tmux-amq/workplans/TAMQ-WP-0012-pushy-feedback-circuit-breaker.md

id	type	title	domain	repo	status	owner	topic_slug	planning_priority	planning_order	created	updated	state_hub_workstream_id
TAMQ-WP-0012	workplan	Pushy feedback circuit breaker and upgrade gate	communication	tmux-amq	finished	codex	coulomb-social	P0	17	2026-08-25	2026-08-25	43d9c66a-0851-55b3-ad40-e9334a393fcd

Pushy feedback circuit breaker and upgrade gate

Stop a live pushy feedback incident, make stale delivery framing detectable, and reject any legacy injected envelope that re-enters a tapped pane.

Halt and characterize the live incident

id: TAMQ-WP-0012-T01
status: done
priority: critical
state_hub_task_id: "e886f7ce-2d13-53e2-ba6e-be7bf34c47e1"

Stop the broker without changing panes or history and preserve evidence of the alternating sender/target chain and recursively appended message identifiers.

Enforce compatible pushy framing

id: TAMQ-WP-0012-T02
status: done
priority: critical
state_hub_task_id: "373311a1-7ef6-5eef-af38-b79c6543786c"

Advertise and require a capability specific to non-routable pushy envelopes so startup restarts a broker that still emits the legacy routable #sender: form.

Add a tap-side circuit breaker and prove containment

id: TAMQ-WP-0012-T03
status: done
priority: critical
state_hub_task_id: "f297c45d-1c0b-5c83-b67e-c32bcffb3bc8"

Recognize legacy injected envelopes by their durable message identity and direction, refuse to enqueue them, and cover stale-service restart, false positive boundaries, one-pass delivery, and isolated real-tmux containment. Install the corrected build but leave the operator broker stopped and preserve incident history unless cleanup is separately authorized.

Completion evidence

• Stopped live broker PID 2656594 before diagnosis; panes and durable history were preserved. Message count stabilized at 105 with 14 pre-existing pending records and no active endpoint.
• The incident records alternate flex-auth and audit-core, append the prior message identifier on every hop, and prove an older #sender: pushy envelope was being routed by newer taps.
• Pushy startup now requires pushy_input_non_routable_v1, forcing a one-time restart of brokers that predate the # from sender: framing.
• The broker independently rejects a legacy hash envelope only when its final message identifier resolves to a durable delivery whose sender and target are the reverse of the observing tap. Unknown receipt-like user text remains routable.
• make check: 126 tests passed, including real tmux injection of a legacy envelope followed by proof that no second durable record appears.
• make install: refreshed tmux-amq==0.1.0. The operator broker remains stopped; the 82 incident-generated records were not deleted or acknowledged.
• Retry and acknowledgement residuals remain owned by TAMQ-WP-0003; this incident adds no untracked residual.