diff --git a/README.md b/README.md
index f14ddd98fa..40917a9995 100644
--- a/README.md
+++ b/README.md
@@ -283,6 +283,11 @@ Host integrations are always part of uninstall. If a broken or unavailable
 host prevents safe cleanup, the command names the blocking plugin manager or
 configuration, gives exact manual cleanup instructions, and stops before
 deleting the binary. Complete that cleanup and rerun uninstall.
+It also keeps the binary when an agent's config file can't be read (another
+tool's too), or when a hook it did not install still runs Plannotator. The
+error names the file, the tool, and what to do. A `plannotator-inbox` entry
+you added yourself, or a Claude Code or Droid plugin installed for one project,
+is named with how to remove it and does not keep the binary.
 These mechanics keep the ordinary confirmation default-negative, make the
 irreversible outcome require a stronger explicit word, and still give package
 managers and scripts a conventional non-interactive flag.
diff --git a/apps/marketing/src/content/docs/getting-started/installation.md b/apps/marketing/src/content/docs/getting-started/installation.md
index 7f05c62717..adec2b2f64 100644
--- a/apps/marketing/src/content/docs/getting-started/installation.md
+++ b/apps/marketing/src/content/docs/getting-started/installation.md
@@ -201,6 +201,11 @@ Host integrations are always part of uninstall. If a broken or unavailable
 host prevents safe cleanup, the command names the blocking plugin manager or
 configuration, gives exact manual cleanup instructions, and stops before
 deleting the binary. Complete that cleanup and rerun uninstall.
+It also keeps the binary when an agent's config file can't be read (another
+tool's too), or when a hook it did not install still runs Plannotator. The
+error names the file, the tool, and what to do. A `plannotator-inbox` entry
+you added yourself, or a Claude Code or Droid plugin installed for one project,
+is named with how to remove it and does not keep the binary.
 
 The purge removes only known Plannotator entries from the configured data
 directory. Unknown top-level files are preserved rather than guessed at, and
diff --git a/apps/marketing/src/content/docs/reference/inbox.md b/apps/marketing/src/content/docs/reference/inbox.md
index 6f02864dd5..47af3989c0 100644
--- a/apps/marketing/src/content/docs/reference/inbox.md
+++ b/apps/marketing/src/content/docs/reference/inbox.md
@@ -88,7 +88,7 @@ Each entry runs `<your plannotator binary> inbox mcp`. The agent uses it from it
 - Editors (VS Code, Zed, JetBrains, Goose) are never changed. Settings has a one-click link or a snippet for each.
 - Qwen Code's `settings.json` may hold comments: Plannotator keeps every one, and adds only its own entry. It never uses `qwen mcp add`, which writes your other servers back with their `${VAR}` values filled in (a token kept in your environment would end up in the file). A file that is not valid JSON or is read-only is left as it was, and the terminal says why. A relative `QWEN_HOME` names a different folder in each project, so you connect Qwen Code by hand then. If the Inbox starts with another `QWEN_HOME` than the one Qwen Code was connected in, Plannotator leaves both folders as they are and tells you once. **Settings → Agents** shows Qwen Code off there, with the folder it is connected in; turn it on to move it. If the new folder's settings.json can't take it, nothing changes and the reason is shown.
 - `PLANNOTATOR_INBOX_CONNECT=0` skips this step.
-- `plannotator uninstall` removes every entry it recorded adding (never one you added yourself). `--dry-run` lists them first. If its record (`~/.plannotator/inbox/agents.json`) is gone, it removes none: an entry that runs this Plannotator is named with how to remove it, since you may have added it by hand.
+- `plannotator uninstall` removes every entry it recorded adding (never one you added yourself). `--dry-run` lists them first. If its record (`~/.plannotator/inbox/agents.json`) is gone, it removes none. Any `plannotator-inbox` entry that still runs Plannotator and that it did not add is named with how to remove it (for Claude Code's `~/.claude.json`, `claude mcp remove plannotator-inbox -s user`), and the `plannotator` command is still removed. If an agent's config file can't be read (not valid JSON or TOML, not UTF-8, or permission denied), uninstall leaves the file as it is and keeps the `plannotator` command. It names the file, the agent and the reason, and says what to do before you run it again.
 
 ### A note in each agent's instructions
 
@@ -395,7 +395,7 @@ The Inbox stores the files agents attached as they were when sent, the messages
 plannotator uninstall --purge
 ```
 
-Both forms remove the `plannotator-inbox` entries `plannotator inbox` added to your agents (an entry you changed to run something else is left, and named). `--purge` also stops a running Inbox first, then deletes `~/.plannotator/inbox/` with the rest of the Plannotator data. If the Inbox does not stop, uninstall still removes the plugins, skills, hooks and config entries, but keeps your Plannotator data (`~/.plannotator`) and the `plannotator` binary. Quit the Inbox and run the command again to finish. Add `--dry-run` to see what would be removed.
+Both forms remove the `plannotator-inbox` entries `plannotator inbox` added to your agents (an entry you changed to run something else is left, and named; so is one you added yourself). An agent config uninstall can't read keeps the `plannotator` binary until you fix it (see [Your agents are connected for you](#your-agents-are-connected-for-you)). `--purge` also stops a running Inbox first, then deletes `~/.plannotator/inbox/` with the rest of the Plannotator data. If the Inbox does not stop, uninstall still removes the plugins, skills, hooks and config entries, but keeps your Plannotator data (`~/.plannotator`) and the `plannotator` binary. Quit the Inbox and run the command again to finish. Add `--dry-run` to see what would be removed.
 
 ## Troubleshooting
 
diff --git a/docs/agent-guides/inbox-foundation.md b/docs/agent-guides/inbox-foundation.md
index 2acc3785ea..db814a0efa 100644
--- a/docs/agent-guides/inbox-foundation.md
+++ b/docs/agent-guides/inbox-foundation.md
@@ -63,7 +63,7 @@ One long-lived local server per machine. Agents leave messages, `:::question` bl
 - When: a person's `plannotator inbox` (with or without `--no-open`), never `--background`, the shim, a connection that starts a stopped Inbox, or the window's Restart (`spawnDetachedInbox` marks those `PLANNOTATOR_INBOX_DETACHED=1`, scrubbed at start; `PLANNOTATOR_INBOX_LOCK_HELD=1` alone counts as detached too, because an Inbox of 0.28.17 or older spawns its Restart into an updated binary, and every other detached start, with only that marker). Starting the Inbox: `inbox.connectAgents()` once it listens, off the request path, its lines on stderr when done. An Inbox already running (an agent started it): the command opens the window, then `POST /api/inbox/control/connect` (connection-route guards: loopback Host, no Origin, the registry token; an older Inbox answers 404 and nothing happens); the step then runs in that Inbox's process, with the environment (PATH, home) the agent started it with. `PLANNOTATOR_INBOX_CONNECT=0` in either environment skips it. One run at a time (`connectAgents` is single-flight); stdout is unchanged.
 - What: every agent found (the install script's rules: its command on PATH, or its folder; Cursor also by `cursor` / `cursor-agent`, Kiro by `kiro-cli`, Codex by `$CODEX_HOME` holding config, a relative one resolved against the working folder as Codex does) with no record in `inbox/agents.json` gets a `plannotator-inbox` MCP server running `<selfCommand> inbox mcp`, through its own `mcp add` where it has one (Codex `codex mcp add … --`, Gemini `gemini mcp add -s user` (`$GEMINI_CLI_HOME` honored), Windsurf/Devin `devin mcp add -s user … --`, Amp, Pi 0.99+ without the extension `pi mcp add`), each only after its `--version` line has that CLI's own shape (`VERSION_SHAPES`: a program that merely shares the name, cln's `pi`, amp.rs, is never handed it; a build older than its `mcp add` is left to the person: Pi before 0.99, which would read the words as a chat prompt, Codex CLI before 0.35.0 and Gemini CLI before 0.1.19), else one key in a JSON file (`mcpServers` in `~/.cursor/mcp.json`, `~/.kiro/settings/mcp.json`, the Claude desktop app's `claude_desktop_config.json`, and Qwen Code's `$QWEN_HOME/settings.json`; created when missing). JSON edits are lossless (`packages/server/json-edit.ts`: only that member's text is inserted or cut, in the file's own style and dominant line ending, BOM kept; a file that is not strict JSON or has a duplicate key on the path is refused with the reason; Qwen's settings.json is read as JSON with comments, as Qwen reads it, and every comment stays: a new member goes after a comment that ends the last member's line, a removal cuts the member and one comma only). Add then remove gives the file back byte for byte: the record keeps the add's exact text change (`undo: { before, after }` on the agent's record in `agents.json`), and removal puts `before` back while `after` is still in the file untouched, so an empty file stays empty, a final newline or its absence stays, and a container Plannotator made goes; a file Plannotator created (`created`) is deleted once only the empty containers are left; an entry the person edited is cut alone; written at a symlink's target, atomic, a no-op when nothing changes (agent-files.ts). Codex's config.toml is read with `Bun.TOML.parse` (every TOML form). Pi with Plannotator's extension (Pi's `settings.json` `packages`) and OpenCode with its plugin (the global `opencode.json(c)` `plugin`, or `plugins` strings or `{ package }`): `inboxTool.<host> = true` in config.json, unless config.json already decides it (false is recorded `off`) or `PLANNOTATOR_INBOX_TOOL` does (nothing written). Claude Code: nothing (said "already on" when the plugin is enabled). Left to the person (`manual`): Codex or Gemini found without its CLI, Qwen with a relative `QWEN_HOME`, Pi before 0.99, a CLI whose version line is not its own, Cline (its `mcp add` is not verified), OpenCode without the plugin. Editors (VS Code, Zed, JetBrains, Goose) are never written. Qwen Code is never connected through `qwen mcp add` / `remove`: Qwen writes the whole `mcpServers` back as it resolved it, `$VAR` / `${VAR}` filled in from its environment, so a person's token would land in the file. Plannotator edits the file itself (`qwenWay`, `QWEN_SETTINGS_RULES`): a file that does not parse or is read-only is left as it is (said with the reason, tried again next run). An entry Plannotator added is checked and removed in the file its record names (`recordedFile`), not the one the environment names now. Places are compared as the file system names them (`samePlace`: the real path of the deepest existing folder, the rest as written), so a symlinked `~/.qwen`, `/tmp` and `/private/tmp`, a trailing slash, or another case on a volume that ignores case (the real path has the case on disk) are one place. Case is never folded by Plannotator: on a case-sensitive volume (Linux, or one so formatted on macOS) `qwen` and `Qwen` are two folders. When `QWEN_HOME` names another place than the add (set in one shell, not in another: an accident of how the Inbox was started), a run reads the recorded file only: an entry gone from it is removed outside, as anywhere; one still there is left with both files untouched, and said once per pair of places (`elsewhere` in the report, `elsewhere_said`, kept when a run from the matching shell comes between, cleared when Settings acts; a run whose `QWEN_HOME` matches drops the other shell's line from the band, and so does any Settings switch of that agent). Settings → Agents shows it off, state `elsewhere`: "Connected in <recorded file>. Turn on to move it here." Uninstall cleans the recorded file. Only the person moves it, by turning it on: the entry is added in the new home first (a relative `QWEN_HOME`, another program named `qwen`, a new settings.json that does not parse or is read-only: refused, nothing changed), then taken out of the recorded file; when that cannot be done (read-only, no longer parses), the new entry is taken back out, so only the recorded one is ever left (if even that fails, both stay, said, and the new one is kept on the record as a `stray` that uninstall removes too). Strays stay recorded through later Settings switches: turning it on where a stray is records that entry as added (the old one moved out), turning it off removes the strays too (one that cannot go stays recorded, said), and uninstall forgets an agent's record only when every entry of it went. A stray is checked as the agent's own entry is: one gone is nothing to do, one the person replaced with their own is theirs (named by uninstall, never touched, no longer recorded). A `qwen` on PATH is still asked its `--version` (any Qwen Code version will do; another program named `qwen` is left to the person), run in the home folder (`cwd`), so Qwen never migrates or resets the Inbox's working folder's `.qwen/settings.json`. The agent CLIs run with no stdin in their own process group; the time limit kills the group, and the answer comes at exit even if a grandchild keeps the output open.
 - Rules: an agent with a record is never added again by itself (turned off, removed outside Plannotator: `removed_outside_at`, checked read-only each run; foreign). An entry is ours when it runs exactly this CLI's command or the one its record says Plannotator wrote; for "already connected", also any `plannotator` binary or checkout running `inbox mcp` (`isPlannotatorInboxCommand`: the program's name is exactly `plannotator`, not `my-plannotator-proxy`). Anything else named `plannotator-inbox` is never replaced and is recorded `foreign`. A refused file or a failing or hung `mcp add` is tried again next run and said again only when its reason changes (`failures` in agents.json). Limits: 10 s per agent, 30 s in all (agents still going are `unfinished`). A test run (PLANNOTATOR_TEST_SANDBOX) whose home is not a scratch folder connects nothing (`agentHomeAllowed`).
-- Said once: the first run "Connected Codex, Gemini CLI and Cursor to the Inbox (Claude Code was already on)." plus "Agents use it from their next session. PLANNOTATOR_INBOX_CONNECT=0 skips this step; plannotator uninstall removes what it added."; a later run "Connected Amp to the Inbox (new on this computer)."; failures and foreign entries name the file and reason (`formatConnectReport`); an agent only a person can connect (no CLI on PATH, Pi before 0.99, Cline) is named with its reason ("Pi needs connecting by hand: …"), once per reason (`manual_said` in `agents.json`, `manual_why` on the report); time limits are said as they are (`formatSeconds`: "1.5 s"). The run's report is kept in `agents.json` (`last_report`, `seen: false` when it has news) and served at `GET /api/inbox/agents` (local only; records with `~` paths). Uninstall removes only entries Plannotator recorded as `added` that still run the command it wrote; with no record at all (`agents.json` lost) nothing is removed, and an entry that runs exactly the binary being uninstalled is named in a warning with how to remove it, since the person may have added it by hand; one the person added (`found`) is left.
+- Said once: the first run "Connected Codex, Gemini CLI and Cursor to the Inbox (Claude Code was already on)." plus "Agents use it from their next session. PLANNOTATOR_INBOX_CONNECT=0 skips this step; plannotator uninstall removes what it added."; a later run "Connected Amp to the Inbox (new on this computer)."; failures and foreign entries name the file and reason (`formatConnectReport`); an agent only a person can connect (no CLI on PATH, Pi before 0.99, Cline) is named with its reason ("Pi needs connecting by hand: …"), once per reason (`manual_said` in `agents.json`, `manual_why` on the report); time limits are said as they are (`formatSeconds`: "1.5 s"). The run's report is kept in `agents.json` (`last_report`, `seen: false` when it has news) and served at `GET /api/inbox/agents` (local only; records with `~` paths). Uninstall removes only entries Plannotator recorded as `added` that still run the command it wrote; with no record at all (`agents.json` lost) nothing is removed, and an entry that runs exactly the binary being uninstalled is named in a warning with how to remove it, since the person may have added it by hand; one the person added (`found`) is left. After that, every agent's file is read once more (`remainingInboxReferences`, `packages/server/uninstall-inbox-references.ts`, skipping the agents the plan already removed or named): any other `plannotator-inbox` that runs an install path, bare `plannotator`, or a source checkout's `inbox mcp` is named in a warning with how to remove it (`inboxEntryRemovalHint`; Claude Code's `~/.claude.json`: `claude mcp remove plannotator-inbox -s user`, never a hand edit of a file Claude Code rewrites while it runs). These are warnings, never a reason to keep the CLI. This check writes nothing, so it reads every agent's JSON leniently (comments and trailing commas, `RawReadOptions.lenient`), Cursor's, Kiro's and the Claude app's too. An agent's file that still cannot be read (not JSON / TOML, not UTF-8, permission denied) does keep it: uninstall cannot tell what it runs. The error names the file, the agent, the reason, that Plannotator did not change it, and the next step. Each file is said once per run. A file over 1 MiB (Claude Code's `~/.claude.json` holds its history) is first searched raw, a chunk at a time, for the text `plannotator-inbox` (`agentFileContains` in `agent-files.ts`): a file without it is never decoded or parsed, whatever it holds. One that has it is parsed if it is at most 64 MiB (`UNINSTALL_PARSE_MAX_BYTES`); a bigger one is not read, and a warning says so with how to remove the entry, never a reason to keep the CLI. Not covered: a key spelled with JSON `\u` escapes.
 - Tests: `packages/server/inbox-agents.test.ts` (fake agent CLIs on a scratch PATH and HOME, `tests/helpers/fake-agents.ts`; the real CLIs are never run), `packages/server/inbox-agents-qwen.test.ts` (Qwen: comments and a person's `${VAR}` kept byte for byte, `qwen --version` run in the home folder, `QWEN_HOME` from the environment or Qwen's `.env` files, a relative one, a foreign `qwen`, turned off, a malformed, trailing-comma or read-only settings.json, removal), `packages/server/inbox-connect-route.test.ts`, `apps/hook/server/inbox-connect-cli.test.ts` (the CLI as processes), the uninstall block in `packages/server/uninstall.test.ts`. The guard test also fails on a path from the real home to an agent's folder and on connecting agents with no agent environment (`agentHomeFindings`, `agentConnectFindings`).
 
 **The note in each agent's instructions** (`packages/server/inbox-agent-notes.ts`; decision 5).
@@ -102,7 +102,7 @@ One long-lived local server per machine. Agents leave messages, `:::question` bl
   - **The release page's redirect** on github.com is read whatever the case of the owner and repository in its path; a mirror (`PLANNOTATOR_UPDATE_LATEST_URL`) is read exactly.
   - **The words.** Settings → General and About say "Up to date" only after a successful check in the last 24 h with checks on (`checkStatusWords`): otherwise "Update checks are off", "Can't check for updates since … · last tried …", "Last check failed <time>", "Last checked <day>" or "Not checked yet". The terminal hint's failing line names the install script only for the binary it manages; any other copy is told to update the way it was installed.
   - Proofs: `packages/shared/update-check-stuck.test.ts`, `packages/server/auto-update-stuck.test.ts` (the real POSIX wrapper killed with SIGKILL), `packages/server/inbox-updates-stuck.test.ts` (a long-running Inbox with an injected clock against a fake GitHub on loopback: the release shows within 10 minutes without a restart; failing for 3 h; an unwritable state file; a dead lock; a future lock; a far snooze; Update now → Ready → Restart → What's new), `apps/hook/server/update-command-stuck.test.ts`, the failing cases in `packages/server/update-advert.test.ts` and `apps/pi-extension/update-advert.test.ts`, and the DOM tests `packages/inbox/updateStuck.test.tsx` and `packages/ui/components/MenuVersionSection.test.tsx`.
