diff --git a/assets/pr-account-cleanup-retry.png b/assets/pr-account-cleanup-retry.png
new file mode 100644
index 000000000..b6fc79c92
Binary files /dev/null and b/assets/pr-account-cleanup-retry.png differ
diff --git a/docs-site/src/content/docs/ja/reference/cli/providers-accounts.md b/docs-site/src/content/docs/ja/reference/cli/providers-accounts.md
index cab525623..a447dc380 100644
--- a/docs-site/src/content/docs/ja/reference/cli/providers-accounts.md
+++ b/docs-site/src/content/docs/ja/reference/cli/providers-accounts.md
@@ -84,7 +84,7 @@ use <provider> <id> Switch the active credential; 'main' selects the Codex App l
 refresh <provider>  Force-refresh Codex or provider quota reports.
 auto-switch <provider> <on|off|status|threshold N>  Control the Codex pool threshold.
 priority <provider> <id|main> [first|earlier|normal|later|last|-100..100|reset]  Selection order; omit the value to read it.
-remove <provider> <id> --yes  Remove a stored account or key after an existence check.
+remove <provider> <id|main> --yes [--cleanup-only]  OAuth/API-key ids are checked first; Codex can retry orphan credential cleanup.
 add-key <provider> [--label <label>]  Add a key read only from piped stdin.
 login/reauth/code/cancel  Run browser or manual-code auth from a headless shell.
 reset-credits <id|main> [--consume --yes]  Inspect or consume Codex reset credits.
@@ -182,18 +182,23 @@ preemption が未バインドリクエストを直ちに引き上げます。既
 
 ヘッドレス シェルからブラウザベースまたは手動コードのアカウント認証を実行します。プロバイダー固有のコマンド形式には `ocx account --help` を使用します。Codex account login は保存済みでも catalog refresh が保留中なら成功終了し、human output の stderr に固定の `ocx sync` 案内を出します。`--json` は案内を混ぜず、完了 state に `catalogRefreshPending: true` を保持します。
 
-### `ocx account remove <provider> <id|main> --yes [--json]`
+### `ocx account remove <provider> <id|main> --yes [--cleanup-only] [--json]`
 
-この保護された非対話型削除には `--yes` が必要です。削除する前に、ID が存在することが確認されます。 ID が欠落している場合は、DELETE を送信せずに 1 が終了します。メインの Codex App ログインは削除できないため、`remove openai main --yes` は拒否されます。削除後、ファミリーは再度読み取られます。固定された Codex アカウントを削除すると、ピンがクリアされ、自動選択に戻ります。 OAuth は最初に残ったアカウントを昇格させるか、何も報告しません。 API キー プールは、最初に残っているキーを昇格するか、何も報告しません。 `--json` の成功と失敗の形状は次のとおりです。
+この保護された非対話型削除には `--yes` が必要です。OAuth と API key の削除は DELETE を送る前に id の存在を確認します。Codex の削除は idempotent であり、中断したローカル credential cleanup を再試行できるよう、row がなくても DELETE を送ります。未知の id は server が 404 を返します。`accountCleanupPending` の後は `--cleanup-only` を追加します。この option は persisted account が存在しないことを確認できた場合のみ orphaned credential cleanup を完了するため、stale retry が再追加済み account を削除しません。メインの Codex App ログインは削除できないため、`remove openai main --yes` は拒否されます。削除後、ファミリーは再度読み取られます。固定された Codex アカウントを削除すると、ピンがクリアされ、自動選択に戻ります。 OAuth は最初に残ったアカウントを昇格させるか、何も報告しません。 API キー プールは、最初に残っているキーを昇格するか、何も報告しません。 `--json` の成功と失敗の形状は次のとおりです。
 
 ```text
-{ ok: true, provider, id, removedActive: boolean, promotedActiveId: string | null, catalogRefreshPending?: boolean }
-{ error: string } // stderr, exit 1
+{ ok: true, provider, id, removedActive: boolean, promotedActiveId: string | null, catalogRefreshPending?: boolean, accountCleanupPending?: boolean }
+{ error: string, catalogRefreshPending?: boolean, accountCleanupPending?: boolean } // stderr, exit 1
 ```
 
 `catalogRefreshPending` は Codex 削除だけに含まれます。`true` でも削除は保存済みで、human output は
 stderr に `ocx sync` の案内を出して終了コード 0 のままです。OAuth account と API key の削除形状は変わりません。
 
+`accountCleanupPending` は Codex 削除の JSON にだけ含まれます。`false` はローカル credential cleanup の完了を示します。
+`true` は account row と live ownership の削除は完了したものの、ローカル credential cleanup が完了していないことを示します。
+human output は固定の `--cleanup-only` 案内を表示して終了コード 0 のままです。JSON output は stdout に警告を混ぜず、この flag を保持します。
+成功した Codex DELETE の後に post-delete verification read が失敗した場合、command は終了コード 1 になりますが、JSON error は両方の Codex completion boolean を保持し、human output も必要な recovery guidance を表示します。
+
 ### `ocx account add-key <provider> [--label <label>] [--json]`
 
 API キー プロバイダーのキーを追加してアクティブ化します。キーは、非 TTY パイプ/リダイレクトされた標準入力からの読み取り専用です。インタラクティブ TTY 入力、空の入力、OAuth/Codex プロバイダー、および API エラー終了 1。キーがラベル内に表示される場合も含め、キーがエコーされることはありません。シークレット マネージャーまたはヒア文字列を使用することをお勧めします。
diff --git a/docs-site/src/content/docs/ja/reference/management-api.md b/docs-site/src/content/docs/ja/reference/management-api.md
index 7e903d874..d8086d0b0 100644
--- a/docs-site/src/content/docs/ja/reference/management-api.md
+++ b/docs-site/src/content/docs/ja/reference/management-api.md
@@ -206,7 +206,7 @@ Authorization: Bearer <admin-token>
 
 |メソッドとパス |目的 |注目すべきエラー |
 | --- | --- | --- |
-| `GET, POST, DELETE /api/codex-auth/accounts` | Codex アカウントの一覧表示/更新、必要に応じてインポート、削除。成功した POST/DELETE は `catalogRefreshPending` を返します。 | 400 無効な入力。手動インポートは無効にすることができます。 |
+| `GET, POST, DELETE /api/codex-auth/accounts` | Codex アカウントの一覧表示/更新、必要に応じてインポート、削除。成功した POST/DELETE は `catalogRefreshPending` を返し、DELETE は `accountCleanupPending: true` を返す場合もあります。 | 400 無効な入力。404 不明なアカウント。409 cleanup-only retry で account absence を確認できない。500 `codex_account_delete_rollback_failed` は再試行前に再起動が必要。手動インポートは無効にすることができます。 |
 | `PUT /api/codex-auth/accounts/alias` |アカウント エイリアスの設定またはクリア | 400 無効なアカウント/エイリアス |
 | `PUT /api/codex-auth/accounts/pause` | 1 つのアカウントを一時停止または再開する | 400 無効なアカウント/状態。 404 アカウントが見つかりません |
 | `PUT /api/codex-auth/accounts/pause-exhausted` |クォータを使い果たしたアカウントを一時停止する |ミューテーションロックの失敗は 503 になります |
@@ -235,6 +235,13 @@ account 作成を再試行する前に再認証するか削除してください
 保存済み mutation をロールバックせず、内部 provider/account/path/credential detail も返しません。削除した
 account の selector binding は残るため、欠落中の exact route は fail closed し、同じ id の再追加で同じ selector が戻ります。
 
+config の削除がコミットされた後にローカルの credential cleanup が完了できない場合でも、
+DELETE は live ownership を無効化して catalog convergence を要求し、`accountCleanupPending: true` を含む
+成功応答を返します。同じ DELETE を繰り返すと、account row が既に存在しなくても cleanup を再試行できます。
+recovery client は `cleanupOnly=1` を追加します。この形式は persisted account absence を確認できない場合に 409 で拒否し、
+stale retry が再追加済み account を削除しないようにします。dashboard は不透明な account id を公開せずこの安全な再試行
+action を保持し、CLI は storage detail を公開せず固定の `--cleanup-only` 案内を表示します。
+
 ## クライアントの選択
 
 通常の管理では、[ウェブダッシュボード](/guides/web-dashboard/) が最も安全なガイド付きワークフローを提供します。ヘッドレス ホストとオートメーションの場合は、対応する `ocx` コマンドを使用します。これらのコマンドは、これと同じライブ API を呼び出し、プロキシに到達できない場合、または操作が失敗した場合にゼロ以外の結果を返します。ダイレクト HTTP は、上記の正確なエンドポイント コントラクトを必要とする統合に最も役立ちます。
diff --git a/docs-site/src/content/docs/ko/reference/cli/providers-accounts.md b/docs-site/src/content/docs/ko/reference/cli/providers-accounts.md
index 5b7bd66ca..24366d830 100644
--- a/docs-site/src/content/docs/ko/reference/cli/providers-accounts.md
+++ b/docs-site/src/content/docs/ko/reference/cli/providers-accounts.md
@@ -84,7 +84,7 @@ use <provider> <id> Switch the active credential; 'main' selects the Codex App l
 refresh <provider>  Force-refresh Codex or provider quota reports.
 auto-switch <provider> <on|off|status|threshold N>  Control the Codex pool threshold.
 priority <provider> <id|main> [first|earlier|normal|later|last|-100..100|reset]  Selection order; omit the value to read it.
-remove <provider> <id> --yes  Remove a stored account or key after an existence check.
+remove <provider> <id|main> --yes [--cleanup-only]  OAuth/API-key ids are checked first; Codex can retry orphan credential cleanup.
 add-key <provider> [--label <label>]  Add a key read only from piped stdin.
 login/reauth/code/cancel  Run browser or manual-code auth from a headless shell.
 reset-credits <id|main> [--consume --yes]  Inspect or consume Codex reset credits.
@@ -181,18 +181,23 @@ Codex pool 계정 하나의 선택 순서를 읽거나 설정합니다. **값이
 
 헤드리스 셸에서 브라우저 기반 또는 수동 코드 계정 인증을 실행합니다. 제공자별 명령 형태는 `ocx account --help`를 보십시오. Codex account login이 저장되었지만 catalog refresh가 보류 중이면 성공으로 종료하고 human output의 stderr에 고정된 `ocx sync` 안내를 표시합니다. `--json`은 안내를 섞지 않고 완료 state의 `catalogRefreshPending: true`를 유지합니다.
 
-### `ocx account remove <provider> <id|main> --yes [--json]`
+### `ocx account remove <provider> <id|main> --yes [--cleanup-only] [--json]`
 
-이 보호된 비대화형 삭제는 `--yes`를 요구합니다. 삭제하기 전에 id가 존재하는지 확인하며, 없는 id는 DELETE를 보내지 않고 종료 코드 1로 끝납니다. Codex App의 main 로그인은 제거할 수 없으므로 `remove openai main --yes`는 거부됩니다. 삭제 후에는 해당 계열을 다시 읽습니다. 고정된 Codex 계정을 제거하면 고정이 풀리고 자동 선택으로 돌아갑니다. OAuth는 남아 있는 첫 번째 계정으로 승격하거나 없다고 보고합니다. API 키 풀은 남아 있는 첫 번째 키로 승격하거나 없다고 보고합니다. `--json`의 성공 및 실패 형식은 다음과 같습니다:
+이 보호된 비대화형 삭제는 `--yes`를 요구합니다. OAuth와 API key 삭제는 DELETE 전에 id 존재를 확인합니다. Codex 삭제는 idempotent하며 중단된 로컬 credential cleanup을 재시도할 수 있도록 row가 없어도 DELETE를 보냅니다. 알 수 없는 id는 server가 404를 반환합니다. `accountCleanupPending` 뒤에는 `--cleanup-only`를 추가합니다. 이 option은 persisted account가 없음을 확인할 수 있을 때만 orphaned credential cleanup을 완료하므로 stale retry가 다시 추가된 account를 삭제하지 않습니다. Codex App의 main 로그인은 제거할 수 없으므로 `remove openai main --yes`는 거부됩니다. 삭제 후에는 해당 계열을 다시 읽습니다. 고정된 Codex 계정을 제거하면 고정이 풀리고 자동 선택으로 돌아갑니다. OAuth는 남아 있는 첫 번째 계정으로 승격하거나 없다고 보고합니다. API 키 풀은 남아 있는 첫 번째 키로 승격하거나 없다고 보고합니다. `--json`의 성공 및 실패 형식은 다음과 같습니다:
 
 ```text
-{ ok: true, provider, id, removedActive: boolean, promotedActiveId: string | null, catalogRefreshPending?: boolean }
-{ error: string } // stderr, exit 1
+{ ok: true, provider, id, removedActive: boolean, promotedActiveId: string | null, catalogRefreshPending?: boolean, accountCleanupPending?: boolean }
+{ error: string, catalogRefreshPending?: boolean, accountCleanupPending?: boolean } // stderr, exit 1
 ```
 
 `catalogRefreshPending`는 Codex 삭제에만 포함됩니다. `true`여도 삭제는 이미 저장되었으며 human output은
 stderr에 `ocx sync` 안내를 표시하고 종료 코드 0을 유지합니다. OAuth account와 API key 삭제 형식은 바뀌지 않습니다.
 
+`accountCleanupPending`는 Codex 삭제 JSON에만 포함됩니다. `false`는 로컬 credential cleanup이 완료되었음을 뜻합니다.
+`true`는 account row와 live ownership은 제거되었지만 로컬 credential cleanup이 완료되지 않았음을 뜻합니다.
+human output은 고정된 `--cleanup-only` 안내를 표시하고 종료 코드 0을 유지합니다. JSON output은 stdout에 경고를 섞지 않고 이 flag를 유지합니다.
+성공한 Codex DELETE 뒤의 post-delete verification read가 실패하면 command는 종료 코드 1을 반환하지만, JSON error는 두 Codex completion boolean을 유지하고 human output도 필요한 recovery guidance를 계속 표시합니다.
+
 ### `ocx account add-key <provider> [--label <label>] [--json]`
 
 API 키 제공자에 키를 추가하고 활성화합니다. 키는 비TTY 파이프/리디렉션 stdin에서만 읽습니다. 대화형 TTY 입력, 빈 입력, OAuth/Codex 제공자, API 실패는 종료 코드 1로 끝납니다. 라벨 안에 들어 있더라도 키는 절대 출력되지 않습니다. 비밀 관리자나 here-string을 쓰는 편이 좋습니다:
diff --git a/docs-site/src/content/docs/ko/reference/management-api.md b/docs-site/src/content/docs/ko/reference/management-api.md
index da0b17085..146766322 100644
--- a/docs-site/src/content/docs/ko/reference/management-api.md
+++ b/docs-site/src/content/docs/ko/reference/management-api.md
@@ -206,7 +206,7 @@ Authorization: Bearer <admin-token>
 
 | Method and path | 목적 | 주요 오류 |
 | --- | --- | --- |
-| `GET, POST, DELETE /api/codex-auth/accounts` | Codex account를 나열/갱신, 선택적으로 가져오기, 또는 삭제합니다. 성공한 POST/DELETE는 `catalogRefreshPending`를 포함합니다. | 400 잘못된 입력; 수동 가져오기를 비활성화할 수 있음 |
+| `GET, POST, DELETE /api/codex-auth/accounts` | Codex account를 나열/갱신, 선택적으로 가져오기, 또는 삭제합니다. 성공한 POST/DELETE는 `catalogRefreshPending`를 포함하며 DELETE는 `accountCleanupPending: true`도 포함할 수 있습니다. | 400 잘못된 입력; 404 알 수 없는 account; 409 cleanup-only retry가 account absence를 확인하지 못함; 500 `codex_account_delete_rollback_failed`는 재시도 전에 재시작해야 함; 수동 가져오기를 비활성화할 수 있음 |
 | `PUT /api/codex-auth/accounts/alias` | 계정 alias를 설정하거나 지웁니다 | 400 잘못된 account/alias |
 | `PUT /api/codex-auth/accounts/pause` | 계정 하나를 일시 중지하거나 재개합니다 | 400 잘못된 account/state; 404 누락된 account |
 | `PUT /api/codex-auth/accounts/pause-exhausted` | quota가 소진된 account를 일시 중지합니다 | mutation-lock 실패는 503이 됩니다 |
@@ -235,6 +235,13 @@ Authorization: Bearer <admin-token>
 mutation을 되돌리지 않고 내부 provider/account/path/credential 세부 정보도 반환하지 않습니다. 삭제된
 account의 selector binding은 남아 있어 계정이 없을 때 exact route가 fail closed하고 같은 id를 다시 추가하면 같은 selector가 복원됩니다.
 
