Keep unreported Android app installs pending instead of failing them

[Dhvanit41]

Related issue: Resolves #52617

Apps installed during the Android setup experience could show as "Failed" in Fleet while the device had them installed and running.

verifyDeviceSoftware marks a pending app failed when the device's status report mentions it in neither ApplicationReports nor NonComplianceDetails. But absence isn't a failure signal: AMAPI reports a real failure as a non-compliance detail, and an app that is still settling is simply left out of both lists. The guess is also unrecoverable, because verification_failed_at takes the row out of ListHostMDMAndroidVPPAppsPendingInstallWithVersion, so the later report that says INSTALLED never gets a chance to correct it.

The fix leaves those apps out of both the verified and the failed set, so they stay pending for a later report. That's the same thing the PENDING/IN_PROGRESS branch a few lines up already does, and the loop below already skips apps missing from markVerified ("ignore those not in markVerified, as they will enter a final state in a future pub-sub message"). The production change is one removed assignment and a log line dropped from error to debug.

Trade-off

An install that fails silently — no non-compliance report, ever — now stays pending instead of being failed. I went with option (a) from the issue because the two errors aren't equal: a stuck Pending is still correctable by the next report, while a wrong Failed is terminal and contradicts what the user sees on the device. Android app installs don't go through upcoming_activities, so a pending row doesn't hold up anything else on the host.

Checklist for submitter

• Changes file added for user-visible changes in changes/, orbit/changes/ or ee/fleetd-chrome/changes.

Testing

• Added/updated automated tests
• QA'd all new/changed functionality manually

TestStatusReportAppInstallVerification gains a case where the device applies the policy and says nothing at all about a pending app: it must stay pending, and a later INSTALLED report must still verify it. The existing multiple apps in various states case encoded the bug as expected behaviour ("app3 not reported at all so failed"), so its expectation moves from failed to pending.

Both were checked by reverting the fix: the new case then fails on Should be empty, but was [a] and the updated case on the failed-set contents, while the other six cases pass either way. go test ./server/mdm/android/... -race is green.

Manual QA

Ran a local Fleet server with Android MDM enabled and a fake enrolled Android host, and pushed AMAPI status reports at the Pub/Sub endpoint. Same database and same build flags for both columns — the only difference is pubsub.go.

Device status report	Before	After
App missing from both reports	failed_install	pending_install
…then a later report says INSTALLED	failed_install	installed
Non-compliance report (a real failure)	failed_install	failed_install
Non-compliance PENDING / IN_PROGRESS	pending_install	pending_install

Row 1 is the reported bug, row 2 shows it was unrecoverable, and rows 3 and 4 confirm genuine failures and in-progress installs are unaffected. Statuses are from GET /api/latest/fleet/hosts/:id/software.

Summary by CodeRabbit

• Bug Fixes
  • Android app installations that are not yet included in a status report remain pending for later updates instead of being incorrectly marked as failed.
  • Explicitly reported installation failures continue to be shown as failed.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: 808eaebe-a2f3-49f6-92d7-ac03d06c788a

📥 Commits

Reviewing files that changed from the base of the PR and between 6443302 and ed4ff39.

⛔ Files ignored due to path filters (1)

• changes/52617-android-setup-app-marked-failed.md is excluded by !**/*.md

📒 Files selected for processing (2)

• server/mdm/android/service/pubsub.go
• server/mdm/android/service/pubsub_test.go

Included review availability: Your plan provides up to 8 included reviews per hour; 7 remain after this review.

---

Walkthrough

verifyDeviceSoftware now keeps a VPP app install pending when the app is absent from both application and non-compliance reports. Tests cover later verification from an installed report and confirm that only explicitly failed apps reach the failure handler.

Merge Risk: ⚪ Minimal · up to ed4ff

Android VPP apps omitted from a status report now remain pending and can be verified by a later installed report, while explicit failures retain their existing behavior. The covered change presents no remaining merge-blocking risk.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 2 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the primary behavior change: unreported Android app installs remain pending instead of failing.
Description check	✅ Passed	The description identifies the related issue, explains the cause and fix, documents trade-offs, and includes automated testing and manual QA results. The changes file is claimed but excluded from revi…
Linked Issues check	✅ Passed	The changes address issue #52617 by keeping apps absent from both reports pending, allowing later INSTALLED reports to verify them. Reported failures and PENDING or IN_PROGRESS states remain unchanged…
Out of Scope Changes check	✅ Passed	The reviewed production and test changes directly support issue #52617. No unrelated code changes are identified. The user-visible changes file is excluded by path filters but is relevant to the state…

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 75.91%. Comparing base (6443302) to head (ed4ff39).

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #52632   +/-   ##
=======================================
  Coverage   75.91%   75.91%           
=======================================
  Files        4102     4102           
  Lines      247984   247982    -2     
  Branches    14261    14261           
=======================================
+ Hits       188262   188265    +3     
+ Misses      59545    59540    -5     
  Partials      177      177           

Flag	Coverage Δ
backend	77.60% <100.00%> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Dhvanit41]

@noahtalerman
This one is ready whenever you get sometime