test(task-persistence): wire both mtime probes and correct four vacuous mutation-kill titles

docs/architecture/task-lifecycle-model.md

@@ -42,18 +42,23 @@ TLA+/PlusCal or Quint with TLC becomes a better fit when the lifecycle needs tem
 
 ## Production mapping
 
-| Model concept             | Production concept                                                                                                   |
-| ------------------------- | -------------------------------------------------------------------------------------------------------------------- |
-| Task record and status    | `HistoryItem` persisted by `TaskHistoryStore`                                                                        |
-| `delegate(parent, child)` | `ClineProvider.delegateParentAndOpenChild`                                                                           |
-| `interrupt(child)`        | cancellation or eviction through `markDelegatedChildInterrupted`                                                     |
-| `complete(child)`         | `ClineProvider.reopenParentFromDelegation`                                                                           |
-| `abandon(child)`          | `ClineProvider.abandonSubtask`                                                                                       |
-| Pending-action settlement | `TaskHistoryStore.clearPendingActionIfMatching` compare-and-clear in the rejected-delegation settlement path (#1714) |
-| Atomic event step         | `atomicReadAndUpdate`, `atomicUpdatePair`, and per-parent delegation transition lock                                 |
-| Event interleaving        | Competing completion, cancellation, abandonment, and new delegation calls                                            |
-
-The model has three fixed task slots, enough to cover competing siblings and a nested parent-child-grandchild chain. It explores every reachable interleaving through depth 12, deduplicating canonical states. Representative checks also exercise rejected operations that do not create a new state: a second concurrent delegation while the first child is active, stale completion after re-delegation, late completion after abandonment, completion after interruption, and nested completion. Named semantic landmarks require the graph to retain interrupted-child re-delegation and nested delegation even when the raw state total changes.
+| Model concept                                             | Production concept                                                                                                                                                                                                                                                                                         |
+| --------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Task record and status                                    | `HistoryItem` persisted by `TaskHistoryStore`                                                                                                                                                                                                                                                              |
+| `delegate(parent, child)`                                 | `ClineProvider.delegateParentAndOpenChild`                                                                                                                                                                                                                                                                 |
+| `interrupt(child)`                                        | cancellation or eviction through `markDelegatedChildInterrupted`                                                                                                                                                                                                                                           |
+| `complete(child)`                                         | `ClineProvider.reopenParentFromDelegation`                                                                                                                                                                                                                                                                 |
+| `abandon(child)`                                          | `ClineProvider.abandonSubtask`                                                                                                                                                                                                                                                                             |
+| Pending-action settlement                                 | `TaskHistoryStore.clearPendingActionIfMatching` compare-and-clear in the rejected-delegation settlement path (#1714)                                                                                                                                                                                       |
+| `reconcileStartup(parent)`                                | startup/periodic `TaskHistoryStore.reconcileDelegationStateCore` orphan repair                                                                                                                                                                                                                             |
+| `markLiveElsewhere(child)` / `expireLiveElsewhere(child)` | child history-file mtime inside the bounded freshness window (`\|now - mtime\| < LIVE_CHILD_MTIME_THRESHOLD_MS`) vs outside it; the store's transient-stat sentinel sits one millisecond inside the future bound (abstracted; no wall clock in model)                                                      |
+| `heartbeat(child)` / `expireHeartbeat(child)`             | persisted `lastActivityAt` liveness heartbeat fresh vs stale against the same bounded window (production: the owning session's throttled heartbeat across the child's whole active lifetime — long streaming turns, long tool calls, and ask-idle periods alike — shared predicate `isDelegatedChildLive`) |
+| Atomic event step                                         | `atomicReadAndUpdate`, `atomicUpdatePair`, and per-parent delegation transition lock                                                                                                                                                                                                                       |
+| Event interleaving                                        | Competing completion, cancellation, abandonment, and new delegation calls                                                                                                                                                                                                                                  |
+
+The model has three fixed task slots, enough to cover competing siblings and a nested parent-child-grandchild chain, plus two abstract booleans per slot recording whether an active child's session shows life: one for ownership by another window (recent history-file mtime) and one for a fresh persisted `lastActivityAt` heartbeat from the owning session. It explores every reachable interleaving through depth 12, deduplicating canonical states. Representative checks also exercise rejected operations that do not create a new state: a second concurrent delegation while the first child is active, stale completion after re-delegation, late completion after abandonment, completion after interruption, and nested completion. Named semantic landmarks require the graph to retain interrupted-child re-delegation and nested delegation even when the raw state total changes, a delegated parent whose active child is live in another window surviving startup reconciliation unchanged, a delegated parent whose active child heartbeats through a long streaming turn (stale mtime, fresh `lastActivityAt`) likewise surviving unchanged, and a stale-mtime, stale-heartbeat (crash-orphan) active child being repaired to `interrupted` while its parent keeps its `awaitingChildId` link, only through `reconcileStartup`.
+
+The crash-orphan repair is deliberately a single write. An earlier shape wrote the parent to `active` as a second, independently locked write, so a peer window resuming the child between the two halves was invisible to the parent-only under-lock guard, the unlink committed, and `reopenParentFromDelegation` then aborted on the `awaitingChildId` mismatch — the resumed child's result was dropped. Stopping at the child half makes every interleaving route, and it converges on the state `cancelTask` already produces mid-session: the parent stays `delegated` awaiting an `interrupted` child until that child is resumed and completes, the parent is re-delegated over the interrupted child, the child record is deleted (the missing-child repair, which is the only path that still reactivates the parent), or the user cancels.
 
