feat: make sessions terminal neutral

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a03397-4d51-7fd1-8ff2-946eb22ea2bc

workplans/TAMQ-WP-0005-terminal-neutral-manual-messaging.md

@@ -4,7 +4,7 @@ type: workplan
 title: "Terminal-neutral sessions and safe manual messaging"
 domain: communication
 repo: tmux-amq
-status: active
+status: finished
 owner: codex
 topic_slug: coulomb-social
 planning_priority: P0
@@ -26,6 +26,12 @@ interactive program—owns a pane.
 tamq start flex-auth audit-core
 ```
 
+The repository-first shorthand is equivalent:
+
+```bash
+tamq flex-auth audit-core
+```
+
 This opens or reuses ordinary interactive shells in the exact registered
 repository paths. It runs no initial command, installs no PTY observer, and
 never injects a queued message into an active terminal input line.
@@ -52,7 +58,7 @@ The sender defaults to the repository identity of the current managed window.
 
 ```task
 id: TAMQ-WP-0005-T01
-status: progress
+status: done
 priority: high
 state_hub_task_id: "84d3b151-3a0a-56ca-8c00-9000ecbb4751"
 ```
@@ -63,11 +69,15 @@ command. Set a trustworthy per-window `TAMQ_REPO` identity without changing the
 user's shell or terminal behavior. Retain explicit compatibility aliases where
 they do not weaken the neutral default.
 
+Completed with repository-first and explicit `start` forms, no default command,
+untouched tmux shells, per-window exported `TAMQ_REPO`, and exact opt-in
+`--command`/`--cmd` execution only for newly created windows.
+
 ## Separate durable messaging from pane input
 
 ```task
 id: TAMQ-WP-0005-T02
-status: todo
+status: done
 priority: high
 state_hub_task_id: "6c0f04a6-2af1-53b7-9976-325a9483a838"
 ```
@@ -77,11 +87,18 @@ from turning their queued messages into `send-keys` input. Make any legacy PTY
 observation/injection path explicit opt-in, visible in status, and absent from
 the default startup path.
 
+Completed with schema-versioned endpoint `delivery_mode`. New and migrated
+endpoints default to `manual`; the broker never injects their pending messages.
+Pane observation/injection requires both explicit `--tap` and `--command`, is
+reported as `pane` mode, and cannot be combined with `--no-service`. Startup
+also restarts a legacy broker that lacks the manual-delivery capability before
+registration.
+
 ## Add a practical manual inbox
 
 ```task
 id: TAMQ-WP-0005-T03
-status: todo
+status: done
 priority: high
 state_hub_task_id: "80bb61bb-8182-58d3-9067-3530026a59a4"
 ```
@@ -91,11 +108,15 @@ automation, use the current window's `TAMQ_REPO` as sender identity, validate
 targets, and preserve explicit acknowledgement. Manual exchange must work
 without corrupting either terminal's current input.
 
+Completed with `tamq inbox`, repository-context sender identity, local target
+validation, human-readable and JSON output, pending-by-default filtering, and
+the existing explicit acknowledgement command.
+
 ## Prove and document the neutral workflow
 
 ```task
 id: TAMQ-WP-0005-T04
-status: wait
+status: done
 priority: high
 state_hub_task_id: "08ca9746-97d1-56d8-badd-5a5ac2c8e147"
 ```
@@ -105,3 +126,10 @@ per-window repository identity, durable send/inbox/ack exchange, and proof that
 pending manual messages never appear as pane input. Update the install/start
 quickstart and practical-usability assessment, then record the local acceptance
 evidence. This task follows T01-T03.
+
+Completed with the isolated installed-package acceptance. It proves untouched
+shells at exact paths, stable reuse, per-window identities, manual
+send/inbox/ack exchange, byte-for-byte unchanged target-pane output, service
+restart and endpoint recovery, and exact explicit-command startup. The full
+suite passes 77 tests with 74% statement coverage; README, INTENT, SCOPE, agent
+workflow, and command rules now state the terminal-neutral boundary.