@khoavu882/doflow 2.0.0-beta.4 → 2.0.0

package/src/cli/commands/reconcile.js

@@ -2,13 +2,19 @@
 // `doflow reconcile` — converge observed state onto the doflow.lock pin: report drift, then heal
 // it on confirmation. Never re-prompts for MCP; selections ride exactly as pinned.
 // TypeScript migration (agent-docs/BRIEF_GOAL_DOFLOW.md): run directly by Node native type-stripping.
+const path = require('node:path');
 const { toolDirs } = require('../../install/targets.js');
 const { resolveContext, printContext } = require('../../install/context.js');
 const { writeManifest } = require('../../install/manifest.js');
+const { DEFAULT_BACKUP_RETENTION, createFileBackup } = require('../../install/backup.js');
+const { backupSetFromPlan, backupSetFromPaths } = require('../../install/backup-set.js');
+const { ledgerPath } = require('../../state/index.js');
+const { backupStep, reportBackup, applyBackupRetention } = require('./install.js');
 const { confirm } = require('../../helper/prompt.js');
 const { sourceCommit } = require('../../helper/git.js');
-const { loadRegistry } = require('../../registry/index.js');
+const { loadRegistry, retiredFor } = require('../../registry/index.js');
 const { applyLifecycle, recordMcpOwnership } = require('../../lifecycle/index.js');
+const { formatRetiredPlans, retiredReleaseKeys } = require('../../lifecycle/retired-harnesses.js');
 const {
   registryLifecycleView, assertSafeRegistryPlan,
 } = require('../../lifecycle/view.js');
@@ -33,6 +39,10 @@ function reconcileReport(view     )      {
     }
     perHarness.set(target.harness, entry);
   }
+  // A retired harness's rows (row 127 IC-003) are drift too: converging means releasing them.
+  for (const change of (view.plan.retiredHarnesses ?? []).flatMap((item     ) => item.changes)) {
+    drifts.push({ harness: change.harness, operation: change.operation, assetId: change.assetId, target: change.target, retired: true });
+  }
   return {
     drifts,
     conflicts: view.plan.conflicts,
@@ -42,17 +52,29 @@ function reconcileReport(view     )      {
   };
 }
 
-function printReconcileReport(report     , lock     )       {
+function printReconcileReport(report     , lock     , retiredLines           = [])       {
   console.log(`[INFO] Reconciling against doflow.lock (sourceVersion ${lock.sourceVersion ?? 'unknown'})`);
   for (const [harness, counts] of Object.entries     (report.perHarness)) {
     const total = counts.create + counts.update + counts.remove;
     console.log(`[INFO] ${harness}: ${total === 0 ? 'clean' : `${total} drift(s) (${counts.create} create, ${counts.update} update, ${counts.remove} remove)`}`);
   }
+  for (const line of retiredLines) console.log(line);
   for (const conflict of report.conflicts) console.log(`[CONFLICT] ${conflict.harness}: ${conflict.reason}`);
   for (const prerequisite of report.prerequisites) console.log(`[PENDING-TRUST] ${prerequisite.harness}: ${prerequisite.prerequisite}`);
   if (report.clean) console.log('[OK] Observed state matches doflow.lock.');
 }
 