+config 삭제가 커밋된 뒤 로컬 credential cleanup이 완료되지 못해도 DELETE는 live ownership을
+무효화하고 catalog convergence를 요청한 다음 `accountCleanupPending: true`가 포함된 성공 응답을 반환합니다.
+같은 DELETE를 반복하면 account row가 이미 없어도 cleanup을 다시 시도합니다. recovery client는 `cleanupOnly=1`을
+추가합니다. 이 형식은 persisted account absence를 확인하지 못하면 409로 거부하여 stale retry가 다시 추가된 account를
+삭제하지 못하게 합니다. dashboard는 불투명한 account id를 노출하지 않고 이 안전한 재시도 action을 유지하며
+CLI는 storage 세부 정보를 노출하지 않는 고정된 `--cleanup-only` 안내를 표시합니다.
+
 ## 클라이언트 선택
 
 일반적인 관리 작업에는 [Web Dashboard](/guides/web-dashboard/)가 가장 안전한 안내형 워크플로를 제공합니다. 헤드리스 호스트와 자동화에는 대응하는 `ocx` 명령을 사용하십시오. 이 명령들은 동일한 실시간 API를 호출하며, 프록시에 접근할 수 없거나 작업이 실패하면 0이 아닌 결과를 반환합니다. 직접 HTTP는 위의 정확한 엔드포인트 계약이 필요한 통합에 가장 유용합니다.
diff --git a/docs-site/src/content/docs/reference/cli/providers-accounts.md b/docs-site/src/content/docs/reference/cli/providers-accounts.md
index 6cb382df8..48c06d56c 100644
--- a/docs-site/src/content/docs/reference/cli/providers-accounts.md
+++ b/docs-site/src/content/docs/reference/cli/providers-accounts.md
@@ -94,7 +94,7 @@ use <provider> <id> Switch the active credential; 'main' selects the Codex App l
 refresh <provider>  Force-refresh Codex or provider quota reports.
 auto-switch <provider> <on|off|status|threshold N>  Control the Codex pool threshold.
 priority <provider> <id|main> [first|earlier|normal|later|last|-100..100|reset]  Selection order; omit the value to read it.
-remove <provider> <id> --yes  Remove a stored account or key after an existence check.
+remove <provider> <id|main> --yes [--cleanup-only]  OAuth/API-key ids are checked first; Codex can retry orphan credential cleanup.
 add-key <provider> [--label <label>]  Add a key read only from piped stdin.
 login/reauth/code/cancel  Run browser or manual-code auth from a headless shell.
 reset-credits <id|main> [--consume --yes]  Inspect or consume Codex reset credits.
@@ -233,24 +233,35 @@ its model-catalog refresh remains pending, human output still exits successfully
 `ocx sync` recovery guidance on stderr. `--json` keeps stdout parseable and carries
 `catalogRefreshPending: true` in the completed login state without the human warning.
 
-### `ocx account remove <provider> <id|main> --yes [--json]`
+### `ocx account remove <provider> <id|main> --yes [--cleanup-only] [--json]`
 
-This guarded, non-interactive deletion requires `--yes`. Before deleting, it verifies that the id
-exists; a missing id exits 1 without sending DELETE. The main Codex App login cannot be removed, so
-`remove openai main --yes` is refused. After deletion, the family is read again: removing the pinned
+This guarded, non-interactive deletion requires `--yes`. OAuth and API-key removals verify that the id
+exists before sending DELETE. Codex removal is idempotent and sends DELETE for an absent row so a
+previously interrupted local cleanup can be retried; the server still returns 404 for an unknown id.
+After an `accountCleanupPending` result, add `--cleanup-only`: this completes orphaned credential
+cleanup only when persisted account absence can be confirmed, so a stale retry cannot remove a
+re-added account.
+The main Codex App login cannot be removed, so `remove openai main --yes` is refused. After deletion, the family is read again: removing the pinned
 Codex account clears the pin and returns to automatic selection; OAuth promotes the first remaining
 account or reports none; API-key pools promote the first remaining key or report none. `--json`
 success and failure shapes are:
 
 ```text
-{ ok: true, provider, id, removedActive: boolean, promotedActiveId: string | null, catalogRefreshPending?: boolean }
-{ error: string } // stderr, exit 1
+{ ok: true, provider, id, removedActive: boolean, promotedActiveId: string | null, catalogRefreshPending?: boolean, accountCleanupPending?: boolean }
+{ error: string, catalogRefreshPending?: boolean, accountCleanupPending?: boolean } // stderr, exit 1
 ```
 
 `catalogRefreshPending` is present on Codex removals only. When it is `true`, the account deletion is
 already saved; human output prints generic `ocx sync` recovery guidance on stderr and still exits 0.
 OAuth-account and API-key removal envelopes do not gain this field.
 
+`accountCleanupPending` is present only on Codex removal JSON. `false` means local credential cleanup
+completed. `true` means the account row was removed and live ownership was invalidated, but local
+credential cleanup did not complete. Human output prints fixed `--cleanup-only` guidance and still
+exits 0. JSON output preserves the flag without mixing warnings into stdout. If the post-delete
+verification read fails after a successful Codex DELETE, the command exits 1 but retains both Codex
+completion booleans in the JSON error, and human output still prints any required recovery guidance.
+
 ### `ocx account add-key <provider> [--label <label>] [--json]`
 
 Adds and activates a key for an API-key provider. The key is read only from non-TTY piped/redirected
diff --git a/docs-site/src/content/docs/reference/management-api.md b/docs-site/src/content/docs/reference/management-api.md
index dde75b270..06adbf0be 100644
--- a/docs-site/src/content/docs/reference/management-api.md
+++ b/docs-site/src/content/docs/reference/management-api.md
@@ -231,7 +231,7 @@ manager. Its routes are:
 
 | Method and path | Purpose | Notable errors |
 | --- | --- | --- |
-| `GET, POST, DELETE /api/codex-auth/accounts` | List/refresh, optionally import, or delete Codex accounts. Successful POST/DELETE responses include `catalogRefreshPending`. | 400 invalid input; manual import can be disabled |
+| `GET, POST, DELETE /api/codex-auth/accounts` | List/refresh, optionally import, or delete Codex accounts. Successful POST/DELETE responses include `catalogRefreshPending`; a DELETE can also include `accountCleanupPending: true`. | 400 invalid input; 404 unknown account; 409 cleanup-only retry could not confirm absence; 500 `codex_account_delete_rollback_failed` requires restart before retry; manual import can be disabled |
 | `PUT /api/codex-auth/accounts/alias` | Set or clear an account alias | 400 invalid account/alias |
 | `PUT /api/codex-auth/accounts/pause` | Pause or resume one account | 400 invalid account/state; 404 missing account |
 | `PUT /api/codex-auth/accounts/pause-exhausted` | Pause accounts whose quota is exhausted | Mutation-lock failures become 503 |
@@ -264,6 +264,14 @@ provider, account, path, or credential details; clients receive only the complet
 an account retains its selector binding so exact routes fail closed while the account is absent and the
 same selector is restored if that account id is added again.
 
+If the config deletion commits but local credential cleanup cannot finish, DELETE still
+invalidates live ownership, requests catalog convergence, and returns success with
+`accountCleanupPending: true`. Repeating the same DELETE is idempotent and retries cleanup even though
+the account row is already absent. Recovery clients add `cleanupOnly=1`; that form refuses with 409
+unless persisted account absence can be confirmed, so a stale retry cannot remove a re-added account.
+The dashboard retains this safe retry action without exposing the opaque account id, and the CLI
+prints fixed `--cleanup-only` guidance without reflecting storage details.
+
 ## Choosing a client
 
 For ordinary administration, the [Web Dashboard](/guides/web-dashboard/) gives the safest guided
diff --git a/docs-site/src/content/docs/ru/reference/cli/providers-accounts.md b/docs-site/src/content/docs/ru/reference/cli/providers-accounts.md
index c1a27cb05..0c7ecbd6d 100644
--- a/docs-site/src/content/docs/ru/reference/cli/providers-accounts.md
+++ b/docs-site/src/content/docs/ru/reference/cli/providers-accounts.md
@@ -97,7 +97,7 @@ use <provider> <id> Switch the active credential; 'main' selects the Codex App l
 refresh <provider>  Force-refresh Codex or provider quota reports.
 auto-switch <provider> <on|off|status|threshold N>  Control the Codex pool threshold.
 priority <provider> <id|main> [first|earlier|normal|later|last|-100..100|reset]  Selection order; omit the value to read it.
-remove <provider> <id> --yes  Remove a stored account or key after an existence check.
+remove <provider> <id|main> --yes [--cleanup-only]  OAuth/API-key ids are checked first; Codex can retry orphan credential cleanup.
 add-key <provider> [--label <label>]  Add a key read only from piped stdin.
 login/reauth/code/cancel  Run browser or manual-code auth from a headless shell.
 reset-credits <id|main> [--consume --yes]  Inspect or consume Codex reset credits.
@@ -230,10 +230,14 @@ provider-specific формы команды используйте `ocx account
 остаётся пригодным для парсинга, а завершённый login-state содержит
 `catalogRefreshPending: true` без human-readable предупреждения.
 
-### `ocx account remove <provider> <id|main> --yes [--json]`
+### `ocx account remove <provider> <id|main> --yes [--cleanup-only] [--json]`
 
-Это защищённое неинтерактивное удаление требует `--yes`. Перед удалением оно проверяет, что id
-существует; если id отсутствует, команда завершается кодом 1 и DELETE даже не отправляется.
+Это защищённое неинтерактивное удаление требует `--yes`. Для OAuth и API-key наличие id проверяется
+до DELETE. Удаление Codex идемпотентно и отправляет DELETE даже при отсутствии row, чтобы повторить
+прерванную локальную очистку credential; для неизвестного id server всё равно возвращает 404.
+После `accountCleanupPending` добавьте `--cleanup-only`: этот option завершает очистку orphaned
+credential только когда отсутствие persisted account подтверждено, поэтому stale retry не удалит
+повторно добавленный account.
 Главный логин Codex App удалить нельзя, поэтому `remove openai main --yes` отклоняется. После
 удаления семейство перечитывается заново: удаление pinned-аккаунта Codex очищает pin и возвращает
 автоматический выбор; OAuth повышает в active первый оставшийся аккаунт либо сообщает, что их не
@@ -241,14 +245,21 @@ provider-specific формы команды используйте `ocx account
 Формы успеха и неудачи в `--json`:
 
 ```text
-{ ok: true, provider, id, removedActive: boolean, promotedActiveId: string | null, catalogRefreshPending?: boolean }
-{ error: string } // stderr, exit 1
+{ ok: true, provider, id, removedActive: boolean, promotedActiveId: string | null, catalogRefreshPending?: boolean, accountCleanupPending?: boolean }
+{ error: string, catalogRefreshPending?: boolean, accountCleanupPending?: boolean } // stderr, exit 1
 ```
 
 `catalogRefreshPending` присутствует только при удалении аккаунтов Codex. Значение `true` означает,
 что удаление уже сохранено; human-readable вывод печатает в stderr общую рекомендацию `ocx sync` и
 по-прежнему завершается с кодом 0. Форматы удаления OAuth-аккаунтов и API-key не меняются.
 
+`accountCleanupPending` присутствует только в JSON удаления Codex. `false` означает, что локальная очистка
+credential завершена. `true` означает, что account row и live ownership удалены, но локальная очистка
+credential не завершилась. Human-readable вывод печатает фиксированную подсказку `--cleanup-only` и
+сохраняет код 0. JSON output сохраняет flag без предупреждения в stdout. Если post-delete verification
+read завершается ошибкой после успешного Codex DELETE, команда возвращает код 1, но JSON error сохраняет
+оба Codex completion boolean, а human-readable вывод по-прежнему печатает необходимые recovery guidance.
+
 ### `ocx account add-key <provider> [--label <label>] [--json]`
 
 Добавить и активировать ключ для API-key-провайдера. Ключ читается только из piped/redirected
diff --git a/docs-site/src/content/docs/ru/reference/management-api.md b/docs-site/src/content/docs/ru/reference/management-api.md
index f6e8c74ae..95102cd60 100644
--- a/docs-site/src/content/docs/ru/reference/management-api.md
+++ b/docs-site/src/content/docs/ru/reference/management-api.md
@@ -230,7 +230,7 @@ picker изменилась. `catalogRefreshPending: true` в успешном 
 
 | Метод и путь | Назначение | Особые ошибки |
 | --- | --- | --- |
-| `GET, POST, DELETE /api/codex-auth/accounts` | Показать/обновить список, по желанию импортировать, либо удалить аккаунты Codex. Успешные POST/DELETE включают `catalogRefreshPending`. | 400 invalid input; manual import can be disabled |
+| `GET, POST, DELETE /api/codex-auth/accounts` | Показать/обновить список, по желанию импортировать, либо удалить аккаунты Codex. Успешные POST/DELETE включают `catalogRefreshPending`; DELETE также может включать `accountCleanupPending: true`. | 400 invalid input; 404 unknown account; 409 cleanup-only retry could not confirm absence; 500 `codex_account_delete_rollback_failed` требует перезапуска перед повтором; manual import can be disabled |
 | `PUT /api/codex-auth/accounts/alias` | Задать или очистить alias аккаунта | 400 invalid account/alias |
 | `PUT /api/codex-auth/accounts/pause` | Поставить один аккаунт на паузу или снять её | 400 invalid account/state; 404 missing account |
 | `PUT /api/codex-auth/accounts/pause-exhausted` | Поставить на паузу аккаунты с исчерпанной квотой | Сбои mutation-lock превращаются в 503 |
@@ -264,6 +264,14 @@ boolean завершения. При удалении аккаунта его se
 fail closed, пока аккаунт отсутствует, а при повторном добавлении того же id восстанавливается тот же
 селектор.
 
+Если удаление из config уже зафиксировано, но локальная очистка credential не завершилась,
+DELETE всё равно отключает live ownership, запускает catalog convergence и возвращает успешный ответ с
+`accountCleanupPending: true`. Повтор того же DELETE идемпотентно запускает очистку, даже когда account row
+уже отсутствует. Recovery-клиенты добавляют `cleanupOnly=1`; эта форма возвращает 409, если отсутствие
+persisted account не удалось подтвердить, поэтому stale retry не удалит повторно добавленный account. Dashboard сохраняет
+это безопасное действие, не раскрывая opaque account id, а CLI выводит фиксированную подсказку
+`--cleanup-only` без раскрытия деталей storage.
+
 ## Как выбрать клиента
 
 Для обычного администрирования самый безопасный guided-workflow даёт
diff --git a/docs-site/src/content/docs/zh-cn/reference/cli/providers-accounts.md b/docs-site/src/content/docs/zh-cn/reference/cli/providers-accounts.md
index 765c21aad..617d10ff1 100644
--- a/docs-site/src/content/docs/zh-cn/reference/cli/providers-accounts.md
+++ b/docs-site/src/content/docs/zh-cn/reference/cli/providers-accounts.md
@@ -88,7 +88,7 @@ use <provider> <id> Switch the active credential; 'main' selects the Codex App l
 refresh <provider>  Force-refresh Codex or provider quota reports.
 auto-switch <provider> <on|off|status|threshold N>  Control the Codex pool threshold.
 priority <provider> <id|main> [first|earlier|normal|later|last|-100..100|reset]  Selection order; omit the value to read it.
-remove <provider> <id> --yes  Remove a stored account or key after an existence check.
+remove <provider> <id|main> --yes [--cleanup-only]  OAuth/API-key ids are checked first; Codex can retry orphan credential cleanup.
 add-key <provider> [--label <label>]  Add a key read only from piped stdin.
 login/reauth/code/cancel  Run browser or manual-code auth from a headless shell.
 reset-credits <id|main> [--consume --yes]  Inspect or consume Codex reset credits.
@@ -206,23 +206,30 @@ token，也不是简单重读账号列表。`--json` 返回
 `--json` 时 stdout 保持可解析，已完成的登录状态会包含 `catalogRefreshPending: true`，且不会
 打印人类可读警告。
 
-### `ocx account remove <provider> <id|main> --yes [--json]`
+### `ocx account remove <provider> <id|main> --yes [--cleanup-only] [--json]`
 
-这个受保护的非交互式删除需要 `--yes`。删除前，它会验证 id 是否存在；缺失的 id
-会以 1 退出，而不会发送 DELETE。主 Codex App 登录不能被移除，因此会拒绝
+这个受保护的非交互式删除需要 `--yes`。OAuth 和 API key 删除会在发送 DELETE 前验证 id。
+Codex 删除是幂等的，即使 row 已不存在也会发送 DELETE，以便重试中断的本地 credential cleanup；未知 id 仍由
+server 返回 404。收到 `accountCleanupPending` 后请添加 `--cleanup-only`；该选项只在能够确认 persisted
+account 不存在时完成 orphaned credential cleanup，因此 stale retry 不会删除重新添加的 account。主 Codex App 登录不能被移除，因此会拒绝
 `remove openai main --yes`。删除后会重新读取该家族：移除已固定的 Codex 账号会清除
 固定并回到自动选择；OAuth 会提升第一个剩余账号，或者报告不存在；API 密钥池会
 提升第一个剩余密钥，或者报告不存在。`--json` 的成功和失败结构如下：
 
 ```text
-{ ok: true, provider, id, removedActive: boolean, promotedActiveId: string | null, catalogRefreshPending?: boolean }
-{ error: string } // stderr, exit 1
+{ ok: true, provider, id, removedActive: boolean, promotedActiveId: string | null, catalogRefreshPending?: boolean, accountCleanupPending?: boolean }
+{ error: string, catalogRefreshPending?: boolean, accountCleanupPending?: boolean } // stderr, exit 1
 ```
 
 `catalogRefreshPending` 只出现在 Codex 删除结果中。值为 `true` 时，账号删除已经保存；人类可读
 输出会在 stderr 打印通用的 `ocx sync` 恢复指引，并仍以 0 退出。OAuth 账号和 API 密钥删除的
 响应结构不会增加此字段。
 
+`accountCleanupPending` 仅出现在 Codex 删除的 JSON 中。`false` 表示本地 credential cleanup 已完成；
+`true` 表示 account row 和 live ownership 已移除，但本地 credential cleanup 尚未完成。
+人类可读输出会显示固定的 `--cleanup-only` 指引并仍以 0 退出。JSON output 会保留该 flag，而不会把警告混入 stdout。
+如果成功的 Codex DELETE 之后 post-delete verification read 失败，命令会以 1 退出，但 JSON error 仍保留两个 Codex completion boolean，人类可读输出也仍会显示所需的 recovery guidance。
+
 ### `ocx account add-key <provider> [--label <label>] [--json]`
 
