fix: bring the skill, plugin, README and API docs in line with the merged agent behaviour (release review)

The self-gate now says the skill reads saved Codex conversations offline outside a session; the staging
reference says only tagged input gets 409 during a guarded submit (the rest is held), and the API
reference notes a managed write past a full hold queue falls back to a direct write. Also: missing
reference rows, agent --help naming inspect/stage/submit, the tunnel opt-in in Remote Access, MCP wording.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

plugins/codeman/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "codeman",
-  "description": "Drive Codeman, the self-hosted session manager for AI coding agents, from inside a Claude Code session: spawn worker sessions, prompt them, wait for them, read their answers, clean up. Acts only inside a Codeman-managed session.",
+  "description": "Drive Codeman, the self-hosted session manager for AI coding agents, from inside a Claude Code session: spawn worker sessions, prompt them, wait for them, read their answers, clean up. Acts inside a Codeman-managed session; outside one it only reads saved Codex conversations offline.",
   "version": "1.45.0",
   "author": {
     "name": "Ark0N",

plugins/codeman/README.md

@@ -7,7 +7,7 @@ The agent skill for [Codeman](https://getcodeman.com), the self-hosted mission c
 /plugin install codeman@codeman
 ```
 
-The skill acts only inside a Codeman-managed session (`CODEMAN_MUX=1`) and refuses everywhere else, so installing it globally costs nothing for unrelated sessions.
+The skill acts inside a Codeman-managed session (`CODEMAN_MUX=1`). Outside one it only reads saved Codex conversations offline (`codeman history read`) and refuses everything else, so installing it globally costs nothing for unrelated sessions.
 
 Pick one install route. Codeman can inject the skill into each case itself (App Settings, Agent Skill), and `codeman skill install` writes a user-level copy; a Claude Code that has one of those AND this plugin lists the skill twice, as `codeman` and `codeman:codeman`. Both work, the second is just noise.
 

plugins/codeman/skills/codeman/reference/inspection-and-staging.md

@@ -96,14 +96,19 @@ failed or was ambiguous, the pane or input changed, or no frame verified in time
 says the message may already be in the composer: no receipt was issued. Do not
 stage again on top of it; follow [Recover a stranded draft](#recover-a-stranded-draft) below first.
 
-While a submit's Enter is in flight (milliseconds), `send` and other input to that
-session answer `409 CONFLICT` with nothing written; retry the input.
+While a submit's Enter is in flight (milliseconds, plus the moment it takes to
+write input held behind it), TAGGED input to that session (`clientId` and `seq`,
+which `codeman agent send` and `interrupt` always carry) answers `409 CONFLICT`
+with nothing written; retry it. Untagged input, terminal keystrokes, `send-key`
+and Codeman's own managed writes are held instead and written in arrival order
+once the Enter is out.
 
 Submit checks the caller, session, hash, expiry, pane lifecycle, input revision,
 geometry, exact composer and caret, then sends one conditional Enter at the session's input
 boundary. It first waits until 250 ms have passed since stage typed (Codex turns an
 Enter that follows typed text within 120 ms into a newline), so submitting right
-after stage is fine. Competing Codeman writes are refused during dispatch. Browser/API/key
+after stage is fine. Competing Codeman writes are held during dispatch and written
+after it, except tagged input, which is refused with `409`. Browser/API/key
 input and managed restarts invalidate receipts even when the visible text or pid
 is restored. Direct tmux edits are outside that input serialization; captures
 remain evidence at the time observed, rather than terminal isolation.