From 4ee9b766007e48493842fd843fff6cf3aef5e9e3 Mon Sep 17 00:00:00 2001
From: Dardan Tigani <dardantigani@gmail.com>
Date: Fri, 25 Sep 2026 14:03:55 -0400
Subject: [PATCH 1/2] fix(bin): identify lab viewers by kernel start time and
 reap labs a task left behind

fm-herdr-lab.sh viewer stop compared a recorded `ps -o lstart` string with a
fresh reading. On WSL2 ps derives lstart from a wall-clock boot time that
re-renders one to two seconds apart for the same live process, so the helper
disowned its own viewer and teardown refused while it stayed attached.

The viewer record now stores a kernel identity: /proc/<pid>/stat starttime in
clock ticks, qualified by the boot id, with the locale-pinned lstart kept as
the exact-match fallback on hosts without that /proc. The Python launcher takes
its identity values from the same helper function, so one function owns the
format.

A lab server outlives the shell that provisioned it, so a lab whose owner died
before its EXIT trap ran stayed registered after its task ended. Provision now
records the owning task id and working directory when FM_TASK_ID is set, and
the new `reap-task` command tears down exactly those labs through the guarded
teardown path. fm-teardown.sh runs it before its worktree process reap, which
would otherwise kill only a lab server started from the worktree and leave the
session registered.
---
 bin/fm-herdr-lab-viewer.py |  23 ++--
 bin/fm-herdr-lab.sh        | 133 +++++++++++++++++++--
 bin/fm-teardown.sh         |  15 +++
 docs/herdr-backend.md      |   1 +
 tests/fm-herdr-lab.test.sh | 233 +++++++++++++++++++++++++++++++++++--
 tests/fm-teardown.test.sh  |  69 ++++++++++-
 6 files changed, 446 insertions(+), 28 deletions(-)

diff --git a/bin/fm-herdr-lab-viewer.py b/bin/fm-herdr-lab-viewer.py
index ce40e0b4a9e..3c5d4103520 100755
--- a/bin/fm-herdr-lab-viewer.py
+++ b/bin/fm-herdr-lab-viewer.py
@@ -78,29 +78,34 @@ def _child(slave, master, session):
     os._exit(127)
 
 
-def _process_start(pid):
+# bin/fm-herdr-lab.sh owns the process identity format the stop guard
+# compares, so the record takes its values from that same function.
+IDENTITY_HELPER = os.path.join(os.path.dirname(os.path.abspath(__file__)), "fm-herdr-lab.sh")
+
+
+def _process_identity(pid):
     result = subprocess.run(
-        ["ps", "-p", str(pid), "-o", "lstart="],
+        ["bash", "-c", '. "$1" && fm_herdr_lab_process_identity "$2"',
+         "fm-herdr-lab-viewer", IDENTITY_HELPER, str(pid)],
         check=True,
         capture_output=True,
         text=True,
-        env={**os.environ, "LC_ALL": "C"},
     )
     value = result.stdout.strip()
-    if not value:
-        raise RuntimeError("process start time unavailable")
+    if not value or "\n" in value:
+        raise RuntimeError("process identity unavailable")
     return value
 
 
 def _write_pidfile(path, launcher_pid, viewer_pid):
-    launcher_start = _process_start(launcher_pid)
-    viewer_start = _process_start(viewer_pid)
+    launcher_identity = _process_identity(launcher_pid)
+    viewer_identity = _process_identity(viewer_pid)
     temporary = "%s.%d.tmp" % (path, launcher_pid)
     with open(temporary, "w", encoding="utf-8") as handle:
         handle.write("launcher_pid=%d\n" % launcher_pid)
-        handle.write("launcher_start=%s\n" % launcher_start)
+        handle.write("launcher_identity=%s\n" % launcher_identity)
         handle.write("viewer_pid=%d\n" % viewer_pid)
-        handle.write("viewer_start=%s\n" % viewer_start)
+        handle.write("viewer_identity=%s\n" % viewer_identity)
     os.rename(temporary, path)
 
 
diff --git a/bin/fm-herdr-lab.sh b/bin/fm-herdr-lab.sh
index d0aa633df55..ce7bec8a86d 100755
--- a/bin/fm-herdr-lab.sh
+++ b/bin/fm-herdr-lab.sh
@@ -11,6 +11,7 @@
 #   fm-herdr-lab.sh viewer stop <session>
 #   fm-herdr-lab.sh stop <session>
 #   fm-herdr-lab.sh teardown <session>
+#   fm-herdr-lab.sh reap-task <task-id> <worktree>
 #
 # Session names must begin with "fm-lab-" and can never be "default".
 # The name command sanitizes the label, caps it at 16 characters, and appends
@@ -25,6 +26,14 @@
 # destructive call.
 # Provision records the running default session as a fleet-state tripwire and
 # teardown requires that record to be identical afterward.
+# Inside a Firstmate task (FM_TASK_ID set) provision also records the task id and
+# its physical working directory as the lab's owner.
+# The lab server outlives whichever shell provisioned it, so a lab that shell
+# never tore down, such as one whose owner was killed before its EXIT trap could
+# run, stays registered after the task ends.
+# reap-task is bin/fm-teardown.sh's backstop for that: it runs the guarded
+# teardown below for every lab recorded for that task id from inside that
+# worktree, and nothing else.
 # The viewer command attaches or detaches one real foreground Herdr client on
 # an owned lab session over a fixed 40-row by 120-column pty;
 # bin/fm-herdr-lab-viewer.py owns the pty mechanics.
@@ -58,6 +67,36 @@ fm_herdr_lab_tripwire_path() { # <session>
   printf '%s/%s.fleet-state.json' "$(fm_herdr_lab_state_dir)" "$1"
 }
 
+fm_herdr_lab_owner_path() { # <session>
+  printf '%s/%s.owner' "$(fm_herdr_lab_state_dir)" "$1"
+}
+
+fm_herdr_lab_valid_task_id() { # <task-id>
+  [[ "${1:-}" =~ ^[a-zA-Z0-9][a-zA-Z0-9._-]*$ ]]
+}
+
+# Records which Firstmate task provisioned the lab, from where. Outside a task
+# nothing is recorded and no teardown will ever reap the lab on its own.
+fm_herdr_lab_record_owner() { # <session>
+  local task=${FM_TASK_ID:-} cwd
+  [ -n "$task" ] || return 0
+  fm_herdr_lab_valid_task_id "$task" || {
+    fm_herdr_lab_error "FM_TASK_ID is not a task id; refusing ambiguous lab ownership: $task"
+    return 1
+  }
+  cwd=$(pwd -P) || return 1
+  case "$cwd" in
+    /*) ;;
+    *) fm_herdr_lab_error "cannot record lab ownership from working directory '$cwd'"; return 1 ;;
+  esac
+  case "$cwd" in *$'\n'*|*$'\r'*)
+    fm_herdr_lab_error "cannot record lab ownership from a working directory containing a line break"
+    return 1
+    ;;
+  esac
+  printf 'task=%s\ncwd=%s\n' "$task" "$cwd" > "$(fm_herdr_lab_owner_path "$1")"
+}
+
 fm_herdr_lab_raw() { # <session> <herdr arguments...>
   local name=$1
   shift
@@ -114,6 +153,10 @@ fm_herdr_lab_prepare() { # <session>
     rm -f "$tripwire"
     return 1
   }
+  fm_herdr_lab_record_owner "$name" || {
+    rm -f "$tripwire" "$(fm_herdr_lab_owner_path "$name")"
+    return 1
+  }
 }
 
 fm_herdr_lab_refuse_if_default() { # <session>
@@ -199,8 +242,40 @@ fm_herdr_lab_viewer_reason() { # <session>
   printf '%s' "$out" | jq -r '.result.reason // empty' 2>/dev/null
 }
 