-- Plain `uninstall` and `--purge` both remove the `plannotator-inbox` MCP entries the connect step added (see "Connecting the agents on this computer"; `removeInboxAgentConnections` in `packages/server/uninstall.ts`): with the binary gone, an entry would fail to start at every agent launch. A plain uninstall then forgets those records, so a reinstall connects them again.
+- Plain `uninstall` and `--purge` both remove the `plannotator-inbox` MCP entries the connect step added (see "Connecting the agents on this computer"; `removeInboxAgentConnections` in `packages/server/uninstall.ts`): with the binary gone, an entry would fail to start at every agent launch. A plain uninstall then forgets those records, so a reinstall connects them again. An entry it did not add is named, never removed, and never keeps the CLI; an agent config it cannot read keeps the CLI (see "Connecting the agents on this computer").
 - `uninstall --purge` stops a running Inbox first (its token-guarded stop route, then SIGTERM only while the port still answers with that `serverSession` and pid) and removes `inbox/` (`inbox` is in `PURGE_OWNED_TOP_LEVEL`, `packages/server/uninstall.ts`). An Inbox that is still running after that blocks the data purge: uninstall says to quit it and run `uninstall --purge` again. It also takes down a tailnet mapping a crashed Inbox left (`takeDownInboxTailnet`, only when `inbox.json` has `tailnet`; `takeDownInboxTailscale` for the window's, only when `tailscale` keeps its ports). `--dry-run` lists the stop and the take-down. A plain uninstall keeps the data.
 
 **Store** (`packages/shared/inbox/`, one writer: the server process).
diff --git a/packages/server/agent-files.ts b/packages/server/agent-files.ts
index acfafaaeb5..7a9030acd3 100644
--- a/packages/server/agent-files.ts
+++ b/packages/server/agent-files.ts
@@ -18,7 +18,7 @@
  */
 
 import { randomBytes } from "node:crypto";
-import { chmodSync, lstatSync, mkdirSync, readFileSync, readlinkSync, realpathSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { chmodSync, closeSync, lstatSync, mkdirSync, openSync, readFileSync, readlinkSync, readSync, realpathSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { basename, dirname, isAbsolute, join, resolve } from "node:path";
 
 /** Files larger than this are never edited. */
@@ -32,7 +32,8 @@ export type AgentFileRead =
    * lone LF), which new text takes.
    */
   | { kind: "file"; path: string; target: string; text: string; mode: number; crlf: boolean; bom: boolean; linked: boolean }
-  | { kind: "refused"; path: string; target: string; reason: string };
+  /** `tooBig`: refused only for its size. */
+  | { kind: "refused"; path: string; target: string; reason: string; tooBig?: true };
 
 /** Where `path` leads: its target when it is a symlink (followed as far as it exists), else itself. */
 export function resolveAgentFileTarget(path: string): string {
@@ -69,7 +70,7 @@ export function readAgentFile(path: string, maxBytes: number = AGENT_FILE_MAX_BY
     return { kind: "refused", path, target, reason: describeFsError(error) };
   }
   if (!stat.isFile()) return { kind: "refused", path, target, reason: "it is not a regular file" };
-  if (stat.size > maxBytes) return { kind: "refused", path, target, reason: `it is larger than ${Math.round(maxBytes / (1024 * 1024))} MiB` };
+  if (stat.size > maxBytes) return { kind: "refused", path, target, reason: `it is larger than ${Math.round(maxBytes / (1024 * 1024))} MiB`, tooBig: true };
   let bytes: Buffer;
   try {
     bytes = readFileSync(target);
@@ -88,6 +89,49 @@ export function readAgentFile(path: string, maxBytes: number = AGENT_FILE_MAX_BY
   return { kind: "file", path, target, text, mode: stat.mode & 0o777, crlf: dominantCrlf(text), bom, linked };
 }
 
+/**
+ * Whether a file over `above` bytes holds `needle` (ASCII) anywhere in its raw
+ * bytes, read a chunk at a time so a big file is never held whole. "small":
+ * not searched (missing, not a file, or not over `above`); `readAgentFile`
+ * decides it. Read-only.
+ */
+export function agentFileContains(path: string, needle: string, above: number): "small" | "absent" | "present" | { refused: string } {
+  const target = resolveAgentFileTarget(path);
+  let size: number;
+  try {
+    const stat = statSync(target);
+    if (!stat.isFile()) return "small";
+    size = stat.size;
+  } catch {
+    return "small";
+  }
+  if (size <= above) return "small";
+  const pattern = Buffer.from(needle, "utf8");
+  const chunk = Buffer.alloc(1024 * 1024 + pattern.length);
+  let fd: number;
+  try {
+    fd = openSync(target, "r");
+  } catch (error) {
+    return { refused: describeFsError(error) };
+  }
+  try {
+    let carried = 0;
+    for (;;) {
+      const read = readSync(fd, chunk, carried, chunk.length - carried, null);
+      if (read === 0) return "absent";
+      const filled = carried + read;
+      if (chunk.subarray(0, filled).includes(pattern)) return "present";
+      // Keep the tail, in case the needle spans two chunks.
+      carried = Math.min(pattern.length - 1, filled);
+      chunk.copy(chunk, 0, filled - carried, filled);
+    }
+  } catch (error) {
+    return { refused: describeFsError(error) };
+  } finally {
+    closeSync(fd);
+  }
+}
+
 /** More CRLF than lone LF line endings. */
 export function dominantCrlf(text: string): boolean {
   const crlf = (text.match(/\r\n/g) ?? []).length;
diff --git a/packages/server/inbox-agents.ts b/packages/server/inbox-agents.ts
index 2270c9e68c..5fbdee8e5c 100644
--- a/packages/server/inbox-agents.ts
+++ b/packages/server/inbox-agents.ts
@@ -58,6 +58,7 @@ import { qwenHome, qwenHomeIsRelative } from "@plannotator/shared/inbox/qwen-ses
 import { INBOX_QWEN_TRUST_ON_CONNECT, QWEN_TRUST_REVOKED_REASON, ensureQwenTrust, retryQwenRevoke, setQwenTrust, type QwenTrustOutcome } from "./inbox-qwen-trust";
 import { addJsonMember, removeJsonMember } from "./json-edit";
 import {
+  agentFileContains,
   describeFsError,
   readAgentFile,
   samePlace,
@@ -350,8 +351,8 @@ export type InboxEntryRead =
   /** It runs this Inbox's stdio entry (or a recorded / Plannotator one; see `ownsEntry`). */
   | { kind: "ours"; argv: string[] }
   | { kind: "other"; argv: string[] | null }
-  /** The file could not be read or parsed; nothing is written to it. */
-  | { kind: "unreadable"; reason: string };
+  /** The file could not be read or parsed; nothing is written to it. `tooBig`: only its size stopped the read. */
+  | { kind: "unreadable"; reason: string; tooBig?: true };
 
 /**
  * Whether argv runs a Plannotator Inbox stdio entry, for uninstall's scan of
@@ -407,16 +408,50 @@ function at(root: unknown, keys: readonly string[]): unknown {
 }
 
 /** The raw `plannotator-inbox` value in a file: absent, a value, or why it cannot be read. */
-type RawEntry = { kind: "absent" } | { kind: "value"; value: unknown } | { kind: "unreadable"; reason: string };
+type RawEntry = { kind: "absent" } | { kind: "value"; value: unknown } | { kind: "unreadable"; reason: string; tooBig?: true };
 
-function rawJsonEntry(path: string, keys: readonly string[], jsonc: boolean, maxBytes?: number): RawEntry {
-  const read = readAgentFile(path, maxBytes);
+/**
+ * How a read-only look reads (uninstall's scan, uninstall-inbox-references.ts);
+ * the Inbox's own reads pass nothing.
+ */
+export type RawReadOptions = {
+  /** The most it reads and parses (readAgentFile's 1 MiB by default). */
+  maxBytes?: number;
+  /** Comments and trailing commas allowed in any agent's JSON, not only the JSONC ones. */
+  lenient?: boolean;
+  /** A file over this size is first searched, raw, for "plannotator-inbox": without it, it is not decoded at all. */
+  searchAbove?: number;
+};
+
+/** A raw search said the entry's name is not in the file, or the file could not be searched. */
+function searchedFirst(path: string, read: RawReadOptions | undefined): RawEntry | null {
+  if (read?.searchAbove === undefined) return null;
+  const found = agentFileContains(path, INBOX_MCP_SERVER_NAME, read.searchAbove);
+  if (found === "absent") return { kind: "absent" };
+  if (typeof found === "object") return { kind: "unreadable", reason: found.refused };
+  return null;
+}
+
+/** Strict JSON; when `lenient`, then with comments and trailing commas too. */
+function parseJsonLeniently(text: string, lenient: boolean): unknown {
+  try {
+    return JSON.parse(text);
+  } catch (error) {
+    if (!lenient) throw error;
+    return JSON.parse(stripJsonComments(text));
+  }
+}
+
+function rawJsonEntry(path: string, keys: readonly string[], jsonc: boolean, options?: RawReadOptions): RawEntry {
+  const searched = searchedFirst(path, options);
+  if (searched) return searched;
+  const read = readAgentFile(path, options?.maxBytes);
   if (read.kind === "missing") return { kind: "absent" };
-  if (read.kind === "refused") return { kind: "unreadable", reason: read.reason };
+  if (read.kind === "refused") return read.tooBig ? { kind: "unreadable", reason: read.reason, tooBig: true } : { kind: "unreadable", reason: read.reason };
   if (!read.text.trim()) return { kind: "absent" };
   let parsed: unknown;
   try {
-    parsed = JSON.parse(jsonc ? stripJsonComments(read.text) : read.text);
+    parsed = jsonc ? JSON.parse(stripJsonComments(read.text)) : parseJsonLeniently(read.text, options?.lenient === true);
   } catch {
     return { kind: "unreadable", reason: "it is not plain JSON" };
   }
@@ -425,10 +460,12 @@ function rawJsonEntry(path: string, keys: readonly string[], jsonc: boolean, max
 }
 
 /** Codex's config.toml, parsed as TOML (every form: tables, inline tables, dotted keys, quoted parts). */
-function rawCodexEntry(path: string): RawEntry {
-  const read = readAgentFile(path);
+function rawCodexEntry(path: string, options?: RawReadOptions): RawEntry {
+  const searched = searchedFirst(path, options);
+  if (searched) return searched;
+  const read = readAgentFile(path, options?.maxBytes);
   if (read.kind === "missing") return { kind: "absent" };
-  if (read.kind === "refused") return { kind: "unreadable", reason: read.reason };
+  if (read.kind === "refused") return read.tooBig ? { kind: "unreadable", reason: read.reason, tooBig: true } : { kind: "unreadable", reason: read.reason };
   let parsed: unknown;
   try {
     parsed = Bun.TOML.parse(read.text);
@@ -479,7 +516,7 @@ interface AgentSpec {
   /** Where its `plannotator-inbox` entry lives (null: unknown, or not a file). */
   file(e: AgentEnvironment): string | null;
   /** The raw entry, read only. Null: the agent's file is not known; the record decides. */
-  raw(e: AgentEnvironment): RawEntry | null;
+  raw(e: AgentEnvironment, read?: RawReadOptions): RawEntry | null;
   /** How uninstall removes it, when not a JSON key. */
   remove?: { bin: string; args: string[] };
 }
@@ -838,7 +875,7 @@ export const AGENT_SPECS: readonly AgentSpec[] = [
     detect: (e) => !!e.which("codex") || codexHomeHasUserConfig(e),
     way: (e, probe) => cliWay(e, "codex", (cmd) => ["mcp", "add", NAME, "--", ...cmd], ["mcp", "remove", NAME], INBOX_CONNECT_AGENT_TIMEOUT_MS, probe === true),
     file: (e) => join(codexHome(e), "config.toml"),
-    raw: (e) => rawCodexEntry(join(codexHome(e), "config.toml")),
+    raw: (e, read) => rawCodexEntry(join(codexHome(e), "config.toml"), read),
     remove: { bin: "codex", args: ["mcp", "remove", NAME] },
   },
   {
@@ -846,7 +883,7 @@ export const AGENT_SPECS: readonly AgentSpec[] = [
     detect: (e) => !!e.which("gemini") || isDir(geminiDir(e)),
     way: (e, probe) => cliWay(e, "gemini", (cmd) => ["mcp", "add", "-s", "user", NAME, ...cmd], ["mcp", "remove", "-s", "user", NAME], INBOX_CONNECT_AGENT_TIMEOUT_MS, probe === true),
     file: (e) => join(geminiDir(e), "settings.json"),
-    raw: (e) => rawJsonEntry(join(geminiDir(e), "settings.json"), ["mcpServers"], true),
+    raw: (e, read) => rawJsonEntry(join(geminiDir(e), "settings.json"), ["mcpServers"], true, read),
     remove: { bin: "gemini", args: ["mcp", "remove", "-s", "user", NAME] },
   },
   {
@@ -854,21 +891,21 @@ export const AGENT_SPECS: readonly AgentSpec[] = [
     detect: (e) => !!e.which("qwen") || isDir(qwenDir(e)),
     way: (e, probe) => qwenWay(e, probe === true),
     file: (e) => join(qwenDir(e), "settings.json"),
-    raw: (e) => rawJsonEntry(join(qwenDir(e), "settings.json"), ["mcpServers"], true),
+    raw: (e, read) => rawJsonEntry(join(qwenDir(e), "settings.json"), ["mcpServers"], true, read),
   },
   {
     id: "cursor",
     detect: (e) => isDir(join(e.homeDir, ".cursor")) || !!e.which("cursor") || !!e.which("cursor-agent"),
     way: async () => ({ kind: "json", keys: ["mcpServers"] }),
     file: (e) => join(e.homeDir, ".cursor", "mcp.json"),
-    raw: (e) => rawJsonEntry(join(e.homeDir, ".cursor", "mcp.json"), ["mcpServers"], false),
+    raw: (e, read) => rawJsonEntry(join(e.homeDir, ".cursor", "mcp.json"), ["mcpServers"], false, read),
   },
   {
     id: "windsurf",
     detect: (e) => !!e.which("devin"),
     way: (e, probe) => cliWay(e, "devin", (cmd) => ["mcp", "add", "-s", "user", NAME, "--", ...cmd], ["mcp", "remove", "-s", "user", NAME], INBOX_CONNECT_AGENT_TIMEOUT_MS, probe === true),
     file: (e) => join(xdgConfigHome(e), "devin", "config.json"),
-    raw: (e) => rawJsonEntry(join(xdgConfigHome(e), "devin", "config.json"), ["mcpServers"], true),
+    raw: (e, read) => rawJsonEntry(join(xdgConfigHome(e), "devin", "config.json"), ["mcpServers"], true, read),
     remove: { bin: "devin", args: ["mcp", "remove", "-s", "user", NAME] },
   },
   {
@@ -876,7 +913,7 @@ export const AGENT_SPECS: readonly AgentSpec[] = [
     detect: (e) => !!e.which("amp"),
     way: (e, probe) => cliWay(e, "amp", (cmd) => ["mcp", "add", NAME, "--", ...cmd], ["mcp", "remove", NAME], INBOX_CONNECT_AGENT_TIMEOUT_MS, probe === true),
     file: (e) => join(xdgConfigHome(e), "amp", "settings.json"),
-    raw: (e) => rawJsonEntry(join(xdgConfigHome(e), "amp", "settings.json"), ["amp.mcpServers"], true),
+    raw: (e, read) => rawJsonEntry(join(xdgConfigHome(e), "amp", "settings.json"), ["amp.mcpServers"], true, read),
     remove: { bin: "amp", args: ["mcp", "remove", NAME] },
   },
   {
@@ -892,7 +929,7 @@ export const AGENT_SPECS: readonly AgentSpec[] = [
     detect: (e) => !!e.which("kiro-cli") || isDir(join(e.homeDir, ".kiro")),
     way: async () => ({ kind: "json", keys: ["mcpServers"] }),
     file: (e) => join(e.homeDir, ".kiro", "settings", "mcp.json"),
-    raw: (e) => rawJsonEntry(join(e.homeDir, ".kiro", "settings", "mcp.json"), ["mcpServers"], false),
+    raw: (e, read) => rawJsonEntry(join(e.homeDir, ".kiro", "settings", "mcp.json"), ["mcpServers"], false, read),
   },
   {
     id: "pi",
@@ -902,7 +939,7 @@ export const AGENT_SPECS: readonly AgentSpec[] = [
         ? Promise.resolve({ kind: "tool", host: "pi" } as ConnectWay)
         : cliWay(e, "pi", (cmd) => ["mcp", "add", NAME, "--", ...cmd], ["mcp", "remove", NAME], INBOX_CONNECT_AGENT_TIMEOUT_MS, probe === true),
     file: (e) => join(piAgentDir(e), "mcp.json"),
-    raw: (e) => rawJsonEntry(join(piAgentDir(e), "mcp.json"), ["mcpServers"], true),
+    raw: (e, read) => rawJsonEntry(join(piAgentDir(e), "mcp.json"), ["mcpServers"], true, read),
     remove: { bin: "pi", args: ["mcp", "remove", NAME] },
   },
   {
@@ -918,7 +955,7 @@ export const AGENT_SPECS: readonly AgentSpec[] = [
     detect: (e) => isDir(claudeAppDir(e)),
     way: async () => ({ kind: "json", keys: ["mcpServers"] }),
     file: (e) => join(claudeAppDir(e), "claude_desktop_config.json"),
-    raw: (e) => rawJsonEntry(join(claudeAppDir(e), "claude_desktop_config.json"), ["mcpServers"], false),
+    raw: (e, read) => rawJsonEntry(join(claudeAppDir(e), "claude_desktop_config.json"), ["mcpServers"], false, read),
   },
 ];
 
@@ -1470,6 +1507,16 @@ export interface RemovalPlan {
   items: RemovalPlanItem[];
   /** Entries left with a reason: one Plannotator added that runs something else now, or one no record says it added. */
   skipped: string[];
+  /** The agents whose own entry `skipped` names. */
+  named: InboxAgentId[];
+}
+
+/** How the person removes an agent's `plannotator-inbox` entry themselves. */
+export function inboxEntryRemovalHint(id: InboxAgentId): string {
+  // Claude Code's user scope is in ~/.claude.json, which Claude Code rewrites while it runs.
