0002 — SendMessage is the agent-to-agent channel; tmux is hosting only

Status: Accepted
Date: 2026-08-29
Deciders: Gera (in conversation, 2026-08-29: "we used to use Tmuxes for… agents to message each other, but then they came out with the send message… method… I didn't want to get forced into the Tmux ecosystem"), recorded here by the ccswitch session — because the decision previously existed only in that conversation, and a session building fleet tooling the same night could not have learned it from anywhere on disk.

The rule

Agent-to-agent communication is SendMessage (or the msg CLI, which parks into a session's inbox). Typing into another session's pane with tmux send-keys — the pre-SendMessage coordination mechanism — is retired.
tmux is a hosting substrate. A session may act on its own pane (respawning itself after a rotation; wedge-heal respawning the pane it runs in) because that is process management, not communication.
A prompt for a restarted session rides the launch, never the terminal. claude --resume <sid> "<prompt>" auto-submits (verified live 2026-08-29). Nothing in the fleet simulates a human typing into a terminal any more.
A human driving panes by hand (/tmux drive) is out of scope. That is Gera operating his own sessions — the rule governs agents.

The send-keys path required solving pane identity from the outside, and the fleet's record shows it repeatedly failing: pane titles are stale/shared, scrollback echoes session ids that are not the pane's own, and long sends collapse into paste blobs that silently stop being commands (all documented in the 2026-08-03 memory that authorized the practice — the gotchas outlived the authorization).
Three misattribution incidents in two days (2026-08-28/29): work briefs delivered to sessions that never sent or asked for them, twice to sessions named "doc" that were different sessions. Identity-less channels made every delivery a guess. SendMessage carries addressing; send-keys carries keystrokes.
Wrapping every session in tmux to make send-keys possible is what created the tmux lock-in Gera rejected; that wrapping code was deliberately deleted.

Surface	Disposition
`~/.claude/skills/tmux/drive-send.sh` used for agent-to-agent sends	Retired for agents. Survives only under `/tmux drive` (human-invoked).
Memory `feedback_tmux_send_keys_authorized`	Done 2026-08-29 — marked superseded for coordination, own-pane gotchas retained.
wedge-heal's `send-keys` resubmit	Done 2026-08-29 — ccswitch#40 replaced poll+send-keys with the primed `--resume` form.
Any future agent send-keys into a non-self pane	Enforcement candidate for `guard-bash.sh` (a rule in the style of rule 13); not yet implemented — until then this ADR is the authority.

A session that needs another session to act sends a message and continues; delivery, queueing, and the addressee's turn boundary are the platform's problem, not the sender's.
Anything that still needs a pane touched (respawn, env) is self-only, and self-only is enforced in code where it exists (wedge-heal's $TMUX_PANE guard).