MrGTV-love · Oct 9, 2026 · Oct 8, 2026 · Oct 9, 2026 · Oct 9, 2026 · Oct 9, 2026
diff --git a/bin/fm-afk-return.sh b/bin/fm-afk-return.sh
@@ -910,7 +910,7 @@ main() {
   . "$SCRIPT_DIR/fm-pr-lib.sh"
 
   mkdir -p "$STATE" || return 1
-  fm_lock_acquire_wait "$LOCK"
+  fm_lock_acquire_wait "$LOCK" || return 1
   trap 'fm_lock_release "$LOCK"' EXIT
   window_epoch=$(window_start_epoch)
   contract_epoch=$(gate_contract_epoch)

diff --git a/bin/fm-backlog-handoff.sh b/bin/fm-backlog-handoff.sh
@@ -849,14 +849,14 @@ with_remote_route_locks() { # <secondmate-id> <function> <args...>
     ;;
   esac
   ACTIVE_REGISTRY_LOCK=$(secondmate_registry_lock_path "$STATE")
-  fm_lock_acquire_wait "$ACTIVE_REGISTRY_LOCK"
+  fm_lock_acquire_wait "$ACTIVE_REGISTRY_LOCK" || { ACTIVE_REGISTRY_LOCK=; return 1; }
   if [ "$(secondmate_registry_field "$REG" "$id" remote 2>/dev/null || true)" != 1 ]; then
     echo "error: pending outbox has no matching remote secondmate route: $id" >&2
     release_remote_locks
     return 1
   fi
   ACTIVE_HANDOFF_LOCK="$STATE/.backlog-handoff-$id.lock"
-  fm_lock_acquire_wait "$ACTIVE_HANDOFF_LOCK"
+  fm_lock_acquire_wait "$ACTIVE_HANDOFF_LOCK" || { ACTIVE_HANDOFF_LOCK=; release_remote_locks; return 1; }
   if "$operation" "$@"; then rc=0; else rc=$?; fi
   release_remote_locks
   return "$rc"
@@ -926,17 +926,17 @@ if [ "$RESUME_PENDING" -eq 1 ]; then
 fi
 
 ACTIVE_REGISTRY_LOCK=$(secondmate_registry_lock_path "$STATE")
-fm_lock_acquire_wait "$ACTIVE_REGISTRY_LOCK"
+fm_lock_acquire_wait "$ACTIVE_REGISTRY_LOCK" || { ACTIVE_REGISTRY_LOCK=; exit 1; }
 REMOTE=$(secondmate_registry_field "$REG" "$ID" remote 2>/dev/null || true)
 if [ "$REMOTE" = 1 ]; then
   ACTIVE_HANDOFF_LOCK="$STATE/.backlog-handoff-$ID.lock"
-  fm_lock_acquire_wait "$ACTIVE_HANDOFF_LOCK"
+  fm_lock_acquire_wait "$ACTIVE_HANDOFF_LOCK" || { ACTIVE_HANDOFF_LOCK=; exit 1; }
   if remote_handoff "$ID" "$@"; then rc=0; else rc=$?; fi
   release_remote_locks
   exit "$rc"
 fi
 ACTIVE_HANDOFF_LOCK="$STATE/.backlog-handoff-$ID.lock"
-fm_lock_acquire_wait "$ACTIVE_HANDOFF_LOCK"
+fm_lock_acquire_wait "$ACTIVE_HANDOFF_LOCK" || { ACTIVE_HANDOFF_LOCK=; exit 1; }
 fm_lock_release "$ACTIVE_REGISTRY_LOCK"
 ACTIVE_REGISTRY_LOCK=
 

diff --git a/bin/fm-captain-hold.sh b/bin/fm-captain-hold.sh
@@ -296,7 +296,7 @@ validate_one_line() {  # <label> <value>
 
 acquire_task_control_lock() {  # <task-id>
   CAPTAIN_CONTROL_LOCK="$STATE/.control-$1.lock"
-  fm_lock_acquire_wait "$CAPTAIN_CONTROL_LOCK"
+  fm_lock_acquire_wait "$CAPTAIN_CONTROL_LOCK" || fail "could not acquire task control lock"
   CAPTAIN_CONTROL_LOCK_HELD=1
 }
 
