From 4ee51a3a2368be1355d2a45239f5297fd2d6ae0c Mon Sep 17 00:00:00 2001
From: garrytan <garrytan@gmail.com>
Date: Thu, 29 Oct 2026 22:04:21 +0000
Subject: [PATCH] =?UTF-8?q?fix(ubicloud):=20no=20zombie=20VMs=20=E2=80=94?=
 =?UTF-8?q?=20owner=20required,=203h=20TTL,=20legacy=20sweep,=20UBICLOUD?=
 =?UTF-8?q?=20left=20line=20(GST-118)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
---
 docs/TESTING_INTERNALS.md            |  25 ++++---
 docs/pregate.md                      |   3 +-
 docs/skills.md                       |  13 ++--
 scripts/ubicloud/pregate-remote.sh   |   9 ++-
 scripts/ubicloud/ubi-runner.sh       | 105 +++++++++++++++++++--------
 test/ubicloud-pregate-remote.test.ts |  38 ++++++++--
 test/ubicloud-runner.test.ts         |  89 +++++++++++++++++++----
 ubicloud/SKILL.md                    |  20 +++--
 ubicloud/SKILL.md.tmpl               |  20 +++--
 9 files changed, 240 insertions(+), 82 deletions(-)

diff --git a/docs/TESTING_INTERNALS.md b/docs/TESTING_INTERNALS.md
index 2a7c30633..2f196ca8d 100644
--- a/docs/TESTING_INTERNALS.md
+++ b/docs/TESTING_INTERNALS.md
@@ -979,28 +979,31 @@ namespaces Chromium's sandbox needs, and `python3-venv` is absent (required by
 the Python runner tests).
 
 VMs are named `ubirun-<owner>-<epoch>-<hex>`, plus a `-t<hours>` TTL suffix
-(below); `<owner>` is `UBI_OWNER` (set it to the thread id on a Capy machine;
-lowercase letters and digits, at most 12), else a stable per-machine id. Every exit
+(below); `<owner>` is `UBI_OWNER` (the thread id on a Capy machine; lowercase
+letters and digits, at most 12), which `up`, `run` and `verify` require. Every exit
 path destroys the client's own VM (`trap` on EXIT, INT, TERM, HUP and QUIT), and
 `down` fails loudly (`FAILED to destroy <location>/<name> (HTTP <code>)`) unless
 the VM is confirmed gone. `list --mine` shows this owner's VMs, `usage` the
 project's, and `records` the VM-id scratch file (`UBI_VM_RECORD`, default
 `~/.capy/work/ubi-runner/vms.tsv`, else `<state root>/vms.tsv`): every VM is
 recorded there before the create call and forgotten only after a confirmed
-destroy, so a killed runner leaves a name to clean up. No age-based sweep runs
-by default, because the project quota is shared with other agents' runners (the
-TTL reaper below destroys only a VM whose own `-t<hours>` TTL has ended); set
+destroy, so a killed runner leaves a name to clean up. `run` and `verify` end
+with `UBICLOUD: left=<0|1|unknown> owner=<o> vm=<name> others=<n>`, checked
+against the project's VM list after teardown; anything but `left=0` turns a
+passing command into exit 1. No owner-age sweep runs by default (the TTL reaper
+below covers every owner); set
 `UBI_GC_HOURS` to a positive number (or run `gc HOURS`; `gc 0` is a no-op) to
 sweep only this owner's VMs older than that. For other commands, use the runner
 directly: `scripts/ubicloud/ubi-runner.sh run --setup <script> -- '<command>'`,
 or its `up` / `ssh` / `sync` / `pull` / `down` steps (`--help` lists them).
 
 The runner is also the `/ubicloud` skill's engine (`bin/gstack-ubi` execs it).
-A generated name ends in `-t<hours>` (`UBI_TTL_HOURS`, default 4; 0 omits it),
-the creator's own statement of how long the VM may live: `reap` destroys every
-VM in the project whose TTL ended more than ten minutes ago, whichever owner
-made it, and every `up` runs it first (`UBI_REAP=0` skips it); names without a
-TTL, such as the ones pregate-remote.sh builds itself, are never reaped. The
+A generated name ends in `-t<hours>` (`UBI_TTL_HOURS`, 1-999, default 3; pregate-remote.sh
+uses `-t1`), the creator's own statement of how long the VM may live: `reap`
+destroys every VM in the project whose TTL ended more than ten minutes ago,
+whichever owner made it, and every `ubirun-*` name without a TTL (older runner
+copies) once it is `UBI_LEGACY_HOURS` old (default 4); every `up` runs it
+first (`UBI_REAP=0` skips it). Names outside the `ubirun-` prefix are never reaped. The
 quota preflight adds the size's vCPUs to the project's running VMs and refuses
 before the create request when that exceeds the known ceiling
 (`UBI_QUOTA_VCPUS`, or the maximum the last refusal printed, remembered in the
@@ -1036,7 +1039,7 @@ machine swap, in this order:
    one side local and the other remote.
 4. Profiling very large imports (a whole-repo ingest, the full free suite under
    a profiler) is warned about before it starts: it holds the VM for hours, and
-   any other lane's `up` reaps it once its TTL (`UBI_TTL_HOURS`, default 4)
+   any other lane's `up` reaps it once its TTL (`UBI_TTL_HOURS`, default 3)
    plus ten minutes has passed, so set `UBI_TTL_HOURS` above the expected
    duration and name that duration in the thread before launching.
