fix(tmux): explicit transport-only dispatch and safe remote quoting (#1496)

tools/tmux/README.md

@@ -28,7 +28,7 @@ Example exchange:
 ## The helper: `agent-send.sh`
 
 Prepends the preamble automatically (auto-detecting your own `host:session`) and
-delivers reliably to local OR remote panes.
+dispatches transport to local OR remote panes; application acceptance remains unknown.
 
 ```bash
 # Local target (same host, default tmux server)
@@ -47,7 +47,7 @@ echo "msg" | agent-send.sh -s <dst_session>
 
 Key flags: `-L` named tmux socket · `-s` dst session (required) · `-H` ssh target for remote · `-n` dst
 hostname for the preamble (else auto-resolved) · `-m`/`-f`/stdin body · `-S`
-override source label · `-v` verbose · `-r N` Enter-flush attempts.
+override source label · `-v` transport metadata only · `-r N` compatibility-only, no retries.
 
 For durable fleet use, prefer exact tmux targets such as `=coder0`. The helper
 normalizes exact session targets to pane-qualified targets internally so pane
@@ -75,13 +75,31 @@ plain `Enter` keyname often does not register at all — `C-m` is needed.
 
 `send-message.sh` solves this for a **local** pane: bracketed-paste the body
 (so multi-line content doesn't submit early), pause, then send `Enter` as its own
-keystroke and flush with a second, verifying against a draft heuristic.
+keystroke. It does not send automatic extra Enters. The legacy `-r` option
+is accepted for compatibility but no longer authorizes flushes.
+
+Jason approved the **transport-only contract** after independent review demonstrated
+that screen layouts cannot prove application acceptance. Exit 0 means tmux accepted
+buffer load, one paste and one Enter command, not that the application submitted,
+queued or processed the message. Output explicitly says:
+`transport dispatched; application acceptance unknown`.
+
+No capture-pane or editor/footer parser participates in transport success. Hidden
+retained drafts can coexist with successful transport; they are never called
+confirmed delivery. Failure exits remain nonzero (1 target resolution, 2 transport
+failed/partial/uncertain, 3 usage; wrapper 4 ambiguous socket). Failed paste is not
+retried with another mode. Never blindly replay a partial/uncertain operation.
+Verbose output is content-free transport metadata. Runtime-bound receipts are
+separate future work, not implemented by this tool.
 
 `agent-send.sh` solves the **remote** case by _shipping `send-message.sh` over ssh_
 (`ssh host bash -s -- ... < send-message.sh`) and running it local to the target
 pane — so the reliable send-keys always happens on the pane's own host. The remote
 needs only `bash` + `tmux` + `base64`; **no mosaic install required there**. The
-message crosses the wire as base64 (`-b`) to avoid all shell-quoting hazards.
+message crosses the wire as base64 (`-b`). Every remote command argument is
+independently POSIX-shell quoted; retry syntax is validated before invoking SSH.
+The executing-shell regression suite checks quote-bearing target/socket arguments
+and rejects an invalid retry before any SSH call.
 
 ## Files