feat: complete reliable coordination adapter

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a03397-4d51-7fd1-8ff2-946eb22ea2bc

TamqMessagingIntroduction.md

@@ -75,8 +75,9 @@ The endpoint mode controls what delivery means:
 New pushy/trigger endpoints have a short startup grace so their foreground
 program can initialize before the first delivery. These modes still cannot
 prove that an arbitrary program accepted or understood the input. A durable
-state of `injected` records successful terminal placement, not agent
-acknowledgement.
+state of `injected` records completion under the default terminal-write policy,
+not agent comprehension or task completion. An `acknowledged` policy instead
+retains the message in `awaiting_ack` until explicit acknowledgement.
 
 An operator can change the live mode:
 
@@ -112,6 +113,38 @@ tamq inbox --repo audit-core
 tamq inspect <message-id>
 tamq ack <message-id>
 tamq send --from audit-core 'To:flex-auth: Direct CLI message.'
+tamq capture --repo audit-core --output tamq-protocol.md
+```
+
+TAMQ automatically keeps a structured protocol ledger for review. It records
+addressed-message acceptance, operator/worker provenance, worker block start
+and close reasons, allowlisted `Cmd:` outcomes, limit blocks, endpoint changes,
+and delivery attempts or failures. It does **not** record unrelated shell input
+or arbitrary pane output. Message bodies appear once, at their durable
+acceptance event.
+
+Use Markdown for a human review or JSONL for analysis:
+
+```bash
+tamq capture --output tamq-protocol.md
+tamq capture --repo audit-core --format jsonl --output audit-core-protocol.jsonl
+tamq capture --message-id m-... --output one-message.md
+tamq capture --event delivery.failed
+```
+
+The default report contains the newest 500 matching events and a summary of
+message provenance, attempts, failures, blocks, and outcomes. Filters match a
+repository as sender or recipient. Do not put secrets in TAMQ messages: durable
+history and captures intentionally retain addressed message content.
+
+After first installing capture support over an older running alpha, recreate
+the managed session once when convenient. Existing durable message lifecycle
+is backfilled, but old already-running pane observers cannot emit worker-block
+and command events retroactively:
+
+```bash
+make cleanup
+tamq --command codex --mode trigger flex-auth audit-core
 ```
 
 If no reply arrives, distinguish these states before resending:
@@ -119,9 +152,12 @@ If no reply arrives, distinguish these states before resending:
 - no durable history row: the source line or completed worker block was not
   observed, the slug was invalid, or a line budget blocked it;
 - `pending`: no eligible live endpoint has completed the selected delivery;
-- `displayed`: output mode showed it, but did not submit it to the worker;
-- `injected`: pushy/trigger placement succeeded, but the worker has not
-  necessarily processed it;
+- `awaiting_ack`: terminal delivery succeeded, but explicit acknowledgement is
+  outstanding and same-ID redelivery may occur after the deadline;
+- `injected`: the selected terminal-write policy completed, but the worker has
+  not necessarily processed it;
+- `failed`: bounded delivery or acknowledgement attempts were exhausted; inspect
+  the reason and use `tamq retry <message-id>` only when redelivery is safe;
 - explicit reply or acknowledgement: the recipient confirmed receipt.
 
 Use a correlation token when duplicate requests would be harmful. TAMQ is an