@@ -44,10 +44,10 @@ Accepted (2026-09-29).
 - `commands` — exactly one of `allow` or `deny`. Which daemon commands a rule decides, and by what
   name, is derived from the command registry, never from a hand list:
   - public commands, by their own name;
-  - internal commands that execute on a device, by the public command their
+  - internal commands with platform execution, by the public command their
     `catalog.servesPublicCommand` names (`install_source` as `install-from-source`), or else by
     their own name (`runtime`, which `react-devtools` and Maestro flows send);
-  - internal commands with no platform execution (leases, takeover, session bookkeeping) are
+  - internal commands with no platform execution (leases, `human_control`, session bookkeeping) are
     protocol plumbing that no rule decides;
   - any other name is decided by the rules, so an allow list fails closed for it.
 
 
@@ -127,25 +127,33 @@ export type CommandCatalogGroup = 'public' | 'internal' | 'local-cli';
  */
 export type CommandFrameworkTier = 'core' | 'extended';
 
-export type CommandCatalogFacet = {
-  /**
-   * The command catalog group. This is explicit on every descriptor so new
-   * descriptors cannot accidentally become public CLI/MCP commands by omission.
-   */
-  group: CommandCatalogGroup;
+type CommandCatalogFacetBase = {
   /**
    * Stable property name used by catalog object projections, e.g.
    * `longPress` for the command name `longpress`.
    */
   key?: string;
-  /**
-   * Internal commands only: the public command this one carries to the daemon, so ADR 0029
-   * daemon-policy command rules name the public command (`install_source` serves
-   * `install-from-source`). An internal device-executing command without it is named by itself.
-   */
-  servesPublicCommand?: string;
 };
 
+/**
+ * The command catalog group is explicit on every descriptor so new descriptors cannot
+ * accidentally become public CLI/MCP commands by omission.
+ */
+export type CommandCatalogFacet = CommandCatalogFacetBase &
+  (
+    | {
+        group: 'internal';
+        /**
+         * The public command this internal command carries to the daemon, so ADR 0029
+         * daemon-policy command rules name the public command (`install_source` serves
+         * `install-from-source`). An internal command with platform execution and no value is
+         * named by itself.
+         */
+        servesPublicCommand?: string;
+      }
+    | { group: Exclude<CommandCatalogGroup, 'internal'>; servesPublicCommand?: never }
+  );
+
 /**
  * ADR 0016: whether a recorded request changes app-visible state or only
  * observes it. The resolver form keeps subcommand-sensitive decisions on the
 
@@ -1,8 +1,6 @@
-import fs from 'node:fs';
 import http from 'node:http';
-import path from 'node:path';
 import { computeDaemonCodeSignature } from '@agent-device/host-kit/code-signature';
-import { findProjectRoot } from '@agent-device/host-kit/version';
+import { resolveDaemonLaunchSpec } from '../../daemon-client/daemon-launch-spec.ts';
 import { listenOnLoopback } from './loopback.ts';
 
 // A loopback stand-in for a running daemon: answers `GET /health`, echoes `responseData` as the
@@ -61,16 +59,13 @@ export async function startHttpDaemonFixture(
   return { server, port, seenPaths, rpcRequests };
 }
 
-/** The code signature a daemon started from this checkout records, so a fixture daemon is reused. */
+/**
+ * The code signature a daemon started from this checkout records, read through the same launch
+ * spec the client uses to launch and sign its daemon, so a fixture daemon is reused.
+ */
 export function currentDaemonCodeSignature(): string {
-  const root = findProjectRoot();
-  const distPath = path.join(root, 'dist', 'src', 'internal', 'daemon.js');
-  const sourcePath = path.join(root, 'src', 'daemon.ts');
-  const entryPath =
-    process.execArgv.includes('--experimental-strip-types') || !fs.existsSync(distPath)
-      ? sourcePath
-      : distPath;
-  return computeDaemonCodeSignature(entryPath, root);
+  const spec = resolveDaemonLaunchSpec();
+  return computeDaemonCodeSignature(spec.useSrc ? spec.srcPath : spec.distPath, spec.root);
 }
 
 /** Swaps `process.stderr.write` for a buffer until `restore`, so a test can read what was printed. */
 
@@ -2,6 +2,13 @@ import assert from 'node:assert/strict';
 import fs from 'node:fs';
 import path from 'node:path';
 import { afterEach, test, vi } from 'vitest';
+
+vi.mock('@agent-device/host-kit/command', async (importOriginal) => ({
+  ...(await importOriginal<typeof import('@agent-device/host-kit/command')>()),
+  runCmdDetachedMonitored: vi.fn(),
+}));
+
+import { runCmdDetachedMonitored } from '@agent-device/host-kit/command';
 import { readProcessStartTime } from '@agent-device/host-kit/process';
 import { readVersion } from '@agent-device/host-kit/version';
 import { AppError } from '@agent-device/kernel/errors';
@@ -15,9 +22,12 @@ import { loadDaemonPolicy } from '../../daemon-policy-file.ts';
 import { resolveDaemonPaths } from '../../daemon-resolution.ts';
 import { sendToDaemon } from '../daemon-client.ts';
 
