricalLifecycleArtifacts: false,
-            includeNativeCleanupCandidate: target.nativeRegistration === true && !codexManagerNeedFailure,
+            includeHistoricalLifecycleArtifacts: target.lifecycleMetadataIntegrityDigest !== undefined,
+            ...(target.lifecycleMetadataIntegrityDigest
+                ? {
+                    expectedLifecycleMetadataIntegrityDigest: target.lifecycleMetadataIntegrityDigest,
+                }
+                : {}),
+            includeNativeCleanupCandidate: target.nativeRegistration === true,
+            ...(activationAction
+                ? {
+                    codexActivationCleanup: [{
+                            codexPluginId: activationAction.target,
+                            scope: activationAction.activationScope,
+                            disposition: activationDisposition,
+                        }],
+                    preserveCodexSharedNativePayload: true,
+                }
+                : {}),
         });
-        const driver = codexManagerNeedFailure && integration.driver.probeNative
-            ? {
-                ...integration.driver,
-                probeNative: async () => {
-                    throw codexManagerNeedFailure;
-                },
-            }
-            : integration.driver;
-        let result = await executeRebuildOperation({
+        const preserveDamagedLifecycle = inventoryErrors.some((error) => error.kind.startsWith('lifecycle'));
+        const result = await executeRebuildOperation({
             command: 'cleanup',
             target: desired,
-            driver,
-            activeStore,
+            driver: integration.driver,
+            activeStore: preserveDamagedLifecycle
+                ? { ...activeStore, remove: async () => undefined }
+                : activeStore,
         });
-        if (codexManagerNeedFailure) {
-            const residual = `${target.pluginName}@${marketplaceName}`;
-            result = {
-                ...result,
-                status: 'failed',
-                actions: [...result.actions, { name: 'cleanup.owned', status: 'failed' }],
-                residual: [...new Set([...result.residual, residual])],
-                failures: [...result.failures, {
-                        phase: 'cleanup.owned',
-                        label: residual,
-                        message: codexManagerNeedFailure.message,
-                    }],
-                error: { phase: 'cleanup.owned', message: codexManagerNeedFailure.message },
-            };
+        if (result.status === 'succeeded' && evidence) {
+            result.removed = [...new Set([
+                    ...result.removed,
+                    ...evidence.plan.actions.flatMap((action) => action.action === 'removeLifecycleSnapshot' ? [action.target] : []),
+                ])];
         }
-        const exclusiveResidual = (await Promise.all(exclusiveRecovery.residual.map(async (entry) => await fs.pathExists(entry) ? entry : null))).filter((entry) => entry !== null);
-        const exclusiveQuarantined = (await Promise.all(exclusiveRecovery.quarantined.map(async (entry) => await fs.pathExists(entry) ? entry : null))).filter((entry) => entry !== null);
-        const exclusiveFailures = (await Promise.all(exclusiveRecovery.failures.map(async (failure) => {
-            const residualPath = failure.quarantinePath ?? failure.label;
-            return await fs.pathExists(residualPath) ? failure : null;
-        }))).filter((failure) => failure !== null);
-        const removed = [...new Set([...result.removed, ...exclusiveRecovery.removed])];
-        const absent = [...new Set([...result.absent, ...exclusiveRecovery.absent])]
-            .filter((entry) => !removed.includes(entry));
-        result = {
-            ...result,
-            removed,
-            absent,
-            residual: [...new Set([...result.residual, ...exclusiveResidual])],
-            quarantined: [...new Set([...result.quarantined, ...exclusiveQuarantined])],
-        };
-        if (exclusiveFailures.length > 0) {
-            const failures = exclusiveFailures.map((failure) => ({
-                phase: 'cleanup.owned',
-                label: failure.label,
-                message: `exclusiveRecoveryFailed: ${failure.phase} ${failure.label}: ${failure.message}`,
-            }));
-            const message = failures[0].message;
-            result = {
-                ...result,
-                status: 'failed',
-                actions: [{ name: 'cleanup.owned', status: 'failed' }],
-                failures: [...result.failures, ...failures],
-                error: { phase: 'cleanup.owned', message },
-            };
+        if (inventoryErrors.length > 0) {
+            result.residual = [...new Set([
+                    ...result.residual,
+                    ...inventoryErrors.map((error) => error.location),
+                ])];
+            warnings.push(...inventoryErrors.map((error) => `stateInventoryResidual: ${error.kind}: ${error.message}`));
         }
         results.push(result);
     }
@@ -739,11 +710,10 @@ async function cleanupOfflineOwnedComponents(options) {
     return leaseSafeRebuildResult({
         platforms: [...new Set(results.map((result) => result.target.platform))],
         plugins: results.filter((result) => result.status === 'succeeded').map((result) => result.target.pluginName),
-        warnings,
+        warnings: [...new Set(warnings)],
         rebuildResults: results,
         targetResults: results.map(toTargetResult),
         overallState: results.every((result) => result.status === 'succeeded') ? 'succeeded' : 'failed',
-        nativePlugins: {}, repoManagedArtifacts: [],
         receiptTargets: results.map((result) => ({
             pluginName: result.target.pluginName,
             pluginId: result.target.pluginId,
@@ -751,6 +721,7 @@ async function cleanupOfflineOwnedComponents(options) {
             platform: result.target.platform,
             scope: result.target.scope,
         })),
+        ...(options.evidence ? { offlineCleanupPlans: options.evidence } : {}),
     });
 }
 async function previewOfflineOwnedComponents(options) {
@@ -759,55 +730,139 @@ async function previewOfflineOwnedComponents(options) {
     }
     await options.onPreviewStage?.('inventory');
     const preview = mergeRebuildCommandResults([]);
-    const codexManagerRequired = (await Promise.all(options.targets.flatMap((target) => target.platform === 'codex' && target.scope === 'user'
-        ? [codexNativeRemovalRequired({
-                pluginName: target.pluginName,
-                cwd: options.cwd,
-                env: options.env,
-                marketplaceName: target.marketplaceName,
-                marketplaceRoot: path.join(resolveAwHome(options.env), 'marketplaces', target.sourceId),
-            })]
-        : []))).some(Boolean);
+    if (options.evidence)
+        preview.offlineCleanupPlans = options.evidence;
     await options.onPreviewStage?.('dependencyPlan');
-    if (codexManagerRequired) {
-        preview.codexManagerPreview = await (options.codexManagerPreviewer ?? previewCodexManager)({
-            cwd: options.cwd,
-            env: options.env,
-            runner: options.nativeCliRunner,
-        });
-    }
     return preview;
 }
 async function assertOfflineCleanupDependents(options) {
     const inventory = await options.readInventory({
-        cwd: options.cwd,
-        env: options.env,
-        includeHistoricalProjects: true,
+        cwd: options.cwd, env: options.env, includeHistoricalProjects: true,
     });
     const currentProjectKey = await resolveCanonicalRepoProjectKey(options.cwd);
+    const cleanupIds = new Set(options.targets.map((target) => target.pluginId));
     for (const target of options.targets) {
-        const pluginsRoot = path.join(resolveAwHome(options.env), 'marketplaces', target.sourceId, 'plugins');
-        const entries = await fs.readdir(pluginsRoot, { withFileTypes: true }).catch(() => []);
-        for (const entry of entries) {
-            if (!entry.isDirectory() || entry.name === target.pluginName)
-                continue;
-            const consumer = await readPluginManifest(path.join(pluginsRoot, entry.name), { mode: 'bundle' })
-                .catch(() => null);
+        const consumerNames = [...new Set(inventory.references.flatMap((reference) => (reference.kind === 'namespacedOwner'
+                || reference.kind === 'namespacedMarketplace'
+                || reference.kind === 'namespacedLifecycle')
+                && reference.sourceId === target.sourceId
+                && reference.sourceIdentity === target.sourceIdentity
+                && reference.pluginName
+                && reference.pluginName !== target.pluginName
+                && reference.platform === target.platform
+                && (target.scope === 'user' || reference.scope === 'project')
+                ? [reference.pluginName]
+                : []))];
+        const consumerPlugins = (await Promise.all(consumerNames.map((pluginName) => readOfflinePluginManifestCandidates({
+            target,
+            sourceIdentity: target.sourceIdentity,
+            pluginName,
+            env: options.env,
+            inventory,
+        })))).flat();
+        for (const consumer of consumerPlugins) {
             if (!consumer?.manifest.dependencies?.includes(target.pluginName))
                 continue;
             const consumerId = formatPluginId({ sourceId: target.sourceId, pluginName: consumer.manifest.name });
-            const live = inventory.references.some((reference) => (reference.kind === 'namespacedOwner' || reference.kind === 'namespacedMarketplace')
+            if (cleanupIds.has(consumerId))
+                continue;
+            const live = inventory.references.some((reference) => (reference.kind === 'namespacedOwner'
+                || reference.kind === 'namespacedMarketplace'
+                || reference.kind === 'namespacedLifecycle')
                 && reference.sourceId === target.sourceId
                 && reference.sourceIdentity === target.sourceIdentity
                 && reference.pluginName === consumer.manifest.name
                 && reference.platform === target.platform
                 && (target.scope === 'user' || reference.scope === 'project')
                 && (target.scope === 'user' || reference.projectKey === currentProjectKey));
-            if (live) {
+            if (live)
                 throw namespacedPreflightError(`dependencyStillRequired: ${target.pluginId} is required by ${consumerId}.`, options.targets);
+        }
+    }
+}
+async function readPluginManifestIfPresent(root) {
+    return readPluginManifest(root, { mode: 'bundle' }).catch(() => null);
+}
+async function readOfflinePluginManifestCandidates(options) {
+    const lifecycleRoots = options.inventory.references.flatMap((reference) => reference.kind === 'namespacedLifecycle'
+        && reference.sourceId === options.target.sourceId
+        && reference.sourceIdentity === options.sourceIdentity
+        && reference.pluginName === options.pluginName
+        ? [path.join(reference.location, 'bundle')]
+        : []);
+    const marketplaceRoot = path.join(resolveAwHome(options.env), 'marketplaces', options.target.sourceId);
+    const marketplace = await readStrictNamespacedMarketplaceRoot({
+        rootDir: marketplaceRoot,
+        sourceId: options.target.sourceId,
+    }).catch(() => null);
+    const marketplaceRoots = marketplace?.config.sourceIdentity === options.sourceIdentity
+        ? [marketplaceRoot]
+        : [];
+    const roots = [
+        ...lifecycleRoots,
+        ...marketplaceRoots.map((root) => path.join(root, 'plugins', options.pluginName)),
+    ];
+    const storeRoot = path.join(resolveAwHome(options.env), 'catalog-store');
+    const logicalEntries = await fs.readdir(storeRoot, { withFileTypes: true }).catch(() => []);
+    for (const logicalEntry of logicalEntries) {
+        if (!logicalEntry.isDirectory() || logicalEntry.isSymbolicLink())
+            continue;
+        const logicalRoot = path.join(storeRoot, logicalEntry.name);
+        const snapshotEntries = await fs.readdir(logicalRoot, { withFileTypes: true }).catch(() => []);
+        for (const snapshotEntry of snapshotEntries) {
+            if (!snapshotEntry.isDirectory()
+                || snapshotEntry.isSymbolicLink()
+                || !/^[0-9a-f]{64}$/u.test(snapshotEntry.name))
+                continue;
+            let logicalIdentity;
+            try {
+                logicalIdentity = decodeURIComponent(logicalEntry.name);
             }
+            catch {
+                continue;
+            }
+            const entry = await readCatalogStoreEntry({
+                logicalIdentity,
