[teamleaderleo]

Carry of #27499: cmux NEXT updater repair.

This carries the original purpose of #27499 and fixes all three P2 findings from its latest BLOCK review:

• an answered appcast probe settles the install click without waiting for a slow pulled-list read;
• known pulled staged builds are never installed when Sparkle cannot cancel them;
• pulled available builds are hidden, cannot be clicked, and their stale Sparkle reply is dismissed.

Original PR: #27499

No capture: no UI change; updater state behavior only.

Agent-Session: agent session

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Carries #27499: the cmux NEXT updater installs the newest build and never offers a pulled one.

Restart to Update now re-reads the feed and pulled list on every install click, even when found updates wait for a click to download, so one click installs the newest build instead of whatever was staged first. A pulled build is never installed: a staged pulled build is dropped and the newest good build downloads, and a pulled running build updates to the newest good one. A "Getting the Newest Build…" card shows progress while the replacement downloads. The "This Nightly Was Pulled" banner with Wait for the Fix and Roll Back is removed.

Bug Fixes

• An answered feed probe settles the install click without waiting for a slow pulled-list read.
• A pulled staged build is never installed even when Sparkle cannot cancel its installer; the update sheet opens instead.
• A pulled build stays pulled for the process lifetime: a failed list read never forgets it, and one staged again is dropped without another fetch.
• Pulled available builds are hidden, cannot be clicked, and their stale Sparkle reply is dismissed.

No UI capture: updater state behavior only.

^{Written for commit 3220c6d. Summary will update on new commits.}

[github-actions]

Default changes

This pull request changes 4 defaults at 631e3d983b29 (what everyone gets without configuring anything):

• tunable-source.CmuxNextApp/Handlers/UpdateHandlers.swift:bind: "efb52ee50d13187fa71bed5cf7d7979b0319e82516de56fc7ad36f9bbc8eb004" -> "1a2d51c9d3271477da73521751eb553e4110fdc904c061c69928c708b66a7faf"
• tunable-source.CmuxNextUpdater/UpdateDropBack.swift:confirmation: "183b8a89a3421222247ec11cf7a1a0d6a7a97155956c99a2be5cadbed76f22b1" -> "ffdb0c0021c3e810b01bb36de9376d03b890a2cf46aa9b49d3629d0a296e4324"
• tunable-source.CmuxNextUpdater/UpdaterStrings.swift:pulledRollBack: "06ce7b7a7595cb4ca296e52a921020eb1770ac50e3de9993193d7d7dfc8140f4" -> (none)
• tunable-source.CmuxNextUpdater/UpdaterStrings.swift:rollBackButton: (none) -> "12b33811fbd47ff1324f40bba4946b4ec77ef43047b6477f937e99402eec90bd"

Needs a review. It passes with an independent review receipt on this commit: a comment or review whose first line is Review (<reviewer>): SHIP at 631e3d983b295ae40a74ad69f8013ca95c225d3e, from a member, not a self-review (the newest verdict naming the head decides; a later BLOCK beats an earlier SHIP), or with an approving review on this commit from @lawrencecchen or @austinywang (the call owners in .github/defaults-call-owners.json, never the author). A receipt posted as a review re-runs this check; after a plain comment, re-run it. The needs a call label alone does not pass, and a new push needs a new receipt.

Regenerate the snapshot with python3 scripts/ci/defaults_guard.py snapshot.

[github-actions]

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Review db054ed: HQ feed card · gallery before/after runs · checks

App of this head (app.zip, kept 1 day)

gh workflow run reload-build.yml -R manaflow-ai/cmux --ref feat-cmux-next -f tag=pr28120 -f ref=lane/carry-27499-updater -f platform=macos -f backend_mode=local

red: cmux-next checks (god files, concurrency, crash safety, l10n); NEW: 3 commit(s) change the sidebar's drawing code without a Sidebar-Look: trailer or an entry in plans/cmux-next/sidebar-owner.md is not red on the base 3f9b925; do not merge until green; see lane-rules

[blacksmith-sh]

Found 10 test failures on Blacksmith runners:

Failures

Test	View Logs
/tmp/tmpahokikjf/summary-missing.json (live):/summary-missing.json (live):	View Logs
/tmp/tmplcjf7cfg/summary-fail.json (live):/summary-fail.json (live):	View Logs
[new_workspaces] debug.new_workspace timed 0 of 50 new workspace rows/ [new_workspaces] debug.new_workspace timed 0 of 50 new workspace rows	View Logs
[new_workspaces] the window draws no frames/[new_workspaces] the window draws no frames	View Logs
[tabs] debug.tab_switch timed 0 of 40 switches/ [tabs] debug.tab_switch timed 0 of 40 switches	View Logs
[tabs] the window draws no frames/[tabs] the window draws no frames	View Logs
main.DeveloperIdAppTests.test_download_prints_the_active_profile_only/ test_download_prints_the_active_profile_only	View Logs
stubs: /System/Library/Frameworks/Security.framework/Versions/A/Security has no stub/ Security has no stub	View Logs
stubs: CoreFoundation.tbd: install-name /System/Library/Frameworks/ CoreFoundation.framework/Versions/A/CoreFoundation, missing 1: ['_CFRetain']/ CoreFoundation, missing 1: ['_CFRetain']	View Logs
stubs: CoreFoundation.tbd: install-name /System/Library/Frameworks/ CoreFoundation.framework/Versions/A/CoreFoundation, missing 1: ['_log2']/ CoreFoundation, missing 1: ['_log2']	View Logs

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[teamleaderleo]

Superseded by #27499 (merged 867e291) and #28074 (merged 58aa84c). Closing on behalf of the owning lane.