 
diff --git a/docs/pregate.md b/docs/pregate.md
index 09a7ee76c..fe047b2b1 100644
--- a/docs/pregate.md
+++ b/docs/pregate.md
@@ -569,7 +569,8 @@ Every refusal line starts with a reason code:
 | `PREGATE_REMOTE_CAP_TOO_LOW` | 5 | the cap cannot buy a 20-minute run at the size's price; nothing created |
 | `PREGATE_REMOTE_NO_PRICE` | 5 | `UBI_SIZE` has no list price in the script |
 | `PREGATE_REMOTE_TIMEOUT_TOO_SHORT` | 5 | pregate's deadline leaves the VM under 300 s after the 135 s teardown reserve; nothing created |
-| `PREGATE_REMOTE_INFRA` | 4 | create, setup, SSH or the stop deadline failed; the VM, its teardown line and `spent=` follow |
+| `PREGATE_REMOTE_OWNER_REQUIRED` | 2 | `UBI_OWNER` is unset; nothing created (every VM must name its owner) |
+| `PREGATE_REMOTE_INFRA` | 4 | create, setup, SSH or the stop deadline failed, or the runner's `UBICLOUD: left=` line is not `0`; the VM, its teardown line and `spent=` follow |
 | `PREGATE_REMOTE_INTERRUPTED` | 130 | TERM or INT; ubi-runner tears the VM down on its own |
 
 <a id="guards"></a>
diff --git a/docs/skills.md b/docs/skills.md
index 348777519..739408308 100644
--- a/docs/skills.md
+++ b/docs/skills.md
@@ -989,8 +989,10 @@ A suite that takes an hour on a 4-core sandbox takes minutes on a `standard-16`
 VM. `/ubicloud` runs it there through one entry point, `bin/gstack-ubi`
 (`scripts/ubicloud/ubi-runner.sh`), with the discipline a shared quota needs:
 every VM is named `ubirun-<owner>-<epoch>-<suffix>-t<hours>`, so its owner
-(`UBI_OWNER`) and TTL (`UBI_TTL_HOURS`, default 4) are visible to everyone;
-every `up` first reaps VMs whose TTL ended, whichever owner made them; the
+(`UBI_OWNER`, required to create one) and TTL (`UBI_TTL_HOURS`, default 3) are
+visible to everyone; every `up` first reaps VMs whose TTL ended, whichever owner
+made them, and `ubirun-*` VMs with no TTL once they are 4 hours old; every run
+ends with `UBICLOUD: left=0` or fails; the
 quota preflight refuses before the create request when the project's running
 VMs plus the new size exceed the known ceiling (`UBI_QUOTA_VCPUS`, or the
 maximum the last refusal printed; `UBI_QUOTA_WAIT` waits for room instead); a
@@ -1011,11 +1013,12 @@ You:   /ubicloud run the full verify
 Claude: UBICLOUD_API_KEY: set; UBI_OWNER=lane7
         gstack-ubi verify  (.gstack/ubicloud.json: bootstrap.sh, "bash scripts/verify.sh", standard-16)
         ubi-runner: reap: no expired VMs
-        ubi-runner: creating eu-central-h1/ubirun-lane7-1761500000-9f3a2c10-t4 (standard-16)
-        ubi-runner: ubirun-lane7-1761500000-9f3a2c10-t4 carries a 4h TTL (any later run of this script reaps it); if this process dies first: gstack-ubi down ubirun-lane7-1761500000-9f3a2c10-t4
+        ubi-runner: creating eu-central-h1/ubirun-lane7-1761500000-9f3a2c10-t3 (standard-16)
+        ubi-runner: ubirun-lane7-1761500000-9f3a2c10-t3 carries a 3h TTL (any later run of this script reaps it); if this process dies first: gstack-ubi down ubirun-lane7-1761500000-9f3a2c10-t3
         ubi-runner: heartbeat: command 300s elapsed, last output 2s ago
         ubi-runner: command exited 0 after 1140s
-        ubi-runner: destroyed eu-central-h1/ubirun-lane7-1761500000-9f3a2c10-t4
+        ubi-runner: destroyed eu-central-h1/ubirun-lane7-1761500000-9f3a2c10-t3
+        UBICLOUD: left=0 owner=lane7 vm=ubirun-lane7-1761500000-9f3a2c10-t3 others=0
 ```
 
 ---
diff --git a/scripts/ubicloud/pregate-remote.sh b/scripts/ubicloud/pregate-remote.sh
index f7247f4d8..8e153684f 100755
--- a/scripts/ubicloud/pregate-remote.sh
+++ b/scripts/ubicloud/pregate-remote.sh
@@ -102,6 +102,7 @@ if [ -z "${UBICLOUD_API_KEY:-${UBICLOUD_API_TOKEN:-}}" ]; then
   exit "$rc"
 fi
 
+[ -n "${UBI_OWNER:-}" ] || stop 2 PREGATE_REMOTE_OWNER_REQUIRED "UBI_OWNER is not set: every VM must carry its owner" "nothing created, nothing spent" "rerun with UBI_OWNER=<your thread code>: $rerun"
 size=${UBI_SIZE:-standard-16}
 case $size in
   standard-2) ppm=0.00104 ;; standard-4) ppm=0.00208 ;; standard-8) ppm=0.00416 ;;
@@ -217,7 +218,7 @@ while :; do
   : >"$stream"
   rm -f "$log.pid" "$log.timedout"
   t0=$(date +%s)
-  vm_name="ubirun-$(bash "$here/ubi-runner.sh" owner)-$(date +%s)-$(head -c4 /dev/urandom | od -An -tx1 | tr -d ' \n')"
+  vm_name="ubirun-$(bash "$here/ubi-runner.sh" owner)-$(date +%s)-$(head -c4 /dev/urandom | od -An -tx1 | tr -d ' \n')-t1"
   say "VM $vm_name; if this run is killed before its teardown line, destroy it with: bash scripts/ubicloud/ubi-runner.sh down $vm_name"
   python3 -c 'import os, sys; os.setsid(); os.execvp(sys.argv[1], sys.argv[1:])' \
     bash -c "$vm_session" pregate-remote-vm "$stop_after" "$log" "$stream" "$here/ubi-runner.sh" "${args[@]}" -n "$vm_name" &
@@ -253,6 +254,12 @@ span() { if [ -n "$1" ] && [ -n "$2" ]; then echo "$(( $2 - $1 ))s"; else echo "
 say "phases: create $(span "$t0" "$t_ready"), setup $(span "$t_setup" "$t_run"), run $(span "$t_run" "$t_exit"), teardown $(span "$t_exit" "$t_end"); total $(( t_end - started ))s (target 600s)"
 say "log: $log"
 
+left=$(sed -n 's/^[0-9]* UBICLOUD: left=\([^ ]*\) .*/\1/p' "$log" | tail -1)
+if [ "$left" != 0 ]; then
+  stop 4 PREGATE_REMOTE_INFRA "VM cleanup not confirmed (UBICLOUD: left=${left:-missing}); no result reported" \
+    "VM: $vm_name; destroy it with: bash scripts/ubicloud/ubi-runner.sh down $vm_name" "log: $log" "spent=$spent ($billed billed min on $size)"
+fi
+
 vm_tree=$(sed -n 's/^[0-9]* PREGATE_VM_TREE \([0-9a-f]*\)$/\1/p' "$log" | tail -1)
 mismatch=$(grep -m1 -oE 'PREGATE_VM_(TREE|PLAN)_MISMATCH .*' "$log" || true)
 if [ -n "$mismatch" ]; then
diff --git a/scripts/ubicloud/ubi-runner.sh b/scripts/ubicloud/ubi-runner.sh
index ce71e52bd..2b2a0a498 100755
--- a/scripts/ubicloud/ubi-runner.sh
+++ b/scripts/ubicloud/ubi-runner.sh
@@ -23,10 +23,12 @@
 # Needs only bash, curl, python3, ssh, ssh-keygen, and tar locally, so it works
 # from dev boxes, containers, and cloud sandboxes.
 #
-# Ownership: VMs are named ubirun-<owner>-<epoch>-<suffix>[-t<hours>]. <owner> is UBI_OWNER
+# Ownership: VMs are named ubirun-<owner>-<epoch>-<suffix>-t<hours>. <owner> is UBI_OWNER
 # (lowercased, letters and digits only, at most 12 characters, starting with a
-# letter) or a random per-machine id kept in $STATE_ROOT/owner-id. Ubicloud names
-# allow 63 characters of [a-z0-9-], so a full name stays under 40.
+# letter). `up`, `run` and `verify` refuse without it (UBI_OWNER_REQUIRED), so
+# every VM names whoever can be asked about it; read-only commands fall back to a
+# per-machine id kept in $STATE_ROOT/owner-id. Ubicloud names allow 63 characters
+# of [a-z0-9-], so a full name stays under 45.
 #
 # Teardown: `up` records each VM's state (location, create status) before it
 # sends the create request, and `down` destroys and polls until the VM is
@@ -40,11 +42,19 @@
 # runs the same sweep on demand. Neither ever touches another owner's VMs.
 #
 # TTL and reaper: a name this script generates ends in -t<hours> (UBI_TTL_HOURS,
-# default 4; 0 omits it), the creator's own declaration of how long the VM may
-# live. `reap` destroys every VM in the project whose TTL expired more than ten
-# minutes ago, whichever owner made it, and every `up` runs it first (UBI_REAP=0
-# skips it), so a runner killed by a sleeping machine leaves nothing behind for
-# longer than its TTL. Names without a TTL are never reaped.
+# 1-999, default 3), the creator's own declaration of how long the VM may live.