+/** The backup a retirement sweep takes (row 127 FR-4): the set install and update take, files and
+ * ledger. A sweep that only gives up rows (release, drop, keep) touches no file, so that set is empty;
+ * the ledger alone is then what a rollback needs to bring the rows and the target entry back. */
+function retirementBackupSet(view     , paths     , scope     )      {
+  const ledger = ledgerPath(view.stateRoot);
+  const args = { scope: scope.global ? 'global' : 'project', scopeRoot: paths.scopeRoot, records: [ledger],
+    exclude: [paths.backupRoot, view.stateRoot, paths.manifestPath, path.join(paths.doflowRoot, 'doflow.lock')] };
+  const set = backupSetFromPlan({ plan: view.plan, ...args });
+  return set.count ? set : backupSetFromPaths({ items: [{ path: ledger, harnesses: [] }], ...args });
+}
+
 function cmdReconcile(o     )       {
   refuseHomeRootedProject(o, 'reconcile');
   const scope = scopeOf(o);
@@ -61,23 +83,33 @@ function cmdReconcile(o     )       {
     const dirs = toolDirs(scope);
     const lifecyclePaths = installPaths(scope);
     const { lock, ledger, manifestServers } = scopeSelectionState(scope);
+    // Read only when there is a pin or a row to classify, as before this check existed.
+    const registry = lock?.targets?.length || ledger?.resources?.length ? loadRegistry({ repoRoot: REPO_ROOT }) : null;
+    const retired = (harness        ) => (registry ? retiredFor(registry, harness) : null);
+    // A retired pin (row 127 IC-004) names a harness with no adapter: dropped, said, and the rest
+    // converge. Its ledger rows are released by this run's plan, like install's and update's.
+    for (const entry of lock?.targets ?? []) {
+      const record = retired(entry.harness);
+      if (record) console.log(`[WARN] ${entry.harness}: retired (use ${record.replacement}); dropped from the pinned targets`);
+    }
+    const livePins = (lock?.targets ?? []).filter((entry     ) => !retired(entry.harness));
     // A harness the ledger holds but the lock does not pin is installed and outside reconcile's reach.
     // Said, not converged: the lock records choices, and reconcile has no choice to record for it.
-    const pinned = new Set((lock?.targets ?? []).map((entry     ) => entry.harness));
-    const unpinned = [...new Set((ledger?.resources ?? []).map((resource     ) => resource.harness))].filter((harness) => !pinned.has(harness)).sort();
+    const pinned = new Set(livePins.map((entry     ) => entry.harness));
+    const unpinned = [...new Set((ledger?.resources ?? []).map((resource     ) => resource.harness))]
+      .filter((harness     ) => !pinned.has(harness) && !retired(harness)).sort();
     for (const harness of unpinned) {
       const count = ledger.resources.filter((resource     ) => resource.harness === harness).length;
       console.log(`[WARN] ${harness}: installed (ledger holds ${count} resource(s)) but absent from doflow.lock; reconcile does not converge it.`);
     }
-    if (!lock || !lock.targets.length) {
+    if (!lock || !livePins.length) {
       // Reconcile converges onto what install pinned; with no pin there is no desired state to
       // converge to, and guessing one from the registry would silently adopt targets the user
       // never chose.
       console.log('[INFO] No doflow.lock in this scope — nothing pinned to reconcile against. Run `doflow install` first.');
       return;
     }
-    const targets = lock.targets.map((entry     ) => entry.harness);
-    const registry = loadRegistry({ repoRoot: REPO_ROOT });
+    const targets = livePins.map((entry     ) => entry.harness);
     printContext(resolveContext({ repoRoot: REPO_ROOT, targets, dirs, sourceCommit: sourceCommit(SCRIPT_DIR), ...scope }));
     // Each harness converges onto its own pinned selection — reconcile never re-prompts and never
     // lends one harness's servers to another.
@@ -87,7 +119,7 @@ function cmdReconcile(o     )       {
     if (!lifecycleView.plan.safe) { assertSafeRegistryPlan(lifecycleView); return; }
 
