---
name: autostart-inherits-job-escaped-daemon
description: "Any test triggering daemon autostart inherits a WMI-launched, job-escaped daemon that no harness cleanup can own (parent reads GONE, outside the test's job/tree); the double-space unquoted cmdline is the WMI rung's fingerprint."
metadata: 
  node_type: memory
  type: project
  originSessionId: 520cc386-a467-49d9-b1f9-c90853dfed9b
  modified: 2026-08-02T21:54:31.120Z
---

The #124 leak's mechanism (hertz's hunt, 2026-08-02): `launch_ladder()` tries the WMI rung FIRST on Windows — `wrapped_daemon_command()` builds `cmd.exe /c set ... & start "" /b <unquoted exe>  <args>` (the empty title yields a DOUBLE SPACE + unquoted path: the rung's fingerprint; CreateProcessW spawns are quoted). The daemon becomes WmiPrvSE's child BY DESIGN (REQ-HAZARD-VIEWER-CLOSE-DETACH — a viewer close must not reap it). Consequence in tests: any test whose spt api call autostarts (`ensure_daemon`, #99 prior art) inherits a daemon outside its job and tree with parent GONE — structurally immune to harness cleanup, ownable only by explicit pid kill. Rigs with DaemonGuard kill-by-pid measure clean; the population leaks anyway. Leak count = number of distinct temp-SPT_HOME tests that autostarted, not dirty-rig count.

**Why:** the property that makes production correct makes tests leak; no amount of rig discipline fixes a spawn the rig never knew happened.

**How to apply:** (1) attribution key = SPT_HOME forwarded by value into the WMI wrapper's own command line — the wrapper cmdline names the home, the home names the test (sample cmd/powershell, not just spt.exe); (2) the CI pre-relink census reap is the tourniquet, never the fix; (3) structural fix = test-mode IN-JOB launch (tests own their daemons' lifecycle, so viewer-close semantics do not apply inside them) — an ownership "contract" without enforcement is [[prompt-prohibition-is-not-a-boundary]]; (4) the hunt's method: three hypotheses (respawn / late-arrival / list-phase) each killed by a designed measurement before the fingerprint named the code path — [[key-must-ride-the-crossing-artifact]], [[containment-ownership-and-unknown-polarity]].