docs(archreview): TST-04 governance — Phase 3 done, Phase 4 scoped, Phase 5 deferred

Resolve the session-resilience epic's shipped-vs-planned entanglement:

- Phase 3 (reconnect) finished: Task 13 = TST-02 (owner-scoped attach, P0),
  Task 15 = TST-01 (reconnect integration test), Task 14 = CLI-15 for 4/5
  clients (Java pending, windev batch).
- Phase 4 (per-session dashboard ACL) scoped as TST-15; the open Viewer-default
  decision is settled: admin-sees-all, Viewer strict per owned/granted session
  (matches TST-02's gRPC owner binding).
- Phase 5 (orphan-worker reattach) marked DEFERRED, not planned. The
  EnableOrphanReattach flag does not exist and must not be referenced as if it
  does. The CLAUDE.md "gateway restart does not reattach orphan workers"
  invariant stands.

Updates oldtasks.md, the tasks.json mirror (statuses + governance note), and the
CLAUDE.md reconnect paragraph (clients now consume ReplayGap; reattach deferred).

Claude-Session: https://claude.ai/code/session_01DMXXvNuPekkkrTEyPNxEkW

oldtasks.md

@@ -15,8 +15,27 @@ The authoritative resume state lives in
 
 ## Status
 
-**12 of 28 tasks complete** (Phases 1–2 + reconnect core of Phase 3). All completed
-work is merged to `main` (commit `c446bef`, pushed to origin).
+**Governance update 2026-07-09 (archreview TST-04).** The epic is resolved into three
+decisions rather than one open backlog:
+
+- **Phase 3 (reconnect) — finishing now, essentially complete.** Task 13 (owner
+  re-validation) shipped as archreview **TST-02** (P0, session attach is owner-scoped,
+  see CLAUDE.md Authentication). Task 15 (reconnect integration test) shipped as
+  **TST-01** (`GatewayEndToEndReconnectReplayTests`). Task 14 (client `ReplayGap`
+  handling) shipped as **CLI-15** for four of five clients (.NET/Go/Rust/Python);
+  the Java client is the only remainder, batched to the windev build host.
+- **Phase 4 (per-session dashboard ACL) — scoped, not yet built.** Tracked as archreview
+  **TST-15**. The previously-open Viewer-default decision is **settled**: admin-sees-all,
+  Viewer strictly scoped to sessions it owns/is granted — matching TST-02's gRPC owner
+  binding for consistency.
+- **Phase 5 (orphan-worker reattach) — DEFERRED, not planned.** It reverses the CLAUDE.md
+  invariant "Gateway restart does not reattach orphan workers" and adds an adoption manifest
+  store + worker phone-home protocol. It stays deferred unless a concrete requirement
+  appears. **The `EnableOrphanReattach` flag (Task 26) does not exist and must not be
+  referenced anywhere as if it does** until that task actually lands.
+
+Original snapshot (historical): **12 of 28 tasks complete** (Phases 1–2 + reconnect core of
+Phase 3), merged to `main` (commit `c446bef`).
 
 ### Completed — Phase 1 (Foundation)
 - ✅ Task 1 (#108): Add OwnerKeyId to the session
@@ -36,33 +55,41 @@ work is merged to `main` (commit `c446bef`, pushed to origin).
 - ✅ Task 11 (#118): Detach-grace session retention
 - ✅ Task 12 (#119): Replay-on-reconnect + emit ReplayGap
 
-### Pending — Phase 3 finish
-- ⏳ Task 13 (#120): Owner re-validation on reconnect — blockedBy 12, 1
-- ⏳ Task 14 (#121): Client ReplayGap handling — all 5 clients — blockedBy 10
-  - Carry the per-language presence-check idiom note for `optional` message fields.
-- ⏳ Task 15 (#122): Reconnect integration test (fake worker) — blockedBy 12
+### Phase 3 finish — DONE (via archreview P0/P2)
+- ✅ Task 13 (#120): Owner re-validation on reconnect — shipped as **TST-02** (P0).
+- 🔄 Task 14 (#121): Client ReplayGap handling — shipped as **CLI-15** for 4/5 clients
+  (.NET/Go/Rust/Python); Java pending (windev batch). Per-language presence-check idiom
+  for `optional` message fields carried in each client's surface.
+- ✅ Task 15 (#122): Reconnect integration test (fake worker) — shipped as **TST-01**.
 
