create-agentic-workspace 0.15.0 → 0.16.0

package/README.md

@@ -33,6 +33,17 @@ it does invoke `claude` (bounded by a closed allowlist — see its own README).
 - Scaffolds a seven-file, schema-valid workspace seed.
 - Re-running is a **reconcile with a drift report** — an edited managed file is reported
   `drifted` and left byte-identical, never overwritten. Never-clobber is unconditional.
+- The permission-floor reconcile is additive with ONE narrow exception: a row shaped exactly like
+  the floor's own root-glob rows (`Bash(<plugin-root-glob>/scripts/<name>[ <sub>]:*)`), whose
+  `(name, sub)` PAIR — not the script name alone — the shipped floor no longer declares, is retired
+  from `allow`/`ask` and printed `[retired] <row>`. The pair, not just the name, matters: retiring
+  one subcommand of a script that still ships other subcommands (say `<name> --a:*` is dropped
+  while `<name> --b:*` remains) removes only the stale `(name, sub)` row, never the whole family —
+  and a script deleted outright does not leave a standing grant behind for a future script with the
+  same name to inherit unreviewed. Any row of another shape (an adopter-authored rule naming a
+  plugin script through a different prefix, or a `deny` row) is never touched. The summary line
+  reports all three outcomes together:
+  `permission-floor reconcile: … — N added, M retired, K unchanged`.
 - `.gitignore` gets its own narrower reconcile on top of that: the file also carries a
   `FOUNDRY-RUNTIME-GITIGNORE-BEGIN`/`-END` managed block, converged independently of the
   whole-file compare above (so an adopter's own surrounding lines never block it from catching

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-agentic-workspace",
-  "version": "0.15.0",
+  "version": "0.16.0",
   "description": "The pre-session bootstrap wizard for an Agentic Foundry workspace: declares (never grants) the permission floor, absorbs foundry-bootstrap.sh's out-of-session identity wiring, and scaffolds a seven-file schema-valid workspace. Zero dependencies, no lifecycle scripts, no telemetry.",
   "license": "MIT",
   "type": "module",
@@ -34,7 +34,7 @@
     "marketplace_name": "agentic-foundry",
     "marketplace_repo": "lukasrepublic/agentic-foundry",
     "plugin_name": "foundry",
-    "plugin_version": "1.15.0",
+    "plugin_version": "1.16.0",
     "pins_researched": "2026-08-02"
   }
 }

package/permission-floor.json

@@ -1,7 +1,7 @@
 {
   "schema_version": 1,
   "plugin_root_glob": "~/.claude/plugins/cache/*/foundry/*",
-  "generated_for_plugin_version": "1.15.0",
+  "generated_for_plugin_version": "1.16.0",
   "entries": [
     {
       "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry-acceptance-contract-validate.py:*)",
@@ -298,6 +298,16 @@
       "tier": "ask",
       "rationale": "ceremony: --create arrives after other args, not prefix-keyable, so the whole script is ask"
     },
+    {
+      "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry-worktree-gc.py --dry-run:*)",
+      "tier": "allow",
+      "rationale": "read-only classification of every worktree/branch matching the discipline's naming glob; --apply below is the deletion tier (branch-and-worktree-discipline, AC-BWD-2)"
+    },
+    {
+      "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry-worktree-gc.py --apply:*)",
+      "tier": "ask",
+      "rationale": "deletes the merged class's worktrees + local (git branch -d, falling back to -D only on that refusal, narrated) AND remote branches (git worktree remove, git push origin --delete) -- a repo-state mutation, ask like foundry-merge-when-green.py's own merge call, never a self-grant"
+    },
     {
       "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry_command_deck.py:*)",
       "tier": "allow",