 为 API 密钥提供方添加并激活一个密钥。该密钥只会从非 TTY 的管道/重定向 stdin
diff --git a/docs-site/src/content/docs/zh-cn/reference/management-api.md b/docs-site/src/content/docs/zh-cn/reference/management-api.md
index 4e611356e..f4c3c20da 100644
--- a/docs-site/src/content/docs/zh-cn/reference/management-api.md
+++ b/docs-site/src/content/docs/zh-cn/reference/management-api.md
@@ -208,7 +208,7 @@ Authorization: Bearer <admin-token>
 
 | 方法和路径 | 用途 | 典型错误 |
 | --- | --- | --- |
-| `GET, POST, DELETE /api/codex-auth/accounts` | 列出/刷新，可选导入，或删除 Codex 账户。成功的 POST/DELETE 响应包含 `catalogRefreshPending`。 | 400 输入无效；手动导入可能被禁用 |
+| `GET, POST, DELETE /api/codex-auth/accounts` | 列出/刷新，可选导入，或删除 Codex 账户。成功的 POST/DELETE 响应包含 `catalogRefreshPending`；DELETE 还可能包含 `accountCleanupPending: true`。 | 400 输入无效；404 未知账户；409 cleanup-only 重试无法确认 account 不存在；500 `codex_account_delete_rollback_failed` 需要重启后再重试；手动导入可能被禁用 |
 | `PUT /api/codex-auth/accounts/alias` | 设置或清除账户别名 | 400 账户/别名无效 |
 | `PUT /api/codex-auth/accounts/pause` | 暂停或恢复一个账户 | 400 账户/状态无效；404 缺少账户 |
 | `PUT /api/codex-auth/accounts/pause-exhausted` | 暂停配额已耗尽的账户 | 变更锁失败会变成 503 |
@@ -238,6 +238,12 @@ Authorization: Bearer <admin-token>
 收到完成状态布尔值。删除账号时会保留 selector 绑定，因此该账号缺失期间精确路由会 fail closed，
 而以后添加相同账号 id 时会恢复同一 selector。
 
+如果 config 删除已经提交，但本地 credential cleanup 未能完成，DELETE 仍会使 live ownership
+失效、请求 catalog convergence，并返回包含 `accountCleanupPending: true` 的成功响应。重复同一个 DELETE
+是幂等的，即使 account row 已不存在也会重试 cleanup。恢复客户端会添加 `cleanupOnly=1`；如果无法确认
+persisted account 不存在，该形式会返回 409，避免 stale retry 删除重新添加的 account。dashboard 会保留这个
+安全重试操作且不暴露不透明的 account id，CLI 会显示固定的 `--cleanup-only` 指引且不暴露 storage 详情。
+
 ## 如何选择客户端
 
 对于日常管理，[Web 仪表板](/guides/web-dashboard/)提供了最安全的引导式流程。对于无头主机和自动化，请使用相应的 `ocx` 命令：它们调用的是同一个实时 API，并在代理不可达或操作失败时返回非零结果。直接 HTTP 最适合需要上述精确端点契约的集成。
diff --git a/gui/src/codex-account-mutation.ts b/gui/src/codex-account-mutation.ts
index 1c90557cd..896cca47e 100644
--- a/gui/src/codex-account-mutation.ts
+++ b/gui/src/codex-account-mutation.ts
@@ -1,6 +1,7 @@
 /** Privacy-safe completion state shared by account mutation UI flows. */
 export interface CodexAccountMutationCompletion {
   catalogRefreshPending: boolean;
+  accountCleanupPending?: true;
 }
 
 /** Project only the public completion flag from an account mutation response. */
@@ -9,9 +10,14 @@ export function codexAccountMutationCompletion(value: unknown): CodexAccountMuta
     return { catalogRefreshPending: false };
   }
   const descriptor = Object.getOwnPropertyDescriptor(value, "catalogRefreshPending");
+  const cleanupDescriptor = Object.getOwnPropertyDescriptor(value, "accountCleanupPending");
+  const accountCleanupPending = cleanupDescriptor !== undefined
+    && "value" in cleanupDescriptor
+    && cleanupDescriptor.value === true;
   return {
     catalogRefreshPending: descriptor !== undefined
       && "value" in descriptor
       && descriptor.value === true,
+    ...(accountCleanupPending ? { accountCleanupPending: true as const } : {}),
   };
 }
diff --git a/gui/src/components/CodexAccountPool.tsx b/gui/src/components/CodexAccountPool.tsx
index 0440f79e5..4a9963084 100644
--- a/gui/src/components/CodexAccountPool.tsx
+++ b/gui/src/components/CodexAccountPool.tsx
@@ -66,6 +66,8 @@ export default function CodexAccountPool({ apiBase, accountModeState = null, ban
   const [reauthId, setReauthId] = useState<string | null>(null);
   const [actionFeedback, setActionFeedback] = useState<string | null>(null);
   const [actionFeedbackTone, setActionFeedbackTone] = useState<NoticeTone | null>(null);
+  const [cleanupRetryId, setCleanupRetryId] = useState<string | null>(null);
+  const [cleanupRetrying, setCleanupRetrying] = useState(false);
   const feedbackTimerRef = useRef<ReturnType<typeof setTimeout> | null>(null);
   const [refreshingQuota, setRefreshingQuota] = useState(false);
   const [resetPopup, setResetPopup] = useState<CodexAccountEntry | null>(null);
@@ -75,10 +77,16 @@ export default function CodexAccountPool({ apiBase, accountModeState = null, ban
   const [creditDetailsLoading, setCreditDetailsLoading] = useState(false);
   const doctorCopy = useCopyFeedback<string>();
 
-  const showActionFeedback = useCallback((text: string, tone: NoticeTone = "ok") => {
+  const showActionFeedback = useCallback((
+    text: string,
+    tone: NoticeTone = "ok",
+    persist = false,
+  ) => {
     if (feedbackTimerRef.current) clearTimeout(feedbackTimerRef.current);
     setActionFeedback(text);
     setActionFeedbackTone(tone);
+    feedbackTimerRef.current = null;
+    if (persist) return;
     feedbackTimerRef.current = setTimeout(() => {
       setActionFeedback(null);
       setActionFeedbackTone(null);
@@ -209,11 +217,49 @@ export default function CodexAccountPool({ apiBase, accountModeState = null, ban
     const result = await controller.removeAccount(id);
     if (!result.ok) {
       showActionFeedback(t("codexAuth.removeFailed"), "err");
+    } else if (result.accountCleanupPending) {
+      setCleanupRetryId(id);
+      const cleanupWarning = t("codexAuth.removeCleanupPending");
+      showActionFeedback(result.catalogRefreshPending
+        ? `${cleanupWarning} ${t("codexAuth.catalogRefreshPending")}`
+        : cleanupWarning, "warn", true);
     } else if (result.catalogRefreshPending) {
       showActionFeedback(t("codexAuth.catalogRefreshPending"), "warn");
     }
   };
 
+  const retryCleanup = async () => {
+    const id = cleanupRetryId;
+    if (id === null || cleanupRetrying) return;
+    setCleanupRetrying(true);
+    try {
+      const result = await controller.retryAccountCleanup(id);
+      if (!result.ok) {
+        if (result.reason === "account-present") {
+          setCleanupRetryId(null);
+          showActionFeedback(t("codexAuth.removeCleanupRetryRefused"), "warn");
+        } else {
+          showActionFeedback(t("codexAuth.removeFailed"), "err", true);
+        }
+      } else if (result.accountCleanupPending) {
+        const cleanupWarning = t("codexAuth.removeCleanupPending");
+        showActionFeedback(result.catalogRefreshPending
+          ? `${cleanupWarning} ${t("codexAuth.catalogRefreshPending")}`
+          : cleanupWarning, "warn", true);
+      } else {
+        setCleanupRetryId(null);
+        showActionFeedback(
+          result.catalogRefreshPending
+            ? t("codexAuth.catalogRefreshPending")
+            : t("codexAuth.removeCleanupComplete"),
+          result.catalogRefreshPending ? "warn" : "ok",
+        );
+      }
+    } finally {
+      setCleanupRetrying(false);
+    }
+  };
+
   const refreshQuotas = async () => {
     setRefreshingQuota(true);
     try {
@@ -286,6 +332,11 @@ export default function CodexAccountPool({ apiBase, accountModeState = null, ban
         refreshingQuota={refreshingQuota}
         actionFeedback={actionFeedback}
         actionFeedbackTone={actionFeedbackTone}
+        actionFeedbackAction={cleanupRetryId === null ? null : {
+          label: t("codexAuth.removeCleanupRetry"),
+          disabled: cleanupRetrying,
+          onClick: () => { void retryCleanup(); },
+        }}
         pausingExhausted={pausingExhausted}
         pauseBusy={pauseBusy}
         onRefresh={() => { void refreshQuotas(); }}
diff --git a/gui/src/components/codex-account-pool-main-card.tsx b/gui/src/components/codex-account-pool-main-card.tsx
index 488984462..b12f4bc9e 100644
--- a/gui/src/components/codex-account-pool-main-card.tsx
+++ b/gui/src/components/codex-account-pool-main-card.tsx
@@ -181,6 +181,7 @@ export function CodexAccountPoolPageHead({
   pauseBusy,
   actionFeedback,
   actionFeedbackTone,
+  actionFeedbackAction,
   onRefresh,
   onPauseExhausted,
 }: {
@@ -191,6 +192,11 @@ export function CodexAccountPoolPageHead({
   pauseBusy?: boolean;
   actionFeedback?: string | null;
   actionFeedbackTone?: NoticeTone | null;
+  actionFeedbackAction?: {
+    label: string;
+    disabled: boolean;
+    onClick: () => void;
+  } | null;
   onRefresh: () => void;
   onPauseExhausted: () => void;
 }) {
@@ -208,6 +214,16 @@ export function CodexAccountPoolPageHead({
         >
           {actionFeedback ?? ""}
         </span>
+        {actionFeedbackAction && (
+          <button
+            type="button"
+            className="btn btn-sm btn-ghost codex-auth-action-btn"
+            onClick={actionFeedbackAction.onClick}
+            disabled={actionFeedbackAction.disabled}
+          >
+            {actionFeedbackAction.label}
+          </button>
+        )}
         <button
           type="button"
           className="btn btn-sm btn-ghost codex-auth-action-btn"
diff --git a/gui/src/hooks/useCodexAccountPool.ts b/gui/src/hooks/useCodexAccountPool.ts
index 84e5c2eb7..c5e2dcbcd 100644
--- a/gui/src/hooks/useCodexAccountPool.ts
+++ b/gui/src/hooks/useCodexAccountPool.ts
@@ -44,7 +44,7 @@ export type CodexAccountLoadState = "loading" | "ready" | "error";
 
 export type CodexAccountActionResult<T extends object = Record<never, never>> =
   | ({ ok: true } & T)
-  | { ok: false; reason: "busy" | "request" | "reload" };
+  | { ok: false; reason: "busy" | "request" | "reload" | "account-present" };
 
 /**
  * The auto-switch threshold arrives on the same /active response as the account list.
@@ -92,6 +92,7 @@ export interface CodexAccountPoolController {
   pauseExhaustedAccounts(): Promise<CodexAccountActionResult<{ pausedCount: number }>>;
   saveAlias(id: string, alias: string): Promise<CodexAccountActionResult>;
   removeAccount(id: string): Promise<CodexAccountActionResult<CodexAccountMutationCompletion>>;
+  retryAccountCleanup(id: string): Promise<CodexAccountActionResult<CodexAccountMutationCompletion>>;
   syncAfterAccountAdded(): Promise<CodexAccountActionResult>;
 
   pauseRefresh(): PauseToken;
@@ -489,13 +490,19 @@ export function useCodexAccountPool(apiBase: string, enabled = true): CodexAccou
     }
   }, [apiBase, load]);
 
-  const removeAccount = useCallback(async (id: string) => {
+  const deleteAccount = useCallback(async (id: string, cleanupOnly: boolean) => {
     try {
       const response = await fetch(
-        `${apiBase}/api/codex-auth/accounts?id=${encodeURIComponent(id)}`,
+        `${apiBase}/api/codex-auth/accounts?id=${encodeURIComponent(id)}${cleanupOnly ? "&cleanupOnly=1" : ""}`,
         { method: "DELETE" },
       );
-      if (!response.ok) return { ok: false, reason: "request" } as const;
+      if (!response.ok) {
+        if (cleanupOnly) await load();
+        return {
+          ok: false,
+          reason: cleanupOnly && response.status === 409 ? "account-present" : "request",
+        } as const;
+      }
       const completion = codexAccountMutationCompletion(
         await response.json().catch(() => ({})),
       );
@@ -505,6 +512,8 @@ export function useCodexAccountPool(apiBase: string, enabled = true): CodexAccou
       return { ok: false, reason: "request" } as const;
     }
   }, [apiBase, load]);
+  const removeAccount = useCallback((id: string) => deleteAccount(id, false), [deleteAccount]);
+  const retryAccountCleanup = useCallback((id: string) => deleteAccount(id, true), [deleteAccount]);
 
   const syncAfterAccountAdded = useCallback(async () => {
     const ok = await load();
@@ -538,6 +547,7 @@ export function useCodexAccountPool(apiBase: string, enabled = true): CodexAccou
     pauseExhaustedAccounts,
     saveAlias,
     removeAccount,
+    retryAccountCleanup,
     syncAfterAccountAdded,
     pauseRefresh,
     resumeRefresh,
diff --git a/gui/src/i18n/de.ts b/gui/src/i18n/de.ts
index 688bc2975..a2bc3a038 100644
--- a/gui/src/i18n/de.ts
+++ b/gui/src/i18n/de.ts
@@ -1017,6 +1017,10 @@ export const de: Record<TKey, string> = {
   "codexAuth.switchFailed": "Das Konto konnte nicht gewechselt werden. Die vorherige Auswahl bleibt erhalten.",
   "codexAuth.removeConfirm": "{id} entfernen?",
   "codexAuth.removeFailed": "Das Konto konnte nicht entfernt werden. Es wurde nichts geändert.",
+  "codexAuth.removeCleanupPending": "Das Konto wurde entfernt, aber die lokale Bereinigung der Anmeldedaten steht noch aus.",
+  "codexAuth.removeCleanupRetry": "Bereinigung erneut versuchen",
+  "codexAuth.removeCleanupComplete": "Kontobereinigung abgeschlossen.",
+  "codexAuth.removeCleanupRetryRefused": "Die Bereinigung wurde abgebrochen, weil die Abwesenheit des Kontos nicht bestätigt werden konnte.",
   "codexAuth.addTitle": "Codex-Konto hinzufügen",
   "codexAuth.addIdLabel": "Konto-ID (slug)",
   "codexAuth.addJsonLabel": "auth.json-Inhalt",
diff --git a/gui/src/i18n/en.ts b/gui/src/i18n/en.ts
index 5705189f2..5400a58e5 100644
--- a/gui/src/i18n/en.ts
+++ b/gui/src/i18n/en.ts
@@ -1475,6 +1475,10 @@ export const en = {
   "codexAuth.switchFailed": "The account could not be switched. Your previous selection is unchanged.",
   "codexAuth.removeConfirm": "Remove {id}?",
   "codexAuth.removeFailed": "The account could not be removed. Nothing was changed.",
+  "codexAuth.removeCleanupPending": "The account was removed, but local credential cleanup is still pending.",
+  "codexAuth.removeCleanupRetry": "Retry cleanup",
+  "codexAuth.removeCleanupComplete": "Account cleanup completed.",
+  "codexAuth.removeCleanupRetryRefused": "Cleanup retry stopped because the account could not be confirmed absent.",
   "codexAuth.addTitle": "Add Codex Account",
   "codexAuth.addIdLabel": "Account ID (slug)",
   "codexAuth.addIdPlaceholder": "codex-work, codex-alt, team...",
diff --git a/gui/src/i18n/ja.ts b/gui/src/i18n/ja.ts
index 3226c7c4b..d103dad91 100644
--- a/gui/src/i18n/ja.ts
+++ b/gui/src/i18n/ja.ts
@@ -1420,6 +1420,10 @@ export const ja: Record<TKey, string> = {
   "codexAuth.switchFailed": "アカウントを切り替えられませんでした。以前の選択はそのままです。",
   "codexAuth.removeConfirm": "{id} を削除しますか?",
   "codexAuth.removeFailed": "アカウントを削除できませんでした。何も変更されていません。",
+  "codexAuth.removeCleanupPending": "アカウントは削除されましたが、ローカル認証情報のクリーンアップが保留中です。",
+  "codexAuth.removeCleanupRetry": "クリーンアップを再試行",
+  "codexAuth.removeCleanupComplete": "アカウントのクリーンアップが完了しました。",
+  "codexAuth.removeCleanupRetryRefused": "アカウントが存在しないことを確認できなかったため、クリーンアップの再試行を停止しました。",
   "codexAuth.addTitle": "Codex アカウントを追加",
   "codexAuth.addIdLabel": "アカウント ID (スラッグ)",
   "codexAuth.addIdPlaceholder": "codex-work、codex-alt、team...",
diff --git a/gui/src/i18n/ko.ts b/gui/src/i18n/ko.ts
index c63a8391a..20e613d19 100644
--- a/gui/src/i18n/ko.ts
+++ b/gui/src/i18n/ko.ts
@@ -1041,6 +1041,10 @@ export const ko: Record<TKey, string> = {
   "codexAuth.switchFailed": "계정을 전환하지 못했습니다. 이전 선택은 그대로 유지됩니다.",
   "codexAuth.removeConfirm": "{id}을(를) 삭제하시겠습니까?",
   "codexAuth.removeFailed": "계정을 제거하지 못했습니다. 변경된 내용은 없습니다.",
+  "codexAuth.removeCleanupPending": "계정은 제거되었지만 로컬 자격 증명 정리가 아직 보류 중입니다.",
+  "codexAuth.removeCleanupRetry": "정리 다시 시도",
+  "codexAuth.removeCleanupComplete": "계정 정리가 완료되었습니다.",
+  "codexAuth.removeCleanupRetryRefused": "계정이 없음을 확인할 수 없어 정리 재시도를 중단했습니다.",
   "codexAuth.addTitle": "Codex 계정 추가",
   "codexAuth.addIdLabel": "계정 ID (슬러그)",
   "codexAuth.addJsonLabel": "auth.json 내용",
diff --git a/gui/src/i18n/ru.ts b/gui/src/i18n/ru.ts
index 07434e996..14d888967 100644
--- a/gui/src/i18n/ru.ts
+++ b/gui/src/i18n/ru.ts
@@ -1462,6 +1462,10 @@ export const ru: Record<TKey, string> = {
   "codexAuth.switchFailed": "Не удалось переключить аккаунт. Ваш предыдущий выбор не изменён.",
   "codexAuth.removeConfirm": "Удалить {id}?",
   "codexAuth.removeFailed": "Не удалось удалить аккаунт. Ничего не изменено.",
+  "codexAuth.removeCleanupPending": "Аккаунт удалён, но локальная очистка учётных данных ещё не завершена.",
+  "codexAuth.removeCleanupRetry": "Повторить очистку",
+  "codexAuth.removeCleanupComplete": "Очистка аккаунта завершена.",
+  "codexAuth.removeCleanupRetryRefused": "Повторная очистка остановлена: отсутствие аккаунта не удалось подтвердить.",
   "codexAuth.addTitle": "Добавить аккаунт Codex",
   "codexAuth.addIdLabel": "ID аккаунта (slug)",
   "codexAuth.addIdPlaceholder": "codex-work, codex-alt, team...",
diff --git a/gui/src/i18n/zh.ts b/gui/src/i18n/zh.ts
index 474ebe423..f7714fc24 100644
--- a/gui/src/i18n/zh.ts
+++ b/gui/src/i18n/zh.ts
@@ -1034,6 +1034,10 @@ export const zh: Record<TKey, string> = {
   "codexAuth.switchFailed": "无法切换账户。之前的选择保持不变。",
   "codexAuth.removeConfirm": "删除 {id}？",
   "codexAuth.removeFailed": "无法移除账户。未进行任何更改。",
+  "codexAuth.removeCleanupPending": "账户已移除，但本地凭据清理仍待完成。",
+  "codexAuth.removeCleanupRetry": "重试清理",
+  "codexAuth.removeCleanupComplete": "账户清理已完成。",
+  "codexAuth.removeCleanupRetryRefused": "无法确认账户已不存在，因此已停止重试清理。",
   "codexAuth.addTitle": "添加 Codex 账号",
   "codexAuth.addIdLabel": "账号 ID（标识符）",
   "codexAuth.addJsonLabel": "auth.json 内容",
diff --git a/gui/tests/codex-account-pool-behaviour.test.tsx b/gui/tests/codex-account-pool-behaviour.test.tsx
index 2f41d4562..baa7459c5 100644
--- a/gui/tests/codex-account-pool-behaviour.test.tsx
+++ b/gui/tests/codex-account-pool-behaviour.test.tsx
@@ -36,6 +36,7 @@ let activePinnedAccountId: string | null = null;
 let omitPinnedAccountId = false;
 let activeGetId: string | null = null;
 let deleteCatalogRefreshPending = false;
+let deleteAccountCleanupPending = false;
 