     const report = reconcileReport(lifecycleView);
-    printReconcileReport(report, lock);
+    printReconcileReport(report, lock, formatRetiredPlans(lifecycleView.plan.retiredHarnesses ?? []));
     if (o.json) console.log(JSON.stringify({ scope: lock.scope, sourceVersion: lock.sourceVersion, targets, unpinned, ...report }, null, 2));
     if (o.dryRun) {
       console.log('[DRY] Reconcile plan complete — no changes written');
@@ -107,10 +139,22 @@ function cmdReconcile(o     )       {
       process.exit(1);
     }
     checkpointRunLock(hold);
+    // A run that changes a retired harness's rows backs the retirement up first, as install and
+    // update do, so `doflow rollback` restores it (row 127 FR-4). Any other reconcile takes none.
+    let bid = '';
+    const retiring = retiredReleaseKeys(lifecycleView.plan.retiredHarnesses ?? []).size > 0;
+    if (retiring && o.noBackup) {
+      console.error('[WARN]  Skipping backup (--no-backup)');
+    } else if (retiring) {
+      const commit = sourceCommit(SCRIPT_DIR);
+      bid = reportBackup(backupStep(() => createFileBackup({ operation: 'reconcile', set: retirementBackupSet(lifecycleView, lifecyclePaths, scope),
+        backupRoot: lifecyclePaths.backupRoot, repoRoot: SCRIPT_DIR, sourceCommit: commit, version: pkg.version, date: new Date() })));
+    }
     applyLifecycle({ plan: lifecycleView.plan, registry: lifecycleView.registry,
       adapters: buildAdapterRegistry(),
       stateRoot: lifecycleView.stateRoot, ledger: lifecycleView.ledger });
-    writeManifest({ scopeRoot: lifecyclePaths.scopeRoot, scriptVersion: pkg.version, operation: 'update', repoRoot: SCRIPT_DIR, sourceCommit: sourceCommit(SCRIPT_DIR), backupId: '', tools: targets, date: new Date() });
+    writeManifest({ scopeRoot: lifecyclePaths.scopeRoot, scriptVersion: pkg.version, operation: 'update', repoRoot: SCRIPT_DIR, sourceCommit: sourceCommit(SCRIPT_DIR), backupId: bid, tools: targets, date: new Date() });
+    if (bid) applyBackupRetention({ backupRoot: lifecyclePaths.backupRoot, prune: o.prune, keep: o.prune ?? DEFAULT_BACKUP_RETENTION, bid });
     console.log('[OK] Reconciliation complete — state converged onto doflow.lock.');
   } finally {
     hold?.release();

package/src/cli/commands/remove.js

@@ -59,8 +59,8 @@ function cmdRemove(o     )       {
       scope: codexScope(scope), scopeRoot: scope.global ? os.homedir() : path.resolve(scope.projectRoot),
       targets: lifecycleTargets, mcpAdoptable, retainedMcpIds, stateRoot: view.stateRoot, ledger: view.ledger,
       context: view.plan.targets[0].adapterInput.context });
-    // Shared destinations (one .doflow/scripts tree for claude/codex/gemini, one .agents for
-    // gemini/copilot) mean a removal can legitimately leave files standing. Saying only "removed"
+    // Shared destinations (one .doflow/scripts tree for claude/codex, one .agents for
+    // antigravity/copilot) mean a removal can legitimately leave files standing. Saying only "removed"
     // would be half the truth, so what was kept and who still claims it is printed, not implied.
     for (const line of retentionSummary(result.retained)) console.log(`[INFO] ${line}`);
     console.log(`[OK] Removed ${result.ledger.resources.length === 0 ? 'all' : 'eligible'} native resource(s) for ${lifecycleTargets.join(', ')}; ${result.ledger.resources.length} owned record(s) remain.`);