package/src/floorReconcile.mjs

@@ -7,9 +7,15 @@
 // handbooks are missing the entire floor as a result.
 //
 // This module converges the target's `permissions` block by ADDING the rules the classifier named.
-// Nothing is removed, nothing is reordered. The desired state is the shipped constant, the current
-// state is what the classifier reads, and the write is the delta — recomputed every run, which is
-// why no ledger is needed and why a second run is silent.
+// Nothing is reordered. The desired state is the shipped constant, the current state is what the
+// classifier reads, and the write is the delta — recomputed every run, which is why no ledger is
+// needed and why a second run is silent.
+//
+// AC-FRR-1 (ER #199, floor-retires-rows) adds the ONE narrow exception: a row shaped exactly like
+// the floor's own root-glob rows, whose script name(+sub) the shipped map no longer declares, is
+// removed from `allow`/`ask` — see `planRetirements`/`applyRetirements` below. Nothing else about
+// the additive design above changes: an adopter-authored row of any other shape still survives
+// forever, and `deny` is never touched by either side.
 //
 // THE WRITE IS THIS CLI'S FIRST TO A PATH THAT ALREADY EXISTS, and every anti-clobber control in
 // the codebase is structurally unavailable to it. `applyPlan` opens O_EXCL, create-only, refusing
@@ -23,9 +29,10 @@
 //     rather than its letter.
 // One mechanism answers all three: confinement join + LINK-LEVEL stat + temp-in-.claude + rename.
 import fs from 'node:fs';
+import os from 'node:os';
 import path from 'node:path';
 import { confinedJoin, RefusalError } from './util.mjs';
-import { buildSettings } from './permissionFloor.mjs';
+import { buildSettings, classifyDrift } from './permissionFloor.mjs';
 
 /** The drift classes whose findings name a rule this module may ADD. Everything else the
  * classifier can emit is report-only: blanket-allow, ask-shadowed, ask-shadowed-ceremony and
@@ -157,6 +164,115 @@ export function planAdditions({ findings, map, settingsObj, pins }) {
   return { additions, total, pin, withheldAllow, blanket, pinsVersion: pins.plugin_version };
 }
 
