5.11 What is "incoming"?

After a developer uploads a package, it stays for a short while in the "incoming" directory before it is checked that it's genuine and allowed into the archive.

Usually nobody should install things from this place. However, in some rare cases of emergency, the incoming directory is available at https://incoming.debian.org/. You can manually fetch packages, check the GPG signature and MD5sums in the .changes and .dsc files, and then install them.