 Each task slot can also hold one of two pending `create_subtask` actions. A `stage` action mirrors `setPendingTaskAction` overwrite semantics, delegation clears the action its request carried, completion clears the child's action only when its event carries the matching action ID, and a `settle-rejected` action models the settlement that follows an authoritative delegation rejection (#1714). Production settles through the typed `LifecycleTransitionError` from the shared guards: the provider calls the disk-authoritative `TaskHistoryStore.clearPendingActionIfMatching` compare-and-clear under the per-file lock, then propagates the original rejection. Six named witnesses must remain reachable: settlement from an interrupted record after rejection, settlement through a successful active delegation, unrelated-action preservation during completion, stale-action protection where a settlement targeting one action ID leaves a replacement action intact, matching-ID completion clearing, and replacement-ID completion preservation. A mismatched pending-action request keeps its production behavior: the atomic update throws before any transition, and no settlement runs.
 
@@ -175,8 +180,10 @@ The task delegation checker currently enforces:
 5. Parent-child lineage is acyclic.
 6. Completed task records cannot be changed by later lifecycle events.
 7. Active-child re-delegation, stale completion after ownership moves to another child, duplicate/late completion, and abandonment of a live child are rejected by the shared production guards.
-8. A rejected delegation settles only the exact matching pending `create_subtask` action. Settlement preserves status, lineage, and accounting, never clears a replacement or different-kind action, and never mutates a completed record. The settlement compare-and-clear reads the persisted record under the per-file lock, so it never clears from a stale host cache.
-9. A completion clears the completing child's pending action only when the completion event carries the exact matching action ID. A completion with no action ID or a different ID preserves the pending action.
+8. No transition may clear a delegated parent's link to a child that is active and live, where live means either marked live-elsewhere (`ModelState.liveElsewhere` true, history-file mtime inside the bounded freshness window) or heartbeat-alive (`ModelState.heartbeatAlive` true, fresh persisted `lastActivityAt` inside the same window); reconciliation repairs the link only when both flags are false. This encodes the PR #1495 cross-window misrepair bug class — which broke delegation links so subtask completion could not return to the parent — extended by the liveness-heartbeat fix so a child streaming a long turn (minutes without any other history-file write) is likewise preserved. The window is bounded in BOTH directions and symmetric: a timestamp less than the threshold away from `now` (including small future clock skew) is fresh, and a timestamp at or beyond the threshold in either direction (clock rollback, restored archive) is not evidence of life.
+9. A crash-orphan repair writes the child half only. `reconcileStartup` may transition an active child to `interrupted`, and must leave its parent `delegated` with `awaitingChildId` and `delegatedToId` unchanged. The repair is therefore a single guarded write with no cross-file window: no peer resume, claim, or completion interleaving can leave a resumed child completing into an unlinked parent. The parent is reactivated only by the missing-child repair (child record gone), by child completion through `completeDelegatedChild`, or by re-delegation over the interrupted child.
+10. A rejected delegation settles only the exact matching pending `create_subtask` action. Settlement preserves status, lineage, and accounting, never clears a replacement or different-kind action, and never mutates a completed record. The settlement compare-and-clear reads the persisted record under the per-file lock, so it never clears from a stale host cache.
+11. A completion clears the completing child's pending action only when the completion event carries the exact matching action ID. A completion with no action ID or a different ID preserves the pending action.
 
 The completion persistence checker additionally enforces:
 

packages/types/src/history.ts

@@ -49,6 +49,7 @@ export const historyItemSchema = z.object({
 	awaitingChildId: z.string().optional(), // Child currently awaited (set when delegated)
 	completedByChildId: z.string().optional(), // Child that completed and resumed this parent
 	completionResultSummary: z.string().optional(), // Summary from completed child
+	lastActivityAt: z.number().optional(), // Liveness heartbeat: last time the owning session persisted activity
 	pendingAction: pendingTaskActionSchema.optional(),
 })