fix: prevent mixed-version pushy feedback

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a03397-4d51-7fd1-8ff2-946eb22ea2bc

workplans/TAMQ-WP-0012-pushy-feedback-circuit-breaker.md

@@ -0,0 +1,76 @@
+---
+id: TAMQ-WP-0012
+type: workplan
+title: "Pushy feedback circuit breaker and upgrade gate"
+domain: communication
+repo: tmux-amq
+status: finished
+owner: codex
+topic_slug: coulomb-social
+planning_priority: P0
+planning_order: 17
+created: "2026-08-25"
+updated: "2026-08-25"
+---
+
+# Pushy feedback circuit breaker and upgrade gate
+
+Stop a live pushy feedback incident, make stale delivery framing detectable,
+and reject any legacy injected envelope that re-enters a tapped pane.
+
+## Halt and characterize the live incident
+
+```task
+id: TAMQ-WP-0012-T01
+status: done
+priority: critical
+```
+
+Stop the broker without changing panes or history and preserve evidence of the
+alternating sender/target chain and recursively appended message identifiers.
+
+## Enforce compatible pushy framing
+
+```task
+id: TAMQ-WP-0012-T02
+status: done
+priority: critical
+```
+
+Advertise and require a capability specific to non-routable pushy envelopes so
+startup restarts a broker that still emits the legacy routable `#sender:` form.
+
+## Add a tap-side circuit breaker and prove containment
+
+```task
+id: TAMQ-WP-0012-T03
+status: done
+priority: critical
+```
+
+Recognize legacy injected envelopes by their durable message identity and
+direction, refuse to enqueue them, and cover stale-service restart, false
+positive boundaries, one-pass delivery, and isolated real-tmux containment.
+Install the corrected build but leave the operator broker stopped and preserve
+incident history unless cleanup is separately authorized.
+
+## Completion evidence
+
+- Stopped live broker PID 2656594 before diagnosis; panes and durable history
+  were preserved. Message count stabilized at 105 with 14 pre-existing pending
+  records and no active endpoint.
+- The incident records alternate `flex-auth` and `audit-core`, append the prior
+  message identifier on every hop, and prove an older `#sender:` pushy envelope
+  was being routed by newer taps.
+- Pushy startup now requires `pushy_input_non_routable_v1`, forcing a one-time
+  restart of brokers that predate the `# from sender:` framing.
+- The broker independently rejects a legacy hash envelope only when its final
+  message identifier resolves to a durable delivery whose sender and target
+  are the reverse of the observing tap. Unknown receipt-like user text remains
+  routable.
+- `make check`: 126 tests passed, including real tmux injection of a legacy
+  envelope followed by proof that no second durable record appears.
+- `make install`: refreshed `tmux-amq==0.1.0`. The operator broker remains
+  stopped; the 82 incident-generated records were not deleted or acknowledged.
+- Retry and acknowledgement residuals remain owned by `TAMQ-WP-0003`; this
+  incident adds no untracked residual.