fix(TST-29): retire oldtasks.md; delete root docs-review artifacts

Migrate the durable session-resilience governance record (Phase 5
orphan-worker reattach deferred-not-planned, EnableOrphanReattach
does not yet exist, settled Phase-4 Viewer-default decision) from
oldtasks.md into a new "Session-Resilience Epic Scope" entry in
docs/DesignDecisions.md, repoint CLAUDE.md and stillpending.md's
oldtasks.md references to the new home / tasks.json, and git rm
oldtasks.md now that it has no unique content left. Flip TST-29 to
Done in the archreview tracking registers.

The five untracked root docs-review artifacts (MxAccessGateway-docs-*,
MxGatewayClient-docs-*) are absent from this worktree; they must be
deleted from the main working tree separately (gitignored, no repo
impact).

docs/DesignDecisions.md

@@ -135,6 +135,36 @@ alarm state is gateway-wide, not session-scoped — every client wants the same
 current set plus updates, and forcing each to own a worker would multiply AVEVA
 polling load for no benefit.
 
+## Session-Resilience Epic Scope
+
+Decision (2026-07-09, archreview TST-04; migrated here 2026-08-07 from the retired
+`oldtasks.md` mirror per TST-29): the session-resilience epic
+(`docs/plans/2026-06-15-session-resilience.md`, 28 tasks) resolves into three per-phase
+decisions rather than one open backlog.
+
+- **Phase 3 (reconnect)** — essentially complete. Task 13 (owner re-validation) shipped
+  as archreview **TST-02** (P0, session attach is owner-scoped; see
+  [Session Reconnect](#session-reconnect) above). Task 15 (reconnect integration test)
+  shipped as **TST-01** (`GatewayEndToEndReconnectReplayTests`). Task 14 (client
+  `ReplayGap` handling) shipped as **CLI-15** for four of five clients
+  (.NET/Go/Rust/Python); the Java client is the only remainder.
+- **Phase 4 (per-session dashboard ACL)** — scoped, not yet built. Tracked as archreview
+  **TST-15**. The Viewer-default decision is settled: admin-sees-all, Viewer strictly
+  scoped to sessions it owns or is granted — matching the gRPC owner-binding decision in
+  [Session Reconnect](#session-reconnect) above, for consistency between the gRPC and
+  dashboard surfaces.
+- **Phase 5 (orphan-worker reattach)** — deferred, not planned. It would reverse the
+  "Gateway restart does not reattach orphan workers" invariant (see CLAUDE.md), adding a
+  stable gateway-instance id, an adoption-manifest SQLite store, a worker phone-home
+  reconnect protocol, and gateway-side adoption (re-open pipes, nonce-validate, reject
+  impostors). It stays deferred unless a concrete requirement appears; the invariant
+  stands. **`EnableOrphanReattach` does not exist and must not be referenced anywhere as
+  if it does** until that task actually lands.
+
+`docs/plans/2026-06-15-session-resilience.md.tasks.json` remains the sole resume state
+for the still-pending Phase 4 tasks (16-19) and the deferred Phase 5 tasks (20-28) — one
+authority, no mirror.
+
 ## Authentication
 
 Decision: API key authentication for the public gateway.