+  if (id === "claude-code") return `run \`claude mcp remove ${NAME} -s user\``;
+  const remove = agentSpec(id).remove;
+  return jsonFileFor(id) ? "delete that entry by hand" : remove ? `run \`${remove.bin} ${remove.args.join(" ")}\`` : "remove it in the agent's settings";
 }
 
 /**
@@ -1488,7 +1535,8 @@ export function planInboxAgentRemoval(dataDir: string, e: AgentEnvironment, ourC
   /** After every agent's own entry, so a caller looking for an agent's item finds that one first. */
   const strays: RemovalPlanItem[] = [];
   const skipped: string[] = [];
-  if (!agentHomeAllowed(e)) return { items, skipped };
+  const named: InboxAgentId[] = [];
+  if (!agentHomeAllowed(e)) return { items, skipped, named };
   for (const spec of AGENT_SPECS) {
     const record = file.agents[spec.id];
     const label = INBOX_AGENT_LABELS[spec.id];
@@ -1524,8 +1572,8 @@ export function planInboxAgentRemoval(dataDir: string, e: AgentEnvironment, ourC
       const unrecorded = raw === null ? null : classify(raw, [[...ourCommand]], false);
       if (unrecorded?.kind === "ours") {
         const at = displayPath(spec.file(e), e);
-        const how = jsonFileFor(spec.id) ? "delete that entry by hand" : spec.remove ? `run \`${spec.remove.bin} ${spec.remove.args.join(" ")}\`` : "remove it in the agent's settings";
-        skipped.push(`${label}'s "${NAME}"${at ? ` in ${at}` : ""} runs this Plannotator, but no record says Plannotator added it, so it may be yours (to remove it, ${how})`);
+        skipped.push(`${label}'s "${NAME}"${at ? ` in ${at}` : ""} runs this Plannotator, but no record says Plannotator added it, so it may be yours (to remove it, ${inboxEntryRemovalHint(spec.id)})`);
+        named.push(spec.id);
       }
       continue;
     }
@@ -1533,6 +1581,7 @@ export function planInboxAgentRemoval(dataDir: string, e: AgentEnvironment, ourC
     const read = raw === null ? null : classify(raw, ours, false);
     if (read?.kind === "other") {
       skipped.push(`${label}'s "${NAME}" now runs something else (changed by hand), so it is yours`);
+      named.push(spec.id);
       continue;
     }
     if (read && read.kind !== "ours") continue;
@@ -1556,6 +1605,7 @@ export function planInboxAgentRemoval(dataDir: string, e: AgentEnvironment, ourC
     const bin = e.which(remove.bin);
     if (!bin) {
       skipped.push(`${label}'s "${NAME}"${shown ? ` in ${shown}` : ""}: ${remove.bin} is not on PATH; run \`${remove.bin} ${remove.args.join(" ")}\``);
+      named.push(spec.id);
       continue;
     }
     items.push({
@@ -1569,7 +1619,7 @@ export function planInboxAgentRemoval(dataDir: string, e: AgentEnvironment, ourC
       },
     });
   }
-  return { items: [...items, ...strays], skipped };
+  return { items: [...items, ...strays], skipped, named };
 }
 
 /** The agents whose JSON file Plannotator edits itself: where their entry is and how the file is edited. */
@@ -1626,10 +1676,13 @@ export interface InboxAgentReachState {
  * `~/.claude.json`. Read only, never written: Claude Code is connected through
  * its plugin, and this only says that one added by hand already reaches the Inbox.
  */
-function claudeCodeMcpEntry(e: AgentEnvironment, ours: readonly (readonly string[])[]): InboxEntryRead {
-  const dir = envDir(e, "CLAUDE_CONFIG_DIR");
+export function claudeCodeMcpPath(e: AgentEnvironment): string {
+  return join(envDir(e, "CLAUDE_CONFIG_DIR") ?? e.homeDir, ".claude.json");
+}
+
+export function claudeCodeMcpEntry(e: AgentEnvironment, ours: readonly (readonly string[])[], read: RawReadOptions = { maxBytes: CLAUDE_JSON_MAX_BYTES }): InboxEntryRead {
   // .claude.json holds Claude Code's per-project history and often passes 1 MiB; this read only looks.
-  return classify(rawJsonEntry(join(dir ?? e.homeDir, ".claude.json"), ["mcpServers"], false, CLAUDE_JSON_MAX_BYTES), ours, true);
+  return classify(rawJsonEntry(claudeCodeMcpPath(e), ["mcpServers"], false, read), ours, true);
 }
 
 /** The most `.claude.json` the read-only MCP lookup reads. */
diff --git a/packages/server/uninstall-hooks.ts b/packages/server/uninstall-hooks.ts
new file mode 100644
index 0000000000..3b423a0357
--- /dev/null
+++ b/packages/server/uninstall-hooks.ts
@@ -0,0 +1,195 @@
+import { basename, isAbsolute } from "node:path";
+import { simpleShellCommandWords } from "@plannotator/shared/plannotator-tool";
+import { parseT3HookCommand } from "@plannotator/shared/t3-hook-command";
+
+type HookSuffix = "" | "improve-context" | "t3-hook";
+export type ManagedHookSpec = { readonly event: string; readonly matcher?: string; readonly suffix: HookSuffix };
+
+function asRecord(value: unknown): Record<string, unknown> | null {
+  return typeof value === "object" && value !== null && !Array.isArray(value)
+    ? value as Record<string, unknown>
+    : null;
+}
+
+function sameCommand(left: string, right: string, platform: NodeJS.Platform): boolean {
+  const normalizedLeft = left.replace(/\\/g, "/");
+  const normalizedRight = right.replace(/\\/g, "/");
+  return platform === "win32"
+    ? normalizedLeft.toLowerCase() === normalizedRight.toLowerCase()
+    : normalizedLeft === normalizedRight;
+}
+
+/** Read a literal executable, never shell wrappers or commands that merely mention it. */
+function commandParts(command: string) {
+  const match = /^(?:"([^"$`]+)"|'([^']+)'|([^\s"';&|<>()$`*?\[{}]+))(?=\s|[;&|<>()]|$)([\s\S]*)$/.exec(command.trim());
+  if (!match) return null;
+  const executable = match[1] ?? match[2] ?? match[3];
+  if (!executable) return null;
+  const tail = match[4] ?? "";
+  // Trimming the tail must not turn a shell command separator into whitespace.
+  return { executable, args: /[\r\n]/.test(tail) ? null : simpleShellCommandWords(tail) };
+}
+
+function isPlannotatorExecutable(
+  executable: string,
+  binaryPaths: readonly string[],
+  platform: NodeJS.Platform,
+  allowRelocatedBinary: boolean,
+): boolean {
+  if (executable === "plannotator") return true;
+  if (platform === "win32" && /^(?:plannotator|plannotator\.exe)$/i.test(executable)) return true;
+  if (binaryPaths.some((path) => sameCommand(executable, path, platform))) return true;
+  if (!allowRelocatedBinary || !isAbsolute(executable)) return false;
+  const name = basename(executable).toLowerCase();
+  return name === "plannotator" || name === "plannotator.exe";
+}
+
+/** The whole command is an install path, as written: install.sh writes the Codex hook unquoted, so a path with spaces is one word there. */
+function isBinaryPathCommand(command: string, binaryPaths: readonly string[], tail: string, platform: NodeJS.Platform): boolean {
+  const trimmed = command.trim();
+  return binaryPaths.some((path) => sameCommand(trimmed, `${path}${tail}`, platform));
+}
+
+/** Only supported hook arguments are safe to remove automatically. */
+export function isManagedHook(
+  value: unknown,
+  binaryPaths: readonly string[],
+  suffix: HookSuffix,
+  platform: NodeJS.Platform,
+  allowRelocatedBinary = false,
+): boolean {
+  const hook = asRecord(value);
+  if (!hook || hook.type !== "command" || typeof hook.command !== "string") return false;
+  if (suffix === "t3-hook") {
+    const parsed = parseT3HookCommand(hook.command);
+    return parsed !== undefined && isPlannotatorExecutable(parsed.executable, binaryPaths, platform, false);
+  }
+  if (isBinaryPathCommand(hook.command, binaryPaths, suffix ? ` ${suffix}` : "", platform)) return true;
+  const parsed = commandParts(hook.command);
+  if (!parsed || !parsed.args || !isPlannotatorExecutable(parsed.executable, binaryPaths, platform, allowRelocatedBinary)) return false;
+
+  const remaining: string[] = [];
+  let browserSeen = false;
+  for (let index = 0; index < parsed.args.length; index++) {
+    const arg = parsed.args[index];
+    if (arg !== "--browser") {
+      if (arg !== undefined) remaining.push(arg);
+      continue;
+    }
+    const browser = parsed.args[++index];
+    if (browserSeen || !browser || browser.startsWith("-")) return false;
+    browserSeen = true;
+  }
+  return suffix === ""
+    ? remaining.length === 0
+    : remaining.length === 1 && remaining[0] === suffix;
+}
+
+/** Split only outside quotes/comments. These segments are inspected, never executed or auto-removed. */
+function commandSegments(command: string): string[] {
+  const segments: string[] = [];
+  let start = 0;
+  let quote: "'" | '"' | null = null;
+  let comment = false;
+  for (let index = 0; index < command.length; index++) {
+    const char = command[index];
+    if (comment) {
+      if (char !== "\n" && char !== "\r") continue;
+      comment = false;
+      start = index + 1;
+      continue;
+    }
+    if (char === "\\" && quote !== "'") {
+      index++;
+      continue;
+    }
+    if (quote) {
+      if (char === quote) quote = null;
+      continue;
+    }
+    if (char === "'" || char === '"') {
+      quote = char;
+      continue;
+    }
+    if (char === "#" && (index === start || /\s/.test(command[index - 1] ?? ""))) {
+      segments.push(command.slice(start, index));
+      comment = true;
+      continue;
+    }
+    if (char && ";&|()\r\n".includes(char)) {
+      segments.push(command.slice(start, index));
+      start = index + 1;
+    }
+  }
+  if (!comment) segments.push(command.slice(start));
+  return segments;
+}
+
+/** Skip literal shell assignments, keeping quoted values intact. */
+function withoutAssignments(segment: string): string {
+  let rest = segment.trimStart();
+  while (/^[A-Za-z_][A-Za-z0-9_]*=/.test(rest)) {
+    let quote: "'" | '"' | null = null;
+    let index = 0;
+    for (; index < rest.length; index++) {
+      const char = rest[index];
+      if (char === "\\" && quote !== "'") { index++; continue; }
+      if (quote) { if (char === quote) quote = null; continue; }
+      if (char === "'" || char === '"') { quote = char; continue; }
+      if (char && /\s/.test(char)) break;
+    }
+    rest = rest.slice(index).trimStart();
+  }
+  return rest;
+}
+
+/** Find surviving invocations in any event/matcher, including commands we must not edit. */
+export function remainingHookReferences(
+  config: unknown,
+  binaryPaths: readonly string[],
+  platform: NodeJS.Platform,
+  allowRelocatedBinary: boolean,
+  projectedRemovals: readonly ManagedHookSpec[] = [],
+  removedVibeIndices: ReadonlySet<number> = new Set(),
+): string[] {
+  const root = asRecord(config);
+  const invokesPlannotator = (command: unknown): boolean => {
+    if (typeof command !== "string") return false;
+    // An install path written unquoted, spaces and all, as its first word.
+    const trimmed = command.trim();
+    if (binaryPaths.some((path) => sameCommand(trimmed.slice(0, path.length), path, platform) && /^(?:\s|$)/.test(trimmed.slice(path.length)))) return true;
+    const gated = parseT3HookCommand(command)?.executable;
+    if (gated && isPlannotatorExecutable(gated, binaryPaths, platform, allowRelocatedBinary)) return true;
+    return commandSegments(command).some((segment) => {
+      const executable = commandParts(withoutAssignments(segment))?.executable;
+      return executable !== undefined && isPlannotatorExecutable(executable, binaryPaths, platform, allowRelocatedBinary);
+    });
+  };
+  // Vibe stores commands directly in [[hooks]], rather than nested event entries.
+  if (Array.isArray(root?.hooks)) {
+    return root.hooks.flatMap((value: unknown, index) =>
+      !removedVibeIndices.has(index) && invokesPlannotator(asRecord(value)?.command) ? [`hooks[${index}].command`] : [],
+    );
+  }
+  const hooks = root ? asRecord(root.hooks) : null;
+  if (!hooks) return [];
+  const references: string[] = [];
+  for (const [event, entries] of Object.entries(hooks)) {
+    if (!Array.isArray(entries)) continue;
+    entries.forEach((value: unknown, entryIndex) => {
+      const entry = asRecord(value);
+      if (!entry || !Array.isArray(entry.hooks)) return;
+      entry.hooks.forEach((value: unknown, hookIndex: number) => {
+        const hook = asRecord(value);
+        if (!hook || hook.type !== "command" || typeof hook.command !== "string") return;
+        const willRemove = projectedRemovals.some((spec) => spec.event === event
+          && (spec.matcher === undefined || spec.matcher === entry.matcher)
+          && isManagedHook(hook, binaryPaths, spec.suffix, platform, allowRelocatedBinary));
+        if (!willRemove && invokesPlannotator(hook.command)) {
+          references.push(`hooks.${event}[${entryIndex}].hooks[${hookIndex}].command`);
+        }
+      });
+    });
+  }
+  return references;
+}
diff --git a/packages/server/uninstall-host-references.ts b/packages/server/uninstall-host-references.ts
new file mode 100644
index 0000000000..d10ad71719
--- /dev/null
+++ b/packages/server/uninstall-host-references.ts
@@ -0,0 +1,152 @@
+import { readFileSync, readdirSync } from "node:fs";
+import { join } from "node:path";
+import { describeFsError } from "./agent-files";
+
+/** A file uninstall must read to finish, and why it could not. Nothing is written to it. */
+export type Unreadable = { file: string; reason: string };
+
+export type HostReferences = {
+  /** What the host's own remove command takes away. While any is left, the CLI stays. */
+  references: string[];
+  /** Installs in another scope (a project's), which that command leaves. Named in a warning only. */
+  otherScopes: OtherScope[];
+  unreadable: Unreadable[];
+};
+
+export type OtherScope = { field: string; scope: string; project: string | null };
+
+type JsonRead =
+  | { kind: "missing" }
+  | { kind: "value"; value: unknown }
+  | { kind: "unreadable"; unreadable: Unreadable };
+
+function record(value: unknown): Record<string, unknown> | null {
+  return typeof value === "object" && value !== null && !Array.isArray(value)
+    ? value as Record<string, unknown>
+    : null;
+}
+
+function missing(error: unknown): boolean {
+  return error instanceof Error && "code" in error && error.code === "ENOENT";
+}
+
+function readJson(file: string): JsonRead {
+  let text: string;
+  try {
+    text = readFileSync(file, "utf8");
+  } catch (error) {
+    if (missing(error)) return { kind: "missing" };
+    return { kind: "unreadable", unreadable: { file, reason: describeFsError(error) } };
+  }
+  // An empty file holds nothing; a BOM (Windows editors) is not part of the JSON.
+  if (!text.trim()) return { kind: "missing" };
+  try {
+    return { kind: "value", value: JSON.parse(text.replace(/^/, "")) };
+  } catch {
+    return { kind: "unreadable", unreadable: { file, reason: "it is not valid JSON" } };
+  }
+}
+
+function objectFile(file: string): { value: Record<string, unknown> | null; unreadable: Unreadable[] } {
+  const read = readJson(file);
+  if (read.kind === "missing") return { value: null, unreadable: [] };
+  if (read.kind === "unreadable") return { value: null, unreadable: [read.unreadable] };
+  const value = record(read.value);
+  return { value, unreadable: value ? [] : [{ file, reason: "it is not a JSON object" }] };
+}
+
+export function enabledPluginReferences(file: string, id: string): HostReferences {
+  const field = `enabledPlugins[${JSON.stringify(id)}]`;
+  const read = objectFile(file);
+  const enabled = record(read.value?.enabledPlugins);
+  return { references: enabled?.[id] === true ? [`${file}, ${field}`] : [], otherScopes: [], unreadable: read.unreadable };
+}
+
+/**
+ * Claude Code's and Droid's plugin records: `enabledPlugins` in the user's
+ * settings.json, and one `installed_plugins.json` entry per scope. `--scope
+ * user` removes only the user's; a project's or a managed one stays, so it
+ * is named, never waited for. An entry with no scope predates scopes: the user's.
+ */
+export function pluginReferences(directory: string, id: string): HostReferences {
+  const enabled = enabledPluginReferences(join(directory, "settings.json"), id);
+  const file = join(directory, "plugins", "installed_plugins.json");
+  const installed = objectFile(file);
+  const entries = record(installed.value?.plugins)?.[id];
+  const installs: string[] = [];
+  const otherScopes: OtherScope[] = [];
+  if (Array.isArray(entries)) {
+    entries.forEach((entry: unknown, index) => {
+      const field = `${file}, plugins[${JSON.stringify(id)}][${index}]`;
+      const scope = record(entry)?.scope;
+      if (typeof scope !== "string" || scope === "user") {
+        installs.push(field);
+        return;
+      }
+      const project = record(entry)?.projectPath;
+      otherScopes.push({ field, scope, project: typeof project === "string" ? project : null });
+    });
+  }
+  // A user enabledPlugins key counts even with no user install: Claude Code installs (or rescopes) the plugin
+  // for the user from it at its next start.
+  return { references: [...enabled.references, ...installs], otherScopes, unreadable: [...enabled.unreadable, ...installed.unreadable] };
+}
+
+export function piPackageReferences(file: string): HostReferences {
+  const read = objectFile(file);
+  const packages = read.value?.packages;
+  return {
+    otherScopes: [],
+    unreadable: read.unreadable,
+    references: Array.isArray(packages) ? packages.flatMap((entry: unknown, index) => {
+      const source = typeof entry === "string" ? entry : record(entry)?.source;
+      return typeof source === "string" && /^npm:@plannotator\/pi-extension(?:@|$)/.test(source)
+        ? [`${file}, packages[${index}]${typeof entry === "string" ? "" : ".source"}`]
+        : [];
+    }) : [],
+  };
+}
+
+export function directoryReferences(directory: string, prefix: string): HostReferences {
+  try {
+    return {
+      references: readdirSync(directory).filter((entry) => entry.startsWith(prefix)).map((entry) => join(directory, entry)),
+      otherScopes: [],
+      unreadable: [],
+    };
+  } catch (error) {
+    return { references: [], otherScopes: [], unreadable: missing(error) ? [] : [{ file: directory, reason: describeFsError(error) }] };
+  }
+}
+
+/** VS Code can unregister an extension while leaving its files for later cleanup. */
+export function vscodeReferences(directory: string): HostReferences {
+  const id = "backnotprop.plannotator-webview";
+  const file = join(directory, "extensions.json");
+  const registry = readJson(file);
+  if (registry.kind === "unreadable") return { references: [], otherScopes: [], unreadable: [registry.unreadable] };
+  if (registry.kind === "value") {
+    if (!Array.isArray(registry.value)) {
+      return { references: [], otherScopes: [], unreadable: [{ file, reason: "it is not a JSON array" }] };
+    }
+    return {
+      references: registry.value.flatMap((entry: unknown, index) => {
+        const identifier = record(record(entry)?.identifier)?.id;
+        return typeof identifier === "string" && identifier.toLowerCase() === id
+          ? [`${file}, [${index}].identifier.id (${id})`]
+          : [];
+      }),
+      otherScopes: [],
+      unreadable: [],
+    };
+  }
+  // Older installations may not have a registration index. Honor their removal markers.