+# `reap` destroys every VM in the project whose TTL expired more than ten
+# minutes ago, whichever owner made it, and every ubirun-* name with no TTL
+# (older runner copies, hand-built names) once it is UBI_LEGACY_HOURS old
+# (default 4); every `up` runs it first (UBI_REAP=0 skips it), so a runner
+# killed by a sleeping machine leaves nothing behind for longer than its TTL.
+# Names outside the ubirun- prefix are never reaped.
+#
+# Leftover line: `run` and `verify` end with
+#   UBICLOUD: left=<0|1|unknown> owner=<owner> vm=<name> others=<n>
+# after teardown: left counts this invocation's own VM, checked against the
+# project's VM list, and others counts this owner's other VMs (information only).
+# A left other than 0 turns a passing command into exit 1.
 #
 # Quota preflight: when the project's vCPU ceiling is known (UBI_QUOTA_VCPUS, or
 # the maximum a refusal printed, cached in $STATE_ROOT/quota-max), `up` adds the
@@ -75,7 +85,8 @@ CREATE_GRACE="${UBI_CREATE_GRACE:-180}"
 DOWN_TIMEOUT="${UBI_DOWN_TIMEOUT:-900}"
 POLL="${UBI_POLL_SECONDS:-5}"
 ALLOWED_STORAGE="${UBI_ALLOWED_STORAGE:-320 640}"
-TTL_HOURS="${UBI_TTL_HOURS:-4}"
+TTL_HOURS="${UBI_TTL_HOURS:-3}"
+LEGACY_HOURS="${UBI_LEGACY_HOURS:-4}"
 REAP="${UBI_REAP:-1}"
 REAP_GRACE=600
 IDLE_TIMEOUT="${UBI_IDLE_TIMEOUT:-1800}"
@@ -96,7 +107,8 @@ for bin in curl python3 ssh ssh-keygen tar; do
 done
 UBICLOUD_API_KEY="${UBICLOUD_API_KEY:-${UBICLOUD_API_TOKEN:-}}"
 [[ "$GC_HOURS" =~ ^[0-9]+$ ]] || die "UBI_GC_HOURS must be a whole number of hours (unset or 0 disables the sweep)"
-[[ "$TTL_HOURS" =~ ^(0|[1-9][0-9]{0,2})$ ]] || die "UBI_TTL_HOURS must be a whole number of hours from 0 to 999 with no leading zero (0 names VMs without a TTL)"
+[[ "$TTL_HOURS" =~ ^[1-9][0-9]{0,2}$ ]] || die "UBI_TTL_HOURS must be a whole number of hours from 1 to 999 with no leading zero (every VM carries a TTL; set it above your longest run)"
+[[ "$LEGACY_HOURS" =~ ^[1-9][0-9]{0,3}$ ]] || die "UBI_LEGACY_HOURS must be a whole number of hours from 1 to 9999 with no leading zero (how old a TTL-less ubirun-* VM must be before reap destroys it)"
 for v in IDLE_TIMEOUT RUN_TIMEOUT HEARTBEAT QUOTA_WAIT; do
   [[ "${!v}" =~ ^[0-9]+$ ]] || die "UBI_$v must be a whole number of seconds (0 disables it)"
 done
@@ -121,6 +133,11 @@ owner_id() {
 }
 OWNER=$(owner_id)
 
+# require_owner: up, run and verify create VMs, and a VM must name its owner.
+require_owner() {
+  [ -n "${UBI_OWNER:-}" ] || die "UBI_OWNER is not set: every VM must carry its owner; export UBI_OWNER=<your thread or session code> (for example gsta164) and rerun (UBI_OWNER_REQUIRED)"
+}
+
 # api OUT ARGS...: send one Ubicloud CLI command, write the body to OUT, and
 # print the HTTP status (000 when no response arrived).
 api() {
@@ -269,9 +286,10 @@ watched() {
   return "$rc"
 }
 
-# vm_rows: "location name owner expires" for every VM in the project; owner is
-# "-" for untagged ubirun-<epoch>-* names and "." for VMs this runner did not
-# name; expires is the epoch the name's -t<hours> TTL ends at, or "-".
+# vm_rows: "location name owner expires created" for every VM in the project;
+# owner is "-" for untagged ubirun-<epoch>-* names and "." for VMs this runner
+# did not name; expires is the epoch the name's -t<hours> TTL ends at, or "-";
+# created is the name's epoch, or "-".
 vm_rows() {
   local loc name owner created expires
   cli vm list -N -f location,name | while read -r loc name; do
@@ -284,23 +302,29 @@ vm_rows() {
     if [ -n "$created" ] && [[ "$name" =~ -t([0-9]{1,3})$ ]]; then
       expires=$(( 10#$created + 10#${BASH_REMATCH[1]} * 3600 ))
     fi
-    echo "$loc $name $owner $expires"
+    echo "$loc $name $owner $expires ${created:--}"
   done
 }
 
 # reap: destroy every VM whose name carries a TTL that ended more than
 # REAP_GRACE seconds ago, whichever owner created it (the TTL is that owner's
-# own declaration). Names without a TTL are never touched.
+# own declaration), and every TTL-less ubirun-* name at least LEGACY_HOURS old
+# (nobody declared a lifetime for it). Names outside the prefix are never touched.
 cmd_reap() {
-  local now rows loc name owner expires n=0 failed=0
+  local now rows loc name owner expires created n=0 failed=0
   now=$(date +%s)
   rows=$(vm_rows) || { log "reap: could not list the project's VMs; nothing destroyed"; return 1; }
-  while read -r loc name owner expires; do
+  while read -r loc name owner expires created; do
     [ -n "$name" ] || continue
-    [ "$expires" != - ] || continue
-    [ "$now" -ge $(( expires + REAP_GRACE )) ] || continue
+    if [ "$expires" != - ]; then
+      [ "$now" -ge $(( expires + REAP_GRACE )) ] || continue
+      log "reaping expired $loc/$name (owner $owner; its TTL ended $(( (now - expires) / 60 )) min ago)"
+    else
+      [ "$owner" != . ] && [ "$created" != - ] || continue
+      [ $(( now - 10#$created )) -ge $(( LEGACY_HOURS * 3600 )) ] || continue
+      log "reaping TTL-less $loc/$name (owner $owner; $(( (now - 10#$created) / 3600 ))h old, legacy sweep at ${LEGACY_HOURS}h)"
+    fi
     n=$(( n + 1 ))
-    log "reaping expired $loc/$name (owner $owner; its TTL ended $(( (now - expires) / 60 )) min ago)"
     cmd_down "$name" -l "$loc" || { failed=$(( failed + 1 )); log "failed to reap $loc/$name"; }
   done <<<"$rows"
   [ "$n" -gt 0 ] || log "reap: no expired VMs"
@@ -379,9 +403,7 @@ cmd_records() {
 }
 
 new_name() {
-  local ttl=""
-  [ "$TTL_HOURS" -eq 0 ] || ttl="-t$TTL_HOURS"
-  echo "$PREFIX-$OWNER-$(date +%s)-$(head -c4 /dev/urandom | od -An -tx1 | tr -d ' \n')$ttl"
+  echo "$PREFIX-$OWNER-$(date +%s)-$(head -c4 /dev/urandom | od -An -tx1 | tr -d ' \n')-t$TTL_HOURS"
 }
 
 # vcpus SIZE: the vCPU count a Ubicloud size name carries (standard-16 -> 16).
@@ -438,6 +460,7 @@ check_storage() {
 UP_NAME=""
 UP_READY=""
 cmd_up() {
+  require_owner
   local size=$DEFAULT_SIZE location=$DEFAULT_LOCATION name="" storage="" image=ubuntu-noble
   while [ $# -gt 0 ]; do
     case $1 in
@@ -715,7 +738,28 @@ inside_dir() {
 # PULL_ROOT: set by verify; every pull destination must resolve inside it at
 # pull time (an earlier pull may have placed a symlink where a later one lands).
 PULL_ROOT=""
+
+# run_teardown RC: run's EXIT handler. Destroys RUN_VM, ignoring further
+# signals, then checks the project's VM list for it and prints the leftover
+# line; a VM still listed, or a list that cannot be read, fails the run.
