@@ -394,7 +394,7 @@ The release store pairs with the acquire load every reader does on `state`. Any
 
 **Bump the generation counter, then ring the doorbells.** Finally the writer does `header->generation.fetch_add(1)`. The generation counter is the table's change signal. Publishers, services, and clients cache their lookup results and re-scan only when the generation moves, so bumping it here tells every cached reader that the graph changed and its cache is stale. Immediately after the bump, the writer sends one octet to every registered doorbell (`ring_doorbells`), which wakes any process blocked in `rmw_wait` so it re-reads the counter. The order is load-bearing: ring strictly after the bump, paired with the wait side draining its doorbell strictly before reading the counter, is what makes a lost wakeup impossible (see The doorbell under Wait set). This is what turns a new registration into a graph event without any daemon: the table is the state, the doorbell is the edge.
 
-**The slot index is remembered, so removal needs no scan.** `registry_add` returns the slot index, and the owning entity stores it. Removal (`registry_remove`) indexes straight to that slot and CASes its `state` back to `ENTRY_EMPTY`. There is no second scan to find the entry on the way out, which keeps teardown cheap and makes removal symmetric with the single-CAS claim used on the way in.
+**The slot index is remembered, so removal needs no scan.** `registry_add` returns the slot index, and the owning entity stores it. Removal (`registry_remove`) indexes straight to that slot, CASes its `state` to `ENTRY_RESERVED`, tears it down, and only then stores `ENTRY_EMPTY`. There is no second scan to find the entry on the way out, which keeps teardown cheap and makes removal symmetric with the single-CAS claim used on the way in.
 
 **Failure path.** If the scan finds no empty slot, `registry_add` runs the stale-cleanup pass once (reclaiming slots whose owning PID is dead) and retries the scan a single time. If the table is still full after that, the add fails and returns -1. There is no resize and no spinning.
 
@@ -436,9 +436,9 @@ Services and clients cache the same way against the same generation counter; the
 
 Two failure modes leave entries behind: a clean shutdown, and a process that dies without running its destructors. They are handled separately because only one of them can be trusted to tell the truth about itself.
 
-**Clean shutdown.** When an endpoint is destroyed normally, it removes its own slot. Because each entity records the slot index it was assigned at registration, removal needs no scan: it indexes straight to its slot. `registry_remove` reads the slot's current `state`, then attempts a single compare-and-swap from that state value to `ENTRY_EMPTY`. The CAS is what makes the removal safe under concurrency: exactly one caller can win it, and the winner owns the teardown. If the CAS fails, someone else already emptied the slot, so the function returns without touching anything.
+**Clean shutdown.** When an endpoint is destroyed normally, it removes its own slot. Because each entity records the slot index it was assigned at registration, removal needs no scan: it indexes straight to its slot. `registry_remove` reads the slot's current `state`, then attempts a single compare-and-swap from that state value to `ENTRY_RESERVED`. The CAS is what makes the removal safe under concurrency: exactly one caller can win it, and the winner owns the teardown. If the CAS fails (or the slot is already `ENTRY_EMPTY` or `ENTRY_RESERVED`), someone else is emptying it, so the function returns without touching anything.
 
-The teardown itself runs under the slot's seqlock (the same odd/even protocol used on the write side). `teardown_slot` bumps `seq` to odd, copies out the socket path, zeroes every payload field, then bumps `seq` back to even. Any reader that was mid-snapshot sees the odd `seq` and retries, so it can never read a half-erased slot. The socket file is unlinked after the seqlock closes, because a filesystem operation does not need to be observable atomically by other processes. Finally `generation` is incremented so every cached reader learns the graph changed. The order matters: `state` flips to `ENTRY_EMPTY` first (no new reader can match the slot), the payload is wiped under the seqlock, and only then does `generation` move.
+The teardown itself runs under the slot's seqlock (the same odd/even protocol used on the write side). `teardown_slot` bumps `seq` to odd, copies out the socket path, zeroes every payload field, then bumps `seq` back to even. Any reader that was mid-snapshot sees the odd `seq` and retries, so it can never read a half-erased slot. The socket file is unlinked after the seqlock closes, because a filesystem operation does not need to be observable atomically by other processes. Finally `generation` is incremented so every cached reader learns the graph changed. The order matters: `state` flips to `ENTRY_RESERVED` first (no new reader can match the slot, and no adder can claim it), the payload is wiped under the seqlock, `state` is set to `ENTRY_EMPTY`, and only then does `generation` move. Freeing the slot before the wipe would let a concurrent add claim it in between and have its fresh entry and socket file erased by the late teardown.
 
