@@ -468,9 +468,17 @@ extension RunnerTests {
     }
     switch command.traits.launchPolicy {
     case .noApp:
-      // Answers from the runner's own capture and state, so the target is resolved exactly as it
-      // stands.
-      return .context(ActiveCommandContext(app: resolveAppWithoutActivation(command: command)))
+      // A surface that is genuinely on screen is the screen this command would observe, so it is
+      // served in place first, exactly as it is for the reads: bringing nothing forward is what makes
+      // an observation honest, and it is not the same promise as ignoring what is presented (#2438).
+      if let presented = presentedSystemSurfaceHost() {
+        return .context(ActiveCommandContext(app: presented.app, systemSurface: presented.host))
+      }
+      // Nothing is presented, so the target is the one that already stands: the cached session app,
+      // or the runner host when nothing is bound. Not the request's bundle id — this route never
+      // resolves a bundle it has not already bound, which is what keeps an observation from deciding
+      // which app it is about.
+      return .context(ActiveCommandContext(app: mainOwned.app ?? app))
     case .presentedSurface:
       // The command is about the surface that already has focus; activating an app under it would
       // cancel exactly what the command is about.
@@ -581,9 +589,8 @@ extension RunnerTests {
   private func presentedSystemSurfaceHost() -> (host: SystemSurfaceHost, app: XCUIApplication)? {
 #if os(iOS)
     for host in SystemSurfaceHostRegistry.hosts {
-      let candidate = XCUIApplication(bundleIdentifier: host.bundleId)
-      if candidate.state == .runningForeground {
-        return (host, candidate)
+      if systemSurfaceHostState(host) == .runningForeground {
+        return (host, XCUIApplication(bundleIdentifier: host.bundleId))
       }
     }
     return nil
@@ -592,6 +599,19 @@ extension RunnerTests {
 #endif
   }
 
+  /// Whether a registered host is on screen. A registered host is an out-of-process service that only
+  /// comes up because some app presented it, and `open` refuses to launch one, so no in-bundle test
+  /// can make the system report one foreground; the named hosts answer that one question here and the
+  /// registry order and the foreground condition above stay the production ones.
+  private func systemSurfaceHostState(_ host: SystemSurfaceHost) -> XCUIApplication.State {
+    #if AGENT_DEVICE_RUNNER_UNIT_TESTS
+    if presentedSystemSurfaceForegroundOverrideForTesting?.contains(host.bundleId) == true {
+      return .runningForeground
+    }
+    #endif
+    return XCUIApplication(bundleIdentifier: host.bundleId).state
+  }
+
   func currentXCTestFailureCount() -> Int {
     return testRun?.failureCount ?? 0
   }
 
@@ -44,8 +44,11 @@ enum CommandType: String, Codable, CaseIterable {
 /// decides whether a stopped app is started, so it is declared per command rather than inferred
 /// from whether the command may be replayed (#2890).
 enum CommandLaunchPolicy: Equatable {
-  /// Never brings an app forward: the command answers from the runner's own capture and state, or
-  /// drives the runner's own lifecycle.
+  /// Preparation brings no app forward and binds no target: the command answers from the runner's own
+  /// capture and state, or drives the runner's own lifecycle, so it is served the standing cached
+  /// target. A surface that is genuinely presented is served in place instead, because that is the
+  /// screen the command observes (#2438). Scoped to preparation: a command body may still go to the
+  /// app it names, as macOS `screenshot` does.
   case noApp
   /// Answers from the surface that already has focus, where activating an app would cancel exactly
   /// what the command is about: an in-place system surface, or a press that belongs to the system.
 
@@ -202,6 +202,12 @@ final class RunnerTests: XCTestCase {
   var blockingSystemModalPresenceOverrideForTesting: Bool?
   var alertResolutionOverrideForTesting: (@MainActor (Date) -> RunnerAlert?)?
   var alertButtonHittabilityProbeOverrideForTesting: (@MainActor (Date) -> Bool)?
+  // Unit-test-only seam for the in-place surface probe (`presentedSystemSurfaceHost`): a registered
+  // host is an out-of-process XPC service that only comes up because some app presented it, and
+  // `open` refuses to launch one, so the foreground answer for the named registered hosts is
+  // supplied here. The probe's registry order and its `.runningForeground` condition stay the
+  // production ones. Production never compiles this property.
+  var presentedSystemSurfaceForegroundOverrideForTesting: Set<String>?
   // Runs on the waiting thread after `runMainThreadWork`'s wait timed out and before it takes the
   // lock that decides between finished and abandoned, so a test can finish the work in that window.
   var mainThreadWorkTimedOutForTesting: (@Sendable () -> Void)?
 