+// ── AC-FRR-1/-2 (floor-retires-rows, ER #199). ───────────────────────────────────────────────────
+//
+// The reconcile above only ever ADDS: every pre-existing rule survives forever, even the ones the
+// shipped floor itself no longer declares. Concretely: v1.15.0 deleted four fleet scripts (#196)
+// and dropped their four `allow` rows from cli/permission-floor.json, and every workspace scaffolded
+// or reconciled at an earlier version keeps those four `allow` rules with nothing to remove them —
+// a script with the same name landing later would silently inherit a grant nobody re-authorized.
+//
+// Retirement is deliberately NARROWER than the addition side's classifyDrift/covers() fold: it
+// compares a row's LITERAL text against the floor's OWN `plugin_root_glob` text (never resolved
+// against a real filesystem path, never folded across `~`/`$HOME`/an interpreter word), because the
+// question here is "did the FLOOR ITSELF write this exact shape", not "does some broader rule cover
+// the reach this map entry names". A row of any other shape — a different prefix, a hand-authored
+// rule naming the same script through a bare path, a `deny` row — is never a retirement candidate
+// (AC-FRR-2): only a row shaped exactly like the ones `buildSettings`/the reconcile itself would
+// write is the floor's own to take back.
+
+const ROOT_SHAPE_NAME_RE = '[A-Za-z0-9_.-]+';
+
+/** Escape every regex metacharacter in `glob`, INCLUDING `*` — the floor's own glob text is matched
+ * LITERALLY here (an actual `*` character in the permission rule's text), never expanded against a
+ * filesystem. Sibling of foldRegexFromGlob in permissionFloor.mjs, which instead treats `*` as a
+ * wildcard for the addition-side coverage fold; the two escape functions look alike and answer two
+ * different questions on purpose. */
+function escapeLiteral(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+
+/** Build the regex that recognizes the floor's own row shape over ITS OWN `plugin_root_glob`:
+ * `Bash(<plugin_root_glob>/scripts/<name>[ <sub>]:*)`. Derived from the map's own glob text, never
+ * a second hardcoded copy of it — the same one-source-of-truth reasoning foldRegexFromGlob already
+ * documents for the addition side. */
+function floorRootShapeRe(pluginRootGlob) {
+  return new RegExp(`^Bash\\(${escapeLiteral(pluginRootGlob)}/scripts/(${ROOT_SHAPE_NAME_RE})(?: (.+))?:\\*\\)$`);
+}
+
+/** Parse `rule` against the floor's own root-glob shape (the same shape `buildSettings` writes).
+ * Returns `{ name, sub }` (`sub` is `null` for a bare `<name>:*` row) when `rule` is of exactly this
+ * shape, `null` for any other shape at all — including the map's own bare, non-`:*` exception
+ * (`foundry-doctor.py)` with no trailing marker) and every adopter-authored rule that merely NAMES a
+ * plugin script through a different prefix or with no plugin-root glob (AC-FRR-2). Exported for the
+ * differential/fixture tests that need to assert the shape gate directly. */
+export function parseFloorRootShape(rule, pluginRootGlob) {
+  if (typeof pluginRootGlob !== 'string' || pluginRootGlob === '') return null;
+  const m = floorRootShapeRe(pluginRootGlob).exec(rule);
+  if (!m) return null;
+  return { name: m[1], sub: m[2] ?? null };
+}
+
+/** A collision-free key for the `(name, sub)` pair — `JSON.stringify` of a 2-tuple rather than a
+ * string concatenation with a hand-picked separator, which a `sub` containing that exact separator
+ * (an unlikely but not-impossible flag value) could otherwise fold into a DIFFERENT pair's key. */
+function rootNameKey(parsed) {
+  return JSON.stringify([parsed.name, parsed.sub]);
+}
+
+/** The (name, sub) pairs the SHIPPED map itself declares, each parsed through the exact same shape
+ * matcher used to recognize a target row — never a second, hand-written enumeration of script
+ * names, which is precisely how the two could drift apart. A map entry of another shape (there is
+ * none today, but the parser must not silently assume one) contributes nothing here. */
+function shippedRootNames(map) {
+  const set = new Set();
+  for (const e of map.entries) {
+    const parsed = parseFloorRootShape(e.rule, map.plugin_root_glob);
+    if (parsed) set.add(rootNameKey(parsed));
+  }
+  return set;
+}
+
+/** Compute the rows the reconcile SHALL remove (AC-FRR-1), WITHOUT touching the filesystem. Every
+ * `allow`/`ask` row shaped exactly like the floor's own root-glob rows, whose `(name, sub)` pair the
+ * shipped map no longer declares, is queued for removal. `deny` is never a candidate (AC-FRR-2) —
+ * retirement only narrows a grant or a prompt, and a deny row read back as "extra" is, if anything,
+ * a reason to leave it exactly where the operator (or an earlier release) put it. Returns
+ * `{ retirements: { allow: [...], ask: [...] }, total }`. */
+export function planRetirements({ settingsObj, map }) {
+  const shipped = shippedRootNames(map);
+  const retirements = { allow: [], ask: [] };
+  const perms = (settingsObj && settingsObj.permissions) || {};
+  for (const tier of ['allow', 'ask']) {
+    for (const rule of perms[tier] || []) {
+      const parsed = parseFloorRootShape(rule, map.plugin_root_glob);
+      if (!parsed) continue; // not the floor's own shape at all -> never touched (AC-FRR-2)
+      if (!shipped.has(rootNameKey(parsed))) retirements[tier].push(rule);
+    }
+  }
+  const total = retirements.allow.length + retirements.ask.length;
+  return { retirements, total };
+}
+
+/** Apply a retirement plan to a parsed settings object, returning a NEW object. Pure — no I/O.
+ * Removes exactly the named rows from `allow`/`ask`, preserving every surviving rule's text and
+ * relative order; `deny` and every other top-level key pass through untouched. Composed with
+ * `applyAdditions` at the call site — the two touch disjoint rule sets by construction (a row
+ * cannot simultaneously be absent-from-target-and-in-the-map, which is what `applyAdditions` adds,
+ * and present-in-target-and-absent-from-the-map, which is what this removes). */
+export function applyRetirements(settingsObj, retirementPlan) {
+  const next = { ...settingsObj };
+  const perms = { ...(settingsObj.permissions || {}) };
+  for (const tier of ['allow', 'ask']) {
+    const toRemove = new Set(retirementPlan.retirements[tier]);
+    if (toRemove.size === 0) continue;
+    const existing = Array.isArray(perms[tier]) ? perms[tier] : [];
+    perms[tier] = existing.filter((rule) => !toRemove.has(rule));
+  }
+  next.permissions = perms;
+  return next;
+}
+
 /** Apply a plan to a parsed settings object, returning a NEW object. Pure — no I/O.
  *
  * Additive by construction: every pre-existing rule keeps its text, its tier and its position
@@ -186,6 +302,39 @@ export function applyAdditions(settingsObj, plan, { map, pins }) {
   return next;
 }
 