package/src/cli/commands/rollback.js

@@ -6,7 +6,7 @@
 // restores per tool, as it always did.
 // TypeScript migration (agent-docs/BRIEF_GOAL_DOFLOW.md): run directly by Node native type-stripping.
 const path = require('node:path');
-const { resolveTargets, toolDirs } = require('../../install/targets.js');
+const { VALID, resolveTargets, toolDirs } = require('../../install/targets.js');
 const { resolveContext, printContext } = require('../../install/context.js');
 const {
   BackupError, createFileBackup, planRestore, executeRestore, listBackups, formatBytes,
@@ -59,9 +59,12 @@ function cmdRollback(o     )       {
       fail(error);
     }
     // A per-file backup restores the harnesses it holds (only those in --target when given), so the
-    // banner and the install manifest name those, not the default target.
+    // banner and the install manifest name those, not the default target. A backup taken by a run
+    // that swept a retired harness (127 IC-003) holds that harness's files and rows too: they are
+    // restored like any other, but a retired id is no target, so the banner and manifest skip it.
     const restoredTools = plan.format === 2
-      ? [...new Set(plan.restore.flatMap((item     ) => item.harnesses))].filter((h) => !explicitTargets || targets.includes(h)).sort()
+      ? [...new Set(plan.restore.flatMap((item     ) => item.harnesses))]
+        .filter((h     ) => VALID.includes(h) && (!explicitTargets || targets.includes(h))).sort()
       : targets;
     printContext(resolveContext({ repoRoot: REPO_ROOT, targets: restoredTools, dirs, sourceCommit: commit, global: o.global, projectRoot: '.' }));
 

package/src/cli/commands/self-update.js

@@ -2,32 +2,41 @@
 // `doflow self-update` — git fetch/pull the checkout, then re-run the install path so the
 // installed trees match the freshly pulled source.
 // TypeScript migration (agent-docs/BRIEF_GOAL_DOFLOW.md): run directly by Node native type-stripping.
+const fs = require('node:fs');
+const path = require('node:path');
 const { execFileSync } = require('node:child_process');
 const { REPO_ROOT } = require('../shared.js');
 const cmdInstall = require('./install.js');
 
-function cmdSelfUpdate(o     )       {
+/** The second argument is for tests: the checkout to update and the install it re-runs. */
+function cmdSelfUpdate(o     , { repoRoot = REPO_ROOT, install = cmdInstall }                                                    = {})       {
   console.log('[INFO] Self-update: checking for upstream changes...');
   let pulled = false;
   let fetchOk = false;
-  try {
-    execFileSync('git', ['-C', REPO_ROOT, 'fetch', '--depth=1', 'origin'], { stdio: ['ignore', 'ignore', 'pipe'], timeout: 10000 });
-    fetchOk = true;
-  } catch {
-    console.error('[WARN]  git fetch failed (offline or no remote configured) — installing from current HEAD');
+  // An npm install is not a git checkout: `git -C` there would act on whatever repository holds
+  // node_modules (or fail), never on DoFlow's source.
+  const isCheckout = fs.existsSync(path.join(repoRoot, '.git'));
+  if (!isCheckout) console.log('[INFO] This install is not a git checkout; to upgrade DoFlow run: npm install -g @khoavu882/doflow');
+  if (isCheckout) {
+    try {
+      execFileSync('git', ['-C', repoRoot, 'fetch', '--depth=1', 'origin'], { stdio: ['ignore', 'ignore', 'pipe'], timeout: 10000 });
+      fetchOk = true;
+    } catch {
+      console.error('[WARN]  git fetch failed (offline or no remote configured) — installing from current HEAD');
+    }
   }
   if (fetchOk) {
     try {
-      execFileSync('git', ['-C', REPO_ROOT, 'pull', '--ff-only'], { stdio: ['ignore', 'ignore', 'pipe'], timeout: 10000 });
+      execFileSync('git', ['-C', repoRoot, 'pull', '--ff-only'], { stdio: ['ignore', 'ignore', 'pipe'], timeout: 10000 });
       pulled = true;
-      const commit = execFileSync('git', ['-C', REPO_ROOT, 'rev-parse', '--short', 'HEAD']).toString().trim();
+      const commit = execFileSync('git', ['-C', repoRoot, 'rev-parse', '--short', 'HEAD']).toString().trim();
       console.log(`[INFO] Updated to commit: ${commit}`);
     } catch {
       console.error('[WARN]  Fast-forward not possible — using current local state');
     }
   }
   console.log(`[INFO] Running install (after ${pulled ? 'a git pull' : 'checking for updates'})...`);
-  cmdInstall(o);
+  install(o);
 }
 
