@@ -51,13 +51,13 @@ TLA+/PlusCal or Quint with TLC becomes a better fit when the lifecycle needs tem
 | Atomic event step         | `atomicReadAndUpdate`, `atomicUpdatePair`, and per-parent delegation transition lock |
 | Event interleaving        | Competing completion, cancellation, abandonment, and new delegation calls            |
 
-The model has three fixed task slots, enough to cover competing siblings and a nested parent-child-grandchild chain. It explores every reachable interleaving through depth 12, deduplicating canonical states. Runtime ownership is modeled separately from persisted status: an `owner-loss` fault can remove the live owner of an active or delegated child without changing its history record, matching process termination or session skip. Recovery is enabled only when the awaited delegation chain has no live owner and ends in an interrupted/completed task, a delegated task with no `awaitingChildId`, or a missing awaited record. Representative checks also exercise rejected operations that do not create a new state: a second concurrent delegation while the first child is active, stale completion after re-delegation, late completion after abandonment, completion after interruption, and nested completion. Named semantic landmarks require the graph to retain interrupted-child re-delegation, nested delegation, and owner-loss recovery even when the raw state total changes.
+The model has three fixed task slots, enough to cover competing siblings and a nested parent-child-grandchild chain. It explores every reachable interleaving through depth 12, deduplicating canonical states. Runtime ownership is modeled separately from persisted status: an `owner-loss` fault can remove the live owner of an active or delegated child without changing its history record, matching process termination or session skip. Recovery is enabled only when the awaited delegation chain has no live owner and ends in an interrupted/completed task, a delegated task with no `awaitingChildId`, or a missing awaited record whose task ID also has no live owner. Representative checks also exercise rejected operations that do not create a new state: a second concurrent delegation while the first child is active, stale completion after re-delegation, late completion after abandonment, completion after interruption, and nested completion. Named semantic landmarks require the graph to retain interrupted-child re-delegation, nested delegation, and owner-loss recovery even when the raw state total changes.
 
 Production completion also accepts a recovery-compatible `active` parent that still awaits the returning child, then clears the stale pointers. Normal model transitions never create that intermediate state, so it is covered by a focused reducer test rather than admitted as a generally valid reachable state.
 
 The `recover-active` action models startup repair after an active child loses its owner. `recoverDelegationParent` clears the parent's child pointers but interrupts it when an ancestor still awaits it; a top-level parent becomes active. The repair journal accepts both target statuses so a crash between the child and parent writes cannot break that ancestor link. Filesystem tests cover journal replay and subsequent re-delegation. Provider tests separately cover registration delayed by the recovery reservation, including disposal or cancellation before registration and preventing later scheduling.
 
-For [#1624](https://github.com/Zoo-Code-Org/Zoo-Code/issues/1624), `recoverDeadDelegatedChild` repairs a nested delegated child whose descendant chain ends dead. Startup reconciliation and runtime re-delegation check provider-wide ownership while reserving registration through persistence; persisted delegated status alone is not evidence of a live session.
+For [#1624](https://github.com/Zoo-Code-Org/Zoo-Code/issues/1624), `recoverDeadDelegatedChild` repairs a nested delegated child whose descendant chain ends dead. Startup reconciliation and runtime re-delegation check provider-wide ownership while reserving registration through persistence; persisted delegated status alone is not evidence of a live session. Runtime re-delegation refreshes the chain with `TaskHistoryStore.refreshStrict`, so an unreadable or invalid descendant record aborts recovery instead of looking missing. If disposal cancels a delegation after the parent commit, rollback releases the parent through `recoverDelegationParent` and restores its pending action, without recreating a task on the disposed provider.
 