+run_teardown() {
+  local rc=$1 rows left others
+  trap "" INT TERM HUP QUIT
+  cmd_down "$RUN_VM" || log "WARNING: failed to destroy $RUN_VM; run: $0 down $RUN_VM"
+  if rows=$(vm_rows 2>/dev/null); then
+    left=$(awk -v n="$RUN_VM" '$2==n' <<<"$rows" | grep -c . || true)
+    others=$(awk -v n="$RUN_VM" -v o="$OWNER" '$3==o && $2!=n' <<<"$rows" | grep -c . || true)
+  else
+    left=unknown others=unknown
+  fi
+  echo "UBICLOUD: left=$left owner=$OWNER vm=$RUN_VM others=$others" >&2
+  [ "$left" = 0 ] && return 0
+  log "VM cleanup not confirmed for $RUN_VM (left=$left); destroy it with: $0 down $RUN_VM"
+  [ "$rc" -ne 0 ] || exit 1
+}
+
 cmd_run() {
+  require_owner
   local up_args=() src=. dest="" setup="" keep=0 pulls=() envs=()
   while [ $# -gt 0 ]; do
     case $1 in
@@ -745,16 +789,17 @@ cmd_run() {
   RUN_VM=$name
   # Armed before the create request: an interrupted `up` still destroys its VM.
   # A second signal must not cut teardown short, so the EXIT handler ignores them.
-  trap 'trap "" INT TERM HUP QUIT; cmd_down "$RUN_VM" || log "WARNING: failed to destroy $RUN_VM; run: $0 down $RUN_VM"' EXIT
+  trap 'run_teardown "$?"' EXIT
   trap 'exit 130' INT TERM HUP QUIT
   cmd_up "${up_args[@]}" >/dev/null
   if [[ "$name" =~ -t([0-9]+)$ ]]; then
     log "$name carries a ${BASH_REMATCH[1]}h TTL (any later run of this script reaps it); if this process dies first: $0 down $name"
   else
-    log "$name has no TTL; if this process dies before its teardown line, destroy it with: $0 down $name"
+    log "$name has no TTL (reap destroys it once it is ${LEGACY_HOURS}h old); if this process dies before its teardown line, destroy it with: $0 down $name"
   fi
   if [ "$keep" = 1 ]; then
     trap - EXIT
+    echo "UBICLOUD: left=1 owner=$OWNER vm=$name kept=1" >&2
     log "--keep: leaving $name running; destroy with: $0 down $name"
   fi
 
@@ -902,13 +947,15 @@ usage: ubi-runner.sh <command> [args]
   owner                  print this caller's owner tag ($OWNER)
   records                VMs this machine created and has not confirmed gone ($VM_RECORD)
   gc HOURS               destroy this owner's VMs older than HOURS (never other owners')
-  reap                   destroy every VM whose -t<hours> TTL has ended (any owner; TTL-less names never)
+  reap                   destroy every VM whose -t<hours> TTL has ended (any owner) and every
+                         TTL-less ubirun-* VM older than UBI_LEGACY_HOURS
   cli ARGS...            raw Ubicloud CLI passthrough (e.g. cli vm list)
 
-VMs are named $PREFIX-<owner>-<epoch>-<suffix>-t<ttl hours>; set UBI_OWNER (e.g. your
-thread code) to tag them, otherwise a per-machine id is used.
+VMs are named $PREFIX-<owner>-<epoch>-<suffix>-t<ttl hours>; up, run and verify need
+UBI_OWNER (e.g. your thread code); run and verify end with a UBICLOUD: left=<n> line.
 defaults: size=$DEFAULT_SIZE location=$DEFAULT_LOCATION (env UBI_SIZE, UBI_LOCATION)
-env: UBI_TTL_HOURS (${TTL_HOURS}h in the name; 0 omits it), UBI_REAP (0: up skips the reap),
+env: UBI_TTL_HOURS (${TTL_HOURS}h in the name, 1-999), UBI_REAP (0: up skips the reap),
+     UBI_LEGACY_HOURS (${LEGACY_HOURS}h: reap's bound for TTL-less ubirun-* names),
      UBI_IDLE_TIMEOUT (${IDLE_TIMEOUT}s of silence kills the remote command, exit 124; 0 disables),
      UBI_RUN_TIMEOUT (${RUN_TIMEOUT}s wall clock; 0 unlimited), UBI_HEARTBEAT (${HEARTBEAT}s between heartbeat lines),
      UBI_QUOTA_VCPUS (project vCPU ceiling for the preflight; else the last refusal's maximum),
diff --git a/test/ubicloud-pregate-remote.test.ts b/test/ubicloud-pregate-remote.test.ts
