---
id: TAMQ-WP-0012
type: workplan
title: "Pushy feedback circuit breaker and upgrade gate"
domain: communication
repo: tmux-amq
status: finished
owner: codex
topic_slug: coulomb-social
planning_priority: P0
planning_order: 17
created: "2026-08-25"
updated: "2026-08-25"
state_hub_workstream_id: "43d9c66a-0851-55b3-ad40-e9334a393fcd"
---

# Pushy feedback circuit breaker and upgrade gate

Stop a live pushy feedback incident, make stale delivery framing detectable,
and reject any legacy injected envelope that re-enters a tapped pane.

## Halt and characterize the live incident

```task
id: TAMQ-WP-0012-T01
status: done
priority: critical
state_hub_task_id: "e886f7ce-2d13-53e2-ba6e-be7bf34c47e1"
```

Stop the broker without changing panes or history and preserve evidence of the
alternating sender/target chain and recursively appended message identifiers.

## Enforce compatible pushy framing

```task
id: TAMQ-WP-0012-T02
status: done
priority: critical
state_hub_task_id: "373311a1-7ef6-5eef-af38-b79c6543786c"
```

Advertise and require a capability specific to non-routable pushy envelopes so
startup restarts a broker that still emits the legacy routable `#sender:` form.

## Add a tap-side circuit breaker and prove containment

```task
id: TAMQ-WP-0012-T03
status: done
priority: critical
state_hub_task_id: "f297c45d-1c0b-5c83-b67e-c32bcffb3bc8"
```

Recognize legacy injected envelopes by their durable message identity and
direction, refuse to enqueue them, and cover stale-service restart, false
positive boundaries, one-pass delivery, and isolated real-tmux containment.
Install the corrected build but leave the operator broker stopped and preserve
incident history unless cleanup is separately authorized.

## Completion evidence

- Stopped live broker PID 2656594 before diagnosis; panes and durable history
  were preserved. Message count stabilized at 105 with 14 pre-existing pending
  records and no active endpoint.
- The incident records alternate `flex-auth` and `audit-core`, append the prior
  message identifier on every hop, and prove an older `#sender:` pushy envelope
  was being routed by newer taps.
- Pushy startup now requires `pushy_input_non_routable_v1`, forcing a one-time
  restart of brokers that predate the `# from sender:` framing.
- The broker independently rejects a legacy hash envelope only when its final
  message identifier resolves to a durable delivery whose sender and target
  are the reverse of the observing tap. Unknown receipt-like user text remains
  routable.
- `make check`: 126 tests passed, including real tmux injection of a legacy
  envelope followed by proof that no second durable record appears.
- `make install`: refreshed `tmux-amq==0.1.0`. The operator broker remains
  stopped; the 82 incident-generated records were not deleted or acknowledged.
- Retry and acknowledgement residuals remain owned by `TAMQ-WP-0003`; this
  incident adds no untracked residual.