 **Crash.** A process killed by SIGKILL, OOM, or a container teardown never reaches `registry_remove`. Its slot keeps a stale socket path that no longer accepts connections. There is no destructor to trust, so the registry infers death from the operating system instead. `registry_cleanup_stale` walks the table, and for each live slot it takes a seqlock snapshot and checks the owning PID by stat-ing `/proc/<pid>`. The decision is deliberately conservative:
 
@@ -448,7 +448,7 @@ The teardown itself runs under the slot's seqlock (the same odd/even protocol us
 
 The bias toward keeping is intentional. The cost of wrongly keeping a dead slot is one wasted slot until the next pass; the cost of wrongly reclaiming a live slot is tearing down a working endpoint. A `pid` of 0 is also never reclaimed, since that value only appears in the transient snapshot of a slot whose payload has not been written yet, never in a committed entry.
 
-The dangerous window is between vetting a slot and tearing it down. The owner could exit, the slot could be reclaimed by a clean remove, and a different process could re-add an entry of the same type into the same slot, all before this pass acts. This is the classic ABA problem: the slot looks identical but is a different entry, and the `state` value alone cannot tell them apart. The seqlock counter closes the gap. The snapshot captures the slot's `seq` (`snap_seq`), and immediately before the reclaim CAS the pass re-reads `seq` and compares. Any intervening write (a remove or a re-add both go through the seqlock) advances the counter, so a mismatch means the slot is no longer the entry that was checked, and the pass skips it. Only when `seq` is unchanged does it CAS the observed `state` to `ENTRY_EMPTY`, log a one-line breadcrumb naming the slot, PID, node, and topic so an ungraceful exit is visible in the ROS log, run the same `teardown_slot`, and bump `generation`.
+The dangerous window is between vetting a slot and tearing it down. The owner could exit, the slot could be reclaimed by a clean remove, and a different process could re-add an entry of the same type into the same slot, all before this pass acts. This is the classic ABA problem: the slot looks identical but is a different entry, and the `state` value alone cannot tell them apart. The seqlock counter closes the gap. The snapshot captures the slot's `seq` (`snap_seq`), and immediately before the reclaim CAS the pass re-reads `seq` and compares. Any intervening write (a remove or a re-add both go through the seqlock) advances the counter, so a mismatch means the slot is no longer the entry that was checked, and the pass skips it. Only when `seq` is unchanged does it CAS the observed `state` to `ENTRY_RESERVED`, log a one-line breadcrumb naming the slot, PID, node, and topic so an ungraceful exit is visible in the ROS log, run the same `teardown_slot`, store `ENTRY_EMPTY`, and bump `generation`.
 
 **When it runs.** There are two triggers.
 
@@ -476,7 +476,7 @@ So the hot paths avoid locks entirely. They rely on the fact that `std::atomic<u
 
 Three mechanisms replace the lock:
 
-- **Claiming a slot is a single CAS.** To add an entry, a writer scans for an empty slot and flips its `state` from `ENTRY_EMPTY` to `ENTRY_RESERVED` with one atomic compare-and-swap. Exactly one writer wins. `ENTRY_RESERVED` is a private "claimed but not yet filled in" marker (see Registering an entry for the full read/write protocol). Removal is the mirror image: a CAS of `state` back to `ENTRY_EMPTY` decides who owns the teardown.
+- **Claiming a slot is a single CAS.** To add an entry, a writer scans for an empty slot and flips its `state` from `ENTRY_EMPTY` to `ENTRY_RESERVED` with one atomic compare-and-swap. Exactly one writer wins. `ENTRY_RESERVED` is a private "claimed but not yet filled in" marker (see Registering an entry for the full read/write protocol). Removal is the mirror image: a CAS of `state` to `ENTRY_RESERVED` decides who owns the teardown, and `ENTRY_EMPTY` is stored only once the slot is wiped.
 
 - **Publishing and reading a slot is a seqlock.** A writer brackets the payload copy with an odd/even `seq` counter; a reader snapshots `seq` before and after the copy and retries on mismatch. The full protocol is described in Registering an entry. The point for locking is that readers never block a writer and writers never block a reader, and the bounded retry (`MAX_READ_RETRIES`) guarantees a persistent writer cannot spin a reader forever.
 