+// ── AC-FRR-1 review round 1: additions MUST be planned against the POST-retirement rule set ────
+//
+// Computing `planAdditions` over the raw (pre-retirement) tracked rules is a real, one-cycle
+// defect, not a hypothetical: the addition side's `covers()` is a PREFIX fold — a `:*`-suffixed
+// effective rule covers every narrower reach beneath it — so a bare `Bash(<glob>/scripts/foo:*)`
+// row a workspace still carries covers BOTH `Bash(<glob>/scripts/foo --a:*)` and
+// `Bash(<glob>/scripts/foo --b:*)` map entries a map restructure might split it into. Planned in
+// that order, a SINGLE reconcile pass would retire the bare row (its exact `(foo, null)` pair is
+// no longer in the shipped map) while adding NEITHER split row (the pre-retirement classification
+// still sees the bare row "covering" them) — the grant for that script is gone until a SECOND run
+// notices the split rows are now genuinely absent. `planReconcile` closes the gap by re-deriving
+// the tracked rules from the ALREADY-RETIRED settings object before classifying what to add, so
+// the two sides compose into one correct delta in one pass. This is the ONLY entry point either
+// call site (run.mjs's `--existing` path, update.mjs's Phase 4) should use from here on — never
+// `planAdditions`/`planRetirements` called separately against the same raw settingsObj.
+
+/** Compute both plans, correctly composed: retirement first, additions against the resulting
+ * (post-retirement) rule set. Returns `{ additionsPlan, retirementPlan }`; `additionsPlan.settingsObj`
+ * is the POST-retirement object — the one `applyAdditions` must be called against, so the caller
+ * never needs to call `applyRetirements` a second time on top of it. */
+export function planReconcile({
+  settingsObj, map, pins, pluginRootExpansion = [], unreadableOrigins = [], home = os.homedir(),
+}) {
+  const retirementPlan = planRetirements({ settingsObj, map });
+  const postRetirementSettingsObj = applyRetirements(settingsObj, retirementPlan);
+  const findings = classifyDrift(map, readTrackedRules(postRetirementSettingsObj), {
+    pluginRootExpansion, unreadableOrigins, home,
+  });
+  const additionsPlan = planAdditions({ findings, map, settingsObj: postRetirementSettingsObj, pins });
+  additionsPlan.settingsObj = postRetirementSettingsObj;
+  return { additionsPlan, retirementPlan };
+}
+
 /** Resolve the target settings path, refusing anything that is not a regular file inside the root.
  * lstat, NOT stat: statSync().isFile() follows a symlink, so an in-root link would pass. */
 export function resolveTarget(physicalRoot) {
@@ -246,17 +395,32 @@ export function writeTargetAtomically(targetPath, obj) {
 
