[teamleaderleo]

Fixes #31309. Follow-up from the adjudication on #31235 (#31235 (comment)).

Problem. FeedHandoffDriver.adopt checked that an item's workspace or terminal is a normal window's only before it sent feed.adopt. A normal workspace that no window lists can be placed into an incognito window (reveal, openWindow(incognito: true); WindowRegistry.crossesIncognito treats an unlisted workspace as crossing nothing). If that happens while the adopt is in flight, the adopt commits and the item stays in the Feed and pushes to the iPhone, although its workspace is now an incognito window's.

Change. After the adopt returns (or an idempotency conflict confirms an earlier commit), the driver re-checks policy().frozenContent(for:). When the item is no longer a normal window's, it withdraws it with the existing pair: feed.adopt.cancel, then the daemon step. A committed adopt answers cancelled: false, so withdraw now archives the cloud copy (feed.archive, which also clears its push_due_at) before feed-local-handoff-done. An archive that fails leaves the item handing_off, and the next pass withdraws it again (same idempotency keys). The same archive applies to a frozen item from a crashed run whose adopt had committed.

Limit. A push whose delay was zero may already have gone out by the time the reply arrives; archiving cannot recall it. Nothing else of the item stays in the Feed.

Tests. Two commits: the first adds anItemWhoseWorkspaceMovesIntoAnIncognitoWindowDuringTheSendIsWithdrawn (red: only feed.adopt is sent), the second the fix. Run on the fleet with cmux-ci run ... package-test-lane.sh suite Packages/macOS/CmuxNext IncognitoFeedHandoffTests.

Spec: leo-workspace design/spaces.md "Incognito".

Agent session: agent session

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Fixes a race in FeedHandoffDriver where an item's workspace could move into an incognito window while its feed.adopt was in flight, leaving the item in the Feed and pushing it to the iPhone.

The driver now re-checks the window after the adopt commits and withdraws the item with feed.adopt.cancel followed by the daemon step. A committed adopt answers cancelled: false, so the cloud copy is archived first, which also clears its pending push; a failed archive leaves the item handing off and the next pass withdraws it again. Zero-delay pushes may already have gone out before the reply arrives and cannot be recalled. Adds a regression test for the race.

^{Written for commit b72cc42. Summary will update on new commits.}

[github-actions]

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Review 17c9fec: HQ feed card · gallery before/after runs · checks

App of this head (app.zip, kept 1 day)

gh workflow run reload-build.yml -R manaflow-ai/cmux --ref feat-cmux-next -f tag=pr31316 -f ref=leo/feed-incognito-await-31309 -f platform=macos -f backend_mode=local

red: cmux-next checks (god files, concurrency, crash safety, l10n); base red: the same failure on the base 044769a; does not block

Shipped in:

• cmux NEXT nightly 1.0.0-nightly.4135723253101 (888bf01111)
• cmux NEXT nightly 1.0.0-nightly.4135814557601 (ac43fbd69a)
• cmux NEXT nightly 1.0.0-nightly.4135865771101 (245d8c0571)
• cmux NEXT nightly 1.0.0-nightly.4135956244901 (f024646dc3)
• cmux NEXT nightly 1.0.0-nightly.4136073207401 (9a8633089c)

The feat-cmux-next push run https://github.com/manaflow-ai/cmux/actions/runs/41357380659 at 888bf01 failed: cmux-next generated files.
Those jobs last passed at 412578b. This pull request is one of 5 merged since: #31359, #27559, #31382, #31316, #31352.
If the failure is in your change, fix forward on feat-cmux-next. Pull requests run only the tiers their paths reach (docs/ci/cmux-next-tiers.md); label a batch PR full-ci to run them all before merging.

[teamleaderleo]

Owned by an agent session · session

[teamleaderleo]

Review (subagent, claude-opus-5-5 medium): SHIP at 17c9fec

The re-check after the adopt uses the same rule as the check before it (policy().frozenContent(for:)). A committed adopt answers feed.adopt.cancel with cancelled: false, and the cloud copy is archived before daemon.done. The archive's idempotency key is stable, so a failed archive leaves the item handing_off and the next pass retries it safely. feed.archive takes the same principal check as the feed.read this driver already sends. Adopted items are always notices, so the archive can't be refused as an open request. The test fails before the fix and passes after it.

Fleet runs: red at 6a6b1fa (ops → ["feed.adopt"], step 02b518d8966c108b6d8f1777), green at 17c9fec (IncognitoFeedHandoffTests 6/6, step 1daff24af0a79f27b5f3c267).

Follow-ups: filed as an issue (archive is not a delete, and a zero-delay push may already be out; archiving now also covers closed or gone workspaces; skip the archive when installID is nil and refusals other than stop codes; a timeout for the test's continuation).

[blacksmith-sh]

Found 7 test failures on Blacksmith runners:

Failures

Test	View Logs
/tmp/tmp2a5wa4f7/summary-fail.json (live):/summary-fail.json (live):	View Logs
/tmp/tmp7sppzxzg/summary-missing.json (live):/summary-missing.json (live):	View Logs
[new_workspaces] debug.new_workspace timed 0 of 50 new workspace rows/ [new_workspaces] debug.new_workspace timed 0 of 50 new workspace rows	View Logs
[new_workspaces] the window draws no frames/[new_workspaces] the window draws no frames	View Logs
[tabs] debug.tab_switch timed 0 of 40 switches/ [tabs] debug.tab_switch timed 0 of 40 switches	View Logs
[tabs] the window draws no frames/[tabs] the window draws no frames	View Logs
imported web bundle inputs are not routed:/imported web bundle inputs are not routed:	View Logs

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[teamleaderleo]

Review (next-review patch-id; carried): SHIP at b72cc42

The independent SHIP at 17c9fec carries to this head: the PR's own change (git diff $(git merge-base feat-cmux-next HEAD) HEAD) has the same git patch-id --verbatim (73a5aee36d197479) at both heads, and no merge between them was resolved by hand. Nothing new to review. A newer BLOCK, or any change to the PR's own diff, ends the carry.