+                snapshotDigest: `sha256:${snapshotEntry.name}`,
+                env: options.env,
+            }).catch(() => null);
+            if (!entry)
+                continue;
+            const storeAnchor = await readPluginManifestIfPresent(path.join(entry.snapshotRoot, 'plugins', options.target.pluginName));
+            if (!storeAnchor || storeAnchor.manifest.name !== options.target.pluginName)
+                continue;
+            roots.push(path.join(entry.snapshotRoot, 'plugins', options.pluginName));
         }
     }
+    const plugins = await Promise.all([...new Set(roots)].map(readPluginManifestIfPresent));
+    return plugins.filter((plugin) => plugin !== null);
+}
+async function cleanupTargetIsDesired(options) {
+    const pending = options.roots.filter((root) => root.platforms.includes(options.target.platform));
+    const visited = new Set();
+    while (pending.length > 0) {
+        const root = pending.pop();
+        if (visited.has(root.pluginId))
+            continue;
+        visited.add(root.pluginId);
+        if (root.pluginId === options.target.pluginId)
+            return true;
+        const parsed = parsePluginId(root.pluginId);
+        if (parsed.sourceId !== options.target.sourceId)
+            continue;
+        const plugins = await readOfflinePluginManifestCandidates({
+            target: options.target,
+            sourceIdentity: options.target.sourceIdentity,
+            pluginName: parsed.pluginName,
+            env: options.env,
+            inventory: options.inventory,
+        });
+        pending.push(...plugins.flatMap((plugin) => plugin.manifest.dependencies ?? []).map((pluginName) => ({
+            pluginId: formatPluginId({ sourceId: parsed.sourceId, pluginName }),
+            platforms: [options.target.platform],
+        })));
+    }
+    return false;
 }
 export async function runRebuildCommand(options) {
     if (options.runtime?.catalogResolution && options.runtime.bypassDependencyPlan) {
@@ -818,10 +873,24 @@ export async function runRebuildCommand(options) {
         ?? inventoryCatalogSourceReferences;
     let ordinaryInventory;
     const readOrdinaryInventory = async () => {
-        ordinaryInventory ??= await readInventory({
+        ordinaryInventory ??= await measureCommandPerformanceStage(options.runtime, 'inventory', () => readInventory({
             cwd: options.commandOptions.cwd,
             env: runtimeEnv,
-        });
+            ...(options.command === 'cleanup' && options.all
+                ? { includeOrphanedCodexNativeResidue: true }
+                : {}),
+            ...(options.command === 'cleanup' && !options.all
+                ? {
+                    codexNativeResidueTargets: options.pluginNames.map((selector) => {
+                        const parsed = parsePluginId(selector);
+                        return {
+                            pluginName: parsed.pluginName,
+                            ...(parsed.sourceId ? { sourceId: parsed.sourceId } : {}),
+                        };
+                    }),
+                }
+                : {}),
+        }));
         return ordinaryInventory;
     };
     let requestedPluginNames = options.pluginNames;
@@ -830,7 +899,6 @@ export async function runRebuildCommand(options) {
     const expectedOfflineCleanup = options.runtime?.expectedOfflineCleanupEvidence;
     let cleanupInventory;
     let cleanupLiveTargets = [];
-    let cleanupHasDamagedExclusiveTarget = false;
     let liveTargets = [];
     let legacyLiveTargets = [];
     if (options.command === 'cleanup' && !options.all) {
@@ -863,48 +931,8 @@ export async function runRebuildCommand(options) {
             }
             cleanupLiveTargets = [liveTarget];
         }
-        if (cleanupForce && !expectedOfflineCleanup) {
-            const damagedTargets = (await Promise.all(requestedPluginNames.map(async (selector) => parsePluginId(selector).sourceId
-                ? discoverDamagedExclusiveCleanupTargets({
-                    selector,
-                    platforms: selectedPlatforms(options.commandOptions.platform),
-                    scope: options.commandOptions.scope,
-                    cwd: options.commandOptions.cwd,
-                    env: runtimeEnv,
-                })
-                : []))).flat();
-            cleanupHasDamagedExclusiveTarget = damagedTargets.length > 0;
-            cleanupLiveTargets = [...new Map([
-                    ...damagedTargets,
-                    ...cleanupLiveTargets,
-                ].map((target) => [[target.pluginId, target.platform, target.scope].join('\0'), target])).values()];
-        }
         liveTargets = cleanupLiveTargets;
     }
-    if (cleanupHasDamagedExclusiveTarget) {
-        if (options.runtime?.previewDependencyPlanOnly) {
-            return previewOfflineOwnedComponents({
-                targets: cleanupLiveTargets,
-                cwd: options.commandOptions.cwd,
-                env: runtimeEnv,
-                nativeCliRunner: options.runtime.nativeCliRunner,
-                codexManagerPreviewer: options.runtime.codexManagerPreviewer,
-                onPreviewStage: options.runtime.onPreviewStage,
-            });
-        }
-        return cleanupOfflineOwnedComponents({
-            targets: cleanupLiveTargets,
-            cwd: options.commandOptions.cwd,
-            env: runtimeEnv,
-            force: true,
-            removeObsoleteInstallationContracts: options.runtime?.removeObsoleteInstallationContracts,
-            nativeCliRunner: options.runtime?.nativeCliRunner,
-            codexManager: options.runtime?.codexManager,
-            codexManagerResolver: options.runtime?.codexManagerResolver,
-            managedCodexAuthorizer: options.runtime?.managedCodexAuthorizer,
-            corruptExclusiveDirectoryOperations: options.runtime?.corruptExclusiveDirectoryOperations,
-        });
-    }
     if (options.all) {
         const inventory = await readOrdinaryInventory();
         if (options.command !== 'cleanup')
@@ -937,6 +965,10 @@ export async function runRebuildCommand(options) {
                     ].join('\0'), target];
             })).values()];
         liveTargets = projectedTargets;
+        if (options.command === 'cleanup') {
+            cleanupInventory = inventory;
+            cleanupLiveTargets = projectedTargets;
+        }
         const identities = new Map();
         for (const reference of live) {
             if (!reference.sourceIdentity) {
@@ -959,6 +991,147 @@ export async function runRebuildCommand(options) {
         }
         return mergeRebuildCommandResults([]);
     }
+    if (options.command === 'cleanup') {
+        if (cleanupLiveTargets.some((target) => target.marketplaceIdentityUnresolved)) {
+            throw namespacedPreflightError('marketplaceIdentityUnavailable: Cannot uniquely recover the native marketplace name from live inventory or a canonical native registration path.', cleanupLiveTargets);
+        }
+        if (cleanupLiveTargets.length === 0) {
+            const configuredSnapshot = await readCatalogSourcesConfigSnapshot(runtimeEnv).catch(() => null);
+            const configuredSources = new Set(configuredSnapshot?.config.sources.map((source) => source.id) ?? []);
+            const requestedPlatforms = selectedPlatforms(options.commandOptions.platform);
+            const primarySource = configuredSnapshot?.config.sources.find((source) => source.primary)?.id;
+            const unresolvedTargets = requestedPluginNames.flatMap((selector) => {
+                const parsed = parsePluginId(selector);
+                const sourceId = parsed.sourceId ?? primarySource;
+                return sourceId ? requestedPlatforms.map((platform) => ({
+                    pluginId: formatPluginId({ sourceId, pluginName: parsed.pluginName }),
+                    pluginName: parsed.pluginName,
+                    sourceId,
+                    sourceIdentity: 'unavailable',
+                    platform,
+                    scope: options.commandOptions.scope,
+                })) : [];
+            });
+            const inventoryError = cleanupInventory?.errors.find((error) => error.relevance.global || unresolvedTargets.some((target) => !error.relevance.global
+                && (error.relevance.sourceId === undefined || error.relevance.sourceId === target.sourceId)
+                && (error.relevance.pluginName === undefined || error.relevance.pluginName === target.pluginName)
+                && (error.relevance.platform === undefined || error.relevance.platform === target.platform)
+                && (error.relevance.scope === undefined
+                    || error.relevance.scope === target.scope
+                    || target.platform === 'codex')));
+            if (inventoryError) {
+                throw namespacedPreflightError(`stateInventoryFailed: ${inventoryError.message}`, unresolvedTargets);
+            }
+            const missingTargets = requestedPluginNames.flatMap((selector) => {
+                const parsed = parsePluginId(selector);
+                return parsed.sourceId && !configuredSources.has(parsed.sourceId)
+                    ? requestedPlatforms.map((platform) => ({
+                        pluginId: selector,
+                        pluginName: parsed.pluginName,
+                        sourceId: parsed.sourceId,
+                        sourceIdentity: 'unavailable',
+                        platform,
+                        scope: options.commandOptions.scope,
+                    }))
+                    : [];
+            });
+            if (missingTargets.length > 0) {
+                throw namespacedPreflightError('sourceMissing: cleanup target source is unavailable.', missingTargets);
+            }
+            const result = mergeRebuildCommandResults([]);
+            if (cleanupForce && !options.runtime?.previewDependencyPlanOnly) {
+                try {
+                    await (options.runtime?.removeObsoleteInstallationContracts ?? fs.remove)(path.join(resolveAwHome(runtimeEnv), 'installation-contracts'));
+                }
+                catch (error) {
+                    result.warnings.push(`obsoleteContractsCleanupFailed: ${error instanceof Error ? error.message : String(error)}`);
+                }
+            }
+            return result;
+        }
+        const configuredSources = await readCatalogSourcesConfigSnapshot(runtimeEnv)
+            .then((snapshot) => new Set(snapshot.config.sources.map((source) => source.id)))
+            .catch(() => new Set());
+        if (!cleanupForce) {
+            await assertOfflineCleanupDependents({
+                targets: cleanupLiveTargets,
+                cwd: options.commandOptions.cwd,
+                env: runtimeEnv,
+                readInventory,
+            });
+        }
+        const desiredIntent = await readPluginIntentState({
+            scope: options.commandOptions.scope,
+            cwd: options.commandOptions.cwd,
+            env: runtimeEnv,
+        });
+        const desiredFlags = await Promise.all(cleanupLiveTargets.map((target) => cleanupTargetIsDesired({
+            target,
+            roots: desiredIntent.roots,
+            inventory: cleanupInventory,
+            env: runtimeEnv,
+        })));
+        const desiredTargets = cleanupLiveTargets.filter((_, index) => desiredFlags[index]);
+        const removalTargets = cleanupLiveTargets.filter((_, index) => !desiredFlags[index]);
+        if (removalTargets.length === 0) {
+            const result = desiredCleanupNoopResult(desiredTargets, options.commandOptions.cwd);
+            if (cleanupForce && !options.runtime?.previewDependencyPlanOnly) {
+                try {
+                    await (options.runtime?.removeObsoleteInstallationContracts ?? fs.remove)(path.join(resolveAwHome(runtimeEnv), 'installation-contracts'));
+                }
+                catch (error) {
+                    result.warnings.push(`obsoleteContractsCleanupFailed: ${error instanceof Error ? error.message : String(error)}`);
+                }
+            }
+            return leaseSafeRebuildResult(result);
+        }
+        const evidence = expectedOfflineCleanup
+            ? [expectedOfflineCleanup]
+            : removalTargets.flatMap((target) => {
+                const value = offlineCleanupEvidenceFromInventory({
+                    reason: configuredSources.has(target.sourceId) ? 'bundleUnavailable' : 'sourceMissing',
+                    pluginId: target.pluginId,
+                    pluginName: target.pluginName,
+                    sourceId: target.sourceId,
+                    sourceIdentity: target.sourceIdentity,
+                    platform: target.platform,
+                    scope: target.scope,
+                    inventory: cleanupInventory,