@@ -143,6 +143,85 @@ extension RunnerTests {
     }
   }
 
+  /// `.noApp` owes both of the merge-base's answers: a registered host presented over the session is
+  /// served in place (#2438), and with nothing presented the standing cached target is served rather
+  /// than a target resolved from the request. The policy axis dropped both. The request names a bundle
+  /// the session never bound because that is the only shape separating the two targets — when the
+  /// request agrees with the cache, both answers name the same app. The seam is the host's foreground
+  /// state alone: the probe's registry walk and foreground condition stay the production ones, and the
+  /// `snapshot`/`querySelector` route that consumes this preparation is pinned live by the replay
+  /// layers, which need a host something actually presented.
+  @MainActor
+  func testNoAppCommandStillServesAPresentedSurfaceInPlaceAndOtherwiseTheStandingTarget() throws {
+    let cachedBundleId = "com.example.session"
+    let requestedBundleId = "com.example.requested-but-never-bound"
+    defer {
+      presentedSystemSurfaceForegroundOverrideForTesting = nil
+      invalidateCachedTarget(reason: "unit_test_cleanup")
+    }
+
+    let host = try XCTUnwrap(SystemSurfaceHostRegistry.hosts.first)
+    let screenshot = try runnerCommandFixture(
+      #"{"command":"screenshot","commandId":"capture-1","appBundleId":"\#(requestedBundleId)"}"#
+    )
+    mainOwned.app = app
+    mainOwned.bundleId = cachedBundleId
+
+    presentedSystemSurfaceForegroundOverrideForTesting = [host.bundleId]
+    guard case .context(let presented) = prepareActiveCommandContext(command: screenshot) else {
+      return XCTFail("screenshot must be prepared, not refused")
+    }
+    XCTAssertEqual(
+      presented.systemSurface,
+      host,
+      "a capture taken under a presented surface must carry that surface's provenance (#2438)"
+    )
+    XCTAssertFalse(
+      presented.app === app,
+      "the capture target is the presented host, not the standing session target"
+    )
+    XCTAssertFalse(
+      presented.app === springboard,
+      "a presented surface is served in place, never through SpringBoard"
+    )
+    XCTAssertNil(pendingTargetActivation, "serving a surface in place may not record an activation")
+    XCTAssertEqual(
+      mainOwned.bundleId,
+      cachedBundleId,
+      "serving a surface in place may not rebind the session target"
+    )
+
+    // A second host reported instead of the first: an arm that returned the registry's first entry
+    // rather than walking it would pass everything above and fail here.
+    let secondHost = SystemSurfaceHostRegistry.hosts[1]
+    presentedSystemSurfaceForegroundOverrideForTesting = [secondHost.bundleId]
+    guard case .context(let other) = prepareActiveCommandContext(command: screenshot) else {
+      return XCTFail("screenshot must be prepared, not refused")
+    }
+    XCTAssertEqual(
+      other.systemSurface,
+      secondHost,
+      "the probe must serve the host that is reported foreground, not the registry's first entry"
+    )
+
+    // The other half, with nothing presented. Without this the arm could pass by serving a surface
+    // that is not there.
+    presentedSystemSurfaceForegroundOverrideForTesting = nil
+    guard case .context(let standing) = prepareActiveCommandContext(command: screenshot) else {
+      return XCTFail("screenshot must be prepared, not refused")
+    }
+    XCTAssertNil(
+      standing.systemSurface,
+      "no surface is presented, so nothing may be disclosed as one"
+    )
+    XCTAssertTrue(
+      standing.app === app,
+      "naming another bundle is no licence to point the observation away from the standing target"
+    )
+    XCTAssertNil(pendingTargetActivation)
+    XCTAssertEqual(mainOwned.bundleId, cachedBundleId, "preparing a capture binds nothing")
+  }
+
   @MainActor
   func testSkipAppActivationPreflightIncludesForegroundCachedCoordinateOnlyTaps() throws {
     app.launch()