## Symptom

Every `persistent` shell on hfenduleam (doyle/PACER-0, perri/PACER-0, todlando/PACER-0, doyle/alchemy-1, deployah/alchemy-0, …) went offline at the daemon restart of 2026-09-07 08:03:20Z and stayed offline. No error anywhere. The operator noticed 27 hours later because doyle's pacer had stopped pacing. `shell list` read `offline` the whole time, which is correct, and nothing ever relaunched.

## Mechanism (measured 2026-09-08 10:26Z, spt-core 0.67.0, log `daemon.stderr.log` generation 0 / pid 48232)

- Machine boot: 2026-09-04 08:02:53Z. Pacer launched by that boot's sweep: 2026-09-04 08:03:39Z (`shell.launch.json launched_ms=1788509019651`, native start stamp agrees).
- Daemon restarted (no machine reboot): 2026-09-07 08:03:20Z. The pacer process (pid 27656) died with it. The heal fired: `SHELL_RECORD_HEALED:doyle/PACER-0: online -> offline` (8 such lines, one per persistent instance).
- The restore never fired: zero `SHELL_BOOT_RESTORED` / `SHELL_OWNER_ONLINE_RESTORED` lines in the whole generation. The previous generation (boot 2026-09-04) shows `SHELL_BOOT_RESTORED:doyle/alchemy-0` etc.
- Cause: `launch_predates_boot(launched_ms, boot_ms, slack)` in `spt_daemon::shellwake` compares against the MACHINE boot instant (`boot_instant_ms` = now minus `GetTickCount64`). A launch at boot+46 s does not predate that boot, so every daemon-only restart lands in the "force-killed THIS boot => NOT eligible" arm on all three triggers (boot sweep, owner-online edge, watcher). By construction, a daemon restart is indistinguishable from an operator force-kill under this discriminant.
- doyle/alchemy-0 came back only because `spt shell cmd` wakes an offline persistent instance on demand (linkhost `wake_if_offline_persistent`); PACER receives no owner commands, so it stays down until a human runs `relink`. Confirmed: `spt shell relink PACER-0` at 10:28:39Z brought it online (pid 45088), status reply received.

## Why this matters

A daemon restart happens on every self-update. KNOWN-HAZARDS 2.7 (`REQ-HAZARD-RESTART-STRANDS-PERSISTENT-SHELLS`) states "a node restart must not strand a persistent instance" and was closed for the machine-reboot face; the daemon-restart face reproduces the same stranding through the discriminant that closed it. The contract sentence (a persistent shell is online whenever its owner is) is false after every update.

## Shape question for the fix (not ruled here)

The force-kill freeze (releases#78 leg (c)) must survive. Candidate: evaluate the corpse against the DAEMON generation instant as well as the machine boot instant, i.e. a corpse whose launch predates the current daemon start is a restart casualty. The open edge: a shell that survives a daemon restart and is then force-killed would have a launch older than the daemon start and would be relaunched. Whether any shell survives a restart (broker-hosted ones die with the broker; relay ones close on link-break) needs measuring before the rule is set.

## Evidence

- `C:\Users\decid\AppData\Local\spt-core\logs\daemon.stderr.log` lines 64-119 (heals), no RESTORED lines.
- `owlery/doyle/shells/PACER-0/{shell.pid,shell.launch.json,info.json}`.
- perri/PACER-0 (pid 28464) and todlando/PACER-0 (pid 42736) still offline at filing; their owners must relink or issue a shell cmd.