 module.exports = cmdSelfUpdate;

package/src/cli/commands/status.js

@@ -42,6 +42,10 @@ function cmdStatus(o     )       {
       ledgerPresent: Boolean(readLedger(registryView.stateRoot)),
       plan: { changes: registryView.plan.changes.length, conflicts: registryView.plan.conflicts, prerequisites: registryView.plan.prerequisites },
     };
+    // Row 127: a retired harness the ledger still holds rows of, which the next install or update
+    // releases. Absent when there is none, so the report is unchanged for every other ledger.
+    const retired = (registryView.plan.retiredHarnesses ?? []).map((item     ) => ({ harness: item.harness, replacement: item.replacement, rows: item.changes.length }));
+    if (retired.length) ctx.registry.retired = retired;
     // Per-harness status must derive from that harness's own plan target, not the flattened
     // registryView.plan.changes/conflicts across every target — otherwise, e.g., Codex having
     // pending changes when it isn't installed yet would make Claude's line falsely report
@@ -50,7 +54,7 @@ function cmdStatus(o     )       {
     // Hook-wiring status needs the same general per-harness verification every install/update run
     // already flows through (src/lifecycle's verifyLifecycle) rather than a Codex-only hardcode:
     // it is the one place that can tell 'installed and active' apart from 'installed but pending a
-    // prerequisite' (Codex's unreviewed trust, Gemini's live hook-trust check) from 'absent'.
+    // prerequisite' (Codex's unreviewed trust) from 'absent'.
     const verification = verifyLifecycle({ plan: registryView.plan, adapters: registryView.adapters, context: { registry } });
     const hooksFor = (harness        ) => verification.verifications.find((item     ) => item.harness === harness)?.hookWiring ?? null;
     const harnessStatus = (harness        ) => {
@@ -80,8 +84,19 @@ function cmdStatus(o     )       {
     ctx.registry = { status: 'invalid', error: error.message };
   }
 
+  // The primary is read on use only (row 120 A.4): a fault in resolving it never breaks status.
+  let primary      = null;
+  let primaryText        ;
+  try {
+    const { primarySummary, resolveForReport } = require('../../runtime/context/primary-command.js');
+    primary = resolveForReport({ env: process.env, projectRoot: path.resolve(scope.projectRoot) }).primary;
+    primaryText = primarySummary(primary);
+  } catch (error     ) {
+    primaryText = `unavailable (${error?.message || String(error)})`;
+  }
+
   if (o.json) {
-    console.log(JSON.stringify({ context: ctx, manifest, codex: ctx.codex ?? null, mcpSelections }, null, 2));
+    console.log(JSON.stringify({ context: ctx, manifest, codex: ctx.codex ?? null, mcpSelections, primary }, null, 2));
     return;
   }
 
@@ -92,6 +107,7 @@ function cmdStatus(o     )       {
   };
 
   printContext(ctx);
+  console.log(`primary: ${primaryText}`);
   if (!manifest) {
     console.log("[WARN] No install manifest found — run 'doflow install' to get started");
     return;
@@ -126,6 +142,9 @@ function cmdStatus(o     )       {
   if (ctx.registry) {
     console.log(`  Registry lifecycle:   ${ctx.registry.status === 'invalid' ? ctx.registry.error : `${ctx.registry.plan.changes} pending, ${ctx.registry.plan.conflicts.length} conflict(s)`}`);
     if (ctx.registry.status !== 'invalid') console.log(`  Neutral state:         ${ctx.registry.stateRoot}${ctx.registry.ledgerPresent ? ' (ledger present)' : ' (not yet created)'}`);
+    for (const item of ctx.registry.retired ?? []) {
+      console.log(`  Retired harness:      ${item.harness} (use ${item.replacement}): ${item.rows} ledger row(s); the next 'doflow install' or 'doflow update' in this scope releases them`);
+    }
   }
   console.log('\n  TOOL         STATUS         LAST UPDATED');
   for (const tool of LIFECYCLE_HARNESSES) {

