tmux-amq/workplans/TAMQ-WP-0003-delivery-reliability.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	state_hub_workstream_id
TAMQ-WP-0003	workplan	Delivery reliability and practical integration evidence	communication	tmux-amq	finished	codex	coulomb-social	2026-08-24	2026-08-26	7961275b-8f1f-5827-b9fc-46b3ac35fb73

Delivery reliability and practical integration evidence

Close the reliability gaps found during the 2026-08-24 intent and usability assessment before treating tmux-amq as an unattended local transport or as a stable coordination-engine dependency.

Enforce bounded delivery attempts

id: TAMQ-WP-0003-T01
status: done
priority: high
state_hub_task_id: "52c43745-5c28-599e-b74c-0386d5b51e68"

Persist attempt counts and failure reasons, apply the selected policy profile's retry cap, define lease-expiry behavior, and introduce an inspectable terminal failure state. Prove restart-safe behavior and avoid tight retry loops.

Completed with schema-v6 persistent attempt, deadline, and failure fields. Lease acquisition consumes an attempt; write failure or lease expiry releases ownership into configured bounded backoff. The selected endpoint policy caps attempts from one to nine, exhaustion becomes failed, and tamq retry is the explicit recovery action. Protocol events retain attempt, cap, reason, and retry timing without raw terminal output.

Enforce acknowledgement semantics

id: TAMQ-WP-0003-T02
status: done
priority: high
state_hub_task_id: "ff88d6c9-f4d7-52c7-9645-7c3a7a34ccb4"

Make delivery_ack_mode control whether injection completes delivery or waits for explicit recipient acknowledgement. Specify timeout, redelivery, duplicate, and late-acknowledgement behavior. This task follows the state model from T01.

Completed for every automatic delivery mode. injected completes after a successful terminal write. acknowledged enters awaiting_ack, schedules same-message-ID redelivery after the configured deadline, records ack_timeout on retries and exhaustion, and accepts a late acknowledgement even after failed. The contract warns that redelivery can duplicate terminal presentation and never represents task completion.

Add real tmux and PTY lifecycle coverage

id: TAMQ-WP-0003-T03
status: done
priority: high
state_hub_task_id: "9a3d84b4-55a5-5d18-b4ee-99ac4f111875"

Exercise a real tmux server, managed windows, control-mode injection, tamq tap, service shutdown, endpoint disappearance, and restart recovery without starting an external coding agent. Keep fast unit tests while adding a bounded integration suite.

Completed with a real isolated-tmux PTY fixture that proves initial dimensions, SIGWINCH resize propagation, raw mouse-sequence forwarding without newline buffering, and bounded cleanup. The installed-package lifecycle smoke now also proves service shutdown/restart, stable pane reuse, disappeared-session endpoint retirement, and clean recovery into a new tmux instance. The PTY proxy restores terminal state and forwards termination signals; --no-service bypasses the tap entirely as documented.

Align CI and operator documentation

id: TAMQ-WP-0003-T04
status: done
priority: medium
state_hub_task_id: "44939829-a52e-582a-b06b-60337b36080e"

Run the integration suite in Forgejo CI with explicit tmux and gita setup. Update README claims about retries, acknowledgement, prerequisites, and maturity from verified behavior. This task follows T01-T03.

Forgejo CI now runs make check, including generated-gita and isolated tmux installation fixtures, compile/diff checks, and CLI/capture help smokes on Python 3.11. README, SCOPE, configuration examples, and the agent introduction describe the implemented state machine and terminal-comprehension boundary.

Residuals

Long-duration and arbitrary-terminal soak coverage remains a maturity gate in SCOPE rather than a missing part of this bounded reliability contract. The coordination runtime above TAMQ remains owned by coordination-engine.