[lawrencecchen]

Fixes the #33324 part of the arch-ratchet red over the last green arch tip 6500d46 ([app_lines] CmuxNextApp Swift lines: +195). Culprit per commit: 84aa409 (#33324) +141. The other culprits: #33567 (+74) is #33730, #33155 (+1) was #33610.

Takes back #33324: only its rules move to packages; every decision, its order and every text and locale are the same.

Cause

#33324 added 141 CmuxNextApp lines for the Release copy of the person's Claude login: the gate rules (switch first, then the consent, asked once; an automatic recovery never asks; Claude only; the transfer's last check), the build gates, and the one-time consent dialog.

Fix

• The rules move to CmuxNextCloudCredentials as CloudLoginCopyGate (copyAllowed, automaticAllowed, recoveryAllowed, stillAllowed, read(into:), askConsent(_:)), with Leo's three conditions as its doc.
• The build gates move to CloudCredentialTransfer+Switch (offersLoginCopy, allowsCreatorTeamGuest), next to passesHarnessLogin.
• The consent dialog's spec moves to CmuxNextCloudUI as CloudLoginCopyConsent, with its 5 keys moved to a new CmuxNextCloudUI CloudCredentialRecovery.xcstrings (every locale unchanged; checked key by key).
• The App keeps the wiring: reading the switch, cmux.json and presenting the dialog (CloudStartChat.loginCopyGate).

arch-ratchet.py --base HEAD^ --head HEAD: app_lines -77. No arch exception.

Risk: risk_tier.py grades the files normal. This PR moves the Release consent and switch checks without a change to them; the review was asked to check each decision against the base.

Red at the base, green at the head

Command: python3 scripts/cmux-next/arch-ratchet.py --base PARENT --head COMMIT

• Red at 84aa409 over its parent: +141.
• This PR's commit: -77, no count rises. With base red: Move to Cloud's text is CmuxNextCloudUI's CloudMoveStrings (arch app_lines +74 from #33567) #33730 (-104) the row over 6500d46 goes below zero.

New test CloudLoginCopyGateTests pins the gate (dogfood reads nothing; switch then consent, asked once; automatic never asks; Claude only; the last check).

Changelog

none

Observed / Not run

Observed on the fleet at 11fdedf: compile-check CmuxNext passed (job eb6578f46a32127bbe8f7f08, 292 s); suites CloudLoginCopyGateTests, CloudStartChatLoginTests, CloudCredentialRecoveryTests and CloudCredentialTransferTests passed (key a141-suites-11fdedff01). prepush-gate.py, lint-ios-package-conventions.sh, check-xcstrings-keys.py and lint-xcstrings.py passed.
Not run: the dialog on screen (the spec is the same values; no capture).

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Takes back #33324 by moving the Release Claude login copy rules out of the main app into packages, cutting CmuxNextApp by 77 lines with no behavior change: every decision, its order, and every text and locale stay identical.

• The gate rules (switch first, then consent asked once; automatic recovery never asks; Claude only; the transfer's last check) move to CloudLoginCopyGate in CmuxNextCloudCredentials.
• The build gates move to CloudCredentialTransfer+Switch (offersLoginCopy, allowsCreatorTeamGuest).
• The consent dialog spec and its 5 keys move to CloudLoginCopyConsent in CmuxNextCloudUI with all locales unchanged.
• The App keeps only the wiring: reading the switch, cmux.json, and presenting the dialog.
• Adds CloudLoginCopyGateTests to pin the gate's rules.

^{Written for commit 11fdedf. Summary will update on new commits.}

[github-actions]

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Review 11fdedf: HQ feed card · gallery before/after runs · checks

App of this head (app.zip, kept 1 day)

gh workflow run reload-build.yml -R manaflow-ai/cmux --ref feat-cmux-next -f tag=pr33844 -f ref=base-red/app-lines-33324 -f platform=macos -f backend_mode=local

Shipped in:

• cmux NEXT nightly 1.0.0-nightly.4165528235801 (b08cc6f4d3)
• cmux NEXT nightly 1.0.0-nightly.4165709173201 (7f6fe51cc3)
• cmux NEXT nightly 1.0.0-nightly.4165880669801 (de5076464a)
• cmux NEXT nightly 1.0.0-nightly.4166004947701 (abcde7ea04)

[blacksmith-sh]

Found 2 test failures on Blacksmith runners:

Failures

Test	View Logs
test_every_compile_job_names_its_warm_sources (main.ThisTree.test_every_compile_job _names_its_warm_sources)/ test_every_compile_job_names_its_warm_sources (main.ThisTree.test_every_compile_job _names_its_warm_sources)	View Logs
test_the_repository_highlights_validate (main.DigestTests.test_the_repository_highl ights_validate)/ test_the_repository_highlights_validate (main.DigestTests.test_the_repository_highl ights_validate)	View Logs

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[lawrencecchen]

Review (independent subagent): SHIP at 11fdedf

Correctness review against merge base e4cf14d. I read the code only. I did not build or test Swift; the fleet compile and suites in the description cover that.