package/src/cli/commands/ui.js

@@ -0,0 +1,99 @@
+'use strict';
+// `doflow ui [<project>] [--port N] [private TLS flags]` — run the DoFlow Console, a separately installed package
+// (092 IC-008). The package is found by file existence and never loaded into the core: this module
+// loads only node:fs, node:path and node:child_process (test/runtime/ui-launcher.test.ts). It never
+// listens, reads DoFlow state, installs anything, or adds a variable to the Console's environment.
+// TypeScript migration (agent-docs/BRIEF_GOAL_DOFLOW.md): run directly by Node native type-stripping.
+const fs = require('node:fs');
+const path = require('node:path');
+const { spawn } = require('node:child_process');
+
+/** The package's entry, fixed by its own contract (093 IC-002). */
+const CONSOLE_BIN = path.join('bin', 'doflow-ui.js');
+const USAGE = 'doflow ui: usage: doflow ui [<project>] [--port N] [--listen-address <private IP> --tls-cert <absolute path> --tls-key <absolute path>]';
+const NOT_INSTALLED = 'doflow ui: the Console is not installed. Install it with: npm install -g @khoavu882/doflow-ui';
+
+/** The Console bin when `dir` holds both the package's package.json and its bin, else null. */
+function consoleBinIn(dir        )                {
+  const bin = path.join(dir, CONSOLE_BIN);
+  return fs.existsSync(path.join(dir, 'package.json')) && fs.existsSync(bin) ? bin : null;
+}
+
+/**
+ * IC-008 order. First the core's sibling: npm puts both packages in the same
+ * `node_modules/@khoavu882/`, global or project, so that copy was installed next to this very core.
+ * Then a walk up from the project for `node_modules/@khoavu882/doflow-ui`.
+ */
+function findConsole(coreRoot        , project        )                {
+  const sibling = consoleBinIn(path.join(coreRoot, '..', 'doflow-ui'));
+  if (sibling) return sibling;
+  for (let dir = project; ; dir = path.dirname(dir)) {
+    const bin = consoleBinIn(path.join(dir, 'node_modules', '@khoavu882', 'doflow-ui'));
+    if (bin) return bin;
+    if (path.dirname(dir) === dir) return null;
+  }
+}
+
+/** `coreRoot` is this core's package root, passed in by the COMMANDS table (src/helper/repo-root.js owns it). */
+function cmdUi(o     , coreRoot        )                       {
+  const port = o.port;
+  const uiFlags = new Set(['--listen-address', '--tls-cert', '--tls-key']);
+  const otherFlags = o.flagsGiven.filter((flag        ) => {
+    const name = flag.split('=', 1)[0];
+    return name !== '--port' && !uiFlags.has(name);
+  });
+  const remoteValues = [o.listenAddress, o.tlsCert, o.tlsKey];
+  const remoteCount = remoteValues.filter((value         ) => value !== undefined).length;
+  if (o.positional.length > 1 || otherFlags.length > 0
+    || (remoteCount !== 0 && remoteCount !== remoteValues.length)
+    || (port !== undefined && !(/^[0-9]{1,5}$/.test(port) && Number(port) <= 65535))) {
+    console.error(USAGE);
+    process.exitCode = 2;
+    return;
+  }
+  const project = path.resolve(o.positional[0] ?? '.');
+  const bin = findConsole(coreRoot, project);
+  if (!bin) {
+    console.error(NOT_INSTALLED);
+    process.exitCode = 2;
+    return;
+  }
+  // stderr, so stdout carries only the Console's own one line (093 IC-002).
+  console.error(`doflow ui: using ${bin}`);
+  const args = [bin, '--core', path.join(coreRoot, 'bin', 'doflow.js')];
+  if (o.positional.length > 0) args.push('--project', project);
+  if (port !== undefined) args.push('--port', port);
+  if (o.listenAddress !== undefined) args.push('--listen-address', o.listenAddress);
+  if (o.tlsCert !== undefined) args.push('--tls-cert', o.tlsCert);
+  if (o.tlsKey !== undefined) args.push('--tls-key', o.tlsKey);
+  const child = spawn(process.execPath, args, { stdio: 'inherit' });
+
+  // Stay up until the Console exits, so its exit code is ours. A terminal Ctrl-C already reaches the
+  // Console through the process group; it is forwarded as SIGTERM, which the Console handles once
+  // separately from SIGINT, so the second delivery does not cut its 2 s shutdown short.
+  const forward = () => { child.kill('SIGTERM'); };
+  process.on('SIGINT', forward);
+  process.on('SIGTERM', forward);
+  return new Promise((resolve) => {
+    let settled = false;
+    const settle = (finish            ) => {
+      if (settled) return;
+      settled = true;
+      process.off('SIGINT', forward);
+      process.off('SIGTERM', forward);
+      finish();
+      resolve();
+    };
+    child.on('error', (error     ) => settle(() => {
+      console.error(`doflow ui: cannot start ${bin}: ${error.message}`);
+      process.exitCode = 1;
+    }));
+    // Killed by a signal: die by the same signal, the shell's own way of forwarding it.
+    child.on('exit', (code               , signal               ) => settle(() => {
+      if (signal) process.kill(process.pid, signal);
+      else process.exitCode = code ?? 1;
+    }));
+  });
+}
+
+module.exports = cmdUi;

