fix: defer nvtake to slackrepo confirm

nvchecker's oldver is now synced (nvtake) only when the slackrepo prompt
is confirmed, per package, just before slackrepo runs. Moved out of the
hint-rewrite step in --check and the version-accept step in --hintfile
(both now route through run_slackrepo). Confirming slackrepo acknowledges
the versions; a stopped/failed slackrepo can be rerun without nvchecker
re-reporting already-committed versions.

Fixes the stuck state where interrupting a run between hint-rewrite and
slackrepo left oldver behind the hint, so nvchecker logged a phantom
'updated' line every subsequent --check.

Tests T20/T23 answer Y to slackrepo so nvtake fires. Dead
check_nvchecker_take flag removed.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

5 files changed, 26 insertions, 12 deletions

diff --git a/CHANGELOG.md b/CHANGELOG.md
index eb416bd..6b9add7 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,19 @@ All notable changes to this project are documented here. The format is based on
 [Keep a Changelog](https://keepachangelog.com/), and this project adheres to
 [Semantic Versioning](https://semver.org/).
 
+## [Unreleased]
+
+### Changed
+- `nvtake` timing: nvchecker's `oldver` is now synced (via `nvtake`) only when
+  you confirm the slackrepo prompt, per package, just before slackrepo runs —
+  moved out of the hint-rewrite step in `--check` and out of the version-accept
+  step in `--hintfile`. Confirming slackrepo acknowledges the versions; if
+  slackrepo is then stopped or fails, rerun it without nvchecker re-reporting
+  already-committed versions. Declining slackrepo leaves the hint bumped but the
+  update re-reported next run. Fixes the stuck state where interrupting a run
+  between hint-rewrite and slackrepo left `oldver` behind the hint, so nvchecker
+  logged a phantom "updated" line every subsequent `--check`.
+
 ## [1.3.0] - 2026-07-10
 
