feat: add experimental pushy delivery mode

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a03397-4d51-7fd1-8ff2-946eb22ea2bc

README.md

@@ -54,13 +54,37 @@ tamq start --command 'htop --tree' flex-auth audit-core
 `--cmd` remains an alias for `--command`. Repeated starts reuse existing
 windows and never run another initial command in them.
 
-By default, a routed message is also written as sanitized output to its target
-pane. Use `--no-display` when you want durable inbox-only delivery:
+Select an endpoint delivery mode at startup. `output` is the safe default;
+`inbox` keeps messages durable without displaying them:
 
 ```bash
-tamq --no-display flex-auth audit-core
+tamq --mode output flex-auth audit-core
+tamq --mode inbox flex-auth audit-core
 ```
 
+`--no-display` remains a compatibility alias for `--mode inbox`.
+
+Experimental `pushy` mode submits each routed message to the target pane as
+input. It is intended for coding-agent interfaces that queue user prompts:
+
+```bash
+tamq --mode pushy --command codex flex-auth audit-core
+```
+
+The submitted line is sanitized and sender-labelled, then followed by exactly
+one Enter key:
+
+```text
+#flex-auth: please review the auth boundary [m-...]
+```
+
+This leading `#` makes an empty ordinary shell prompt treat the line as a
+comment. Pushy mode cannot determine whether a pane is an agent, a shell, or
+whether someone is already editing input: it can append to that input and
+submit the combined line. Use it only for panes whose occupant is known to
+accept or queue asynchronous prompts. Switching an existing endpoint to pushy
+may also submit pending messages that have never been displayed.
+
 ## Exchange messages manually
 
 Each managed shell exports its own repository slug as `TAMQ_REPO`. From the
@@ -152,9 +176,11 @@ it and all later messages pending. Filters never run in the background and
 cannot be combined with `--all` or `--json`.
 
 Outside a managed window, use `tamq inbox --repo audit-core` and optionally
-`--json`. Displayed messages remain durable and pending until acknowledged.
-Neither normal output delivery nor `--no-display` injects terminal keystrokes,
-so they cannot execute or alter a command being typed in the target pane.
+`--json`. Output-displayed messages remain durable and pending until
+acknowledged. Neither `output` nor `inbox` mode injects terminal keystrokes, so
+they cannot execute or alter a command being typed in the target pane. Pushy
+mode intentionally crosses that boundary and records accepted submissions as
+`injected`.
 
 After upgrading from an earlier alpha, recreate the managed session once so
 existing panes inherit the neutral shell contract, repository command `PATH`,
@@ -208,10 +234,13 @@ observation and message identity.
 
 Normal endpoints use terminal-output delivery: each message is written once to
 the target pane's PTY output and stays pending in the durable inbox until
-acknowledged. `--no-display` selects inbox-only manual mode. Neither becomes
-pane input. The legacy pane-input path is available only with the explicit
-`tamq start --tap --command ...` opt-in; it remains subject to the retry and
-acknowledgement limitations tracked by `TAMQ-WP-0003`.
+acknowledged. `--mode inbox` selects inbox-only manual mode. Neither becomes
+pane input. Experimental `--mode pushy` sends one checked tmux command list
+containing sanitized literal input followed by Enter, then records the message
+as `injected`. The older full-duplex pane-input path remains available only
+with the explicit `tamq start --tap --command ...` opt-in. Both input paths
+remain subject to the retry and acknowledgement limitations tracked by
+`TAMQ-WP-0003`.
 The visible endpoint label is `tmux-amq-<PID>`; each boot also receives an
 instance nonce so PID reuse cannot collide with prior leases or receipts.