fix(delegation): preserve live child delegation links across extension host startup (multi-window subtask return)

docs/architecture/task-lifecycle-model.md

@@ -41,18 +41,21 @@ TLA+/PlusCal or Quint with TLC becomes a better fit when the lifecycle needs tem
 
 ## Production mapping
 
-| Model concept             | Production concept                                                                                                   |
-| ------------------------- | -------------------------------------------------------------------------------------------------------------------- |
-| Task record and status    | `HistoryItem` persisted by `TaskHistoryStore`                                                                        |
-| `delegate(parent, child)` | `ClineProvider.delegateParentAndOpenChild`                                                                           |
-| `interrupt(child)`        | cancellation or eviction through `markDelegatedChildInterrupted`                                                     |
-| `complete(child)`         | `ClineProvider.reopenParentFromDelegation`                                                                           |
-| `abandon(child)`          | `ClineProvider.abandonSubtask`                                                                                       |
-| Pending-action settlement | `TaskHistoryStore.clearPendingActionIfMatching` compare-and-clear in the rejected-delegation settlement path (#1714) |
-| Atomic event step         | `atomicReadAndUpdate`, `atomicUpdatePair`, and per-parent delegation transition lock                                 |
-| Event interleaving        | Competing completion, cancellation, abandonment, and new delegation calls                                            |
-
-The model has three fixed task slots, enough to cover competing siblings and a nested parent-child-grandchild chain. It explores every reachable interleaving through depth 12, deduplicating canonical states. Representative checks also exercise rejected operations that do not create a new state: a second concurrent delegation while the first child is active, stale completion after re-delegation, late completion after abandonment, completion after interruption, and nested completion. Named semantic landmarks require the graph to retain interrupted-child re-delegation and nested delegation even when the raw state total changes.
+| Model concept                                             | Production concept                                                                                                 |
+| --------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------ |
+| Task record and status                                    | `HistoryItem` persisted by `TaskHistoryStore`                                                                      |
+| `delegate(parent, child)`                                 | `ClineProvider.delegateParentAndOpenChild`                                                                         |
+| `interrupt(child)`                                        | cancellation or eviction through `markDelegatedChildInterrupted`                                                   |
+| `complete(child)`                                         | `ClineProvider.reopenParentFromDelegation`                                                                         |
+| `abandon(child)`                                          | `ClineProvider.abandonSubtask`                                                                                     |
+| Pending-action settlement                                 | `TaskHistoryStore.clearPendingActionIfMatching` compare-and-clear in the rejected-delegation settlement path (#1714) |
+| `reconcileStartup(parent)`                                | startup/periodic `TaskHistoryStore.reconcileDelegationStateCore` orphan repair                                     |
+| `markLiveElsewhere(child)` / `expireLiveElsewhere(child)` | child history-file mtime recent vs stale past `LIVE_CHILD_MTIME_THRESHOLD_MS` (abstracted; no wall clock in model) |
+| `heartbeat(child)` / `expireHeartbeat(child)`             | persisted `lastActivityAt` liveness heartbeat fresh vs stale past `LIVE_CHILD_MTIME_THRESHOLD_MS` (production: the owning session's throttled heartbeat across the child's whole active lifetime — long streaming turns, long tool calls, and ask-idle periods alike — shared predicate `isDelegatedChildLive`) |
+| Atomic event step                                         | `atomicReadAndUpdate`, `atomicUpdatePair`, and per-parent delegation transition lock                               |
+| Event interleaving                                        | Competing completion, cancellation, abandonment, and new delegation calls                                          |
+
+The model has three fixed task slots, enough to cover competing siblings and a nested parent-child-grandchild chain, plus two abstract booleans per slot recording whether an active child's session shows life: one for ownership by another window (recent history-file mtime) and one for a fresh persisted `lastActivityAt` heartbeat from the owning session. It explores every reachable interleaving through depth 12, deduplicating canonical states. Representative checks also exercise rejected operations that do not create a new state: a second concurrent delegation while the first child is active, stale completion after re-delegation, late completion after abandonment, completion after interruption, and nested completion. Named semantic landmarks require the graph to retain interrupted-child re-delegation and nested delegation even when the raw state total changes, a delegated parent whose active child is live in another window surviving startup reconciliation unchanged, a delegated parent whose active child heartbeats through a long streaming turn (stale mtime, fresh `lastActivityAt`) likewise surviving unchanged, and a stale-mtime, stale-heartbeat (crash-orphan) active child being repaired to `interrupted` with the parent returned to `active` only through `reconcileStartup`.
 
 Each task slot can also hold one of two pending `create_subtask` actions. A `stage` action mirrors `setPendingTaskAction` overwrite semantics, delegation clears the action its request carried, completion clears the child's action only when its event carries the matching action ID, and a `settle-rejected` action models the settlement that follows an authoritative delegation rejection (#1714). Production settles through the typed `LifecycleTransitionError` from the shared guards: the provider calls the disk-authoritative `TaskHistoryStore.clearPendingActionIfMatching` compare-and-clear under the per-file lock, then propagates the original rejection. Six named witnesses must remain reachable: settlement from an interrupted record after rejection, settlement through a successful active delegation, unrelated-action preservation during completion, stale-action protection where a settlement targeting one action ID leaves a replacement action intact, matching-ID completion clearing, and replacement-ID completion preservation. A mismatched pending-action request keeps its production behavior: the atomic update throws before any transition, and no settlement runs.
 
@@ -140,8 +143,9 @@ The task delegation checker currently enforces:
 5. Parent-child lineage is acyclic.
 6. Completed task records cannot be changed by later lifecycle events.
 7. Active-child re-delegation, stale completion after ownership moves to another child, duplicate/late completion, and abandonment of a live child are rejected by the shared production guards.
-8. A rejected delegation settles only the exact matching pending `create_subtask` action. Settlement preserves status, lineage, and accounting, never clears a replacement or different-kind action, and never mutates a completed record. The settlement compare-and-clear reads the persisted record under the per-file lock, so it never clears from a stale host cache.
-9. A completion clears the completing child's pending action only when the completion event carries the exact matching action ID. A completion with no action ID or a different ID preserves the pending action.
+8. No transition may clear a delegated parent's link to a child that is active and live, where live means either marked live-elsewhere (`ModelState.liveElsewhere` true, recent history-file mtime) or heartbeat-alive (`ModelState.heartbeatAlive` true, fresh persisted `lastActivityAt`); reconciliation repairs the link only when both flags are false. This encodes the PR #1495 cross-window misrepair bug class — which broke delegation links so subtask completion could not return to the parent — extended by the liveness-heartbeat fix so a child streaming a long turn (minutes without any other history-file write) is likewise preserved.
+9. A rejected delegation settles only the exact matching pending `create_subtask` action. Settlement preserves status, lineage, and accounting, never clears a replacement or different-kind action, and never mutates a completed record. The settlement compare-and-clear reads the persisted record under the per-file lock, so it never clears from a stale host cache.
+10. A completion clears the completing child's pending action only when the completion event carries the exact matching action ID. A completion with no action ID or a different ID preserves the pending action.
 
 The completion persistence checker additionally enforces:
 

packages/types/src/history.ts

@@ -48,6 +48,7 @@ export const historyItemSchema = z.object({
 	awaitingChildId: z.string().optional(), // Child currently awaited (set when delegated)
 	completedByChildId: z.string().optional(), // Child that completed and resumed this parent
 	completionResultSummary: z.string().optional(), // Summary from completed child
+	lastActivityAt: z.number().optional(), // Liveness heartbeat: last time the owning session persisted activity
 	pendingAction: pendingTaskActionSchema.optional(),
 })