-fm_herdr_lab_process_start() { # <pid>
-  LC_ALL=C ps -p "$1" -o lstart= 2>/dev/null | sed 's/^[[:space:]]*//;s/[[:space:]]*$//'
+# Prints one line identifying a live process across PID reuse, the value the
+# viewer record stores. A Linux-compatible /proc supplies stat field 22
+# (starttime, clock ticks since boot) qualified by the kernel boot id when that
+# is readable. The kernel fixes starttime at fork, while ps derives lstart from
+# the wall clock and a boot time that WSL2 re-renders seconds apart for the same
+# live process, so an lstart identity wrongly disowns the lab's own viewer.
+# Hosts without that /proc fall back to the locale-pinned lstart, which their
+# kernels record directly. FM_PROC_ROOT_OVERRIDE replaces /proc for tests.
+fm_herdr_lab_process_identity() { # <pid>
+  local pid=$1 proc_root stat_line starttime boot_id value
+  local -a stat_fields
+  case "$pid" in ''|*[!0-9]*) return 1 ;; esac
+  proc_root=${FM_PROC_ROOT_OVERRIDE:-/proc}
+  if [ -r "$proc_root/$pid/stat" ]; then
+    stat_line=$(cat "$proc_root/$pid/stat" 2>/dev/null) || return 1
+    # After the final comm delimiter, array index 19 is proc stat field 22.
+    read -r -a stat_fields <<< "${stat_line##*)}"
+    [ "${#stat_fields[@]}" -ge 20 ] || return 1
+    starttime=${stat_fields[19]}
+    case "$starttime" in ''|*[!0-9]*) return 1 ;; esac
+    boot_id=
+    [ ! -r "$proc_root/sys/kernel/random/boot_id" ] \
+      || boot_id=$(tr -cd 'a-f0-9-' < "$proc_root/sys/kernel/random/boot_id" 2>/dev/null) || boot_id=
+    if [ -n "$boot_id" ]; then
+      printf 'boot=%s starttime=%s\n' "$boot_id" "$starttime"
+    else
+      printf 'starttime=%s\n' "$starttime"
+    fi
+    return 0
+  fi
+  value=$(LC_ALL=C ps -p "$pid" -o lstart= 2>/dev/null | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')
+  [ -n "$value" ] || return 1
+  case "$value" in *$'\n'*|*$'\r'*) return 1 ;; esac
+  printf 'lstart=%s\n' "$value"
 }
 
 fm_herdr_lab_process_parent() { # <pid>
@@ -217,18 +292,18 @@ fm_herdr_lab_viewer_recorded_value() { # <session> <key>
 }
 
 fm_herdr_lab_viewer_owned_pair() { # <session>
-  local launcher_pid viewer_pid launcher_start viewer_start current_start parent_pid
+  local launcher_pid viewer_pid launcher_identity viewer_identity current_identity parent_pid
   launcher_pid=$(fm_herdr_lab_viewer_recorded_value "$1" launcher_pid) || return 1
   viewer_pid=$(fm_herdr_lab_viewer_recorded_value "$1" viewer_pid) || return 1
   case "$launcher_pid:$viewer_pid" in
     *[!0-9:]*) return 1 ;;
   esac
-  launcher_start=$(fm_herdr_lab_viewer_recorded_value "$1" launcher_start) || return 1
-  viewer_start=$(fm_herdr_lab_viewer_recorded_value "$1" viewer_start) || return 1
-  current_start=$(fm_herdr_lab_process_start "$launcher_pid") || return 1
-  [ -n "$current_start" ] && [ "$current_start" = "$launcher_start" ] || return 1
-  current_start=$(fm_herdr_lab_process_start "$viewer_pid") || return 1
-  [ -n "$current_start" ] && [ "$current_start" = "$viewer_start" ] || return 1
+  launcher_identity=$(fm_herdr_lab_viewer_recorded_value "$1" launcher_identity) || return 1
+  viewer_identity=$(fm_herdr_lab_viewer_recorded_value "$1" viewer_identity) || return 1
+  current_identity=$(fm_herdr_lab_process_identity "$launcher_pid") || return 1
+  [ -n "$current_identity" ] && [ "$current_identity" = "$launcher_identity" ] || return 1
+  current_identity=$(fm_herdr_lab_process_identity "$viewer_pid") || return 1
+  [ -n "$current_identity" ] && [ "$current_identity" = "$viewer_identity" ] || return 1
   parent_pid=$(fm_herdr_lab_process_parent "$viewer_pid") || return 1
   [ "$parent_pid" = "$launcher_pid" ] || return 1
   printf '%s %s' "$launcher_pid" "$viewer_pid"
@@ -469,7 +544,7 @@ fm_herdr_lab_verify_tripwire() { # <session>
   local name=$1 tripwire
   fm_herdr_lab_check_tripwire "$name" || return 1
   tripwire=$(fm_herdr_lab_tripwire_path "$name")
-  rm -f "$tripwire"
+  rm -f "$tripwire" "$(fm_herdr_lab_owner_path "$name")"
 }
 
 fm_herdr_lab_stop() { # <session>
@@ -523,6 +598,38 @@ fm_herdr_lab_teardown() { # <session>
   fm_herdr_lab_verify_tripwire "$name"
 }
 
+fm_herdr_lab_reap_task() { # <task-id> <worktree>
+  local task=${1:-} worktree=${2:-} real owner name recorded_task recorded_cwd status=0
+  fm_herdr_lab_valid_task_id "$task" || { fm_herdr_lab_error "reap-task needs a task id: $task"; return 2; }
+  case "$worktree" in
+    /?*) ;;
+    *) fm_herdr_lab_error "reap-task needs an absolute worktree path: $worktree"; return 2 ;;
+  esac
+  worktree=${worktree%/}
+  real=$(cd "$worktree" 2>/dev/null && pwd -P) || real=$worktree
+  [ "$real" != / ] || { fm_herdr_lab_error "reap-task refuses the filesystem root as a worktree"; return 2; }
+  for owner in "$(fm_herdr_lab_state_dir)"/fm-lab-*.owner; do
+    [ -f "$owner" ] || continue
+    name=${owner##*/}
+    name=${name%.owner}
+    fm_herdr_lab_validate_name "$name" 2>/dev/null || continue
+    recorded_task=$(sed -n 's/^task=//p' "$owner" | head -n 1)
+    recorded_cwd=$(sed -n 's/^cwd=//p' "$owner" | head -n 1)
+    [ "$recorded_task" = "$task" ] || continue
+    case "$recorded_cwd/" in
+      "$real"/*|"$worktree"/*) ;;
+      *) continue ;;
+    esac
+    if fm_herdr_lab_teardown "$name"; then
+      printf 'fm-herdr-lab: tore down lab session %s left behind by task %s\n' "$name" "$task"
+    else
+      fm_herdr_lab_error "could not tear down lab session '$name' left behind by task $task"
+      status=1
+    fi
+  done
+  return "$status"
+}
+
 fm_herdr_lab_name() { # <label>
   local label=${1:-lab}
   label=$(printf '%s' "$label" | tr -cd 'a-zA-Z0-9_-' | sed 's/^[^a-zA-Z0-9]*//; s/-*$//')
@@ -534,7 +641,7 @@ fm_herdr_lab_name() { # <label>
 }
 
 fm_herdr_lab_usage() {
-  sed -n '2,15p' "${BASH_SOURCE[0]}" | sed 's/^# \{0,1\}//'
+  sed -n '2,16p' "${BASH_SOURCE[0]}" | sed 's/^# \{0,1\}//'
 }
 
 fm_herdr_lab_main() {
@@ -569,6 +676,10 @@ fm_herdr_lab_main() {
       [ "$#" -eq 2 ] || { fm_herdr_lab_usage >&2; return 2; }
       fm_herdr_lab_teardown "$2"
       ;;
+    reap-task)
+      [ "$#" -eq 3 ] || { fm_herdr_lab_usage >&2; return 2; }
+      fm_herdr_lab_reap_task "$2" "$3"
+      ;;
     -h|--help|help)
       fm_herdr_lab_usage
       ;;
diff --git a/bin/fm-teardown.sh b/bin/fm-teardown.sh
index a1941c4c6c0..9c6ef4ad3a6 100755
--- a/bin/fm-teardown.sh
+++ b/bin/fm-teardown.sh
@@ -276,6 +276,15 @@
 #     root still exists, so the account's healthy LaunchAgent worker and every
 #     live remote secondmate worker are out of scope. Best effort: a sweep
 #     failure never blocks this teardown.
+#   Fix 4 - tear down leftover Herdr labs. A lab provisioned through
+#     bin/fm-herdr-lab.sh keeps its server running detached from the worker,
+#     so a lab the task never tore down outlives it (observed 2026-09-24: a
+#     test's lab still running after its task ended). This runs first, before
+#     Fix 1, because Fix 2 would otherwise kill only a lab server started from
+#     the worktree and leave its session registered. `fm-herdr-lab.sh
+#     reap-task` owns which labs count as this task's and tears each down
+#     through the helper's guarded path. Best effort: a lab that cannot be torn
+#     down is reported but never blocks this teardown.
 set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
@@ -3448,6 +3457,12 @@ else
   fi
 fi
 