 beforeEach(() => {
   previous = Object.fromEntries(globals.map((k) => [k, Reflect.get(globalThis, k)])) as typeof previous;
@@ -64,6 +65,7 @@ beforeEach(() => {
   omitPinnedAccountId = false;
   activeGetId = null;
   deleteCatalogRefreshPending = false;
+  deleteAccountCleanupPending = false;
   accounts = [{ id: "a1", email: "account-one", isMain: true, paused: false, priority: 0, hasCredential: true, quota: null }];
   Object.defineProperty(globalThis, "fetch", {
     configurable: true,
@@ -124,6 +126,7 @@ beforeEach(() => {
           json: async () => ({
             ok: true,
             catalogRefreshPending: deleteCatalogRefreshPending,
+            accountCleanupPending: deleteAccountCleanupPending,
             privateDetail: "private-delete-detail",
           }),
         } as unknown as Response;
@@ -229,6 +232,33 @@ test("account removal returns only the public catalog completion flag", async ()
   expect(calls).toContain("DELETE codex-auth/accounts?id=a1");
 });
 
+test("account removal carries the public cleanup-pending completion flag", async () => {
+  deleteAccountCleanupPending = true;
+  const seen = await mountController();
+
+  await act(async () => {
+    expect(await seen.current!.removeAccount("a1")).toEqual({
+      ok: true,
+      catalogRefreshPending: false,
+      accountCleanupPending: true,
+    });
+  });
+  expect(calls).toContain("DELETE codex-auth/accounts?id=a1");
+});
+
+test("account cleanup retry uses the cleanup-only deletion contract", async () => {
+  deleteAccountCleanupPending = false;
+  const seen = await mountController();
+
+  await act(async () => {
+    expect(await seen.current!.retryAccountCleanup("a1")).toEqual({
+      ok: true,
+      catalogRefreshPending: false,
+    });
+  });
+  expect(calls).toContain("DELETE codex-auth/accounts?id=a1&cleanupOnly=1");
+});
+
 test("pausing an account writes the persisted endpoint and updates shared state", async () => {
   const seen = await mountController();
 
diff --git a/gui/tests/codex-account-pool-pinned-badge.test.tsx b/gui/tests/codex-account-pool-pinned-badge.test.tsx
index f31d5e419..89d062365 100644
--- a/gui/tests/codex-account-pool-pinned-badge.test.tsx
+++ b/gui/tests/codex-account-pool-pinned-badge.test.tsx
@@ -62,6 +62,7 @@ function makeController(overrides: Partial<CodexAccountPoolController> = {}): Co
     pauseExhaustedAccounts: async () => ({ ok: true, pausedCount: 0 }),
     saveAlias: async () => ({ ok: true }),
     removeAccount: async () => ({ ok: true }),
+    retryAccountCleanup: async () => ({ ok: true }),
     syncAfterAccountAdded: async () => ({ ok: true }),
     pauseRefresh: () => ({ __brand: "codex-pool-pause" }) as never,
     resumeRefresh: () => {},
diff --git a/gui/tests/codex-account-pool-toast-tone.test.tsx b/gui/tests/codex-account-pool-toast-tone.test.tsx
index a8e070bfc..baf498bca 100644
--- a/gui/tests/codex-account-pool-toast-tone.test.tsx
+++ b/gui/tests/codex-account-pool-toast-tone.test.tsx
@@ -50,6 +50,7 @@ function makeController(overrides: Partial<CodexAccountPoolController> = {}): Co
     pauseExhaustedAccounts: async () => ({ ok: true, pausedCount: 0 }),
     saveAlias: async () => ({ ok: true }),
     removeAccount: async () => ({ ok: false, reason: "request" }),
+    retryAccountCleanup: async () => ({ ok: false, reason: "request" }),
     syncAfterAccountAdded: async () => ({ ok: true }),
     pauseRefresh: () => ({ __brand: "codex-pool-pause" }) as never,
     resumeRefresh: () => {},
@@ -191,6 +192,85 @@ test("a saved removal with pending catalog refresh renders a warning tone", asyn
   expect(host.querySelector(".codex-auth-page-head__feedback.is-err")).toBeNull();
 });
 
+test("a saved removal with pending local cleanup renders retry guidance", async () => {
+  const removed: string[] = [];
+  await mountPool(makeController({
+    removeAccount: async (id) => {
+      removed.push(id);
+      return { ok: true, catalogRefreshPending: false, accountCleanupPending: true };
+    },
+    retryAccountCleanup: async (id) => {
+      removed.push(id);
+      return { ok: true, catalogRefreshPending: false };
+    },
+  }));
+
+  const removeButton = [...host.querySelectorAll("button")].find(button =>
+    (button.getAttribute("aria-label") ?? "").includes("pool@example.test")
+    && (button.getAttribute("aria-label") ?? "").toLowerCase().includes("remove"),
+  );
+  expect(removeButton).toBeTruthy();
+  await act(async () => {
+    removeButton!.dispatchEvent(new win.MouseEvent("click", { bubbles: true }));
+    await new Promise(resolve => setTimeout(resolve, 20));
+  });
+
+  const warning = host.querySelector(".codex-auth-page-head__feedback.is-warn");
+  expect(warning?.textContent).toContain("local credential cleanup is still pending");
+  expect(warning?.textContent).not.toContain("pool-1");
+  const retryButton = [...host.querySelectorAll("button")]
+    .find(button => button.textContent?.includes("Retry cleanup"));
+  expect(retryButton).toBeTruthy();
+
+  await act(async () => {
+    retryButton!.dispatchEvent(new win.MouseEvent("click", { bubbles: true }));
+    await new Promise(resolve => setTimeout(resolve, 20));
+  });
+
+  expect(removed).toEqual(["pool-1", "pool-1"]);
+  expect(host.querySelector(".codex-auth-page-head__feedback.is-ok")?.textContent)
+    .toContain("Account cleanup completed");
+  expect([...host.querySelectorAll("button")]
+    .some(button => button.textContent?.includes("Retry cleanup"))).toBe(false);
+  expect(host.querySelector(".codex-auth-page-head__feedback.is-err")).toBeNull();
+});
+
+test("a cleanup retry cannot remove an account that is present again", async () => {
+  const calls: string[] = [];
+  await mountPool(makeController({
+    removeAccount: async (id) => {
+      calls.push(`remove:${id}`);
+      return { ok: true, catalogRefreshPending: false, accountCleanupPending: true };
+    },
+    retryAccountCleanup: async (id) => {
+      calls.push(`cleanup:${id}`);
+      return { ok: false, reason: "account-present" };
+    },
+  }));
+
+  const removeButton = [...host.querySelectorAll("button")].find(button =>
+    (button.getAttribute("aria-label") ?? "").includes("pool@example.test")
+    && (button.getAttribute("aria-label") ?? "").toLowerCase().includes("remove"),
+  );
+  await act(async () => {
+    removeButton!.dispatchEvent(new win.MouseEvent("click", { bubbles: true }));
+    await new Promise(resolve => setTimeout(resolve, 20));
+  });
+  const retryButton = [...host.querySelectorAll("button")]
+    .find(button => button.textContent?.includes("Retry cleanup"));
+  await act(async () => {
+    retryButton!.dispatchEvent(new win.MouseEvent("click", { bubbles: true }));
+    await new Promise(resolve => setTimeout(resolve, 20));
+  });
+
+  expect(calls).toEqual(["remove:pool-1", "cleanup:pool-1"]);
+  expect(host.querySelector(".codex-auth-page-head__feedback.is-warn")?.textContent)
+    .toContain("account could not be confirmed absent");
+  expect(host.querySelector(".codex-auth-page-head__feedback")?.textContent).not.toContain("pool-1");
+  expect([...host.querySelectorAll("button")]
+    .some(button => button.textContent?.includes("Retry cleanup"))).toBe(false);
+});
+
 test("a busy selection order write shows no toast at all", async () => {
   await mountPool(makeController({
     setAccountPriority: async () => ({ ok: false, reason: "busy" }),
diff --git a/src/cli/account-catalog-refresh.ts b/src/cli/account-catalog-refresh.ts
index 0f31d309e..512789c1f 100644
--- a/src/cli/account-catalog-refresh.ts
+++ b/src/cli/account-catalog-refresh.ts
@@ -1,5 +1,7 @@
 export const CODEX_CATALOG_REFRESH_PENDING_WARNING =
   "Warning: the account change was saved, but the Codex model catalog refresh is pending. Run 'ocx sync' to retry.";
+export const CODEX_ACCOUNT_CLEANUP_PENDING_WARNING =
+  "Warning: the account was removed, but local credential cleanup is pending. Re-run with '--cleanup-only' to retry without deleting a re-added account.";
 
 /** Read only the public completion flag from an account mutation response. */
 export function codexCatalogRefreshPending(value: unknown): boolean {
@@ -8,7 +10,19 @@ export function codexCatalogRefreshPending(value: unknown): boolean {
   return descriptor !== undefined && "value" in descriptor && descriptor.value === true;
 }
 
+/** Read only the public cleanup-completion flag from an account removal response. */
+export function codexAccountCleanupPending(value: unknown): boolean {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+  const descriptor = Object.getOwnPropertyDescriptor(value, "accountCleanupPending");
+  return descriptor !== undefined && "value" in descriptor && descriptor.value === true;
+}
+
 /** Print fixed recovery guidance without reflecting server or account details. */
 export function warnIfCodexCatalogRefreshPending(value: unknown): void {
   if (codexCatalogRefreshPending(value)) console.error(CODEX_CATALOG_REFRESH_PENDING_WARNING);
 }
+
+/** Print fixed cleanup guidance without reflecting server or account details. */
+export function warnIfCodexAccountCleanupPending(value: unknown): void {
+  if (codexAccountCleanupPending(value)) console.error(CODEX_ACCOUNT_CLEANUP_PENDING_WARNING);
+}
diff --git a/src/cli/account-extended.ts b/src/cli/account-extended.ts
index afb04e359..b21f0a1a2 100644
--- a/src/cli/account-extended.ts
+++ b/src/cli/account-extended.ts
@@ -18,7 +18,9 @@ import {
   type ProviderQuotaDto, type ProviderQuotaReportDto,
 } from "./account-api";
 import {
+  codexAccountCleanupPending,
   codexCatalogRefreshPending,
+  warnIfCodexAccountCleanupPending,
   warnIfCodexCatalogRefreshPending,
 } from "./account-catalog-refresh";
 
@@ -29,7 +31,7 @@ const EXTENDED_USAGE = `Usage:
   ocx account auto-switch <provider> <on|off|status|threshold <0-100>> [--json]
   ocx account alias <provider> <id|main> <display-name|-> [--json]
   ocx account priority <provider> <id|main> [<-100..100|first|earlier|normal|later|last|reset>] [--json]
-  ocx account remove <provider> <id|main> --yes [--json]
+  ocx account remove <provider> <id|main> --yes [--cleanup-only] [--json]
   ocx account clear-cooldown <provider> <id|main> [--json]
   ocx account add-key <provider> [--label <label>] [--json]`;
 const PIPE_GUIDANCE = `Pipe the API key on stdin, for example:
@@ -207,16 +209,27 @@ export async function cmdAutoSwitch(args: string[], deps: AccountDeps): Promise<
   return 0;
 }
 