+                });
+                return value ? [value] : [];
+            });
+        if (options.runtime?.previewDependencyPlanOnly) {
+            const previewResult = await previewOfflineOwnedComponents({
+                targets: removalTargets,
+                evidence,
+                cwd: options.commandOptions.cwd,
+                env: runtimeEnv,
+                onPreviewStage: options.runtime.onPreviewStage,
+            });
+            return desiredTargets.length > 0
+                ? mergeRebuildCommandResults([
+                    desiredCleanupNoopResult(desiredTargets, options.commandOptions.cwd),
+                    previewResult,
+                ])
+                : previewResult;
+        }
+        const cleanupResult = await cleanupOfflineOwnedComponents({
+            targets: removalTargets,
+            evidence,
+            cwd: options.commandOptions.cwd,
+            env: runtimeEnv,
+            inventoryErrors: cleanupInventory.errors,
+            removeObsoleteInstallationContracts: options.runtime?.removeObsoleteInstallationContracts,
+            nativeCliRunner: options.runtime?.nativeCliRunner,
+            codexManager: options.runtime?.codexManager,
+        });
+        return desiredTargets.length > 0
+            ? mergeRebuildCommandResults([
+                desiredCleanupNoopResult(desiredTargets, options.commandOptions.cwd),
+                cleanupResult,
+            ])
+            : cleanupResult;
+    }
     try {
         if (options.runtime?.previewDependencyPlanOnly) {
             await options.runtime.onPreviewStage?.('catalog');
@@ -967,31 +1140,18 @@ export async function runRebuildCommand(options) {
             throw options.runtime.catalogBootstrapError;
         }
         const catalogOperation = options.runtime?.catalogOperationContext
-            ?? (options.command === 'cleanup'
-                ? undefined
-                : await resolveCatalogOperationContext({
-                    cliVersion: resolveRuntimeCliVersion(),
-                    ...(sourceIds ? { sourceIds } : {}),
-                    env: runtimeEnv,
-                    ...(options.runtime?.catalogGenerationRuntime
-                        ? { runtime: options.runtime.catalogGenerationRuntime }
-                        : {}),
-                    ...(options.runtime?.awHomeMutationToken
-                        ? { bootstrapMissingActive: false }
-                        : {}),
-                }));
+            ?? await measureCommandPerformanceStage(options.runtime, 'catalog.load', () => resolveCatalogOperationContext({
+                ...(sourceIds ? { sourceIds } : {}),
+                env: runtimeEnv,
+            }));
         if (options.runtime?.expectedGenerationSetDigest
             && catalogOperation?.generationSetDigest !== options.runtime.expectedGenerationSetDigest) {
             throw new Error('operationReviewStale: Active Catalog generation changed before mutation.');
         }
         const resolvedResult = await withResolvedMultiSourceCatalog({
             cliVersion: resolveRuntimeCliVersion(),
-            freshnessPolicy: 'cacheFirst',
             ...(sourceIds ? { sourceIds } : {}),
             ...(catalogOperation ? { operationContext: catalogOperation } : {}),
-            ...(options.command === 'cleanup' || options.runtime?.awHomeMutationToken
-                ? { bootstrapMissingActive: false }
-                : {}),
             env: runtimeEnv,
             consume: async (catalog) => {
                 const failedSources = catalog.sources.filter((source) => source.error);
@@ -1050,9 +1210,16 @@ export async function runRebuildCommand(options) {
                     ? availableEntries.filter((candidate) => selectedEntries.some((selectedEntry) => candidate.source.sourceId === selectedEntry.source.sourceId
                         && candidate.entry.dependencies.includes(selectedEntry.entry.name)))
                     : [];
+                const removalDesiredEntries = options.command === 'cleanup' || options.command === 'uninstall'
+                    ? entryClosure(selectedEntries)
+                    : [];
                 const requiredEntryClosure = dependencyEnabled
                     ? entryClosure(selectedEntries)
-                    : [...new Map([...selectedEntries, ...removalConsumerEntries].map((candidate) => [candidate.pluginId, candidate])).values()];
+                    : [...new Map([
+                            ...selectedEntries,
+                            ...removalDesiredEntries,
+                            ...removalConsumerEntries,
+                        ].map((candidate) => [candidate.pluginId, candidate])).values()];
                 if (dependencyEnabled) {
                     for (const candidate of requiredEntryClosure) {
                         const requiredCapabilities = candidate.entry.requires.aw.capabilities ?? [];
@@ -1061,15 +1228,17 @@ export async function runRebuildCommand(options) {
                             throw new AwCapabilityUnsupportedError(candidate.pluginId, support.missing);
                         }
                     }
-                    for (const item of catalog.sources) {
-                        const source = item.resolution;
-                        const names = requiredEntryClosure
-                            .filter((candidate) => candidate.source.sourceId === source.sourceId)
-                            .map((candidate) => candidate.entry.name);
-                        if (names.length > 0) {
-                            await validateCatalogSnapshotPluginEntriesComplete(source.rootDir, names);
+                    await measureCommandPerformanceStage(options.runtime, 'catalog.validation', async () => {
+                        for (const item of catalog.sources) {
+                            const source = item.resolution;
+                            const names = requiredEntryClosure
+                                .filter((candidate) => candidate.source.sourceId === source.sourceId)
+                                .map((candidate) => candidate.entry.name);
+                            if (names.length > 0) {
+                                await validateCatalogSnapshotPluginEntriesComplete(source.rootDir, names);
+                            }
                         }
-                    }
+                    });
                 }
                 const available = await Promise.all(requiredEntryClosure.map(async (candidate) => {
                     const plugin = await readPluginManifest(path.join(candidate.source.rootDir, 'plugins', candidate.entry.name), { mode: 'bundle' });
@@ -1105,7 +1274,9 @@ export async function runRebuildCommand(options) {
                 }
                 const closureEntries = dependencyEnabled
                     ? [...new Map([...closureEntriesByPlatform.values()].flat().map((entry) => [entry.pluginId, entry])).values()]
-                    : selected;
+                    : options.command === 'cleanup' || options.command === 'uninstall'
+                        ? resolveClosureEntries(selected)
+                        : selected;
                 const rawExecutionSelections = options.all
                     ? liveTargets.flatMap((target) => {
                         const entry = selected.find((candidate) => candidate.pluginId === target.pluginId);
@@ -1149,6 +1320,20 @@ export async function runRebuildCommand(options) {
                 const stateInventory = await readOrdinaryInventory();
                 if (options.command !== 'cleanup')
                     assertCatalogSourceInventoryComplete(stateInventory);
+                const hasCodexSelection = executionSelections.some((selection) => selection.platform === 'codex');
+                const intentBeforeByScope = hasCodexSelection || dependencyEnabled
+                    ? {
+                        user: await readPluginIntentState({
+                            scope: 'user', cwd: options.commandOptions.cwd, env: runtimeEnv,
+                        }),
+                        project: await readPluginIntentState({
+                            scope: 'project', cwd: options.commandOptions.cwd, env: runtimeEnv,
+                        }),
+                    }
+                    : {
+                        user: createEmptyPluginIntentState(),
+                        project: createEmptyPluginIntentState(),
+                    };
                 const commandProjectKey = await resolveCanonicalRepoProjectKey(options.commandOptions.cwd);
                 const codexScopePathsAlias = codexProjectConfigAliasesUserHome(options.commandOptions.cwd, runtimeEnv);
                 const selectedLegacy = selectedLegacyLiveReferences(stateInventory.references, new Set(executionSelections.map((selection) => selection.platform)), options.commandOptions.scope);
@@ -1236,10 +1421,27 @@ export async function runRebuildCommand(options) {
                     context: executionContext,
                     scriptTimeoutMs: options.commandOptions.scriptTimeoutMs,
                 });
+                const selectedRootsForPlan = (plan) => [...new Map(plan.targets.flatMap((target) => target.relation === 'requested'
+                        ? [[target.pluginId, {
+                                    pluginId: target.pluginId,
+                                    platforms: plan.targets.flatMap((candidate) => candidate.relation === 'requested'
+                                        && candidate.pluginId === target.pluginId
+                                        ? [candidate.platform]
+                                        : []),
+                                }]]
+                        : [])).values()];
                 const createPlan = async (inventory) => {
                     if (options.command !== 'cleanup')
                         assertCatalogSourceInventoryComplete(inventory);
+                    const codexActivationSnapshots = executionSelections.some((selection) => selection.platform === 'codex')
+                        ? Object.fromEntries(await Promise.all(['user', 'project'].map(async (scope) => [
+                            scope,
+                            (await readCodexConfigFile(resolveCodexPaths(options.commandOptions.cwd, scope, runtimeEnv).configTomlPath)).snapshot,
+                        ])))
+                        : undefined;
                     const targets = [];
+                    const placementNodes = [];
+                    const blockingTargets = new Map();
                     for (const [order, { entry, platform }] of executionSelections.entries()) {
                         const relation = selectedIds.has(entry.pluginId) ? 'requested' : 'dependency';
                         let resolvedScope = options.commandOptions.scope;
@@ -1292,7 +1494,54 @@ export async function runRebuildCommand(options) {
                                 ? Promise.resolve({ state: 'absent', components: [], errors: [] })
                                 : inspectScope(otherScope),
                         ]);
-                        let state = requestedInspection.state;
+                        const surface = platform === 'codex'
+                            ? analyzeCodexSurface(entry.plugin.manifest)
+                            : undefined;
+                        const codexPluginId = `${entry.plugin.manifest.name}@${marketplaceNameFor(entry, platform, resolvedScope)}`;
+                        const placementState = (inspected, scope) => {
+                            if (platform !== 'codex'
+                                || surface?.classification !== 'native'
+                                || options.command === 'cleanup'
+                                || options.command === 'uninstall')
+                                return inspected.state;
+                            const nativePresent = inspected.components.some((component) => component.component.kind === 'native-plugin' && component.state === 'present');
+                            return nativePresent
+                                && codexActivationSnapshots?.[scope].plugins[codexPluginId]?.enabled === true
+                                ? 'present'
+                                : 'absent';
+                        };
+                        const requestedPlacementState = placementState(requestedInspection, options.commandOptions.scope);
+                        let otherPlacementState = placementState(otherInspection, otherScope);
+                        if (surface?.classification === 'native'
+                            && requestedPlacementState === 'present'
+                            && otherPlacementState === 'present') {
+                            otherPlacementState = 'absent';