+# Fix 4 (see script header): tear down Herdr labs this task left behind.
+if [ "$KIND" != secondmate ] && [ -n "$WT" ]; then
+  "$SCRIPT_DIR/fm-herdr-lab.sh" reap-task "$ID" "$WT" >&2 \
+    || echo "warning: a Herdr lab session left behind by $ID could not be torn down; see the fm-herdr-lab lines above" >&2
+fi
+
 # Every landed/discard-work refusal above has now passed (or --force skipped
 # them). Fix 1 and Fix 2 (see script header) run here, unconditionally on
 # --force, and before ANY destructive step below - a still-parked run or a
diff --git a/docs/herdr-backend.md b/docs/herdr-backend.md
index aed96ee49d0..0aed1b56955 100644
--- a/docs/herdr-backend.md
+++ b/docs/herdr-backend.md
@@ -341,6 +341,7 @@ An environment-only session selection can silently reach a different running ser
 It provisions only non-default names beginning with `fm-lab-`, appends an explicit `--session` to allowed task commands, refuses caller-supplied session flags and server/session lifecycle subcommands, and performs destructive stop/delete only through its guarded lifecycle actions.
 Immediately before every destructive call it re-queries the named session and refuses empty, missing, literal `default`, or `default:true` identities.
 Its before/after tripwire requires the live default-session snapshot to remain byte-identical.
+A lab server outlives the shell that provisioned it, so a lab provisioned inside a Firstmate task records that task as its owner, and task cleanup tears down any lab the task left behind through the same guarded path.
 
 The helper's header and `--help` own exact commands.
 Tests use thin compatibility wrappers in `tests/herdr-test-safety.sh` and never duplicate the destructive policy.
diff --git a/tests/fm-herdr-lab.test.sh b/tests/fm-herdr-lab.test.sh
index 474b3f3e87e..b41907cf342 100755
--- a/tests/fm-herdr-lab.test.sh
+++ b/tests/fm-herdr-lab.test.sh
@@ -90,6 +90,7 @@ run_with_fake() {
     FM_FAKE_HERDR_DELETE_FAIL="${FM_FAKE_HERDR_DELETE_FAIL:-}" \
     FM_FAKE_HERDR_TITLE_FAIL="${FM_FAKE_HERDR_TITLE_FAIL:-}" \
     FM_HERDR_LAB_STATE_DIR="$TRIPWIRES" \
+    FM_TASK_ID="${FM_FAKE_TASK_ID:-}" \
     "$@"
 }
 
@@ -245,6 +246,73 @@ SH
 }
 
 
+provision_from() { # <dir> <task-id> <session>
+  (cd "$1" && FM_FAKE_TASK_ID=$2 run_with_fake fm_herdr_lab_provision "$3")
+}
+
+test_provision_records_the_owning_task() {
+  local wt="$TMP_ROOT/owner-wt" name="fm-lab-owner-$$" status=0 real
+  mkdir -p "$wt/sub"
+  real=$(cd "$wt/sub" && pwd -P)
+  provision_from "$wt/sub" task-owner "$name" || fail "owned provision failed"
+  [ "$(cat "$TRIPWIRES/$name.owner" 2>/dev/null)" = "$(printf 'task=task-owner\ncwd=%s' "$real")" ] \
+    || fail "provision did not record the owning task and its physical working directory"
+  run_with_fake fm_herdr_lab_teardown "$name" || fail "owned lab teardown failed"
+  assert_absent "$TRIPWIRES/$name.owner" "teardown left the lab's owner record behind"
+
+  provision_from "$wt" '' "$name-free" || fail "unowned provision failed"
+  assert_absent "$TRIPWIRES/$name-free.owner" "a lab provisioned outside a task recorded an owner"
+  run_with_fake fm_herdr_lab_teardown "$name-free" || fail "unowned lab teardown failed"
+
+  provision_from "$wt" 'bad id' "$name-bad" >/dev/null 2>&1 || status=$?
+  expect_code 1 "$status" "a malformed task id must not provision an ambiguously owned lab"
+  assert_absent "$TRIPWIRES/$name-bad.fleet-state.json" "a refused owner record left its tripwire behind"
+  assert_absent "$FAKE_STATE/$name-bad" "a refused owner record still started the lab session"
+  pass "fm-herdr-lab: provision records the owning task and teardown retires it"
+}
+
+# A lab whose provisioning shell died before its EXIT trap ran must not outlive
+# its task; reap-task is the task teardown's backstop and must touch only that
+# task's own labs.
+test_reap_task_tears_down_only_that_tasks_labs() {
+  local wt="$TMP_ROOT/reap-wt" other="$TMP_ROOT/reap-other" base="fm-lab-reap-$$" out status=0 lab
+  mkdir -p "$wt/nested" "$other"
+  provision_from "$wt/nested" task-a "$base-mine" || fail "reap fixture provision failed"
+  provision_from "$wt" task-b "$base-other-task" || fail "reap fixture provision failed"
+  provision_from "$other" task-a "$base-other-home" || fail "reap fixture provision failed"
+  provision_from "$wt" '' "$base-unowned" || fail "reap fixture provision failed"
+
+  out=$(run_with_fake "$ROOT/bin/fm-herdr-lab.sh" reap-task task-a "$wt/") || fail "reap-task failed: $out"
+  assert_contains "$out" "$base-mine" "reap-task did not report the lab it tore down"
+  [ "$(cat "$FAKE_STATE/$base-mine")" = deleted ] || fail "reap-task left the task's own lab session behind"
+  assert_absent "$TRIPWIRES/$base-mine.fleet-state.json" "reap-task skipped the fleet-state tripwire check"
+  assert_absent "$TRIPWIRES/$base-mine.owner" "reap-task left the reaped lab's owner record"
+  for lab in "$base-other-task" "$base-other-home" "$base-unowned"; do
+    [ "$(cat "$FAKE_STATE/$lab")" = running ] || fail "reap-task tore down $lab, which the task does not own"
+  done
+
+  out=$(run_with_fake "$ROOT/bin/fm-herdr-lab.sh" reap-task task-a "$wt" 2>&1) || fail "a repeated reap-task failed: $out"
+  [ -z "$out" ] || fail "a reap-task with nothing left to reap printed output: $out"
+
+  provision_from "$wt" task-c "$base-stuck" || fail "reap fixture provision failed"
+  FM_FAKE_HERDR_DELETE_FAIL=1 run_with_fake "$ROOT/bin/fm-herdr-lab.sh" reap-task task-c "$wt" \
+    >/dev/null 2>&1 || status=$?
+  expect_code 1 "$status" "a lab reap-task could not remove must be reported"
+  assert_present "$TRIPWIRES/$base-stuck.owner" "a failed reap discarded the lab's owner record"
+
+  status=0
+  run_with_fake "$ROOT/bin/fm-herdr-lab.sh" reap-task task-a relative/path >/dev/null 2>&1 || status=$?
+  expect_code 2 "$status" "reap-task must refuse a relative worktree"
+  status=0
+  run_with_fake "$ROOT/bin/fm-herdr-lab.sh" reap-task task-a / >/dev/null 2>&1 || status=$?
+  expect_code 2 "$status" "reap-task must refuse the filesystem root"
+
+  for lab in "$base-other-task" "$base-other-home" "$base-unowned" "$base-stuck"; do
+    run_with_fake fm_herdr_lab_teardown "$lab" >/dev/null 2>&1 || fail "reap fixture teardown of $lab failed"
+  done
+  pass "fm-herdr-lab: reap-task tears down only the labs that task provisioned from its worktree"
+}
+
 # The pty attachment itself needs a real Herdr client, so the live guard
 # tests/fm-herdr-attached-viewer-live-e2e.test.sh owns that proof. What is
 # portable is who the helper will ever attach to, and who it will signal.
@@ -279,11 +347,11 @@ start_viewer_fixture() {
 }
 
 write_viewer_record() {
-  local record=$1 launcher_pid=$2 viewer_pid=$3 launcher_start viewer_start
-  launcher_start=$(fm_herdr_lab_process_start "$launcher_pid") || fail "could not identify launcher fixture process"
-  viewer_start=$(fm_herdr_lab_process_start "$viewer_pid") || fail "could not identify viewer fixture process"
-  printf 'launcher_pid=%s\nlauncher_start=%s\nviewer_pid=%s\nviewer_start=%s\n' \
-    "$launcher_pid" "$launcher_start" "$viewer_pid" "$viewer_start" > "$record"
+  local record=$1 launcher_pid=$2 viewer_pid=$3 launcher_identity viewer_identity
+  launcher_identity=$(fm_herdr_lab_process_identity "$launcher_pid") || fail "could not identify launcher fixture process"
+  viewer_identity=$(fm_herdr_lab_process_identity "$viewer_pid") || fail "could not identify viewer fixture process"
+  printf 'launcher_pid=%s\nlauncher_identity=%s\nviewer_pid=%s\nviewer_identity=%s\n' \
+    "$launcher_pid" "$launcher_identity" "$viewer_pid" "$viewer_identity" > "$record"
 }
 
 test_viewer_start_cancels_an_unrecorded_launcher() {
@@ -381,7 +449,7 @@ test_viewer_stop_only_signals_owned_processes() {
 
   sleep 20 &
   holder_pid=$!
-  printf 'launcher_pid=%s\nlauncher_start=not-this-process\nviewer_pid=%s\nviewer_start=not-this-process\n' \
+  printf 'launcher_pid=%s\nlauncher_identity=not-this-process\nviewer_pid=%s\nviewer_identity=not-this-process\n' \
     "$holder_pid" "$holder_pid" > "$record"
   printf '%s\n' no_foreground_client > "$FAKE_STATE/$name.foreground"
   run_with_fake fm_herdr_lab_viewer_stop "$name" || fail "stop rejected a stale process record"
@@ -415,6 +483,153 @@ test_viewer_stop_requires_the_recorded_parent() {
   pass "fm-herdr-lab: viewer ownership requires the recorded parent"
 }
 