package/src/cli/commands/update.js

@@ -19,7 +19,7 @@ const { loadRegistry } = require('../../registry/index.js');
 const { storageAfterInstall } = require('../../runtime/storage/upkeep.js');
 const { applyLifecycle, recordMcpOwnership, retentionSummary } = require('../../lifecycle/index.js');
 const {
-  codexScope, registryLifecycleView, printRegistryLifecycle, printPlanNotices, assertSafeRegistryPlan,
+  codexScope, registryLifecycleView, printRegistryLifecycle, printRetiredPlans, printPlanNotices, assertSafeRegistryPlan,
   lockDocument, lockDelta, recordLock,
 } = require('../../lifecycle/view.js');
 const {
@@ -51,7 +51,7 @@ function cmdUpdate(o     )       {
     // One lifecycle view across every requested target — computed unconditionally (not only under
     // --dry-run) so its safety gate and its plan are the exact same object the real apply below uses.
     const lifecycleView = registryLifecycleView({ registry, repoRoot: REPO_ROOT, scope, dirs, targets,
-      mcpSelections: selection.selections, mcpAdoptable: selection.adoptable, retainedMcpIds: selection.retainedMcpIds,
+      mcpSelections: selection.selections, mcpAdoptable: selection.adoptable, retainedMcpIds: selection.retainedMcpIds, operation: 'update',
       force: o.force, permissions: o.permissions === true, statusline: o.statusline === true });
     if (!lifecycleView.plan.safe) { assertSafeRegistryPlan(lifecycleView); return; }
     printMcpSelection(lifecycleView, selection.sources, { requested: o.mcp, prefix: o.dryRun ? '[DRY]' : '[INFO]' });
@@ -139,6 +139,7 @@ function cmdUpdate(o     )       {
       const owned = result.ledger.resources.filter((resource     ) => resource.harness === target.harness).length;
       console.log(`[INFO] ${target.harness}: lifecycle verified (${owned} owned resource(s))`);
     }
+    printRetiredPlans(lifecycleView);
     printPlanNotices(lifecycleView);
     // As remove does: a file this update leaves standing because a harness outside the run still
     // claims it is said, not implied. The per-file prune and keep lines are the plan notices above.