+  const directories = directoryReferences(directory, `${id}-`);
+  if (directories.references.length === 0) return directories;
+  const obsolete = objectFile(join(directory, ".obsolete"));
+  return {
+    references: directories.references.filter((path) => obsolete.value?.[path.slice(directory.length + 1)] !== true),
+    otherScopes: [],
+    unreadable: [...directories.unreadable, ...obsolete.unreadable],
+  };
+}
diff --git a/packages/server/uninstall-inbox-references.ts b/packages/server/uninstall-inbox-references.ts
new file mode 100644
index 0000000000..08b6c6b536
--- /dev/null
+++ b/packages/server/uninstall-inbox-references.ts
@@ -0,0 +1,75 @@
+import { INBOX_AGENT_LABELS, type InboxAgentId } from "@plannotator/core/inbox-types";
+import {
+  AGENT_SPECS, agentHomeAllowed, claudeCodeMcpEntry, claudeCodeMcpPath, displayPath, entryArgv,
+  INBOX_MCP_SERVER_NAME, inboxEntryRemovalHint, isPlannotatorInboxCommand, type AgentEnvironment,
+  type RawReadOptions,
+} from "./inbox-agents";
+import { AGENT_FILE_MAX_BYTES } from "./agent-files";
+import type { Unreadable } from "./uninstall-host-references";
+
+/**
+ * The most of one agent file this check parses. A file over 1 MiB (Claude
+ * Code's ~/.claude.json holds its history) is first searched, raw and a chunk
+ * at a time, for "plannotator-inbox"; only a file that has it is read whole
+ * and parsed, and only up to this size. One bigger than this that has it is
+ * not read: a warning says so, never a reason to keep the CLI.
+ */
+export const UNINSTALL_PARSE_MAX_BYTES = 64 * 1024 * 1024;
+
+/** This scan writes nothing, so it reads every agent's JSON leniently (comments, trailing commas). */
+const SCAN_READ: RawReadOptions = { maxBytes: UNINSTALL_PARSE_MAX_BYTES, lenient: true, searchAbove: AGENT_FILE_MAX_BYTES };
+
+export type InboxReferenceScan = {
+  /** Entries no record says Plannotator added that still run it: named with how to remove them, never a reason to keep the CLI. */
+  warnings: string[];
+  /** Agent configs that could not be read. */
+  unreadable: Array<Unreadable & { owner: string }>;
+};
+
+/**
+ * Every agent's `plannotator-inbox` entry that still runs Plannotator,
+ * whoever added it. `skip`: the agents whose entry uninstall already removed
+ * or named (`planInboxAgentRemoval`).
+ */
+export function remainingInboxReferences(
+  environment: AgentEnvironment,
+  binaryPaths: readonly string[],
+  skip: ReadonlySet<InboxAgentId>,
+): InboxReferenceScan {
+  const scan: InboxReferenceScan = { warnings: [], unreadable: [] };
+  if (!agentHomeAllowed(environment)) return scan;
+  const normalize = (path: string) => {
+    const normalized = path.replace(/\\/g, "/");
+    return environment.platform === "win32" ? normalized.toLowerCase() : normalized;
+  };
+  const executables = new Set([...binaryPaths, "plannotator", ...(environment.platform === "win32" ? ["plannotator.exe"] : [])].map(normalize));
+  for (const spec of AGENT_SPECS) {
+    if (skip.has(spec.id)) continue;
+    const claude = spec.id === "claude-code";
+    const path = claude ? claudeCodeMcpPath(environment) : spec.file(environment);
+    if (!path) continue;
+    const read = claude ? claudeCodeMcpEntry(environment, [], SCAN_READ) : spec.raw(environment, SCAN_READ);
+    if (!read || read.kind === "absent") continue;
+    const owner = INBOX_AGENT_LABELS[spec.id];
+    if (read.kind === "unreadable" && read.tooBig) {
+      scan.warnings.push(
+        `Skipped: ${owner}'s ${displayPath(path, environment)} has the text "${INBOX_MCP_SERVER_NAME}" but is larger than ${UNINSTALL_PARSE_MAX_BYTES / (1024 * 1024)} MiB, so uninstall did not read it. If it has a "${INBOX_MCP_SERVER_NAME}" entry that runs Plannotator, that entry will fail to start once Plannotator is gone (to remove it, ${inboxEntryRemovalHint(spec.id)}).`,
+      );
+      continue;
+    }
+    if (read.kind === "unreadable") {
+      scan.unreadable.push({ file: path, reason: read.reason, owner });
+      continue;
+    }
+    const argv = read.kind === "value" ? entryArgv(read.value) : read.argv;
+    const executable = argv?.[0];
+    // Source execution uses Bun/Node; the interpreter alone is not Plannotator.
+    const sourceCommand = argv?.length === 4 && isPlannotatorInboxCommand(argv);
+    if (executable && (executables.has(normalize(executable)) || sourceCommand)) {
+      scan.warnings.push(
+        `Skipped: ${owner}'s "${INBOX_MCP_SERVER_NAME}" in ${displayPath(path, environment)} runs Plannotator and will fail to start once it is gone, but uninstall could not tell that Plannotator added it, so it is left (to remove it, ${inboxEntryRemovalHint(spec.id)}).`,
+      );
+    }
+  }
+  return scan;
+}
diff --git a/packages/server/uninstall.test.ts b/packages/server/uninstall.test.ts
index 1e714d2e1d..cce119fafc 100644
--- a/packages/server/uninstall.test.ts
+++ b/packages/server/uninstall.test.ts
@@ -13,6 +13,7 @@ import {
   rmSync,
   statSync,
   symlinkSync,
+  truncateSync,
   writeFileSync,
 } from "node:fs";
 import { tmpdir } from "node:os";
@@ -441,7 +442,7 @@ describe("default uninstall", () => {
         'name = "plannotator-exit-plan-mode"',
         'type = "pre_tool"',
         'match = "exit_plan_mode"',
-        `command = "${join(homeDir, ".local", "bin", "plannotator")}"`,
+        `command = ${JSON.stringify(join(homeDir, ".local", "bin", "plannotator"))}`,
         "timeout = 345600",
         'description = "Plannotator plan review (managed)"',
         "# <<< plannotator-managed-vibe-hooks <<<",
@@ -831,7 +832,8 @@ describe("default uninstall", () => {
         "# >>> plannotator-managed-vibe-hooks (managed; do not edit) >>>",
         "[[hooks]]",
         'name = "plannotator-exit-plan-mode"',
-        `command = "${binary}"`,
+        // A TOML string: a Windows path's backslashes are escapes there.
+        `command = ${JSON.stringify(binary)}`,
         "# <<< plannotator-managed-vibe-hooks <<<",
         "",
       ].join("\n"),
@@ -1594,6 +1596,184 @@ describe("purge uninstall", () => {
 });
 
 describe("host and platform integrations", () => {
+  test.each([
+    [".claude", "settings.json", "PermissionRequest", "ExitPlanMode"],
+    [".codex", "hooks.json", "Stop", ""],
+    [".gemini", "settings.json", "BeforeTool", "exit_plan_mode"],
+  ])("cleans customized %s hooks in dry-run and real uninstall", async (directory, file, event, matcher) => {
+    const fixture = createFixture();
+    const binary = join(fixture.homeDir, ".local", "bin", "plannotator");
+    const settings = join(fixture.homeDir, directory, file);
+    const custom = { type: "command", command: "my-custom-hook" };
+    writeText(binary);
+    writeJson(settings, { hooks: { [event]: [{ matcher, hooks: [
+      { type: "command", command: "plannotator --browser Safari" }, custom,
+    ] }] } });
+    const before = snapshotTree(fixture.homeDir);
+    const dryRun = await runPlannotatorUninstall(
+      { purge: false, dryRun: true }, fixture.environment,
+    );
+    expect(dryRun.ok).toBe(true);
+    expect(dryRun.planned.join("\n")).toContain(settings);
+    expect(snapshotTree(fixture.homeDir)).toEqual(before);
+
+    const result = await runPlannotatorUninstall(
+      { purge: false, dryRun: false }, fixture.environment,
+    );
+    expect(result.ok).toBe(true);
+    expect(existsSync(binary)).toBe(false);
+    expect(readJson(settings)).toEqual({ hooks: { [event]: [{ matcher, hooks: [custom] }] } });
+  });
+
+  test("cleans browser overrides on improve-context and Windows executable paths", async () => {
+    const fixture = createFixture({
+      platform: "win32",
+      which: (command) => command === "powershell.exe" ? "C:\\Windows\\powershell.exe" : null,
+    });
+    const binary = join(fixture.homeDir, "AppData", "Local", "plannotator", "plannotator.exe");
+    const settings = join(fixture.homeDir, ".claude", "settings.json");
+    writeText(binary);
+    writeJson(settings, { theme: "dark", hooks: { PreToolUse: [{
+      matcher: "EnterPlanMode", hooks: [
+        { type: "command", command: `"${binary.replaceAll("/", "\\")}" improve-context --browser "Google Chrome"` },
+        { type: "command", command: "plannotator --browser Safari improve-context" },
+      ],
+    }] } });
+    const result = await runPlannotatorUninstall(
+      { purge: false, dryRun: false }, fixture.environment,
+    );
+    expect(result.ok).toBe(true);
+    expect(readJson(settings)).toEqual({ theme: "dark" });
+    expect(existsSync(binary)).toBe(false);
+  });
+
+  test.each([
+    "plannotator --custom-option",
+    "plannotator --browser Safari && my-custom-hook",
+    "plannotator&&my-custom-hook",
+    "plannotator review",
+  ])("preserves and blocks on unsupported or composite hook %s", async (command) => {
+    const fixture = createFixture();
+    const binary = join(fixture.homeDir, ".local", "bin", "plannotator");
+    const settings = join(fixture.homeDir, ".claude", "settings.json");
+    writeText(binary);
+    const config = { hooks: { PermissionRequest: [{ matcher: "ExitPlanMode", hooks: [
+      { type: "command", command },
+    ] }] } };
+    writeJson(settings, config);
+    const result = await runPlannotatorUninstall(
+      { purge: false, dryRun: false }, fixture.environment,
+    );
+    expect(result.ok).toBe(false);
+    expect(existsSync(binary)).toBe(true);
+    expect(readJson(settings)).toEqual(config);
+    expect(result.errors.join("\n")).toContain("hooks.PermissionRequest[0].hooks[0].command");
+  });
+
+  test("blocks on a Vibe command outside the managed block without deleting custom hooks", async () => {
+    const fixture = createFixture();
+    const binary = join(fixture.homeDir, ".local", "bin", "plannotator");
+    const settings = join(fixture.homeDir, ".vibe", "hooks.toml");
+    const content = '[[hooks]]\nname = "custom-plan"\ncommand = "plannotator --browser Safari"\n';
+    writeText(binary);
+    writeText(settings, content);
+    const result = await runPlannotatorUninstall(
+      { purge: false, dryRun: false }, fixture.environment,
+    );
+    expect(result.ok).toBe(false);
+    expect(existsSync(binary)).toBe(true);
+    expect(readFileSync(settings, "utf8")).toBe(content);
+    expect(result.errors.join("\n")).toContain(settings);
+    expect(result.errors.join("\n")).toContain("hooks[0].command");
+  });
+
+  test("does not trust a host manager's success while its configuration survives", async () => {
+    const fixture = createFixture({ which: () => "/fake/droid" });
+    const binary = join(fixture.homeDir, ".local", "bin", "plannotator");
+    const settings = join(fixture.homeDir, ".factory", "settings.json");
+    writeText(binary);
+    writeJson(settings, { enabledPlugins: { "plannotator@plannotator": true, "user-plugin": true } });
+    const blocked = await runPlannotatorUninstall(
+      { purge: false, dryRun: false }, fixture.environment,
+    );
+    expect(blocked.ok).toBe(false);
+    expect(existsSync(binary)).toBe(true);
+    expect(blocked.errors.join("\n")).toContain('enabledPlugins["plannotator@plannotator"]');
+    expect(blocked.errors.join("\n")).toContain(settings);
+    const retry = await runPlannotatorUninstall(
+      { purge: false, dryRun: false }, {
+        ...fixture.environment,
+        runCommand: async () => {
+          writeJson(settings, { enabledPlugins: { "user-plugin": true } });
+          return { exitCode: 0, timedOut: false };
+        },
+      },
+    );
+    expect(retry.ok).toBe(true);
+    expect(existsSync(binary)).toBe(false);
+    expect(readJson(settings)).toEqual({ enabledPlugins: { "user-plugin": true } });
+  });
+
+  test("removes browser-customized hooks but preserves unrelated commands", async () => {
+    const fixture = createFixture();
+    const binary = join(fixture.homeDir, ".local", "bin", "plannotator");
+    const settings = join(fixture.homeDir, ".claude", "settings.json");
+    const custom = [
+      { type: "command", command: "my-custom-hook" },
+      { type: "command", command: "echo plannotator --browser Safari" },
+      { type: "command", command: "plannotator-helper --browser Safari" },
+    ];
+    writeText(binary);
+    writeJson(settings, { theme: "dark", hooks: { PermissionRequest: [{
+      matcher: "ExitPlanMode", hooks: [
+        { type: "command", command: "plannotator --browser Safari" },
+        { type: "command", command: `"${binary}" --browser "Google Chrome"` },
+        ...custom,
+      ],
+    }] } });
+
+    const result = await runPlannotatorUninstall(
+      { purge: false, dryRun: false }, fixture.environment,
+    );
+
+    expect(result.ok).toBe(true);
+    expect(existsSync(binary)).toBe(false);
+    expect(readJson(settings)).toEqual({ theme: "dark", hooks: {
+      PermissionRequest: [{ matcher: "ExitPlanMode", hooks: custom }],
+    } });
+  });
+
+  test("blocks binary removal for a surviving recognized command until manual cleanup", async () => {
+    const fixture = createFixture();
+    const binary = join(fixture.homeDir, ".local", "bin", "plannotator");
+    const settings = join(fixture.homeDir, ".claude", "settings.json");
+    const hooks = [{ matcher: "custom-tool", hooks: [
+      { type: "command", command: "plannotator --browser Safari" },
+      { type: "command", command: "my-custom-hook" },
+    ] }];
+    writeText(binary);
+    writeJson(settings, { hooks: { PreToolUse: hooks } });
+
+    const blocked = await runPlannotatorUninstall(
+      { purge: false, dryRun: false }, fixture.environment,
+    );
+    expect(blocked.ok).toBe(false);
+    expect(existsSync(binary)).toBe(true);
+    expect(readJson(settings)).toEqual({ hooks: { PreToolUse: hooks } });
+    expect(blocked.errors.join("\n")).toContain(settings);
+    expect(blocked.errors.join("\n")).toContain("hooks.PreToolUse[0].hooks[0].command");
+    expect(blocked.errors.join("\n")).toContain("plannotator uninstall");
+
+    writeJson(settings, { hooks: { PreToolUse: [{ matcher: "custom-tool", hooks: [
+      { type: "command", command: "my-custom-hook" },
+    ] }] } });
+    const retry = await runPlannotatorUninstall(
+      { purge: false, dryRun: false }, fixture.environment,
+    );
+    expect(retry.ok).toBe(true);
+    expect(existsSync(binary)).toBe(false);
+  });
+
   test("keeps the binary and reports the exact command when a host is unavailable", async () => {
     const fixture = createFixture();
     const binary = join(
@@ -1623,6 +1803,8 @@ describe("host and platform integrations", () => {
     expect(result.errors[0]).toContain(
       "After it succeeds, rerun `plannotator uninstall`.",
     );
+    expect(result.errors[0]).toContain(join(fixture.homeDir, ".factory", "settings.json"));
+    expect(result.errors[0]).toContain('enabledPlugins["plannotator@plannotator"]');
     expect(existsSync(binary)).toBe(true);
     expect(result.warnings).toContain(
       "Preserved the Plannotator CLI and its Windows PATH entry so you can resolve the errors and retry uninstall.",
@@ -1765,12 +1947,7 @@ describe("host and platform integrations", () => {
         "--keep-data",
         "--yes",
       ],
-      [
-        "plugins",
-        "remove",
-        "plannotator-copilot@plannotator",
-        "--plugin",
-      ],
+      ["plugin", "uninstall", "plannotator-copilot@plannotator"],
       [
         "plugin",
         "uninstall",
@@ -2306,15 +2483,20 @@ describe("the Inbox's agent connections (inbox-agents.ts)", () => {
     expect(readFileSync(join(fixture.homeDir, ".codex", "AGENTS.md"), "utf8")).toBe("Mine.\n");
   });
 
-  test("with no record (agents.json lost), an entry that runs this binary is named and left, never removed", async () => {
+  test("with no record (agents.json lost), an entry that runs this binary is named once and left, never removed, and the binary still goes", async () => {
+    // A real install runs from the path it is uninstalling.
