docs: clarify multi-repo alpha startup contract

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a03397-4d51-7fd1-8ff2-946eb22ea2bc

workplans/TAMQ-WP-0004-operator-installable-local-alpha.md

@@ -4,7 +4,7 @@ type: workplan
 title: "Operator-installable local alpha session"
 domain: communication
 repo: tmux-amq
-status: ready
+status: active
 owner: codex
 topic_slug: coulomb-social
 planning_priority: P0
@@ -30,20 +30,46 @@ cd tmux-amq
 make install
 
 tamq --version
-tamq start tmux-amq
+tamq start --command codex railiance-platform activity-core
 ```
 
-`tamq start tmux-amq` starts or reuses the local service and managed `tamq`
+`tamq start --command codex railiance-platform activity-core` starts or reuses
-session, opens the `tmux-amq` gita repository in its registered path, launches
+the local service and managed `tamq` session, creates windows named
-Codex behind `tamq tap`, and attaches the operator to the session. The detached
+`railiance-platform` and `activity-core` in that order, roots them at their exact
-workflow must also work:
+`gita freeze` paths, launches `codex` behind `tamq tap` in each window, and
+attaches the operator to the first window. Because Codex is the default agent
+command, this shorthand must be equivalent:
 
 ```bash
-tamq start --detach tmux-amq
+tamq start railiance-platform activity-core
+```
+
+The repository operands are gita slugs, not startup modes. A single operand such
+as `tmux-amq` means "open one window for the tmux-amq repository"; it has no
+special meaning to tamq.
+
+The detached workflow must also work:
+
+```bash
+tamq start --detach --command codex railiance-platform activity-core
 tamq status
 tamq attach
 ```
 
+## Supported startup modes
+
+- Interactive multi-repo start: create/reuse the requested windows, launch the
+  agent command in new windows, then attach.
+- Detached multi-repo start: perform the same setup with `--detach`, print the
+  endpoint summary, and return to the shell.
+- Existing-session attach: `tamq attach` attaches without changing repository
+  membership or launching another agent process.
+- Advanced service-only operation: `tamq serve` runs the local broker in the
+  foreground for diagnostics or supervision.
+- Degraded tmux-only operation: `tamq start --no-service ...` may be retained
+  only with explicit, tested semantics; it must not attempt socket registration
+  when no service exists or imply that messaging is available.
+
 ## Acceptance gates
 
 - `make install` is documented, repeatable, and installs an isolated `tamq`
@@ -53,6 +79,13 @@ tamq attach
   registration produces a direct actionable error before a partial session is
   left behind.
 - The first and subsequent windows start in their exact `gita freeze` paths.
+- `--command` is the documented option name; the existing `--cmd` spelling
+  remains a compatibility alias. Omitting both selects `codex`.
+- Each distinct repository operand creates exactly one same-named window and
+  invokes the selected agent command exactly once when that window is created.
+- The required two-repository acceptance case creates windows
+  `railiance-platform` and `activity-core`, rooted at their registered paths,
+  with Codex running automatically in both.
 - Default `tamq start` attaches; `--detach` returns to the caller and prints a
   useful endpoint/session summary; `tamq attach` attaches later.
 - Repeating `tamq start` safely reuses the service/session and does not create
@@ -87,11 +120,15 @@ priority: high
 state_hub_task_id: "8e926f2b-b7b2-53f5-81e1-9bdd3c4b7d3e"
 ```
 
-Implement the currently unused `--detach` flag. Make non-detached `tamq start`
+Add `--command` as the canonical start option while retaining `--cmd` as an
-attach to the managed session after successful endpoint registration and pending
+alias, with `codex` as the default. Implement the currently unused `--detach`
-delivery. Ensure the first boot window uses the selected repository's registered
+flag. Make non-detached `tamq start` attach to the managed session after
-path rather than the caller's current directory, and preserve idempotent reuse of
+successful endpoint registration and pending delivery. Ensure all boot windows,
-existing windows.
+including the first, use their selected repositories' registered paths rather
+than the caller's current directory. Invoke the agent command exactly once per
+new window and preserve idempotent reuse of existing windows. Define and test
+`--no-service` as an explicitly degraded tmux-only mode or remove it from the
+alpha surface.
 
 ## Add installation and startup preflight
 
@@ -119,9 +156,11 @@ state_hub_task_id: "76990b5d-b0d7-562f-8316-1b9cc452cadf"
 
 Add automated coverage using an isolated uv tool directory, state directory,
 socket, and tmux server. Use a deterministic benign agent fixture in automation,
-then perform the operator acceptance with the installed `tamq` command and Codex.
+then perform the operator acceptance with the installed `tamq` command and the
-Prove attach/detach semantics, correct pane directories, idempotent reuse,
+exact `railiance-platform activity-core` Codex invocation above. Prove that two
-message injection/history, shutdown, and cleanup. This task follows T01-T03.
+same-named windows open in their registered paths with Codex running
+automatically, along with attach/detach semantics, idempotent reuse, message
+injection/history, shutdown, and cleanup. This task follows T01-T03.
 
 ## Publish the alpha quickstart and evidence