-// ADR 0029: a caller that names a daemon policy must not reuse a daemon that enforces another one.
+// ADR 0029: a caller that names a daemon policy must not use a daemon that enforces another one.
+
+const mockSpawnDaemon = vi.mocked(runCmdDetachedMonitored);
 
 afterEach(() => {
+  mockSpawnDaemon.mockReset();
   vi.unstubAllEnvs();
 });
 
@@ -81,6 +91,30 @@ test('a caller naming a policy reuses a daemon that enforces the same policy', a
   }
 });
 
+test('a caller naming a policy refuses a daemon another caller started without it', async (t) => {
+  if (!(await supportsLoopbackBind())) {
+    t.skip('loopback listeners are not permitted in this environment');
+    return;
+  }
+  // No daemon runs yet. While this caller starts one, another caller's daemon without the policy
+  // wins the state dir: its metadata is what startup finds.
+  const fixture = await startReusableDaemon({ policyDigest: undefined, publish: 'on-spawn' });
+  try {
+    await assert.rejects(
+      () => sendSmoke(fixture.stateDir),
+      (error: unknown) => {
+        assert.ok(error instanceof AppError);
+        assert.equal(error.details?.reason, 'DAEMON_POLICY_MISMATCH');
+        return true;
+      },
+    );
+    assert.equal(mockSpawnDaemon.mock.calls.length, 1, 'this caller did start a daemon');
+    assert.ok(!fixture.seenPaths.includes('POST /rpc'), 'no command reaches the daemon');
+  } finally {
+    await fixture.close();
+  }
+});
+
 async function sendSmoke(stateDir: string) {
   return await sendToDaemon({
     session: 'default',
@@ -91,7 +125,10 @@ async function sendSmoke(stateDir: string) {
   });
 }
 
-async function startReusableDaemon(options: { policyDigest: string | undefined }) {
+async function startReusableDaemon(options: {
+  policyDigest: string | undefined;
+  publish?: 'now' | 'on-spawn';
+}) {
   const stateDir = mkdtempForTestSync('agent-device-policy-reuse-');
   const policyPath = path.join(stateDir, 'policy.json');
   fs.writeFileSync(
@@ -102,20 +139,29 @@ async function startReusableDaemon(options: { policyDigest: string | undefined }
   const daemon = await startHttpDaemonFixture({ via: 'http' });
   const paths = resolveDaemonPaths(stateDir);
   fs.mkdirSync(paths.baseDir, { recursive: true });
-  fs.writeFileSync(
-    paths.infoPath,
-    `${JSON.stringify({
-      httpPort: daemon.port,
-      transport: 'http',
-      token: 'local-secret',
-      pid: process.pid,
-      version: readVersion(),
-      codeSignature: currentDaemonCodeSignature(),
-      processStartTime: readProcessStartTime(process.pid) ?? undefined,
-      policyDigest:
-        options.policyDigest === 'matching' ? loadDaemonPolicy()?.digest : options.policyDigest,
-    })}\n`,
-  );
+  const publishInfo = () =>
+    fs.writeFileSync(
+      paths.infoPath,
+      `${JSON.stringify({
+        httpPort: daemon.port,
+        transport: 'http',
+        token: 'local-secret',
+        pid: process.pid,
+        version: readVersion(),
+        codeSignature: currentDaemonCodeSignature(),
+        processStartTime: readProcessStartTime(process.pid) ?? undefined,
+        policyDigest:
+          options.policyDigest === 'matching' ? loadDaemonPolicy()?.digest : options.policyDigest,
+      })}\n`,
+    );
+  if (options.publish === 'on-spawn') {
+    mockSpawnDaemon.mockImplementation(() => {
+      publishInfo();
+      return { pid: process.pid, exited: new Promise(() => {}) };
+    });
+  } else {
+    publishInfo();
+  }
   return {
     stateDir,
     seenPaths: daemon.seenPaths,
 
@@ -157,6 +157,13 @@ export async function ensureDaemon(settings: DaemonClientSettings): Promise<Ensu
     return await ensureRemoteDaemon(settings);
   }
 
+  const ensured = await ensureLocalDaemon(settings);
+  // Checked on both branches: a startup can resolve to a daemon another caller raced in.
+  await assertDaemonPolicyMatches(ensured.info, settings.paths.baseDir);
+  return ensured;
+}
+
+async function ensureLocalDaemon(settings: DaemonClientSettings): Promise<EnsuredDaemon> {
   const reusable = await readReusableLocalDaemon(settings);
   if (reusable) return { info: reusable, startedByClient: false };
 
@@ -194,10 +201,7 @@ async function readReusableLocalDaemon(settings: DaemonClientSettings): Promise<
     onAnyAdvertisedTransport: async () =>
       viaClientTransport || (await canConnectReusableDaemon(existing, 'auto')),
   });
-  if (decision.kind === 'reuse') {
-    await assertReusableDaemonPolicy(existing, settings.paths.baseDir);
-    return existing;
-  }
+  if (decision.kind === 'reuse') return existing;
   if (decision.kind === 'refuseNewer') {
     throw newerDaemonRefusedError(existing, decision, settings.paths.baseDir);
   }
@@ -209,10 +213,10 @@ async function readReusableLocalDaemon(settings: DaemonClientSettings): Promise<
 }
 