     const fixture = createFixture();
-    const entry = { command: fixture.environment.execPath, args: ["inbox", "mcp"] };
+    const installed = join(fixture.homeDir, ".local", "bin", "plannotator");
+    writeText(installed);
+    const entry = { command: installed, args: ["inbox", "mcp"] };
     writeJson(cursorFile(fixture), { mcpServers: { "plannotator-inbox": entry } });
-    const result = await runPlannotatorUninstall({ purge: false, dryRun: false }, fixture.environment);
-    expect(result.warnings).toContain(
+    const result = await runPlannotatorUninstall({ purge: false, dryRun: false }, { ...fixture.environment, execPath: installed });
+    expect(result.ok).toBe(true);
+    expect(result.warnings.filter((warning) => warning.includes("plannotator-inbox"))).toEqual([
       `Skipped: Cursor's "plannotator-inbox" in ${join("~", ".cursor", "mcp.json")} runs this Plannotator, but no record says Plannotator added it, so it may be yours (to remove it, delete that entry by hand).`,
-    );
+    ]);
     expect(readJson(cursorFile(fixture)).mcpServers).toEqual({ "plannotator-inbox": entry });
+    expect(existsSync(installed)).toBe(false);
   });
 
   test("an entry that runs something else now is named and left", async () => {
@@ -2327,6 +2509,589 @@ describe("the Inbox's agent connections (inbox-agents.ts)", () => {
   });
 });
 
+describe("hooks that still run Plannotator keep the CLI", () => {
+  test.each([
+    "plannotator\nimprove-context",
+    "plannotator\rimprove-context",
+    "PLANNOTATOR_BROWSER=Safari plannotator",
+    "PLANNOTATOR_BROWSER=\"Google Chrome\" plannotator",
+    "echo preflight && plannotator --browser Safari",
+    "echo preflight;plannotator",
+  ])("preserves composite hook and blocks removal: %s", async (command) => {
+    const fixture = createFixture();
+    const binary = join(fixture.homeDir, ".local", "bin", "plannotator");
+    const file = join(fixture.homeDir, ".claude", "settings.json");
+    writeText(binary);
+    const config = { hooks: { PreToolUse: [{ matcher: "EnterPlanMode", hooks: [{ type: "command", command }] }] } };
+    writeJson(file, config);
+    for (const dryRun of [true, false]) {
+      const result = await runPlannotatorUninstall({ purge: false, dryRun }, fixture.environment);
+      expect(result.ok).toBe(false);
+      expect(existsSync(binary)).toBe(true);
+      expect(readJson(file)).toEqual(config);
+      expect(result.errors.join("\n")).toContain(file);
+      expect(result.errors.join("\n")).toContain("hooks.PreToolUse[0].hooks[0].command");
+      expect(result.planned).not.toContain(binary);
+    }
+  });
+
+  test.each([
+    "echo plannotator",
+    "echo 'preflight && plannotator'",
+    'echo "preflight; plannotator"',
+    "echo preflight # plannotator; plannotator",
+  ])("does not claim a command that only mentions Plannotator: %s", async (command) => {
+    const fixture = createFixture();
+    const binary = join(fixture.homeDir, ".local", "bin", "plannotator");
+    const file = join(fixture.homeDir, ".claude", "settings.json");
+    writeText(binary);
+    const config = { hooks: { PermissionRequest: [{ matcher: "ExitPlanMode", hooks: [{ type: "command", command }] }] } };
+    writeJson(file, config);
+    const result = await runPlannotatorUninstall({ purge: false, dryRun: false }, fixture.environment);
+    expect(result.ok).toBe(true);
+    expect(existsSync(binary)).toBe(false);
+    expect(readJson(file)).toEqual(config);
+  });
+
+  test.each(["plannotator review", "plannotator --custom-option"])("dry-run reports preserved hook blocker: %s", async (command) => {
+    const fixture = createFixture();
+    const binary = join(fixture.homeDir, ".local", "bin", "plannotator");
+    const file = join(fixture.homeDir, ".gemini", "settings.json");
+    writeText(binary);
+    writeJson(file, { hooks: { BeforeTool: [{ matcher: "exit_plan_mode", hooks: [
+      { type: "command", command: "plannotator --browser Safari" },
+      { type: "command", command },
+    ] }] } });
+    const before = snapshotTree(fixture.homeDir);
+    const result = await runPlannotatorUninstall({ purge: false, dryRun: true }, fixture.environment);
+    expect(result.ok).toBe(false);
+    expect(result.errors.join("\n")).toContain(file);
+    expect(result.errors.join("\n")).toContain("hooks.BeforeTool[0].hooks[1].command");
+    expect(result.planned).not.toContain(binary);
+    expect(snapshotTree(fixture.homeDir)).toEqual(before);
+  });
+
+  test("dry-run reports original entry indices after other matcher entries are removed", async () => {
+    const fixture = createFixture();
+    const file = join(fixture.homeDir, ".claude", "settings.json");
+    const config = { hooks: { PreToolUse: [
+      { matcher: "EnterPlanMode", hooks: [{ type: "command", command: "plannotator improve-context" }] },
+      { matcher: "Bash", hooks: [{ type: "command", command: "plannotator review" }] },
+    ] } };
+    writeJson(file, config);
+    const result = await runPlannotatorUninstall({ purge: false, dryRun: true }, fixture.environment);
+    expect(result.ok).toBe(false);
+    expect(result.errors.join("\n")).toContain("hooks.PreToolUse[1].hooks[0].command");
+    expect(readJson(file)).toEqual(config);
+  });
+
+  test("Vibe dry-run reports original index of a surviving hook beside the managed block", async () => {
+    const fixture = createFixture();
+    const file = join(fixture.homeDir, ".vibe", "hooks.toml");
+    const content = '# >>> plannotator-managed-vibe-hooks\n[[hooks]]\ncommand = "plannotator"\n# <<< plannotator-managed-vibe-hooks\n[[hooks]]\ncommand = "plannotator review"\n';
+    writeText(file, content);
+    const result = await runPlannotatorUninstall({ purge: false, dryRun: true }, fixture.environment);
+    expect(result.ok).toBe(false);
+    expect(result.errors.join("\n")).toContain("hooks[1].command");
+    expect(readFileSync(file, "utf8")).toBe(content);
+  });
+
+  test("two surviving hooks in one file are one error naming both", async () => {
+    const fixture = createFixture();
+    const file = join(fixture.homeDir, ".claude", "settings.json");
+    writeJson(file, { hooks: { PreToolUse: [{ matcher: "Bash", hooks: [
+      { type: "command", command: "plannotator review" },
+      { type: "command", command: "plannotator annotate" },
+    ] }] } });
+    const result = await runPlannotatorUninstall({ purge: false, dryRun: false }, fixture.environment);
+    const about = result.errors.filter((error) => error.includes(file));
+    expect(about).toHaveLength(1);
+    expect(about[0]).toContain("hooks.PreToolUse[0].hooks[0].command, hooks.PreToolUse[0].hooks[1].command");
+  });
+
+  // install.sh writes the Codex hook as `"command": "${PLANNOTATOR_BIN}"`: unquoted, spaces and all.
+  test("an unquoted install path with spaces is still Plannotator's own hook", async () => {
+    const fixture = createFixture();
+    const homeDir = join(fixture.root, "my home");
+    const binary = join(homeDir, ".local", "bin", "plannotator");
+    const file = join(homeDir, ".codex", "hooks.json");
+    writeText(binary);
+    writeJson(file, { hooks: { Stop: [{ hooks: [{ type: "command", command: binary }] }] } });
+    const environment = { ...fixture.environment, homeDir };
+
+    const dry = await runPlannotatorUninstall({ purge: false, dryRun: true }, environment);
+    expect(dry.ok).toBe(true);
+    expect(dry.planned).toContain(`managed Codex Stop hook in ${file}`);
+
+    const result = await runPlannotatorUninstall({ purge: false, dryRun: false }, environment);
+    expect(result.ok).toBe(true);
+    expect(existsSync(file)).toBe(false);
+    expect(existsSync(binary)).toBe(false);
+  });
+
+  // One run names every blocker, so fixing one never uncovers the next.
+  test("a real run names a surviving hook beside another blocker, in the same run", async () => {
+    const fixture = createFixture();
+    const binary = join(fixture.homeDir, ".local", "bin", "plannotator");
+    const cursor = join(fixture.homeDir, ".cursor", "mcp.json");
+    const settings = join(fixture.homeDir, ".claude", "settings.json");
+    writeText(binary);
+    writeText(cursor, "{broken");
+    writeJson(settings, { hooks: { PreToolUse: [{ matcher: "Bash", hooks: [{ type: "command", command: "plannotator annotate-last" }] }] } });
+    const result = await runPlannotatorUninstall({ purge: false, dryRun: false }, fixture.environment);
+    expect(result.ok).toBe(false);
+    expect(existsSync(binary)).toBe(true);
+    expect(result.errors).toEqual([
+      `Could not read Cursor's ${cursor}: it is not plain JSON. Plannotator did not change it. To continue, fix that (or put back a working copy of the file), then run \`plannotator uninstall\` again.`,
+      `Claude Code's ${settings} still runs Plannotator at hooks.PreToolUse[0].hooks[0].command. Plannotator removes only the hooks it installs exactly as it wrote them, so it did not change this one. To continue, remove only that hook (keep the rest of the file), then run \`plannotator uninstall\` again.`,
+    ]);
+  });
+
+  // The failed write is the error; the check after it does not also call that hook one Plannotator did not install.
+  test.skipIf(process.platform === "win32" || process.getuid?.() === 0)("a settings.json uninstall could not rewrite is one error, not also a surviving-hook one", async () => {
+    const fixture = createFixture();
+    const binary = join(fixture.homeDir, ".local", "bin", "plannotator");
+    const settings = join(fixture.homeDir, ".claude", "settings.json");
+    writeText(binary);
+    writeJson(settings, { hooks: { PermissionRequest: [{ matcher: "ExitPlanMode", hooks: [{ type: "command", command: "plannotator" }] }] } });
+    chmodSync(settings, 0o444);
+    try {
+      const result = await runPlannotatorUninstall({ purge: false, dryRun: false }, fixture.environment);
+      expect(result.ok).toBe(false);
+      expect(existsSync(binary)).toBe(true);
+      const about = result.errors.filter((error) => error.includes(settings));
+      expect(about).toHaveLength(1);
+      expect(about[0]).toStartWith(`Could not update ${settings}:`);
+    } finally { chmodSync(settings, 0o644); }
+  });
+});
+
+describe("host plugin managers", () => {
+  // Copilot CLI 1.0.68 refuses `copilot plugins remove … --plugin`.
+  test("without copilot on PATH, the command to run is one Copilot CLI accepts", async () => {
+    const fixture = createFixture();
+    writeJson(join(fixture.homeDir, ".copilot", "settings.json"), { enabledPlugins: { "plannotator-copilot@plannotator": true } });
+    const result = await runPlannotatorUninstall({ purge: false, dryRun: false }, fixture.environment);
+    expect(result.ok).toBe(false);
+    expect(result.errors).toHaveLength(1);
+    expect(result.errors[0]).toContain("run `copilot plugin uninstall plannotator-copilot@plannotator`");
+  });
+
+  test("rejects a successful host cleanup whose formerly detected config is now malformed", async () => {
+    const fixture = createFixture({ which: () => "/fake/droid" });
+    const binary = join(fixture.homeDir, ".local", "bin", "plannotator");
+    const file = join(fixture.homeDir, ".factory", "settings.json");
+    writeText(binary);
+    writeJson(file, { enabledPlugins: { "plannotator@plannotator": true } });
+    const result = await runPlannotatorUninstall({ purge: false, dryRun: false }, {
+      ...fixture.environment,
+      runCommand: async () => {
+        writeText(file, "{broken");
+        return { exitCode: 0, timedOut: false };
+      },
+    });
+    expect(result.ok).toBe(false);
+    expect(existsSync(binary)).toBe(true);
+    expect(result.errors).toEqual([
+      `Could not read Droid's ${file}: it is not valid JSON. Plannotator did not change it. To continue, fix that (or put back a working copy of the file), then run \`plannotator uninstall\` again.`,
+    ]);
+    expect(readFileSync(file, "utf8")).toBe("{broken");
+  });
+
+  test("accepts VS Code removal when registration is gone but directory remains", async () => {
+    const fixture = createFixture({ which: (name) => name === "code" ? "/fake/code" : null });
+    const binary = join(fixture.homeDir, ".local", "bin", "plannotator");
+    const directory = join(fixture.homeDir, ".vscode", "extensions", "backnotprop.plannotator-webview-0.1.0");
+    const registry = join(fixture.homeDir, ".vscode", "extensions", "extensions.json");
+    writeText(binary);
+    writeText(join(directory, "package.json"));
+    writeJson(registry, [{ identifier: { id: "backnotprop.plannotator-webview" }, version: "0.1.0" }]);
+    const result = await runPlannotatorUninstall({ purge: false, dryRun: false }, {
+      ...fixture.environment,
+      runCommand: async () => {
+        writeJson(registry, []);
+        return { exitCode: 0, timedOut: false };
+      },
+    });
+    expect(result.ok).toBe(true);
+    expect(existsSync(binary)).toBe(false);
+    expect(existsSync(directory)).toBe(true);
+    const remainingRegistry: unknown = JSON.parse(readFileSync(registry, "utf8"));
+    expect(remainingRegistry).toEqual([]);
+  });
+
+  test.each(["registry", "obsolete"])("does not invoke VS Code for unregistered leftovers: %s", async (kind) => {
+    const fixture = createFixture();
+    const binary = join(fixture.homeDir, ".local", "bin", "plannotator");
+    const parent = join(fixture.homeDir, ".vscode", "extensions");
+    const name = "backnotprop.plannotator-webview-0.1.0";
+    writeText(binary);
+    writeText(join(parent, name, "package.json"));
+    if (kind === "registry") writeJson(join(parent, "extensions.json"), []);
+    else writeJson(join(parent, ".obsolete"), { [name]: true });
+    const result = await runPlannotatorUninstall({ purge: false, dryRun: false }, fixture.environment);
+    expect(result.ok).toBe(true);
+    expect(fixture.commandCalls).toEqual([]);
+    expect(existsSync(binary)).toBe(false);
+    expect(existsSync(join(parent, name))).toBe(true);
+  });
+
+  test("dry-run reports missing Droid CLI with exact recovery entries", async () => {
+    const fixture = createFixture();
+    const binary = join(fixture.homeDir, ".local", "bin", "plannotator");
+    const file = join(fixture.homeDir, ".factory", "settings.json");
+    writeText(binary); writeJson(file, { enabledPlugins: { "plannotator@plannotator": true } });
+    const before = snapshotTree(fixture.homeDir);
+    const result = await runPlannotatorUninstall({ purge: false, dryRun: true }, fixture.environment);
+    expect(result.ok).toBe(false);
+    expect(result.errors.join("\n")).toContain("restore droid on PATH");
+    expect(result.errors.join("\n")).toContain(file);
+    expect(result.errors.join("\n")).toContain('enabledPlugins["plannotator@plannotator"]');
+    expect(result.planned).not.toContain(binary);
+    expect(snapshotTree(fixture.homeDir)).toEqual(before);
+  });
+
+  // `--scope user` removes only the user's install; a project's stays in installed_plugins.json.
+  test.each([
+    { host: "claude", dir: ".claude" },
+    { host: "droid", dir: ".factory" },
+  ])("$host: a project-scope install that survives the user-scope uninstall is named, and the CLI still goes", async ({ host, dir }) => {
+    const fixture = createFixture();
+    const binary = join(fixture.homeDir, ".local", "bin", "plannotator");
+    const record = join(fixture.homeDir, dir, "plugins", "installed_plugins.json");
+    const project = { scope: "project", projectPath: "/work/app", installPath: "/cache/plannotator" };
+    writeText(binary);
+    writeJson(record, { version: 2, plugins: { "plannotator@plannotator": [{ scope: "user", installPath: "/cache/plannotator" }, project] } });
+    const environment = {
+      ...fixture.environment,
+      which: (command: string) => (command === host ? `/fake/${host}` : null),
+      runCommand: async (command: string, args: string[]) => {
+        fixture.commandCalls.push({ command, args });
+        // As the host does: only the user-scope entry goes.
+        writeJson(record, { version: 2, plugins: { "plannotator@plannotator": [project] } });
+        return { exitCode: 0, timedOut: false };
+      },
+    };
+
+    const result = await runPlannotatorUninstall({ purge: false, dryRun: false }, environment);
+    expect(result.ok).toBe(true);
+    expect(existsSync(binary)).toBe(false);
+    expect(fixture.commandCalls).toHaveLength(1);
+    const named = result.warnings.filter((warning) => warning.includes("project scope"));
+    expect(named).toHaveLength(1);
+    expect(named[0]).toContain(`\`${host} plugin uninstall plannotator@plannotator --scope project\` in /work/app`);
+
+    // A retry with only the project's install left never asks the host to remove a user install that is gone.
+    writeText(binary);
+    const retry = await runPlannotatorUninstall({ purge: false, dryRun: false }, environment);
+    expect(retry.ok).toBe(true);
+    expect(fixture.commandCalls).toHaveLength(1);
+    expect(existsSync(binary)).toBe(false);
+  });
+
+  // Claude Code installs (or rescopes) the plugin for the user from that key at its next start, so it keeps the CLI.