 
@@ -305,10 +305,11 @@ int32_t registry_add(RegistryHeader * header, const RegistryEntry & entry)
   return try_add_once(header, entry);
 }
 
-// Best-effort tear-down of a slot we already claimed (state already EMPTY).
-// Unlink the socket file and zero out the payload so the next reuse starts
-// from a clean state. Wrapped in a seqlock so any reader still in the middle
-// of a snapshot retries.
+// Best-effort tear-down of a slot we already claimed (state RESERVED). Unlink the
+// socket file and zero out the payload so the next reuse starts from a clean
+// state. Wrapped in a seqlock so any reader still in the middle of a snapshot
+// retries. The caller stores EMPTY only afterwards: freeing the slot first would
+// let a concurrent add claim it and have its fresh entry (and socket) wiped here.
 static void teardown_slot(RegistryEntrySlot * slot)
 {
   slot->seq.fetch_add(1, std::memory_order_acq_rel);
@@ -352,17 +353,19 @@ void registry_remove(RegistryHeader * header, int32_t index)
   auto * slot = &registry_slots(header)[index];
 
   uint8_t st = slot->state.load(std::memory_order_acquire);
-  if (st == ENTRY_EMPTY) {
-    return;
+  if (st == ENTRY_EMPTY || st == ENTRY_RESERVED) {
+    return;  // already free, or another thread is mid-add/mid-teardown
   }
-  // CAS state -> EMPTY. Winner owns the teardown.
+  // CAS state -> RESERVED. Winner owns the teardown; the slot stays unclaimable
+  // until the payload is zeroed.
   if (!slot->state.compare_exchange_strong(
-      st, static_cast<uint8_t>(ENTRY_EMPTY),
+      st, static_cast<uint8_t>(ENTRY_RESERVED),
       std::memory_order_acq_rel, std::memory_order_relaxed))
   {
     return;  // someone else removed it
   }
   teardown_slot(slot);
+  slot->state.store(static_cast<uint8_t>(ENTRY_EMPTY), std::memory_order_release);
   header->generation.fetch_add(1, std::memory_order_acq_rel);
   if (st != ENTRY_DOORBELL) {  // doorbell slots have no wake consumers
     ring_doorbells(header);    // strictly after the bump — see ring_doorbells
@@ -518,10 +521,11 @@ void registry_cleanup_stale(RegistryHeader * header)
       continue;  // slot was rewritten since snapshot — not the entry we vetted
     }
     // Try to claim the slot for removal. The CAS-expected value is the state
-    // we observed in the snapshot.
+    // we observed in the snapshot. RESERVED (not EMPTY) keeps adders out until
+    // teardown_slot has zeroed it; see teardown_slot.
     uint8_t expected = snap.state.load(std::memory_order_relaxed);
     if (!slots[i].state.compare_exchange_strong(
-        expected, static_cast<uint8_t>(ENTRY_EMPTY),
+        expected, static_cast<uint8_t>(ENTRY_RESERVED),
         std::memory_order_acq_rel, std::memory_order_relaxed))
     {
       continue;  // raced with another remover / writer
@@ -539,6 +543,7 @@ void registry_cleanup_stale(RegistryHeader * header)
       snap.topic_name[0] ? snap.topic_name : "(none)");
 
     teardown_slot(&slots[i]);
+    slots[i].state.store(static_cast<uint8_t>(ENTRY_EMPTY), std::memory_order_release);
     header->generation.fetch_add(1, std::memory_order_acq_rel);
     if (expected != static_cast<uint8_t>(ENTRY_DOORBELL)) {
       reclaimed = true;  // doorbell-only reclaims ring nobody
 
@@ -104,11 +104,12 @@ static_assert(offsetof(RegistryEntry, qos_depth) == 1160, "RegistryEntry layout
 //   4. s2 = seq.load(acquire); if (s1 != s2) retry (bounded retries, then skip)
 //
 // Protocol (remove):
-//   1. CAS state <current> -> EMPTY      (claims removal; loses race => abort)
+//   1. CAS state <current> -> RESERVED   (claims removal; loses race => abort)
 //   2. seq.fetch_add(1)                  -> begin payload teardown
 //   3. unlink(socket_path); memset payload
 //   4. seq.fetch_add(1)                  -> end teardown
-//   5. generation.fetch_add(1)
+//   5. state.store(EMPTY, release)       -> only now can an adder claim the slot
+//   6. generation.fetch_add(1)
 //
 // All atomics are lock-free + address-free (std::atomic<u8/u32>::is_always_lock_free
 // is true on every Linux target we support), so they work across process
 