-function deletePath(type: "codex" | "oauth" | "api-key", name: string, id: string): string {
-  if (type === "codex") return `/api/codex-auth/accounts?id=${encodeURIComponent(id)}`;
+function deletePath(
+  type: "codex" | "oauth" | "api-key",
+  name: string,
+  id: string,
+  cleanupOnly = false,
+): string {
+  if (type === "codex") {
+    return `/api/codex-auth/accounts?id=${encodeURIComponent(id)}${cleanupOnly ? "&cleanupOnly=1" : ""}`;
+  }
   if (type === "oauth") return `/api/oauth/accounts?provider=${encodeURIComponent(name)}&id=${encodeURIComponent(id)}`;
   return `/api/providers/keys?name=${encodeURIComponent(name)}&id=${encodeURIComponent(id)}`;
 }
 
 export async function cmdRemove(args: string[], deps: AccountDeps): Promise<number> {
   const wantsJson = flag(args, "--json");
-  const fail = (message: string): number => {
-    if (wantsJson) console.error(JSON.stringify({ error: message }));
+  const cleanupOnly = flag(args, "--cleanup-only");
+  const fail = (
+    message: string,
+    codexStatus?: { catalogRefreshPending: boolean; accountCleanupPending: boolean },
+  ): number => {
+    if (wantsJson) console.error(JSON.stringify({ error: message, ...codexStatus }));
     else console.error(`Error: ${message}`);
     return 1;
   };
@@ -225,13 +238,16 @@ export async function cmdRemove(args: string[], deps: AccountDeps): Promise<numb
   const requestedId = args.shift();
   if (!name || !requestedId || args.length) return wantsJson ? fail("provider and account id are required") : usage();
   if (!confirmed) {
-    const message = `Confirmation required. Re-run: ocx account remove ${name} ${requestedId} --yes`;
+    const message = `Confirmation required. Re-run: ocx account remove ${name} ${requestedId} --yes${cleanupOnly ? " --cleanup-only" : ""}`;
     return wantsJson ? fail(message) : usage(message);
   }
   const classified = configAndType(deps, name);
   if ("error" in classified) return wantsJson ? fail(classified.error) : usage(`Error: ${classified.error}`);
+  if (cleanupOnly && classified.type !== "codex") return wantsJson
+    ? fail("--cleanup-only applies only to Codex accounts")
+    : usage("Error: --cleanup-only applies only to Codex accounts");
   const id = classified.type === "codex" && requestedId === "main" ? MAIN_ID : requestedId;
-  if (classified.type === "codex" && id === MAIN_ID) return wantsJson
+  if (classified.type === "codex" && id === MAIN_ID && !cleanupOnly) return wantsJson
     ? fail("the main Codex App login cannot be removed")
     : usage("Error: the main Codex App login cannot be removed");
   const baseUrl = await resolveBaseUrl(deps);
@@ -239,18 +255,32 @@ export async function cmdRemove(args: string[], deps: AccountDeps): Promise<numb
   const before = await fetchRows(deps, baseUrl, name, classified.type);
   if (before.networkDown) return fail("Proxy not reachable. Start it with 'ocx start' or 'ocx ensure'.");
   if (before.errorJson) return fail(errorText(before.errorJson, `failed to verify ${name} before removal`));
-  if (!before.rows.some(row => row.id === id)) return wantsJson
+  if (!before.rows.some(row => row.id === id) && classified.type !== "codex") return wantsJson
     ? fail(`account or key "${requestedId}" was not found`)
     : usage(`Error: account or key "${requestedId}" was not found`);
-  const response = await apiJson(deps, baseUrl, "DELETE", deletePath(classified.type, name, id));
+  const response = await apiJson(
+    deps,
+    baseUrl,
+    "DELETE",
+    deletePath(classified.type, name, id, cleanupOnly),
+  );
   if (response.status === 0) return fail("Proxy not reachable. Start it with 'ocx start' or 'ocx ensure'.");
   if (response.status !== 200) return fail(errorText(response.json, `failed to remove ${requestedId}`));
   const catalogRefreshPending = classified.type === "codex"
     && codexCatalogRefreshPending(response.json);
+  const accountCleanupPending = classified.type === "codex"
+    && codexAccountCleanupPending(response.json);
   const after = await fetchRows(deps, baseUrl, name, classified.type);
   if (after.networkDown || after.errorJson) {
     const detail = after.networkDown ? "proxy not reachable" : typeof after.errorJson?.error === "string" ? after.errorJson.error : "unknown error";
-    return fail(`post-delete verification failed; delete may have succeeded: ${detail}`);
+    const message = `post-delete verification failed; delete may have succeeded: ${detail}`;
+    if (wantsJson) return fail(message, classified.type === "codex"
+      ? { catalogRefreshPending, accountCleanupPending }
+      : undefined);
+    const code = fail(message);
+    if (catalogRefreshPending) warnIfCodexCatalogRefreshPending(response.json);
+    if (accountCleanupPending) warnIfCodexAccountCleanupPending(response.json);
+    return code;
   }
   const removedActive = before.activeId === id;
   const result = {
@@ -259,14 +289,18 @@ export async function cmdRemove(args: string[], deps: AccountDeps): Promise<numb
     id,
     removedActive,
     promotedActiveId: after.activeId,
-    ...(classified.type === "codex" ? { catalogRefreshPending } : {}),
+    ...(classified.type === "codex" ? { catalogRefreshPending, accountCleanupPending } : {}),
   };
   if (wantsJson) console.log(JSON.stringify(result, null, 2));
   else if (classified.type === "codex" && removedActive && after.activeId === null) console.log(`openai: ${AUTO_NOTE}`);
   else if (classified.type === "oauth") console.log(after.rows.length ? `${name}: active account is now ${after.activeId}` : `${name}: no accounts remaining`);
   else if (classified.type === "api-key") console.log(after.rows.length ? `${name}: active key is now ${after.activeId}` : `${name}: no keys remaining`);
+  else if (cleanupOnly) console.log(accountCleanupPending
+    ? `${name}: account cleanup is still pending`
+    : `${name}: account cleanup completed`);
   else console.log(`${name}: removed account ${requestedId}`);
   if (!wantsJson && catalogRefreshPending) warnIfCodexCatalogRefreshPending(response.json);
+  if (!wantsJson && accountCleanupPending) warnIfCodexAccountCleanupPending(response.json);
   return 0;
 }
 
diff --git a/src/cli/account.ts b/src/cli/account.ts
index da8cc8099..159e41ea2 100644
--- a/src/cli/account.ts
+++ b/src/cli/account.ts
@@ -23,7 +23,7 @@ const ACCOUNT_USAGE = `Usage:
   ocx account auto-switch <provider> <on|off|status|threshold <0-100>> [--json]
   ocx account alias <provider> <account-or-key-id> <display-name|-> [--json]
   ocx account priority <provider> <account-id|main> [<-100..100|first|earlier|normal|later|last|reset>] [--json]
-  ocx account remove <provider> <account-or-key-id|main> --yes [--json]
+  ocx account remove <provider> <account-or-key-id|main> --yes [--cleanup-only] [--json]
   ocx account clear-cooldown <provider> <account-id|main> [--json]
   ocx account add-key <provider> [--label <label>] [--json]
   ocx account login <provider> [--id <account-id>] [--reauth] [--code -] [--no-wait] [--json]
diff --git a/src/cli/help.ts b/src/cli/help.ts
index 4737f9515..7917122d5 100644
--- a/src/cli/help.ts
+++ b/src/cli/help.ts
@@ -119,7 +119,7 @@ const helpEntries: Record<string, HelpEntry> = {
       "refresh <provider>  Force-refresh Codex or provider quota reports.",
       "auto-switch <provider> <on|off|status|threshold N>  Control the Codex pool threshold.",
       "priority <provider> <id|main> [first|earlier|normal|later|last|-100..100|reset]  Selection order; omit the value to read it.",
-      "remove <provider> <id> --yes  Remove a stored account or key after an existence check.",
+      "remove <provider> <id|main> --yes [--cleanup-only]  OAuth/API-key ids are checked first; Codex can retry orphan credential cleanup.",
       "add-key <provider> [--label <label>]  Add a key read only from piped stdin.",
       "login/reauth/code/cancel  Run browser or manual-code auth from a headless shell.",
       "reset-credits <id|main> [--consume --yes]  Inspect or consume Codex reset credits.",
diff --git a/src/codex/account-lifecycle.ts b/src/codex/account-lifecycle.ts
index b9757a988..78767f0ee 100644
--- a/src/codex/account-lifecycle.ts
+++ b/src/codex/account-lifecycle.ts
@@ -1,11 +1,11 @@
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync, readFileSync, unlinkSync } from "node:fs";
 import {
   atomicWriteFile,
   getConfigPath,
   saveConfigPreservingClaudeCode,
   withConfigMutationLockSync,
 } from "../config";
-import { removeCodexAccountCredential } from "./account-store";
+import { getCodexAccountCredential, removeCodexAccountCredential } from "./account-store";
 import { clearAccountNeedsReauth } from "./account-runtime-state";
 import { getMainChatgptAccountId } from "./auth-collision";
 import { MAIN_CODEX_ACCOUNT_ID, setMainAccountPlan } from "./main-account";
@@ -21,12 +21,19 @@ import type { OcxConfig } from "../types";
 let observedMainChatgptAccountId: string | undefined;
 
 export class CodexAccountDeleteCleanupError extends Error {
-  constructor() {
+  constructor(readonly pickerVisibilityChanged: boolean) {
     super("Account deletion was saved, but local credential cleanup did not complete. Retry removal.");
     this.name = "CodexAccountDeleteCleanupError";
   }
 }
 
+export class CodexAccountCleanupRetryConflictError extends Error {
+  constructor() {
+    super("Account cleanup retry refused because account absence could not be confirmed.");
+    this.name = "CodexAccountCleanupRetryConflictError";
+  }
+}
+
 export class CodexAccountDeleteRollbackError extends Error {
   constructor() {
     super("Account deletion failed and the previous config could not be restored. Restart before retrying.");
@@ -97,7 +104,15 @@ function restoreRuntimeConfig(target: OcxConfig, snapshot: OcxConfig): void {
   Object.assign(target, snapshot);
 }
 
-function restorePersistedConfig(configPath: string, previousBytes: string): void {
+function restorePersistedConfig(configPath: string, previousBytes: string | undefined): void {
+  if (previousBytes === undefined) {
+    try {
+      unlinkSync(configPath);
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error;
+    }
+    return;
+  }
   try {
     if (readFileSync(configPath, "utf8") === previousBytes) return;
   } catch (error) {
@@ -106,19 +121,65 @@ function restorePersistedConfig(configPath: string, previousBytes: string): void
   atomicWriteFile(configPath, previousBytes);
 }
 
+function persistedPoolAccountPresence(
+  persistedBytes: string | undefined,
+  accountId: string,
+): "present" | "absent" | "unknown" {
+  if (persistedBytes === undefined) return "absent";
+  try {
+    const parsed = JSON.parse(persistedBytes.replace(/^\uFEFF/, "")) as unknown;
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return "unknown";
+    const descriptor = Object.getOwnPropertyDescriptor(parsed, "codexAccounts");
+    if (descriptor === undefined || !("value" in descriptor) || descriptor.value === undefined) {
+      return "absent";
+    }
+    if (!Array.isArray(descriptor.value)) return "unknown";
+    for (const account of descriptor.value) {
+      if (account === null || typeof account !== "object" || Array.isArray(account)) return "unknown";
+      const idDescriptor = Object.getOwnPropertyDescriptor(account, "id");
+      const mainDescriptor = Object.getOwnPropertyDescriptor(account, "isMain");
+      if (idDescriptor === undefined || !("value" in idDescriptor)
+        || typeof idDescriptor.value !== "string"
+        || mainDescriptor === undefined || !("value" in mainDescriptor)
+        || typeof mainDescriptor.value !== "boolean") {
+        return "unknown";
+      }
+      if (idDescriptor.value === accountId && mainDescriptor.value === false) return "present";
+    }
+    return "absent";
+  } catch {
+    return "unknown";
+  }
+}
+
 /**
  * Delete a stored account while retaining its selector binding.
  *
  * When the runtime config is backed by an existing config.json, commit the config deletion before
  * credentials or runtime state are destroyed. Transient callers intentionally skip durable config
- * persistence because they have no durable account row to protect. The whole sequence shares the
- * config mutation coordinator so a cooperating writer cannot re-add a persisted account between
- * the durable config commit and credential cleanup.
+ * persistence unless their API boundary sets `persistMissingConfig`; that keeps first-file creation
+ * inside the same mutation transaction. The whole sequence shares the config mutation coordinator
+ * so a cooperating writer cannot re-add a persisted account between config commit and cleanup.
  *
  * Returns true when a picker-visible row disappeared and the catalog must converge.
  */
-export function deleteCodexAccount(runtimeConfig: OcxConfig, accountId: string): boolean {
-  let cleanupFailed = false;
+export function deleteCodexAccount(
+  runtimeConfig: OcxConfig,
+  accountId: string,
+  options: { persistMissingConfig?: boolean; cleanupOnly?: boolean } = {},
+): boolean {
+  let credentialCleanupFailed = false;
+  const cleanupLocalState = () => {
+    try {
+      removeCodexAccountCredential(accountId);
+    } catch {
+      // The owning config/runtime mutation has already crossed its commit boundary (or cleanup-only
+      // proved the row absent). Preserve a retryable completion while invalidating live owners.
+      credentialCleanupFailed = true;
+    }
+    purgeCodexAccountRuntimeState(accountId);
+    invalidateCodexWebSocketsForAccount(accountId);
+  };
   const pickerVisibilityChanged = withConfigMutationLockSync(() => {
     const previousConfig = structuredClone(runtimeConfig);
     const configPath = getConfigPath();
@@ -126,6 +187,16 @@ export function deleteCodexAccount(runtimeConfig: OcxConfig, accountId: string):
     const previousPersistedConfig = hasPersistedConfig ? readFileSync(configPath, "utf8") : undefined;
     const hadStoredAccount = (runtimeConfig.codexAccounts ?? [])
       .some(account => !account.isMain && account.id === accountId);
+    const persistedPresence = persistedPoolAccountPresence(previousPersistedConfig, accountId);
+    if (options.cleanupOnly === true
+      && (hadStoredAccount || persistedPresence !== "absent")) {
+      throw new CodexAccountCleanupRetryConflictError();
+    }
+    if (options.cleanupOnly === true) {
+      if (getCodexAccountCredential(accountId) === null) return false;
+      cleanupLocalState();
+      return false;
+    }
     const hadVisiblePickerBinding = hadStoredAccount
       && codexAccountPickerEnabled(runtimeConfig)
       && codexAccountNamespaceEntries(runtimeConfig)
@@ -138,10 +209,10 @@ export function deleteCodexAccount(runtimeConfig: OcxConfig, accountId: string):
     clearCodexAccountPin(runtimeConfig, accountId);
     if (runtimeConfig.activeCodexAccountId === accountId) runtimeConfig.activeCodexAccountId = undefined;
 
-    if (previousPersistedConfig !== undefined) {
+    if (previousPersistedConfig !== undefined || options.persistMissingConfig === true) {
       try {
-        // Persist first for durable configs. Destructive cleanup below must never run for a
-        // deletion that failed to commit. Transient configs intentionally skip this write.
+        // Persist first for durable configs and persistence-owning API callers. Destructive
+        // cleanup below must never run for a deletion that failed to commit.
         saveConfigPreservingClaudeCode(runtimeConfig);
       } catch (error) {
         restoreRuntimeConfig(runtimeConfig, previousConfig);
@@ -154,19 +225,13 @@ export function deleteCodexAccount(runtimeConfig: OcxConfig, accountId: string):
       }
     }
 
-    try {
-      removeCodexAccountCredential(accountId);
-      purgeCodexAccountRuntimeState(accountId);
-      invalidateCodexWebSocketsForAccount(accountId);
-    } catch {
-      // Do not throw through the mutation coordinator after config.json committed: that would roll
-      // back only the SQLite generation transaction, not the already-atomic file replacement.
-      cleanupFailed = true;
-    }
+    cleanupLocalState();
 
     return hadVisiblePickerBinding;
   });
 
-  if (cleanupFailed) throw new CodexAccountDeleteCleanupError();
+  if (credentialCleanupFailed) {
+    throw new CodexAccountDeleteCleanupError(pickerVisibilityChanged);
+  }
   return pickerVisibilityChanged;
 }
diff --git a/src/codex/auth-api.ts b/src/codex/auth-api.ts
index 1d63a2d50..5b2974a62 100644
--- a/src/codex/auth-api.ts
+++ b/src/codex/auth-api.ts
@@ -19,7 +19,13 @@ import {
   CodexCredentialRefreshStaleError,
   TokenRefreshError,
 } from "./account-store";
-import { deleteCodexAccount, reconcileMainCodexAccountRuntimeState } from "./account-lifecycle";
+import {
+  CodexAccountCleanupRetryConflictError,
+  CodexAccountDeleteCleanupError,
+  CodexAccountDeleteRollbackError,
+  deleteCodexAccount,
+  reconcileMainCodexAccountRuntimeState,
+} from "./account-lifecycle";
 import {
   appendDefaultCodexAccountNamespace,
   codexAccountPickerEnabled,
@@ -1399,20 +1405,66 @@ export async function handleCodexAuthAPI(
   if (url.pathname === "/api/codex-auth/accounts" && req.method === "DELETE") {
     const id = url.searchParams.get("id");
     if (!id) return jsonResponse({ error: "Missing id" }, 400);
+    const cleanupOnlyValue = url.searchParams.get("cleanupOnly");
+    if (cleanupOnlyValue !== null && cleanupOnlyValue !== "1") {
+      return jsonResponse({ error: "cleanupOnly must be 1 when provided" }, 400);
+    }
+    const cleanupOnly = cleanupOnlyValue === "1";
     const runtimeConfig = getRuntimeConfig(config);
-    const isLegacyPoolAccount = CODEX_ACCOUNT_ID_RE.test(id)
-      && (runtimeConfig.codexAccounts ?? []).some(account => !account.isMain && account.id === id);
-    if (!isValidCodexAccountId(id) && !isLegacyPoolAccount) {
+    const hasStoredAccount = (runtimeConfig.codexAccounts ?? [])
+      .some(account => !account.isMain && account.id === id);
+    const hasLegacyIdSyntax = CODEX_ACCOUNT_ID_RE.test(id);
+    const storedCredential = hasLegacyIdSyntax
+      ? getCodexAccountCredential(id)
+      : null;
+    const isLegacyPoolAccount = hasLegacyIdSyntax
+      && (hasStoredAccount || storedCredential !== null);
+    if (!isValidCodexAccountId(id) && !(cleanupOnly ? hasLegacyIdSyntax : isLegacyPoolAccount)) {
       return jsonResponse({ error: "Invalid account id format" }, 400);
     }
-    const pickerVisibilityChanged = deleteCodexAccount(runtimeConfig, id);
-    saveRuntimeConfig(config, runtimeConfig);
+    if (!cleanupOnly && !hasStoredAccount && storedCredential === null) {
+      return jsonResponse({ error: "Account not found" }, 404);
+    }
+    let pickerVisibilityChanged: boolean;
+    let cleanupError: CodexAccountDeleteCleanupError | undefined;
+    try {
+      pickerVisibilityChanged = deleteCodexAccount(runtimeConfig, id, {
+        // A configured row owns first-file persistence. A credential-only legacy orphan has no
+        // config deletion to commit, so removing it must not materialize config.json.
+        persistMissingConfig: !cleanupOnly && hasStoredAccount,
+        cleanupOnly,
+      });
+    } catch (error) {
+      if (error instanceof CodexAccountCleanupRetryConflictError) {
+        return jsonResponse({
+          error: "Account absence could not be confirmed; cleanup retry was not applied",
+        }, 409);
+      }
+      if (error instanceof CodexAccountDeleteRollbackError) {
+        // The typed error contains fixed recovery guidance only. The underlying persistence and
+        // restore failures can carry paths or storage details and must not cross the API boundary.
+        return jsonResponse({
+          error: error.message,
+          code: "codex_account_delete_rollback_failed",
+        }, 500);
+      }
+      if (!(error instanceof CodexAccountDeleteCleanupError)) throw error;
+      pickerVisibilityChanged = error.pickerVisibilityChanged;
+      cleanupError = error;
+    }
     reconcileLiveStateStores();
     const catalogRefresh = await convergeAccountNamespaceCatalog(
       runtimeConfig,
       pickerVisibilityChanged,
       convergeCodexCatalog,
     );
+    if (cleanupError) {
+      return jsonResponse({
+        ok: true,
+        accountCleanupPending: true,
+        ...catalogRefresh,
+      });
+    }
     return jsonResponse({ ok: true, ...catalogRefresh });
   }
 
diff --git a/src/config.ts b/src/config.ts
index b662959bd..81a70e44c 100644
--- a/src/config.ts
+++ b/src/config.ts
@@ -2221,9 +2221,11 @@ let configMutationDatabase: Database | null = null;
 
