docs: freeze interface contracts IC-1 through IC-4

- IC-1: removed tree event (OQ-1, Gruppe T out of scope), deferred resize msg (OQ-2)
- IC-2: thumbnail endpoint returns raw text/plain (OQ-3)
- IC-3: deviceToken/environment optional pre-Phase-2, mandatory in Phase 2 (OQ-4)
- IC-4: frozen as-is, no changes
- Added OQ-5 decision: per-server tmux control-mode connection
- Recorded freeze decisions and rationale in PHASE-1-sidecar.md
- Updated SYNC.md: contracts table frozen 2026-05-15

docs/PHASE-1-sidecar.md

@@ -127,7 +127,6 @@ type ClientToServer =
 
 type ServerToClient =
   | { type: "state"; value: "thinking" | "tool" | "idle" | "awaiting-input"; tool?: string; ts: number }
-  | { type: "tree"; nodes: TreeNode[]; current: string }   // optional, read-only
   | { type: "snapshot"; seq: number; data: string }        // base64 ANSI snapshot
   | { type: "session-meta"; name: string; description?: string; createdAt: string }
   | { type: "error"; code: string; message: string };
@@ -136,6 +135,11 @@ type ServerToClient =
 Binary frames carry an out-of-band `seq` via a leading 8-byte
 big-endian header. Owner: T-1.5.
 
+> **Frozen 2026-05-15.**
+> - `tree` event **removed** (no current consumer; Gruppe T out of iOS scope). Can be re-added later via CCR.
+> - `resize` message **deferred** — fixed 120×40 for v1.
+> - `snapshot` event remains as specified.
+
 ### IC-2 — HTTP REST shape
 
 ```
@@ -145,12 +149,14 @@ GET    /sessions                   → [{ id, name, description, state, lastOutp
 PATCH  /sessions/:id               → updates @description
 DELETE /sessions/:id               → kills tmux session, optionally clears buffer
 GET    /sessions/:id/commands      → [{ name, description, args }]
-GET    /sessions/:id/thumbnail     → text/plain capture-pane (40×12)
+GET    /sessions/:id/thumbnail     → text/plain capture-pane (40×12) — raw terminal text, client parses lines
 ```
 
 All endpoints behind bearer token, all responses `application/json` unless
 noted. Owner: T-1.5..T-1.7.
 
+> **Frozen 2026-05-15.** `/sessions/:id/thumbnail` returns **raw text/plain**.
+
 ### IC-3 — Pairing payload
 
 QR encodes a `pi-remote://` URL:
@@ -161,6 +167,8 @@ pi-remote://<host>:<port>?pair=<pairing-token>&fp=<sha256-hex>&name=<sidecar-nam
 
 Pairing exchange: client `POST /pair` with `{ pairingToken, deviceToken?, environment?, deviceName? }` → server replies `{ bearerToken, sidecarId }`. Owner: T-1.3.
 
+> **Frozen 2026-05-15.** `deviceToken` and `environment` are **optional** pre-Phase 2 (no iOS app yet), become **mandatory** when Phase 2 iOS work starts.
+
 ### IC-4 — Config schema (TOML)
 
 ```toml
@@ -193,6 +201,8 @@ model          = "claude-haiku-4-5"
 
 Owner: T-1.7.
 
+> **Frozen 2026-05-15.**
+
 ## Branching Strategy
 
 - Each task is a feature branch off `main`, named `feat/p1-<task-id>-<slug>`,

docs/SYNC.md

@@ -99,10 +99,10 @@ Phase 2 kicks off.
 
 | ID | Defined in | Status | Frozen at | Owner of changes |
 |---|---|---|---|---|
-| IC-1 — WebSocket frame protocol | `PHASE-1-sidecar.md` §Interface Contracts | **draft** — needs orchestrator sign-off before T-1.5 starts | — | T-1.5 lead, with sign-off from any active T-2.x owner |
-| IC-2 — HTTP REST shape | `PHASE-1-sidecar.md` §Interface Contracts | **draft** | — | T-1.5..T-1.7 leads |
-| IC-3 — Pairing payload | `PHASE-1-sidecar.md` §Interface Contracts | **draft** | — | T-1.3 lead |
-| IC-4 — Config TOML schema | `PHASE-1-sidecar.md` §Interface Contracts | **draft** | — | T-1.7 lead |
+| IC-1 — WebSocket frame protocol | `PHASE-1-sidecar.md` §Interface Contracts | **frozen** | 2026-05-15 | T-1.5 lead, with sign-off from any active T-2.x owner |
+| IC-2 — HTTP REST shape | `PHASE-1-sidecar.md` §Interface Contracts | **frozen** | 2026-05-15 | T-1.5..T-1.7 leads |
+| IC-3 — Pairing payload | `PHASE-1-sidecar.md` §Interface Contracts | **frozen** | 2026-05-15 | T-1.3 lead |
+| IC-4 — Config TOML schema | `PHASE-1-sidecar.md` §Interface Contracts | **frozen** | 2026-05-15 | T-1.7 lead |
 | IC-2.1 — `SessionConnection` Swift surface | `PHASE-2-ios-mvp.md` §Interface Contracts | **draft** — freeze at Phase 2 kickoff | — | T-2.5 lead |
 
 **Freeze protocol:** when the orchestrator is ready to fan out work that
@@ -141,6 +141,16 @@ Threads that don't belong in a single phase plan.
   wrong or unbuildable, write a short note here under **History**, plus
   open a CCR if it changes a frozen contract. The spec itself stays
   immutable until a v4 review round.
+- **Interface contract freeze (2026-05-15).** IC-1 through IC-4 frozen.
+  - OQ-1: `tree` event removed from IC-1. Gruppe T out of iOS scope.
+  - OQ-2: `resize` message deferred; fixed 120×40 for v1.
+  - OQ-3: `/sessions/:id/thumbnail` returns raw text/plain.
+  - OQ-4: `deviceToken`/`environment` optional pre-Phase 2, mandatory in Phase 2.
+  - OQ-5: **tmux control mode: per-server connection.** One long-lived `tmux -C` connection
+    to the tmux server, multiplexing all session subscriptions.
+    Scales better than per-session (fewer processes, shared event parsing),
+    and tmux control mode naturally supports this — we can attach once and
+    subscribe to multiple sessions/panes. T-1.1 should implement this pattern.
 - **Risks materialised.** When a `Risks` row from a phase plan actually
   hits, log it here with the workaround used.
 - **Tools / shared scripts.** Anything added under `scripts/` that's