+                        }
+                        const allowedScopes = platform === 'codex'
+                            ? [
+                                ...(surface?.ok ? ['user'] : []),
+                                ...(surface?.ok && !codexScopePathsAlias ? ['project'] : []),
+                            ]
+                            : ['project', 'user'];
+                        if (allowedScopes.length === 0)
+                            allowedScopes.push(options.commandOptions.scope);
+                        placementNodes.push({
+                            pluginId: entry.pluginId,
+                            pluginName: entry.plugin.manifest.name,
+                            platform,
+                            relation,
+                            depth: order,
+                            allowedScopes,
+                            current: {
+                                project: options.commandOptions.scope === 'project'
+                                    ? requestedPlacementState
+                                    : otherPlacementState,
+                                user: options.commandOptions.scope === 'user'
+                                    ? requestedPlacementState
+                                    : otherPlacementState,
+                            },
+                        });
+                        let state = requestedPlacementState;
                         let action = relation === 'requested'
                             ? options.command
                             : options.command === 'reinstall' ? 'reinstall' : 'upgrade';
@@ -1303,15 +1552,32 @@ export async function runRebuildCommand(options) {
                             action = 'block';
                             errorCode = 'artifactCollision';
                         }
+                        else if (dependencyEnabled
+                            && platform === 'codex'
+                            && relation === 'requested'
+                            && surface?.scopeOverlap === 'aw-owned-conflict'
+                            && options.runtime?.reconcileIntentOnly !== true
+                            && !(options.command === 'install'
+                                && intentBeforeByScope[otherScope].roots.some((root) => root.pluginId === entry.pluginId && root.platforms.includes(platform)))
+                            && otherInspection.components.some((component) => component.state !== 'absent'
+                                && component.component.kind !== 'native-plugin'
+                                && !component.component.identity.artifactKey.startsWith('activation-')
+                                && !component.component.identity.artifactKey.startsWith('marketplace-'))) {
+                            action = 'block';
+                            errorCode = 'codexExtensionScopeConflict';
+                        }
                         else if (dependencyEnabled && relation === 'requested'
                             && (requestedInspection.state === 'error'
-                                || (requestedInspection.state === 'partial' && options.command !== 'reinstall'))) {
+                                || (requestedInspection.state === 'partial'
+                                    && platform !== 'codex'
+                                    && options.command !== 'reinstall'
+                                    && options.command !== 'cleanup'))) {
                             action = 'block';
                             errorCode = 'dependencyNotReady';
                         }
                         if (!hasForeignCollision && relation === 'dependency'
-                            && requestedInspection.state === 'present'
-                            && otherInspection.state === 'present') {
+                            && requestedPlacementState === 'present'
+                            && otherPlacementState === 'present') {
                             action = 'block';
                             state = 'partial';
                             errorCode = 'dependencyScopeConflict';
@@ -1324,24 +1590,26 @@ export async function runRebuildCommand(options) {
                         }
                         else if (!hasForeignCollision && relation === 'dependency'
                             && options.commandOptions.scope === 'project'
-                            && (otherInspection.state === 'partial' || otherInspection.state === 'error')) {
+                            && (otherPlacementState === 'partial' || otherPlacementState === 'error')) {
                             resolvedScope = 'user';
-                            state = otherInspection.state;
-                            if (otherInspection.state === 'error') {
+                            state = otherPlacementState;
+                            if (otherPlacementState === 'error') {
                                 action = 'block';
                                 errorCode = 'dependencyNotReady';
                             }
                         }
                         else if (!hasForeignCollision && relation === 'dependency'
                             && options.commandOptions.scope === 'user'
-                            && otherInspection.state !== 'absent') {
+                            && otherPlacementState !== 'absent') {
                             action = 'block';
                             errorCode = 'dependencyScopeTooNarrow';
                         }
                         const resolvedInspection = resolvedScope === options.commandOptions.scope
                             ? requestedInspection
                             : otherInspection;
-                        state = resolvedInspection.state;
+                        state = resolvedScope === options.commandOptions.scope
+                            ? requestedPlacementState
+                            : otherPlacementState;
                         if (!hasForeignCollision && !errorCode
                             && relation === 'dependency' && options.command === 'install') {
                             action = state === 'present' ? 'keep' : state === 'partial' ? 'reinstall' : 'install';
@@ -1352,13 +1620,6 @@ export async function runRebuildCommand(options) {
                             state = resolvedInspection.state;
                             errorCode ??= 'dependencyNotReady';
                         }
-                        if (!hasForeignCollision && relation === 'dependency'
-                            && platform === 'codex'
-                            && resolvedScope === 'project'
-                            && (entry.plugin.manifest.apps || !hasCodexProjectManagedArtifacts(entry.plugin))) {
-                            action = 'block';
-                            errorCode = 'dependencyTargetUnsupported';
-                        }
                         if (entry.plugin.manifest.config?.schema
                             && (action === 'install' || action === 'upgrade' || action === 'reinstall')) {
                             const effective = await resolveEffectivePluginConfig({
@@ -1381,6 +1642,12 @@ export async function runRebuildCommand(options) {
                             action = 'block';
                             errorCode = 'codexScopePathAlias';
                         }
+                        if (dependencyEnabled && platform === 'codex' && !surface?.ok) {
+                            action = 'block';
+                            errorCode = surface?.errorCode ?? 'codexNativeKindUnsupported';
+                        }
+                        if (errorCode)
+                            blockingTargets.set(`${entry.pluginId}\0${platform}`, errorCode);
                         targets.push({
                             pluginId: entry.pluginId,
                             pluginName: entry.plugin.manifest.name,
@@ -1398,6 +1665,46 @@ export async function runRebuildCommand(options) {
                             ...(errorCode ? { errorCode } : {}),
                         });
                     }
+                    if (dependencyEnabled) {
+                        const placement = createDependencyPlacementPlan({
+                            requestedPluginIds: selected.map((entry) => entry.pluginId),
+                            nodes: placementNodes,
+                            roots: placementNodes.flatMap((node) => selectedIds.has(node.pluginId)
+                                ? [{ pluginId: node.pluginId, platform: node.platform, scope: options.commandOptions.scope }]
+                                : []),
+                            dependencyEdges: closureEntries.flatMap((entry) => (entry.plugin.manifest.dependencies ?? []).flatMap((dependency) => {
+                                const dependencyId = formatPluginId({
+                                    sourceId: entry.source.sourceId,
+                                    pluginName: dependency,
+                                });
+                                return ['codex', 'claude'].flatMap((platform) => placementNodes.some((node) => node.pluginId === entry.pluginId && node.platform === platform)
+                                    && placementNodes.some((node) => node.pluginId === dependencyId && node.platform === platform)
+                                    ? [{ from: entry.pluginId, to: dependencyId, platform }]
+                                    : []);
+                            })),
+                            scopeOverrides: effectiveDependencyScopeOverrides({
+                                state: intentBeforeByScope[options.commandOptions.scope],
+                                explicit: options.commandOptions
+                                    .dependencyScopeOverrides ?? [],
+                                nodes: placementNodes,
+                                ignoredPersistedRootIds: selectedIds,
+                            }),
+                            operation: options.command,
+                        });
+                        return createDependencyOperationPlan({
+                            requestedPluginIds: placement.requestedPluginIds,
+                            resolvedPluginIds: placement.resolvedPluginIds,
+                            dependencyEdges: placement.dependencyEdges,
+                            scopeOverrides: placement.scopeOverrides,
+                            claimRoots: placement.claimRoots,
+                            targets: placement.targets.map((target) => {
+                                const errorCode = blockingTargets.get(`${target.pluginId}\0${target.platform}`);
+                                return errorCode
+                                    ? { ...target, action: 'block', errorCode }
+                                    : target;
+                            }),
+                        });
+                    }
                     return createDependencyOperationPlan({
                         requestedPluginIds: selected.map((entry) => entry.pluginId),
                         resolvedPluginIds: closureEntries.map((entry) => entry.pluginId),
@@ -1408,6 +1715,214 @@ export async function runRebuildCommand(options) {
                         targets,
                     });
                 };
+                const createCodexPlans = async (plan, activationSupport = 'observed') => {
+                    const codexTargets = plan.targets.filter((target) => target.platform === 'codex');
+                    const selectedRoots = selectedRootsForPlan(plan);
+                    const currentScope = options.commandOptions.scope;
+                    const otherScope = currentScope === 'user' ? 'project' : 'user';
+                    const reconciledCodexTargets = codexTargets;
+                    if (reconciledCodexTargets.length === 0)
+                        return [];
+                    const beforeByScope = intentBeforeByScope;
+                    const afterByScope = {
+                        user: beforeByScope.user,
+                        project: beforeByScope.project,
+                    };
+                    afterByScope[currentScope] = deriveDesiredIntentState({
+                        command: options.command,
+                        state: beforeByScope[currentScope],
+                        selectedRoots,
+                        plan,
+                        reconcileIntentOnly: options.runtime?.reconcileIntentOnly,
+                    });
+                    if (options.command === 'install' && options.runtime?.reconcileIntentOnly !== true) {
+                        let other = afterByScope[otherScope];
+                        for (const root of selectedRoots)
+                            other = removePluginIntentRootPlatforms(other, root);
