@@ -214,17 +214,29 @@ public enum SnapshotGeometrySpace: Equatable {
   /// two spaces instead of letting rects under those hosts read as addresses (#2612).
   public static func unplacedSurfaceHostCount(in nodes: [RawAXNode], viewport: CGRect) -> Int {
     guard isPlottable(viewport) else { return 0 }
-    var count = 0
-    for node in nodes {
+    // `parentIndex` is a position into this array: every producer appends nodes in traversal order
+    // with `index == nodes.count` and sets a child's `parentIndex` to the parent's index, so
+    // `nodes[parentIndex]` is that parent. A turned host is one surface even when both its window
+    // and the surface directly under it report the turned box, so a turned node whose parent is
+    // itself turned is folded into that parent rather than counted a second time.
+    func turnedFrame(_ node: RawAXNode) -> Bool {
       let parentIsWindow = node.parentIndex.map { index in
         nodes.indices.contains(index) && isWindowType(nodes[index].type)
       } ?? false
       guard isSurfaceHost(isWindow: isWindowType(node.type), parentIsWindow: parentIsWindow)
-      else { continue }
-      let frame = CGRect(
-        x: node.rect.x, y: node.rect.y, width: node.rect.width, height: node.rect.height
+      else { return false }
+      return isQuarterTurned(
+        CGRect(x: node.rect.x, y: node.rect.y, width: node.rect.width, height: node.rect.height),
+        relativeTo: viewport
       )
-      if isQuarterTurned(frame, relativeTo: viewport) { count += 1 }
+    }
+    var count = 0
+    for node in nodes {
+      guard turnedFrame(node) else { continue }
+      let parentTurned = node.parentIndex.map { index in
+        nodes.indices.contains(index) && turnedFrame(nodes[index])
+      } ?? false
+      if !parentTurned { count += 1 }
     }
     return count
   }
 
@@ -355,6 +355,16 @@ final class CoordinateSpaceTests: XCTestCase {
     ]
     XCTAssertEqual(SnapshotGeometrySpace.unplacedSurfaceHostCount(in: deep, viewport: viewport), 0)
     XCTAssertEqual(SnapshotGeometrySpace.unplacedSurfaceHostCount(in: unplaced, viewport: .infinite), 0)
+
+    // One turned surface is one host even when the window AND the surface under it both report the
+    // turned box: the child folds into the turned window rather than counting a second time.
+    let bothTurned = [
+      node(0, type: "Application", rect: SnapshotRect(x: 0, y: 0, width: 874, height: 402), parent: nil),
+      node(1, type: "Window", rect: SnapshotRect(x: 0, y: 0, width: 402, height: 874), parent: 0),
+      node(2, type: "Other", rect: SnapshotRect(x: 0, y: 0, width: 402, height: 874), parent: 1),
+      node(3, type: "Key", rect: SnapshotRect(x: 154, y: 77, width: 45, height: 72), parent: 2),
+    ]
+    XCTAssertEqual(SnapshotGeometrySpace.unplacedSurfaceHostCount(in: bothTurned, viewport: viewport), 1)
   }
 
   /// Golden parity table (#2612): every case in contracts/fixtures/window-coordinate-space.json
 
@@ -0,0 +1,21 @@
+import assert from 'node:assert/strict';
+import { test } from 'vitest';
+import { snapshotSourceCaptureError, snapshotSourceError } from './errors.ts';
+
+// The scope decides whether the route retires the app generation from the bridge, so it is a
+// required constructor argument (no default): a failure cannot be built without naming its side of
+// the rule. These two factories are the only constructors, and each names its scope.
+test('snapshotSourceError is evidence about the app generation', () => {
+  const error = snapshotSourceError('transport-failure', 'bridge-disconnected');
+  assert.equal(error.failureScope, 'generation');
+});
+
+test('snapshotSourceCaptureError is evidence about this capture only', () => {
+  const preparing = snapshotSourceCaptureError('preparing', 'bridge-preparation-pending');
+  assert.equal(preparing.failureScope, 'capture');
+  const rotated = snapshotSourceCaptureError('unsupported', 'window-coordinate-space-unresolved', {
+    windows: 1,
+  });
+  assert.equal(rotated.failureScope, 'capture');
+  assert.equal(rotated.details?.windows, 1);
+});
@@ -20,10 +20,10 @@ export class SnapshotSourceError extends AppError {
   constructor(
     kind: SnapshotSourceFailureKind,
     code: string,
+    scope: SnapshotSourceFailureScope,
     message = `iOS Simulator snapshot source ${kind}: ${code}`,
     details: Readonly<Record<string, unknown>> = {},
     cause?: unknown,
-    scope: SnapshotSourceFailureScope = 'generation',
   ) {
     super(
       APP_ERROR_CODE_BY_KIND[kind],
@@ -50,7 +50,7 @@ export function snapshotSourceError(
   details: Readonly<Record<string, unknown>> = {},
   cause?: unknown,
 ): SnapshotSourceError {
-  return new SnapshotSourceError(kind, code, undefined, details, cause);
+  return new SnapshotSourceError(kind, code, 'generation', undefined, details, cause);
 }
 
 /**
@@ -63,7 +63,7 @@ export function snapshotSourceCaptureError(
   code: string,
   details: Readonly<Record<string, unknown>> = {},
 ): SnapshotSourceError {
-  return new SnapshotSourceError(kind, code, undefined, details, undefined, 'capture');
+  return new SnapshotSourceError(kind, code, 'capture', undefined, details);
 }
 
 export function asSnapshotSourceError(error: unknown): SnapshotSourceError {