 ### Added
diff --git a/CLAUDE.md b/CLAUDE.md
index 6c7ad9c..c3de268 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -144,10 +144,10 @@ When adding new features, add a corresponding test case to `tests/mkhint_test.sh
 - `--new` with existing `.info`: copies `.info` as template, strips `PRGNAM`, `HOMEPAGE`, `MAINTAINER`, `EMAIL`, comments out `REQUIRES`, sets `ARCH="x86_64"`. Keeps `VERSION` from `.info`. If `-V` given, updates version string and recalculates checksums. Also appends an nvchecker `[section]` to the config via `add_nvchecker_section`.
 - `add_nvchecker_section` autodetection: `_detect_nvchecker_source` recognizes github, gitlab, bitbucket, gitea, codeberg, and pagure owner/repo URLs plus the pypi, npm, gems, crates.io (`cratesio`), cpan, hackage, packagist, and cran registries, else leaves a commented stub. Github gets `use_latest_release = true` with commented `use_max_tag`/`prefix = "v"` fallbacks; the other forges get `use_max_tag = true` plus a commented `# prefix = "v"`; registries use the package name parsed from the URL via `_registry_name_from_url`, falling back to `PRGNAM` when no host-specific pattern matches. Either way, the managed stanza (freshly added or already present) is echoed fenced on stdout via `_extract_nvchecker_section`.
 - `--new` when hint already exists: backs up old, creates empty skeleton.
-- `--hintfile` with no `-V`: queries nvchecker for latest version, shows current vs. latest, prompts to accept/override/decline. After accepting, runs `nvtake` to sync nvchecker's keyfile.
+- `--hintfile` with no `-V`: queries nvchecker for latest version, shows current vs. latest, prompts to accept/override/decline. After accepting, updates the hint, then dispatches slackrepo via `prompt_slackrepo`; `nvtake` (syncing nvchecker's oldver keyfile) fires from `run_slackrepo` only when you confirm the slackrepo question, not on version-accept. Decline slackrepo and the hint stays bumped but oldver lags, so nvchecker keeps reporting the update until it's built.
 - `--list` / `-l`: lists hints with `HintVer`/`SBOVer` plus a `DelReq` column (before `Created`) showing `✓` when the hint has a populated `DELREQUIRES` (detected via `grep '^DELREQUIRES="..*"'`, padded with `_pad_glyph` so the multibyte glyph stays aligned). Hints with no `VERSION` are skipped (and excluded from the total). Version columns are 22 wide to fit long version strings. Coloring: rows where the two versions are byte-equal get the whole row yellow (and populate `MATCHED_PKGS` for `-R`); when they differ, `sort -V` picks the newer side and only that version cell is green (version strings are pre-padded to 22 before the color wrap so the escape bytes don't break alignment); an absent/empty `SBOVer` leaves the row plain. Color only on a TTY (or `MKHINT_FORCE_COLOR`); plain when piped. Legend `(yellow row = versions match; green = newer side)` prints when any row matched. With package names (`-l foo bar`), the table is skipped and each named hint is shown side by side with its `.info` via `_show_hint_diff` (shared with `--review`); missing hint → exit 2.
 - `--review` / `-R`: with no package args, iterates only the matched (highlighted) hints. With explicit package names (`-R foo bar`), reviews each named hint regardless of version match (existence required: missing hint → exit 2). For each, shows the hint side-by-side with its `.info` (`git diff --no-index` if git present, else `diff -y`), then prompts `[K]eep / [D]elete / [S]kip` (default Keep). Delete removes the hint and its `.bak` via `_remove_hint`. Prints a deleted/kept summary counting hints actually reviewed. `-l` and `-R` combine: `-lR` shows the table first, then reviews. Bare `-R` with no matches → "nothing to review", exit 0. Per-hint logic lives in `_review_one_hint`; `review_hint_files` drives it from either the named list or `MATCHED_PKGS`.
-- `--check` / `-C`: runs nvchecker for all (or named) hints. With exactly one explicit package it uses `nvchecker -e <pkg>` to skip scanning the whole config; with two+ packages or no args it does one full scan. (`--hintfile` with no `-V` also queries via `nvchecker -e <pkg>`.) reports outdated packages with current → latest versions, prompts per-package to update, applies updates with `nvtake`, then prompts slackrepo for all updated packages. The slackrepo action is chosen per package by `pkg_in_repo` (glob `PACKAGES_DIR/*/<pkg>/<pkg>-*.txz`): a package already built in `PACKAGES_DIR` gets `slackrepo update`, an absent one gets `slackrepo build`. `--check` partitions its updated set into built vs. fresh and prompts `update` then `build` separately (each only if its list is non-empty), both dispatched through the shared `run_slackrepo` helper. Hints with no `[pkg]` section in `nvchecker.toml` are collected and, after the scan, a single prompt offers to populate the config via `add_nvchecker_section` (github/pypi autodetect, else stub); on accept it prints a "review and re-run" message and stops the run without applying updates. Packages whose `.info` is not found in `REPO_DIR` are skipped. Upstream versions are normalized via `_normalize_version` (`-` → `_`) before comparing and before storing, so a dashed upstream version like `2026-06-02` matches the packaged `2026_06_02` (SlackBuild versions cannot contain `-`) and updates are written in the underscore form. The same normalization applies to `--hintfile` with no `-V`. `nvtake` still uses nvchecker's own raw keyfile value.
