Test-only. The `resident_service_e2e` teardown reaped resident services while their supervisor was still up.

The `ServiceSet` is hosted in the **daemon** — deliberately, so a routine brain restart does not bounce every resident service through the orphan path — and `servicehost.rs`'s Relaunch arm re-mints a service pid when one dies un-asked. Killing a supervised service under a live supervisor therefore did not reduce the population, it **rotated** it: the service came back as a new pid that no per-pid check in this test holds. That is the shape of the leak this rig kept catching (FLAKE-LEDGER, 4th occurrence).

## What changed

- **The supervisor host dies first.** `broker.kill()` + `wait()` moves above the per-service `authenticated_kill` loop; services next; brain last. The `Child` handle stays the mechanism — authenticated by construction, never a breadcrumb.
- **`daemon stop --force` is observed**, not `let _ =`. Both teardown exit codes plus the stop's stdout and stderr are printed unconditionally: a stop that *succeeded* and leaked anyway is the more interesting of the two findings.
- **Survivors carry their own identity.** `Population.survivors` widens from `(u32, PathBuf)` to a `Survivor` record with `started_at`, `parent`, `parent_exe` and `via` (which selector claimed it). The parent is the discriminator: parent = this run's daemon is a teardown-**order** defect, parent gone is an orphan, and those want different fixes. The pid→ppid map is read **once** per sweep — stamping each survivor from its own fresh read would print a parent set that never existed at any single instant.
- **The stderr sinks are preserved before any assertion can abort.** `SPT_HOME` is a `TempDir`: a failing assertion unwinds, the drop deletes the directory, and the brain/daemon stderr that explains the leak goes with it. Sinks are copied to `<target>/test-artifacts/resident_service_e2e/<unix-ms>/` (`SPT_TEST_ARTIFACTS` overrides; the target root is derived from the test binary's own path, so it follows `CARGO_TARGET_DIR` however it was spelled). The leak assertion cites the directory, reports what was copied *or why it was not*, and pastes a bounded 200-line tail — on CI the job log is the only artifact that survives, and a path on the runner is not evidence anyone can open.
- **The previously unidentified leaked child is identified by construction**, not hunted: that pid is long dead and cannot be named now, but the next occurrence prints its parent and start time in the failure text itself.

## Verification

| leg | exit |
|---|---|
| `cargo check --workspace --all-targets` | 0 |
| `cargo nextest run -E 'binary(resident_service_e2e)'` | 0 — `Summary [16.441s] 1 test run: 1 passed` |
| `cargo clippy --workspace --all-targets -- -D warnings` | 0 |
| `traceable-reqs check` | 0 |

**What this does not prove:** the run is green, so the leak assertion never fired — the new stamp-and-preserve path is exercised only as far as being built. It is proven when something actually leaks. The FLAKE-LEDGER row stays **open** until a Windows golden runs through the changed teardown.

No product code, no new requirement; the existing `REQ-TEST-RIG-DAEMON-TEARDOWN-PROVEN` tag at the census is the right home and tags are unaffected.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_01WAw9XAcTR8oSwzYPsqZoY2