 /** Render the plan for the operator: every rule that would be added, with its tier, plus the
  * per-tier counts and any qualifier. Used for both the dry-run report and the post-write one, so
- * the two cannot describe the same plan differently. */
-export function renderPlan(plan, { applied }) {
+ * the two cannot describe the same plan differently.
+ *
+ * AC-FRR-1: when `retirementPlan` is supplied (both call sites in this codebase always supply
+ * one), every row it names prints as `[retired] <row>` — same tag whether this is a dry-run
+ * preview or a just-applied report, because the row itself does not become "more retired" for
+ * having actually been removed — and the summary line gains `N added, M retired, K unchanged` in
+ * the SAME line as the existing per-tier addition counts, never a second, separately-findable
+ * report. `K unchanged` is the shipped floor's own row count minus what this run added — the rows
+ * that needed no action at all, additions and retirements both being actions. */
+export function renderPlan(plan, { applied, retirementPlan = null, mapEntryCount = null }) {
   const lines = [];
   const verb = applied ? 'added' : 'would add';
   for (const tier of ['allow', 'ask', 'deny']) {
     for (const rule of plan.additions[tier]) lines.push(`  [${tier}] ${rule}`);
   }
-  lines.push(
-    `permission-floor reconcile: ${verb} ` +
-      ['allow', 'ask', 'deny'].map((t) => `${t}=${plan.additions[t].length}`).join(', '),
-  );
+  if (retirementPlan) {
+    for (const tier of ['allow', 'ask']) {
+      for (const rule of retirementPlan.retirements[tier]) lines.push(`  [retired] ${rule}`);
+    }
+  }
+  let summary = `permission-floor reconcile: ${verb} ` +
+      ['allow', 'ask', 'deny'].map((t) => `${t}=${plan.additions[t].length}`).join(', ');
+  if (retirementPlan && typeof mapEntryCount === 'number') {
+    summary += ` — ${plan.total} added, ${retirementPlan.total} retired, ${mapEntryCount - plan.total} unchanged`;
+  }
+  lines.push(summary);
   if (plan.pin.state === 'absent') {
     lines.push(`  + marketplace pin added — the bundled allow rules are wildcarded across the plugin cache and are bounded only by it`);
   } else if (plan.pin.state === 'pinned') {

package/src/run.mjs

@@ -15,8 +15,7 @@ import { planManagedFiles, applyPlan, exitCodeForPlan } from './reconcile.mjs';
 import { renderPreview, TRUST_HANDOFF_TEXT } from './preview.mjs';
 import { validateSlug, resolveIdentity, wireIdentity, plannedMachineScopeWrites } from './identity.mjs';
 import {
-  resolveTarget, readTarget, readTrackedRules, planAdditions, applyAdditions,
-  writeTargetAtomically, renderPlan,
+  resolveTarget, readTarget, applyAdditions, planReconcile, writeTargetAtomically, renderPlan,
 } from './floorReconcile.mjs';
 import { reconcileGitignorePlan, applyGitignorePlan, renderGitignoreRow } from './gitignoreReconcile.mjs';
 
@@ -198,18 +197,25 @@ export async function runCli(argv, { cwd, isTTY, input, output, homeDir, pkgDir
     // would stay incomplete while the report said converged — and the repo would then ship to every
     // other clone and to CI without it.
     let floorPlan = null;
+    let floorRetirementPlan = null;
     let floorTarget = null;
     if (answers.reconcileFloor) {
       floorTarget = resolveTarget(physicalRoot);
       if (floorTarget.present) {
         const settingsObj = readTarget(floorTarget.path);
-        const trackedFindings = classifyDrift(map, readTrackedRules(settingsObj), {
-          pluginRootExpansion, unreadableOrigins: [], home: homeDir,
+        // AC-FRR-1 (ER #199, review round 1): retirement first, additions planned against the
+        // POST-retirement rule set — never against the raw settingsObj directly. See
+        // floorReconcile.mjs's own comment on planReconcile for why the other order loses a grant
+        // for one cycle across a map restructure.
+        const { additionsPlan, retirementPlan } = planReconcile({
+          settingsObj, map, pins, pluginRootExpansion, unreadableOrigins: [], home: homeDir,
         });
-        floorPlan = planAdditions({ findings: trackedFindings, map, settingsObj, pins });
-        floorPlan.settingsObj = settingsObj;
+        floorPlan = additionsPlan;
+        floorRetirementPlan = retirementPlan;
         print('');
-        for (const line of renderPlan(floorPlan, { applied: false })) print(line);
+        for (const line of renderPlan(floorPlan, {
+          applied: false, retirementPlan: floorRetirementPlan, mapEntryCount: map.entries.length,
+        })) print(line);
       } else {
         // absent settings.json is the CREATE path's business, not this one's — the managed-file
         // plan above already writes the full floor for it, and racing that would duplicate it
@@ -223,7 +229,9 @@ export async function runCli(argv, { cwd, isTTY, input, output, homeDir, pkgDir
     // permission floor unattended; --yes must be given EXPLICITLY. This sits above applyPlan
     // deliberately — a "refused" verdict printed after the scaffold write had already landed reads
     // as "nothing happened", which is the one thing it must not mean.
-    if (floorPlan && floorPlan.total > 0 && !isTTY && answers.yes !== true) {
+    const floorHasWork = Boolean(floorPlan)
+      && (floorPlan.total > 0 || (floorRetirementPlan && floorRetirementPlan.total > 0));
+    if (floorHasWork && !isTTY && answers.yes !== true) {
       throw new RefusalError(
         'refusing --reconcile-floor without a terminal: pass --yes explicitly to confirm the write',
         'reconcile-floor',
@@ -252,10 +260,15 @@ export async function runCli(argv, { cwd, isTTY, input, output, homeDir, pkgDir
     // --reconcile-floor's pre-write refusal exists for.
     applyGitignorePlan(gitignorePlan);
 