 /**
  * Serialize synchronous config and Codex credential-generation commits across processes with an
- * OS-backed SQLite write transaction. `busy_timeout=0` is deliberate: runtime request paths must
- * fail immediately under contention rather than freeze the Bun event loop. Process exit releases
- * SQLite locks without stale-owner deletion or lease recovery races.
+ * OS-backed SQLite write transaction. In rollback-journal mode, `BEGIN EXCLUSIVE` acquires the
+ * commit-required reader exclusion before callbacks can mutate external files; in WAL mode readers
+ * cannot block commit. `busy_timeout=0` is deliberate: runtime request paths must fail immediately
+ * under contention rather than freeze the Bun event loop. Process exit releases SQLite locks
+ * without stale-owner deletion or lease recovery races.
  *
  * Reentrancy is limited to the current synchronous call stack; never return a Promise from `fn`.
  */
@@ -2242,7 +2244,7 @@ export function withConfigMutationLockSync<T>(fn: () => T): T {
   try {
     database = new Database(path, { create: true });
     try { chmodSync(path, 0o600); } catch { /* platform may ignore chmod */ }
-    database.exec("PRAGMA busy_timeout = 0; BEGIN IMMEDIATE");
+    database.exec("PRAGMA busy_timeout = 0; BEGIN EXCLUSIVE");
     transactionOpen = true;
     initializeConfigGeneration(database);
   } catch (cause) {
@@ -2302,7 +2304,7 @@ export function observeConfigGeneration(): ConfigGenerationObservation {
  * Read the generation from the transaction that is open RIGHT NOW.
  *
  * The observer cannot do this job. On the very first acquisition the
- * `BEGIN IMMEDIATE` that creates the table has not committed yet, so a separate
+ * transaction that creates the table has not committed yet, so a separate
  * read-only connection cannot read a generation from it — measured, not
  * assumed. A caller that compared a pre-lock observation against an observer
  * re-read would therefore refuse every first write as stale.
diff --git a/structure/05_gui-and-management-api.md b/structure/05_gui-and-management-api.md
index a8ad2a898..7f7c2cf5e 100644
--- a/structure/05_gui-and-management-api.md
+++ b/structure/05_gui-and-management-api.md
@@ -102,7 +102,7 @@ this document owns is which module holds which area and what invariant that area
 | Effort and fallback | `src/server/management/agent-settings-routes.ts` — `GET/PUT /api/effort-caps`, `/api/subagent-models`, `/api/subagent-model-fallback`. Caps clamp; they do not reject. |
 | Grok and Claude integrations | `src/server/management/agent-settings-routes.ts` — `GET /api/grok`, `PUT /api/grok/selection`, `POST /api/grok/apply`, `GET/PUT /api/claude-desktop`, `POST /api/claude-desktop/apply`, `GET /api/claude-desktop/status`, `GET/PUT /api/claude-code`. Apply writes an external app's profile, so its status probe must read the same resolved path it writes (see [`04_transports-and-sidecars.md`](04_transports-and-sidecars.md)). |
 | Combos | `src/server/management/combo-routes.ts` — `GET/PUT/DELETE /api/combos` own provider combination and failover definitions. |
-| Codex accounts | `src/codex/auth-api.ts` — `GET/POST/DELETE /api/codex-auth/accounts`, `PUT /api/codex-auth/accounts/alias`, `PUT /api/codex-auth/accounts/pause`, `PUT /api/codex-auth/accounts/pause-exhausted`, `POST /api/codex-auth/accounts/clear-cooldown`, `GET/PUT /api/codex-auth/active`, `PUT /api/codex-auth/auto-switch`, `PUT /api/codex-auth/pool-strategy`, `PUT /api/codex-auth/failover`, `GET /api/codex-auth/quota`, `GET /api/codex-auth/reset-credits` with `POST /api/codex-auth/reset-credits/consume`, and the login flow `POST /api/codex-auth/login`, `POST /api/codex-auth/login/code`, `POST /api/codex-auth/login/cancel`, `GET /api/codex-auth/login-status`. Account ids are opaque handles and are serialized so the GUI can address an account; emails are masked and tokens are never serialized. New-account config commits add UI-managed selector bindings in the same config save; deletion deliberately retains existing bindings for fail-closed exact routing and re-add stability. Account mutations request catalog convergence only after config durability and expose only the boolean `catalogRefreshPending` completion projection. |
+| Codex accounts | `src/codex/auth-api.ts` — `GET/POST/DELETE /api/codex-auth/accounts`, `PUT /api/codex-auth/accounts/alias`, `PUT /api/codex-auth/accounts/pause`, `PUT /api/codex-auth/accounts/pause-exhausted`, `POST /api/codex-auth/accounts/clear-cooldown`, `GET/PUT /api/codex-auth/active`, `PUT /api/codex-auth/auto-switch`, `PUT /api/codex-auth/pool-strategy`, `PUT /api/codex-auth/failover`, `GET /api/codex-auth/quota`, `GET /api/codex-auth/reset-credits` with `POST /api/codex-auth/reset-credits/consume`, and the login flow `POST /api/codex-auth/login`, `POST /api/codex-auth/login/code`, `POST /api/codex-auth/login/cancel`, `GET /api/codex-auth/login-status`. Account ids are opaque handles and are serialized so the GUI can address an account; emails are masked and tokens are never serialized. New-account config commits add UI-managed selector bindings in the same config save; deletion deliberately retains existing bindings for fail-closed exact routing and re-add stability. Account mutations request catalog convergence only after config durability and expose privacy-safe `catalogRefreshPending` and, for a committed deletion whose local credential cleanup needs an idempotent retry, `accountCleanupPending` completion flags. Cleanup-only retries require authoritative persisted absence so stale clients cannot delete a re-added account. If a failed config commit also cannot restore the prior bytes, DELETE returns fixed `codex_account_delete_rollback_failed` recovery guidance, performs no credential cleanup or convergence, and requires restart before retry. |
 | Sidebar | `src/server/management/sidebar-routes.ts` — `GET/POST /api/github/star` and `GET /api/update/badge`. Sidebar state is cosmetic; a failed fetch degrades silently. |
 | Logs | `src/server/management/logs-usage-routes.ts` — `GET /api/logs`, `GET /api/claude/inbound-debug`, and `GET /api/debug/injection-logs` join the debug streams described above. |
 
diff --git a/tests/cli-account.test.ts b/tests/cli-account.test.ts
index 951c27c52..c55e75929 100644
--- a/tests/cli-account.test.ts
+++ b/tests/cli-account.test.ts
@@ -58,6 +58,8 @@ let oauthActiveId: string | null = "acct_1";
 let oauthLoginStatus: Record<string, unknown> = { loggedIn: false };
 let codexLoginStatus: Record<string, unknown> = { status: "pending" };
 let codexDeleteCatalogRefreshPending = false;
+let codexDeleteCleanupFailuresRemaining = 0;
+let codexOrphanAccountIds = new Set<string>();
 let keyEntries: Array<Record<string, unknown>> = [];
 let keyActiveId: string | null = "key_1";
 let logs: string[] = [];
@@ -138,9 +140,32 @@ async function mockManagementApi(req: Request): Promise<Response> {
   if (req.method === "DELETE" && url.pathname === "/api/codex-auth/accounts") {
     if (deleteFailure) return json({ error: deleteFailure.error }, deleteFailure.status);
     const id = url.searchParams.get("id");
-    codexAccounts = codexAccounts.filter(account => account.id !== id);
-    if (activeCodexAccountId === id) activeCodexAccountId = null;
+    const cleanupOnly = url.searchParams.get("cleanupOnly") === "1";
+    const configured = codexAccounts.some(account => account.id === id && account.isMain !== true);
+    if (cleanupOnly && configured) {
+      return json({ error: "Account absence could not be confirmed; cleanup retry was not applied" }, 409);
+    }
+    if (!cleanupOnly && !configured && (id === null || !codexOrphanAccountIds.has(id))) {
+      return json({ error: "Account not found" }, 404);
+    }
+    if (!cleanupOnly) {
+      codexAccounts = codexAccounts.filter(account => account.id !== id);
+      if (activeCodexAccountId === id) activeCodexAccountId = null;
+    }
     lastDeletedType = "codex";
+    if (id !== null
+      && codexDeleteCleanupFailuresRemaining > 0
+      && (!cleanupOnly || codexOrphanAccountIds.has(id))) {
+      codexDeleteCleanupFailuresRemaining -= 1;
+      codexOrphanAccountIds.add(id);
+      return json({
+        ok: true,
+        accountCleanupPending: true,
+        catalogRefreshPending: codexDeleteCatalogRefreshPending,
+        internalError: "private-delete-detail",
+      });
+    }
+    if (id !== null) codexOrphanAccountIds.delete(id);
     return json({
       ok: true,
       catalogRefreshPending: codexDeleteCatalogRefreshPending,
@@ -417,6 +442,8 @@ beforeEach(() => {
   oauthLoginStatus = { loggedIn: false };
   codexLoginStatus = { status: "pending" };
   codexDeleteCatalogRefreshPending = false;
+  codexDeleteCleanupFailuresRemaining = 0;
+  codexOrphanAccountIds = new Set<string>();
   keyEntries = [{
     id: "key_1",
     label: "personal",
@@ -787,12 +814,12 @@ describe("ocx account CLI (issue #180 matrix)", () => {
     expect(calls).toHaveLength(0);
   });
 
-  test("23: remove pre-check rejects an unknown id without DELETE", async () => {
+  test("23: the server rejects an unknown Codex id after an idempotent DELETE", async () => {
     const result = await run(["remove", "openai", "nope", "--yes"]);
 
     expect(result.code).toBe(1);
-    expect(result.stderr).toContain('"nope" was not found');
-    expect(requests.some(request => request.method === "DELETE")).toBe(false);
+    expect(result.stderr).toContain("Account not found");
+    expect(requests.some(request => request.method === "DELETE")).toBe(true);
   });
 
   test("24: removing the pinned Codex account reports automatic selection", async () => {
@@ -816,39 +843,131 @@ describe("ocx account CLI (issue #180 matrix)", () => {
     expect(result.output).not.toContain("private-delete-detail");
   });
 
-  test("JSON Codex removal retains the pending flag without a human warning", async () => {
+  test("JSON Codex removal retains pending flags without a human warning", async () => {
     codexDeleteCatalogRefreshPending = true;
+    codexDeleteCleanupFailuresRemaining = 1;
     const result = await run(["remove", "openai", "chatgpt_1", "--yes", "--json"]);
 
     expect(result.code).toBe(0);
     expect(JSON.parse(result.stdout)).toEqual(expect.objectContaining({
       ok: true,
       catalogRefreshPending: true,
+      accountCleanupPending: true,
     }));
     expect(result.stdout).not.toContain("private-delete-detail");
     expect(result.stderr).toBe("");
   });
 
-  test("25: removing the active OAuth account reports the promoted account", async () => {
-    const result = await run(["remove", "anthropic", "acct_1", "--yes"]);
+  test("Codex cleanup-pending removal warns and cleanup-only completes the retry", async () => {
+    codexDeleteCleanupFailuresRemaining = 1;
+    codexDeleteCatalogRefreshPending = true;
+
+    const first = await run(["remove", "openai", "chatgpt_1", "--yes"]);
+    expect(first.code).toBe(0);
+    expect(first.stderr).toContain("local credential cleanup is pending");
+    expect(first.stderr).toContain("--cleanup-only");
+    expect(first.stderr).toContain("without deleting a re-added account");
+    expect(first.stderr).toContain("ocx sync");
+    expect(first.output).not.toContain("private-delete-detail");
+    expect(codexOrphanAccountIds.has("chatgpt_1")).toBe(true);
+
+    codexDeleteCatalogRefreshPending = false;
+    const retry = await run(["remove", "openai", "chatgpt_1", "--yes", "--cleanup-only"]);
+    expect(retry.code).toBe(0);
+    expect(retry.stdout).toContain("openai: account cleanup completed");
+    expect(retry.stderr).toBe("");
+    expect(codexOrphanAccountIds.has("chatgpt_1")).toBe(false);
+    expect(requests.some(request => request.method === "DELETE"
+      && request.search === "?id=chatgpt_1&cleanupOnly=1")).toBe(true);
+    expect(requests.filter(request =>
+      request.method === "DELETE" && request.path === "/api/codex-auth/accounts"
+    )).toHaveLength(2);
+  });
+
+  test("Codex cleanup-only retry never claims completion while cleanup remains pending", async () => {
+    codexDeleteCleanupFailuresRemaining = 2;
+
+    const first = await run(["remove", "openai", "chatgpt_1", "--yes"]);
+    expect(first.code).toBe(0);
+    expect(codexOrphanAccountIds.has("chatgpt_1")).toBe(true);
+
+    const retry = await run(["remove", "openai", "chatgpt_1", "--yes", "--cleanup-only"]);
+    expect(retry.code).toBe(0);
+    expect(retry.stdout).toContain("openai: account cleanup is still pending");
+    expect(retry.stdout).not.toContain("account cleanup completed");
+    expect(retry.stderr).toContain("--cleanup-only");
+    expect(codexOrphanAccountIds.has("chatgpt_1")).toBe(true);
+  });
+
+  test("Codex cleanup-only removal refuses a present account", async () => {
+    const before = structuredClone(codexAccounts);
+    const result = await run([
+      "remove", "openai", "chatgpt_1", "--yes", "--cleanup-only",
+    ]);
+
+    expect(result.code).toBe(1);
+    expect(result.stderr).toContain("cleanup retry was not applied");
+    expect(codexAccounts).toEqual(before);
+  });
+
+  test("Codex cleanup-only removal completes when no orphaned credential exists", async () => {
+    codexDeleteCleanupFailuresRemaining = 1;
+
+    const result = await run([
+      "remove", "openai", "missing", "--yes", "--cleanup-only",
+    ]);
 
     expect(result.code).toBe(0);
-    expect(result.stdout).toContain("active account is now acct_2");
+    expect(result.stdout).toBe("openai: account cleanup completed");
+    expect(result.stderr).toBe("");
+    expect(codexOrphanAccountIds.has("missing")).toBe(false);
+    expect(codexDeleteCleanupFailuresRemaining).toBe(1);
+    expect(requests.some(request => request.method === "DELETE"
+      && request.path === "/api/codex-auth/accounts"
+      && request.search === "?id=missing&cleanupOnly=1")).toBe(true);
   });
 
-  test("26: removing the last API key reports no keys remaining", async () => {
-    const result = await run(["remove", "openrouter", "key_1", "--yes"]);
+  test("Codex cleanup-only removal maps main to an orphaned __main__ credential", async () => {
+    codexOrphanAccountIds.add("__main__");
+
+    const result = await run([
+      "remove", "openai", "main", "--yes", "--cleanup-only",
+    ]);
 
     expect(result.code).toBe(0);
-    expect(result.stdout).toContain("no keys remaining");
+    expect(result.stdout).toContain("openai: account cleanup completed");
+    expect(result.stderr).toBe("");
+    expect(codexOrphanAccountIds.has("__main__")).toBe(false);
+    expect(requests.some(request => request.method === "DELETE"
+      && request.path === "/api/codex-auth/accounts"
+      && request.search === "?id=__main__&cleanupOnly=1")).toBe(true);
+    expect(codexAccounts.some(account => account.id === "__main__"
+      && account.isMain === true)).toBe(true);
   });
 
-  test("27: removing the main Codex login is refused without DELETE", async () => {
+  test("Codex removal refuses the main account without cleanup-only", async () => {
+    const before = structuredClone(codexAccounts);
     const result = await run(["remove", "openai", "main", "--yes"]);
 
     expect(result.code).toBe(1);
-    expect(result.stderr).toContain("main Codex App login cannot be removed");
+    expect(result.stdout).toBe("");
+    expect(result.stderr).toContain("the main Codex App login cannot be removed");
     expect(requests).toHaveLength(0);
+    expect(codexAccounts).toEqual(before);
+  });
+
+  test("25: removing the active OAuth account reports the promoted account", async () => {
+    const result = await run(["remove", "anthropic", "acct_1", "--yes"]);
+
+    expect(result.code).toBe(0);
+    expect(result.stdout).toContain("active account is now acct_2");
+  });
+
+  test("26: removing the last API key reports no keys remaining", async () => {
+    const result = await run(["remove", "openrouter", "key_1", "--yes"]);
+
+    expect(result.code).toBe(0);
+    expect(result.stdout).toContain("no keys remaining");
   });
 
   test("28: add-key reads a pipe, posts the key and never prints it", async () => {
@@ -898,6 +1017,37 @@ describe("ocx account CLI (issue #180 matrix)", () => {
     expect(verifyFailed.stderr).toContain("post-delete read failed");
   });
 
