fix(#565): captain re-adoption after cmux restart — role restoration + no-death-by-absence fail-safe

[tu11aa]

Summary

Correction: this PR originally claimed the fix was a reconcileLiveness startedAt-ordering change. That theory was wrong (confirmed by the reporter against live daemon/cmux data) and does not explain the incident. It's kept as a defensive hardening only — see "Kept as hardening" below — but it is not what fixes #565.

The actual root cause and fix, verified against the live incident data pulled from the running daemon and the real ~/.cmuxterm/claude-hook-sessions.json:

cmux's own hook-sessions record for the still-alive bet2fun-app captain (pid alive 7h49m+) degraded to a bare launchCommand (["claude"], missing --append-system-prompt-file) after a crash/reattach. runLivenessTick's roleFromTemplate classification depends entirely on that flag, so the record read role:"unknown", was filtered out of the captain group, and the project fell out of seen on the very next tick — triggering markEnded() → "stopped" forever, crews reaped, delivery permanently paused. The pid was alive the entire time; nothing ever re-checked that before inferring death.

Two changes, both in packages/core/src/daemon/delivery-loop.ts (runLivenessTick):

1. Root cause fix — sessionId identity now outranks a degraded/unclassifiable launchCommand. A record whose sessionId matches an already-known captain for its project is treated as that captain regardless of what roleFromTemplate currently reads.
2. Fail-safe / intentional contract change — a captain missing from the runtime snapshot is no longer marked ended on absence alone. markEnded now requires positive evidence: the tracked pid must be confirmed dead via isPidAlive. If the pid is still alive, or unknown/null, the entry is left alone (a log line is emitted instead). This also gates the Detect user-closed captain workspace → clean up (deregister relay, reap orphaned crews) + set explicit 'stopped' status #324 reaper, which fires off the same derived state — so live crews can no longer be reaped from an inferred signal.

This is a deliberate breaking change to the reap contract, not a side effect

Reaping is destructive — it terminalizes live, working crew tasks. The old contract ("absent from one runtime snapshot read → captain is stopped → reap its crews") is exactly what turned a cosmetic cmux store glitch into 3 cancelled crews that were actively committing code the morning of this incident. packages/cli/src/__tests__/squadrantd-daemon-direct.test.ts had a test that encoded the old contract directly (isPidAlive: () => true yet still asserting the crew got reaped on snapshot absence). Rather than loosen the fix to keep that test green, the test was updated to reflect the new, intentional contract:

• The genuine-close case now simulates what actually happens on a real close — the snapshot goes empty and the pid dies — and still asserts the crew gets reaped. The real reap path is preserved and covered.
• A new test reproduces the actual incident: captain absent from the snapshot but pid still alive → crew is not reaped, task stays "working".

Kept as hardening (not the fix)

packages/core/src/liveness.ts's reconcileLiveness: a live pid now outranks a startedAt-ordering comparison once prev is already dead, so a captain can't get stuck if reconcileLiveness ever sees a live reopen with an older startedAt for some other reason. Doesn't apply when prev is still alive (preserves the existing #527 stale-duplicate guard). Independently reasonable, doesn't fix #565 on its own.

Test plan

• Added regression tests reproducing the exact incident: (a) a record with role:"unknown" but a known-captain sessionId is still treated as the captain, (b) a captain absent from the snapshot with a still-alive pid is NOT marked ended and NOT reaped (core-level + CLI integration-level), (c) same with an unknown/null pid
• Updated the pre-existing tests that encoded the old (buggy) absence-implies-death contract — both in packages/core (unit) and packages/cli (integration) — to require genuine death instead, and added the inverse case alongside each
• npx tsc -b on packages/shared/packages/core/packages/agents/packages/workspaces (leaf deps, needed to unblock local test resolution in this fresh worktree) + npx vitest run in packages/core (42 files/656 tests) and packages/cli (58/59 files, 479/480 tests — the one failing file is an unrelated pre-existing @squadrant/web unbuilt-dist issue in this worktree) — all green
• npx tsc --noEmit clean in both packages/core and packages/cli