docs: plan terminal-neutral messaging

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a03397-4d51-7fd1-8ff2-946eb22ea2bc

WORK-RECORDS.md

@@ -13,6 +13,7 @@
 | workplan | TAMQ-WP-0002 | active | — | workplans/TAMQ-WP-0002-coordination-engine-adapter.md |
 | workplan | TAMQ-WP-0003 | active | — | workplans/TAMQ-WP-0003-delivery-reliability.md |
 | workplan | TAMQ-WP-0004 | finished | — | workplans/TAMQ-WP-0004-operator-installable-local-alpha.md |
+| workplan | TAMQ-WP-0005 | active | — | workplans/TAMQ-WP-0005-terminal-neutral-manual-messaging.md |
 | task | TAMQ-WP-ADHOC-2026-08-24-T01 | done | — | workplans/ADHOC-2026-08-24.md |
 | task | TAMQ-WP-0001-T01 | done | — | workplans/TAMQ-WP-0001-statehub-bootstrap.md |
 | task | TAMQ-WP-0001-T02 | done | — | workplans/TAMQ-WP-0001-statehub-bootstrap.md |
@@ -29,3 +30,7 @@
 | task | TAMQ-WP-0004-T03 | done | — | workplans/TAMQ-WP-0004-operator-installable-local-alpha.md |
 | task | TAMQ-WP-0004-T04 | done | — | workplans/TAMQ-WP-0004-operator-installable-local-alpha.md |
 | task | TAMQ-WP-0004-T05 | done | — | workplans/TAMQ-WP-0004-operator-installable-local-alpha.md |
+| task | TAMQ-WP-0005-T01 | progress | — | workplans/TAMQ-WP-0005-terminal-neutral-manual-messaging.md |
+| task | TAMQ-WP-0005-T02 | todo | — | workplans/TAMQ-WP-0005-terminal-neutral-manual-messaging.md |
+| task | TAMQ-WP-0005-T03 | todo | — | workplans/TAMQ-WP-0005-terminal-neutral-manual-messaging.md |
+| task | TAMQ-WP-0005-T04 | wait | — | workplans/TAMQ-WP-0005-terminal-neutral-manual-messaging.md |

workplans/TAMQ-WP-0005-terminal-neutral-manual-messaging.md

@@ -0,0 +1,102 @@
+---
+id: TAMQ-WP-0005
+type: workplan
+title: "Terminal-neutral sessions and safe manual messaging"
+domain: communication
+repo: tmux-amq
+status: active
+owner: codex
+topic_slug: coulomb-social
+planning_priority: P0
+planning_order: 10
+created: "2026-08-24"
+updated: "2026-08-24"
+---
+
+# Terminal-neutral sessions and safe manual messaging
+
+Correct the operator-alpha contract so tamq owns repository-aware tmux topology
+and durable messages without assuming that a coding agent—or any particular
+interactive program—owns a pane.
+
+## Required operator contract
+
+```bash
+tamq start flex-auth audit-core
+```
+
+This opens or reuses ordinary interactive shells in the exact registered
+repository paths. It runs no initial command, installs no PTY observer, and
+never injects a queued message into an active terminal input line.
+
+```bash
+tamq start --command codex flex-auth audit-core
+```
+
+`--command` is explicit opt-in and runs exactly the supplied initial command in
+newly created windows. It does not imply that the command is an agent or that it
+accepts tamq message injection.
+
+Manual exchange uses durable commands from repository shells:
+
+```bash
+tamq send '@audit-core: please review the auth boundary'
+tamq inbox --repo audit-core
+tamq ack <message-id>
+```
+
+The sender defaults to the repository identity of the current managed window.
+
+## Make repository sessions terminal-neutral
+
+```task
+id: TAMQ-WP-0005-T01
+status: progress
+priority: high
+```
+
+Remove the implicit Codex default. Leave tmux's ordinary shell untouched when
+`--command` is absent; when present, parse and execute only the requested
+command. Set a trustworthy per-window `TAMQ_REPO` identity without changing the
+user's shell or terminal behavior. Retain explicit compatibility aliases where
+they do not weaken the neutral default.
+
+## Separate durable messaging from pane input
+
+```task
+id: TAMQ-WP-0005-T02
+status: todo
+priority: high
+```
+
+Register neutral endpoints in a manual delivery mode and prohibit the service
+from turning their queued messages into `send-keys` input. Make any legacy PTY
+observation/injection path explicit opt-in, visible in status, and absent from
+the default startup path.
+
+## Add a practical manual inbox
+
+```task
+id: TAMQ-WP-0005-T03
+status: todo
+priority: high
+```
+
+Add a concise inbox command for pending messages by repository, retain JSON for
+automation, use the current window's `TAMQ_REPO` as sender identity, validate
+targets, and preserve explicit acknowledgement. Manual exchange must work
+without corrupting either terminal's current input.
+
+## Prove and document the neutral workflow
+
+```task
+id: TAMQ-WP-0005-T04
+status: wait
+priority: high
+```
+
+Exercise real tmux shells with no initial keystrokes, exact opt-in commands,
+per-window repository identity, durable send/inbox/ack exchange, and proof that
+pending manual messages never appear as pane input. Update the install/start
+quickstart and practical-usability assessment, then record the local acceptance
+evidence. This task follows T01-T03.