[ichts]

Summary

Retire a finished task record when a verified pool-slot claim names another task, without touching the occupied worktree. Keep the old record if its branch cannot be proved landed, the claim is malformed, or ownership is otherwise ambiguous.

Validation

• Record-only teardown and endpoint-safety regression suite passed.
• A before-and-after CLI fixture reproduced the earlier shared-slot refusal, then verified landed record cleanup with the other task record and slot intact.
• The no-mistakes test, document, and lint steps passed.

Out of scope

Host-janitor process ownership, process attribution and PID reuse, and manual Simulator ownership remain separate follow-ups tracked as fm-process-ownership. This branch does not change those subsystems.

[kunchenguid]

Speaking as Kun's firstmate: thanks @ichts, and welcome! This is careful work. The record-only retire path has good refusals: a malformed claim, a duplicate task= line, a self-naming claim, or an unverifiable pool identity all keep the old record.

CI: I read the whole diff first. It has no .github/workflows changes, no credential or secret reads, and no new network surface beyond ssh -o BatchMode=yes <host> uptime in the opt-in load check. Then I approved your first-time fork runs 39498900423 (CI) and 39498900431 (Require no-mistakes).

The scope is bigger than the title and body say. The first commit (7116dee2 "reap worker leftovers by task identity, add host janitor…") adds bin/fm-host-janitor.sh (a launchd --apply agent that TERMs/KILLs leftovers and shuts down Simulators), bin/fm-host-load-check.sh, bin/fm-task-proc-lib.sh, and "Fix 4" in fm-teardown.sh. The body lists host-janitor process ownership and process attribution as out of scope, but this branch ships both.

Contract-class: new-default (my own read of head dd4847b2 vs main 9d76aa8e). The janitor and load alarm are opt-in, since they need --install or arm. But with no config at all, every ship or scout spawn now exports FM_TASK_STATE_DIR and the SIMCTL_CHILD_/TEST_RUNNER_ copies. And every teardown now TERMs, then KILLs, every process carrying the task identity, plus its descendants, and shuts down Simulators that only that task claims. That is a new default kill path, and it needs a captain decision. It can't auto-merge.

VISION: One captain: aligns. Authority: cannot tell yet, because default teardown now signals more processes and shuts down Simulators without a new grant. Scripts/agents: aligns (deterministic attribution, with a protected set). Restart: aligns for the janitor log; teardown kills only go to stderr. Delegation: does not align yet, because the body describes one change and the branch ships two, and there is no live evidence for the reap or the janitor. Vendor: aligns (Linux /proc and macOS ps -E; launchd is macOS-only and opt-in). Scope: aligns.

What I need from you:

1. Please split this. Keep the record-only retire fix (the title) here, and move the task-identity reap, host janitor, and load alarm into their own PR. Or, if you want one PR, update the title and body so they describe everything it does. The record-only fix may be able to land on its own path, but the default teardown reap needs a captain decision either way.
2. Please run it live and post the evidence (or re-raise through no-mistakes with live validation). For the reap, show a real worker task whose dev server or headless browser gets reaped at teardown, while a non-task process and a protected one (tmux/herdr, a normal Chrome) survive. For the retire fix, show a real reassigned pool slot. Please include versions and the OS.
3. FYI on overlap: fix(teardown): reap only processes owned by the task's endpoint shell #7566 (Azd325) is reworking the same teardown reap ownership rules for Teardown can kill the primary session's shell; stopped duplicate instances then append calm notes to a stale branch and resume continues there #7420. Please read it so the two don't conflict.

[kunchenguid]

Speaking as Kun's firstmate:

Thanks @ichts. I read the new commit b8be764b ("apply CI fixes"). It changes only tests: it adds the fm-task-proc-lib.sh symlink to the gotmp fixture and a bounded TERM-then-KILL wait in the public-followup cleanup. Nothing in it is a CI or security concern, so I approved the fork runs for this head (39515316867 CI, 39515316923 Require no-mistakes).

This is still waiting on you for the three things from my last comment:

1. Split or redescribe. The title and body still say record-only retire, with host-janitor and process attribution out of scope. The branch still ships fm-host-janitor.sh, fm-host-load-check.sh, fm-task-proc-lib.sh, and the default teardown reap. You can split them into two PRs, or update the title and body so they cover everything.
2. Live evidence. Please re-raise through git push no-mistakes with live validation, or post the live runs I described. On the last head, "PR must be raised via no-mistakes" failed because the body has no pipeline attestation.
3. Overlap with fix(teardown): reap only processes owned by the task's endpoint shell #7566, which changes the same teardown reap area.

Contract class is still new-default because of the default teardown reap. Once the above is done and CI is green, that part goes to Kun for a merge-or-leave decision.

[kunchenguid]

Speaking as Kun's firstmate: thanks @ichts for the new push.

I read commit 4bf00c8b ("apply CI fixes"). It only touches tests: it passes the existing --herdr-resume-lock-wait flag to the two concurrent-recovery spawns in tests/fm-backend-herdr-presentation-e2e.test.sh. That raises no CI or security concern, so I approved the fork runs for this head: CI 39537791338 and Require no-mistakes 39537791301. On the previous head (b8be764b), CI failed on Behavior tests (Herdr), which this commit appears to target. Serial 2 was cancelled at the 30-minute ceiling, which is our known flake (#7255) and not yours.

This is still waiting on you for the same three things as before:

1. Split or redescribe. The title and body still describe a record-only retire with the host janitor out of scope. The branch still ships fm-host-janitor.sh, fm-host-load-check.sh, fm-task-proc-lib.sh and the default teardown reap.
2. Live evidence. Please re-raise through git push no-mistakes with live validation. The body still has no pipeline attestation, so "PR must be raised via no-mistakes" will fail again.
3. Overlap with fix(teardown): reap only processes owned by the task's endpoint shell #7566 in the teardown reap area.

Contract class (my own read): still new-default, because every unconfigured teardown now TERMs and then KILLs task-identity processes and shuts down task-only Simulators. Once the three items are done and CI is green, that part goes to Kun as a merge-or-leave decision.

[ichts]

Opened against the wrong repository by mistake; closing. Sorry for the noise.