index 3c51d1ef5..1f253f010 100644
--- a/test/ubicloud-pregate-remote.test.ts
+++ b/test/ubicloud-pregate-remote.test.ts
@@ -40,6 +40,7 @@ const UBI_RUNNER_STUB = `#!/usr/bin/env bash
 # Every teardown is appended to $STUB_CALLS.down.
 set -uo pipefail
 [ "$1" != owner ] || { echo stub; exit 0; }
+left() { echo "UBICLOUD: left=\${STUB_LEFT:-0} owner=stub vm=$name others=0" >&2; }
 [ "$1" = run ] || exit 2
 shift
 printf '%s\\n' "$*" >>"$STUB_CALLS"
@@ -65,16 +66,18 @@ if [ "$fail" = quota ] || { [ "$fail" = quota-once ] && [ "$calls" -eq 1 ]; }; t
   log "quota refused eu-central-h1/$name ($size): it needs 16 vCPUs and the project already uses 64 of 64"
   log "create failed: vCPU quota exhausted; wait for running VMs to finish, or use fewer or smaller VMs (ci:ubicloud --vms N)"
   log "gone: eu-central-h1/$name (never existed or already destroyed)"
+  left
   exit 1
 fi
 if [ "$fail" = create ]; then
   echo "Validation failed for following fields: size" >&2
   log "create failed"
   log "gone: eu-central-h1/$name (never existed or already destroyed)"
+  left
   exit 1
 fi
 log "ready: $name (192.0.2.1)"
-trap 'log "destroyed eu-central-h1/$name"; echo "term $name" >>"$STUB_CALLS.down"; exit 130' TERM
+trap 'log "destroyed eu-central-h1/$name"; left; echo "term $name" >>"$STUB_CALLS.down"; exit 130' TERM
 vm=$STUB_VM_HOME
 dest="$vm/work/$(basename "$src")"
 rm -rf "$dest" && mkdir -p "$dest"
@@ -88,6 +91,7 @@ if [ -n "$setup" ]; then
   if ! (cd "$dest" && HOME="$vm" bash -c '. ~/.ubirun-env && bash ~/.ubirun-setup.sh'); then
     log "setup failed"
     log "destroyed eu-central-h1/$name"
+    left
     exit 1
   fi
 fi
@@ -102,6 +106,7 @@ else
 fi
 log "command exited $rc after 1s"
 log "destroyed eu-central-h1/$name"
+left
 echo "exit $name" >>"$STUB_CALLS.down"
 exit "$rc"
 `;
@@ -150,7 +155,7 @@ function gate(f: Fixture, files: string[] | null, env: Record<string, string | u
   const out = r.stdout.toString() + r.stderr.toString();
   return { exit: r.exitCode, out, report: parseRemoteReport(out), calls: fs.existsSync(f.calls) ? fs.readFileSync(f.calls, 'utf8').trim().split('\n') : [] };
 }
-const KEY = { UBICLOUD_API_KEY: 'offline-stub' };
+const KEY = { UBICLOUD_API_KEY: 'offline-stub', UBI_OWNER: 'stub' };
 
 describe('pregate-remote.sh inputs and the local tree check', () => {
   test('run bare it exits 2 before any work, naming the pregate command', () => {
@@ -208,6 +213,25 @@ describe('pregate-remote.sh keyed path (stub ubi-runner)', () => {
     expect(remoteReportProblem(empty.report!, empty.report!.tree)).toBe('the remote gate reported 0 tests');
   }, 90_000);
 
+  test('a passing run whose VM is not confirmed gone, or whose runner printed no leftover line, is PREGATE_REMOTE_INFRA, never a test result', () => {
+    for (const [stubLeft, shown] of [['1', 'left=1'], ['unknown', 'left=unknown']] as const) {
+      const r = gate(fixture(), ['test/alpha.test.ts'], { ...KEY, STUB_LEFT: stubLeft });
+      expect(r.exit, r.out).toBe(4);
+      expect(r.out).toContain(`PREGATE_REMOTE_INFRA: VM cleanup not confirmed (UBICLOUD: ${shown}); no result reported`);
+      expect(r.out).toMatch(/VM: (ubirun-stub-\d+-[0-9a-f]{8}-t1); destroy it with: bash scripts\/ubicloud\/ubi-runner\.sh down \1/);
+      expect(r.report).toBeNull();
+    }
+  }, 90_000);
+
+  test('without UBI_OWNER the keyed path refuses with exit 2 before any VM is created', () => {
+    const f = fixture();
+    const r = gate(f, ['test/alpha.test.ts'], { ...KEY, UBI_OWNER: '' });
+    expect(r.exit, r.out).toBe(2);
+    expect(r.out).toContain('PREGATE_REMOTE_OWNER_REQUIRED: UBI_OWNER is not set: every VM must carry its owner');
+    expect(r.out).toContain('nothing created, nothing spent');
+    expect(fs.existsSync(f.calls)).toBe(false);
+  }, 60_000);
+
   test('the cap refuses before any VM is created, at the price of the size actually used', () => {
     const f = fixture();
     const low = gate(f, ['test/alpha.test.ts'], { ...KEY, PREGATE_SPEND_CAP_USD: '0.1' });
@@ -231,14 +255,14 @@ describe('pregate-remote.sh keyed path (stub ubi-runner)', () => {
     const create = gate(fixture(), ['test/alpha.test.ts'], { ...KEY, STUB_FAIL: 'create' });
     expect(create.exit, create.out).toBe(4);
     expect(create.out).toContain('PREGATE_REMOTE_INFRA: infrastructure failure (ubi-runner exit 1): ubi-runner: create failed');
-    expect(create.out).toMatch(/VM: eu-central-h1\/(ubirun-stub-\d+-[0-9a-f]{8}); ubi-runner: gone: eu-central-h1\/\1 \(never existed or already destroyed\)/);
-    expect(create.out).toMatch(/VM (ubirun-stub-\d+-[0-9a-f]{8}); if this run is killed before its teardown line, destroy it with: bash scripts\/ubicloud\/ubi-runner\.sh down \1\n/);
+    expect(create.out).toMatch(/VM: eu-central-h1\/(ubirun-stub-\d+-[0-9a-f]{8}-t1); ubi-runner: gone: eu-central-h1\/\1 \(never existed or already destroyed\)/);
+    expect(create.out).toMatch(/VM (ubirun-stub-\d+-[0-9a-f]{8}-t1); if this run is killed before its teardown line, destroy it with: bash scripts\/ubicloud\/ubi-runner\.sh down \1\n/);
     expect(create.out).toMatch(/log: \S+\/\.context\/pregate-remote\/\S+\/run\.log/);
     expect(create.out).toContain('spent=0.00 (0 billed min on standard-16)');
     const setup = gate(fixture(), ['test/alpha.test.ts'], { ...KEY, STUB_SETUP_FAIL: '1' });
     expect(setup.exit, setup.out).toBe(4);
     expect(setup.out).toContain('ubi-runner: setup failed');
-    expect(setup.out).toMatch(/; ubi-runner: destroyed eu-central-h1\/ubirun-stub-\d+-[0-9a-f]{8}/);
+    expect(setup.out).toMatch(/; ubi-runner: destroyed eu-central-h1\/ubirun-stub-\d+-[0-9a-f]{8}-t1/);
     expect(setup.out).toContain('spent=0.01 (1 billed min on standard-16)');
     const ssh = gate(fixture(), ['test/alpha.test.ts'], { ...KEY, STUB_FAIL: 'ssh' });
     expect(ssh.exit, ssh.out).toBe(4);
@@ -293,7 +317,7 @@ describe('pregate-remote.sh keyed path (stub ubi-runner)', () => {
     process.kill(-a.pid, 'SIGKILL');
     await a.exited;
     await until(() => down(killed).endsWith('\n'), 30_000);
-    expect(down(killed)).toMatch(/^exit ubirun-stub-\d+-[0-9a-f]{8}\n$/);
+    expect(down(killed)).toMatch(/^exit ubirun-stub-\d+-[0-9a-f]{8}-t1\n$/);
     const termed = fixture();
     const b = run(termed);
     await until(() => vmLog(termed).includes('ubi-runner: running on'), 30_000);
@@ -301,7 +325,7 @@ describe('pregate-remote.sh keyed path (stub ubi-runner)', () => {
     expect(await b.exited).toBe(130);
     expect(await new Response(b.stdout).text()).toContain('interrupted: ubi-runner is tearing the VM down on its own');
     await until(() => down(termed).endsWith('\n'), 10_000);
-    expect(down(termed)).toMatch(/^term ubirun-stub-\d+-[0-9a-f]{8}\n$/);
+    expect(down(termed)).toMatch(/^term ubirun-stub-\d+-[0-9a-f]{8}-t1\n$/);
     const edited = fixture();
     const c = run(edited);
     await until(() => vmLog(edited).includes('ubi-runner: running on'), 30_000);
diff --git a/test/ubicloud-runner.test.ts b/test/ubicloud-runner.test.ts
index bb6e66012..a99fa0b71 100644
--- a/test/ubicloud-runner.test.ts
+++ b/test/ubicloud-runner.test.ts
@@ -54,8 +54,10 @@ describe('ubicloud free-suite runner', () => {
     const runner = read('scripts/ubicloud/ubi-runner.sh');
     expect(runner).toContain('"umask 022; $*"');
     // Armed before the create request and shielded from a second signal (record-before-create teardown, plan E2).