+- `--check` / `-C`: runs nvchecker for all (or named) hints. With exactly one explicit package it uses `nvchecker -e <pkg>` to skip scanning the whole config; with two+ packages or no args it does one full scan. (`--hintfile` with no `-V` also queries via `nvchecker -e <pkg>`.) reports outdated packages with current → latest versions, prompts per-package to update (rewriting the hint on confirm), then prompts slackrepo for all updated packages. `nvtake` (syncing nvchecker's oldver) is NOT called at hint-rewrite time; it fires from `run_slackrepo`, per package, only after you answer Y to the slackrepo question and just before slackrepo runs. So answering Y acknowledges the versions; if slackrepo is then stopped or fails, just rerun it and nvchecker won't re-report versions already committed. Declining slackrepo (n) leaves the hints bumped but oldver behind, so those updates re-report next run. The slackrepo action is chosen per package by `pkg_in_repo` (glob `PACKAGES_DIR/*/<pkg>/<pkg>-*.txz`): a package already built in `PACKAGES_DIR` gets `slackrepo update`, an absent one gets `slackrepo build`. `--check` partitions its updated set into built vs. fresh and prompts `update` then `build` separately (each only if its list is non-empty), both dispatched through the shared `run_slackrepo` helper. Hints with no `[pkg]` section in `nvchecker.toml` are collected and, after the scan, a single prompt offers to populate the config via `add_nvchecker_section` (github/pypi autodetect, else stub); on accept it prints a "review and re-run" message and stops the run without applying updates. Packages whose `.info` is not found in `REPO_DIR` are skipped. Upstream versions are normalized via `_normalize_version` (`-` → `_`) before comparing and before storing, so a dashed upstream version like `2026-06-02` matches the packaged `2026_06_02` (SlackBuild versions cannot contain `-`) and updates are written in the underscore form. The same normalization applies to `--hintfile` with no `-V`. `nvtake` still uses nvchecker's own raw keyfile value.
 - `--no-dl` / `-N`: downloads and recalculates checksums as normal, then appends `NODOWNLOAD=yes` after `MD5SUM_x86_64=`. Works with `--hintfile` or `--new`. Error if used alone.
 - `--fix-current` / `-F`: bulk sweep. Loads `PHANTOM_DEPS_FILE`, scans every `.info` in `REPO_DIR`, and for each package whose REQUIRES contains a phantom dep, ensures its hint carries the matching `DELREQUIRES`. No existing hint → create a minimal `DELREQUIRES="..."` file. Existing hint → back up to `.bak` and union the phantom deps into its `DELREQUIRES` line (dedup), leaving all other content untouched. Idempotent: if the deps are already present, the file is left alone and no `.bak` is written. No per-package prompts, safe under `set -e`. Mutually exclusive with `-V`/`-f`/`-n` (exit 1). Empty/missing list → "Nothing to do", exit 0. Helpers: `load_phantom_deps`, `phantom_deps_in_info`, `merge_delrequires`, `fix_current`.
 - `--new` phantom-dep hook: after commenting out REQUIRES, `create_new_hint_file` appends `DELREQUIRES="..."` for any phantom dep found in the `.info` REQUIRES. Same list as `--fix-current`.
diff --git a/README.md b/README.md
index 7e43aab..b8b4beb 100644
--- a/README.md
+++ b/README.md
@@ -180,13 +180,13 @@ When creating a new hint file with `--new`, mkhint automatically appends an nvch
 mkhint --new mypackage            # adds [mypackage] section to nvchecker config
 ```
 
-When updating an existing hint file with `--hintfile` but without `-v`, mkhint queries nvchecker for the latest version, shows you the current and latest versions, and prompts to accept the latest, type a different version, or decline. After accepting an update, it runs `nvtake` to sync nvchecker's keyfile:
+When updating an existing hint file with `--hintfile` but without `-v`, mkhint queries nvchecker for the latest version, shows you the current and latest versions, and prompts to accept the latest, type a different version, or decline. After accepting, it updates the hint and prompts to run slackrepo; `nvtake` (which syncs nvchecker's keyfile) runs only when you confirm the slackrepo step, not on accept:
 
