Refactor setup commands and enhance version management features

AGENTS.md

@@ -64,7 +64,7 @@ src/
     nupm.rs            — `numan nupm status|inspect|import|diff`: nupm discovery + import + drift (Phase 6.1–6.3)
     completions.rs     — `numan completions <shell>`: bash/fish/zsh/powershell/nushell scripts (Phase 7.3)
     setup.rs           — `numan setup nu [VERSION]|remove|path|use <path>` + `setup loader`: Nushell bootstrap + nushell-loader install
-    try_cmd.rs         — `numan try [--no-activate]`: curated starter install + activate for current Nu
+    try_cmd.rs         — `numan try [--yes] [--no-activate]`: curated starter install + activate for current Nu
     use_cmd.rs         — `numan use <version>|latest|list`: activates a previously installed managed Nu version (no auto-download); writes the active-version marker after a PreMutation snapshot under the root mutation lock
     nu_pin_offer.rs    — Shared TTY offer to `setup nu <version>` + `init --refresh` on Nu mismatch
   install/
@@ -144,7 +144,7 @@ tests/
 - **Activation scope**: `PluginActivation` struct stores `(nu_executable_sha256, nu_version, plugin_registry_path)`; a plugin is "active" only when all three match the current `NuPaths` — bare `bool` would go stale after `numan init --refresh`
 - **Journal**: `state/pending-activation.json` written as all-`prepared` before first registration; each entry advances to `registered` atomically before lockfile update; reconciled on next `activate` run if process is interrupted
 - **Plugin deactivate journal**: `state/pending-plugin-deactivate.json` (`Prepared` → `Unregistered` → clear lockfile `activation`); reconciled on next `deactivate`; doctor warns `journal.plugin_deactivate_pending`
-- **Migration journal**: `state/migration-journal.json` for the legacy-Nu single-binary → versioned layout transition. Stages `Prepared` (before `create_dir_all`) → `Renamed` (after legitimate `rename`) → `Active` (after `write_active_version`); journal deleted on transition to `Active`. Every well-formed pending journal stage (`Prepared`, `Renamed`, and `Active`) is reconciled by `numan doctor --fix` (Auto-tier, fix hint `numan use`) and by the self-healing `reconcile(root)?` at the top of every `migrate_legacy_install_with_detector` call; file-system truth takes precedence over journal stage when they disagree. Unreadable or schema-mismatched journals emit `journal.migration_invalid` (Error severity, Manual repair tier: delete the stale journal); they are not auto-reconciled.
+- **Migration journal**: `state/migration-journal.json` for the legacy-Nu single-binary → versioned layout transition. Stages `Prepared` (before `create_dir_all`) → `Renamed` (after legitimate `rename`) → `Active` (after `write_active_version`); journal deleted on transition to `Active`. Every well-formed pending journal stage (`Prepared`, `Renamed`, and `Active`) is reconciled by `numan doctor --fix` (Auto-tier, fix hint `numan use`) and by the self-healing `reconcile(root)?` at the top of every `migrate_legacy_install_with_detector` call; file-system truth takes precedence over journal stage when they disagree. Unreadable or schema-mismatched journals emit `journal.migration_invalid` (Error severity, Manual repair tier: delete the stale journal); they are not auto-reconciled. `reconcile` refuses to act when `tools/nushell` is a symlink or reparse point (`assert_not_symlink` guard); the journal is left unchanged on that path so a follow-up attempt can succeed once the symlink is resolved. A `Prepared`-stage orphan directory that cannot be removed (e.g. ENOTEMPTY) causes `reconcile` to return `Err` and retain the journal so the next invocation can retry.
 - **Active version marker**: `nu_state/active-version.json` (`{ "version": "X.Y.Z" }`, optionally `{ "version": "X.Y.Z", "binary_path": "/abs/path/to/nu" }` for off-tree selections). Sole authority for which `tools/nushell/<v>/` is selected. Written by `numan setup nu` and `numan use <version>|latest`. The optional `binary_path` records the resolved off-tree binary when `numan setup nu use <path>` swaps to a user-supplied Nu so subsequent `numan use list` and `find_nu_executable_with_root` can resolve the chosen version even when no on-tree install exists (the field uses `#[serde(default, skip_serializing_if = "Option::is_none")]` so the on-disk shape stays `{ "version": ... }` for on-tree selections and pre-existing markers still load).
 - **Atomic writes**: all JSON state files (lockfile, journal, nu_state/paths.json) use `write_json_atomic` (tempfile in same dir + persist) — no partial-write corruption
 - **Function signatures**: use `&Path` not `&PathBuf` in function parameters (clippy::ptr_arg is CI-enforced)

src/cmd/doctor.rs

@@ -1185,6 +1185,35 @@ fn apply_repairs(
 
     drop(lock.take());
 
