[teamleaderleo]

Leo asked (2026-10-21): "Find out why the newest nightly is not on his Mac. Is nightly publishing stuck, is the cmux-next appcast stale, or did Sparkle download a build and fail to install it on relaunch (check the Sparkle logs and ~/Library/Caches)? Fix the root cause in the pipeline or updater. If an installed update ever fails, the app must say why instead of offering Restart again."

Leo-ask: ask-24cefc7e85

What I found

• Publishing and the appcast are not stuck now. At 2026-11-01 17:43 UTC, files-next.cmux.com/nightly-next/appcast-arm64.xml had a build from 17:26 and nightly-next/next/appcast-arm64.xml had one from 17:34.
• The staging bugs found since the ask are fixed on base: cmux NEXT: never offer the running build as Update Ready #22804 (the running build is never offered), cmux NEXT: a stale same-build update no longer installs on quit #22874 (a stale same-build update no longer installs on quit), fix(updater): keep nightly staged updates replaceable #25129 (staged nightly updates can be replaced), cmux NEXT updates: a staged update gives way to a newer build of the ring #24183 (a staged update gives way to a newer one), cmux NEXT updater: Restart to Update installs the newest build; a pulled build is dropped (carries #27499) #28074/cmux NEXT updater: Restart to Update installs the newest build; a pulled build is dropped, never offered #27499 (Restart to Update installs the newest build; pulled builds are dropped), fix(release): Sparkle appcast fails closed when the signing key is not the app's SUPublicEDKey #27732 (the appcast fails closed on a key mismatch), and the click-time preflight UpdateInstallPreflight (folder not writable, no space, staged copy gone).
• One part was still missing: an install that fails after the app quits. Sparkle's installer swaps the bundle only after cmux has quit. If that swap fails, Sparkle reopens the old build. The update stages again and the card shows "Update Ready / Restart to Update" as though nothing happened. No code compared the build after the relaunch with the build that was being installed. This PR adds that check.

Change

• UpdateInstallCheck: just before Sparkle relaunches (updaterWillRelaunchApplication), the updater saves {fromBuild, targetBuild, recordedAt} in the app's own defaults. The next launch reads that record once. If the app is still on fromBuild, the install failed. If it is on targetBuild, the install worked. A third build, a record older than a day, or a no-op install counts as neither. Every path where the install ends with the app still running clears the record (new abandonInstall()), so a later launch of the same build isn't reported as a failed install.

• UpdateInstallFailure.diagnose: on a failed install, the app checks for causes it can see on disk:

  • App Translocation (a read-only copy)
  • a bundle or folder it can't write to
  • not enough free disk space

  If none of these applies, the card says the installer kept this version and gave no reason. Sparkle's installer leaves no error the app can read, so the app does not guess. The folder and space checks reuse the preflight's checks (UpdateInstallPreflight.placeFailure, split out of failure() with no change in behavior).

• The staged update card, for the build whose install failed, now shows "Update Didn't Install", the one-line reason, and a Try Again button in place of "Restart to Update". The full reason and what to do are in the popover and in the button's help text. A newer staged build gets the normal card. While Try Again installs, the card shows Installing as before. The updater log records install of X did not replace Y: <cause>.

• 10 new strings, translated into all 21 locales (non-English marked needs_review).

Tests

Packages/macOS/CmuxNext/Tests/CmuxNextAppTests/UpdateInstallCheckTests.swift: judging the record, reading it only once, the relaunch writing it and the next launch reading it as failed, a relaunch into the new build counting as success, an abandoned install leaving no record, the card text for a failure and while installing, the reason applying only to the failed build, and diagnose (translocated path, a writable folder, a read-only folder).

Observed / Not run

• Observed: scripts/cmux-next/prepush-gate.py reported no new violations. scripts/lint-ios-package-conventions.sh passed. The appcast reads quoted above.
• Not run: the Swift compile and the suite. This lane VM has no Swift toolchain, so they run in this PR's CI. Not run: a real failed install in a DEV build (making the installer fail needs a read-only or translocated app on a Mac).

risk: high (updater path).

Changelog

• Fixed: when an update fails to install after cmux restarts, the update card now says why and offers Try Again instead of offering Restart to Update again.

No capture: a native card state that needs a failed real install; the strings and layout reuse the existing staged update card.

🤖 Generated with Claude Code
Agent session: agent session

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

When Sparkle's installer fails to replace cmux after it quits, the app relaunches the old build and showed "Restart to Update" again as if nothing happened. The updater now records which build it installs over which before relaunch, checks the outcome on the next launch, and a failed install makes the update card say why and offer Try Again instead.

• Saves a from/target build record just before Sparkle relaunches and reads it once at launch; still running the old build means the install failed.
• Diagnoses the cause on disk: App Translocation, an unwritable bundle or folder, or not enough disk space; otherwise the card says the installer kept this version with no reason.
• Any path where the install ends with the app still running clears the record, so a later launch doesn't report a false failure.

^{Written for commit 58c0cdd. Summary will update on new commits.}

[github-actions]

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Review 8d4bdfd: HQ feed card · gallery before/after runs · checks

App of this head (app.zip, kept 1 day)

gh workflow run reload-build.yml -R manaflow-ai/cmux --ref feat-cmux-next -f tag=pr31178 -f ref=lane/next-update-install-failed-says-why -f platform=macos -f backend_mode=local

web and size checks: green

Shipped in:

• cmux NEXT nightly 1.0.0-nightly.4133598742701 (1e1948befb)
• cmux NEXT nightly 1.0.0-nightly.4133716725501 (d30463325c)
• cmux NEXT nightly 1.0.0-nightly.4133769596201 (0272db645e)
• cmux NEXT nightly 1.0.0-nightly.4133822529301 (68e3df851b)
• cmux NEXT nightly 1.0.0-nightly.4133907849701 (c2ef233b76)
• cmux NEXT nightly 1.0.0-nightly.4133963836301 (48e4448d11)
• cmux NEXT nightly 1.0.0-nightly.4134024448601 (94322a6ccf)

[teamleaderleo]

Review (codex gpt-6-astra high): SHIP at 8d4bdfd

Review (codex gpt-6-astra high, router-review): SHIP at 8d4bdfd

Follow-ups:

1. [P1][follow-up] With updates.notify silent, readyCard needs footerPill or flow.userAsked, so after an automatic relaunch a failed install shows no card, reason or Try Again. Surface failed-install details independently of the silent card preference.

Filed: #31192