 ## Shared-store concurrency model
 
 
@@ -21,6 +21,7 @@ function makeStoreStub(
 ) {
 	return {
 		invalidate: vi.fn().mockResolvedValue(undefined),
+		refreshStrict: vi.fn().mockResolvedValue(undefined),
 		atomicReadAndUpdate: vi.fn(async (_taskId: string, updater: (h: HistoryItem) => HistoryItem) => {
 			updater(parentHistoryItem)
 			return []
@@ -90,6 +91,64 @@ describe("ClineProvider.delegateParentAndOpenChild()", () => {
 		expect(taskHistoryStore.atomicReadAndUpdate).not.toHaveBeenCalled()
 	})
 
+	it("releases the committed parent when disposal cancels delegation after the commit", async () => {
+		const pendingAction = {
+			kind: "create_subtask" as const,
+			actionId: "create-action",
+			approvalText: "{}",
+			mode: "code",
+			message: "Do something",
+			todos: [],
+		}
+		let current: HistoryItem = { ...parentHistoryItem, status: "active", pendingAction }
+		const child = { taskId: "child-1", run: vi.fn().mockResolvedValue(undefined) }
+		const createTaskWithHistoryItem = vi.fn()
+		const deleteTaskWithId = vi.fn().mockResolvedValue(undefined)
+		const provider = {
+			_disposed: false,
+			taskScheduler: new TaskScheduler(),
+			emit: vi.fn(),
+			getCurrentTask: vi.fn(() => makeParentTask()),
+			removeClineFromStack: vi.fn().mockResolvedValue(undefined),
+			createTask: vi.fn().mockResolvedValue(child),
+			handleModeSwitch: vi.fn().mockResolvedValue(undefined),
+			deleteTaskWithId,
+			createTaskWithHistoryItem,
+			log: vi.fn(),
+			isViewLaunched: false,
+		} as unknown as ClineProvider
+		const parentTask = makeParentTask()
+		vi.mocked(provider.getCurrentTask).mockReturnValue(parentTask)
+		Reflect.set(provider, "taskHistoryStore", {
+			invalidate: vi.fn().mockResolvedValue(undefined),
+			get: vi.fn(() => current),
+			atomicReadAndUpdate: vi.fn(async (_taskId: string, updater: (item: HistoryItem) => HistoryItem) => {
+				current = updater(current)
+				// Disposal starts right after the parent commit lands.
+				Reflect.set(provider, "_disposed", true)
+				return [current]
+			}),
+		})
+
+		await expect(
+			ClineProvider.prototype.delegateParentAndOpenChild.call(provider, {
+				parentTaskId: "parent-1",
+				message: "Do something",
+				initialTodos: [],
+				mode: "code",
+				pendingActionId: "create-action",
+			}),
+		).rejects.toThrow("disposed before child scheduling")
+
+		expect(child.run).not.toHaveBeenCalled()
+		expect(deleteTaskWithId).toHaveBeenCalledWith("child-1", false)
+		// The parent no longer awaits the deleted child and keeps its unresolved action.
+		expect(current).toMatchObject({ status: "active", awaitingChildId: undefined, delegatedToId: undefined })
+		expect(current.pendingAction).toEqual(pendingAction)
+		// A disposed provider must not recreate the parent task.
+		expect(createTaskWithHistoryItem).not.toHaveBeenCalled()
+	})
+
 	it("clears a matching pending action when delegation commits", async () => {
 		const pendingAction = {
 			kind: "create_subtask" as const,
@@ -861,7 +920,7 @@ describe("ClineProvider.delegateParentAndOpenChild()", () => {
 				return []
 			}),
 		})
-		taskHistoryStore.invalidate.mockImplementation(async (id: string) => {
+		taskHistoryStore.refreshStrict.mockImplementation(async (id: string) => {
 			if (id === oldChildId) cache.set(id, refreshedChild)
 			if (id === grandchildId) cache.set(id, refreshedGrandchild)
 		})
@@ -877,11 +936,85 @@ describe("ClineProvider.delegateParentAndOpenChild()", () => {
 
 		await ClineProvider.prototype["recoverDeadAwaitedChild"].call(provider, parent, oldChildId)
 
-		expect(taskHistoryStore.invalidate).toHaveBeenCalledWith(oldChildId)
-		expect(taskHistoryStore.invalidate).toHaveBeenCalledWith(grandchildId)
+		expect(taskHistoryStore.refreshStrict).toHaveBeenCalledWith(oldChildId)
+		expect(taskHistoryStore.refreshStrict).toHaveBeenCalledWith(grandchildId)
 		expect(cache.get(oldChildId)).toMatchObject({ status: "interrupted", awaitingChildId: undefined })
 	})
 
