Verify replacement actually landed before retiring stale toggle artifacts

The command<->skills toggle cleanup added for #2948 deferred destructive
removal of the old-mode artifact until after the replacement registration
call completed without raising. That was necessary but not sufficient:
none of _register_skills(), _register_commands(),
register_commands_for_agent(), or _register_extension_skills() raise on
a missing source template, a safety-validation skip, or a corrupted
manifest entry — they simply return an empty or partial result. Treating
"did not raise" as "fully replaced" meant a stale artifact could still be
deleted (or its tracking dropped) even though its specific replacement
never actually landed, leaving neither artifact in place for that logical
command/skill.

Fix all four affected toggle directions by checking the replacement
call's actual return value before allowing any destructive step:

- presets command->skills (register_enabled_presets_for_agent): only
  unregister a stale command name once its corresponding skill name
  (via the existing _skill_names_for_command() helper) is confirmed
  present in the skills call's returned names for that agent; the
  remainder stays tracked and on disk.
- presets skills->command (register_enabled_presets_for_agent): only
  unregister a stale skill name once its corresponding command name is
  confirmed present in the commands call's returned names for that
  agent, using the same helper.
- extensions skills->command (register_enabled_extensions_for_agent):
  only remove a skill mirror once the matching command (mapped via the
  existing HookExecutor._skill_name_from_command() helper) is confirmed
  present in register_commands_for_agent's returned names.
- extensions command->skills (register_enabled_extensions_for_agent):
  only remove a deferred stale command once its matching skill name is
  confirmed present in _register_extension_skills()'s returned names.

All four reuse the existing command<->skill name-derivation helpers
rather than inventing new mapping logic. Registry tracking is updated to
retain exactly the unreplaced subset rather than being popped wholesale,
so partially-successful toggles leave correct, minimal tracking behind.

Added 8 new regression tests (4 presets, 4 extensions) covering both the
fully-empty and genuinely-partial result cases for each of the four
toggle directions, using real missing-source-file scenarios (not mocked
return values) to exercise the actual code paths. Confirmed red before
the fix and green after for all 8.

Focused (test_presets.py, test_extension_skills.py, test_extensions.py,
tests/integrations): 2551 passed, 1 skipped.
Full suite (tests, excluding the pre-existing environment-local
1Password-signing git-extension failures): 3917 passed, 74 skipped, 90
deselected.
ruff check: clean.

Assisted-by: GitHub Copilot (model: Claude Sonnet 5, autonomous)
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: marcelsafin

src/specify_cli/extensions/__init__.py

@@ -2103,9 +2103,26 @@ def register_enabled_extensions_for_agent(self, agent_name: str) -> None:
                                 for name in existing_skills
                                 if (agent_skills_dir / name).is_dir()
                             ]
-                            if owned_here:
+                            # Only retire a skill mirror when the
+                            # replacement command for the same logical
+                            # command was actually written this call —
+                            # `registered` (from register_commands_for_agent
+                            # above) may be empty or a partial subset
+                            # (missing source file, safety rejection,
+                            # corrupted manifest), and removing a skill
+                            # mirror whose command replacement never
+                            # landed would leave neither artifact (#2948).
+                            replaced_skill_names = {
+                                HookExecutor._skill_name_from_command(cmd_name)
+                                for cmd_name in (registered or [])
+                            }
+                            to_remove = [
+                                name for name in owned_here
+                                if name in replaced_skill_names
+                            ]
+                            if to_remove:
                                 self._unregister_extension_skills(
-                                    owned_here, ext_id, skills_dir=agent_skills_dir
+                                    to_remove, ext_id, skills_dir=agent_skills_dir
                                 )
                                 # registered_skills is a single flat list
                                 # shared across every agent this extension
@@ -2132,17 +2149,41 @@ def register_enabled_extensions_for_agent(self, agent_name: str) -> None:
                         # registration is confirmed, so the stale
                         # command-mode artifact can finally be removed
                         # without risking a transient state where neither
-                        # artifact exists (#2948).
+                        # artifact exists. Only retire a stale command
+                        # whose corresponding skill was actually returned
+                        # this call — `registered_skills` may be empty or
+                        # a partial subset (missing source file, safety
+                        # rejection, corrupted manifest), and unregistering
+                        # a command whose skill replacement never landed
+                        # would leave neither artifact (#2948).
                         if deferred_stale_commands:
-                            registrar.unregister_commands(
-                                {agent_name: deferred_stale_commands}, self.project_root
-                            )
-                            registered_commands = metadata.get("registered_commands", {})
-                            if isinstance(registered_commands, dict):
-                                new_registered = copy.deepcopy(registered_commands)
-                                new_registered.pop(agent_name, None)
-                                if new_registered != registered_commands:
-                                    updates["registered_commands"] = new_registered
+                            replaced_skill_names = set(registered_skills or [])
+                            fully_replaced = [
+                                cmd_name for cmd_name in deferred_stale_commands
+                                if HookExecutor._skill_name_from_command(cmd_name)
+                                in replaced_skill_names
+                            ]
+                            if fully_replaced:
+                                registrar.unregister_commands(
+                                    {agent_name: fully_replaced}, self.project_root
+                                )
+                                registered_commands = metadata.get(
+                                    "registered_commands", {}
+                                )
+                                if isinstance(registered_commands, dict) and (
+                                    registered_commands.get(agent_name)
+                                ):
+                                    new_registered = copy.deepcopy(registered_commands)
+                                    remaining_commands = [
+                                        c for c in new_registered[agent_name]
+                                        if c not in fully_replaced
+                                    ]
+                                    if remaining_commands:
+                                        new_registered[agent_name] = remaining_commands
+                                    else:
+                                        new_registered.pop(agent_name, None)
+                                    if new_registered != registered_commands:
+                                        updates["registered_commands"] = new_registered
 