+# Hosts without a Linux-compatible /proc get a synthesized one for the fixture
+# pids, so the kernel-identity logic under test is the same on every platform.
+viewer_fixture_proc_root() { # <dir> <pid>...
+  local dir=$1 pid
+  shift
+  if [ -r "/proc/$$/stat" ]; then
+    printf '%s' /proc
+    return
+  fi
+  for pid in "$@"; do
+    mkdir -p "$dir/$pid"
+    printf '%s (sleep) S 1 1 1 0 -1 0 0 0 0 0 0 0 0 0 20 0 1 0 %s 0 0\n' "$pid" "$((1000 + pid))" > "$dir/$pid/stat"
+  done
+  printf '%s' "$dir"
+}
+
+# Prints the date one second after an LC_ALL=C lstart value.
+lstart_plus_one_second() { # <lstart>
+  local epoch
+  if epoch=$(LC_ALL=C date -d "$1" +%s 2>/dev/null); then
+    LC_ALL=C date -d "@$((epoch + 1))" '+%a %b %e %H:%M:%S %Y'
+  else
+    epoch=$(LC_ALL=C date -j -f '%a %b %e %T %Y' "$1" +%s) || return 1
+    LC_ALL=C date -j -r "$((epoch + 1))" '+%a %b %e %H:%M:%S %Y'
+  fi
+}
+
+# WSL2 re-renders `ps -o lstart` one to two seconds apart for the same live
+# process because ps derives it from a wall-clock boot time. A drifted lstart
+# must not disown the lab's own viewer, or teardown refuses while it is attached.
+test_viewer_stop_survives_lstart_drift() {
+  local name="fm-lab-viewer-drift-$$" record pair="$TMP_ROOT/viewer-drift-pair"
+  local driftbin="$TMP_ROOT/driftbin" real_ps real_lstart drifted_lstart proc_root waited
+  run_with_fake fm_herdr_lab_provision "$name" || fail "viewer-drift fixture provision failed"
+  record=$(run_with_fake fm_herdr_lab_viewer_record_path "$name")
+  start_viewer_fixture "$pair"
+  proc_root=$(viewer_fixture_proc_root "$TMP_ROOT/drift-proc" "$FIXTURE_LAUNCHER_PID" "$FIXTURE_VIEWER_PID")
+  FM_PROC_ROOT_OVERRIDE="$proc_root" write_viewer_record "$record" "$FIXTURE_LAUNCHER_PID" "$FIXTURE_VIEWER_PID"
+
+  real_ps=$(command -v ps)
+  mkdir -p "$driftbin"
+  cat > "$driftbin/ps" <<SH
+#!/usr/bin/env bash
+case " \$* " in
+  *" lstart= "*)
+    value=\$(LC_ALL=C "$real_ps" "\$@") || exit \$?
+    value=\$(printf '%s' "\$value" | sed 's/^[[:space:]]*//;s/[[:space:]]*\$//')
+    if epoch=\$(LC_ALL=C date -d "\$value" +%s 2>/dev/null); then
+      LC_ALL=C date -d "@\$((epoch + 1))" '+%a %b %e %H:%M:%S %Y'
+    else
+      epoch=\$(LC_ALL=C date -j -f '%a %b %e %T %Y' "\$value" +%s) || exit 1
+      LC_ALL=C date -j -r "\$((epoch + 1))" '+%a %b %e %H:%M:%S %Y'
+    fi
+    ;;
+  *) exec "$real_ps" "\$@" ;;
+esac
+SH
+  chmod +x "$driftbin/ps"
+  real_lstart=$(LC_ALL=C ps -p "$FIXTURE_VIEWER_PID" -o lstart= | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')
+  drifted_lstart=$(PATH="$driftbin:$PATH" ps -p "$FIXTURE_VIEWER_PID" -o lstart=)
+  [ -n "$real_lstart" ] && [ -n "$drifted_lstart" ] && [ "$real_lstart" != "$drifted_lstart" ] \
+    || fail "the drift fixture did not shift lstart (real '$real_lstart', drifted '$drifted_lstart')"
+
+  printf '%s\n' no_foreground_client > "$FAKE_STATE/$name.foreground"
+  PATH="$driftbin:$PATH" FM_PROC_ROOT_OVERRIDE="$proc_root" run_with_fake fm_herdr_lab_viewer_stop "$name" \
+    || fail "viewer stop failed under a one-second lstart drift"
+  # The fixture would exit on its own after 20 seconds, so only a prompt exit
+  # proves that stop signalled it.
+  waited=0
+  while kill -0 "$FIXTURE_VIEWER_PID" 2>/dev/null && [ "$waited" -lt 20 ]; do
+    "$REAL_SLEEP" 0.1
+    waited=$((waited + 1))
+  done
+  kill -0 "$FIXTURE_VIEWER_PID" 2>/dev/null && fail "a one-second lstart drift disowned the lab's own viewer"
+  wait "$FIXTURE_LAUNCHER_PID" 2>/dev/null || true
+  assert_absent "$record" "a confirmed detach left the viewer record behind"
+  run_with_fake fm_herdr_lab_teardown "$name" || fail "viewer-drift fixture teardown failed"
+  pass "fm-herdr-lab: a drifting ps lstart still identifies the lab's own viewer"
+}
+
+# A recorded pid now held by a different process must stay unsignalled: a
+# different kernel start time or boot on the kernel identity, and a different
+# lstart on the portable fallback, each mean a different process.
+test_viewer_stop_refuses_a_reused_pid() {
+  local name="fm-lab-viewer-reuse-$$" record pair="$TMP_ROOT/viewer-reuse-pair" proc_root
+  local launcher_identity viewer_identity starttime case_label forged_launcher forged_viewer
+  run_with_fake fm_herdr_lab_provision "$name" || fail "viewer-reuse fixture provision failed"
+  record=$(run_with_fake fm_herdr_lab_viewer_record_path "$name")
+  start_viewer_fixture "$pair"
+  proc_root=$(viewer_fixture_proc_root "$TMP_ROOT/reuse-proc" "$FIXTURE_LAUNCHER_PID" "$FIXTURE_VIEWER_PID")
+  launcher_identity=$(FM_PROC_ROOT_OVERRIDE="$proc_root" fm_herdr_lab_process_identity "$FIXTURE_LAUNCHER_PID") \
+    || fail "could not identify the reuse launcher fixture"
+  viewer_identity=$(FM_PROC_ROOT_OVERRIDE="$proc_root" fm_herdr_lab_process_identity "$FIXTURE_VIEWER_PID") \
+    || fail "could not identify the reuse viewer fixture"
+  case "$viewer_identity" in
+    *starttime=*) ;;
+    *) fail "a Linux-compatible proc root did not yield a kernel identity: $viewer_identity" ;;
+  esac
+  printf '%s\n' no_foreground_client > "$FAKE_STATE/$name.foreground"
+
+  for case_label in starttime boot; do
+    case "$case_label" in
+      starttime)
+        starttime=${launcher_identity##*starttime=}
+        forged_launcher="${launcher_identity%starttime=*}starttime=$((starttime + 1))"
+        starttime=${viewer_identity##*starttime=}
+        forged_viewer="${viewer_identity%starttime=*}starttime=$((starttime + 1))"
+        ;;
+      boot)
+        forged_launcher="boot=00000000-0000-0000-0000-000000000000 starttime=${launcher_identity##*starttime=}"
+        forged_viewer="boot=00000000-0000-0000-0000-000000000000 starttime=${viewer_identity##*starttime=}"
+        ;;
+    esac
+    [ "$forged_viewer" != "$viewer_identity" ] || fail "the $case_label reuse case did not change the identity"
+    printf 'launcher_pid=%s\nlauncher_identity=%s\nviewer_pid=%s\nviewer_identity=%s\n' \
+      "$FIXTURE_LAUNCHER_PID" "$forged_launcher" "$FIXTURE_VIEWER_PID" "$forged_viewer" > "$record"
+    FM_PROC_ROOT_OVERRIDE="$proc_root" run_with_fake fm_herdr_lab_viewer_stop "$name" \
+      || fail "stop rejected a $case_label-mismatched record"
+    kill -0 "$FIXTURE_VIEWER_PID" 2>/dev/null \
+      || fail "stop signalled a reused viewer pid with a different $case_label"
+    kill -0 "$FIXTURE_LAUNCHER_PID" 2>/dev/null \
+      || fail "stop signalled a reused launcher pid with a different $case_label"
+  done
+
+  # Without a compatible /proc the lstart fallback stays an exact match.
+  launcher_identity=$(FM_PROC_ROOT_OVERRIDE="$TMP_ROOT/no-proc" fm_herdr_lab_process_identity "$FIXTURE_LAUNCHER_PID") \
+    || fail "the lstart fallback could not identify the launcher fixture"
+  case "$launcher_identity" in
+    lstart=?*) ;;
+    *) fail "a host without /proc did not fall back to lstart: $launcher_identity" ;;
+  esac
+  viewer_identity=$(FM_PROC_ROOT_OVERRIDE="$TMP_ROOT/no-proc" fm_herdr_lab_process_identity "$FIXTURE_VIEWER_PID") \
+    || fail "the lstart fallback could not identify the viewer fixture"
+  forged_launcher=$(lstart_plus_one_second "${launcher_identity#lstart=}") || fail "could not shift the launcher lstart"
+  forged_viewer=$(lstart_plus_one_second "${viewer_identity#lstart=}") || fail "could not shift the viewer lstart"
+  printf 'launcher_pid=%s\nlauncher_identity=lstart=%s\nviewer_pid=%s\nviewer_identity=lstart=%s\n' \
+    "$FIXTURE_LAUNCHER_PID" "$forged_launcher" "$FIXTURE_VIEWER_PID" "$forged_viewer" > "$record"
+  FM_PROC_ROOT_OVERRIDE="$TMP_ROOT/no-proc" run_with_fake fm_herdr_lab_viewer_stop "$name" \
+    || fail "stop rejected an lstart-mismatched record"
+  kill -0 "$FIXTURE_VIEWER_PID" 2>/dev/null || fail "the lstart fallback signalled a reused viewer pid"
+
+  kill "$FIXTURE_VIEWER_PID" 2>/dev/null || true
+  wait "$FIXTURE_LAUNCHER_PID" 2>/dev/null || true
+  run_with_fake fm_herdr_lab_teardown "$name" || fail "viewer-reuse fixture teardown failed"
+  pass "fm-herdr-lab: a reused viewer pid with a different identity is never signalled"
+}
+
 test_interrupted_viewer_start_cancels_launcher() {
   local name="fm-lab-viewer-interrupt-$$" command_pid launcher_pid status=0
   local started="$TMP_ROOT/viewer-interrupt-started" attached="$TMP_ROOT/viewer-interrupt-attached"
@@ -473,7 +688,7 @@ test_viewer_stop_retains_record_when_detach_is_unreadable() {
   local name="fm-lab-viewer-unreadable-$$" record status=0
   run_with_fake fm_herdr_lab_provision "$name" || fail "unreadable-detach fixture provision failed"
   record=$(run_with_fake fm_herdr_lab_viewer_record_path "$name")
-  printf 'launcher_pid=99999999\nlauncher_start=stale\nviewer_pid=99999999\nviewer_start=stale\n' > "$record"
+  printf 'launcher_pid=99999999\nlauncher_identity=stale\nviewer_pid=99999999\nviewer_identity=stale\n' > "$record"
   FM_FAKE_HERDR_FAST_POLL=1 FM_FAKE_HERDR_TITLE_FAIL=1 \
     run_with_fake fm_herdr_lab_viewer_stop "$name" >/dev/null 2>&1 || status=$?
   expect_code 1 "$status" "an unreadable detach result on a running session must fail closed"
@@ -505,12 +720,16 @@ test_changed_default_trips_after_teardown
 test_stopped_owned_lab_can_reprovision
 test_failed_delete_retains_tripwire
 test_timed_out_provision_cancels_late_launch
+test_provision_records_the_owning_task
+test_reap_task_tears_down_only_that_tasks_labs
 test_viewer_refuses_unowned_sessions
 test_viewer_start_cancels_an_unrecorded_launcher
 test_viewer_timeout_allows_launcher_escalation
 test_viewer_start_requires_its_owned_process
 test_viewer_stop_only_signals_owned_processes
 test_viewer_stop_requires_the_recorded_parent
+test_viewer_stop_survives_lstart_drift
+test_viewer_stop_refuses_a_reused_pid
 test_interrupted_viewer_start_cancels_launcher
 test_teardown_refuses_while_viewer_attached
 test_viewer_stop_retains_record_when_detach_is_unreadable
diff --git a/tests/fm-teardown.test.sh b/tests/fm-teardown.test.sh
index 7b2a86df631..5e1adbe786a 100755
--- a/tests/fm-teardown.test.sh
+++ b/tests/fm-teardown.test.sh
@@ -623,11 +623,13 @@ run_teardown() {
   local case_dir=$1; shift
   # FM_DATA_OVERRIDE is pinned to the case dir because teardown closes this
   # home's backlog item itself; without it $DATA would resolve to the real
-  # repo's own home and a test could mutate live records.
+  # repo's own home and a test could mutate live records. The Herdr lab state
+  # dir is pinned for the same reason: teardown tears down the task's labs.
   FM_ROOT_OVERRIDE="$ROOT" \
   FM_STATE_OVERRIDE="$case_dir/state" \
   FM_DATA_OVERRIDE="$case_dir/data" \
   FM_CONFIG_OVERRIDE="$case_dir/config" \
+  FM_HERDR_LAB_STATE_DIR="$case_dir/herdr-lab" \
   PATH="$case_dir/fakebin:${FM_TEARDOWN_TEST_PATH:-$PATH}" \
     "$TEARDOWN" task-x1 "$@"
 }
@@ -3474,6 +3476,70 @@ test_leaked_worktree_process_is_reaped() {
   pass "a leaked descendant process rooted under the task's worktree is reaped by teardown, not left surviving"
 }
 