 /**
- * ADR 0029: a caller that names a daemon policy must not silently reuse a daemon that enforces a
- * different one (or none). A caller that names no policy reuses whatever the daemon enforces.
+ * ADR 0029: a caller that names a daemon policy must not silently use a daemon that enforces a
+ * different one (or none). A caller that names no policy uses whatever the daemon enforces.
  */
-async function assertReusableDaemonPolicy(existing: DaemonInfo, stateDir: string): Promise<void> {
+async function assertDaemonPolicyMatches(existing: DaemonInfo, stateDir: string): Promise<void> {
   if (!process.env.AGENT_DEVICE_DAEMON_POLICY?.trim()) return;
   const { loadDaemonPolicy } = await import('../daemon-policy-file.ts');
   const expected = loadDaemonPolicy(process.env)?.digest;
 
@@ -29,7 +29,7 @@ const DESCRIPTORS = commandDescriptors as readonly CommandDescriptor[];
 
 /**
  * Derived from the registry (catalog group plus platform execution). Internal daemon commands with
- * no platform execution — leases, takeover, session bookkeeping — are protocol plumbing that no
+ * no platform execution — leases, `human_control`, session bookkeeping — are protocol plumbing that no
  * command rule decides. Every other command a request names is decided by command rules, including
  * a name the registry does not know, so an allow list fails closed.
  */
@@ -43,7 +43,7 @@ const PROTOCOL_COMMANDS: ReadonlySet<string> = new Set(
 );
 
 /**
- * The names a policy may use: public commands, and internal commands that execute on a device,
+ * The names a policy may use: public commands, and internal commands with platform execution,
  * each by the public command it serves (`install_source` as `install-from-source`) or else by its
  * own name (`runtime`).
  */
 
@@ -228,34 +228,42 @@ test('a provider answering with only out-of-scope devices does not hide allowed
 
 test('an allow list denies the internal runtime command unless it names runtime', async () => {
   const { handler, bind } = makeHandler(policy({ commands: { allow: ['snapshot'] } }));
+  const runtimeClear = request('runtime', { positionals: ['clear'] });
 
-  const response = await handler(request('runtime', { positionals: ['clear'] }));
+  const response = await handler(runtimeClear);
 
   expectPolicyDenied(response, 'command');
   expect(response).toMatchObject({ error: { details: { command: 'runtime' } } });
   expect(bind).not.toHaveBeenCalled();
+  expect(deniedCommand(policy({ commands: { allow: ['runtime'] } }), runtimeClear)).toBeUndefined();
 });
 
 test('command rules name internal device commands the registry way', () => {
   const denyRuntime = policy({ commands: { deny: ['runtime', 'install-from-source'] } });
   const allowSnapshot = policy({ commands: { allow: ['snapshot'] } });
 
-  expect(() => assertDaemonPolicyAdmitsRequest(denyRuntime, request('runtime'))).toThrow(
-    /denies the runtime command/,
-  );
-  expect(() => assertDaemonPolicyAdmitsRequest(denyRuntime, request('install_source'))).toThrow(
-    /denies the install-from-source command/,
-  );
+  expect(deniedCommand(denyRuntime, request('runtime'))).toBe('runtime');
+  expect(deniedCommand(denyRuntime, request('install_source'))).toBe('install-from-source');
   // Protocol plumbing (leases, session bookkeeping) is never decided by command rules.
-  expect(() =>
-    assertDaemonPolicyAdmitsRequest(allowSnapshot, request('lease_heartbeat')),
-  ).not.toThrow();
+  expect(deniedCommand(allowSnapshot, request('lease_heartbeat'))).toBeUndefined();
   // A name the registry does not know fails closed under an allow list.
-  expect(() => assertDaemonPolicyAdmitsRequest(allowSnapshot, request('not-a-command'))).toThrow(
-    /denies the not-a-command command/,
-  );
+  expect(deniedCommand(allowSnapshot, request('not-a-command'))).toBe('not-a-command');
 });
 
+/** The command a policy denial names, or undefined when the policy admits the request. */
+function deniedCommand(daemonPolicy: ReturnType<typeof policy>, req: DaemonRequest) {
+  try {
+    assertDaemonPolicyAdmitsRequest(daemonPolicy, req);
+    return undefined;
+  } catch (error) {
+    expect(error).toMatchObject({
+      code: 'UNAUTHORIZED',
+      details: { reason: 'DAEMON_POLICY_DENIED', rule: 'command' },
+    });
+    return (error as { details: { command: string } }).details.command;
+  }
+}
+
 test('doctor counts only the devices the policy allows', async () => {
   const { handler } = makeHandler(policy({ devices: { allow: [{ udid: IOS_SIMULATOR.id }] } }), {
     inventory: [IOS_SIMULATOR, OTHER_SIMULATOR],