-    expect(runner).toMatch(/trap 'trap "" INT TERM HUP QUIT; cmd_down "\$RUN_VM"[^']*' EXIT/);
-    expect(runner.indexOf("trap 'trap \"\" INT TERM HUP QUIT; cmd_down \"$RUN_VM\"")).toBeLessThan(runner.indexOf('cmd_up "${up_args[@]}" >/dev/null'));
+    expect(runner).toContain(`trap 'run_teardown "$?"' EXIT`);
+    expect(runner.indexOf(`trap 'run_teardown "$?"' EXIT`)).toBeLessThan(runner.indexOf('cmd_up "${up_args[@]}" >/dev/null'));
+    const teardown = runner.slice(runner.indexOf('run_teardown() {'), runner.indexOf('\n}\n', runner.indexOf('run_teardown() {')));
+    expect(teardown.indexOf('trap "" INT TERM HUP QUIT')).toBeLessThan(teardown.indexOf('cmd_down "$RUN_VM"'));
   });
 
   test('pull retrieves the retained free-test logs and skips a glob that matches nothing', () => {
@@ -210,7 +212,7 @@ esac
       expect(r.exitCode).toBe(1);
       const err = r.stderr.toString();
       expect(err).toMatch(/reaping expired eu-central-h1\/ubirun-other-1000000000-bbbb-t1 \(owner other; its TTL ended \d+ min ago\)/);
-      expect(err).toMatch(/quota preflight refused eu-central-h1\/ubirun-thrd1-\d{10}-[0-9a-f]{8}-t4 \(standard-16\): it needs 16 vCPUs and the project's VMs already use 16 of 31/);
+      expect(err).toMatch(/quota preflight refused eu-central-h1\/ubirun-thrd1-\d{10}-[0-9a-f]{8}-t3 \(standard-16\): it needs 16 vCPUs and the project's VMs already use 16 of 31/);
       expect(err).toContain('create refused before any request: vCPU quota exhausted');
       const destroyed = f.calls().split('\n').filter(l => l.includes('destroy'));
       expect(destroyed).toHaveLength(1);
@@ -220,23 +222,39 @@ esac
     } finally { rmSync(f.root, { recursive: true, force: true }); }
   });
 
-  test('UBI_REAP=0 skips the reap and UBI_TTL_HOURS=0 names the VM without a TTL; reap alone never touches unexpired or TTL-less names', () => {
-    const listed = 'eu-central-h1 ubirun-other-1000000000-bbbb-t1\neu-central-h1 ubirun-thrd1-9999999999-dddd-t1\neu-central-h1 ubirun-thrd1-1000000000-aaaa\neu-central-h1 ubirun-1000000000-cccc\n';
+  test('UBI_REAP=0 skips the reap and UBI_TTL_HOURS sets the name\'s TTL; reap destroys expired TTLs and old TTL-less ubirun names, never unexpired, recent or foreign ones', () => {
+    const now = Math.floor(Date.now() / 1000);
+    const listed = `eu-central-h1 ubirun-other-1000000000-bbbb-t1\neu-central-h1 ubirun-thrd1-9999999999-dddd-t1\neu-central-h1 ubirun-thrd1-1000000000-aaaa\neu-central-h1 ubirun-1000000000-cccc\neu-central-h1 ubirun-peer-${now - 3 * 3600}-eeee\neu-central-h1 team-db-1000000000-ffff\n`;
     const f = fakeApi({ destroy: 200, listed });
     try {
-      const up = Bun.spawnSync(['bash', join(DIR, 'ubi-runner.sh'), 'up'], { env: { ...process.env, PATH: `${join(f.root, 'bin')}:${process.env.PATH}`, UBICLOUD_API_KEY: 'offline', UBI_RUNNER_STATE: join(f.root, 'state'), UBI_POLL_SECONDS: '1', UBI_VM_RECORD: f.record, UBI_OWNER: 'thrd1', UBI_QUOTA_VCPUS: '64', UBI_REAP: '0', UBI_TTL_HOURS: '0' }, timeout: 90_000 });
+      const up = Bun.spawnSync(['bash', join(DIR, 'ubi-runner.sh'), 'up'], { env: { ...process.env, PATH: `${join(f.root, 'bin')}:${process.env.PATH}`, UBICLOUD_API_KEY: 'offline', UBI_RUNNER_STATE: join(f.root, 'state'), UBI_POLL_SECONDS: '1', UBI_VM_RECORD: f.record, UBI_OWNER: 'thrd1', UBI_QUOTA_VCPUS: '96', UBI_REAP: '0', UBI_TTL_HOURS: '7' }, timeout: 90_000 });
       expect(up.exitCode).toBe(1);
-      expect(up.stderr.toString()).toMatch(/quota preflight refused eu-central-h1\/ubirun-thrd1-\d{10}-[0-9a-f]{8} \(standard-16\): it needs 16 vCPUs and the project's VMs already use 64 of 64/);
+      expect(up.stderr.toString()).toMatch(/quota preflight refused eu-central-h1\/ubirun-thrd1-\d{10}-[0-9a-f]{8}-t7 \(standard-16\): it needs 16 vCPUs and the project's VMs already use 96 of 96/);
       expect(f.calls()).not.toContain('destroy');
       const reap = f.run('reap');
       expect(reap.exitCode).toBe(0);
-      const destroyed = f.calls().split('\n').filter(l => l.includes('destroy'));
-      expect(destroyed).toHaveLength(1);
-      expect(destroyed[0]).toContain('ubirun-other-1000000000-bbbb-t1');
+      expect(reap.stderr.toString()).toMatch(/reaping TTL-less eu-central-h1\/ubirun-thrd1-1000000000-aaaa \(owner thrd1; \d+h old, legacy sweep at 4h\)/);
+      const destroyed = f.calls().split('\n').filter(l => l.includes('destroy')).map(l => l.match(/ubirun-[a-z0-9-]+|team-db-[a-z0-9-]+/)?.[0]).sort();
+      expect(destroyed).toEqual(['ubirun-1000000000-cccc', 'ubirun-other-1000000000-bbbb-t1', 'ubirun-thrd1-1000000000-aaaa']);
       expect(f.run('reap').stderr.toString()).toContain('reap: no expired VMs');
     } finally { rmSync(f.root, { recursive: true, force: true }); }
   });
 
+  test('up and run refuse without UBI_OWNER before any API call; list, usage, reap and down still work without it', () => {
+    const f = fakeApi({ destroy: 200, listed: 'eu-central-h1 vm-a\n', owner: '' });
+    try {
+      for (const args of [['up'], ['run', '--', 'true']]) {
+        const r = f.run(...args);
+        expect(r.exitCode).toBe(1);
+        expect(r.stderr.toString()).toContain('UBI_OWNER is not set: every VM must carry its owner; export UBI_OWNER=<your thread or session code>');
+        expect(r.stderr.toString()).toContain('(UBI_OWNER_REQUIRED)');
+      }
+      expect(f.calls()).toBe('');
+      for (const args of [['list'], ['usage'], ['reap']]) expect(f.run(...args).exitCode).toBe(0);
+      expect(f.run('down', 'vm-a').exitCode).toBe(0);
+    } finally { rmSync(f.root, { recursive: true, force: true }); }
+  });
+
   test('the watchdog kills a silent remote command with exit 124 and the last output, and the heartbeat reports progress', () => {
     const f = fakeApi({ destroy: 200, listed: 'eu-central-h1 vm-a\n' });
     try {
@@ -381,8 +399,8 @@ describe('ubi-runner run, verify and quota against a fake API and a fake ssh', (
       'name=$(printf \'%s\' "$body" | sed -n \'s/.*"vm", *"[^/"]*\\/\\([^"]*\\)".*/\\1/p\')\n' +
       'case "$body" in\n' +
       '  *\'"create"\'*) if [ -n ' + JSON.stringify(opts.refuse ?? '') + ' ]; then printf \'%s\' ' + JSON.stringify(opts.refuse ?? '') + ' > "$out"; printf 400; else echo "$loc $name" >> "$listed"; : > "$out"; printf 200; fi ;;\n' +
-      '  *destroy*) : > "$out"; grep -v " $name$" "$listed" > "$listed.tmp"; mv "$listed.tmp" "$listed"; printf 200 ;;\n' +
-      '  *\'"list"\'*) cat "$listed" > "$out"; printf 200 ;;\n' +
+      '  *destroy*) : > "$out"; if [ -f "$listed.destroy-fails" ]; then printf 500; else grep -v " $name$" "$listed" > "$listed.tmp"; mv "$listed.tmp" "$listed"; printf 200; fi ;;\n' +