@@ -38,6 +38,7 @@
 #include <vector>
 
 #include <sys/mman.h>
+#include <sys/wait.h>
 #include <unistd.h>
 
 #include "../src/registry.hpp"
@@ -340,3 +341,77 @@ TEST_F(RegistryConcurrentTest, GenerationCounterMonotonicUnderChaos)
   EXPECT_EQ(0, regressions.load())
     << "generation counter regressed " << regressions.load() << " times";
 }
+
+// A stale-PID reap must never tear down an entry that a live process wrote into
+// the same slot after the reaper claimed it. Before the fix the reaper freed the
+// slot (state -> EMPTY) before zeroing it, so a concurrent add could take the
+// slot and have its payload wiped: the live entry vanished and a nameless
+// "ghost" stayed behind (seen as an empty service name in a 10-robot fleet).
+TEST_F(RegistryConcurrentTest, StaleReapNeverClobbersConcurrentAdd)
+{
+  auto * header = rmw_uds::registry_header(registry_ptr);
+
+  pid_t dead = fork();
+  ASSERT_GE(dead, 0);
+  if (dead == 0) {_exit(0);}
+  ASSERT_EQ(dead, waitpid(dead, nullptr, 0));  // reaped: /proc/<dead> is gone
+
+  std::atomic<bool> stop{false};
+  std::atomic<int> lost{0}, ghosts{0};
+
+  // Mimics a launch spawner that exits uncleanly: its entry keeps landing in
+  // the lowest free slot and a sweep keeps reaping it.
+  std::thread reaper([&]() {
+      while (!stop.load()) {
+        rmw_uds::RegistryEntry e;
+        std::memset(&e, 0, sizeof(e));
+        e.type = rmw_uds::ENTRY_SERVICE;
+        e.pid = dead;
+        std::snprintf(e.topic_name, sizeof(e.topic_name), "/dead_srv");
+        std::snprintf(e.type_name, sizeof(e.type_name), "T");
+        rmw_uds::registry_add(header, e);
+        rmw_uds::registry_cleanup_stale(header);
+      }
+    });
+
+  std::thread detector([&]() {
+      while (!stop.load()) {
+        for (auto & r : rmw_uds::registry_query(
+            header, rmw_uds::ENTRY_SERVICE, nullptr, nullptr, nullptr))
+        {
+          if (r.topic_name.empty()) {ghosts.fetch_add(1);}
+        }
+      }
+    });
+
+  std::vector<std::thread> writers;
+  for (int t = 0; t < 4; ++t) {
+    writers.emplace_back([&, t]() {
+        for (int k = 0; k < 5000; ++k) {
+          rmw_uds::RegistryEntry e;
+          std::memset(&e, 0, sizeof(e));
+          e.type = rmw_uds::ENTRY_SERVICE;
+          e.pid = getpid();
+          std::snprintf(e.topic_name, sizeof(e.topic_name), "/live_%d_%d", t, k);
+          std::snprintf(e.type_name, sizeof(e.type_name), "T");
+          int32_t idx = rmw_uds::registry_add(header, e);
+          ASSERT_GE(idx, 0);
+          // Give an in-flight reap of this slot time to finish its teardown.
+          std::this_thread::sleep_for(std::chrono::microseconds(50));
+          if (rmw_uds::registry_query(
+              header, rmw_uds::ENTRY_SERVICE, e.topic_name, nullptr, nullptr).size() != 1)
+          {
+            lost.fetch_add(1);
+          }
+          rmw_uds::registry_remove(header, idx);
+        }
+      });
+  }
+  for (auto & w : writers) {w.join();}
+  stop.store(true);
+  reaper.join();
+  detector.join();
+
+  EXPECT_EQ(0, lost.load()) << "live entries wiped by a concurrent stale reap";
+  EXPECT_EQ(0, ghosts.load()) << "nameless entries observed after a reap clobbered an add";
+}