+    // Reconcile pending migration journals BEFORE off-PATH Nu registration.
+    // A Prepared orphan empty `<version>/` under tools/nushell makes
+    // `setup nu use` refuse without `--force`; cleaning it first lets one
+    // `doctor --fix` pass complete both repairs.
+    if findings
+        .iter()
+        .any(|f| f.id == "journal.migration_pending" && f.severity == Severity::Warn)
+    {
+        let id = "journal.migration_repaired".to_string();
+        let _migration_repair_lock = acquire_mutation_lock(root)?;
+        match migration_journal::reconcile(root) {
+            Ok(Some(_)) => records.push(RepairRecord {
+                id,
+                status: RepairStatus::Applied,
+                reason: None,
+            }),
+            Ok(None) => records.push(RepairRecord {
+                id,
+                status: RepairStatus::Skipped,
+                reason: None,
+            }),
+            Err(e) => records.push(RepairRecord {
+                id,
+                status: RepairStatus::Failed,
+                reason: Some(e.to_string()),
+            }),
+        }
+    }
+
     if findings
         .iter()
         .any(|f| f.id == "nu.binary.found_off_path" && f.severity == Severity::Warn)
@@ -2386,14 +2415,36 @@ mod tests {
         .save(root)
         .unwrap();
 
-        let args = DoctorArgs {
+        // Capture the findings first so we can call apply_repairs directly and
+        // inspect the returned RepairRecord list.
+        let scan_args = DoctorArgs {
+            scan: true,
+            json: false,
+            nupm_home: None,
+        };
+        let report = run_checks_with_options(&scan_args, root, &test_doctor_options()).unwrap();
+
+        let fix_args = DoctorArgs {
             scan: false,
             json: false,
             nupm_home: None,
         };
-        let _ = execute_with_options(&args, root, test_doctor_options()).unwrap();
+        let records =
+            apply_repairs(&fix_args, root, &report.findings, &test_doctor_options()).unwrap();
+
+        // The repair record for the migration journal must be Applied.
+        let rec = records
+            .iter()
+            .find(|r| r.id == "journal.migration_repaired")
+            .expect("journal.migration_repaired repair record must be present");
+        assert_eq!(
+            rec.status,
+            RepairStatus::Applied,
+            "migration journal repair must be Applied, got: {:?}",
+            rec.status
+        );
 
-        // After `doctor --fix`: the empty subdir AND the journal must be gone.
+        // After repair: the empty subdir AND the journal must be gone.
         assert!(
             !tools.join("0.113.1").exists(),
             "empty versioned subdir must be removed by reconcile"
@@ -2404,6 +2455,51 @@ mod tests {
         );
     }
 
+    /// A well-formed journal with an unknown `schema_version` must surface a
+    /// `journal.migration_invalid` finding (Error severity, Manual repair tier)
+    /// and must NOT produce a `journal.migration_pending` finding.
+    #[test]
+    fn doctor_reports_unsupported_schema_version_as_invalid() {
+        let dir = TempDir::new().unwrap();
+        let root = dir.path();
+
+        // Construct a well-formed JSON journal with an unsupported schema_version.
+        let journal_path = PendingMigration::journal_path(root);
+        std::fs::create_dir_all(journal_path.parent().unwrap()).unwrap();
+        let content = serde_json::json!({
+            "schema_version": 9999,
+            "version": "0.113.1",
+            "stage": "prepared"
+        });
+        std::fs::write(&journal_path, serde_json::to_vec(&content).unwrap()).unwrap();
+
+        let report = run_checks_with_options(
+            &DoctorArgs {
+                scan: true,
+                json: false,
+                nupm_home: None,
+            },
+            root,
+            &test_doctor_options(),
+        )
+        .unwrap();
+
+        let invalid = report
+            .findings
+            .iter()
+            .find(|f| f.id == "journal.migration_invalid")
+            .expect("journal.migration_invalid must be reported for unknown schema_version");
+        assert_eq!(invalid.severity, Severity::Error);
+        assert_eq!(invalid.repair, RepairTier::Manual);
+        assert!(
+            report
+                .findings
+                .iter()
+                .all(|f| f.id != "journal.migration_pending"),
+            "migration_pending must NOT be reported alongside migration_invalid"
+        );
+    }
+
     /// PR69 WCk regression: a malformed `migration-journal.json` must
     /// surface a `journal.migration_invalid` finding at Error severity with
     /// a Manual repair tier. Previously the report silently dropped the

src/cmd/remove.rs

@@ -35,6 +35,14 @@ fn execute_with_tty(args: &RemoveArgs, root: &Path, is_tty: bool) -> Result<()>
     // Refuse unattended (non-TTY) sessions without explicit --yes so safe-batch
     // automation has to opt in; interactive sessions keep the existing flow.
     crate::util::confirm::require_tty_or_yes_with_seam(args.yes, "package removal", is_tty)?;
+    crate::util::confirm::confirm_or_bail(
+        &format!(
+            "Remove package '{}' ? This deletes its payload.",
+            args.package
+        ),
+        args.yes,
+        "Cancelled.",
+    )?;
 
     let _lock = acquire_mutation_lock(root)?;