+                        afterByScope[otherScope] = other;
+                    }
+                    const desiredScopesForEntry = (entry) => {
+                        const scopes = new Set();
+                        for (const intentScope of ['user', 'project']) {
+                            const intent = afterByScope[intentScope];
+                            for (const root of intent.roots.filter((candidate) => candidate.platforms.includes('codex'))) {
+                                const rootEntry = available.find((candidate) => candidate.pluginId === root.pluginId);
+                                if (!rootEntry || rootEntry.source.sourceId !== entry.source.sourceId)
+                                    continue;
+                                const sourcePlugins = available
+                                    .filter((candidate) => candidate.source.sourceId === entry.source.sourceId)
+                                    .map((candidate) => candidate.plugin);
+                                let closure;
+                                try {
+                                    closure = resolvePluginMetaDependencyClosure(sourcePlugins, [rootEntry.plugin.manifest.name]);
+                                }
+                                catch {
+                                    closure = [rootEntry.plugin];
+                                }
+                                if (!closure.some((plugin) => plugin.manifest.name === entry.plugin.manifest.name)) {
+                                    continue;
+                                }
+                                const currentPlannedScope = intentScope === currentScope
+                                    && selectedRoots.some((selectedRoot) => selectedRoot.pluginId === root.pluginId)
+                                    ? plan.targets.find((target) => target.pluginId === entry.pluginId && target.platform === 'codex')?.resolvedScope
+                                    : undefined;
+                                const override = intent.dependencyScopeOverrides.find((candidate) => candidate.pluginId === entry.pluginId && candidate.platform === 'codex');
+                                const reusedUserDependency = intentScope === 'project'
+                                    && root.pluginId !== entry.pluginId
+                                    && scopes.has('user');
+                                scopes.add(currentPlannedScope
+                                    ?? override?.scope
+                                    ?? (reusedUserDependency ? 'user' : intentScope));
+                            }
+                        }
+                        return [...scopes].sort();
+                    };
+                    const intentScopesForEntry = (entry) => {
+                        const scopes = new Set();
+                        for (const intentScope of ['user', 'project']) {
+                            for (const root of afterByScope[intentScope].roots.filter((candidate) => candidate.platforms.includes('codex'))) {
+                                const rootEntry = available.find((candidate) => candidate.pluginId === root.pluginId);
+                                if (!rootEntry || rootEntry.source.sourceId !== entry.source.sourceId)
+                                    continue;
+                                const sourcePlugins = available
+                                    .filter((candidate) => candidate.source.sourceId === entry.source.sourceId)
+                                    .map((candidate) => candidate.plugin);
+                                let closure;
+                                try {
+                                    closure = resolvePluginMetaDependencyClosure(sourcePlugins, [rootEntry.plugin.manifest.name]);
+                                }
+                                catch {
+                                    closure = [rootEntry.plugin];
+                                }
+                                if (closure.some((plugin) => plugin.manifest.name === entry.plugin.manifest.name)) {
+                                    scopes.add(intentScope);
+                                }
+                            }
+                        }
+                        return [...scopes].sort();
+                    };
+                    const inspectBothScopes = options.command !== 'cleanup' && options.command !== 'uninstall';
+                    const readActivationConfig = async (scope) => {
+                        return readCodexConfigFile(resolveCodexPaths(options.commandOptions.cwd, scope, runtimeEnv).configTomlPath);
+                    };
+                    const [userConfig, projectConfig] = await Promise.all([
+                        readActivationConfig('user'),
+                        readActivationConfig('project'),
+                    ]);
+                    const catalogClosure = [];
+                    const liveEvidence = [];
+                    for (const planned of reconciledCodexTargets) {
+                        const entry = available.find((candidate) => candidate.pluginId === planned.pluginId);
+                        const surface = analyzeCodexSurface(entry.plugin.manifest);
+                        const marketplaceName = marketplaceNameFor(entry, 'codex', planned.resolvedScope);
+                        const codexPluginId = `${entry.plugin.manifest.name}@${marketplaceName}`;
+                        const contentDigest = await calculateCodexSharedNativePayloadDigest(entry.plugin.rootDir);
+                        const desiredScopes = desiredScopesForEntry(entry);
+                        catalogClosure.push({
+                            pluginId: entry.pluginId,
+                            pluginName: entry.plugin.manifest.name,
+                            codexPluginId,
+                            version: entry.plugin.manifest.version,
+                            payloadDigest: contentDigest,
+                            relation: planned.relation,
+                            resolvedScope: planned.resolvedScope,
+                            desiredScopes,
+                            intentScopes: intentScopesForEntry(entry),
+                            surface,
+                        });
+                        const managedBefore = beforeByScope.user.managed.codexPluginIds.includes(codexPluginId)
+                            || beforeByScope.project.managed.codexPluginIds.includes(codexPluginId);
+                        const sharedInspection = surface.nativeKinds.length > 0
+                            ? await inspectCodexSharedNativeLive({
+                                pluginName: entry.plugin.manifest.name,
+                                desiredVersion: entry.plugin.manifest.version,
+                                expectedPayloadDigest: contentDigest,
+                                cwd: options.commandOptions.cwd,
+                                env: runtimeEnv,
+                                managedByCurrentIntent: managedBefore,
+                                marketplaceName,
+                                marketplaceRoot: path.join(resolveAwHome(runtimeEnv), 'marketplaces', entry.source.sourceId),
+                            })
+                            : undefined;
+                        const sharedNative = sharedInspection?.sharedNative
+                            ?? { state: 'absent', nativeAction: 'install' };
+                        const projectionEntries = [];
+                        const extensions = [];
+                        for (const scope of (inspectBothScopes
+                            ? ['user', 'project']
+                            : [currentScope])) {
+                            const desired = await inspection.buildTarget({
+                                sourceId: entry.source.sourceId,
+                                sourceIdentity: entry.source.sourceIdentity,
+                                pluginId: entry.pluginId,
+                                marketplaceName,
+                                marketplaceRoot: path.join(resolveAwHome(runtimeEnv), 'marketplaces', entry.source.sourceId),
+                                plugin: entry.plugin,
+                                platform: 'codex',
+                                scope,
+                                cwd: options.commandOptions.cwd,
+                                command: options.command,
+                                catalog: toCatalogResolution(entry.source),
+                                includeHistoricalLifecycleArtifacts: false,
+                                readOnlyInspectionPlan: true,
+                            });
+                            const inspected = await inspectOwnedComponents({
+                                components: desired.ownedComponents,
+                                nativeProbe: inspection.driver.probeNative,
+                                verifyHealth: true,
+                            });
+                            const projected = inspected.components.filter((component) => component.component.kind !== 'native-plugin'
+                                && !component.component.identity.artifactKey.startsWith('activation-')
+                                && !component.component.identity.artifactKey.startsWith('marketplace-'));
+                            projectionEntries.push(...projected.map((component) => ({
+                                scope,
+                                artifactKey: component.component.identity.artifactKey,
+                                state: component.state,
+                                collision: component.collision?.reason,
+                            })));
+                            const projectionState = projected.some((component) => component.collision)
+                                ? planned.action === 'block' ? 'absent' : 'foreign'
+                                : projected.some((component) => component.state === 'partial'
+                                    || component.state === 'error')
+                                    ? 'drifted'
+                                    : projected.some((component) => component.state === 'present')
+                                        ? 'present'
+                                        : 'absent';
+                            for (const component of surface.components.filter((candidate) => candidate.owner === 'aw')) {
+                                extensions.push({ componentKey: component.key, scope, state: projectionState });
+                            }
+                        }
+                        liveEvidence.push({
+                            codexPluginId,
+                            sharedNative,
+                            ...(sharedInspection?.actualPayloadDigest
+                                ? { sharedNativePayloadDigest: sharedInspection.actualPayloadDigest }
+                                : {}),
+                            ...(sharedInspection?.payloadPath
+                                ? { sharedNativePayloadPath: sharedInspection.payloadPath }
+                                : {}),
+                            ...(sharedNative.state === 'corrupt' ? { repairableSharedNative: true } : {}),
+                            activations: {
+                                user: userConfig?.snapshot.plugins[codexPluginId]?.enabled,
+                                project: projectConfig?.snapshot.plugins[codexPluginId]?.enabled,
+                            },
+                            extensions,
+                            projectionDigest: JSON.stringify(projectionEntries.sort((left, right) => `${left.scope}\0${left.artifactKey}`.localeCompare(`${right.scope}\0${right.artifactKey}`, 'en'))),
+                        });
+                    }
+                    return [createCodexReconcilePlan({
+                            scope: currentScope,
+                            cwd: options.commandOptions.cwd,
+                            operation: options.runtime?.reconcileIntentOnly ? 'sync' : options.command,
+                            intentBefore: beforeByScope[currentScope],
+                            intentAfter: afterByScope[currentScope],
+                            relatedIntentBefore: beforeByScope[otherScope],
+                            relatedIntentAfter: afterByScope[otherScope],
+                            catalogClosure,
+                            liveEvidence,
+                            activationSupport,
+                        })];
+                };
                 const operationNeedsNativeCli = async (platform, plan) => {
                     for (const { entry, platform: selectedPlatform } of executionSelections) {
                         if (selectedPlatform !== platform)