-    if (floorPlan && floorPlan.total > 0) {
+    if (floorHasWork) {
+      // floorPlan.settingsObj is ALREADY post-retirement (planReconcile derived it that way) —
+      // applyAdditions composes onto it directly; a second applyRetirements call here would be
+      // retiring an object that was never given the rows back in the first place.
       writeTargetAtomically(floorTarget.path, applyAdditions(floorPlan.settingsObj, floorPlan, { map, pins }));
       print('');
-      for (const line of renderPlan(floorPlan, { applied: true })) print(line);
+      for (const line of renderPlan(floorPlan, {
+        applied: true, retirementPlan: floorRetirementPlan, mapEntryCount: map.entries.length,
+      })) print(line);
     }
 
     if (slug) {

package/src/update.mjs

@@ -8,11 +8,11 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { RefusalError, physicalResolve } from './util.mjs';
-import { loadMap, buildSettings, classifyDrift } from './permissionFloor.mjs';
+import { loadMap, buildSettings } from './permissionFloor.mjs';
 import { buildManagedFiles } from './scaffold.mjs';
 import { planManagedFiles, applyPlan } from './reconcile.mjs';
 import {
-  resolveTarget, readTarget, readTrackedRules, planAdditions, applyAdditions, writeTargetAtomically,
+  resolveTarget, readTarget, applyAdditions, planReconcile, writeTargetAtomically, renderPlan,
 } from './floorReconcile.mjs';
 import { reconcileGitignorePlan, applyGitignorePlan, renderGitignoreRow } from './gitignoreReconcile.mjs';
 import {
@@ -153,14 +153,18 @@ export async function runUpdate(argv, { cwd, configDir, homeDir, pkgDir, output,
     // captured plan verbatim in Phase 4 would silently clobber whatever Phase 1 just wrote —
     // Phase 4 therefore re-reads and recomputes the floor plan fresh, right before it writes.
     const floorTarget = resolveTarget(physicalRoot);
-    const previewFloorPlan = floorTarget.present
-      ? planAdditions({
-        findings: classifyDrift(map, readTrackedRules(readTarget(floorTarget.path)), {
-          pluginRootExpansion: [], unreadableOrigins: [], home: homeDir,
-        }),
-        map, settingsObj: readTarget(floorTarget.path), pins,
+    // AC-FRR-1 (ER #199, review round 1): retirement first, additions planned against the
+    // POST-retirement rule set — planReconcile is the ONLY entry point either the preview here or
+    // Phase 4 below should use; see its own comment in floorReconcile.mjs. PREVIEW-ONLY: Phase 4
+    // re-reads and recomputes fresh right before it writes, for the migration-clobber reason above.
+    const previewReconcile = floorTarget.present
+      ? planReconcile({
+        settingsObj: readTarget(floorTarget.path), map, pins,
+        pluginRootExpansion: [], unreadableOrigins: [], home: homeDir,
       })
       : null;
+    const previewFloorPlan = previewReconcile ? previewReconcile.additionsPlan : null;
+    const previewRetirementPlan = previewReconcile ? previewReconcile.retirementPlan : null;
 