+      '  *\'"list"\'*) if [ -f "$listed.list-fails" ]; then echo down > "$out"; printf 503; else cat "$listed" > "$out"; printf 200; fi ;;\n' +
       '  *\'"show"\'*) [ -z "${FAKE_SHOW_DELAY:-}" ] || sleep "$FAKE_SHOW_DELAY"; if grep -q " $name$" "$listed"; then printf \'state: running\\nsize: standard-16\\nip4: 192.0.2.1\\n\' > "$out"; printf 200; else : > "$out"; printf 404; fi ;;\n' +
       '  *) : > "$out"; printf 200 ;;\n' +
       'esac\n');
@@ -439,7 +457,7 @@ describe('ubi-runner run, verify and quota against a fake API and a fake ssh', (
       expect(f.ssh()).toMatch(/setsid -w bash -c 'printf %s \$\$ >~\/\.ubirun-setup-\d+\.sid; cd work\/[^ ]+ && \. ~\/\.ubirun-env && bash -l ~\/\.ubirun-setup\.sh'; else bash -c '[^']*'; fi$/m);
       expect(readFileSync(join(f.root, 'cancel.log'), 'utf8')).toMatch(/rm -f ~\/\.ubirun-setup-\d+\.sid; \[ -z "\$sid" \] \|\| \{ pkill -TERM -s "\$sid"; sleep 2; pkill -KILL -s "\$sid"; \}/);
       expect(f.calls()).toContain('destroy');
-      expect(err).toMatch(/destroyed eu-central-h1\/ubirun-thrd1-\d{10}-[0-9a-f]{8}-t4/);
+      expect(err).toMatch(/destroyed eu-central-h1\/ubirun-thrd1-\d{10}-[0-9a-f]{8}-t3/);
       expect(f.listed()).toBe('');
       expect(readFileSync(f.record, 'utf8')).toBe('');
     } finally { rmSync(f.root, { recursive: true, force: true }); }
@@ -457,6 +475,40 @@ describe('ubi-runner run, verify and quota against a fake API and a fake ssh', (
     } finally { rmSync(f.root, { recursive: true, force: true }); }
   }, 60_000);
 
+  test('run: ends with UBICLOUD: left=0 for its own VM; a same-owner sibling is counted as information and does not fail the run', () => {
+    const f = fakeVm({ listed: 'eu-central-h1 ubirun-thrd1-9999999999-sib1-t3\n' });
+    try {
+      const r = f.run(['run', '--src', f.root, '--', 'true'], { UBI_REAP: '0' });
+      const err = r.stderr.toString();
+      expect(r.exitCode, err).toBe(0);
+      expect(err).toMatch(/UBICLOUD: left=0 owner=thrd1 vm=ubirun-thrd1-\d{10}-[0-9a-f]{8}-t3 others=1\n/);
+      expect(f.listed()).toBe('eu-central-h1 ubirun-thrd1-9999999999-sib1-t3\n');
+    } finally { rmSync(f.root, { recursive: true, force: true }); }
+  }, 30_000);
+
+  test('run: a passing command whose teardown fails exits 1 with UBICLOUD: left=1 and the down command; an unreadable VM list fails closed', () => {
+    const f = fakeVm();
+    try {
+      writeFileSync(join(f.root, 'listed.destroy-fails'), '');
+      const leaked = f.run(['run', '--src', f.root, '--', 'true'], { UBI_REAP: '0', UBI_DOWN_TIMEOUT: '3' });
+      const err = leaked.stderr.toString();
+      expect(leaked.exitCode, err).toBe(1);
+      expect(err).toMatch(/UBICLOUD: left=1 owner=thrd1 vm=(ubirun-thrd1-\d{10}-[0-9a-f]{8}-t3) others=0\n[^]*VM cleanup not confirmed for \1 \(left=1\); destroy it with: \S+ down \1/);
+      expect(f.listed()).toContain('ubirun-thrd1-');
+      const blind = fakeVm();
+      try {
+        writeFileSync(join(blind.root, 'bin/curl.real'), readFileSync(join(blind.root, 'bin/curl')));
+        chmodSync(join(blind.root, 'bin/curl.real'), 0o755);
+        writeFileSync(join(blind.root, 'bin/curl'), '#!/usr/bin/env bash\nif [ -f ' + JSON.stringify(join(blind.root, 'armed')) + ' ]; then touch ' + JSON.stringify(join(blind.root, 'listed.list-fails')) + '; fi\nexec ' + JSON.stringify(join(blind.root, 'bin/curl.real')) + ' "$@"\n');
+        chmodSync(join(blind.root, 'bin/curl'), 0o755);
+        writeFileSync(join(blind.root, 'command-mode'), 'touch ' + JSON.stringify(join(blind.root, 'armed')));
+        const r = blind.run(['run', '--src', blind.root, '--', 'true'], { UBI_REAP: '0' });
+        expect(r.exitCode, r.stderr.toString()).toBe(1);
+        expect(r.stderr.toString()).toMatch(/UBICLOUD: left=unknown owner=thrd1 vm=ubirun-thrd1-\d{10}-[0-9a-f]{8}-t3 others=unknown\n/);
+      } finally { rmSync(blind.root, { recursive: true, force: true }); }
+    } finally { rmSync(f.root, { recursive: true, force: true }); }
+  }, 60_000);
+
   test('run: the fake ssh dispatches on the remote command, so a checkout whose name holds -O still syncs and runs (GSTA-139)', () => {
     const f = fakeVm();
     try {
@@ -612,7 +664,7 @@ describe('ubi-runner run, verify and quota against a fake API and a fake ssh', (
       expect(f.calls()).toContain('"create"');
       expect(existsSync(join(f.state, 'quota-max'))).toBe(false);
       const name = stale.stdout.toString().trim();
-      expect(name).toMatch(/^ubirun-thrd1-\d{10}-[0-9a-f]{8}-t4$/);
+      expect(name).toMatch(/^ubirun-thrd1-\d{10}-[0-9a-f]{8}-t3$/);
       expect(run(f, ['down', name]).exitCode).toBe(0);
       expect(f.listed()).toBe('eu-central-h1 ubirun-peer-9999999999-cccc\n');
     } finally { rmSync(f.root, { recursive: true, force: true }); }
@@ -660,12 +712,17 @@ describe('ubi-runner run, verify and quota against a fake API and a fake ssh', (
       const listFails = run(f, ['reap']);
       expect(listFails.exitCode).toBe(1);
       expect(listFails.stderr.toString()).toContain("reap: could not list the project's VMs; nothing destroyed");
-      for (const ttl of ['08', '1000', 'abc']) {
+      for (const ttl of ['0', '08', '1000', 'abc']) {
         const r = run(f, ['owner'], { UBI_TTL_HOURS: ttl });
         expect(r.exitCode).toBe(1);
-        expect(r.stderr.toString()).toContain('UBI_TTL_HOURS must be a whole number of hours from 0 to 999');
+        expect(r.stderr.toString()).toContain('UBI_TTL_HOURS must be a whole number of hours from 1 to 999');
       }
       expect(run(f, ['owner'], { UBI_TTL_HOURS: '999' }).exitCode).toBe(0);
+      for (const legacy of ['0', '04', 'x']) {
+        const r = run(f, ['owner'], { UBI_LEGACY_HOURS: legacy });
+        expect(r.exitCode).toBe(1);
+        expect(r.stderr.toString()).toContain('UBI_LEGACY_HOURS must be a whole number of hours from 1 to 9999');
+      }
     } finally { rmSync(f.root, { recursive: true, force: true }); }
   }, 30_000);
 });
diff --git a/ubicloud/SKILL.md b/ubicloud/SKILL.md
index b8b6e0a26..b7dbd6c87 100644
--- a/ubicloud/SKILL.md
+++ b/ubicloud/SKILL.md
@@ -126,8 +126,10 @@ $U owner
 `UBICLOUD_API_KEY` (or `UBICLOUD_API_TOKEN`) is a project-scoped token. When it
 is unset, ask for it as an environment variable and stop; never echo it, write
 it to a file or commit, and never run `env`, `printenv` or `set -x` while it is
-in the environment. `UBI_OWNER` is what `usage` and `list --mine` key on, so set
-it before the first `up` of every session and on every machine.