+# A Herdr lab session whose server runs detached from the worker, recorded by
+# bin/fm-herdr-lab.sh as provisioned by this task from its worktree, must not
+# outlive the task; another task's lab is never touched.
+add_fake_herdr_lab_server() {  # <case-dir>
+  cat > "$1/fakebin/herdr" <<'SH'
+#!/usr/bin/env bash
+set -eu
+session=${!#}
+state=$FM_FAKE_HERDR_STATE
+lab=absent
+[ ! -f "$state/$session" ] || lab=$(cat "$state/$session")
+case "$1 ${2:-}" in
+  "session list")
+    jq -nc --arg name "$session" --arg lab "$lab" '
+      {sessions: ([{default: true, name: "default", running: true, socket_path: "/fake/herdr.sock"}]
+        + (if $lab == "running" or $lab == "stopped"
+           then [{default: false, name: $name, running: ($lab == "running"), socket_path: "/fake/lab.sock"}]
+           else [] end))}'
+    ;;
+  "server --session") printf 'running\n' > "$state/$session" ;;
+  "status --json") jq -nc --arg lab "$lab" '{server: {running: ($lab == "running")}}' ;;
+  "session stop") printf 'stopped\n' > "$state/$session" ;;
+  "session delete") printf 'deleted\n' > "$state/$session" ;;
+  "terminal title") printf '%s\n' '{"result":{"reason":"no_foreground_client"}}' ;;
+  *) printf '%s\n' '{"ok":true}' ;;
+esac
+SH
+  chmod +x "$1/fakebin/herdr"
+  mkdir -p "$1/herdr-state" "$1/herdr-lab"
+}
+
+provision_fake_herdr_lab() {  # <case-dir> <task-id> <session>
+  ( cd "$1/wt" \
+    && FM_TASK_ID=$2 FM_HERDR_LAB_STATE_DIR="$1/herdr-lab" FM_FAKE_HERDR_STATE="$1/herdr-state" \
+      PATH="$1/fakebin:$PATH" "$ROOT/bin/fm-herdr-lab.sh" provision "$3" )
+}
+
+test_leftover_herdr_lab_is_torn_down() {
+  local case_dir rc
+  case_dir=$(make_case leftover-herdr-lab)
+  write_meta "$case_dir" no-mistakes ship
+  land_shippable_commit "$case_dir"
+  add_fake_herdr_lab_server "$case_dir"
+  provision_fake_herdr_lab "$case_dir" task-x1 fm-lab-mine || fail "leftover-herdr-lab: lab fixture provision failed"
+  provision_fake_herdr_lab "$case_dir" task-y2 fm-lab-theirs || fail "leftover-herdr-lab: lab fixture provision failed"
+
+  rc=0
+  FM_FAKE_HERDR_STATE="$case_dir/herdr-state" \
+    run_teardown "$case_dir" > "$case_dir/stdout" 2> "$case_dir/stderr" || rc=$?
+
+  expect_code 0 "$rc" "leftover-herdr-lab: teardown should succeed: $(cat "$case_dir/stderr")"
+  [ "$(cat "$case_dir/herdr-state/fm-lab-mine")" = deleted ] \
+    || fail "leftover-herdr-lab: the task's leftover lab session survived teardown"
+  assert_absent "$case_dir/herdr-lab/fm-lab-mine.owner" \
+    "leftover-herdr-lab: teardown left the reaped lab's ownership record"
+  assert_grep "fm-lab-mine" "$case_dir/stderr" \
+    "leftover-herdr-lab: teardown did not report the lab it tore down"
+  [ "$(cat "$case_dir/herdr-state/fm-lab-theirs")" = running ] \
+    || fail "leftover-herdr-lab: teardown touched another task's lab session"
+  assert_present "$case_dir/herdr-lab/fm-lab-theirs.owner" \
+    "leftover-herdr-lab: teardown removed another task's lab ownership record"
+  pass "a Herdr lab the task left behind is torn down with the task, and another task's lab is left alone"
+}
+
 test_leaked_tasktmp_process_is_reaped() {
   local case_dir rc pid
   case_dir=$(make_case leaked-tasktmp-reap)
@@ -3913,6 +3979,7 @@ test_not_found_status_after_abort_confirms_completion
 test_another_branchs_parked_run_is_never_touched
 test_own_autonomous_run_is_left_alone
 test_leaked_worktree_process_is_reaped
+test_leftover_herdr_lab_is_torn_down
 test_leaked_tasktmp_process_is_reaped
 test_lsof_absent_reaps_tmux_process_group
 test_lsof_error_refuses_before_removal