@@ -1739,7 +1739,7 @@ command_complete() {
   [ -f "$meta" ] && has_meta=1
   if [ "$has_meta" = 1 ]; then
     CAPTAIN_META_LOCK=$(fm_meta_lock_path "$meta") || fail "could not resolve task metadata lock"
-    fm_lock_acquire_wait "$CAPTAIN_META_LOCK"
+    fm_lock_acquire_wait "$CAPTAIN_META_LOCK" || fail "could not acquire task metadata lock"
     CAPTAIN_META_LOCK_HELD=1
     [ -f "$meta" ] || fail "task metadata disappeared while recording completion"
   fi

diff --git a/bin/fm-control.sh b/bin/fm-control.sh
@@ -674,7 +674,7 @@ clear_retired_meta_busy_gen() {  # <gen>
     . "$SCRIPT_DIR/fm-backlog-transition-lib.sh"
   fi
   lock=$(fm_meta_lock_path "$meta") || return 1
-  fm_lock_acquire_wait "$lock"
+  fm_lock_acquire_wait "$lock" || return 1
   current=$(fm_meta_get "$meta" busy_gen)
   if [ "$current" != "$gen" ]; then
     fm_lock_release "$lock"

diff --git a/bin/fm-gate-refuse-lib.sh b/bin/fm-gate-refuse-lib.sh
@@ -41,8 +41,9 @@
 # part of the "lab" back onto the real fleet. The threat model stays a CONFUSED
 # agent: a hostile agent that would hand-forge the marker file is the
 # adversarial case no-mistakes' neutral-execution-context and the
-# HEAD-continuity guard already own, so the check is a plain token file, not a
-# bound record. This is an allowance on the CAPABILITY side only:
+# HEAD-continuity guard already own, so authorization checks only the first-line
+# token, not the reaping provenance owned by bin/fm-test-reap-orphans.sh.
+# This is an allowance on the CAPABILITY side only:
 # fm_is_gate_agent still reports the gate context, so the sessionstart
 # stand-downs that read it directly are unaffected by the marker.
 #
@@ -77,8 +78,8 @@
 # test as "the gate refusal fired" rather than an ordinary usage error.
 FM_GATE_REFUSE_EXIT=3
 
-# The disposable-lab-home marker file and the token line it must carry. The
-# format is owned here; bin/fm-lab-home.sh is the supported writer.
+# The disposable-lab-home marker file and first-line gate token are owned here;
+# bin/fm-lab-home.sh is the supported writer.
 FM_GATE_LAB_MARKER='.fm-lab-home'
 FM_GATE_LAB_TOKEN='fm-lab-home v1'
 

diff --git a/bin/fm-lab-home.sh b/bin/fm-lab-home.sh
@@ -4,7 +4,8 @@
 # A lab home is a throwaway FM_HOME that a no-mistakes GATE agent may drive
 # through the fleet lifecycle entrypoints: bin/fm-gate-refuse-lib.sh refuses
 # those calls inside a gate agent unless FM_HOME carries the marker file this
-# helper writes (the lib owns the marker format and authorization decision;
+# helper writes (the lib owns the gate token and authorization decision;
+# bin/fm-test-reap-orphans.sh owns the reaping provenance requirements, and
 # this script is the supported writer).
 #
 # Usage:
@@ -64,6 +65,10 @@ case "${1:-}" in
       fm_lab_home_error "refusing '$dir': a lab marker is only ever stamped on a fresh empty dir"
       exit 1
     }
+    # shellcheck source=bin/fm-wake-lib.sh
+    FM_STATE_OVERRIDE="$dir" . "$SCRIPT_DIR/fm-wake-lib.sh"
+    owner_identity=$(fm_pid_identity "$PPID") || { fm_lab_home_error "cannot identify the lab owner"; exit 1; }
+    printf 'owner_pid=%s\nowner_identity=%s\n' "$PPID" "$owner_identity" >> "$dir/.fm-lab-home" || exit 1
     mkdir -p "$dir/state" "$dir/data" "$dir/config" "$dir/projects" || exit 1
     printf '%s\n' "$dir"
     ;;

diff --git a/bin/fm-lease-lib.sh b/bin/fm-lease-lib.sh
@@ -220,7 +220,7 @@ fm_lease_guard() {
   # A caller with more than one guarded phase already excludes claims until
   # its shared cleanup; do not recursively acquire the non-reentrant lock.
   if [ "$FM_LEASE_GUARD_LOCK" != "$lock" ]; then
-    fm_lock_acquire_wait "$lock"
+    fm_lock_acquire_wait "$lock" || exit "$FM_LEASE_REFUSE_EXIT"
     FM_LEASE_GUARD_LOCK=$lock
   fi
   if ! fm_lease_live "$task"; then

diff --git a/bin/fm-live-lab.sh b/bin/fm-live-lab.sh
@@ -495,6 +495,10 @@ cmd_up() {
     mkdir -p "$root" || die "cannot create '$root'"
   fi
   ROOT=$(real_dir "$root")
+  # shellcheck source=bin/fm-wake-lib.sh
+  FM_STATE_OVERRIDE="$ROOT" . "$SCRIPT_DIR/fm-wake-lib.sh"
+  local owner_identity
+  owner_identity=$(fm_pid_identity "$$") || die "cannot identify the lab creator"
   LAB="$ROOT/home"
   HARNESS=$harness EXPECT_HOST=$expect_host WANT_MATE=$mate WANT_WORKER=$worker
   NONCE=$(od -An -N6 -tx1 /dev/urandom | tr -d ' \n')
@@ -504,6 +508,7 @@ cmd_up() {
   treehouse_listing | sort > "$ROOT/.treehouse-before"
   {
     echo "$RECORD_TOKEN"
+    printf 'owner_pid=%s\nowner_identity=%s\n' "$$" "$owner_identity"
     echo "harness=$harness"
     echo "home=$LAB"
     echo "expect_host=$expect_host"