                 if updates:
                     self.registry.update(ext_id, updates)

src/specify_cli/presets/__init__.py

@@ -854,11 +854,28 @@ def register_enabled_presets_for_agent(self, agent_name: str) -> None:
                     # direction is already register-new-then-remove-old:
                     # _register_commands (the replacement) ran unconditionally
                     # above and only reaches here once it has already
-                    # succeeded, so this cleanup happens only after the new
-                    # command artifact is confirmed in place (#2948).
-                    self._unregister_skills(
-                        {agent_name: merged_skills.pop(agent_name)}, pack_dir
-                    )
+                    # succeeded — but that call can still have returned
+                    # empty or partial results (missing source template,
+                    # safety-validation skip, corrupted manifest), so only
+                    # retire the subset of stale skills whose corresponding
+                    # command name was actually returned for this agent;
+                    # anything unreplaced stays tracked and on disk (#2948).
+                    stale_skill_names = merged_skills[agent_name]
+                    replaced_skill_names: set = set()
+                    for cmd_name in registered_commands.get(agent_name) or []:
+                        modern_name, legacy_name = self._skill_names_for_command(cmd_name)
+                        replaced_skill_names.add(modern_name)
+                        replaced_skill_names.add(legacy_name)
+                    to_remove = [n for n in stale_skill_names if n in replaced_skill_names]
+                    remaining_stale = [
+                        n for n in stale_skill_names if n not in replaced_skill_names
+                    ]
+                    if to_remove:
+                        self._unregister_skills({agent_name: to_remove}, pack_dir)
+                    if remaining_stale:
+                        merged_skills[agent_name] = remaining_stale
+                    else:
+                        merged_skills.pop(agent_name, None)
                 # A legacy flat-list registered_skills value (predating
                 # per-agent provenance) must migrate to the dict format on
                 # disk even when the rescaffolded names are unchanged from
@@ -874,14 +891,32 @@ def register_enabled_presets_for_agent(self, agent_name: str) -> None:
                 if merged_skills != existing_skills or needs_migration:
                     self.registry.update(pack_id, {"registered_skills": merged_skills})
 
-                # The skills phase above completed without raising, so the
-                # replacement artifact is confirmed — now it's safe to
-                # remove the stale command-mode artifact deferred earlier
-                # (#2948).
+                # The skills phase above completed without raising, but a
+                # non-raising result can still be empty or partial (missing
+                # source template, safety-validation skip, corrupted
+                # manifest) — retiring every stale command purely on "did
+                # not raise" would delete a command whose replacement skill
+                # never actually landed, leaving neither artifact. Only
+                # retire the subset of stale commands whose corresponding
+                # skill name was actually returned for this agent; anything
+                # unreplaced stays tracked and on disk (#2948).
                 if stale_command_names:
-                    self._unregister_commands({agent_name: stale_command_names})
-                    merged_commands.pop(agent_name, None)
-                    self.registry.update(pack_id, {"registered_commands": merged_commands})
+                    replaced_skill_names = set(registered_skills.get(agent_name) or [])
+                    fully_replaced = []
+                    remaining_stale = []
+                    for cmd_name in stale_command_names:
+                        modern_name, legacy_name = self._skill_names_for_command(cmd_name)
+                        if modern_name in replaced_skill_names or legacy_name in replaced_skill_names:
+                            fully_replaced.append(cmd_name)
+                        else:
+                            remaining_stale.append(cmd_name)
+                    if fully_replaced:
+                        self._unregister_commands({agent_name: fully_replaced})
+                        if remaining_stale:
+                            merged_commands[agent_name] = remaining_stale
+                        else:
+                            merged_commands.pop(agent_name, None)
+                        self.registry.update(pack_id, {"registered_commands": merged_commands})
             except Exception as pack_err:
                 from .. import _print_cli_warning