fix(runtime): retain session proof for lifecycle cleanup

Author: roodboi

docs/architecture.md

@@ -125,9 +125,10 @@ stable home and can be torn down on `hack down`.
 Lifecycle state is checkout-local at `.hack/.internal/lifecycle/state.json`. Each compose instance
 has its own entry, so starting a branch instance does not replace the base instance's entry in the
 same checkout. Cleanup reconciles the saved process group with the live process table; if the group
-leader exited while members remain, `hack doctor` reports the orphan and `hack down` terminates the
-persisted leaderless group. A live group leader without its saved pane PID is not trusted as lifecycle
-ownership because the PID may have been reused.
+leader exited while members remain, `hack doctor` reports the orphan. `hack down` terminates the
+persisted leaderless group only while a matching lifecycle mux session still proves ownership; without
+that session, cleanup stays non-destructive because the numeric PGID may have been reused. A live group
+leader without its saved pane PID is likewise not trusted as lifecycle ownership.
 
 For fixed-port helpers such as SSM/database/search tunnels, lifecycle config can also declare a
 `singleton` listener set. This lets Hack reuse an already-running equivalent helper or fail fast on

src/lib/project-lifecycle-processes.ts

@@ -160,17 +160,14 @@ export function resolvePersistedLifecycleProcessGroupIds(opts: {
   });
 }
 
-/** Trust all live roots with a session, or only leaderless persisted groups without one. */
+/** Only trust persisted lifecycle metadata when a matching mux session was observed live. */
 export function resolveLifecycleStopProcessGroupIds(opts: {
   readonly matchedLiveSession: boolean;
   readonly lifecycleEntry: LifecycleStateEntry | null;
   readonly snapshot: readonly ProcessSnapshotRow[];
 }): number[] {
   if (!opts.matchedLiveSession) {
-    return resolveLeaderlessPersistedLifecycleProcessGroupIds({
-      lifecycleEntry: opts.lifecycleEntry,
-      snapshot: opts.snapshot,
-    });
+    return [];
   }
   return resolvePersistedLifecycleProcessGroupIds({
     lifecycleEntry: opts.lifecycleEntry,

tests/project-lifecycle-processes.test.ts

@@ -274,7 +274,7 @@ test("resolveLifecycleStopProcessGroupIds skips persisted cleanup without a live
   expect(groups).toEqual([]);
 });
 
-test("resolveLifecycleStopProcessGroupIds recovers a leaderless persisted group without a mux session", () => {
+test("resolveLifecycleStopProcessGroupIds skips a leaderless persisted group without a mux session", () => {
   const groups = resolveLifecycleStopProcessGroupIds({
     matchedLiveSession: false,
     lifecycleEntry: {
@@ -300,6 +300,35 @@ test("resolveLifecycleStopProcessGroupIds recovers a leaderless persisted group
     ],
   });
 
+  expect(groups).toEqual([]);
+});
+
+test("resolveLifecycleStopProcessGroupIds recovers a leaderless persisted group with a live mux session", () => {
+  const groups = resolveLifecycleStopProcessGroupIds({
+    matchedLiveSession: true,
+    lifecycleEntry: {
+      composeProject: "event-agent",
+      projectName: "event-agent",
+      branch: "feature-cleanup",
+      sessionName: "event-agent--lifecycle-feature-cleanup",
+      backend: "tmux",
+      updatedAt: "2026-04-01T14:00:00.000Z",
+      processes: [
+        {
+          name: "proxy",
+          windowName: "proxy",
+          logPath: "/tmp/event-agent.log",
+          panePid: 500,
+          processGroupId: 500,
+        },
+      ],
+    },
+    snapshot: [
+      { pid: 501, ppid: 1, processGroupId: 500 },
+      { pid: 502, ppid: 501, processGroupId: 500 },
+    ],
+  });
+
   expect(groups).toEqual([500]);
 });