+	it("fails closed when a descendant record cannot be read during recovery", async () => {
+		const oldChildId = "old-child"
+		const grandchildId = "grandchild"
+		const parent = {
+			...parentHistoryItem,
+			status: "delegated" as const,
+			awaitingChildId: oldChildId,
+			delegatedToId: oldChildId,
+		}
+		const child = {
+			...parentHistoryItem,
+			id: oldChildId,
+			status: "delegated" as const,
+			awaitingChildId: grandchildId,
+			delegatedToId: grandchildId,
+		}
+		const taskHistoryStore = makeStoreStub({
+			get: vi.fn((id: string) => (id === oldChildId ? child : undefined)),
+		})
+		taskHistoryStore.refreshStrict.mockImplementation(async (id: string) => {
+			if (id === grandchildId) throw Object.assign(new Error("EACCES: permission denied"), { code: "EACCES" })
+		})
+		const provider = {
+			taskRegistry: { hasRunning: vi.fn().mockReturnValue(false) },
+			taskHistoryStore,
+			log: vi.fn(),
+		} as unknown as ClineProvider
+		Object.assign(provider, {
+			isTaskRunningInAnyProvider: ClineProvider.prototype["isTaskRunningInAnyProvider"],
+			refreshDelegationChain: ClineProvider.prototype["refreshDelegationChain"],
+		})
+
+		await expect(
+			ClineProvider.prototype["recoverDeadAwaitedChild"].call(provider, parent, oldChildId),
+		).rejects.toThrow("EACCES")
+		expect(taskHistoryStore.atomicReadAndUpdate).not.toHaveBeenCalled()
+	})
+
+	it("does not recover when a missing descendant record is still live in a provider", async () => {
+		const oldChildId = "old-child"
+		const grandchildId = "grandchild"
+		const parent = {
+			...parentHistoryItem,
+			status: "delegated" as const,
+			awaitingChildId: oldChildId,
+			delegatedToId: oldChildId,
+		}
+		const child = {
+			...parentHistoryItem,
+			id: oldChildId,
+			status: "delegated" as const,
+			awaitingChildId: grandchildId,
+			delegatedToId: grandchildId,
+		}
+		const taskHistoryStore = makeStoreStub({
+			// The grandchild record is absent, but its task still runs.
+			get: vi.fn((id: string) => (id === oldChildId ? child : undefined)),
+		})
+		const provider = {
+			taskRegistry: { hasRunning: vi.fn((id: string) => id === grandchildId) },
+			taskHistoryStore,
+			log: vi.fn(),
+		} as unknown as ClineProvider
+		Object.assign(provider, {
+			isTaskRunningInAnyProvider: ClineProvider.prototype["isTaskRunningInAnyProvider"],
+			refreshDelegationChain: ClineProvider.prototype["refreshDelegationChain"],
+		})
+
+		await expect(
+			ClineProvider.prototype["recoverDeadAwaitedChild"].call(provider, parent, oldChildId),
+		).resolves.toMatchObject({ status: "delegated" })
+		expect(taskHistoryStore.atomicReadAndUpdate).not.toHaveBeenCalled()
+	})
+
 	it("rejects a missing awaited-child record without creating a child", async () => {
 		const oldChildId = "missing-child"
 		const parent = {
 
@@ -818,6 +818,34 @@ export class TaskHistoryStore {
 		})
 	}
 
+	/**
+	 * Re-read a single task for an ownership decision. Unlike `invalidate()`, only a missing file
+	 * removes the cache entry; an unreadable, malformed, or mismatched record throws and keeps the
+	 * cached entry, so callers fail closed instead of treating the task as absent.
+	 */
+	async refreshStrict(taskId: string): Promise<void> {
+		return this.withLock(async () => {
+			const filePath = await this.getTaskFilePath(taskId)
+			let raw: string
+			try {
+				raw = await fs.readFile(filePath, "utf8")
+			} catch (error) {
+				if (error && typeof error === "object" && "code" in error && error.code === "ENOENT") {
+					this.cache.delete(taskId)
+					this.taskFileMtimes.delete(taskId)
+					return
+				}
+				throw error
+			}
+			const item: unknown = JSON.parse(raw)
+			if (typeof item !== "object" || item === null || (item as { id?: unknown }).id !== taskId) {
+				throw new Error(`Invalid task history record: ${filePath}`)
+			}
+			this.cache.set(taskId, item as HistoryItem)
+			this.taskFileMtimes.delete(taskId)
+		})
+	}
+
 	/**
 	 * Clear all in-memory cache entries; a subsequent `reconcile()` repopulates them from task files.
 	 */
 