+  test("a user enabledPlugins key the host refuses to uninstall keeps the CLI, and names the key to remove by hand", async () => {
+    const fixture = createFixture();
+    const binary = join(fixture.homeDir, ".local", "bin", "plannotator");
+    const settings = join(fixture.homeDir, ".claude", "settings.json");
+    writeText(binary);
+    writeJson(settings, { enabledPlugins: { "plannotator@plannotator": true } });
+    writeJson(join(fixture.homeDir, ".claude", "plugins", "installed_plugins.json"), {
+      version: 2,
+      plugins: { "plannotator@plannotator": [{ scope: "project", projectPath: "/work/app", installPath: "/cache/plannotator" }] },
+    });
+    const environment = {
+      ...fixture.environment,
+      which: (command: string) => (command === "claude" ? "/fake/claude" : null),
+      runCommand: async (command: string, args: string[]) => {
+        fixture.commandCalls.push({ command, args });
+        return { exitCode: 1, timedOut: false };
+      },
+    };
+    const blocked = await runPlannotatorUninstall({ purge: false, dryRun: false }, environment);
+    expect(blocked.ok).toBe(false);
+    expect(fixture.commandCalls).toHaveLength(1);
+    expect(existsSync(binary)).toBe(true);
+    expect(blocked.errors.join("\n")).toContain(`remove only these Plannotator entries by hand: ${settings}, enabledPlugins["plannotator@plannotator"]`);
+
+    writeJson(settings, { enabledPlugins: {} });
+    const retry = await runPlannotatorUninstall({ purge: false, dryRun: false }, environment);
+    expect(retry.ok).toBe(true);
+    expect(fixture.commandCalls).toHaveLength(1);
+    expect(existsSync(binary)).toBe(false);
+  });
+
+  test("a user-scope entry still there after the host reported success keeps the CLI, and says what to remove", async () => {
+    const fixture = createFixture({ which: (command) => (command === "claude" ? "/fake/claude" : null) });
+    const binary = join(fixture.homeDir, ".local", "bin", "plannotator");
+    const record = join(fixture.homeDir, ".claude", "plugins", "installed_plugins.json");
+    writeText(binary);
+    writeJson(record, { version: 2, plugins: { "plannotator@plannotator": [{ scope: "user", installPath: "/cache/plannotator" }] } });
+    const result = await runPlannotatorUninstall({ purge: false, dryRun: false }, fixture.environment);
+    expect(result.ok).toBe(false);
+    expect(existsSync(binary)).toBe(true);
+    expect(result.errors.join("\n")).toContain(`${record}, plugins["plannotator@plannotator"][0]`);
+  });
+});
+
+describe("plannotator-inbox entries no record says Plannotator added", () => {
+  test.each([true, false])("one that runs the installed CLI is named with how to remove it, and never keeps the CLI, dryRun=%s", async (dryRun) => {
+    const fixture = createFixture();
+    const binary = join(fixture.homeDir, ".local", "bin", "plannotator");
+    const file = join(fixture.homeDir, ".cursor", "mcp.json");
+    const entry = { command: binary, args: ["inbox", "mcp"] };
+    const config = { mcpServers: { "plannotator-inbox": entry, mine: { command: "user-server" } } };
+    writeText(binary);
+    writeJson(file, config);
+    const result = await runPlannotatorUninstall({ purge: false, dryRun }, fixture.environment);
+    expect(result.ok).toBe(true);
+    expect(result.warnings.filter((warning) => warning.includes("plannotator-inbox"))).toEqual([
+      `Skipped: Cursor's "plannotator-inbox" in ${join("~", ".cursor", "mcp.json")} runs Plannotator and will fail to start once it is gone, but uninstall could not tell that Plannotator added it, so it is left (to remove it, delete that entry by hand).`,
+    ]);
+    expect(existsSync(binary)).toBe(dryRun);
+    expect(readJson(file)).toEqual(config);
+  });
+
+  test.each([false, true])("Claude Code's in ~/.claude.json points to `claude mcp remove`, config override=%s", async (override) => {
+    const fixture = createFixture();
+    const binary = join(fixture.homeDir, ".local", "bin", "plannotator");
+    const directory = override ? join(fixture.root, "claude-custom") : fixture.homeDir;
+    const file = join(directory, ".claude.json");
+    const config = { mcpServers: { "plannotator-inbox": { command: binary, args: ["inbox", "mcp"] } }, projects: { mine: {} } };
+    writeText(binary); writeJson(file, config);
+    const environment = { ...fixture.environment, env: override ? { CLAUDE_CONFIG_DIR: directory } : {} };
+    const result = await runPlannotatorUninstall({ purge: false, dryRun: false }, environment);
+    expect(result.ok).toBe(true);
+    expect(existsSync(binary)).toBe(false);
+    const named = result.warnings.filter((warning) => warning.includes("plannotator-inbox"));
+    expect(named).toHaveLength(1);
+    expect(named[0]).toContain("Claude Code's");
+    expect(named[0]).toContain("run `claude mcp remove plannotator-inbox -s user`");
+    expect(readJson(file)).toEqual(config);
+  });
+
+  test("source-run uninstall does not claim a user-owned Bun MCP entry", async () => {
+    const fixture = createFixture({ execPath: process.execPath });
+    const binary = join(fixture.homeDir, ".local", "bin", "plannotator");
+    const file = join(fixture.homeDir, ".cursor", "mcp.json");
+    const config = { mcpServers: { "plannotator-inbox": { command: process.execPath, args: ["unrelated-server.ts"] } } };
+    writeText(binary); writeJson(file, config);
+    const result = await runPlannotatorUninstall({ purge: false, dryRun: false }, fixture.environment);
+    expect(result.ok).toBe(true); expect(existsSync(binary)).toBe(false);
+    expect(result.warnings.filter((warning) => warning.includes("plannotator-inbox"))).toEqual([]);
+    expect(readJson(file)).toEqual(config);
+  });
+
+  // Cursor writes strict JSON, but a person may add a comment or leave a trailing comma; this check only reads.
+  test.each([false, true])("a Cursor mcp.json with a comment and a trailing comma never keeps the CLI, with the entry=%s", async (withEntry) => {
+    const fixture = createFixture();
+    const binary = join(fixture.homeDir, ".local", "bin", "plannotator");
+    const file = join(fixture.homeDir, ".cursor", "mcp.json");
+    const entry = withEntry ? `\n    "plannotator-inbox": { "command": ${JSON.stringify(binary)}, "args": ["inbox", "mcp"] },` : "";
+    const content = `{\n  // mine\n  "mcpServers": {${entry}\n    "mine": { "command": "user-server" },\n  },\n}\n`;
+    writeText(binary);
+    writeText(file, content);
+    const result = await runPlannotatorUninstall({ purge: false, dryRun: false }, fixture.environment);
+    expect(result.errors).toEqual([]);
+    expect(result.ok).toBe(true);
+    expect(existsSync(binary)).toBe(false);
+    expect(result.warnings.filter((warning) => warning.includes("plannotator-inbox"))).toEqual(withEntry ? [
+      `Skipped: Cursor's "plannotator-inbox" in ${join("~", ".cursor", "mcp.json")} runs Plannotator and will fail to start once it is gone, but uninstall could not tell that Plannotator added it, so it is left (to remove it, delete that entry by hand).`,
+    ] : []);
+    expect(readFileSync(file, "utf8")).toBe(content);
+  });
+});
+
+describe("configs uninstall cannot read keep the CLI", () => {
+  test("a malformed Claude Code settings.json is reported once, with what to do", async () => {
+    const fixture = createFixture({ which: () => "/fake/claude" });
+    const binary = join(fixture.homeDir, ".local", "bin", "plannotator");
+    const file = join(fixture.homeDir, ".claude", "settings.json");
+    writeText(binary);
+    writeText(file, '{ "enabledPlugins": ');
+    for (const dryRun of [true, false]) {
+      const result = await runPlannotatorUninstall({ purge: false, dryRun }, fixture.environment);
+      expect(result.ok).toBe(false);
+      expect(result.errors.filter((error) => error.includes(file))).toEqual([
+        `Could not read Claude Code's ${file}: it is not valid JSON. Plannotator did not change it. To continue, fix that (or put back a working copy of the file), then run \`plannotator uninstall\` again.`,
+      ]);
+      expect(fixture.commandCalls).toEqual([]);
+      expect(existsSync(binary)).toBe(true);
+      expect(readFileSync(file, "utf8")).toBe('{ "enabledPlugins": ');
+    }
+  });
+
+  test("an agent's MCP config that cannot be read is named with its tool, and a fixed one lets the CLI go", async () => {
+    const fixture = createFixture();
+    const binary = join(fixture.homeDir, ".local", "bin", "plannotator");
+    const file = join(fixture.homeDir, ".cursor", "mcp.json");
+    writeText(binary);
+    writeText(file, "{ mcpServers: {} }");
+    const blocked = await runPlannotatorUninstall({ purge: false, dryRun: false }, fixture.environment);
+    expect(blocked.ok).toBe(false);
+    expect(existsSync(binary)).toBe(true);
+    expect(blocked.errors).toEqual([
+      `Could not read Cursor's ${file}: it is not plain JSON. Plannotator did not change it. To continue, fix that (or put back a working copy of the file), then run \`plannotator uninstall\` again.`,
+    ]);
+    writeJson(file, { mcpServers: {} });
+    const retry = await runPlannotatorUninstall({ purge: false, dryRun: false }, fixture.environment);
+    expect(retry.ok).toBe(true);
+    expect(existsSync(binary)).toBe(false);
+  });
+
+  // The Inbox reads at most 32 MiB of it; uninstall searches it first, then parses one that has the name, so its size never blocks.
+  test("~/.claude.json over the Inbox's size cap is still checked, and never keeps the CLI for its size", async () => {
+    const fixture = createFixture();
+    const binary = join(fixture.homeDir, ".local", "bin", "plannotator");
+    const file = join(fixture.homeDir, ".claude.json");
+    writeText(binary);
+    const history = "x".repeat(33 * 1024 * 1024);
+    writeText(file, JSON.stringify({ projects: { "/work": { history } } }));
+    const none = await runPlannotatorUninstall({ purge: false, dryRun: true }, fixture.environment);
+    expect(none.ok).toBe(true);
+    expect(none.errors).toEqual([]);
+
+    writeText(file, JSON.stringify({ mcpServers: { "plannotator-inbox": { command: binary, args: ["inbox", "mcp"] } }, projects: { "/work": { history } } }));
+    const result = await runPlannotatorUninstall({ purge: false, dryRun: false }, fixture.environment);
+    expect(result.ok).toBe(true);
+    expect(existsSync(binary)).toBe(false);
+    expect(result.warnings.filter((warning) => warning.includes("plannotator-inbox"))).toHaveLength(1);
+    expect(result.warnings.join("\n")).toContain("run `claude mcp remove plannotator-inbox -s user`");
+  });
+
+  test("another agent's file over the Inbox's 1 MiB cap is read and checked like any other", async () => {
+    const fixture = createFixture();
+    const file = join(fixture.homeDir, ".cursor", "mcp.json");
+    writeText(file, JSON.stringify({ mcpServers: { "plannotator-inbox": { command: "plannotator", args: ["inbox", "mcp"] } }, pad: "x".repeat(1024 * 1024) }));
+    const result = await runPlannotatorUninstall({ purge: false, dryRun: true }, fixture.environment);
+    expect(result.ok).toBe(true);
+    expect(result.warnings.filter((warning) => warning.includes("plannotator-inbox"))).toEqual([
+      `Skipped: Cursor's "plannotator-inbox" in ${join("~", ".cursor", "mcp.json")} runs Plannotator and will fail to start once it is gone, but uninstall could not tell that Plannotator added it, so it is left (to remove it, delete that entry by hand).`,
+    ]);
+  });
+
+  // Over 1 MiB, the raw bytes are searched first: a file without the name is never decoded or parsed.
+  test("a big agent file without \"plannotator-inbox\" is not parsed, so it never keeps the CLI", async () => {
+    const fixture = createFixture();
+    const binary = join(fixture.homeDir, ".local", "bin", "plannotator");
+    writeText(binary);
+    const claude = join(fixture.homeDir, ".claude.json");
+    const cursor = join(fixture.homeDir, ".cursor", "mcp.json");
+    mkdirSync(dirname(cursor), { recursive: true });
+    writeFileSync(claude, Buffer.alloc(2 * 1024 * 1024, 0xff));
+    writeFileSync(cursor, `{ "pad": "${"x".repeat(2 * 1024 * 1024)}", broken`);
+    const result = await runPlannotatorUninstall({ purge: false, dryRun: false }, fixture.environment);
+    expect(result.errors).toEqual([]);
+    expect(result.ok).toBe(true);
+    expect(existsSync(binary)).toBe(false);
+  });
+
+  // The search reads a chunk at a time; a name split across two chunks is still found.
+  test("a big file whose entry straddles the search's 1 MiB chunks is still named", async () => {
+    const fixture = createFixture();
+    const file = join(fixture.homeDir, ".cursor", "mcp.json");
+    const head = '{"pad":"';
+    const middle = '","mcpServers":{"';
+    const pad = "x".repeat(1024 * 1024 + 8 - head.length - middle.length);
+    writeText(file, `${head}${pad}${middle}plannotator-inbox":{"command":"plannotator","args":["inbox","mcp"]}}}`);
+    expect(readFileSync(file, "utf8").indexOf("plannotator-inbox")).toBe(1024 * 1024 + 8);
+    const result = await runPlannotatorUninstall({ purge: false, dryRun: true }, fixture.environment);
+    expect(result.ok).toBe(true);
+    expect(result.warnings.filter((warning) => warning.includes("plannotator-inbox"))).toHaveLength(1);
+  });
+
+  test("an agent file over 64 MiB that has \"plannotator-inbox\" is not read, is named, and never keeps the CLI", async () => {
+    const fixture = createFixture();
+    const binary = join(fixture.homeDir, ".local", "bin", "plannotator");
+    const file = join(fixture.homeDir, ".claude.json");
+    writeText(binary);
+    writeText(file, '{"mcpServers":{"plannotator-inbox":{"command":"plannotator","args":["inbox","mcp"]}}}');
+    truncateSync(file, 65 * 1024 * 1024);
+    const result = await runPlannotatorUninstall({ purge: false, dryRun: false }, fixture.environment);
+    expect(result.errors).toEqual([]);
+    expect(result.ok).toBe(true);
+    expect(existsSync(binary)).toBe(false);
+    expect(result.warnings.filter((warning) => warning.includes("plannotator-inbox"))).toEqual([
+      `Skipped: Claude Code's ${join("~", ".claude.json")} has the text "plannotator-inbox" but is larger than 64 MiB, so uninstall did not read it. If it has a "plannotator-inbox" entry that runs Plannotator, that entry will fail to start once Plannotator is gone (to remove it, run \`claude mcp remove plannotator-inbox -s user\`).`,
+    ]);
+  });
+
+  test.skipIf(process.platform === "win32" || process.getuid?.() === 0).each([
+    ["Codex", [".codex", "config.toml"], "[features]\nhooks = true\n"],
+    ["Codex", [".codex", "hooks.json"], "{}"],
+    ["OpenCode", [".config", "opencode", "opencode.json"], "{}"],
+    ["Gemini CLI", [".gemini", "settings.json"], "{}"],
+  ] as const)("%s's %j it cannot read names the file, the tool and what to do", async (owner, parts, content) => {
+    const fixture = createFixture();
+    const binary = join(fixture.homeDir, ".local", "bin", "plannotator");
+    const file = join(fixture.homeDir, ...parts);
+    writeText(binary);
+    writeText(file, content);
+    chmodSync(file, 0o000);
+    try {
+      for (const dryRun of [true, false]) {
+        const result = await runPlannotatorUninstall({ purge: false, dryRun }, fixture.environment);
+        expect(result.ok).toBe(false);
+        expect(existsSync(binary)).toBe(true);
+        expect(result.errors).toEqual([
+          `Could not read ${owner}'s ${file}: permission denied. Plannotator did not change it. To continue, fix that (or put back a working copy of the file), then run \`plannotator uninstall\` again.`,
+        ]);
+      }
+    } finally { chmodSync(file, 0o644); }
+  });
+
+  test("a real run leaves a Vibe hooks.toml it cannot parse exactly as it was, managed block included", async () => {
+    const fixture = createFixture();
+    const binary = join(fixture.homeDir, ".local", "bin", "plannotator");
+    const file = join(fixture.homeDir, ".vibe", "hooks.toml");
+    const content = '[[hooks]]\nname = "mine"\ncommand = "unterminated\n# >>> plannotator-managed-vibe-hooks\n[[hooks]]\ncommand = "plannotator"\n# <<< plannotator-managed-vibe-hooks\n';
+    writeText(binary);
+    writeText(file, content);
+    const result = await runPlannotatorUninstall({ purge: false, dryRun: false }, fixture.environment);
+    expect(result.ok).toBe(false);
+    expect(readFileSync(file, "utf8")).toBe(content);
+    expect(result.removed.some((item) => item.includes(file))).toBe(false);
+    expect(result.errors.filter((error) => error.includes(file))).toHaveLength(1);
+    expect(existsSync(binary)).toBe(true);
+  });
+
+  test("a Vibe hooks.toml that is not valid TOML says what is wrong", async () => {
+    const fixture = createFixture();
+    const file = join(fixture.homeDir, ".vibe", "hooks.toml");
+    const content = '[[hooks]]\nname = "mine"\ncommand = "unterminated\n';
+    writeText(file, content);
+    const result = await runPlannotatorUninstall({ purge: false, dryRun: true }, fixture.environment);
+    expect(result.ok).toBe(false);
+    expect(result.errors).toHaveLength(1);
+    expect(result.errors[0]).toStartWith(`Could not read Mistral Vibe's ${file}: it is not valid TOML (Unterminated string`);
+    expect(result.errors[0]).toContain("Plannotator did not change it. To continue, fix that");
+    expect(readFileSync(file, "utf8")).toBe(content);
+  });
+
+  test.skipIf(process.platform === "win32" || process.getuid?.() === 0)("inaccessible hook target blocks removal instead of appearing missing", async () => {
+    const fixture = createFixture();
+    const binary = join(fixture.homeDir, ".local", "bin", "plannotator");
+    const targetDirectory = join(fixture.root, "inaccessible");
+    const target = join(targetDirectory, "hooks.toml");
+    const file = join(fixture.homeDir, ".vibe", "hooks.toml");
+    writeText(binary); writeText(target, '[[hooks]]\ncommand = "plannotator"\n');
+    mkdirSync(dirname(file), { recursive: true }); symlinkSync(target, file);
+    chmodSync(targetDirectory, 0o000);
+    try {
+      expect(existsSync(file)).toBe(false);
+      for (const dryRun of [true, false]) {
+        const result = await runPlannotatorUninstall({ purge: false, dryRun }, fixture.environment);
+        expect(result.ok).toBe(false);
+        expect(existsSync(binary)).toBe(true);
+        expect(result.errors).toEqual([
+          `Could not read Mistral Vibe's ${file}: permission denied. Plannotator did not change it. To continue, fix that (or put back a working copy of the file), then run \`plannotator uninstall\` again.`,
+        ]);
+        expect(result.planned).not.toContain(binary);
+      }
+    } finally { chmodSync(targetDirectory, 0o755); }
+  });
+});
+
 describe("Qwen Code", () => {
   function writeQwenInstall(qwenDir: string): void {
     writeJson(join(qwenDir, "extensions", "plannotator", "qwen-extension.json"), { name: "plannotator", version: "1.0.0" });
@@ -2336,15 +3101,25 @@ describe("Qwen Code", () => {
     writeText(join(qwenDir, "skills", "my-own-skill", "SKILL.md"));
   }
 
+  /** qwen on PATH; like the real `qwen extensions uninstall`, it removes the extension's folder. */
+  function withQwen(fixture: Fixture, qwenDir: string): UninstallEnvironment {
+    return {
+      ...fixture.environment,
+      which: (command) => (command === "qwen" ? "/fake/qwen" : null),
+      runCommand: async (command, args, env) => {
+        fixture.commandCalls.push({ command, args, env });
+        if (command === "/fake/qwen") rmSync(join(qwenDir, "extensions", "plannotator"), { recursive: true, force: true });
+        return { exitCode: 0, timedOut: false };
+      },
+    };
+  }
+
   test("removes the extension with qwen and the installed skills, and keeps the person's own skill", async () => {
     const fixture = createFixture();
     const qwenDir = join(fixture.homeDir, ".qwen");
     writeQwenInstall(qwenDir);
 
-    const result = await runPlannotatorUninstall(
-      { purge: false, dryRun: false },
-      { ...fixture.environment, which: (command) => (command === "qwen" ? "/fake/qwen" : null) },
-    );
+    const result = await runPlannotatorUninstall({ purge: false, dryRun: false }, withQwen(fixture, qwenDir));
 
     expect(fixture.commandCalls.map((call) => [call.command, ...call.args])).toEqual([
       ["/fake/qwen", "extensions", "uninstall", "plannotator"],
@@ -2362,10 +3137,7 @@ describe("Qwen Code", () => {
     writeJson(join(fixture.dataDir, "qwen-code", "extension", "qwen-extension.json"), { name: "plannotator", version: "1.0.0" });
     writeText(join(fixture.dataDir, "config.json"));
 
-    await runPlannotatorUninstall(
-      { purge: false, dryRun: false },
-      { ...fixture.environment, which: (command) => (command === "qwen" ? "/fake/qwen" : null) },
-    );
+    await runPlannotatorUninstall({ purge: false, dryRun: false }, withQwen(fixture, join(fixture.homeDir, ".qwen")));
 
     expect(existsSync(join(fixture.dataDir, "qwen-code"))).toBe(false);
     expect(existsSync(join(fixture.dataDir, "config.json"))).toBe(true);
@@ -2378,11 +3150,7 @@ describe("Qwen Code", () => {
 
     await runPlannotatorUninstall(
       { purge: false, dryRun: false },
-      {
-        ...fixture.environment,
-        env: { QWEN_HOME: "~/qwen-home" },
-        which: (command) => (command === "qwen" ? "/fake/qwen" : null),
-      },
+      { ...withQwen(fixture, qwenDir), env: { QWEN_HOME: "~/qwen-home" } },
     );
 
     expect(fixture.commandCalls.map((call) => call.args)).toEqual([["extensions", "uninstall", "plannotator"]]);
diff --git a/packages/server/uninstall.ts b/packages/server/uninstall.ts
index 58f37e6b30..9a0f2d8be8 100644
--- a/packages/server/uninstall.ts
+++ b/packages/server/uninstall.ts
@@ -19,7 +19,6 @@ import {
 } from "node:fs";
 import { homedir, tmpdir } from "node:os";
 import {
-  basename,
   dirname,
   isAbsolute,
   join,
@@ -29,7 +28,14 @@ import {
   resolve,
 } from "node:path";
 import { getPlannotatorDataDir } from "@plannotator/shared/data-dir";
-import { parseT3HookCommand, T3_SETTINGS_BACKUP_SUFFIX } from "@plannotator/shared/t3-hook-command";
+import { T3_SETTINGS_BACKUP_SUFFIX } from "@plannotator/shared/t3-hook-command";
+import { isManagedHook, remainingHookReferences, type ManagedHookSpec } from "./uninstall-hooks";
+import { remainingInboxReferences } from "./uninstall-inbox-references";
+import {
+  pluginReferences, enabledPluginReferences, piPackageReferences, directoryReferences, vscodeReferences,
+  type HostReferences, type Unreadable,
+} from "./uninstall-host-references";
+import { describeFsError } from "./agent-files";
 import { runningT3Workers, stopT3Workers } from "@plannotator/shared/t3-workers";
 import { inboxStatus, readInboxRegistry, stopInbox } from "@plannotator/shared/inbox/registry";
 import { takeDownInboxTailnet } from "./inbox-devices";
@@ -314,17 +320,17 @@ type MutableUninstallResult = {
   preserved: string[];
   warnings: string[];
   errors: string[];
+  /** Files already named in an error (unreadable, or not rewritten), so each is said once. */
+  reported: Set<string>;
 };
 
-type HookCleanupSpec = {
-  readonly event: string;
-  readonly matcher?: string;
-  readonly suffix: "" | "improve-context" | "t3-hook";
-};
+type HookCleanupSpec = ManagedHookSpec;
 
 type HookCleanupPolicy = {
   readonly allowRelocatedBinary: boolean;
   readonly removeFileWhenEmpty: boolean;
+  /** The host the file belongs to, as the person knows it. */
+  readonly owner: string;
 };
 
 type HostCleanupRecovery = {
@@ -391,6 +397,7 @@ export async function runPlannotatorUninstall(
     preserved: [],
     warnings: [],
     errors: [],
+    reported: new Set(),
   };
 
   const initialDataDirIdentity = readPathIdentity(state.dataDir);
@@ -403,8 +410,9 @@ export async function runPlannotatorUninstall(
     ) ?? inspectDataDir(state.dataDir);
 
   if (request.purge && dataDirSafetyIssue) {
+    const { reported: _reported, ...result } = state;
     return {
-      ...state,
+      ...result,
       ok: false,
       errors: [
         `Refusing to purge ${state.dataDir}: ${dataDirSafetyIssue}.`,
@@ -485,7 +493,7 @@ export async function runPlannotatorUninstall(
   removeHostConfigEntries(request, environment, paths, state);
   // Plain uninstall too: with the binary gone, an agent's plannotator-inbox
   // entry would fail to start at every launch.