@@ -1422,14 +1937,6 @@ export async function runRebuildCommand(options) {
                         entry.plugin.marketplaceName = marketplaceName;
                         const marketplaceRoot = path.join(resolveAwHome(runtimeEnv), 'marketplaces', entry.source.sourceId);
                         if (!dependencyEnabled && selectedPlatform === 'codex') {
-                            if (scope === 'user' && await codexNativeRemovalRequired({
-                                pluginName: entry.plugin.manifest.name,
-                                cwd: options.commandOptions.cwd,
-                                env: runtimeEnv,
-                                marketplaceName,
-                                marketplaceRoot,
-                            }))
-                                return true;
                             continue;
                         }
                         const target = await inspection.buildTarget({
@@ -1449,7 +1956,7 @@ export async function runRebuildCommand(options) {
                             includeHistoricalLifecycleArtifacts: false,
                             readOnlyInspectionPlan: true,
                         });
-                        if (dependencyEnabled && target.requiresNative)
+                        if (dependencyEnabled && (target.writeNativeRequired ?? target.requiresNative))
                             return true;
                         const nativeComponents = target.ownedComponents.filter((component) => component.kind === 'native-plugin'
                             || (component.kind === 'shared-config'
@@ -1468,11 +1975,36 @@ export async function runRebuildCommand(options) {
                 };
                 if (options.runtime?.previewDependencyPlanOnly) {
                     await options.runtime.onPreviewStage?.('dependencyPlan');
-                    const initialPlan = dependencyEnabled ? await createPlan(stateInventory) : undefined;
+                    const initialPlan = dependencyEnabled
+                        ? await measureCommandPerformanceStage(options.runtime, 'dependency.plan', () => createPlan(stateInventory))
+                        : undefined;
+                    const provisionalCodexPlans = initialPlan ? await createCodexPlans(initialPlan) : [];
+                    const previewNeedsNativeMaterialization = provisionalCodexPlans.some((plan) => plan.sharedNativeActions.some((action) => action.action === 'install'
+                        || action.action === 'replace'
+                        || action.action === 'repair'));
+                    const previewActivationOnlyProject = !previewNeedsNativeMaterialization
+                        && provisionalCodexPlans.some((plan) => plan.requirement.requiresProjectPluginContract
+                            && plan.postcheck.plugins.length > 0);
+                    const previewConsumer = previewActivationOnlyProject
+                        ? await (options.runtime?.codexOperationConsumerResolver ?? resolveCodexOperationConsumer)({
+                            cwd: options.commandOptions.cwd,
+                            env: runtimeEnv,
+                            runner: options.runtime?.nativeCliRunner ?? getDefaultNativeCliRunner(),
+                            operationRequirement: getCodexOperationRequirement('project'),
+                            requiresNativeMaterialization: false,
+                        })
+                        : undefined;
+                    const initialCodexPlans = initialPlan && previewConsumer?.support === 'assumed'
+                        ? await createCodexPlans(initialPlan, 'assumed')
+                        : provisionalCodexPlans;
                     const preview = mergeRebuildCommandResults([]);
                     if (initialPlan)
                         preview.dependencyPlan = initialPlan;
-                    if (await operationNeedsNativeCli('codex', initialPlan)) {
+                    if (initialCodexPlans.length > 0)
+                        preview.codexReconcilePlans = initialCodexPlans;
+                    if (initialCodexPlans.some((plan) => plan.sharedNativeActions.some((action) => action.action === 'install'
+                        || action.action === 'replace'
+                        || action.action === 'repair'))) {
                         preview.codexManagerPreview = await (options.runtime.codexManagerPreviewer ?? previewCodexManager)({
                             cwd: options.commandOptions.cwd,
                             env: runtimeEnv,
@@ -1506,11 +2038,62 @@ export async function runRebuildCommand(options) {
                         contentDigest: entry.source.manifest.entries.find((candidate) => candidate.name === entry.plugin.manifest.name)?.contentDigest,
                     });
                 }
-                const lockedPlan = await createPlan(stateInventory);
+                const lockedPlan = await measureCommandPerformanceStage(options.runtime, 'dependency.plan', () => createPlan(stateInventory));
+                const provisionalLockedCodexPlans = await createCodexPlans(lockedPlan);
+                const codexManagerRequired = provisionalLockedCodexPlans.some((plan) => plan.sharedNativeActions.some((action) => action.action === 'install'
+                    || action.action === 'replace'
+                    || action.action === 'repair'));
+                const activationOnlyProjectOperation = !codexManagerRequired
+                    && provisionalLockedCodexPlans.some((plan) => plan.requirement.requiresProjectPluginContract
+                        && plan.postcheck.plugins.length > 0);
+                const activationConsumer = activationOnlyProjectOperation
+                    ? await (options.runtime?.codexOperationConsumerResolver ?? resolveCodexOperationConsumer)({
+                        cwd: options.commandOptions.cwd,
+                        env: runtimeEnv,
+                        runner: executionContext.nativeCliRunner,
+                        operationRequirement: getCodexOperationRequirement('project'),
+                        requiresNativeMaterialization: false,
+                    })
+                    : undefined;
+                const lockedCodexPlans = activationConsumer?.support === 'assumed'
+                    ? await createCodexPlans(lockedPlan, 'assumed')
+                    : provisionalLockedCodexPlans;
+                if (activationConsumer?.support === 'observed') {
+                    executionContext.codexManager = activationConsumer.manager;
+                }
                 if (options.runtime?.expectedOperationDependencyPlan
                     && JSON.stringify(lockedPlan) !== JSON.stringify(options.runtime.expectedOperationDependencyPlan)) {
                     throw namespacedPreflightError('operationReviewStale: dependency plan changed before mutation.', preflightTargets);
                 }
+                if (options.runtime?.expectedCodexReconcilePlans
+                    && JSON.stringify(lockedCodexPlans) !== JSON.stringify(options.runtime.expectedCodexReconcilePlans)) {
+                    throw namespacedPreflightError('operationReviewStale: Codex reconciliation evidence or plan changed before mutation.', preflightTargets);
+                }
+                if (options.runtime?.directCli
+                    && options.commandOptions.yes !== true
+                    && (options.command === 'install'
+                        || options.command === 'upgrade'
+                        || options.command === 'reinstall')) {
+                    const sharedNativeImpact = lockedCodexPlans.some((plan) => plan.review.requiresConfirmation);
+                    if (sharedNativeImpact) {
+                        throw namespacedPreflightError('sharedNativeImpactAuthorizationRequired: Replacing or force-reinstalling shared Codex native state requires --yes.', preflightTargets);
+                    }
+                }
+                let desiredIntent;
+                if (options.runtime?.awHomeMutationToken
+                    && !lockedPlan.targets.some((target) => target.action === 'block')) {
+                    const selectedRoots = selectedRootsForPlan(lockedPlan);
+                    desiredIntent = await writeDesiredIntentSuperset({
+                        command: options.command,
+                        cwd: options.commandOptions.cwd,
+                        scope: options.commandOptions.scope,
+                        selectedRoots,
+                        plan: lockedPlan,
+                        codexPlan: lockedCodexPlans[0],
+                        reconcileIntentOnly: options.runtime?.reconcileIntentOnly,
+                        env: runtimeEnv,
+                    });
+                }
                 for (const pluginName of new Set(lockedPlan.targets.flatMap((target) => target.platform === 'claude'
                     && (target.action === 'install'
                         || target.action === 'upgrade'
@@ -1523,15 +2106,36 @@ export async function runRebuildCommand(options) {
                         env: runtimeEnv,
                     });
                 }
-                const codexManagerRequired = await operationNeedsNativeCli('codex', lockedPlan);
                 const claudeCliRequired = await operationNeedsNativeCli('claude', lockedPlan);
+                const codexUserActivationDesired = new Set(lockedCodexPlans.flatMap((plan) => plan.activationActions.user.flatMap((action) => action.desired ? [action.codexPluginId] : [])));
+                executionContext.codexUserActivationDesired = codexUserActivationDesired;
                 if (codexManagerRequired) {
-                    executionContext.codexManager = await (options.runtime?.codexManagerResolver ?? resolveCodexManager)({
-                        cwd: options.commandOptions.cwd,
-                        env: runtimeEnv,
-                        runner: executionContext.nativeCliRunner,
-                        authorizer: options.runtime?.managedCodexAuthorizer,
-                    });
+                    const codexRequirementScope = lockedCodexPlans.some((plan) => plan.requirement.requiresProjectPluginContract)
+                        ? 'project'
+                        : 'user';
+                    if (options.runtime?.codexManagerResolver && codexManagerRequired) {
+                        executionContext.codexManager = await options.runtime.codexManagerResolver({
+                            cwd: options.commandOptions.cwd,
+                            env: runtimeEnv,
+                            runner: executionContext.nativeCliRunner,
+                            authorizer: options.runtime?.managedCodexAuthorizer,
+                            operationRequirement: getCodexOperationRequirement(codexRequirementScope),
+                        });
+                    }
+                    else {
+                        const consumer = await (options.runtime?.codexOperationConsumerResolver ?? resolveCodexOperationConsumer)({
+                            cwd: options.commandOptions.cwd,
+                            env: runtimeEnv,
+                            runner: executionContext.nativeCliRunner,
+                            authorizer: options.runtime?.managedCodexAuthorizer,
+                            operationRequirement: getCodexOperationRequirement(codexRequirementScope),
+                            requiresNativeMaterialization: codexManagerRequired,
+                        });
+                        if (consumer.support !== 'observed') {
+                            throw new Error('Codex native materialization requires an observed CLI consumer.');
+                        }
+                        executionContext.codexManager = consumer.manager;
+                    }
                 }
                 await assertClaudeVersion({
                     platforms: claudeCliRequired ? ['claude'] : [],
@@ -1548,13 +2152,30 @@ export async function runRebuildCommand(options) {
                 const lockedCollisionSelections = [];
                 for (const { entry, platform } of executionSelections) {
                     const planned = lockedPlan.targets.find((candidate) => candidate.pluginId === entry.pluginId && candidate.platform === platform);
+                    const desiredCleanup = platform === 'codex'
+                        && options.command === 'cleanup'
+                        && lockedCodexPlans.some((plan) => plan.desiredTargets.some((target) => target.pluginId === entry.pluginId && target.scopes.includes(planned.resolvedScope)));
+                    const reconcileObsolete = platform === 'codex'
+                        && options.runtime?.reconcileIntentOnly === true
+                        && lockedCodexPlans.some((plan) => plan.desiredTargets.some((target) => target.pluginId === entry.pluginId && !target.scopes.includes(planned.resolvedScope)));
