feat: deliver installable local alpha sessions

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a03397-4d51-7fd1-8ff2-946eb22ea2bc

SCOPE.md

@@ -42,7 +42,7 @@ transport.
 | Direct repository addressing | Implemented | Exact `gita` validation and `@repo:` parsing are covered by tests. |
 | Durable, inspectable local queue | Implemented | SQLite history, leases, endpoint records, inspect/history, JSONL export/replay, acknowledgement, and purge are present. |
 | Local socket service | Implemented | Peer-credential checks and structured ping/register/send/history/ack/endpoints/disconnect operations are tested. |
-| Tmux endpoint lifecycle and delivery | Implemented, integration confidence limited | The manager, control client, and delivery loop exist, but tests use fakes and CI does not exercise real tmux panes or agent processes. |
+| Tmux endpoint lifecycle and delivery | Implemented for local alpha | Real isolated-tmux and installed-package tests prove exact repository windows, stable reuse, control-mode injection, durable history transition, service stop, and bounded cleanup. |
 | Full-duplex input observation | Implemented, lightly proven | `tamq tap` preserves PTY traffic and observes complete address lines; PTY code coverage is 23%. |
 | Bounded retry behavior | Not enforced | Failed injection remains pending and becomes claimable after lease expiry, but no attempt counter or terminal failure state applies the configured cap. |
 | Acknowledgement policy | Partially implemented | Explicit acknowledgement and the configuration field exist; delivery always marks a successful tmux injection as `injected`, irrespective of `delivery_ack_mode`. |
@@ -50,15 +50,19 @@ transport.
 
 ## Practical Usability
 
-The following operator path was exercised successfully on 2026-08-24 with an
-isolated state directory: start the socket service, ping it, inspect status,
-queue a message to registered repo `tmux-amq`, inspect history, export one JSONL
-record, and stop the service.
+The installable alpha path was exercised successfully on 2026-08-24 with both
+isolated fixtures and the operator's registered repositories. `make install`
+produced a user-level `tamq` command; `tamq start --detach --command codex
+railiance-platform activity-core` created two same-named live panes rooted at
+their exact gita paths. Repeating the command retained the same session instance
+and pane PIDs. The automated installed-package path also proved message
+injection, history, status, service stop, and cleanup.
 
 Suitable today:
 
 - Local queue, history, export/replay, and diagnostic use.
-- Controlled experiments with gita-registered repositories and tmux endpoints.
+- Interactive local Codex sessions over one or more gita-registered repositories.
+- Controlled message-routing experiments between managed tmux endpoints.
 - Developing and testing the future coordination-engine adapter against the
   local socket boundary.
 
@@ -66,20 +70,20 @@ Not yet suitable:
 
 - Unattended or high-confidence delivery where bounded retries and positive
   recipient acknowledgement are required.
-- Production-style operation without a real tmux/PTY integration test suite,
-  crash-recovery evidence, and stronger process supervision evidence.
+- Production-style operation without full PTY lifecycle, crash-recovery, and
+  stronger process-supervision evidence.
 - Cross-host messaging or use as a general-purpose broker.
 
-The suite currently has 50 passing tests and 73% statement coverage. Coverage
+The suite currently has 63 passing tests and 75% statement coverage. Coverage
 is strongest in durable storage and registry handling, and weakest in the PTY
-tap, control-mode process handling, and CLI orchestration. The Forgejo CI job
-runs unit tests and CLI help/version smoke checks on Python 3.11, but does not
-install or exercise tmux and gita end to end.
+tap and CLI orchestration. The Forgejo CI job installs tmux and uv, runs the
+real-tmux and isolated installed-package session tests with a deterministic gita
+fixture, and retains CLI help/version smoke checks on Python 3.11.
 
 ## Next Usability Gates
 
-- `TAMQ-WP-0003` owns bounded retry state, acknowledgement enforcement,
-  lifecycle recovery, and real tmux/PTY integration evidence.
+- `TAMQ-WP-0003` owns bounded retry state, acknowledgement enforcement, crash
+  recovery, and deeper PTY lifecycle evidence.
 - `TAMQ-WP-0002` owns the coordination-engine adapter after the local delivery
   contract is sufficiently reliable.