Two gaps kept the targeted release from firing on the reported repro:
- The lease pid is never the bridge's pid. ptyprocess forks the leader
(`node entry.js`); the `tui_gateway` CHILD of that leader is what claims
the single-writer lease, so an equality match on `bridge.pid` matched
nothing in a real deployment (reporter's table: node 840, lease pid 850).
`hosts_pid` now matches the leader itself or any PTY whose leader is an
ancestor of the holder (psutil). A holder with no PTY ancestor — a plain
`hermes` terminal — still closes nothing, so that refusal stands.
- Leases live in the home the chat runs in. A profile-scoped chat's child
claims under the profile's HERMES_HOME, so reading the dashboard's launch
home found no holder. The lookup now takes the child's HERMES_HOME.
The matched sessions are popped under the registry lock and closed outside
it (a close can wait out the helper SIGHUP grace and the lock serializes
every new chat), still before the spawn so the lease is released first —
the close discipline main's teardown series adopted, carried from #131179.
Co-authored-by: liuhao1024 <sunsky.lau@gmail.com>
f139d661c7