+  test("Codex post-delete verification failure retains human cleanup guidance", async () => {
+    codexDeleteCleanupFailuresRemaining = 1;
+    codexDeleteCatalogRefreshPending = true;
+    postDeleteReadFailure = { status: 500, error: "post-delete read failed" };
+
+    const result = await run(["remove", "openai", "chatgpt_1", "--yes"]);
+
+    expect(result.code).toBe(1);
+    expect(result.stderr).toContain("delete may have succeeded");
+    expect(result.stderr).toContain("--cleanup-only");
+    expect(result.stderr).toContain("ocx sync");
+    expect(result.output).not.toContain("private-delete-detail");
+  });
+
+  test("Codex JSON post-delete verification failure retains completion flags", async () => {
+    codexDeleteCleanupFailuresRemaining = 1;
+    codexDeleteCatalogRefreshPending = true;
+    postDeleteReadFailure = { status: 500, error: "post-delete read failed" };
+
+    const result = await run(["remove", "openai", "chatgpt_1", "--yes", "--json"]);
+
+    expect(result.code).toBe(1);
+    expect(result.stdout).toBe("");
+    expect(JSON.parse(result.stderr)).toEqual({
+      error: "post-delete verification failed; delete may have succeeded: post-delete read failed",
+      catalogRefreshPending: true,
+      accountCleanupPending: true,
+    });
+    expect(result.output).not.toContain("private-delete-detail");
+  });
+
   test("31: add-key surfaces POST failure and cleans stdin timeout listeners", async () => {
     const key = "test-key-1234567890abcdef";
     addKeyFailure = { status: 400, error: "key rejected" };
@@ -968,6 +1118,9 @@ describe("ocx account CLI (issue #180 matrix)", () => {
     for (const command of ["refresh", "auto-switch", "remove", "add-key"]) {
       expect(help).toContain(command);
     }
+    expect(help).toContain(
+      "remove <provider> <id|main> --yes [--cleanup-only]  OAuth/API-key ids are checked first; Codex can retry orphan credential cleanup.",
+    );
   });
 
   test("C-gate fold: add-key redacts a key containing JSON-escaped characters", async () => {
@@ -1052,8 +1205,15 @@ describe("ocx account CLI (issue #180 matrix)", () => {
       removedActive: true,
       promotedActiveId: null,
       catalogRefreshPending: false,
+      accountCleanupPending: false,
     });
 
+    const removedKey = await run(["remove", "openrouter", "key_1", "--yes", "--json"]);
+    const removedKeyJson = JSON.parse(removedKey.stdout) as Record<string, unknown>;
+    expect(removedKey.code).toBe(0);
+    expect(removedKeyJson).not.toHaveProperty("catalogRefreshPending");
+    expect(removedKeyJson).not.toHaveProperty("accountCleanupPending");
+
     deleteFailure = { status: 500, error: "json delete failed" };
     const failed = await run(["remove", "anthropic", "acct_1", "--yes", "--json"]);
     expect(failed.code).toBe(1);
diff --git a/tests/codex-account-delete-atomicity.test.ts b/tests/codex-account-delete-atomicity.test.ts
index 8f71e730f..6573124c5 100644
--- a/tests/codex-account-delete-atomicity.test.ts
+++ b/tests/codex-account-delete-atomicity.test.ts
@@ -1,4 +1,5 @@
 import { afterEach, beforeEach, describe, expect, spyOn, test } from "bun:test";
+import { Database } from "bun:sqlite";
 import { existsSync, mkdirSync, readFileSync, rmSync } from "node:fs";
 import { join } from "node:path";
 import * as accountStoreModule from "../src/codex/account-store";
@@ -7,6 +8,7 @@ import {
   saveCodexAccountCredential,
 } from "../src/codex/account-store";
 import {
+  CodexAccountCleanupRetryConflictError,
   CodexAccountDeleteCleanupError,
   deleteCodexAccount,
 } from "../src/codex/account-lifecycle";
@@ -18,7 +20,13 @@ import {
   getAccountQuota,
   updateAccountQuota,
 } from "../src/codex/quota";
-import { getConfigPath, loadConfig, saveConfig } from "../src/config";
+import {
+  ConfigMutationLockError,
+  getConfigPath,
+  loadConfig,
+  observeConfigGeneration,
+  saveConfig,
+} from "../src/config";
 import * as configModule from "../src/config";
 import type { OcxConfig } from "../src/types";
 
@@ -65,6 +73,71 @@ afterEach(() => {
 });
 
 describe("Codex account delete persistence ordering", () => {
+  test("a persistence-owning delete creates a missing config exactly once before cleanup", () => {
+    const config = loadConfig();
+    config.codexAccounts = [{
+      id: ACCOUNT_ID,
+      email: "delete-atomicity@example.test",
+      isMain: false,
+    }];
+    saveCodexAccountCredential(ACCOUNT_ID, {
+      accessToken: "delete-access",
+      refreshToken: "delete-refresh",
+      expiresAt: Date.now() + 60_000,
+      chatgptAccountId: "delete-chatgpt-id",
+    });
+    let saveCalls = 0;
+    const realSave = configModule.saveConfigPreservingClaudeCode;
+    const saveSpy = spyOn(configModule, "saveConfigPreservingClaudeCode")
+      .mockImplementation(candidate => {
+        saveCalls += 1;
+        realSave(candidate);
+      });
+
+    try {
+      expect(deleteCodexAccount(config, ACCOUNT_ID, { persistMissingConfig: true })).toBe(false);
+    } finally {
+      saveSpy.mockRestore();
+    }
+
+    expect(saveCalls).toBe(1);
+    expect(loadConfig().codexAccounts).toEqual([]);
+    expect(getCodexAccountCredential(ACCOUNT_ID)).toBeNull();
+  });
+
+  test("a post-write failure restores a previously missing config to absence", () => {
+    const config = loadConfig();
+    config.codexAccounts = [{
+      id: ACCOUNT_ID,
+      email: "delete-atomicity@example.test",
+      isMain: false,
+    }];
+    const before = structuredClone(config);
+    saveCodexAccountCredential(ACCOUNT_ID, {
+      accessToken: "delete-access",
+      refreshToken: "delete-refresh",
+      expiresAt: Date.now() + 60_000,
+      chatgptAccountId: "delete-chatgpt-id",
+    });
+    const realSave = configModule.saveConfigPreservingClaudeCode;
+    const saveSpy = spyOn(configModule, "saveConfigPreservingClaudeCode")
+      .mockImplementation(candidate => {
+        realSave(candidate);
+        throw new Error("forced first-config post-write failure");
+      });
+
+    try {
+      expect(() => deleteCodexAccount(config, ACCOUNT_ID, { persistMissingConfig: true }))
+        .toThrow("forced first-config post-write failure");
+    } finally {
+      saveSpy.mockRestore();
+    }
+
+    expect(config).toEqual(before);
+    expect(existsSync(getConfigPath())).toBe(false);
+    expect(getCodexAccountCredential(ACCOUNT_ID)).not.toBeNull();
+  });
+
   test("a config persistence failure leaves the account and destructive state intact", () => {
     const config = seededConfig();
     const before = structuredClone(config);
@@ -84,6 +157,98 @@ describe("Codex account delete persistence ordering", () => {
     }
   });
 
+  test("a cleanup-only retry refuses a live row before mutation", () => {
+    const config = seededConfig();
+    const before = structuredClone(config);
+    const beforeConfigBytes = readFileSync(getConfigPath(), "utf8");
+
+    expect(() => deleteCodexAccount(config, ACCOUNT_ID, {
+      persistMissingConfig: true,
+      cleanupOnly: true,
+    })).toThrow(CodexAccountCleanupRetryConflictError);
+
+    expect(config).toEqual(before);
+    expect(readFileSync(getConfigPath(), "utf8")).toBe(beforeConfigBytes);
+    expect(getCodexAccountCredential(ACCOUNT_ID)).not.toBeNull();
+    expect(isAccountNeedsReauth(ACCOUNT_ID)).toBe(true);
+    expect(getAccountQuota(ACCOUNT_ID)).not.toBeNull();
+  });
+
+  test("a cleanup-only retry trusts the persisted row over a stale runtime snapshot", () => {
+    const liveConfig = seededConfig();
+    const staleRuntime = structuredClone(liveConfig);
+    staleRuntime.codexAccounts = [];
+    const beforeRuntime = structuredClone(staleRuntime);
+    const beforeConfigBytes = readFileSync(getConfigPath(), "utf8");
+
+    expect(() => deleteCodexAccount(staleRuntime, ACCOUNT_ID, { cleanupOnly: true }))
+      .toThrow(CodexAccountCleanupRetryConflictError);
+
+    expect(staleRuntime).toEqual(beforeRuntime);
+    expect(readFileSync(getConfigPath(), "utf8")).toBe(beforeConfigBytes);
+    expect(getCodexAccountCredential(ACCOUNT_ID)).not.toBeNull();
+    expect(isAccountNeedsReauth(ACCOUNT_ID)).toBe(true);
+    expect(getAccountQuota(ACCOUNT_ID)).not.toBeNull();
+  });
+
+  test("cleanup-only changes no config bytes or fields while removing an orphan credential", () => {
+    const liveConfig = seededConfig();
+    const staleRuntime = structuredClone(liveConfig);
+    staleRuntime.codexAccounts = [];
+    const persisted = loadConfig();
+    persisted.codexAccounts = [];
+    persisted.port = 54321;
+    saveConfig(persisted);
+    const beforeRuntime = structuredClone(staleRuntime);
+    const beforeConfigBytes = readFileSync(getConfigPath(), "utf8");
+
+    expect(deleteCodexAccount(staleRuntime, ACCOUNT_ID, { cleanupOnly: true })).toBe(false);
+
+    expect(staleRuntime).toEqual(beforeRuntime);
+    expect(readFileSync(getConfigPath(), "utf8")).toBe(beforeConfigBytes);
+    expect(loadConfig().port).toBe(54321);
+    expect(getCodexAccountCredential(ACCOUNT_ID)).toBeNull();
+    expect(isAccountNeedsReauth(ACCOUNT_ID)).toBe(false);
+    expect(getAccountQuota(ACCOUNT_ID)).toBeNull();
+  });
+
+  test("a coordinator reader blocks deletion before any external state changes", () => {
+    const config = seededConfig();
+    const beforeConfig = structuredClone(config);
+    const beforeConfigBytes = readFileSync(getConfigPath(), "utf8");
+    const credentialPath = join(TEST_DIR, "codex-accounts.json");
+    const beforeCredentialBytes = readFileSync(credentialPath, "utf8");
+    const beforeGeneration = observeConfigGeneration();
+    const reader = new Database(join(TEST_DIR, "config-mutation.sqlite"));
+    reader.exec("PRAGMA busy_timeout = 0; BEGIN");
+    reader.query("SELECT value FROM config_generation WHERE singleton = 1").get();
+
+    try {
+      const startedAt = performance.now();
+      expect(() => deleteCodexAccount(config, ACCOUNT_ID)).toThrow(ConfigMutationLockError);
+      expect(performance.now() - startedAt).toBeLessThan(1_000);
+      expect(config).toEqual(beforeConfig);
+      expect(readFileSync(getConfigPath(), "utf8")).toBe(beforeConfigBytes);
+      expect(readFileSync(credentialPath, "utf8")).toBe(beforeCredentialBytes);
+      expect(getCodexAccountCredential(ACCOUNT_ID)).not.toBeNull();
+      expect(isAccountNeedsReauth(ACCOUNT_ID)).toBe(true);
+      expect(getAccountQuota(ACCOUNT_ID)).not.toBeNull();
+      expect(observeConfigGeneration()).toEqual(beforeGeneration);
+    } finally {
+      reader.exec("ROLLBACK");
+      reader.close();
+    }
+
+    expect(deleteCodexAccount(config, ACCOUNT_ID)).toBe(true);
+    expect(getCodexAccountCredential(ACCOUNT_ID)).toBeNull();
+    const afterGeneration = observeConfigGeneration();
+    expect(beforeGeneration.kind).toBe("ready");
+    expect(afterGeneration.kind).toBe("ready");
+    if (beforeGeneration.kind === "ready" && afterGeneration.kind === "ready") {
+      expect(afterGeneration.generation.value).toBe(beforeGeneration.generation.value + 1);
+    }
+  });
+
   test("a failure after durable config replacement restores the prior config", () => {
     const config = seededConfig();
     const before = structuredClone(config);
@@ -162,6 +327,9 @@ describe("Codex account delete persistence ordering", () => {
       expect(loadConfig().codexAccounts?.some(account => account.id === ACCOUNT_ID)).toBe(false);
       expect(config.codexAccounts?.some(account => account.id === ACCOUNT_ID)).toBe(false);
       expect(getCodexAccountCredential(ACCOUNT_ID)).not.toBeNull();
+      expect(isAccountNeedsReauth(ACCOUNT_ID)).toBe(false);
+      expect(getAccountQuota(ACCOUNT_ID)).toBeNull();
+      expect((thrown as CodexAccountDeleteCleanupError).pickerVisibilityChanged).toBe(true);
     } finally {
       removeSpy.mockRestore();
     }
diff --git a/tests/codex-admission-primitives.test.ts b/tests/codex-admission-primitives.test.ts
index 3e643efd2..6059f6fda 100644
--- a/tests/codex-admission-primitives.test.ts
+++ b/tests/codex-admission-primitives.test.ts
@@ -178,7 +178,7 @@ describe("absence is one state, and being unable to look is another", () => {
 describe("the generation read that belongs to the open transaction", () => {
   /**
    * The measured fact that made this necessary: on first acquisition the
-   * BEGIN IMMEDIATE creating the table has not committed, so a separate
+   * transaction creating the table has not committed, so a separate
    * read-only connection still sees nothing. The observer cannot do this job.
    */
   test("the observer cannot read the first transaction, and this can", () => {
diff --git a/tests/codex-auth-api.test.ts b/tests/codex-auth-api.test.ts
index 1000dc8f6..39e037d36 100644
--- a/tests/codex-auth-api.test.ts
+++ b/tests/codex-auth-api.test.ts
@@ -2563,6 +2563,7 @@ describe("codex-auth API", () => {
       codexAccountNamespaces: { team: accountId },
       codexAccountPickerEnabled: true,
     });
+    saveConfig(config);
     saveCodexAccountCredential(accountId, {
       accessToken: "delete-access",
       refreshToken: "delete-refresh",
@@ -3547,6 +3548,167 @@ describe("codex-auth API", () => {
     expect(isAccountNeedsReauth("pool-delete")).toBe(false);
   });
 