@@ -528,6 +528,49 @@ describe("TaskHistoryStore", () => {
 		})
 	})
 
+	describe("refreshStrict()", () => {
+		it.each([
+			["missing", undefined],
+			["read-error", { code: "EISDIR" }],
+			["malformed", { name: "SyntaxError" }],
+			["other-task-id", { message: expect.stringContaining("Invalid task history record") }],
+		] as const)("keeps the cached record unless the file is missing (%s)", async (scenario, error) => {
+			await store.initialize()
+			store.dispose() // Keep filesystem watcher reconciliation out of this explicit refresh test.
+			const owner = makeHistoryItem({ id: "owner", status: "delegated", awaitingChildId: "child" })
+			await store.upsert(owner)
+			const filePath = path.join(tmpDir, "tasks", "owner", GlobalFileNames.historyItem)
+			if (scenario === "malformed") {
+				await fs.writeFile(filePath, "{")
+			} else if (scenario === "other-task-id") {
+				await fs.writeFile(filePath, JSON.stringify({ ...owner, id: "other-task" }))
+			} else {
+				await fs.unlink(filePath)
+				if (scenario === "read-error") await fs.mkdir(filePath)
+			}
+
+			if (error) {
+				await expect(store.refreshStrict("owner")).rejects.toMatchObject(error)
+				expect(store.get("owner")).toEqual(owner)
+			} else {
+				await expect(store.refreshStrict("owner")).resolves.toBeUndefined()
+				expect(store.get("owner")).toBeUndefined()
+			}
+		})
+
+		it("re-reads a valid record from disk", async () => {
+			await store.initialize()
+			const item = makeHistoryItem({ id: "strict-task", tokensIn: 100 })
+			await store.upsert(item)
+			const filePath = path.join(tmpDir, "tasks", "strict-task", GlobalFileNames.historyItem)
+			await fs.writeFile(filePath, JSON.stringify({ ...item, tokensIn: 999 }))
+
+			await store.refreshStrict("strict-task")
+
+			expect(store.get("strict-task")?.tokensIn).toBe(999)
+		})
+	})
+
 	describe("invalidateAll()", () => {
 		it("waits for an in-flight write before clearing the cache", async () => {
 			const onWrite = vi.fn().mockResolvedValue(undefined)
 
@@ -109,6 +109,14 @@ describe("task lifecycle transitions", () => {
 		).toBe(false)
 		expect(isDeadDelegationChain({ ...child, status: "active" }, (id) => tasks.get(id))).toBe(false)
 		expect(isDeadDelegationChain({ ...child, awaitingChildId: "missing" }, (id) => tasks.get(id))).toBe(true)
+		// A missing record is not proof of death when its task still has a live owner.
+		expect(
+			isDeadDelegationChain(
+				{ ...child, awaitingChildId: "missing" },
+				(id) => tasks.get(id),
+				(id) => id === "missing",
+			),
+		).toBe(false)
 		expect(
 			isDeadDelegationChain({ ...child, awaitingChildId: child.id }, (id) =>
 				id === child.id ? child : undefined,
 
@@ -22,6 +22,7 @@ export {
 	interruptDelegatedChild,
 	isDeadDelegationChain,
 	recoverDeadDelegatedChild,
+	recoverDelegationParent,
 	LifecycleTransitionError,
 	type HistoryItemStatus,
 	VALID_TASK_STATUS_TRANSITIONS,
 
@@ -91,8 +91,10 @@ export function isDeadDelegationChain(
 		if (current.status === "interrupted" || current.status === "completed") return true
 		if (current.status !== "delegated") return false
 		if (!current.awaitingChildId) return true
-		current = getTask(current.awaitingChildId)
-		if (!current) return true
+		const awaitedId: string = current.awaitingChildId
+		current = getTask(awaitedId)
+		// A missing record is not proof of death: the descendant may still run elsewhere.
+		if (!current) return !isTaskLive(awaitedId)
 	}
 }
 