+                    if (reconcileObsolete)
+                        continue;
                     if (planned.action !== 'install'
                         && planned.action !== 'upgrade'
-                        && planned.action !== 'reinstall')
+                        && planned.action !== 'reinstall'
+                        && planned.action !== 'move'
+                        && !desiredCleanup)
                         continue;
+                    const buildCommand = desiredCleanup
+                        ? 'install'
+                        : planned.action === 'move'
+                            ? 'install'
+                            : planned.relation === 'dependency'
+                                ? planned.action
+                                : options.command;
                     const marketplaceName = marketplaceNameFor(entry, platform, planned.resolvedScope);
                     try {
-                        const target = await executionIntegration.buildTarget({
+                        const target = await measureCommandPerformanceStage(options.runtime, 'target.build', () => executionIntegration.buildTarget({
                             sourceId: entry.source.sourceId,
                             sourceIdentity: entry.source.sourceIdentity,
                             pluginId: entry.pluginId,
@@ -1564,21 +2185,27 @@ export async function runRebuildCommand(options) {
                             platform,
                             scope: planned.resolvedScope,
                             cwd: options.commandOptions.cwd,
-                            command: planned.relation === 'dependency' ? planned.action : options.command,
+                            command: buildCommand,
                             catalog: toCatalogResolution(entry.source),
                             includeHistoricalLifecycleArtifacts: true,
-                        });
+                        }));
+                        if (platform === 'codex') {
+                            const plannedNative = lockedCodexPlans.flatMap((plan) => plan.sharedNativeActions).find((action) => action.pluginId === entry.pluginId);
+                            if (plannedNative) {
+                                target.writeNativeRequired = plannedNative.action === 'install'
+                                    || plannedNative.action === 'replace'
+                                    || plannedNative.action === 'repair';
+                            }
+                        }
                         preparedTargets.set(`${entry.pluginId}\0${platform}`, {
                             target,
                             driver: executionIntegration.driver,
                             context: executionContext,
                         });
-                        if (selectedIds.has(entry.pluginId)) {
-                            await rebuildCommandTestHooks?.afterTargetBuilt?.({
-                                command: options.command,
-                                identity: target.identity,
-                            });
-                        }
+                        await rebuildCommandTestHooks?.afterTargetBuilt?.({
+                            command: options.command,
+                            identity: target.identity,
+                        });
                         lockedCollisionSelections.push({
                             pluginId: entry.pluginId,
                             targetKey: `${platform}/${target.identity.scope}`,
@@ -1601,7 +2228,9 @@ export async function runRebuildCommand(options) {
                     throw namespacedPreflightError(`artifactCollision: ${lockedCollisions.map((collision) => `${collision.targetKey} (${collision.pluginIds.join(', ')})`).join('; ')}`, preflightTargets);
                 }
                 const removalRequiredConsumers = new Map();
-                if ((options.command === 'cleanup' && !cleanupForce) || options.command === 'uninstall') {
+                if ((options.command === 'cleanup' && !cleanupForce)
+                    || options.command === 'uninstall'
+                    || options.runtime?.reconcileIntentOnly === true) {
                     const removalStateInventory = await readInventory({
                         cwd: options.commandOptions.cwd,
                         env: runtimeEnv,
@@ -1745,6 +2374,32 @@ export async function runRebuildCommand(options) {
                         scope: planned.resolvedScope,
                         cwd: options.commandOptions.cwd,
                     };
+                    const codexReconcilePlan = platform === 'codex'
+                        ? lockedCodexPlans.find((plan) => plan.desiredTargets.some((target) => target.pluginId === entry.pluginId))
+                        : undefined;
+                    const desiredInCurrentScope = codexReconcilePlan?.desiredTargets.some((target) => target.pluginId === entry.pluginId && target.scopes.includes(planned.resolvedScope)) === true;
+                    const reconcileObsolete = platform === 'codex'
+                        && options.runtime?.reconcileIntentOnly === true
+                        && !desiredInCurrentScope;
+                    const desiredCleanupMutation = codexReconcilePlan !== undefined && (codexReconcilePlan.sharedNativeActions.some((action) => action.pluginId === entry.pluginId
+                        && (action.action === 'install'
+                            || action.action === 'replace'
+                            || action.action === 'repair'))
+                        || [...codexReconcilePlan.activationActions.user,
+                            ...codexReconcilePlan.activationActions.project].some((action) => action.pluginId === entry.pluginId && action.action !== 'none')
+                        || [...codexReconcilePlan.extensionWrites,
+                            ...codexReconcilePlan.extensionRemovals].some((action) => action.pluginId === entry.pluginId));
+                    const plannedNativeAction = codexReconcilePlan?.sharedNativeActions.find((action) => action.pluginId === entry.pluginId);
+                    const hasCodexExtensionMutation = codexReconcilePlan !== undefined
+                        && [...codexReconcilePlan.extensionWrites, ...codexReconcilePlan.extensionRemovals]
+                            .some((action) => action.pluginId === entry.pluginId);
+                    const reconcileActivationOnly = platform === 'codex'
+                        && plannedNativeAction !== undefined
+                        && (plannedNativeAction.action === 'reuse'
+                            || plannedNativeAction.action === 'claim'
+                            || plannedNativeAction.action === 'none')
+                        && !hasCodexExtensionMutation
+                        && entry.plugin.manifest.scripts?.lifecycle?.uninstall === undefined;
                     if (failedDependency || failedConsumer || planned.action === 'block') {
                         const code = failedConsumer
                             ? 'dependencyStillRequired'
@@ -1768,7 +2423,7 @@ export async function runRebuildCommand(options) {
                                     errorCode: code,
                                     message,
                                 }],
-                            overallState: 'failed', nativePlugins: {}, repoManagedArtifacts: [],
+                            overallState: 'failed',
                             receiptTargets: [{
                                     pluginName: identity.pluginName, pluginId: identity.pluginId,
                                     sourceId: identity.sourceId, platform, scope: planned.resolvedScope,
@@ -1777,7 +2432,51 @@ export async function runRebuildCommand(options) {
                         dependencyStates.set(`${entry.pluginId}\0${platform}`, failedDependency || failedConsumer ? 'skipped' : 'failed');
                         continue;
                     }
-                    if (planned.action === 'keep') {
+                    if (reconcileActivationOnly) {
+                        const preparedError = preparedTargetErrors.get(`${entry.pluginId}\0${platform}`);
+                        if (preparedError) {
+                            const message = preparedError instanceof Error
+                                ? preparedError.message
+                                : String(preparedError);
+                            const result = failedResult(options.command, identity, message);
+                            results.push({
+                                platforms: [platform], plugins: [], warnings: [], rebuildResults: [result],
+                                targetResults: [{
+                                        target: identity,
+                                        action: planned.action,
+                                        state: 'failed',
+                                        errorCode: message.split(':', 1)[0] ?? 'targetPreparationFailed',
+                                        message,
+                                    }],
+                                overallState: 'failed',
+                                receiptTargets: [{
+                                        pluginName: identity.pluginName, pluginId: identity.pluginId,
+                                        sourceId: identity.sourceId, platform, scope: planned.resolvedScope,
+                                    }],
+                            });
+                            dependencyStates.set(`${entry.pluginId}\0${platform}`, 'failed');
+                            continue;
+                        }
+                        const result = {
+                            status: 'succeeded', command: options.command, target: identity, actions: [],
+                            cleanupAttempted: false, removed: [], absent: [], residual: [], quarantined: [], failures: [],
+                        };
+                        results.push({
+                            platforms: [platform], plugins: [identity.pluginName], warnings: [], rebuildResults: [result],
+                            targetResults: [{ target: identity, action: planned.action, state: 'completed' }],
+                            overallState: 'succeeded',
+                            receiptTargets: [{
+                                    pluginName: identity.pluginName, pluginId: identity.pluginId,
+                                    sourceId: identity.sourceId, platform, scope: planned.resolvedScope,
+                                }],
+                        });
+                        dependencyStates.set(`${entry.pluginId}\0${platform}`, 'completed');
+                        continue;
+                    }
+                    if (platform === 'codex'
+                        && desiredInCurrentScope
+                        && (options.command === 'uninstall'
+                            || (options.command === 'cleanup' && !desiredCleanupMutation))) {
                         const result = {
                             status: 'succeeded', command: options.command, target: identity, actions: [],
                             cleanupAttempted: false, removed: [], absent: [], residual: [], quarantined: [], failures: [],
@@ -1785,7 +2484,24 @@ export async function runRebuildCommand(options) {
                         results.push({
                             platforms: [platform], plugins: [identity.pluginName], warnings: [], rebuildResults: [result],
                             targetResults: [{ target: identity, action: 'keep', state: 'completed' }],
-                            overallState: 'succeeded', nativePlugins: {}, repoManagedArtifacts: [],
+                            overallState: 'succeeded',
+                            receiptTargets: [{
+                                    pluginName: identity.pluginName, pluginId: identity.pluginId,
+                                    sourceId: identity.sourceId, platform, scope: planned.resolvedScope,
+                                }],
+                        });
+                        dependencyStates.set(`${entry.pluginId}\0${platform}`, 'kept');
+                        continue;
+                    }
+                    if (planned.action === 'keep' && !reconcileObsolete) {
+                        const result = {
+                            status: 'succeeded', command: options.command, target: identity, actions: [],
+                            cleanupAttempted: false, removed: [], absent: [], residual: [], quarantined: [], failures: [],
+                        };
+                        results.push({
+                            platforms: [platform], plugins: [identity.pluginName], warnings: [], rebuildResults: [result],