Each decision has the same result, in the same order, as before:

1. CloudPresenter.recoverCredentials: recoveryAllowed(claude:automatic:) returns true in a dogfood build and reads nothing. In Release it checks Claude only first. The automatic path then calls automaticAllowed: it reads the switch first, then checks consent() == true, and stops at the first fail. It never asks, the same as the old guard. The manual path calls copyAllowed: the switch, then the kept answer, else ask(). This is the same as the old releaseCopyAllowed. The later if request.automatic { provider == .claude, hasCachedLogin } did not change.
2. CloudStartChat.passHarnessLogin: read(into:) sets remoteSwitch and then consent only when not dogfood, as the old if !DevTools.isEnabled block did. askConsent(&decision): on decline it sets consent from the kept answer and the outcome "declined", then returns false. On yes it sets consent = true and continues only when verdict.step == .install. Both match the removed lines. stillAllowed is the gate's. services.cloud is a lazy var that is set once, so the closure reads the same CloudService that the old local cloud read.
3. CloudHandlers+Account: copyAllowed() comes before the transfer and the gate's stillAllowed goes into run. harnessLoginCopySwitch is a non-optional let, so .current equals the old remoteSwitch?.current.
4. offersLoginCopy and allowsCreatorTeamGuest match the removed offersLoginCopyHere and allowsCreatorTeamGuestHere. In the dogfood branch the old DevTools.isEnabled argument was already true, and remoteSwitch defaults to nil.
5. The closures read loginCopyConsent(services) (cmux.json) on every call; nothing is cached. ask keeps the answer through askLoginCopyConsent. When services is gone: readSwitch gives nil, so stillAllowed, automaticAllowed and copyAllowed give false (the old recheck(nil) also gave false). consent gives nil and ask gives false. Every path fails closed.
6. Swift: CloudLoginCopyGate holds a Bool and @MainActor @Sendable closures, so its Sendable conformance is valid. CmuxNextCloudCredentials uses daemonSwiftSettings, which has no default MainActor, so await consent() from a nonisolated async function is correct. [self] in stillAllowed captures a Sendable value. CmuxNextCloudUI needs public import CmuxNextDesign because CmuxDialogSpec appears in its public API. No references to the removed helpers or loginCopyConsentIdentifier are left in the repo.
7. The dialog spec has the same title, lines, keys, table, .cancel decline, "use" accept with .default role, and identifier cmux.dialog.cloud.loginCopyConsent. confirmLoginCopy still returns button == "use" && !isDismissal, and DebugDialog userOnly uses the same identifier string.

Checks I ran:

• The 5 xcstrings keys moved without a change: each entry is equal to the base (21 locales), and the other App keys did not change.
• check-xcstrings-keys.py passed (rc 0).
• lint-xcstrings.py --catalog passed on both catalogs.
• arch-ratchet.py --base e4cf14db6ca --head 11fdedff013: app_lines -77, no count rises.

[lawrencecchen]

Swift logic follow-up (tip watcher swift-logic row, STATUS 13027 "SWIFT LOGIC CULPRITS"; lead order).

This PR raised swift_logic_lines by +52 at its merge commit 0cbd449: scripts/cmux-next/swift-logic-lines.py before and after the merge, with the same table (the tip's, c6be943). The largest declarations of the rise:

• struct CloudLoginCopyGate in Packages/macOS/CmuxNext/Sources/CmuxNextCloudCredentials/CloudLoginCopyGate.swift: +69 lines counted as Swift logic (no row in plans/cmux-next/swift-logic-classes.tsv)
• extension CloudCredentialTransfer in Packages/macOS/CmuxNext/Sources/CmuxNextCloudCredentials/CloudCredentialTransfer+Switch.swift: +13 lines counted as Swift logic (its row counts it as logic)

plans/cmux-next/layer-ownership.md says Rust owns every state, list and rule and Swift is the platform shell. Please move the new logic of this PR in a follow-up: to Rust (the crate that owns the area; the owner lists in STATUS 12147-12165 name the target per area), or at least out of the app into its package. If a declaration above is platform code (AppKit, Core Animation, OS calls, strings, tokens, DEBUG tooling), reply here and the table gets a PLATFORM row with your reason instead.

The swift-logic row is a report, not a gate: nothing blocks on this comment.