feat(issue-18): decide liveness and delivery by the event protocol, not the screen

Contract (no new event types): heartbeat every N s (automatic timer),
unresponsive after K x N s without an event, `started` within T s of the
injection, retained per-job state, and a remote transport.

- registry: heartbeat_sec / heartbeat_misses / ack_timeout_sec / transport
  fields; idle_timeout_sec derives K x N unless explicit (defaults 30/4/60
  keep the historical 120 s idle window).
- heartbeat.py + publish_event --heartbeat N: detached fixed-cadence timer
  publishing signed `progress` heartbeats (threaded wire publish, local
  record first); stopped by the terminal event via pidfile, by re-dispatch
  and by lifetime. Terminal events refuse --heartbeat.
- publish_event: retained `<prefix>/state` (status, last_event, seq, HMAC)
  sent on the same connection after every event (--no-state to skip);
  publisher.publish_raw takes extra messages.
- job_subscriber: subscribes the state topic, recovers terminal status from
  retained state, resets idle on any accepted message, records seq_gap and
  reconnected in the audit log, idle budget before the first event is
  T + K x N (--ack-timeout), --remote mirrors started/terminal events into
  the registry through the transition boundary.
- lib.sh send_keys_safe: an accepted-but-unconfirmed submission is confirmed
  by agent_status working or the job's own `started` (_sks_job_started);
  pane change and busy token are no longer delivery signals.
- wrapper: --heartbeat/--heartbeat-misses/--ack-timeout (MAM_* env),
  injected start command arms the timer, brief states the contract,
  _wait_started (registry / events.log / subscriber log, bounded by T and
  the wall clock) replaces the 10 s inject grace, R1 grace uses only the
  on-disk event age (herdr/pane logged once as a diagnostic),
  remote:<name> sessions skip preflight/idle/pane and dispatch over the
  broker (remote_dispatch).
- remote.py (+ scripts shim): signed retained dispatch (MAM_DISPATCH_SECRET)
  and a runner that mirrors the job into its own registry with the
  orchestrator's identity, publishes started --heartbeat, runs --exec and
  publishes the terminal event.
- loop runner: passes MAM_HEARTBEAT_SEC / MAM_HEARTBEAT_MISSES /
  MAM_ACK_TIMEOUT_S through; YAML rows with transport: remote delegate as
  remote:<name>.
- docs: MESSAGING.md 2.5 contract + remote transport, delegate-job SKILL.md,
  registry.md, loop SKILL.md.
- tests: tests/test_issue18_liveness_contract.py (16); issue 14 pane-signal
  tests flipped to started-based; issue 6 working-agent tests acknowledge
  with started; CLI snapshot/help captures refreshed.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VCgu9Fa9iT7TbJUSzdq4Ff

.agents/skills/lib_py/loop/runner.py

@@ -241,6 +241,32 @@ class LoopRunner:
             return "codex"
         return "claude"
 
+    def session_label(self, name: str) -> str:
+        """`herdr:<name>` for a pane-backed session, `remote:<name>` for a row
+        registered with `transport: remote` (Issue #18: the prompt then goes
+        over the broker and no herdr/pane/lsof/ps path is taken)."""
+        state = getattr(self, "_sessions_state", None)
+        if state is None:
+            state = self.load_sessions_state()
+            self._sessions_state = state
+        for s in state.get("herdr_sessions", []):
+            if s.get("name") == name and str(s.get("transport") or "").lower() == "remote":
+                return f"remote:{name}"
+        return f"herdr:{name}"
+
+    def contract_args(self) -> List[str]:
+        """Liveness-contract knobs passed through to every delegate job
+        (Issue #18): MAM_HEARTBEAT_SEC (N), MAM_HEARTBEAT_MISSES (K),
+        MAM_ACK_TIMEOUT_S (T). The wrapper derives --idle-timeout as K x N."""
+        args: List[str] = []
+        for env_name, flag in (("MAM_HEARTBEAT_SEC", "--heartbeat"),
+                               ("MAM_HEARTBEAT_MISSES", "--heartbeat-misses"),
+                               ("MAM_ACK_TIMEOUT_S", "--ack-timeout")):
+            val = os.environ.get(env_name)
+            if val and val.isdigit() and int(val) > 0:
+                args += [flag, val]
+        return args
+
     def resolve_all_reviewers(self, state: Dict[str, Any]) -> List[str]:
         """Resolve running reviewer sessions excluding creator."""
         reviewers = []
@@ -266,12 +292,12 @@ class LoopRunner:
         def _run_cmd(p_text: str):
             cmd = [
                 "bash", str(wrapper_script), "submit",
-                "--agent-session", f"herdr:{agent_session}",
+                "--agent-session", self.session_label(agent_session),
                 "--agent", agent_type,
                 "--type", "direct",
                 "--role", role,
                 "--prompt", p_text,
-            ]
+            ] + self.contract_args()
             env = dict(os.environ)
             if "DELEGATE_JOB_PYTHON" not in env:
                 env["DELEGATE_JOB_PYTHON"] = sys.executable