# Saved Task List — Session Resilience Epic

> Snapshot taken 2026-06-16, before switching to the dashboard disable-login feature.
> This is the in-flight epic from `docs/plans/2026-06-15-session-resilience.md`.

## How to resume

```
/superpowers-extended-cc:executing-plans docs/plans/2026-06-15-session-resilience.md
```

The authoritative resume state lives in
`docs/plans/2026-06-15-session-resilience.md.tasks.json` (tasks 1–12 completed,
13–28 pending). This file is just a human-readable mirror.

## Status

**Governance update 2026-07-09 (archreview TST-04).** The epic is resolved into three
decisions rather than one open backlog:

- **Phase 3 (reconnect) — finishing now, essentially complete.** Task 13 (owner
  re-validation) shipped as archreview **TST-02** (P0, session attach is owner-scoped,
  see CLAUDE.md Authentication). Task 15 (reconnect integration test) shipped as
  **TST-01** (`GatewayEndToEndReconnectReplayTests`). Task 14 (client `ReplayGap`
  handling) shipped as **CLI-15** for four of five clients (.NET/Go/Rust/Python);
  the Java client is the only remainder, batched to the windev build host.
- **Phase 4 (per-session dashboard ACL) — scoped, not yet built.** Tracked as archreview
  **TST-15**. The previously-open Viewer-default decision is **settled**: admin-sees-all,
  Viewer strictly scoped to sessions it owns/is granted — matching TST-02's gRPC owner
  binding for consistency.
- **Phase 5 (orphan-worker reattach) — DEFERRED, not planned.** It reverses the CLAUDE.md
  invariant "Gateway restart does not reattach orphan workers" and adds an adoption manifest
  store + worker phone-home protocol. It stays deferred unless a concrete requirement
  appears. **The `EnableOrphanReattach` flag (Task 26) does not exist and must not be
  referenced anywhere as if it does** until that task actually lands.

Original snapshot (historical): **12 of 28 tasks complete** (Phases 1–2 + reconnect core of
Phase 3), merged to `main` (commit `c446bef`).

### Completed — Phase 1 (Foundation)
- ✅ Task 1 (#108): Add OwnerKeyId to the session
- ✅ Task 2 (#109): SessionEventDistributor skeleton
- ✅ Task 3 (#110): Bounded replay ring buffer
- ✅ Task 4 (#111): Rewire AttachEventSubscriber + EventStreamService onto distributor
- ✅ Task 5 (#112): Per-subscriber backpressure isolation
- ✅ Task 6 (#113): Dashboard broadcaster becomes a distributor subscriber

### Completed — Phase 2 (Multi-subscriber fan-out)
- ✅ Task 7 (#114): Remove validator block + add subscriber cap option
- ✅ Task 8 (#115): Subscriber-lease collection + cap enforcement
- ✅ Task 9 (#116): Multi-subscriber end-to-end test (FakeWorkerHarness)

### Completed — Phase 3 (Reconnect core)
- ✅ Task 10 (#117): Proto — ReplayGap signal
- ✅ Task 11 (#118): Detach-grace session retention
- ✅ Task 12 (#119): Replay-on-reconnect + emit ReplayGap

### Phase 3 finish — DONE (via archreview P0/P2)
- ✅ Task 13 (#120): Owner re-validation on reconnect — shipped as **TST-02** (P0).
- 🔄 Task 14 (#121): Client ReplayGap handling — shipped as **CLI-15** for 4/5 clients
  (.NET/Go/Rust/Python); Java pending (windev batch). Per-language presence-check idiom
  for `optional` message fields carried in each client's surface.
- ✅ Task 15 (#122): Reconnect integration test (fake worker) — shipped as **TST-01**.

### Phase 4 (Per-session dashboard ACL) — SCOPED, tracked as archreview TST-15
- ⏳ Task 16 (#123): gRPC session-owner gate + all-sessions admin scope — blockedBy 9, 1
  - Note: the gRPC owner gate itself already exists (TST-02); Phase 4 adds the admin
    all-sessions scope + the dashboard-side twin.
- ⏳ Task 17 (#124): Session Tag + dashboard group-to-tag config — blockedBy 9
- ⏳ Task 18 (#125): EventsHub per-session ACL + hub-token tag claim — blockedBy 17
  - Decision SETTLED: admin-sees-all, Viewer strictly scoped to owned/granted sessions
    (matches TST-02 gRPC owner binding).
- ⏳ Task 19 (#126): ACL tests incl. live LDAP users — blockedBy 18

### Phase 5 (Orphan-worker reattach) — DEFERRED, NOT PLANNED
Deferred unless a concrete requirement appears. It reverses the CLAUDE.md invariant
"Gateway restart does not reattach orphan workers" and adds an adoption manifest store +
worker phone-home protocol. **`EnableOrphanReattach` (Task 26) does not exist** — do not
reference it as if it does until the task lands.
- 🚫 Task 20 (#127): Stable gateway-instance id + stable pipe naming
- 🚫 Task 21 (#128): Adoption manifest store (SQLite)
- 🚫 Task 22 (#129): Proto — worker adopt/reconnect frame
- 🚫 Task 23 (#130): Worker phone-home reconnect loop + self-terminate (net48/x86, windev)
- 🚫 Task 24 (#131): Gateway adoption — re-open pipes, nonce-validate, reject impostors
- 🚫 Task 25 (#132): Resync adopted worker + ReplayGap to subscribers
- 🚫 Task 26 (#133): EnableOrphanReattach flag (default off) + terminator fallback
- 🚫 Task 27 (#134): Gateway-restart reattach round-trip (WINDEV + live worker)
- 🚫 Task 28 (#135): Documented-rule reversals + stillpending refresh

## Notes
- Phase 5 was designed to reverse the "Gateway restart does not reattach orphan workers"
  rule (CLAUDE.md), but is now **deferred, not planned** (TST-04) — the invariant stands.
- Two deferred follow-ups noted earlier: dashboard visibility of `DetachedAtUtc` on
  `DashboardSessionSummary`.
- Worker (net48/x86) tasks build/test on windev; everything else builds on macOS.