+in the environment. `UBI_OWNER` is required: `up`, `run` and `verify` refuse
+without it (`UBI_OWNER_REQUIRED`), because a VM nobody can name is a VM nobody
+cleans up. `usage` and `list --mine` key on it, so set it before the first
+`up` of every session and on every machine.
 
 ---
 
@@ -143,8 +145,9 @@ $U usage          # VMs and vCPUs per owner: who holds the shared quota
 A VM in `records` but absent from `list` is already gone: `$U down <name>`
 forgets it. A VM in the project under another owner is theirs; leave it (its
 TTL will reap it). Every `up` runs `$U reap` first, destroying any VM whose
-`-t<hours>` TTL ended more than ten minutes ago, whichever owner made it; a name
-without a TTL is never reaped.
+`-t<hours>` TTL ended more than ten minutes ago, whichever owner made it, and
+any `ubirun-*` name with no TTL once it is `UBI_LEGACY_HOURS` old (default 4);
+names outside the `ubirun-` prefix are never reaped.
 
 Quota: with `UBI_QUOTA_VCPUS=<project ceiling>` exported (or after one refusal,
 whose maximum the runner remembers), `up` adds the size's vCPUs to the project's
@@ -165,8 +168,9 @@ background operation leaves its VM until the reaper. So:
   detach it, and never leave it unwatched when the thread goes idle.
 - In Claude Code, run it under `gstack-detach` and poll the log for its
   `### gstack-detach EXIT=<code> ###` sentinel.
-- Set `UBI_TTL_HOURS` above the longest plausible run (default 4) and name the
-  expected duration in the thread before launching anything over an hour.
+- Set `UBI_TTL_HOURS` above the longest plausible run (default 3; 1-999) and
+  name the expected duration in the thread before launching anything over an
+  hour. A run that outlives its TTL is reaped by the next `up` anywhere.
 
 The runner prints `<name> carries a <n>h TTL ...; if this process dies first:
 <self> down <name>` right after the VM is ready; quote that line in your report
@@ -238,6 +242,10 @@ and for browser tests `xvfb` plus
 
 - `ubi-runner: command exited <rc> after <n>s` is the verdict line; the exit
   status is the command's.
+- `UBICLOUD: left=<n> owner=<o> vm=<name> others=<n>` follows teardown. Report
+  it with every result: `left=0` means this run's VM is confirmed gone. `left=1`
+  or `left=unknown` turns a passing command into exit 1; run the printed `down`
+  command now. `others` counts this owner's other VMs, for information.
 - Exit 124 with `watchdog: <phase> printed nothing for <n>s` (or `ran <n>s`)
   means the remote hung or exceeded its budget; the last 40 lines follow.
   Diagnose from them before rerunning; a hang is a failure, not infrastructure.
diff --git a/ubicloud/SKILL.md.tmpl b/ubicloud/SKILL.md.tmpl
index a5a7fe190..db9be819d 100644
--- a/ubicloud/SKILL.md.tmpl
+++ b/ubicloud/SKILL.md.tmpl
@@ -52,8 +52,10 @@ $U owner
 `UBICLOUD_API_KEY` (or `UBICLOUD_API_TOKEN`) is a project-scoped token. When it
 is unset, ask for it as an environment variable and stop; never echo it, write
 it to a file or commit, and never run `env`, `printenv` or `set -x` while it is
-in the environment. `UBI_OWNER` is what `usage` and `list --mine` key on, so set
-it before the first `up` of every session and on every machine.
+in the environment. `UBI_OWNER` is required: `up`, `run` and `verify` refuse
+without it (`UBI_OWNER_REQUIRED`), because a VM nobody can name is a VM nobody
+cleans up. `usage` and `list --mine` key on it, so set it before the first
+`up` of every session and on every machine.
 
 ---
 
@@ -69,8 +71,9 @@ $U usage          # VMs and vCPUs per owner: who holds the shared quota
 A VM in `records` but absent from `list` is already gone: `$U down <name>`
 forgets it. A VM in the project under another owner is theirs; leave it (its
 TTL will reap it). Every `up` runs `$U reap` first, destroying any VM whose
-`-t<hours>` TTL ended more than ten minutes ago, whichever owner made it; a name
-without a TTL is never reaped.
+`-t<hours>` TTL ended more than ten minutes ago, whichever owner made it, and
+any `ubirun-*` name with no TTL once it is `UBI_LEGACY_HOURS` old (default 4);
+names outside the `ubirun-` prefix are never reaped.
 
 Quota: with `UBI_QUOTA_VCPUS=<project ceiling>` exported (or after one refusal,
 whose maximum the runner remembers), `up` adds the size's vCPUs to the project's
@@ -91,8 +94,9 @@ background operation leaves its VM until the reaper. So:
   detach it, and never leave it unwatched when the thread goes idle.
 - In Claude Code, run it under `gstack-detach` and poll the log for its
   `### gstack-detach EXIT=<code> ###` sentinel.
-- Set `UBI_TTL_HOURS` above the longest plausible run (default 4) and name the
-  expected duration in the thread before launching anything over an hour.
+- Set `UBI_TTL_HOURS` above the longest plausible run (default 3; 1-999) and
+  name the expected duration in the thread before launching anything over an
+  hour. A run that outlives its TTL is reaped by the next `up` anywhere.
 
 The runner prints `<name> carries a <n>h TTL ...; if this process dies first:
 <self> down <name>` right after the VM is ready; quote that line in your report
@@ -164,6 +168,10 @@ and for browser tests `xvfb` plus
 
 - `ubi-runner: command exited <rc> after <n>s` is the verdict line; the exit
   status is the command's.
+- `UBICLOUD: left=<n> owner=<o> vm=<name> others=<n>` follows teardown. Report
+  it with every result: `left=0` means this run's VM is confirmed gone. `left=1`
+  or `left=unknown` turns a passing command into exit 1; run the printed `down`
+  command now. `others` counts this owner's other VMs, for information.
 - Exit 124 with `watchdog: <phase> printed nothing for <n>s` (or `ran <n>s`)
   means the remote hung or exceeded its budget; the last 40 lines follow.
   Diagnose from them before rerunning; a hang is a failure, not infrastructure.