     // gitignore-block-reconcile (ER #177, AC-GBR-1): PREVIEW-ONLY, same caveat as previewFloorPlan
     // above — `.gitignore` is not a migration target, but Phase 4 recomputes fresh from disk anyway,
@@ -195,6 +199,9 @@ export async function runUpdate(argv, { cwd, configDir, homeDir, pkgDir, output,
     for (const f of filePlan) previewLines.push(`  [${f.action}] ${f.relPath}`);
     if (previewFloorPlan) {
       previewLines.push(`  [permission-floor] would add allow=${previewFloorPlan.additions.allow.length}, ask=${previewFloorPlan.additions.ask.length}, deny=${previewFloorPlan.additions.deny.length}`);
+      if (previewRetirementPlan && previewRetirementPlan.total > 0) {
+        previewLines.push(`  [permission-floor] would retire allow=${previewRetirementPlan.retirements.allow.length}, ask=${previewRetirementPlan.retirements.ask.length}`);
+      }
     } else {
       previewLines.push('  [permission-floor] .claude/settings.json absent — left to the create path');
     }
@@ -252,16 +259,24 @@ export async function runUpdate(argv, { cwd, configDir, homeDir, pkgDir, output,
     // migration may have just rewritten this exact file (project scope's settings.json IS the
     // floor-reconcile target). Applying a stale pre-migration plan here would silently clobber it.
     let floorPlan = null;
+    let floorRetirementPlan = null;
     const freshFloorTarget = resolveTarget(physicalRoot);
     if (freshFloorTarget.present) {
       const settingsObj = readTarget(freshFloorTarget.path);
-      const findings = classifyDrift(map, readTrackedRules(settingsObj), {
-        pluginRootExpansion: [], unreadableOrigins: [], home: homeDir,
+      // AC-FRR-1 (ER #199, review round 1): the upgrader's own reconcile path — retirement first,
+      // additions planned against the POST-retirement rule set (planReconcile; see its comment in
+      // floorReconcile.mjs). `floorPlan.settingsObj` comes back already post-retirement, so the
+      // write below composes onto it directly — never a second `applyRetirements` call.
+      const { additionsPlan, retirementPlan } = planReconcile({
+        settingsObj, map, pins, pluginRootExpansion: [], unreadableOrigins: [], home: homeDir,
       });
-      floorPlan = planAdditions({ findings, map, settingsObj, pins });
-      floorPlan.settingsObj = settingsObj;
-      if (floorPlan.total > 0) {
-        writeTargetAtomically(freshFloorTarget.path, applyAdditions(settingsObj, floorPlan, { map, pins }));
+      floorPlan = additionsPlan;
+      floorRetirementPlan = retirementPlan;
+      if (floorPlan.total > 0 || floorRetirementPlan.total > 0) {
+        writeTargetAtomically(freshFloorTarget.path, applyAdditions(floorPlan.settingsObj, floorPlan, { map, pins }));
+        for (const line of renderPlan(floorPlan, {
+          applied: true, retirementPlan: floorRetirementPlan, mapEntryCount: map.entries.length,
+        })) print(line);
       }
     }
     // Recomputed FRESH from disk, same reasoning as floorPlan just above: never apply a plan
@@ -280,7 +295,8 @@ export async function runUpdate(argv, { cwd, configDir, homeDir, pkgDir, output,
     }
 
     const anyCreated = filePlan.some((f) => f.action === 'create');
-    const anyFloorAdded = Boolean(floorPlan && floorPlan.total > 0);
+    const anyFloorAdded = Boolean(floorPlan && floorPlan.total > 0)
+      || Boolean(floorRetirementPlan && floorRetirementPlan.total > 0);
     const anyGitignoreChanged = Boolean(
       freshGitignorePlan && (freshGitignorePlan.action === 'converged' || freshGitignorePlan.action === 'appended'),
     );