-### Pending — Phase 4 (Per-session dashboard ACL)
+### Phase 4 (Per-session dashboard ACL) — SCOPED, tracked as archreview TST-15
 - ⏳ Task 16 (#123): gRPC session-owner gate + all-sessions admin scope — blockedBy 9, 1
+  - Note: the gRPC owner gate itself already exists (TST-02); Phase 4 adds the admin
+    all-sessions scope + the dashboard-side twin.
 - ⏳ Task 17 (#124): Session Tag + dashboard group-to-tag config — blockedBy 9
 - ⏳ Task 18 (#125): EventsHub per-session ACL + hub-token tag claim — blockedBy 17
-  - Open decision: Viewer default (admin-sees-all vs strict per-session).
+  - Decision SETTLED: admin-sees-all, Viewer strictly scoped to owned/granted sessions
+    (matches TST-02 gRPC owner binding).
 - ⏳ Task 19 (#126): ACL tests incl. live LDAP users — blockedBy 18
 
-### Pending — Phase 5 (Orphan-worker reattach)
-- ⏳ Task 20 (#127): Stable gateway-instance id + stable pipe naming — blockedBy 19
-- ⏳ Task 21 (#128): Adoption manifest store (SQLite) — blockedBy 20
-- ⏳ Task 22 (#129): Proto — worker adopt/reconnect frame — blockedBy 21
-- ⏳ Task 23 (#130): Worker phone-home reconnect loop + self-terminate — blockedBy 22 (net48/x86, windev)
-- ⏳ Task 24 (#131): Gateway adoption — re-open pipes, nonce-validate, reject impostors — blockedBy 23
-- ⏳ Task 25 (#132): Resync adopted worker + ReplayGap to subscribers — blockedBy 24, 12
-- ⏳ Task 26 (#133): EnableOrphanReattach flag (default off) + terminator fallback — blockedBy 24
-- ⏳ Task 27 (#134): Gateway-restart reattach round-trip (WINDEV + live worker) — blockedBy 25, 26
-- ⏳ Task 28 (#135): Documented-rule reversals + stillpending refresh — blockedBy 27
+### Phase 5 (Orphan-worker reattach) — DEFERRED, NOT PLANNED
+Deferred unless a concrete requirement appears. It reverses the CLAUDE.md invariant
+"Gateway restart does not reattach orphan workers" and adds an adoption manifest store +
+worker phone-home protocol. **`EnableOrphanReattach` (Task 26) does not exist** — do not
+reference it as if it does until the task lands.
+- 🚫 Task 20 (#127): Stable gateway-instance id + stable pipe naming
+- 🚫 Task 21 (#128): Adoption manifest store (SQLite)
+- 🚫 Task 22 (#129): Proto — worker adopt/reconnect frame
+- 🚫 Task 23 (#130): Worker phone-home reconnect loop + self-terminate (net48/x86, windev)
+- 🚫 Task 24 (#131): Gateway adoption — re-open pipes, nonce-validate, reject impostors
+- 🚫 Task 25 (#132): Resync adopted worker + ReplayGap to subscribers
+- 🚫 Task 26 (#133): EnableOrphanReattach flag (default off) + terminator fallback
+- 🚫 Task 27 (#134): Gateway-restart reattach round-trip (WINDEV + live worker)
+- 🚫 Task 28 (#135): Documented-rule reversals + stillpending refresh
 
 ## Notes
-- Phase 5 reverses the documented "Gateway restart does not reattach orphan workers"
-  rule (CLAUDE.md) — this was explicitly approved during design.
+- Phase 5 was designed to reverse the "Gateway restart does not reattach orphan workers"
+  rule (CLAUDE.md), but is now **deferred, not planned** (TST-04) — the invariant stands.
 - Two deferred follow-ups noted earlier: dashboard visibility of `DetachedAtUtc` on
   `DashboardSessionSummary`.
 - Worker (net48/x86) tasks build/test on windev; everything else builds on macOS.