From a71750d6e06066cccc4ed09206c8a0fd9e93198c Mon Sep 17 00:00:00 2001
From: Dardan Tigani <dardantigani@gmail.com>
Date: Fri, 25 Sep 2026 14:18:11 -0400
Subject: [PATCH 2/2] no-mistakes(review): Drop lab-leak backstop, keep
 kernel-identity viewer fix

---
 bin/fm-herdr-lab.sh        | 83 +-------------------------------------
 bin/fm-teardown.sh         | 15 -------
 docs/herdr-backend.md      |  1 -
 tests/fm-herdr-lab.test.sh | 70 --------------------------------
 tests/fm-teardown.test.sh  | 69 +------------------------------
 5 files changed, 3 insertions(+), 235 deletions(-)

diff --git a/bin/fm-herdr-lab.sh b/bin/fm-herdr-lab.sh
index ce7bec8a86d..a1313d32773 100755
--- a/bin/fm-herdr-lab.sh
+++ b/bin/fm-herdr-lab.sh
@@ -11,7 +11,6 @@
 #   fm-herdr-lab.sh viewer stop <session>
 #   fm-herdr-lab.sh stop <session>
 #   fm-herdr-lab.sh teardown <session>
-#   fm-herdr-lab.sh reap-task <task-id> <worktree>
 #
 # Session names must begin with "fm-lab-" and can never be "default".
 # The name command sanitizes the label, caps it at 16 characters, and appends
@@ -26,14 +25,6 @@
 # destructive call.
 # Provision records the running default session as a fleet-state tripwire and
 # teardown requires that record to be identical afterward.
-# Inside a Firstmate task (FM_TASK_ID set) provision also records the task id and
-# its physical working directory as the lab's owner.
-# The lab server outlives whichever shell provisioned it, so a lab that shell
-# never tore down, such as one whose owner was killed before its EXIT trap could
-# run, stays registered after the task ends.
-# reap-task is bin/fm-teardown.sh's backstop for that: it runs the guarded
-# teardown below for every lab recorded for that task id from inside that
-# worktree, and nothing else.
 # The viewer command attaches or detaches one real foreground Herdr client on
 # an owned lab session over a fixed 40-row by 120-column pty;
 # bin/fm-herdr-lab-viewer.py owns the pty mechanics.
@@ -67,36 +58,6 @@ fm_herdr_lab_tripwire_path() { # <session>
   printf '%s/%s.fleet-state.json' "$(fm_herdr_lab_state_dir)" "$1"
 }
 
-fm_herdr_lab_owner_path() { # <session>
-  printf '%s/%s.owner' "$(fm_herdr_lab_state_dir)" "$1"
-}
-
-fm_herdr_lab_valid_task_id() { # <task-id>
-  [[ "${1:-}" =~ ^[a-zA-Z0-9][a-zA-Z0-9._-]*$ ]]
-}
-
-# Records which Firstmate task provisioned the lab, from where. Outside a task
-# nothing is recorded and no teardown will ever reap the lab on its own.
-fm_herdr_lab_record_owner() { # <session>
-  local task=${FM_TASK_ID:-} cwd
-  [ -n "$task" ] || return 0
-  fm_herdr_lab_valid_task_id "$task" || {
-    fm_herdr_lab_error "FM_TASK_ID is not a task id; refusing ambiguous lab ownership: $task"
-    return 1
-  }
-  cwd=$(pwd -P) || return 1
-  case "$cwd" in
-    /*) ;;
-    *) fm_herdr_lab_error "cannot record lab ownership from working directory '$cwd'"; return 1 ;;
-  esac
-  case "$cwd" in *$'\n'*|*$'\r'*)
-    fm_herdr_lab_error "cannot record lab ownership from a working directory containing a line break"
-    return 1
-    ;;
-  esac
-  printf 'task=%s\ncwd=%s\n' "$task" "$cwd" > "$(fm_herdr_lab_owner_path "$1")"
-}
-
 fm_herdr_lab_raw() { # <session> <herdr arguments...>
   local name=$1
   shift
@@ -153,10 +114,6 @@ fm_herdr_lab_prepare() { # <session>
     rm -f "$tripwire"
     return 1
   }
-  fm_herdr_lab_record_owner "$name" || {
-    rm -f "$tripwire" "$(fm_herdr_lab_owner_path "$name")"
-    return 1
-  }
 }
 
 fm_herdr_lab_refuse_if_default() { # <session>
@@ -544,7 +501,7 @@ fm_herdr_lab_verify_tripwire() { # <session>
   local name=$1 tripwire
   fm_herdr_lab_check_tripwire "$name" || return 1
   tripwire=$(fm_herdr_lab_tripwire_path "$name")
-  rm -f "$tripwire" "$(fm_herdr_lab_owner_path "$name")"
+  rm -f "$tripwire"
 }
 
 fm_herdr_lab_stop() { # <session>
@@ -598,38 +555,6 @@ fm_herdr_lab_teardown() { # <session>
   fm_herdr_lab_verify_tripwire "$name"
 }
 