 ```bash
 mkhint --hintfile mypackage       # suggests latest version via nvchecker (no -V flag)
 ```
 
-Check one or more packages for upstream updates with `--check`. mkhint runs nvchecker for all (or named) hint files, reports outdated packages, prompts per-package to update, applies updates with `nvtake`, and finishes by prompting slackrepo for all updated packages:
+Check one or more packages for upstream updates with `--check`. mkhint runs nvchecker for all (or named) hint files, reports outdated packages, prompts per-package to update (rewriting the hint on confirm), and finishes by prompting slackrepo for all updated packages. `nvtake` runs per package only when you confirm the slackrepo prompt, just before slackrepo runs. So confirming slackrepo acknowledges the versions: if slackrepo is then stopped or fails, rerun it and nvchecker won't re-report those updates. Declining slackrepo leaves the hint bumped but the update re-reported next run:
 
 ```bash
 mkhint --check                    # check all hints for upstream updates
diff --git a/mkhint b/mkhint
index e463dde..62bbbf8 100755
--- a/mkhint
+++ b/mkhint
@@ -1553,6 +1553,11 @@ run_slackrepo() {
     read -r -p "Run 'slackrepo $action $*'? [Y/n] " answer
     answer="${answer:-Y}"
     if [[ "$answer" =~ ^[Yy]$ ]]; then
+        # nvtake on confirm, before slackrepo runs: saying yes acknowledges the
+        # new versions. If slackrepo is then stopped or fails, just rerun it —
+        # nvchecker won't nag about versions already committed to the hints.
+        local p
+        for p in "$@"; do nvtake -c "$NVCHECKER_CONFIG" "$p" >&2 || true; done
         slackrepo "$action" "$@"
     fi
 }
@@ -1726,7 +1731,6 @@ check_updates() {
             answer="${answer:-Y}"
             if [[ "$answer" =~ ^[Yy]$ ]]; then
                 update_hint_file "$p" "${outdated_new[$i]}"
-                nvtake -c "$NVCHECKER_CONFIG" "$p" >&2 || true
                 updated+=("$p")
             fi
         done
@@ -1961,12 +1965,8 @@ main() {
             if [[ -z "$VERSION" ]]; then
                 check_nvchecker
                 VERSION=$(suggest_version "$HINT_FILE") || { echo "Aborted." >&2; exit 0; }
-                check_nvchecker_take=1
             fi
             update_hint_file "$HINT_FILE" "$VERSION"
-            if [[ "${check_nvchecker_take:-0}" -eq 1 ]]; then
-                nvtake -c "$NVCHECKER_CONFIG" "$HINT_FILE" >&2 || true
-            fi
 
             load_bundle_manifests
             local _bm_pkg="${HINT_FILE%.hint}"
diff --git a/tests/mkhint_test.sh b/tests/mkhint_test.sh
index 90f6705..b30273e 100755
--- a/tests/mkhint_test.sh
+++ b/tests/mkhint_test.sh
@@ -707,8 +707,8 @@ DOWNLOAD_x86_64=""
 MD5SUM_x86_64=""
 EOF
 rm -f "$MOCK_BASE/nvtake.log"
-# blank = accept latest (8.9.0 from keyfile); n = skip slackrepo
-run_mkhint -f curl < <(printf '\nn\n')
+# blank = accept latest (8.9.0 from keyfile); Y = run slackrepo (nvtake fires on confirm)
+run_mkhint -f curl < <(printf '\nY\n')
 assert_contains "VERSION set to latest"   "$MOCK_HINT/curl.hint" 'VERSION="8.9.0"'
 assert_contains "URL has latest version"  "$MOCK_HINT/curl.hint" 'curl-8.9.0'
 assert_file_exists "nvtake was called"    "$MOCK_BASE/nvtake.log"
@@ -762,7 +762,8 @@ MD5SUM_x86_64=""
 EOF
 rm -f "$MOCK_HINT/clion.hint" "$MOCK_HINT/protoc-gen-go-grpc.hint" "$MOCK_HINT"/*.bak 2>/dev/null
 rm -f "$MOCK_BASE/nvtake.log"
-run_mkhint -C curl < <(printf 'Y\nn\n')
+# Y = confirm update; Y = run slackrepo (nvtake fires on slackrepo confirm)
+run_mkhint -C curl < <(printf 'Y\nY\n')
 assert_contains "curl updated to 8.9.0"   "$MOCK_HINT/curl.hint" 'VERSION="8.9.0"'
 assert_file_exists "nvtake called"        "$MOCK_BASE/nvtake.log"