OS update hangs at 93% — rugix-ctrl can't find sfdisk because /usr/sbin is missing from PATH

[basi2815-create]

On umbrelOS 1.7.2 (amd64, legacy mender-grub bootflow), upgrading to 1.7.3 hangs indefinitely at progress 93%. The update bundle has been fully downloaded (~8 GB written to inactive slot system-b), but the boot-slot switch never happens because rugix-ctrl cannot execute sfdisk to read the partition table — /usr/sbin is missing from the PATH inherited by the update subprocess that umbreld spawns.

System remains on the old version and system.updateStatus reports { progress: 93, running: true, error: false } forever (no timeout, no error surfaced).

Environment

• Hardware: ZBOX-CI341 (amd64 mini-PC)
• umbrelOS: 1.7.2 → attempting 1.7.3
• Kernel: Linux 6.12.85+deb13-amd64 (Debian 13 trixie base)
• Boot flow: mender-grub (legacy, migrated from old mender install)
• Update bundle: umbrelos-amd64-legacy.update
• Disk: 92 GB total, 79 GB free, A/B slot layout (sda2=A active, sda3=B target, both ~10 GB)

Steps to reproduce

1. Trigger an OS update from the UI or via POST /trpc/system.update.
2. Progress climbs steadily 0 → 93 % (download + write).
3. At 93 % it freezes. system.updateStatus keeps returning running: true indefinitely (we waited > 25 min).
4. rugix-ctrl process is still alive, both threads in S (sleeping) with WCHAN=0, no further disk I/O on sda3 (last /proc/diskstats shows sectors_written = 8088816 and unchanged over multiple samples).

Root cause

The PATH inherited by the update subprocess (umbreld → bash update-script → rugix-ctrl) is:

/usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games

/usr/sbin and /sbin are missing, but sfdisk lives at /usr/sbin/sfdisk and /sbin/sfdisk on Debian.

Running rugix-ctrl system info from a shell with the same PATH reproduces the error:

$ rugix-ctrl system info
ERROR error reading partition table from root device: unable to read partition table
└▶ error running command `sfdisk --dump --json /dev/sda`: No such file or directory (os error 2)
   at crates/libs/rugix-common/src/disk/sfdisk.rs:19:14
{
  "slots":{
    "system-a":{"active":true,"updatedAt":"2026-05-10T20:55:40.290Z"},
    "system-b":{"active":false}
  },
  "boot":{"bootFlow":"mender-grub","activeGroup":"a","defaultGroup":"a"}
}

Bundle is fully written to system-b but active=false and defaultGroup=a. rugix-ctrl can't promote system-b without sfdisk, so it sits forever — and umbreld never observes a clean exit, so the UI overlay stays stuck.

Workaround

POST /trpc/system.restart cleanly reboots the box (no SSH/sudo needed). The system comes back up on system-a (still 1.7.2). The update has to be re-attempted later — and will fail the same way until the PATH is fixed.

Suggested fix

Either widen umbreld's systemd unit env:

[Service]
Environment=PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

…or at the top of scripts/update-script:

export PATH="/usr/local/sbin:/usr/sbin:/sbin:$PATH"

(The second approach is safer — it scopes the change to the update flow.)

Bonus UI bug (possibly related to #2114)

Clicking "Jetzt installieren" / "Install now" in the update confirmation modal does not trigger the update — the modal just closes, system.updateStatus stays at { running: false, progress: 0 }. Update only started when I invoked the mutation directly with POST /trpc/system.update. Worth verifying whether this is a generic mutation-not-fired bug in 1.7.x.