-fm_herdr_lab_reap_task() { # <task-id> <worktree>
-  local task=${1:-} worktree=${2:-} real owner name recorded_task recorded_cwd status=0
-  fm_herdr_lab_valid_task_id "$task" || { fm_herdr_lab_error "reap-task needs a task id: $task"; return 2; }
-  case "$worktree" in
-    /?*) ;;
-    *) fm_herdr_lab_error "reap-task needs an absolute worktree path: $worktree"; return 2 ;;
-  esac
-  worktree=${worktree%/}
-  real=$(cd "$worktree" 2>/dev/null && pwd -P) || real=$worktree
-  [ "$real" != / ] || { fm_herdr_lab_error "reap-task refuses the filesystem root as a worktree"; return 2; }
-  for owner in "$(fm_herdr_lab_state_dir)"/fm-lab-*.owner; do
-    [ -f "$owner" ] || continue
-    name=${owner##*/}
-    name=${name%.owner}
-    fm_herdr_lab_validate_name "$name" 2>/dev/null || continue
-    recorded_task=$(sed -n 's/^task=//p' "$owner" | head -n 1)
-    recorded_cwd=$(sed -n 's/^cwd=//p' "$owner" | head -n 1)
-    [ "$recorded_task" = "$task" ] || continue
-    case "$recorded_cwd/" in
-      "$real"/*|"$worktree"/*) ;;
-      *) continue ;;
-    esac
-    if fm_herdr_lab_teardown "$name"; then
-      printf 'fm-herdr-lab: tore down lab session %s left behind by task %s\n' "$name" "$task"
-    else
-      fm_herdr_lab_error "could not tear down lab session '$name' left behind by task $task"
-      status=1
-    fi
-  done
-  return "$status"
-}
-
 fm_herdr_lab_name() { # <label>
   local label=${1:-lab}
   label=$(printf '%s' "$label" | tr -cd 'a-zA-Z0-9_-' | sed 's/^[^a-zA-Z0-9]*//; s/-*$//')
@@ -641,7 +566,7 @@ fm_herdr_lab_name() { # <label>
 }
 
 fm_herdr_lab_usage() {
-  sed -n '2,16p' "${BASH_SOURCE[0]}" | sed 's/^# \{0,1\}//'
+  sed -n '2,15p' "${BASH_SOURCE[0]}" | sed 's/^# \{0,1\}//'
 }
 
 fm_herdr_lab_main() {
@@ -676,10 +601,6 @@ fm_herdr_lab_main() {
       [ "$#" -eq 2 ] || { fm_herdr_lab_usage >&2; return 2; }
       fm_herdr_lab_teardown "$2"
       ;;
-    reap-task)
-      [ "$#" -eq 3 ] || { fm_herdr_lab_usage >&2; return 2; }
-      fm_herdr_lab_reap_task "$2" "$3"
-      ;;
     -h|--help|help)
       fm_herdr_lab_usage
       ;;
diff --git a/bin/fm-teardown.sh b/bin/fm-teardown.sh
index 9c6ef4ad3a6..a1941c4c6c0 100755
--- a/bin/fm-teardown.sh
+++ b/bin/fm-teardown.sh
@@ -276,15 +276,6 @@
 #     root still exists, so the account's healthy LaunchAgent worker and every
 #     live remote secondmate worker are out of scope. Best effort: a sweep
 #     failure never blocks this teardown.
-#   Fix 4 - tear down leftover Herdr labs. A lab provisioned through
-#     bin/fm-herdr-lab.sh keeps its server running detached from the worker,
-#     so a lab the task never tore down outlives it (observed 2026-09-24: a
-#     test's lab still running after its task ended). This runs first, before
-#     Fix 1, because Fix 2 would otherwise kill only a lab server started from
-#     the worktree and leave its session registered. `fm-herdr-lab.sh
-#     reap-task` owns which labs count as this task's and tears each down
-#     through the helper's guarded path. Best effort: a lab that cannot be torn
-#     down is reported but never blocks this teardown.
 set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
@@ -3457,12 +3448,6 @@ else
   fi
 fi
 
-# Fix 4 (see script header): tear down Herdr labs this task left behind.
-if [ "$KIND" != secondmate ] && [ -n "$WT" ]; then
-  "$SCRIPT_DIR/fm-herdr-lab.sh" reap-task "$ID" "$WT" >&2 \
-    || echo "warning: a Herdr lab session left behind by $ID could not be torn down; see the fm-herdr-lab lines above" >&2
-fi
-
 # Every landed/discard-work refusal above has now passed (or --force skipped
 # them). Fix 1 and Fix 2 (see script header) run here, unconditionally on
 # --force, and before ANY destructive step below - a still-parked run or a
diff --git a/docs/herdr-backend.md b/docs/herdr-backend.md
index 0aed1b56955..aed96ee49d0 100644
--- a/docs/herdr-backend.md
+++ b/docs/herdr-backend.md
@@ -341,7 +341,6 @@ An environment-only session selection can silently reach a different running ser
 It provisions only non-default names beginning with `fm-lab-`, appends an explicit `--session` to allowed task commands, refuses caller-supplied session flags and server/session lifecycle subcommands, and performs destructive stop/delete only through its guarded lifecycle actions.
 Immediately before every destructive call it re-queries the named session and refuses empty, missing, literal `default`, or `default:true` identities.
 Its before/after tripwire requires the live default-session snapshot to remain byte-identical.
-A lab server outlives the shell that provisioned it, so a lab provisioned inside a Firstmate task records that task as its owner, and task cleanup tears down any lab the task left behind through the same guarded path.
 
 The helper's header and `--help` own exact commands.
 Tests use thin compatibility wrappers in `tests/herdr-test-safety.sh` and never duplicate the destructive policy.
diff --git a/tests/fm-herdr-lab.test.sh b/tests/fm-herdr-lab.test.sh
index b41907cf342..a2031633c89 100755
--- a/tests/fm-herdr-lab.test.sh
+++ b/tests/fm-herdr-lab.test.sh
@@ -90,7 +90,6 @@ run_with_fake() {
     FM_FAKE_HERDR_DELETE_FAIL="${FM_FAKE_HERDR_DELETE_FAIL:-}" \
     FM_FAKE_HERDR_TITLE_FAIL="${FM_FAKE_HERDR_TITLE_FAIL:-}" \
     FM_HERDR_LAB_STATE_DIR="$TRIPWIRES" \
-    FM_TASK_ID="${FM_FAKE_TASK_ID:-}" \
     "$@"
 }
 
