[teamleaderleo]

Nightly train PR 4 (teamleaderleo/leo-workspace#624, section 2): the pulled-build banner. Follows #22590 (Roll Back to Previous Version), which merged as 010e772.

Problem. When nightly-next-rollback.yml pulls a bad build off the feed, Macs already on it keep running it with no signal, and the only way back is knowing about updates.rollback.

Behavior.

• The rollback workflow now also writes pulled.json next to the appcast (nightly-next/next/pulled.json in R2): [{build, reason, pulledAt, serve}], newest first, merged with the existing list, guarded by nightly-next-guard.py r2-key and a write-once / --replace-sha256 conditional upload. A build served again is dropped from the list.
• The app (PulledBuildWatch) reads that list at launch and after every Sparkle update cycle (no polling). The legacy NIGHTLY feed also reads /nightly-next/next/pulled.json.
• If the running build is listed, the update notice card says This Nightly Was Pulled with the reason, and offers Wait for the Fix (default, prominent, also the ×; remembered per build) and Roll Back, which runs UpdateDropBack and only shows when that rollback would run. A failed rollback shows its reason on the card.

Tests. PulledBuildWatchTests (list URLs, decode, wait-first/rollback actions, nothing-kept, not-listed, wait remembered across launches, rollback failure shown); tests/test_nightly_next_feed_rollback.py PulledListTests. Run on CI; not dogfooded in the app.

Localization. 5 new updater.pulled.* keys in Localizable.xcstrings with all 9 app locales.

Not in scope: the Updated toast / What's New work.

Agent session: cosmic-gray

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Adds a pulled-build banner to nightly updates so Macs running a build pulled from the feed get a signal instead of silently continuing.

Behavior

• The rollback workflow now writes pulled.json next to the appcast, listing pulled builds with reason, timestamp, and the build being served instead; a failed write only warns (and the rollback summary says so), so the fix-forward still runs.
• The app reads that list at launch and after every Sparkle update cycle; a pulled build shows a This Nightly Was Pulled notice with the reason, offering Wait for the Fix (default, remembered per build) and Roll Back to the kept build, shown only when a rollback would run.
• The kept-build check runs once per pulled build, and a second Roll Back press while one runs is ignored.
• A failed rollback shows its reason on the card; a build served again is removed from the list, and a build leaving the list clears a stale rollback failure.
• The banner shows even when that update was snoozed.

^{Written for commit c23f92b. Summary will update on new commits.}

[teamleaderleo]

Bead cx-n3eu4 created for this PR by the cmux coordinator.

[github-actions]

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Review e06e101: HQ feed card · gallery before/after runs · checks

App of this head (app.zip, kept 1 day)

gh workflow run reload-build.yml -R manaflow-ai/cmux --ref feat-cmux-next -f tag=pr22896 -f ref=feat/pulled-build-banner-2 -f platform=macos -f backend_mode=local

Not verified: macOS jobs did not run: compile and app tests were skipped on c23f92b096; ci-status is green without them.

CI passes on c23f92b096 (run 39554159342 attempt 1).
macOS jobs did not run: compile and app tests were skipped: Fast static checks skipped (the macos job needs both to succeed). Re-run CI once they pass, before merging.

Written by scripts/ci/classify_failures.py (ci-failure-attribution.yml); signatures are its SIGNATURES table. A machine verdict is the runner's fault, not this PR's; yours means the failing file is one this PR changes, also red on main that main's latest full suite fails the same way, seen on other PRs that it failed on another pull request's run lately.

[teamleaderleo]

Owned by projects-3f on cosmic-gray · session

[cursor]

Bugbot needs on-demand usage enabled

Bugbot uses usage-based billing for this team and requires on-demand usage to be enabled.

A team admin can enable on-demand usage in the Cursor dashboard.

[teamleaderleo]

Orphan sweep (owner session): independent subagent review passed (no blocking findings). Pushed c23f92b, which fixes two of its should-fix items:

• The rollback check verifies the app's signature on the main actor. It now runs once per pulled build instead of after every update cycle.
• A second Roll Back press while one is running is ignored (covered by a test).

Left as follow-ups: a confirmation step before Roll Back, and normalizing hand-written pulled.json entries.

Reds at c23f92b, all shared with base or every current PR:

• defaults-snapshot: base settings exports.
• generated files: stale action inventory and exports on base.
• swift test: the shared AppKit UI reds, plus the test helper truncation ("no Test run with summary line") that Post a Feed card for each installed update #22701, cmux NEXT Home: plural step counts in every locale; the store keeps the thought's headline, not its text #22707 and cmux NEXT: Update Ready card: themed switch, primary Restart to Update, click-to-pin preview, Simulate pending update #22688 hit too.

PulledBuildWatchTests compiled in that job. The fleet compile-check of the app at merge ref 783d829 passed.

[teamleaderleo]

merge-audit: #22896 merged at c23f92b without no SHIP review receipt on the head; no risk tier label. #23275 reverts it. To keep this change, add the missing evidence for c23f92b here; the next audit pass then closes #23275. Otherwise review and land #23275.

[github-actions]

Shipped in:

• cmux NEXT nightly 1.0.0-nightly.3958372135301 (bc661dae0e)

[teamleaderleo]

Review (subagent, correctness first): SHIP at c23f92b

This is a post-hoc independent review of the merged change (merge commit 311050c). It was read-only and nothing was run. risk:high (automatic trigger into the updater and rollback path).

Nothing blocks. Notes:

• Roll Back on the banner swaps and quits with no confirmation, though updates.rollback is marked destructive (PulledBuildWatch.swift:160). Medium, follow-up.
• signingTeam(of: Bundle.main) does a nested signature check on the main actor, and now runs unprompted when the running build is listed (UpdaterService+Rollback.swift:98). Low to medium.
• rollbackChecked gets set even when the check returned nil, so Roll Back stays hidden until relaunch (:145). Low, fails safe.
• Reason text and download size have no length limit (:153, :184). Low.

The merge-audit revert of this PR is handled separately. See leo-workspace briefs/2026-10-20-gui-push/revert-triage.md.