-  await removeInboxAgentConnections(request, environment, state);
+  await removeInboxAgentConnections(request, environment, paths.binaryPaths, state);
   removeInstalledFiles(request, environment, paths, state);
   if (dataDirSafetyIssue) {
     state.warnings.push(
@@ -511,6 +519,26 @@ export async function runPlannotatorUninstall(
     }
   }
 
+  // A dry run checked each file as it planned it; a real run checks what the cleanup left.
+  // It only reads, and runs even after another error, so one run names every blocker.
+  if (!request.dryRun) {
+    for (const [owner, filePath, allowRelocatedBinary] of [
+      ["Claude Code", join(paths.claudeDir, "settings.json"), false],
+      ["Codex", join(paths.codexDir, "hooks.json"), true],
+      ["Gemini CLI", join(environment.homeDir, ".gemini", "settings.json"), false],
+      ["Mistral Vibe", join(paths.vibeDir, "hooks.toml"), false],
+    ] as const) {
+      const config = filePath.endsWith(".toml")
+        ? readVibeHooks(filePath, request, state)
+        : readJsonRecord(
+          owner, filePath, "remaining host hooks",
+          { manualCleanup: `Make ${filePath} a readable, writable strict JSON object and remove only hooks that invoke Plannotator; preserve unrelated settings.` },
+          request, state,
+        );
+      reportRemainingHookReferences(owner, config, filePath, paths.binaryPaths, environment.platform, allowRelocatedBinary, request, state);
+    }
+  }
+
   if (state.errors.length === 0) {
     await removeBinaries(request, environment, paths, state);
   }
@@ -525,8 +553,9 @@ export async function runPlannotatorUninstall(
     }
   }
 
+  const { reported: _reported, ...result } = state;
   return {
-    ...state,
+    ...result,
     ok: state.errors.length === 0,
   };
 }
@@ -581,12 +610,15 @@ function agentEnvironmentOf(environment: UninstallEnvironment): AgentEnvironment
  * agents on this computer (inbox-agents.ts): only the recorded ones that still
  * run Plannotator. An entry the person changed to run something else is theirs
  * and is named; so is one that runs this binary but has no record (agents.json
- * lost), which the person may have added by hand. A failure is a warning,
- * never a reason to keep the CLI.
+ * lost), which the person may have added by hand, and any other entry that
+ * still runs Plannotator. A failure is a warning, never a reason to keep the
+ * CLI. Only an agent's config that cannot be read keeps it: it is not known
+ * what that file runs.
  */
 async function removeInboxAgentConnections(
   request: UninstallRequest,
   environment: UninstallEnvironment,
+  binaryPaths: readonly string[],
   state: MutableUninstallResult,
 ): Promise<void> {
   const agents = agentEnvironmentOf(environment);
@@ -597,11 +629,19 @@ async function removeInboxAgentConnections(
   // Plannotator's trusted-sender token in Qwen Code (inbox-qwen-trust.ts): revoked in Qwen, whoever added the MCP entry.
   const trust = agentHomeAllowed(agents) ? qwenTrustRemoval(state.dataDir, agents) : null;
   for (const skipped of [...plan.skipped, ...notes.skipped]) state.warnings.push(`Skipped: ${skipped}.`);
+  // Every other entry that still runs Plannotator, whoever added it: named, so the person can remove it.
+  const reportOthers = () => {
+    const handled = new Set([...plan.items.filter((item) => !item.stray).map((item) => item.agent), ...plan.named]);
+    const scan = remainingInboxReferences(agents, binaryPaths, handled);
+    state.warnings.push(...scan.warnings);
+    for (const unreadable of scan.unreadable) reportUnreadableConfig(unreadable.owner, unreadable, request, state);
+  };
   if (request.dryRun) {
     for (const item of plan.items) state.planned.push(item.describe);
     for (const note of notes.items) state.planned.push(note.describe);
     if (trust?.runnable) state.planned.push(trust.describe);
     else if (trust) state.warnings.push(`Skipped: ${trust.describe}: qwen is not on PATH; run \`${trust.manual}\`.`);
+    reportOthers();
     return;
   }
   if (trust) {
@@ -628,6 +668,7 @@ async function removeInboxAgentConnections(
     state.removed.push(item.describe);
     removed.push(item.agent);
   }
+  reportOthers();
   // A plain uninstall keeps the data: forget these records so a reinstall connects them again. An agent with an
   // entry left (one of two a move left could not go) keeps its whole record, so the next uninstall tries again.
   if (!request.purge) forgetInboxAgents(state.dataDir, removed.filter((id) => !kept.has(id)));
@@ -651,6 +692,66 @@ function reportHostCleanupFailure(
   );
 }
 
+/**
+ * A config uninstall must read to finish, but cannot: it keeps the CLI, since
+ * the file may run Plannotator. Said once per file, with what to do.
+ */
+function reportUnreadableConfig(
+  owner: string,
+  { file, reason }: Unreadable,
+  request: UninstallRequest,
+  state: MutableUninstallResult,
+): void {
+  if (state.reported.has(file)) return;
+  state.reported.add(file);
+  state.errors.push(
+    `Could not read ${owner}'s ${file}: ${reason}. Plannotator did not change it. To continue, fix that (or put back a working copy of the file), then run \`${formatUninstallRetryCommand(request)}\` again.`,
+  );
+}
+
+/** Hooks that still run Plannotator but are not ones uninstall removes itself: one error per file, naming each. */
+function reportRemainingHookReferences(
+  owner: string,
+  config: unknown,
+  filePath: string,
+  binaryPaths: readonly string[],
+  platform: NodeJS.Platform,
+  allowRelocatedBinary: boolean,
+  request: UninstallRequest,
+  state: MutableUninstallResult,
+  projectedRemovals: readonly ManagedHookSpec[] = [],
+  removedVibeIndices: ReadonlySet<number> = new Set(),
+): void {
+  const fields = remainingHookReferences(config, binaryPaths, platform, allowRelocatedBinary, projectedRemovals, removedVibeIndices);
+  if (fields.length === 0) return;
+  state.errors.push(
+    `${owner}'s ${filePath} still runs Plannotator at ${fields.join(", ")}. Plannotator removes only the hooks it installs exactly as it wrote them, so it did not change ${fields.length === 1 ? "this one" : "these"}. To continue, remove only ${fields.length === 1 ? "that hook" : "those hooks"} (keep the rest of the file), then run \`${formatUninstallRetryCommand(request)}\` again.`,
+  );
+}
+
+/** Vibe's hooks.toml, parsed; null when missing or unreadable (said). */
+function readVibeHooks(filePath: string, request: UninstallRequest, state: MutableUninstallResult): unknown {
+  if (state.reported.has(filePath)) return null;
+  let content: string;
+  try {
+    content = readFileSync(filePath, "utf8");
+  } catch (error) {
+    if (!isMissingPathError(error)) reportUnreadableConfig("Mistral Vibe", { file: filePath, reason: describeFsError(error) }, request, state);
+    return null;
+  }
+  return parseVibeHooks(filePath, content, request, state);
+}
+
+function parseVibeHooks(filePath: string, content: string, request: UninstallRequest, state: MutableUninstallResult): unknown {
+  try {
+    return Bun.TOML.parse(content);
+  } catch (error) {
+    const detail = formatError(error).replace(/^TOML Parse error:\s*/, "");
+    reportUnreadableConfig("Mistral Vibe", { file: filePath, reason: `it is not valid TOML (${detail})` }, request, state);
+    return null;
+  }
+}
+
 function resolveOwnedPaths(environment: UninstallEnvironment) {
   const { homeDir, env } = environment;
   const claudeDir = env.CLAUDE_CONFIG_DIR || join(homeDir, ".claude");
@@ -696,9 +797,18 @@ async function removeHostPlugins(
   paths: ReturnType<typeof resolveOwnedPaths>,
   state: MutableUninstallResult,
 ): Promise<void> {
-  const actions = [
+  const pluginId = "plannotator@plannotator";
+  const actions: ReadonlyArray<{
+    label: string;
+    /** The host, as the person knows it. */
+    owner: string;
+    command: string;
+    args: readonly string[];
+    references: () => HostReferences;
+  }> = [
     {
       label: "Claude Code plugin plannotator@plannotator",
+      owner: "Claude Code",
       command: "claude",
       args: [
         "plugin",
@@ -709,32 +819,24 @@ async function removeHostPlugins(
         ...(request.purge ? [] : ["--keep-data"]),
         "--yes",
       ],
-      installed:
-        hasEnabledPlugin(
-          join(paths.claudeDir, "settings.json"),
-          "plannotator@plannotator",
-        ) ||
-        hasInstalledPlugin(
-          join(paths.claudeDir, "plugins", "installed_plugins.json"),
-          "plannotator@plannotator",
-        ),
+      references: () => pluginReferences(paths.claudeDir, pluginId),
     },
     {
+      // Copilot CLI keeps one install per user: nothing in another scope to leave.
       label: "GitHub Copilot CLI plugin plannotator-copilot@plannotator",
+      owner: "GitHub Copilot CLI",
       command: "copilot",
-      args: ["plugins", "remove", "plannotator-copilot@plannotator", "--plugin"],
-      installed:
-        hasEnabledPlugin(
-          join(paths.copilotDir, "settings.json"),
-          "plannotator-copilot@plannotator",
-        ) ||
-        hasDirectoryWithPrefix(
-          join(paths.copilotDir, "installed-plugins", "plannotator"),
-          "plannotator-copilot",
-        ),
+      // Copilot CLI 1.0.68: `copilot plugin uninstall <name>` (`plugins remove … --plugin` is refused).
+      args: ["plugin", "uninstall", "plannotator-copilot@plannotator"],
+      references: () => {
+        const enabled = enabledPluginReferences(join(paths.copilotDir, "settings.json"), "plannotator-copilot@plannotator");
+        const installed = directoryReferences(join(paths.copilotDir, "installed-plugins", "plannotator"), "plannotator-copilot");
+        return { references: [...enabled.references, ...installed.references], otherScopes: [], unreadable: [...enabled.unreadable, ...installed.unreadable] };
+      },
     },
     {
       label: "Droid plugin plannotator@plannotator",
+      owner: "Droid",
       command: "droid",
       args: [
         "plugin",
@@ -743,68 +845,84 @@ async function removeHostPlugins(
         "--scope",
         "user",
       ],
-      installed:
-        hasEnabledPlugin(
-          join(paths.factoryDir, "settings.json"),
-          "plannotator@plannotator",
-        ) ||
-        hasInstalledPlugin(
-          join(paths.factoryDir, "plugins", "installed_plugins.json"),
-          "plannotator@plannotator",
-        ),
+      references: () => pluginReferences(paths.factoryDir, pluginId),
     },
     {
       label: "Pi extension npm:@plannotator/pi-extension",
+      owner: "Pi",
       command: "pi",
       args: ["remove", "npm:@plannotator/pi-extension"],
-      installed: hasPiPackage(
-        join(
-          environment.env.PI_CODING_AGENT_DIR || join(environment.homeDir, ".pi", "agent"),
-          "settings.json",
-        ),
-      ),
+      references: () => {
+        const filePath = join(environment.env.PI_CODING_AGENT_DIR || join(environment.homeDir, ".pi", "agent"), "settings.json");
+        return piPackageReferences(filePath);
+      },
     },
     {
       // The installers add it with `qwen extensions install`; Qwen's own
       // command removes it from its extension store.
       label: "Qwen Code extension plannotator",
+      owner: "Qwen Code",
       command: "qwen",
       args: ["extensions", "uninstall", "plannotator"],
-      installed: existsSync(join(paths.qwenDir, "extensions", "plannotator", "qwen-extension.json")),
+      references: () => {
+        const folder = join(paths.qwenDir, "extensions", "plannotator");
+        return { references: existsSync(join(folder, "qwen-extension.json")) ? [folder] : [], otherScopes: [], unreadable: [] };
+      },
     },
     {
       label: "VS Code extension backnotprop.plannotator-webview",
+      owner: "VS Code",
       command: "code",
       args: ["--uninstall-extension", "backnotprop.plannotator-webview"],
-      installed: hasDirectoryWithPrefix(
-        join(environment.homeDir, ".vscode", "extensions"),
-        "backnotprop.plannotator-webview-",
-      ),
+      references: () => vscodeReferences(join(environment.homeDir, ".vscode", "extensions")),
     },
-  ] as const;
+  ];
 
+  const retry = formatUninstallRetryCommand(request);
   for (const action of actions) {
-    if (!action.installed) continue;
-    if (request.dryRun) {
-      state.planned.push(action.label);
+    const scan = action.references();
+    if (scan.unreadable.length > 0) {
+      for (const unreadable of scan.unreadable) reportUnreadableConfig(action.owner, unreadable, request, state);
       continue;
     }
-
+    // `--scope user` leaves a project's install: named, never waited for (every retry would stop on it).