@@ -246,73 +245,6 @@ SH
 }
 
 
-provision_from() { # <dir> <task-id> <session>
-  (cd "$1" && FM_FAKE_TASK_ID=$2 run_with_fake fm_herdr_lab_provision "$3")
-}
-
-test_provision_records_the_owning_task() {
-  local wt="$TMP_ROOT/owner-wt" name="fm-lab-owner-$$" status=0 real
-  mkdir -p "$wt/sub"
-  real=$(cd "$wt/sub" && pwd -P)
-  provision_from "$wt/sub" task-owner "$name" || fail "owned provision failed"
-  [ "$(cat "$TRIPWIRES/$name.owner" 2>/dev/null)" = "$(printf 'task=task-owner\ncwd=%s' "$real")" ] \
-    || fail "provision did not record the owning task and its physical working directory"
-  run_with_fake fm_herdr_lab_teardown "$name" || fail "owned lab teardown failed"
-  assert_absent "$TRIPWIRES/$name.owner" "teardown left the lab's owner record behind"
-
-  provision_from "$wt" '' "$name-free" || fail "unowned provision failed"
-  assert_absent "$TRIPWIRES/$name-free.owner" "a lab provisioned outside a task recorded an owner"
-  run_with_fake fm_herdr_lab_teardown "$name-free" || fail "unowned lab teardown failed"
-
-  provision_from "$wt" 'bad id' "$name-bad" >/dev/null 2>&1 || status=$?
-  expect_code 1 "$status" "a malformed task id must not provision an ambiguously owned lab"
-  assert_absent "$TRIPWIRES/$name-bad.fleet-state.json" "a refused owner record left its tripwire behind"
-  assert_absent "$FAKE_STATE/$name-bad" "a refused owner record still started the lab session"
-  pass "fm-herdr-lab: provision records the owning task and teardown retires it"
-}
-
-# A lab whose provisioning shell died before its EXIT trap ran must not outlive
-# its task; reap-task is the task teardown's backstop and must touch only that
-# task's own labs.
-test_reap_task_tears_down_only_that_tasks_labs() {
-  local wt="$TMP_ROOT/reap-wt" other="$TMP_ROOT/reap-other" base="fm-lab-reap-$$" out status=0 lab
-  mkdir -p "$wt/nested" "$other"
-  provision_from "$wt/nested" task-a "$base-mine" || fail "reap fixture provision failed"
-  provision_from "$wt" task-b "$base-other-task" || fail "reap fixture provision failed"
-  provision_from "$other" task-a "$base-other-home" || fail "reap fixture provision failed"
-  provision_from "$wt" '' "$base-unowned" || fail "reap fixture provision failed"
-
-  out=$(run_with_fake "$ROOT/bin/fm-herdr-lab.sh" reap-task task-a "$wt/") || fail "reap-task failed: $out"
-  assert_contains "$out" "$base-mine" "reap-task did not report the lab it tore down"
-  [ "$(cat "$FAKE_STATE/$base-mine")" = deleted ] || fail "reap-task left the task's own lab session behind"
-  assert_absent "$TRIPWIRES/$base-mine.fleet-state.json" "reap-task skipped the fleet-state tripwire check"
-  assert_absent "$TRIPWIRES/$base-mine.owner" "reap-task left the reaped lab's owner record"
-  for lab in "$base-other-task" "$base-other-home" "$base-unowned"; do
-    [ "$(cat "$FAKE_STATE/$lab")" = running ] || fail "reap-task tore down $lab, which the task does not own"
-  done
-
-  out=$(run_with_fake "$ROOT/bin/fm-herdr-lab.sh" reap-task task-a "$wt" 2>&1) || fail "a repeated reap-task failed: $out"
-  [ -z "$out" ] || fail "a reap-task with nothing left to reap printed output: $out"
-
-  provision_from "$wt" task-c "$base-stuck" || fail "reap fixture provision failed"
-  FM_FAKE_HERDR_DELETE_FAIL=1 run_with_fake "$ROOT/bin/fm-herdr-lab.sh" reap-task task-c "$wt" \
-    >/dev/null 2>&1 || status=$?
-  expect_code 1 "$status" "a lab reap-task could not remove must be reported"
-  assert_present "$TRIPWIRES/$base-stuck.owner" "a failed reap discarded the lab's owner record"
-
-  status=0
-  run_with_fake "$ROOT/bin/fm-herdr-lab.sh" reap-task task-a relative/path >/dev/null 2>&1 || status=$?
-  expect_code 2 "$status" "reap-task must refuse a relative worktree"
-  status=0
-  run_with_fake "$ROOT/bin/fm-herdr-lab.sh" reap-task task-a / >/dev/null 2>&1 || status=$?
-  expect_code 2 "$status" "reap-task must refuse the filesystem root"
-
-  for lab in "$base-other-task" "$base-other-home" "$base-unowned" "$base-stuck"; do
-    run_with_fake fm_herdr_lab_teardown "$lab" >/dev/null 2>&1 || fail "reap fixture teardown of $lab failed"
-  done
-  pass "fm-herdr-lab: reap-task tears down only the labs that task provisioned from its worktree"
-}
-
 # The pty attachment itself needs a real Herdr client, so the live guard
 # tests/fm-herdr-attached-viewer-live-e2e.test.sh owns that proof. What is
 # portable is who the helper will ever attach to, and who it will signal.
@@ -720,8 +652,6 @@ test_changed_default_trips_after_teardown
 test_stopped_owned_lab_can_reprovision
 test_failed_delete_retains_tripwire
 test_timed_out_provision_cancels_late_launch
-test_provision_records_the_owning_task
-test_reap_task_tears_down_only_that_tasks_labs
 test_viewer_refuses_unowned_sessions
 test_viewer_start_cancels_an_unrecorded_launcher
 test_viewer_timeout_allows_launcher_escalation
diff --git a/tests/fm-teardown.test.sh b/tests/fm-teardown.test.sh
index 5e1adbe786a..7b2a86df631 100755
--- a/tests/fm-teardown.test.sh
+++ b/tests/fm-teardown.test.sh
@@ -623,13 +623,11 @@ run_teardown() {
   local case_dir=$1; shift
   # FM_DATA_OVERRIDE is pinned to the case dir because teardown closes this
   # home's backlog item itself; without it $DATA would resolve to the real
-  # repo's own home and a test could mutate live records. The Herdr lab state
-  # dir is pinned for the same reason: teardown tears down the task's labs.
+  # repo's own home and a test could mutate live records.
   FM_ROOT_OVERRIDE="$ROOT" \
   FM_STATE_OVERRIDE="$case_dir/state" \
   FM_DATA_OVERRIDE="$case_dir/data" \
   FM_CONFIG_OVERRIDE="$case_dir/config" \
-  FM_HERDR_LAB_STATE_DIR="$case_dir/herdr-lab" \
   PATH="$case_dir/fakebin:${FM_TEARDOWN_TEST_PATH:-$PATH}" \
     "$TEARDOWN" task-x1 "$@"
 }
@@ -3476,70 +3474,6 @@ test_leaked_worktree_process_is_reaped() {
   pass "a leaked descendant process rooted under the task's worktree is reaped by teardown, not left surviving"
 }
 
-# A Herdr lab session whose server runs detached from the worker, recorded by
-# bin/fm-herdr-lab.sh as provisioned by this task from its worktree, must not
-# outlive the task; another task's lab is never touched.
-add_fake_herdr_lab_server() {  # <case-dir>
-  cat > "$1/fakebin/herdr" <<'SH'
-#!/usr/bin/env bash
-set -eu
-session=${!#}
-state=$FM_FAKE_HERDR_STATE
-lab=absent
-[ ! -f "$state/$session" ] || lab=$(cat "$state/$session")
-case "$1 ${2:-}" in
-  "session list")
-    jq -nc --arg name "$session" --arg lab "$lab" '
-      {sessions: ([{default: true, name: "default", running: true, socket_path: "/fake/herdr.sock"}]
-        + (if $lab == "running" or $lab == "stopped"
-           then [{default: false, name: $name, running: ($lab == "running"), socket_path: "/fake/lab.sock"}]
-           else [] end))}'
-    ;;
-  "server --session") printf 'running\n' > "$state/$session" ;;
-  "status --json") jq -nc --arg lab "$lab" '{server: {running: ($lab == "running")}}' ;;
-  "session stop") printf 'stopped\n' > "$state/$session" ;;
-  "session delete") printf 'deleted\n' > "$state/$session" ;;
-  "terminal title") printf '%s\n' '{"result":{"reason":"no_foreground_client"}}' ;;
-  *) printf '%s\n' '{"ok":true}' ;;
-esac
-SH
-  chmod +x "$1/fakebin/herdr"
-  mkdir -p "$1/herdr-state" "$1/herdr-lab"
-}
-
-provision_fake_herdr_lab() {  # <case-dir> <task-id> <session>
-  ( cd "$1/wt" \
-    && FM_TASK_ID=$2 FM_HERDR_LAB_STATE_DIR="$1/herdr-lab" FM_FAKE_HERDR_STATE="$1/herdr-state" \
-      PATH="$1/fakebin:$PATH" "$ROOT/bin/fm-herdr-lab.sh" provision "$3" )
-}
-
-test_leftover_herdr_lab_is_torn_down() {
-  local case_dir rc
-  case_dir=$(make_case leftover-herdr-lab)
-  write_meta "$case_dir" no-mistakes ship
-  land_shippable_commit "$case_dir"
-  add_fake_herdr_lab_server "$case_dir"
-  provision_fake_herdr_lab "$case_dir" task-x1 fm-lab-mine || fail "leftover-herdr-lab: lab fixture provision failed"
-  provision_fake_herdr_lab "$case_dir" task-y2 fm-lab-theirs || fail "leftover-herdr-lab: lab fixture provision failed"
-
-  rc=0
-  FM_FAKE_HERDR_STATE="$case_dir/herdr-state" \
-    run_teardown "$case_dir" > "$case_dir/stdout" 2> "$case_dir/stderr" || rc=$?
-
-  expect_code 0 "$rc" "leftover-herdr-lab: teardown should succeed: $(cat "$case_dir/stderr")"
-  [ "$(cat "$case_dir/herdr-state/fm-lab-mine")" = deleted ] \
-    || fail "leftover-herdr-lab: the task's leftover lab session survived teardown"
-  assert_absent "$case_dir/herdr-lab/fm-lab-mine.owner" \
-    "leftover-herdr-lab: teardown left the reaped lab's ownership record"
-  assert_grep "fm-lab-mine" "$case_dir/stderr" \
-    "leftover-herdr-lab: teardown did not report the lab it tore down"
-  [ "$(cat "$case_dir/herdr-state/fm-lab-theirs")" = running ] \
-    || fail "leftover-herdr-lab: teardown touched another task's lab session"
-  assert_present "$case_dir/herdr-lab/fm-lab-theirs.owner" \
-    "leftover-herdr-lab: teardown removed another task's lab ownership record"
-  pass "a Herdr lab the task left behind is torn down with the task, and another task's lab is left alone"
-}
-
 test_leaked_tasktmp_process_is_reaped() {
   local case_dir rc pid
   case_dir=$(make_case leaked-tasktmp-reap)
@@ -3979,7 +3913,6 @@ test_not_found_status_after_abort_confirms_completion
 test_another_branchs_parked_run_is_never_touched
 test_own_autonomous_run_is_left_alone
 test_leaked_worktree_process_is_reaped
-test_leftover_herdr_lab_is_torn_down
 test_leaked_tasktmp_process_is_reaped
 test_lsof_absent_reaps_tmux_process_group
 test_lsof_error_refuses_before_removal