fix(notifications): hold the push-to-start fence across token rotation

[iscekic]

Changelog for users

• A Live Activity card stays collapsed and silent when the device registers a fresh push-to-start token while a card is already on screen.
• The duplicate push-to-start that lit the screen and expanded the card is no longer sent.

Changelog for maintainers

• dropFencedStarts now treats the push-to-start fence as scope-wide: while any fence under iosStartPrefix is live, every ios_push_to_start token is dropped from the send list.
• Previously the fence was keyed to the exact token that wrote it, so a rotated token bypassed it and raised a second card beside the first.
• Trigger found: a duplicate start. The device rotates its push-to-start token while the first card is still on screen and unadopted; APNs requires an alert on every push-to-start, and that alert is what lights the screen and expands the card.
• An adopted card (an ios_activity row) still releases every fence in the scope and returns the full token list, so ordinary starts resume once the app owns the card.
• Lapsed fences are still deleted on read, including those of tokens the device has rotated away.
• Risk: while a fence is live and no card has been adopted, no push-to-start starts a new card; the fence lapses after the snapshot expiry window.
• Not proven in this change: a push, a local refresh, a reconnect, and an app foreground. Those paths carry no server change here; they are owned by the client adoption and sweep on the base branch.
• Test: holds the push-to-start fence across a rotated push-to-start token in the notifications glanceable delivery tests.

E2E proof

Owner request

Surface: the mobile app (apps/mobile), the iOS Live Activity.

An iOS Live Activity becomes expanded, and vibrates, with no user action. This must never happen. A Live Activity is subtle: it sits collapsed and it stays silent.

Build on the in-flight client fix, #6483 (branch kwf/owner-live-activity-strays-c7). That branch already touches apps/mobile/src/glanceable-ios/adopt-activity.ts, ios-sink.ts, register.ts and lib/glanceable/persist.ts. Reproduce this defect on top of it.

Required behaviour:

• The card stays collapsed until the user taps it.
• No haptic and no vibration from a Live Activity update, whatever the trigger.
• No alert and no sound.
• An update changes the numbers only. It never changes the presentation state on its own.

Audit every path that can expand the card or ask for a haptic: a push, a local refresh, a reconnect, an app foreground, and a duplicate start. Name the trigger you found in the pull request body. If one path cannot be proven, say so and name it.

Proof: the card over several update cycles, staying collapsed and silent, with the decisive log lines or a screen recording from a real iOS simulator.

E2E proof

• not proved live: no live proof was captured this round

Open findings (not fixed here)

• not fully verified: some optional checks did not run
• the '## E2E proof' section carries no log excerpt, so nothing shows the change was driven end to end

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Incremental review since a73411ab: commit 8ffb37a0 drops only the unrelated gastown and session-ingest changes, reverting those files to the base tree (e16445366). The PR's net diff stays the notification push-to-start fence change; no new findings.

Files Reviewed (18 files)

• services/gastown/src/dos/Agent.do.ts
• services/gastown/src/dos/Town.do.ts
• services/gastown/src/dos/town/agents.ts
• services/gastown/src/gastown.worker.ts
• services/gastown/src/handlers/town-container.handler.ts
• services/gastown/test/integration/awaiting-approval.test.ts
• services/gastown/test/integration/convoy-dag.test.ts
• services/gastown/test/integration/http-api.test.ts
• services/gastown/test/integration/mayor-idle.test.ts
• services/gastown/test/integration/pr-poll-errors.test.ts
• services/gastown/test/integration/reconciler.test.ts
• services/gastown/test/integration/review-failure.test.ts
• services/gastown/test/integration/rig-alarm.test.ts
• services/gastown/test/integration/rig-do.test.ts
• services/gastown/test/integration/town-container.test.ts
• services/gastown/test/integration/town-deletion.test.ts
• services/session-ingest/src/ingest/validate-oversized.test.ts
• services/session-ingest/src/ingest/validate.test.ts

Previous Review Summaries (2 snapshots, latest commit a73411a)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit a73411a)

Status: No Issues Found | Recommendation: Merge

Incremental review since 0eb54ffd: the only changed lines are formatting-only (oxfmt) edits; no new findings.

Files Reviewed (3 files)

• services/gastown/src/gastown.worker.ts
• services/gastown/test/integration/http-api.test.ts
• services/gastown/test/integration/town-container.test.ts

Previous review (commit 0eb54ff)

Status: No Issues Found | Recommendation: Merge

Files Reviewed (20 files)

• services/gastown/src/dos/Agent.do.ts
• services/gastown/src/dos/Town.do.ts
• services/gastown/src/dos/town/agents.ts
• services/gastown/src/gastown.worker.ts
• services/gastown/src/handlers/town-container.handler.ts
• services/gastown/test/integration/awaiting-approval.test.ts
• services/gastown/test/integration/convoy-dag.test.ts
• services/gastown/test/integration/http-api.test.ts
• services/gastown/test/integration/mayor-idle.test.ts
• services/gastown/test/integration/pr-poll-errors.test.ts
• services/gastown/test/integration/reconciler.test.ts
• services/gastown/test/integration/review-failure.test.ts
• services/gastown/test/integration/rig-alarm.test.ts
• services/gastown/test/integration/rig-do.test.ts
• services/gastown/test/integration/town-container.test.ts
• services/gastown/test/integration/town-deletion.test.ts
• services/notifications/src/lib/glanceable-delivery.test.ts
• services/notifications/src/lib/glanceable-refresh.ts
• services/session-ingest/src/ingest/validate-oversized.test.ts
• services/session-ingest/src/ingest/validate.test.ts

---

_{Reviewed by deepseek-v4.1-flash · Input: 0 · Output: 0 · Cached: 0}

_{Review guidance: REVIEW.md from base branch kwf/owner-live-activity-strays-c7}