+    for (const other of scan.otherScopes) {
+      const where = other.project ? ` for ${other.project}` : "";
+      const how = other.project && (other.scope === "project" || other.scope === "local")
+        ? `; to remove it, run \`${action.command} plugin uninstall ${pluginId} --scope ${other.scope}\` in ${other.project}`
+        : "";
+      state.warnings.push(`Skipped: ${action.label} installed in ${other.scope} scope${where} (${other.field}), which uninstall leaves. Its hooks need the plannotator command${how}.`);
+    }
+    const references = scan.references;
+    if (references.length === 0) continue;
     const executable = environment.which(action.command);
     const manualCommand = [action.command, ...action.args].join(" ");
+    const byHand = (entries: readonly string[]) => `remove only these Plannotator entries by hand: ${entries.join("; ")}. Keep everything else, then run \`${retry}\` again.`;
     if (!executable) {
       state.errors.push(
-        `${action.label} was detected but ${action.command} is unavailable; it was not removed. Manual cleanup: restore ${action.command} on PATH and run \`${manualCommand}\`. After it succeeds, rerun \`${formatUninstallRetryCommand(request)}\`.`,
+        `${action.label} was detected but ${action.command} is unavailable; it was not removed. Manual cleanup: restore ${action.command} on PATH and run \`${manualCommand}\`. After it succeeds, rerun \`${retry}\`. If ${action.owner} was uninstalled for good, ${byHand(references)}`,
       );
       continue;
     }
 
+    if (request.dryRun) {
+      state.planned.push(action.label);
+      continue;
+    }
     const result = await environment.runCommand(executable, action.args);
     if (result.exitCode === 0) {
-      state.removed.push(action.label);
+      // Only what that command removes counts: another scope's install was named above.
+      const remaining = action.references();
+      for (const unreadable of remaining.unreadable) reportUnreadableConfig(action.owner, unreadable, request, state);
+      if (remaining.unreadable.length > 0) continue;
+      if (remaining.references.length > 0) {
+        state.errors.push(`${action.label} is still there after \`${manualCommand}\` reported success. To continue, ${byHand(remaining.references)}`);
+      } else {
+        state.removed.push(action.label);
+      }
     } else {
       state.errors.push(
-        `${action.label} was not removed automatically (${result.timedOut ? "command timed out" : `exit ${result.exitCode}`}). Manual cleanup: run \`${manualCommand}\` directly and resolve the host error until it succeeds. Then rerun \`${formatUninstallRetryCommand(request)}\`.`,
+        `${action.label} was not removed automatically (${result.timedOut ? "command timed out" : `exit ${result.exitCode}`}). Manual cleanup: run \`${manualCommand}\` directly and resolve the host error until it succeeds. Then rerun \`${retry}\`. If ${action.command} keeps refusing because ${action.owner} no longer has it installed, ${action.command === "claude" ? `run \`claude plugin disable ${pluginId} --scope user\` to turn off its settings key, or ` : ""}${byHand(references)}`,
       );
     }
   }
@@ -828,6 +946,7 @@ function removeHostConfigEntries(
     {
       allowRelocatedBinary: false,
       removeFileWhenEmpty: false,
+      owner: "Claude Code",
     },
     "managed Claude Code hooks",
     `Make ${join(paths.claudeDir, "settings.json")} a readable, writable strict JSON object. Remove only Plannotator command hooks from hooks.PermissionRequest entries whose matcher is "ExitPlanMode", hooks.PreToolUse entries whose matcher is "EnterPlanMode", and Plannotator t3-hook commands in Bash entries, then save the file.`,
@@ -846,6 +965,7 @@ function removeHostConfigEntries(
     {
       allowRelocatedBinary: true,
       removeFileWhenEmpty: true,
+      owner: "Codex",
     },
     "managed Codex Stop hook",
     `Make ${join(paths.codexDir, "hooks.json")} a readable, writable strict JSON object. Remove only Plannotator command hooks from hooks.Stop entries, then save the file; delete it only if no other settings remain.`,
@@ -866,7 +986,7 @@ function removeHostConfigEntries(
     state,
   );
 
-  cleanupVibeHooks(join(paths.vibeDir, "hooks.toml"), request, state);
+  cleanupVibeHooks(join(paths.vibeDir, "hooks.toml"), paths.binaryPaths, environment.platform, request, state);
 
   for (const configDir of paths.configDirs) {
     for (const name of ["opencode.json", "opencode.jsonc"]) {
@@ -1365,6 +1485,7 @@ function cleanupHooksJson(
 ): void {
   const recovery = { manualCleanup };
   const parsed = readJsonRecord(
+    policy.owner,
     filePath,
     label,
     recovery,
@@ -1372,6 +1493,7 @@ function cleanupHooksJson(
     state,
   );
   if (!parsed) return;
+  if (request.dryRun) reportRemainingHookReferences(policy.owner, parsed, filePath, binaryPaths, platform, policy.allowRelocatedBinary, request, state, specs);
 
   const hooks = asRecord(parsed.hooks);
   if (!hooks) return;
@@ -1427,7 +1549,9 @@ function cleanupHooksJson(
     else hooks[spec.event] = nextEntries;
   }
 
-  if (!changed) return;
+  if (!changed) {
+    return;
+  }
   if (Object.keys(hooks).length === 0) delete parsed.hooks;
   else parsed.hooks = hooks;
 
@@ -1457,13 +1581,8 @@ function cleanupCodexConfig(
   try {
     content = readFileSync(filePath, "utf8");
   } catch (error) {
-    reportHostCleanupFailure(
-      `Could not inspect ${filePath}`,
-      formatError(error),
-      recovery,
-      request,
-      state,
-    );
+    // The Inbox check reads this file too: said once.
+    reportUnreadableConfig("Codex", { file: filePath, reason: describeFsError(error) }, request, state);
     return;
   }
 
@@ -1495,10 +1614,11 @@ const VIBE_MANAGED_END = "# <<< plannotator-managed-vibe-hooks";
  */
 function cleanupVibeHooks(
   filePath: string,
+  binaryPaths: readonly string[],
+  platform: NodeJS.Platform,
   request: UninstallRequest,
   state: MutableUninstallResult,
 ): void {
-  if (!existsSync(filePath)) return;
   const recovery = {
     manualCleanup: `Make ${filePath} readable and writable. Remove the lines between and including the "${VIBE_MANAGED_START}" and "${VIBE_MANAGED_END}" markers; keep every other hook. Delete the file only if nothing remains.`,
   };
@@ -1506,13 +1626,7 @@ function cleanupVibeHooks(
   try {
     content = readFileSync(filePath, "utf8");
   } catch (error) {
-    reportHostCleanupFailure(
-      `Could not inspect ${filePath}`,
-      formatError(error),
-      recovery,
-      request,
-      state,
-    );
+    if (!isMissingPathError(error)) reportUnreadableConfig("Mistral Vibe", { file: filePath, reason: describeFsError(error) }, request, state);
     return;
   }
 
@@ -1520,8 +1634,14 @@ function cleanupVibeHooks(
   const nextLines: string[] = [];
   let skipping = false;
   let sawStart = false;
+  let hookIndex = -1;
+  const removedHookIndices = new Set<number>();
   for (const line of lines) {
     const trimmed = line.trim();
+    if (/^\[\[\s*(?:hooks|"hooks"|'hooks')\s*\]\]/.test(trimmed)) {
+      hookIndex++;
+      if (skipping) removedHookIndices.add(hookIndex);
+    }
     if (!skipping && trimmed.startsWith(VIBE_MANAGED_START)) {
       skipping = true;
       sawStart = true;
@@ -1536,6 +1656,12 @@ function cleanupVibeHooks(
     nextLines.push(line);
   }
 
+  // Parsed before anything is written: a file it cannot read as TOML is left exactly as it was.
+  const original = parseVibeHooks(filePath, content, request, state);
+  if (state.reported.has(filePath)) return;
+  if (request.dryRun) {
+    reportRemainingHookReferences("Mistral Vibe", original, filePath, binaryPaths, platform, false, request, state, [], removedHookIndices);
+  }
   if (!sawStart) return;
 
   const remaining = nextLines.filter((line) => line.trim().length > 0);
@@ -1559,6 +1685,7 @@ function cleanupVibeHooks(
     );
     state.removed.push(`${label} in ${filePath}`);
   } catch (error) {
+    state.reported.add(filePath);
     reportHostCleanupFailure(
       `Could not rewrite ${filePath}`,
       formatError(error),
@@ -1580,6 +1707,7 @@ function cleanupGeminiSettings(
     manualCleanup: `Make ${filePath} a readable, writable strict JSON object. Remove only Plannotator command hooks from hooks.BeforeTool entries whose matcher is "exit_plan_mode", then save the file.`,
   };
   const parsed = readJsonRecord(
+    "Gemini CLI",
     filePath,
     "managed Gemini hooks",
     recovery,
@@ -1587,6 +1715,8 @@ function cleanupGeminiSettings(
     state,
   );
   if (!parsed) return;
+  if (request.dryRun) reportRemainingHookReferences("Gemini CLI", parsed, filePath, binaryPaths, platform, false, request, state,
+    [{ event: "BeforeTool", matcher: "exit_plan_mode", suffix: "" }]);
   const wasInstallerTemplate = isGeminiInstallerTemplate(
     parsed,
     binaryPaths,
@@ -1595,7 +1725,9 @@ function cleanupGeminiSettings(
 
   const hooks = asRecord(parsed.hooks);
   const beforeTool = hooks?.BeforeTool;
-  if (!hooks || !Array.isArray(beforeTool)) return;
+  if (!hooks || !Array.isArray(beforeTool)) {
+    return;
+  }
 
   let changed = false;
   const nextEntries: unknown[] = [];
@@ -1625,7 +1757,13 @@ function cleanupGeminiSettings(
     nextEntries.push({ ...entry, hooks: nextHooks });
   }
 
-  if (!changed) return;
+  if (!changed) {
+    return;
+  }
+  if (nextEntries.length === 0) delete hooks.BeforeTool;
+  else hooks.BeforeTool = nextEntries;
+  if (Object.keys(hooks).length === 0) delete parsed.hooks;
+  else parsed.hooks = hooks;
   if (request.dryRun) {
     state.planned.push(`managed Gemini hook in ${filePath}`);
     return;
@@ -1636,10 +1774,6 @@ function cleanupGeminiSettings(
     return;
   }
 
-  if (nextEntries.length === 0) delete hooks.BeforeTool;
-  else hooks.BeforeTool = nextEntries;
-  if (Object.keys(hooks).length === 0) delete parsed.hooks;
-  else parsed.hooks = hooks;
   writeJson(
     filePath,
     parsed,
@@ -1664,13 +1798,7 @@ function cleanupOpenCodeConfig(
   try {
     content = readFileSync(filePath, "utf8");
   } catch (error) {
-    reportHostCleanupFailure(
-      `Could not inspect ${filePath}`,
-      formatError(error),
-      recovery,
-      request,
-      state,
-    );
+    reportUnreadableConfig("OpenCode", { file: filePath, reason: describeFsError(error) }, request, state);
     return;
   }
 
@@ -1789,6 +1917,7 @@ function cleanupRecognizableKiroAgent(
     manualCleanup: `Make ${filePath} a readable, writable strict JSON object without changing its intent. If it is the installer-provided Plannotator Kiro agent, delete it; otherwise keep the repaired custom agent at that path.`,
   };
   const parsed = readJsonRecord(
+    "Kiro",
     filePath,
     "the Plannotator Kiro agent",
     recovery,
@@ -1825,13 +1954,7 @@ function cleanupRecognizableAmpPlugin(
   try {
     content = readFileSync(filePath, "utf8");
   } catch (error) {
-    reportHostCleanupFailure(
-      `Could not inspect ${filePath}`,
-      formatError(error),
-      recovery,
-      request,
-      state,
-    );
+    reportUnreadableConfig("Amp", { file: filePath, reason: describeFsError(error) }, request, state);
     return;
   }
 
@@ -1848,24 +1971,21 @@ function cleanupRecognizableAmpPlugin(
 }
 
 function readJsonRecord(
+  owner: string,
   filePath: string,
   integration: string,
   recovery: HostCleanupRecovery,
   request: UninstallRequest,
   state: MutableUninstallResult,
 ): JsonRecord | null {
-  if (!existsSync(filePath)) return null;
+  // Already said this run (a host's plugin check reads the same settings.json): once is enough.
+  if (state.reported.has(filePath)) return null;
   let content: string;
   try {
     content = readFileSync(filePath, "utf8");
   } catch (error) {
-    reportHostCleanupFailure(
-      `Could not inspect ${filePath}`,
-      formatError(error),
-      recovery,
-      request,
-      state,
-    );
+    if (isMissingPathError(error)) return null;
+    reportUnreadableConfig(owner, { file: filePath, reason: describeFsError(error) }, request, state);
     return null;
   }
 
@@ -1905,6 +2025,7 @@ function reportMalformedSharedConfig(
   request: UninstallRequest,
   state: MutableUninstallResult,
 ): void {
+  state.reported.add(filePath);
   reportHostCleanupFailure(
     `Preserved ${filePath}`,
     `${reason}, so ${integration} cannot be classified safely`,
@@ -1936,6 +2057,7 @@ function writeJson(
     );
     state.removed.push(`${label} in ${filePath}`);
   } catch (error) {
+    state.reported.add(filePath);
     reportHostCleanupFailure(
       `Could not update ${filePath}`,
       formatError(error),
@@ -1958,6 +2080,7 @@ function writeTextUpdate(
     writeFileSync(filePath, content, "utf8");
     state.removed.push(`${label} in ${filePath}`);
   } catch (error) {
+    state.reported.add(filePath);
     reportHostCleanupFailure(
       `Could not update ${filePath}`,
       formatError(error),
@@ -2087,6 +2210,7 @@ function removePath(
     stat = lstatSync(path);
   } catch (error) {
     if (isMissingPathError(error)) return;
+    state.reported.add(path);
     if (recovery) {
       reportHostCleanupFailure(
         `Could not inspect ${path}`,
@@ -2116,6 +2240,7 @@ function removePath(
     }
     state.removed.push(path);
   } catch (error) {
+    state.reported.add(path);
     if (recovery) {
       reportHostCleanupFailure(
         `Could not remove ${path}`,
@@ -2130,59 +2255,6 @@ function removePath(
   }
 }
 
-function isManagedHook(
-  value: unknown,
-  binaryPaths: readonly string[],
-  suffix: "" | "improve-context" | "t3-hook",
-  platform: NodeJS.Platform,
-  allowRelocatedBinary = false,
-): boolean {
-  const hook = asRecord(value);
-  if (!hook || hook.type !== "command" || typeof hook.command !== "string") {
-    return false;
-  }
-
-  const command = hook.command.trim();
-  if (suffix === "t3-hook") {
-    const parsed = parseT3HookCommand(command);
-    return parsed !== undefined && (parsed.executable === "plannotator" || binaryPaths.some((path) => sameCommand(parsed.executable, path, platform)));
-  }
-  const expectedBare = suffix ? `plannotator ${suffix}` : "plannotator";
-  if (command === expectedBare) return true;
-
-  for (const binaryPath of binaryPaths) {
-    const candidates = suffix
-      ? [`${binaryPath} ${suffix}`, `"${binaryPath}" ${suffix}`]
-      : [binaryPath, `"${binaryPath}"`];
-    if (candidates.some((candidate) => sameCommand(command, candidate, platform))) {
-      return true;
-    }
-  }
-  return allowRelocatedBinary && isRelocatedPlannotatorCommand(command, suffix);
-}
-
-function isRelocatedPlannotatorCommand(
-  command: string,
-  suffix: "" | "improve-context",
-): boolean {
-  const commandSuffix = suffix ? ` ${suffix}` : "";
-  if (commandSuffix && !command.endsWith(commandSuffix)) return false;
-
-  const executable = commandSuffix
-    ? command.slice(0, -commandSuffix.length).trim()
-    : command;
-  const unquoted =
-    executable.length >= 2 &&
-      executable.startsWith('"') &&
-      executable.endsWith('"')
-      ? executable.slice(1, -1)
-      : executable;
-  if (!isAbsolute(unquoted)) return false;
-
-  const executableName = basename(unquoted).toLowerCase();
-  return executableName === "plannotator" || executableName === "plannotator.exe";
-}
-
 function isGeminiInstallerTemplate(
   value: JsonRecord,
   binaryPaths: readonly string[],
@@ -2232,19 +2304,6 @@ function isPlannotatorOpenCodePlugin(value: unknown): boolean {
   return spec !== null && /^@plannotator\/opencode(?:@|$)/.test(spec);
 }
 
-function hasEnabledPlugin(filePath: string, pluginId: string): boolean {
-  const parsed = tryReadJsonRecord(filePath);
-  const enabled = parsed ? asRecord(parsed.enabledPlugins) : null;
-  return enabled?.[pluginId] === true;
-}
-
-function hasInstalledPlugin(filePath: string, pluginId: string): boolean {
-  const parsed = tryReadJsonRecord(filePath);
-  const plugins = parsed ? asRecord(parsed.plugins) : null;
-  const installs = plugins?.[pluginId];
-  return Array.isArray(installs) && installs.length > 0;
-}
-
 /**
  * Qwen Code's user folder: $QWEN_HOME (the folder itself, a leading ~
  * expanded, a relative path taken from the current folder) or ~/.qwen, as in
@@ -2258,44 +2317,6 @@ function resolveQwenDir(qwenHome: string | undefined, homeDir: string): string {
   return resolve(value);
 }
 
-function hasPiPackage(filePath: string): boolean {
-  const parsed = tryReadJsonRecord(filePath);
-  const packages = parsed?.packages;
-  if (!Array.isArray(packages)) return false;
-
-  return packages.some((entry) => {
-    const record = asRecord(entry);
-    const source =
-      typeof entry === "string"
-        ? entry
-        : typeof record?.source === "string"
-          ? record.source
-          : null;
-    return (
-      typeof source === "string" &&
-      /^npm:@plannotator\/pi-extension(?:@|$)/.test(source)
-    );
-  });
-}
-
-function tryReadJsonRecord(filePath: string): JsonRecord | null {
-  if (!existsSync(filePath)) return null;
-  try {
-    const parsed: unknown = JSON.parse(readFileSync(filePath, "utf8"));
-    return asRecord(parsed);
-  } catch {
-    return null;
-  }
-}
-
-function hasDirectoryWithPrefix(directory: string, prefix: string): boolean {
-  try {
-    return readdirSync(directory).some((entry) => entry.startsWith(prefix));
-  } catch {
-    return false;
-  }
-}
-
 function asRecord(value: unknown): JsonRecord | null {
   return typeof value === "object" && value !== null && !Array.isArray(value)
     ? value as JsonRecord
@@ -2310,18 +2331,6 @@ function hasOnlyKeys(
   return Object.keys(value).every((key) => allowedSet.has(key));
 }
 
-function sameCommand(
-  left: string,
-  right: string,
-  platform: NodeJS.Platform,
-): boolean {
-  const normalizedLeft = left.replace(/\\/g, "/");
-  const normalizedRight = right.replace(/\\/g, "/");
-  return platform === "win32"
-    ? normalizedLeft.toLowerCase() === normalizedRight.toLowerCase()
-    : normalizedLeft === normalizedRight;
-}
-
 function sameLexicalPath(
   left: string,
   right: string,