fix(tui): isolate prior-session work receipts

[Hmbown]

Draft handoff: narrow #4416 slice

This preserves the release-safe projection fix for another agent/device.

• hide prior-session worker snapshots from the live Work surface at the final projection owner
• show terminal durable-task receipts only when both creation and completion belong to the current TUI session
• keep active tasks visible
• keep shared history available through /tasks and archived agent views

This intentionally references rather than resolves #4416. Durable task/run/worker owner or lease identity is still missing, and a second TaskManager can still rewrite a shared persisted Running task to Failed during startup reconciliation.

Verification:

• cargo fmt --all -- --check
• git diff --check
• cargo check -p codewhale-tui --locked
• Work-sidebar tests: 5 passed
• Work-surface tests: 27 passed
• prior-session tests: 2 passed
• restart regression: 1 passed
• pre-rebase full TUI binary suite: 7,123 passed, 2 ignored
• strict clippy and build passed

Refs #4416

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[claude]

Claude finished @Hmbown's task in 2m 49s —— View job

---

Review: fix(tui): isolate prior-session work receipts

• Gather context (PR diff, files, CLAUDE.md/AGENTS.md guidance)
• Review crates/tui/src/tui/work_surface/live_projection.rs
• Review crates/tui/src/tui/ui.rs
• Review crates/tui/src/tui/ui/tests.rs
• Check provider/model-route safety implications (N/A — TUI-only diff)
• Post final review

Summary

This is a narrow, well-scoped fix. Two independent leaks are closed at the two places that own the "live work" claim:

1. live_projection.rs (crates/tui/src/tui/work_surface/live_projection.rs:71-80): the Work surface now builds its own current_session_agents (filtering from_prior_session) instead of trusting app.subagent_cache to already be filtered. Good defensive choice — subagent_cache is only filtered by the one production call site (ui.rs:3427-3428, AgentList's sorted.retain(|a| !a.from_prior_session)), so a second path writing to that cache without the same filter would otherwise leak prior-session workers straight onto the live surface.

   • Note: cached_worker_ids (line 76-80) is deliberately built from the unfiltered app.subagent_cache, not current_session_agents. At first glance this looks like it undoes the fix, but it's actually required — it's used later (line 170-173) purely to de-dupe agent_progress entries that shadow a cached agent, and if it were filtered too, a prior-session agent with a live agent_progress entry (exactly the agent_active_sibling case in the new test) would slip back in through that second loop. Confirmed correct by tracing the fresh_session_hides_prior_terminal_and_active_sibling_workers test.

2. ui.rs (select_work_sidebar_tasks, crates/tui/src/tui/ui.rs:1751-1766): replaces the old "recent TTL" heuristic with a stricter rule — a terminal task is only shown if both created_at and ended_at fall at/after session_started_at. This correctly handles the case called out in the PR body: startup reconciliation (confirmed to exist in task_manager.rs) can stamp a fresh ended_at on an old Running record, which under the old TTL-based logic would make a brand-new same-workspace TUI instance look like it just failed a task it never touched. Requiring created_at >= session_started_at closes that specific hole. Active (Queued/Running) tasks are still always shown regardless of created_at, matching the PR's "keep active tasks visible" claim.

   • Side effect worth flagging (not a bug, just worth confirming intent): a task that was already Running when the session started (so visible while active) will disappear from the sidebar the instant it completes, since its created_at predates session_started_at. That matches the new recovered_after_restart test and the doc comment's stated design ("shared history stays in /tasks"), but it's a real, user-visible behavior change beyond the Isolate stale failed-agent state between CodeWhale sessions in the same workspace #4416 bug itself — worth a callout in the PR description if not already discussed with a maintainer, since a task a user watched finish in the current session can vanish from the live view.
   • Confirmed no dangling references to the removed WORK_SIDEBAR_RECENT_COMPLETED_TTL constant or the old 4-arg select_work_sidebar_tasks signature anywhere else in the crate.

3. Tests (ui/tests.rs, live_projection.rs tests): solid coverage — session-boundary edge case (>= at exact instant), the restart-reconciliation regression (recovered_old_run), the #1913 stale-task cases, and the prior-session worker/sibling-progress case in live_projection.rs. No missing coverage spotted for the new behavior.

No correctness bugs, no provider/model-route concerns (this diff doesn't touch model/provider selection), no security issues, and no unnecessary duplication — the change is a targeted tightening of two existing filters rather than new machinery.

Not verified in this run

I wasn't able to execute cargo check/cargo test/git fetch in this sandbox (network/build commands required approval that wasn't available here), so I relied on static review and cross-referencing call sites instead of re-running the verification the PR author already reported (fmt, check, and the listed test suites).