fix(update): record why a success could not be verified

Author: elkaix

apps/pythinker-code/src/cli/sub/doctor.ts

@@ -212,7 +212,10 @@ function resolveDeps(deps: Partial<DoctorDeps> | DoctorDeps | undefined): Resolv
               installState.lastSuccess === null
                 ? undefined
                 : `${installState.lastSuccess.version} (installed ` +
-                  `${installState.lastSuccess.installedAt})`,
+                  `${installState.lastSuccess.installedAt})` +
+                  (installState.lastSuccess.unverified === undefined
+                    ? ''
+                    : ` — unverified: ${installState.lastSuccess.unverified}`),
             lastFailure:
               installState.lastFailure === null
                 ? undefined

apps/pythinker-code/src/cli/update/install-state.ts

@@ -153,6 +153,7 @@ const UpdateInstallStateSchema: z.ZodType<UpdateInstallState> = z
         version: z.string().min(1),
         installedAt: z.string().min(1),
         notifiedAt: z.string().min(1).nullable(),
+        unverified: z.string().min(1).optional(),
       })
       .strict()
       .nullable(),

apps/pythinker-code/src/cli/update/preflight.ts

@@ -927,6 +927,7 @@ async function startBackgroundInstall(
             version: target.version,
             installedAt: nowIso(),
             notifiedAt: null,
+            unverified: verification.ok ? verification.unverified : undefined,
           },
         }
         : {

apps/pythinker-code/src/cli/update/types.ts

@@ -112,6 +112,12 @@ export interface UpdateInstallSuccess {
   readonly version: string;
   readonly installedAt: string;
   readonly notifiedAt: string | null;
+  /**
+   * Why this success was recorded without proof that the new version runs.
+   * Absent when the installed binary was probed and matched. `doctor` prints
+   * it, so "it says updated but it did not" is answerable in one command.
+   */
+  readonly unverified?: string;
 }
 
 export interface UpdateInstallState {

apps/pythinker-code/src/cli/update/verify-install.ts

@@ -94,10 +94,9 @@ export async function verifyInstalledVersion(
   expectedVersion: string,
   overrides: Partial<VerifyInstalledVersionDeps> = {},
 ): Promise<InstallVerification> {
-  if (source !== 'native') return unverified(`not verified for ${source} installs`);
-  if (valid(expectedVersion) === null) {
-    return unverified(`not a version to verify against: ${expectedVersion}`);
-  }
+  // Non-native sources are not checkable from here (see the module comment),
+  // and a note on every npm install would be noise rather than a signal.
+  if (source !== 'native' || valid(expectedVersion) === null) return { ok: true };
 
   const execPath = overrides.execPath ?? process.execPath;
   const probe = overrides.probeExecutableVersion ?? defaultProbeExecutableVersion;

apps/pythinker-code/test/cli/doctor.test.ts

@@ -207,7 +207,8 @@ describe('pythinker doctor', () => {
           update: {
             latest: '0.13.1',
             checkedAt: '2026-08-08T12:00:00.000Z',
-            lastSuccess: '0.13.1 (installed 2026-08-08T12:01:00.000Z)',
+            lastSuccess:
+              '0.13.1 (installed 2026-08-08T12:01:00.000Z) — unverified: probe timed out',
             lastFailure: 'install 0.13.1 (attempt 1): still reports 0.12.0',
           },
         }),
@@ -217,7 +218,9 @@ describe('pythinker doctor', () => {
 
     expect(code).toBe(0);
     const output = stdout.join('');
-    expect(output).toContain('  Last update success: 0.13.1 (installed 2026-08-08T12:01:00.000Z)');
+    expect(output).toContain(
+      '  Last update success: 0.13.1 (installed 2026-08-08T12:01:00.000Z) — unverified: probe timed out',
+    );
     expect(output).toContain('  Last update failure: install 0.13.1 (attempt 1): still reports 0.12.0');
   });
 

apps/pythinker-code/test/cli/update/preflight.test.ts

@@ -1439,6 +1439,30 @@ describe('runUpdatePreflight', () => {
     }));
   });
 
+  it('records why a success could not be verified', async () => {
+    mocks.readUpdateCache.mockResolvedValue(cacheWith('0.5.0'));
+    mocks.readUpdateInstallState.mockResolvedValue(installState());
+    mocks.refreshUpdateCache.mockResolvedValue(cacheWith('0.5.0'));
+    mocks.detectInstallSource.mockResolvedValue('native');
+    mocks.verifyInstalledVersion.mockResolvedValue({
+      ok: true,
+      unverified: '/usr/local/bin/pythinker could not be run: ETIMEDOUT',
+    });
+    mockSpawnExit(0);
+    const { options } = captureOutput();
+
+    await expect(runUpdatePreflight('0.4.0', options)).resolves.toBe('continue');
+    await flushBackgroundInstall();
+
+    expect(writeUpdateInstallState).toHaveBeenLastCalledWith(expect.objectContaining({
+      lastFailure: null,
+      lastSuccess: expect.objectContaining({
+        version: '0.5.0',
+        unverified: expect.stringContaining('ETIMEDOUT'),
+      }),
+    }));
+  });
+
   it('does not verify an install the installer already reported as failed', async () => {
     mocks.readUpdateCache.mockResolvedValue(cacheWith('0.5.0'));
     mocks.readUpdateInstallState.mockResolvedValue(installState());

apps/pythinker-code/test/cli/update/verify-install.test.ts

@@ -83,17 +83,17 @@ describe('verifyInstalledVersion native', () => {
     ).resolves.toEqual({ ok: true, unverified: expect.stringContaining('printed no version') });
   });
 
-  it('accepts the install unverified when the target is not a version', async () => {
+  it('checks nothing when the target is not a version', async () => {
     await expect(
       verifyInstalledVersion('native', 'latest', NEVER_PROBED),
-    ).resolves.toEqual({ ok: true, unverified: expect.stringContaining('latest') });
+    ).resolves.toEqual({ ok: true });
   });
 });
 
 describe('verifyInstalledVersion other sources', () => {
   // A global reinstall rewrites the directory this process was loaded from,
   // so nothing readable here proves what the next launch will run.
-  it('leaves every non-native source unverified without probing', async () => {
+  it('checks nothing for a source it cannot prove, without probing', async () => {
     for (const source of [
       'npm-global',
       'pnpm-global',
@@ -104,7 +104,7 @@ describe('verifyInstalledVersion other sources', () => {
     ] as const) {
       await expect(
         verifyInstalledVersion(source, '0.13.1', NEVER_PROBED),
-      ).resolves.toEqual({ ok: true, unverified: `not verified for ${source} installs` });
+      ).resolves.toEqual({ ok: true });
     }
     expect(NEVER_PROBED.probeExecutableVersion).not.toHaveBeenCalled();
   });