+                            targetResults: [{ target: identity, action: 'keep', state: 'completed' }],
+                            overallState: 'succeeded',
                             receiptTargets: [{
                                     pluginName: identity.pluginName, pluginId: identity.pluginId,
                                     sourceId: identity.sourceId, platform, scope: planned.resolvedScope,
@@ -1802,11 +2518,20 @@ export async function runRebuildCommand(options) {
                         marketplaceRoot: path.join(resolveAwHome(runtimeEnv), 'marketplaces', entry.source.sourceId),
                     };
                     entry.plugin.marketplaceName = marketplaceName;
+                    const reconcileDesiredCleanup = platform === 'codex'
+                        && options.command === 'cleanup'
+                        && desiredInCurrentScope;
                     const executionResult = await runSingleSourceRebuildCommand({
                         ...options,
-                        command: planned.relation === 'dependency'
-                            ? planned.action
-                            : options.command,
+                        command: reconcileObsolete
+                            ? 'cleanup'
+                            : reconcileDesiredCleanup
+                                ? 'install'
+                                : planned.action === 'move'
+                                    ? 'install'
+                                    : planned.relation === 'dependency'
+                                        ? planned.action
+                                        : options.command,
                         pluginNames: [entry.plugin.manifest.name],
                         all: false,
                         commandOptions: { ...options.commandOptions, platform, scope: planned.resolvedScope },
@@ -1842,11 +2567,115 @@ export async function runRebuildCommand(options) {
                             },
                         },
                     });
+                    if (reconcileDesiredCleanup) {
+                        for (const result of executionResult.rebuildResults)
+                            result.command = 'cleanup';
+                        for (const result of executionResult.targetResults)
+                            result.action = 'cleanup';
+                    }
                     results.push(executionResult);
                     dependencyStates.set(`${entry.pluginId}\0${platform}`, executionResult.overallState === 'succeeded' ? 'completed' : 'failed');
                 }
+                if (lockedCodexPlans.length > 0
+                    && mergeRebuildCommandResults(results).overallState === 'succeeded') {
+                    try {
+                        await executeCodexReconcileActivations({
+                            plans: lockedCodexPlans,
+                            cwd: options.commandOptions.cwd,
+                            env: runtimeEnv,
+                            manager: executionContext.codexManager,
+                            runner: executionContext.nativeCliRunner,
+                        });
+                    }
+                    catch (error) {
+                        const selection = executionSelections.find((candidate) => candidate.platform === 'codex');
+                        if (!selection)
+                            throw error;
+                        const planned = lockedPlan.targets.find((target) => target.pluginId === selection.entry.pluginId && target.platform === 'codex');
+                        const identity = {
+                            sourceId: selection.entry.source.sourceId,
+                            sourceIdentity: selection.entry.source.sourceIdentity,
+                            pluginId: selection.entry.pluginId,
+                            pluginName: selection.entry.plugin.manifest.name,
+                            pluginVersion: selection.entry.plugin.manifest.version,
+                            platform: 'codex',
+                            scope: planned.resolvedScope,
+                            cwd: options.commandOptions.cwd,
+                        };
+                        const message = error instanceof Error ? error.message : String(error);
+                        const failed = failedResult(options.command, identity, message, 'postcheck.inspect');
+                        results.push({
+                            platforms: ['codex'],
+                            plugins: [],
+                            warnings: [],
+                            rebuildResults: [failed],
+                            targetResults: [{
+                                    target: identity,
+                                    action: options.command,
+                                    state: 'failed',
+                                    errorCode: message.split(':', 1)[0] ?? 'codexActivationPostcheckFailed',
+                                    message,
+                                }],
+                            overallState: 'failed',
+                            receiptTargets: [{
+                                    pluginName: identity.pluginName,
+                                    pluginId: identity.pluginId,
+                                    sourceId: identity.sourceId,
+                                    platform: 'codex',
+                                    scope: identity.scope,
+                                }],
+                        });
+                    }
+                }
+                if (options.command === 'install'
+                    && mergeRebuildCommandResults(results).overallState === 'succeeded') {
+                    for (const { entry, platform } of executionSelections) {
+                        const planned = lockedPlan.targets.find((target) => target.pluginId === entry.pluginId && target.platform === platform);
+                        if (planned.action !== 'move'
+                            || dependencyStates.get(`${entry.pluginId}\0${platform}`) !== 'completed')
+                            continue;
+                        const previousScope = planned.resolvedScope === 'user' ? 'project' : 'user';
+                        const marketplaceName = marketplaceNameFor(entry, platform, previousScope);
+                        entry.plugin.marketplaceName = marketplaceName;
+                        const migration = await runSingleSourceRebuildCommand({
+                            command: 'cleanup',
+                            pluginNames: [entry.plugin.manifest.name],
+                            commandOptions: { ...options.commandOptions, platform, scope: previousScope },
+                            runtime: {
+                                ...options.runtime,
+                                env: runtimeEnv,
+                                ...(executionContext.codexManager
+                                    ? { codexManager: executionContext.codexManager }
+                                    : {}),
+                                catalogResolution: toCatalogResolution(entry.source),
+                                resolvedCatalogPlugins: available
+                                    .filter((candidate) => candidate.source.sourceId === entry.source.sourceId)
+                                    .map((candidate) => candidate.plugin),
+                                namespacedSource: {
+                                    sourceId: entry.source.sourceId,
+                                    sourceIdentity: entry.source.sourceIdentity,
+                                    marketplaceName,
+                                    marketplaceRoot: path.join(resolveAwHome(runtimeEnv), 'marketplaces', entry.source.sourceId),
+                                },
+                                dependencyReviewPreflightHandled: true,
+                                bypassDependencyPlan: true,
+                            },
+                        });
+                        results.push(migration);
+                        if (migration.overallState !== 'succeeded') {
+                            dependencyStates.set(`${entry.pluginId}\0${platform}`, 'failed');
+                        }
+                    }
+                }
                 const merged = mergeRebuildCommandResults(results);
                 merged.dependencyPlan = lockedPlan;
+                if (lockedCodexPlans.length > 0)
+                    merged.codexReconcilePlans = lockedCodexPlans;
+                if (desiredIntent && merged.overallState === 'succeeded') {
+                    for (const intent of desiredIntent) {
+                        await writePluginIntentState(intent.location, convergePluginIntentManagedCodexOwnership(intent.superset, intent.convergedCodexPluginIds));
+                    }
+                }
                 return leaseSafeRebuildResult(merged);
             },
         });
@@ -1865,54 +2694,16 @@ export async function runRebuildCommand(options) {
             const projected = error;
             error = namespacedPreflightError(error instanceof Error ? error.message : String(error), projected.namespacedTargets ?? liveTargets, projected.legacyTargets ?? legacyLiveTargets);
         }
-        if (options.command !== 'cleanup' && options.command !== 'uninstall')
+        if (options.command !== 'uninstall')
             throw error;
         const message = error instanceof Error ? error.message : String(error);
-        const catalogUnavailable = message.startsWith('Cannot resolve required catalog sources:')
-            || message.includes('does not exist in the required catalog source set')
-            || (message.includes('Catalog source')
-                && (message.includes('does not exist')
-                    || message.includes('is not configured')
-                    || message.includes('has no Active generation')));
-        if (options.command === 'cleanup'
-            && (catalogUnavailable || message.includes('sourceChanged'))
-            && cleanupInventory
-            && cleanupLiveTargets.length > 0) {
-            if (!cleanupForce || expectedOfflineCleanup) {
-                await assertOfflineCleanupDependents({
-                    targets: cleanupLiveTargets,
-                    cwd: options.commandOptions.cwd,
-                    env: runtimeEnv,
-                    readInventory,
-                });
-            }
-            if (options.runtime?.previewDependencyPlanOnly) {
-                return previewOfflineOwnedComponents({
-                    targets: cleanupLiveTargets,
-                    cwd: options.commandOptions.cwd,
-                    env: runtimeEnv,
-                    nativeCliRunner: options.runtime.nativeCliRunner,
-                    codexManagerPreviewer: options.runtime.codexManagerPreviewer,
-                    onPreviewStage: options.runtime.onPreviewStage,
-                });
-            }
-            return cleanupOfflineOwnedComponents({
-                targets: cleanupLiveTargets,
-                cwd: options.commandOptions.cwd,
-                env: runtimeEnv,
-                force: cleanupForce && !expectedOfflineCleanup,
-                removeObsoleteInstallationContracts: options.runtime?.removeObsoleteInstallationContracts,
-                nativeCliRunner: options.runtime?.nativeCliRunner,
-                codexManager: options.runtime?.codexManager,
-                codexManagerResolver: options.runtime?.codexManagerResolver,
-                managedCodexAuthorizer: options.runtime?.managedCodexAuthorizer,
-                corruptExclusiveDirectoryOperations: options.runtime?.corruptExclusiveDirectoryOperations,
-            });
-        }
+        const catalogUnavailable = isOfflineCleanupCatalogGenerationError(error)
+            || message.startsWith('Cannot resolve required catalog sources:')
+            || message.includes('does not exist in the required catalog source set');
         if (options.command === 'uninstall' && catalogUnavailable) {
             throw namespacedPreflightError(`catalogSourceUnavailable: ${message} Restore the source to run lifecycle uninstall, or use cleanup; use cleanup --force only for exclusively owned damaged output.`, liveTargets, legacyLiveTargets);
         }
-        if ((message.includes('Catalog source') && message.includes('does not exist'))
+        if (catalogGenerationErrorCode(error) === 'catalogGenerationSourceMissing'
             || message.includes('does not exist in the required catalog source set')) {
             throw namespacedPreflightError(`sourceMissing: ${message} Run cleanup for owner recovery, or cleanup --force for an exclusively owned damaged target.`, liveTargets, legacyLiveTargets);
         }