🤖 feat: opt delegated task(kind:workspace) targets in to unrelated messaging by default

[ThomasK33]

Goal

Opt task(kind: "workspace") delegated targets in to unrelated (cross-task-tree) messaging by default, like user-created workspaces (#4440). The repo owner requires this.

Why it is separate

#4440 first granted consent to delegated targets at creation time. Each fix exposed another window: before the handle reservation, on pre-reservation early exits, when an explicit opt-out raced the deferred grant, and across backends (XUM_ALLOW_MULTIPLE_INSTANCES). #4440 now ships user-created workspaces only, and creates delegated targets with skipDefaultUnrelatedWorkspaceConsent.

Design constraints (write a transition table before code)

Key fact: while a delegated turn is live or reserved, unrelated sends to that root are refused (delegatedRootUnavailable) and task_list(scope:"instance") hides it. So a delegated target's default only matters once its creating turn has settled. Keep consent separate from permission to execute now (#4446).

Cover these states: creation, reservation, settlement (completed/error/interrupted), explicit toggle (from any backend), pre-reservation failure, disposable removal, archive, and restart/crash.

• Grant only for the exact newly created workspace, once. Never renew consent on mode: "existing" follow-ups.
• A pre-reservation failure is not a settlement. Either remove the unsuccessful workspace or finalize the retained one deliberately.
• Skip disposable targets that are being removed. Never unarchive, resume or wake a target as a side effect.
• An explicit settings change from any backend must cancel the pending default in the same serialized durable edit.
• Define crash recovery and failed writes, so a crash before settlement never leaves a workspace permanently pending.
• Verify downgrade against real older builds: whether they drop or preserve any new persisted field, and whether their toggle interacts with it.
• Test with deterministic barriers against real discovery, admission and durable config, not only by asserting that a marker exists.

If the table needs broad new coordination, land durable admission correctness (#4446) first.

---

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: high

[linear-code]

MUX-203

[ThomasK33]

Picked up by Xum workspace workspace-24 (4426dd3ae8) as part of the approved consent-cluster plan (#4455 → #4305 → #4453, sequential PRs).

This issue: PR3 of 3 (default consent granted only by the creating process when the creating turn settles; every other outcome clears the mark; startup resolver for crashed creators).

---

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: high • Cost: $12.63

[ThomasK33]

Status from workspace workspace-24 (4426dd3ae8). The first two PRs of the consent-cluster plan have merged:

• 🤖 fix: finalize the pending default consent on every create()/fork() exit #4814 (for 🤖 fix: follow-ups for default unrelated-messaging consent (#4440) #4455): create()/fork() finalize the pending mark on every exit. PR3's "caller-finalizes" mode builds on this.
• 🤖 fix: refuse unrelated messages to a recipient whose checkout is missing #4823 (for 🤖 fix: clarify unrelated-message acceptance for missing-checkout recipients #4305): early typed refusal for missing-checkout recipients. Consented delegated worktrees that were archived with checkout deletion are therefore protected before this issue opts them in.

This issue (PR3) has not started yet. It is paused so it can begin in a fresh context. The approved design, for whoever picks it up:

1. createWorkspaceTurn mode "new" passes a create() option defaultUnrelatedConsent: "caller-finalizes", or "none" for disposable targets. It replaces skipDefaultUnrelatedWorkspaceConsent. The row gets 🤖 fix: another backend's consent toggle cancels a pending default consent #4783's mark and create() never grants. Assert awaitMaterialization.
2. Take the handle's live-owner lock before create(). An in-memory Set holds creating handle IDs, added after create() returns Ok.
3. At the single terminal-write chokepoint (OwnedWorkspaceTurnHandleStore → afterUpsert), for createdWorkspace && !disposableWorkspace: Set.delete → grant, otherwise clear. This runs before the lock is released. Only the creating process grants, exactly once. Every other settlement, including one after any restart, clears (fail closed). Pre-🤖 fix: another backend's consent toggle cancels a pending default consent #4783 builds do not clear the mark on toggle, so a post-restart grant could override an old opt-out.
4. One finally covers exits before the handle record persists: clear the mark, drop the ID from the Set, release the lock.
5. The shared grant transform clears instead of granting when pendingRemoval is set.
6. Startup resolver (a separate, droppable commit): clears delegated marks (tag mux.taskHandleId, validated with isWorkspaceTurnTaskId) whose lock has no live holder. It skips handles this manager already holds. It never grants.
7. Update the copy strings ("except task(kind:"workspace") targets, for now", etc.) and regenerate the docs.

No #4801 per-attempt lock is needed: #4772's per-handle lock already allows only one settler.

---

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: high • Cost: $25.90

[ThomasK33]

Picked up by Xum workspace workspace-27 for PR3 of the consent-cluster plan (after #4814 and #4823).

Plan: implement the approved design from the handoff comment above. Default consent is granted only by the creating process at the creating handle's first terminal write, before its live-owner lock is released. Every other resolution clears the pending mark. The startup resolver lands as the last, droppable commit.

---

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: high