diff --git a/bin/fm-lock.sh b/bin/fm-lock.sh
@@ -161,7 +161,7 @@ publish_lock_session_or_die() {
 confirm_own_lock() {  # <recorded-pid>
   local recorded waited=0
   if [ "$CLAIM_LOCK_HELD" -ne 1 ]; then
-    fm_lock_acquire_wait "$CLAIM_LOCK"
+    fm_lock_acquire_wait "$CLAIM_LOCK" || exit 1
     CLAIM_LOCK_HELD=1
     waited=1
   fi
@@ -206,7 +206,7 @@ if ! fm_lock_try_acquire "$CLAIM_LOCK"; then
     echo "error: the prior session's bounded startup sweep is finishing; operate read-only until it releases the fleet lock" >&2
     exit 1
   fi
-  fm_lock_acquire_wait "$CLAIM_LOCK"
+  fm_lock_acquire_wait "$CLAIM_LOCK" || exit 1
 fi
 CLAIM_LOCK_HELD=1
 

diff --git a/bin/fm-mail.sh b/bin/fm-mail.sh
@@ -375,7 +375,7 @@ wake_for() {
   # shellcheck source=bin/fm-wake-lib.sh
   # shellcheck disable=SC1091
   . "$lib"
-  fm_lock_acquire_wait "$FM_WAKE_QUEUE_LOCK"
+  fm_lock_acquire_wait "$FM_WAKE_QUEUE_LOCK" || return 3
   if fm_wake_append_locked check "$wake_key" "check: mail $id - $summary"; then
     if mail_record_evidence "$generation" "$id" "$tag"; then
       :
@@ -493,7 +493,7 @@ mail_poll() {
   # shellcheck source=bin/fm-wake-lib.sh
   # shellcheck disable=SC1091
   . "$SCRIPT_DIR/fm-wake-lib.sh"
-  fm_lock_acquire_wait "$STATE_DIR/.mail-seen.lock"
+  fm_lock_acquire_wait "$STATE_DIR/.mail-seen.lock" || return 1
   if ! list="$(run_py poll_list)"; then
     # The poll engine already printed its cause on stderr; just release the
     # lock and fail instead of letting set -e abort the whole script with the

diff --git a/bin/fm-spawn.sh b/bin/fm-spawn.sh
@@ -1685,7 +1685,7 @@ spawn_herdr_presentation_order_lock_acquire() {
   lock_path=$(fm_backend_herdr_presentation_session_lock_path "$session") || return 1
   HERDR_PRESENTATION_ORDER_LOCK="$lock_path"
   if [ "$mode" = wait ]; then
-    fm_lock_acquire_wait "$HERDR_PRESENTATION_ORDER_LOCK"
+    fm_lock_acquire_wait "$HERDR_PRESENTATION_ORDER_LOCK" || return 1
     HERDR_PRESENTATION_ORDER_LOCK_HELD=1
     return 0
   fi
@@ -5857,7 +5857,7 @@ spawn_record_traceparent() {
   # independent critical section so other metadata interfaces can serialize.
   if [ "$SPAWN_META_LOCK_HELD" != 1 ]; then
     SPAWN_META_LOCK=$(fm_meta_lock_path "$meta") || return 1
-    fm_lock_acquire_wait "$SPAWN_META_LOCK"
+    fm_lock_acquire_wait "$SPAWN_META_LOCK" || return 1
     SPAWN_META_LOCK_HELD=1
     acquired=1
   fi

diff --git a/bin/fm-tasks-axi.sh b/bin/fm-tasks-axi.sh
@@ -304,9 +304,9 @@ if [ "$TASK_HELP" = 0 ] && [[ "$TASK_ID" =~ ^[A-Za-z0-9._-]+$ ]]; then
   case "$STATE" in /*) task_state=$STATE ;; *) task_state="$CALLER_DIR/$STATE" ;; esac
   TASK_CONTROL_LOCK="$task_state/.control-$TASK_ID.lock"
   TASK_META_LOCK=$(fm_meta_lock_path "$task_state/$TASK_ID.meta") || fail "cannot resolve the task record lock for $TASK_ID"
-  fm_lock_acquire_wait "$TASK_CONTROL_LOCK"
+  fm_lock_acquire_wait "$TASK_CONTROL_LOCK" || exit 1
   TASK_CONTROL_LOCK_HELD=1
-  fm_lock_acquire_wait "$TASK_META_LOCK"
+  fm_lock_acquire_wait "$TASK_META_LOCK" || exit 1
   TASK_META_LOCK_HELD=1
 fi
 guard_completion