 
@@ -128,6 +128,7 @@ import {
 	delegateTaskToChild,
 	isDeadDelegationChain,
 	recoverDeadDelegatedChild,
+	recoverDelegationParent,
 	interruptDelegatedChild,
 } from "../task-persistence"
 import { readTaskMessages } from "../task-persistence/taskMessages"
@@ -3835,7 +3836,8 @@ export class ClineProvider
 		let currentTaskId: string | undefined = taskId
 		while (currentTaskId && !visited.has(currentTaskId)) {
 			visited.add(currentTaskId)
-			await this.taskHistoryStore.invalidate(currentTaskId)
+			// Strict: an unreadable descendant must abort recovery, not look missing (and so dead).
+			await this.taskHistoryStore.refreshStrict(currentTaskId)
 			const current = this.taskHistoryStore.get(currentTaskId)
 			currentTaskId = current?.status === "delegated" ? current.awaitingChildId : undefined
 		}
@@ -4083,6 +4085,10 @@ export class ClineProvider
 		//    synchronously under the store lock) so a concurrent abandon or completion cannot
 		//    slip between the status snapshot and the write. An active child must never be
 		//    silently detached.
+		// Set once the parent record durably awaits this child, so rollback can undo that link
+		// even when disposal cancels delegation after the commit.
+		let parentCommitted = false
+		let pendingActionBeforeCommit: HistoryItem["pendingAction"]
 		try {
 			if (this._disposed) {
 				throw new Error("[delegateParentAndOpenChild] Provider was disposed before delegation commit")
@@ -4097,12 +4103,14 @@ export class ClineProvider
 					? this.taskHistoryStore.get(historyItem.awaitingChildId)?.status
 					: undefined
 				const delegated = delegateTaskToChild(historyItem, child.taskId, awaitedChildStatus)
+				pendingActionBeforeCommit = historyItem.pendingAction
 				return {
 					...delegated,
 					pendingAction:
 						delegated.pendingAction?.actionId === pendingActionId ? undefined : delegated.pendingAction,
 				}
 			})
+			parentCommitted = true
 			if (this._disposed) {
 				throw new Error("[delegateParentAndOpenChild] Provider was disposed before child scheduling")
 			}
@@ -4141,6 +4149,30 @@ export class ClineProvider
 					}`,
 				)
 			}
+			if (parentCommitted) {
+				// Undo the committed link even on a disposed provider: otherwise the persisted parent
+				// awaits a deleted child until a later reconciliation repairs it.
+				try {
+					await this.taskHistoryStore.atomicReadAndUpdate(parentTaskId, (current) => {
+						if (current.status !== "delegated" || current.awaitingChildId !== child.taskId) {
+							return current // A newer transition already owns the parent.
+						}
+						const ancestor = current.parentTaskId
+							? this.taskHistoryStore.get(current.parentTaskId)
+							: undefined
+						return {
+							...recoverDelegationParent(current, ancestor),
+							pendingAction: pendingActionBeforeCommit,
+						}
+					})
+				} catch (repairError) {
+					this.log(
+						`[delegateParentAndOpenChild] Failed to release parent ${parentTaskId} from deleted child ${child.taskId}: ${
+							(repairError as Error)?.message ?? String(repairError)
+						}`,
+					)
+				}
+			}
 			if (!this._disposed) {
 				try {
 					const { historyItem: parentHistory } = await this.getTaskWithId(parentTaskId)
Original file line number	Diff line number	Diff line change
`@@ -91,8 +91,10 @@ export function isDeadDelegationChain(`
`91`	`91`	`if (current.status === "interrupted" \|\| current.status === "completed") return true`
`92`	`92`	`if (current.status !== "delegated") return false`
`93`	`93`	`if (!current.awaitingChildId) return true`
`94`		`- current = getTask(current.awaitingChildId)`
`95`		`- if (!current) return true`
	`94`	`+ const awaitedId: string = current.awaitingChildId`
	`95`	`+ current = getTask(awaitedId)`
	`96`	`+ // A missing record is not proof of death: the descendant may still run elsewhere.`
	`97`	`+ if (!current) return !isTaskLive(awaitedId)`
`96`	`98`	`}`
`97`	`99`	`}`
`98`	`100`