+  test("DELETE converges the picker after credential cleanup fails", async () => {
+    const accountId = "pool-delete-cleanup-failure";
+    const config = makeConfig({
+      activeCodexAccountId: accountId,
+      codexAccounts: [{ id: accountId, email: "delete-cleanup@example.test", isMain: false }],
+      codexAccountNamespaces: { stable: accountId },
+      codexAccountPickerEnabled: true,
+    });
+    saveConfig(config);
+    saveCodexAccountCredential(accountId, {
+      accessToken: "access-delete-cleanup",
+      refreshToken: "refresh-delete-cleanup",
+      expiresAt: Date.now() + 5 * 60_000,
+      chatgptAccountId: "acct-delete-cleanup",
+    });
+    markAccountNeedsReauth(accountId);
+    updateAccountQuota(accountId, 70);
+    const closed: Array<{ code?: number; reason?: string }> = [];
+    let cancelled = false;
+    const ws = {
+      data: {
+        authContext: {
+          kind: "pool",
+          accountId,
+          generation: 1,
+          accessToken: "access-delete-cleanup",
+          chatgptAccountId: "acct-delete-cleanup",
+        },
+        cancel: () => { cancelled = true; },
+      } as WsData,
+      close: (code?: number, reason?: string) => { closed.push({ code, reason }); },
+    } as unknown as ServerWebSocket<WsData>;
+    registerCodexWebSocket(ws);
+    expect(getTrackedCodexWebSocketCountForAccount(accountId)).toBe(1);
+
+    let configSaveCalls = 0;
+    let convergenceCalls = 0;
+    const realSave = configModule.saveConfigPreservingClaudeCode;
+    const saveSpy = spyOn(configModule, "saveConfigPreservingClaudeCode")
+      .mockImplementation(candidate => {
+        configSaveCalls += 1;
+        realSave(candidate);
+      });
+    const removeSpy = spyOn(accountStoreModule, "removeCodexAccountCredential")
+      .mockImplementation(() => {
+        throw new Error("private cleanup detail /private/codex-accounts.json Bearer secret-token");
+      });
+
+    try {
+      const req = new Request(
+        `http://localhost/api/codex-auth/accounts?id=${encodeURIComponent(accountId)}`,
+        { method: "DELETE" },
+      );
+      const response = await handleCodexAuthAPI(req, new URL(req.url), config, async () => {
+        convergenceCalls += 1;
+        expect(config.codexAccounts).toEqual([]);
+        expect(loadConfig().codexAccounts).toEqual([]);
+        expect(config.codexAccountNamespaces).toEqual({ stable: accountId });
+        expect(getCodexAccountCredential(accountId)).not.toBeNull();
+        expect(isAccountNeedsReauth(accountId)).toBe(false);
+        expect(getAccountQuota(accountId)).toBeNull();
+        expect(cancelled).toBe(true);
+        expect(closed).toEqual([{ code: 4001, reason: "Codex account invalidated" }]);
+        expect(getTrackedCodexWebSocketCountForAccount(accountId)).toBe(0);
+        return { status: "skipped", reason: "busy", retryable: true };
+      });
+
+      expect(response!.status).toBe(200);
+      const body = await response!.json();
+      expect(body).toEqual({
+        ok: true,
+        accountCleanupPending: true,
+        catalogRefreshPending: true,
+      });
+      expect(JSON.stringify(body)).not.toContain("private cleanup detail");
+      expect(JSON.stringify(body)).not.toContain("secret-token");
+      expect(configSaveCalls).toBe(1);
+      expect(convergenceCalls).toBe(1);
+    } finally {
+      removeSpy.mockRestore();
+      saveSpy.mockRestore();
+    }
+
+    const retry = new Request(
+      `http://localhost/api/codex-auth/accounts?id=${encodeURIComponent(accountId)}&cleanupOnly=1`,
+      { method: "DELETE" },
+    );
+    const retried = await handleCodexAuthAPI(retry, new URL(retry.url), config);
+    expect(retried!.status).toBe(200);
+    expect(await retried!.json()).toEqual({ ok: true, catalogRefreshPending: false });
+    expect(getCodexAccountCredential(accountId)).toBeNull();
+  });
+
+  test("cleanup-only DELETE refuses an account row that is present again", async () => {
+    const accountId = "delete-cleanup-readded";
+    const config = makeConfig({
+      activeCodexAccountId: accountId,
+      codexAccounts: [{ id: accountId, email: "readded@example.test", isMain: false }],
+    });
+    saveConfig(config);
+    const beforePersistedConfig = loadConfig();
+    saveCodexAccountCredential(accountId, {
+      accessToken: "readded-access",
+      refreshToken: "readded-refresh",
+      expiresAt: Date.now() + 5 * 60_000,
+      chatgptAccountId: "readded-account",
+    });
+    const beforeConfig = structuredClone(config);
+    const beforeCredential = getCodexAccountCredential(accountId);
+
+    const request = new Request(
+      `http://localhost/api/codex-auth/accounts?id=${encodeURIComponent(accountId)}&cleanupOnly=1`,
+      { method: "DELETE" },
+    );
+    const response = await handleCodexAuthAPI(request, new URL(request.url), config);
+
+    expect(response!.status).toBe(409);
+    expect(await response!.json()).toEqual({
+      error: "Account absence could not be confirmed; cleanup retry was not applied",
+    });
+    expect(config).toEqual(beforeConfig);
+    expect(loadConfig()).toEqual(beforePersistedConfig);
+    expect(getCodexAccountCredential(accountId)).toEqual(beforeCredential);
+
+    accountStoreModule.removeCodexAccountCredential(accountId);
+    const noCredentialResponse = await handleCodexAuthAPI(request, new URL(request.url), config);
+    expect(noCredentialResponse!.status).toBe(409);
+    expect(config).toEqual(beforeConfig);
+    expect(loadConfig()).toEqual(beforePersistedConfig);
+  });
+
+  test("DELETE /api/codex-auth/accounts rejects an unknown valid account id", async () => {
+    const config = makeConfig();
+    const req = new Request(
+      "http://localhost/api/codex-auth/accounts?id=missing-account",
+      { method: "DELETE" },
+    );
+
+    const response = await handleCodexAuthAPI(req, new URL(req.url), config);
+
+    expect(response!.status).toBe(404);
+    expect(await response!.json()).toEqual({ error: "Account not found" });
+  });
+
+  test.each(["0", "true", "yes", ""])(
+    "DELETE /api/codex-auth/accounts rejects cleanupOnly=%s",
+    async (cleanupOnly) => {
+      const config = makeConfig();
+      const url = new URL("http://localhost/api/codex-auth/accounts?id=missing-account");
+      url.searchParams.set("cleanupOnly", cleanupOnly);
+      const request = new Request(url, { method: "DELETE" });
+
+      const response = await handleCodexAuthAPI(request, url, config);
+
+      expect(response!.status).toBe(400);
+      expect(await response!.json()).toEqual({
+        error: "cleanupOnly must be 1 when provided",
+      });
+    },
+  );
+
   test.each([
     MAIN_CODEX_ACCOUNT_ID,
     "__proto__",
@@ -3607,6 +3769,147 @@ describe("codex-auth API", () => {
     expect(getCodexAccountCredential(accountId)).toBeNull();
   });
 
+  test("DELETE persists a configured row removal when config.json does not exist yet", async () => {
+    const accountId = "delete-first-config";
+    const config = makeConfig({
+      codexAccounts: [{ id: accountId, email: "first-config@example.test", isMain: false }],
+    });
+    saveCodexAccountCredential(accountId, {
+      accessToken: "first-config-access",
+      refreshToken: "first-config-refresh",
+      expiresAt: Date.now() + 5 * 60_000,
+      chatgptAccountId: "first-config-account",
+    });
+    expect(existsSync(getConfigPath())).toBe(false);
+
+    const request = new Request(
+      `http://localhost/api/codex-auth/accounts?id=${encodeURIComponent(accountId)}`,
+      { method: "DELETE" },
+    );
+    const response = await handleCodexAuthAPI(request, new URL(request.url), config);
+
+    expect(response!.status).toBe(200);
+    expect(existsSync(getConfigPath())).toBe(true);
+    expect(loadConfig().codexAccounts).toEqual([]);
+    expect(getCodexAccountCredential(accountId)).toBeNull();
+  });
+
+  test("credential-only legacy deletion does not create a missing config.json", async () => {
+    const accountId = "Constructor";
+    const config = makeConfig();
+    saveCodexAccountCredential(accountId, {
+      accessToken: "orphan-access",
+      refreshToken: "orphan-refresh",
+      expiresAt: Date.now() + 5 * 60_000,
+      chatgptAccountId: "orphan-account",
+    });
+    expect(existsSync(getConfigPath())).toBe(false);
+
+    const request = new Request(
+      `http://localhost/api/codex-auth/accounts?id=${encodeURIComponent(accountId)}`,
+      { method: "DELETE" },
+    );
+    const response = await handleCodexAuthAPI(request, new URL(request.url), config);
+
+    expect(response!.status).toBe(200);
+    expect(await response!.json()).toEqual({ ok: true, catalogRefreshPending: false });
+    expect(existsSync(getConfigPath())).toBe(false);
+    expect(getCodexAccountCredential(accountId)).toBeNull();
+  });
+
+  test("DELETE returns fixed recovery guidance when config rollback cannot be restored", async () => {
+    const accountId = "delete-rollback-failed";
+    const config = makeConfig({
+      codexAccounts: [{ id: accountId, email: "rollback@example.test", isMain: false }],
+    });
+    saveConfig(structuredClone(config));
+    saveCodexAccountCredential(accountId, {
+      accessToken: "rollback-access",
+      refreshToken: "rollback-refresh",
+      expiresAt: Date.now() + 5 * 60_000,
+      chatgptAccountId: "rollback-account",
+    });
+    const beforeRuntime = structuredClone(config);
+    const beforeCredential = getCodexAccountCredential(accountId);
+    const saveSpy = spyOn(configModule, "saveConfigPreservingClaudeCode")
+      .mockImplementation(candidate => {
+        writeFileSync(getConfigPath(), JSON.stringify(candidate));
+        throw new Error("private primary persistence detail /secret/config.json");
+      });
+    const restoreSpy = spyOn(configModule, "atomicWriteFile")
+      .mockImplementation(() => {
+        throw new Error("private rollback detail /secret/backup.json");
+      });
+
+    try {
+      const request = new Request(
+        `http://localhost/api/codex-auth/accounts?id=${encodeURIComponent(accountId)}`,
+        { method: "DELETE" },
+      );
+      const response = await handleCodexAuthAPI(request, new URL(request.url), config);
+      const body = await response!.json();
+
+      expect(response!.status).toBe(500);
+      expect(body).toEqual({
+        error: "Account deletion failed and the previous config could not be restored. Restart before retrying.",
+        code: "codex_account_delete_rollback_failed",
+      });
+      expect(JSON.stringify(body)).not.toContain("private");
+      expect(JSON.stringify(body)).not.toContain("/secret/");
+      expect(config).toEqual(beforeRuntime);
+      expect(getCodexAccountCredential(accountId)).toEqual(beforeCredential);
+    } finally {
+      restoreSpy.mockRestore();
+      saveSpy.mockRestore();
+    }
+  });
+
+  test("DELETE /api/codex-auth/accounts retries cleanup for an orphaned legacy reserved account", async () => {
+    const accountId = "Constructor";
+    const config = makeConfig({
+      codexAccounts: [{ id: accountId, email: "legacy@example.test", isMain: false }],
+    });
+    saveCodexAccountCredential(accountId, {
+      accessToken: "legacy-access",
+      refreshToken: "legacy-refresh",
+      expiresAt: Date.now() + 5 * 60_000,
+      chatgptAccountId: "legacy-account",
+    });
+    const removeSpy = spyOn(accountStoreModule, "removeCodexAccountCredential")
+      .mockImplementation(() => {
+        throw new Error("private legacy cleanup detail");
+      });
+
+    try {
+      const firstRequest = new Request(
+        `http://localhost/api/codex-auth/accounts?id=${encodeURIComponent(accountId)}`,
+        { method: "DELETE" },
+      );
+      const firstResponse = await handleCodexAuthAPI(firstRequest, new URL(firstRequest.url), config);
+
+      expect(firstResponse!.status).toBe(200);
+      expect(await firstResponse!.json()).toEqual({
+        ok: true,
+        accountCleanupPending: true,
+        catalogRefreshPending: false,
+      });
+      expect(config.codexAccounts).toEqual([]);
+      expect(getCodexAccountCredential(accountId)).not.toBeNull();
+    } finally {
+      removeSpy.mockRestore();
+    }
+
+    const retryRequest = new Request(
+      `http://localhost/api/codex-auth/accounts?id=${encodeURIComponent(accountId)}`,
+      { method: "DELETE" },
+    );
+    const retryResponse = await handleCodexAuthAPI(retryRequest, new URL(retryRequest.url), config);
+
+    expect(retryResponse!.status).toBe(200);
+    expect(await retryResponse!.json()).toEqual({ ok: true, catalogRefreshPending: false });
+    expect(getCodexAccountCredential(accountId)).toBeNull();
+  });
+
   test("legacy non-main __main__ is quarantined and removable without touching Desktop auth", async () => {
     const config = makeConfig({
       activeCodexAccountId: MAIN_CODEX_ACCOUNT_ID,
@@ -3624,17 +3927,42 @@ describe("codex-auth API", () => {
 
     expect(getMainChatgptAccountId()).toBe("desktop-account");
     expect(resolveCodexAccountForThread("legacy-main-row", config)).toBeNull();
+    const removeSpy = spyOn(accountStoreModule, "removeCodexAccountCredential")
+      .mockImplementation(() => {
+        throw new Error("private legacy main cleanup detail");
+      });
 
-    const req = new Request(
-      `http://localhost/api/codex-auth/accounts?id=${encodeURIComponent(MAIN_CODEX_ACCOUNT_ID)}`,
-      { method: "DELETE" },
-    );
+    try {
+      const req = new Request(
+        `http://localhost/api/codex-auth/accounts?id=${encodeURIComponent(MAIN_CODEX_ACCOUNT_ID)}`,
+        { method: "DELETE" },
+      );
 
-    const resp = await handleCodexAuthAPI(req, new URL(req.url), config);
+      const resp = await handleCodexAuthAPI(req, new URL(req.url), config);
+
+      expect(resp!.status).toBe(200);
+      expect(await resp!.json()).toEqual({
+        ok: true,
+        accountCleanupPending: true,
+        catalogRefreshPending: false,
+      });
+    } finally {
+      removeSpy.mockRestore();
+    }
 
-    expect(resp!.status).toBe(200);
     expect(config.codexAccounts).toEqual([]);
     expect(config.activeCodexAccountId).toBeUndefined();
+    expect(getCodexAccountCredential(MAIN_CODEX_ACCOUNT_ID)).not.toBeNull();
+    expect(getMainChatgptAccountId()).toBe("desktop-account");
+
+    const retry = new Request(
+      `http://localhost/api/codex-auth/accounts?id=${encodeURIComponent(MAIN_CODEX_ACCOUNT_ID)}`,
+      { method: "DELETE" },
+    );
+    const retried = await handleCodexAuthAPI(retry, new URL(retry.url), config);
+
+    expect(retried!.status).toBe(200);
+    expect(await retried!.json()).toEqual({ ok: true, catalogRefreshPending: false });
     expect(getCodexAccountCredential(MAIN_CODEX_ACCOUNT_ID)).toBeNull();
     expect(getMainChatgptAccountId()).toBe("desktop-account");
   });
diff --git a/tests/config-mutation-lock.test.ts b/tests/config-mutation-lock.test.ts
index d984f2724..6a827cebc 100644
--- a/tests/config-mutation-lock.test.ts
+++ b/tests/config-mutation-lock.test.ts
@@ -1,4 +1,5 @@
 import { afterEach, beforeEach, expect, test } from "bun:test";
+import { Database } from "bun:sqlite";
 import { existsSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { pathToFileURL } from "node:url";
@@ -137,8 +138,44 @@ test("a throwing mutation releases the lock and leaves writers available", () =>
   expect(loadConfig().port).toBe(50500);
 });
 
-test("management API maps config mutation lock contention to retryable 503", async () => {
+test("an existing reader rejects a mutation before its callback can change external state", () => {
   saveConfig(config());
+  const reader = new Database(join(testRoot, "config-mutation.sqlite"));
+  reader.exec("PRAGMA busy_timeout = 0; BEGIN");
+  reader.query("SELECT value FROM config_generation WHERE singleton = 1").get();
+  let callbackEntered = false;
+
+  try {
+    expect(() => withConfigMutationLockSync(() => {
+      callbackEntered = true;
+    })).toThrow(ConfigMutationLockError);
+    expect(callbackEntered).toBe(false);
+    expect(loadConfig().port).toBe(10100);
+  } finally {
+    reader.exec("ROLLBACK");
+    reader.close();
+  }
+
+  expect(() => saveConfig(config(40400))).not.toThrow();
+  expect(loadConfig().port).toBe(40400);
+});
+
+test("management API maps config mutation lock contention to retryable 503", async () => {
+  const lockedConfig: OcxConfig = {
+    ...config(),
+    codexAccounts: [{
+      id: "delete-busy-account",
+      email: "delete-busy@example.test",
+      isMain: false,
+    }],
+  };
+  saveConfig(lockedConfig);
+  saveCodexAccountCredential("delete-busy-account", {
+    accessToken: "delete-busy-access",
+    refreshToken: "delete-busy-refresh",
+    expiresAt: Date.now() + 60_000,
+    chatgptAccountId: "delete-busy-chatgpt-account",
+  });
   const readyPath = join(testRoot, "mgmt-holder-ready");
   const releasePath = join(testRoot, "mgmt-holder-release");
   const configModuleUrl = pathToFileURL(join(import.meta.dir, "../src/config.ts")).href;
@@ -169,13 +206,31 @@ test("management API maps config mutation lock contention to retryable 503", asy
         body: JSON.stringify({ threshold: 50 }),
       }),
       url,
-      config(),
+      lockedConfig,
     );
     expect(response?.status).toBe(503);
     expect(await response!.json()).toMatchObject({
       error: "Configuration is busy; retry shortly",
       code: "CONFIG_MUTATION_LOCK_UNAVAILABLE",
     });
+
+    const deleteUrl = new URL(
+      "http://localhost/api/codex-auth/accounts?id=delete-busy-account",
+    );
+    const deleteResponse = await handleManagementAPI(
+      new ManagementRequest(deleteUrl, {
+        method: "DELETE",
+        headers: managementHeaders(),
+      }),
+      deleteUrl,
+      lockedConfig,
+    );
+    expect(deleteResponse?.status).toBe(503);
+    expect(await deleteResponse!.json()).toEqual({
+      error: "Configuration is busy; retry shortly",
+      code: "CONFIG_MUTATION_LOCK_UNAVAILABLE",
+    });
+    expect(getCodexAccountCredential("delete-busy-account")).not.toBeNull();
   } finally {
     writeFileSync(releasePath, "release");
     expect(await waitForOwnedChild(child)).toBe(0);
diff --git a/tests/native-claude-code-toggle.test.ts b/tests/native-claude-code-toggle.test.ts
index d6f0777ce..facf8776e 100644
--- a/tests/native-claude-code-toggle.test.ts
+++ b/tests/native-claude-code-toggle.test.ts
@@ -171,10 +171,9 @@ test("enabling WITH a change flips the flag and reports current", async () => {
 test("a held REAL config transaction refuses 409 config_busy, and release lets a retry through", async () => {
   /*
    * Acceptance (audit r7 #2): a real second connection holding the lock, not
-   * a mocked throw. The holder runs the same `PRAGMA busy_timeout = 0;
-   * BEGIN IMMEDIATE` the lock itself uses (src/config.ts:1771), so the route's
-   * own acquisition fails with SQLITE_BUSY exactly as cross-process contention
-   * would. The route runs the REAL saveConfigPreservingClaudeCode — no seam —
+   * a mocked throw. The holder takes a SQLite write transaction, so the route's
+   * own exclusive acquisition fails with SQLITE_BUSY exactly as cross-process
+   * contention would. The route runs the REAL saveConfigPreservingClaudeCode — no seam —
    * against a fixture OPENCODEX_HOME.
    */
   const { Database } = await import("bun:sqlite");