@@ -15,3 +15,7 @@
 #if __has_include("UnitTests/RunnerEdgeContactTesting.h")
 #import "UnitTests/RunnerEdgeContactTesting.h"
 #endif
+
+#if __has_include("UnitTests/RunnerSnapshotBridgeTesting.h")
+#import "UnitTests/RunnerSnapshotBridgeTesting.h"
+#endif
@@ -209,13 +209,14 @@ @implementation RunnerSnapshotBridgeAnswer
 /// is abandoned, not stopped: its answer is dropped when it returns.
 static NSDictionary *RunnerSnapshotBridgeRead(NSDictionary *request,
                                               NSUInteger budgetMs,
-                                              NSDictionary * (^read)(void))
+                                              NSDictionary * (^read)(void),
+                                              NSTimeInterval (^clock)(void))
 {
   NSUInteger sequence;
   @synchronized (RunnerSnapshotBridgeAnswer.class) {
     if (RunnerSnapshotBridgeReadsInFlight) {
       BOOL wedged = RunnerSnapshotBridgeAbandonedAt > 0 &&
-        NSProcessInfo.processInfo.systemUptime - RunnerSnapshotBridgeAbandonedAt >= RunnerSnapshotBridgeWedgeSeconds;
+        clock() - RunnerSnapshotBridgeAbandonedAt >= RunnerSnapshotBridgeWedgeSeconds;
       return RunnerSnapshotBridgeFailure(request, @"application_not_responding",
                                          wedged ? @"bridge-reader-wedged" : @"bridge-read-in-flight",
                                          @"another accessibility read has not returned yet");
@@ -242,7 +243,7 @@ @implementation RunnerSnapshotBridgeAnswer
   if (dispatch_semaphore_wait(done, dispatch_time(DISPATCH_TIME_NOW, (int64_t)budgetMs * NSEC_PER_MSEC)) != 0) {
     @synchronized (RunnerSnapshotBridgeAnswer.class) {
       if (RunnerSnapshotBridgeReadsInFlight && RunnerSnapshotBridgeReadSequence == sequence) {
-        RunnerSnapshotBridgeAbandonedAt = NSProcessInfo.processInfo.systemUptime;
+        RunnerSnapshotBridgeAbandonedAt = clock();
       }
     }
     return RunnerSnapshotBridgeFailure(request, @"application_not_responding", @"bridge-read-abandoned",
@@ -251,6 +252,18 @@ @implementation RunnerSnapshotBridgeAnswer
   return answer.value;
 }
 
+#if defined(AGENT_DEVICE_RUNNER_UNIT_TESTS)
+NSDictionary *RunnerSnapshotBridgeReadForTest(NSDictionary *request, NSUInteger budgetMs,
+                                               NSDictionary *(^read)(void), NSTimeInterval now)
+{
+  return RunnerSnapshotBridgeRead(request, budgetMs, read, ^{ return now; });
+}
+void RunnerSnapshotBridgeDrainForTest(void)
+{
+  dispatch_sync(RunnerSnapshotBridgeReaderQueue(), ^{});
+}
+#endif
+
 uint32_t RunnerSnapshotBridgeMaximumFrameBytes(void)
 {
   return kMaximumFrameBytes;
@@ -266,12 +279,12 @@ uint32_t RunnerSnapshotBridgeMaximumFrameBytes(void)
   if ([verb isEqualToString:@"target"]) {
     return RunnerSnapshotBridgeRead(request, RunnerSnapshotBridgeBudgetMs(request), ^{
       return RunnerSnapshotBridgeTarget(bundleId, request);
-    });
+    }, ^{ return NSProcessInfo.processInfo.systemUptime; });
   }
   if ([verb isEqualToString:@"describe"]) {
     return RunnerSnapshotBridgeRead(request, RunnerSnapshotBridgeBudgetMs(request), ^{
       return RunnerSnapshotBridgeDescribe(bundleId, request);
-    });
+    }, ^{ return NSProcessInfo.processInfo.systemUptime; });
   }
   return RunnerSnapshotBridgeFailure(request, @"bad_request", @"verb-not-supported",
                                      @"the runner snapshot bridge accepts target and describe requests only");
 
@@ -0,0 +1,9 @@
+#import <Foundation/Foundation.h>
+#import <TargetConditionals.h>
+NS_ASSUME_NONNULL_BEGIN
+#if TARGET_OS_IOS && TARGET_OS_SIMULATOR
+NSDictionary *RunnerSnapshotBridgeReadForTest(NSDictionary *request, NSUInteger budgetMs,
+                                               NSDictionary *(^read)(void), NSTimeInterval now);
+void RunnerSnapshotBridgeDrainForTest(void);
+#endif
+NS_ASSUME_NONNULL_END
@@ -66,6 +66,24 @@ extension RunnerTests {
     let named = Self.snapshotBridgeReaderRequest(payload, simulatorUdid: "SIM")
     XCTAssertEqual(named["simulatorUdid"] as? String, "SIM")
   }
+  func testAbandonedReadBecomesWedgedUntilItReturns() {
+    let release = DispatchSemaphore(value: 0)
+    let request = ["requestId": "wedge"]
+    let first = RunnerSnapshotBridgeReadForTest(request, 100, {
+      release.wait()
+      return ["ok": true]
+    }, 10)
+    XCTAssertEqual(first["error_code"] as? String, "bridge-read-abandoned")
+    let busy = RunnerSnapshotBridgeReadForTest(request, 100, { ["ok": true] }, 14.999)
+    XCTAssertEqual(busy["error_code"] as? String, "bridge-read-in-flight")
+    let wedged = RunnerSnapshotBridgeReadForTest(request, 100, { ["ok": true] }, 15)
+    XCTAssertEqual(wedged["error_code"] as? String, "bridge-reader-wedged")
+    release.signal()
+    RunnerSnapshotBridgeDrainForTest()
+    let admitted = RunnerSnapshotBridgeReadForTest(request, 1000, { ["ok": true] }, 16)
+    XCTAssertEqual(admitted["ok"] as? Bool, true)
+  }
+
   func testReaderDoesNotRefuseTheBoundsOfAFirstRead() throws {
     var request = Self.snapshotBridgeReaderRequest(try firstReadPayload())
     request["pid"] = 1
 
@@ -60,7 +60,6 @@ export function createAppleRunnerRuntime(options: {
   // the foreground read starts a runner that is not up yet, under the capture's own budget, instead
   // of giving up the proof that keeps the capture on the bridge.
   let snapshotRoute: SnapshotBridgeRoute | undefined;
-  let runnerSessionId: string | undefined;
   const readForeground = createSystemSurfaceForegroundProbe(async (device, input) => {
     if (!options.provider.hasLiveSession(device)) {
       try {
@@ -76,11 +75,6 @@ export function createAppleRunnerRuntime(options: {
     }
     const session = readRunnerSessionLiveness(device.id);
     if (session?.liveness !== 'ready') return undefined;
-    if (runnerSessionId !== undefined && runnerSessionId !== session.sessionId) {
-      bridge.resetTargets();
-      snapshotRoute?.resetRunnerSession();
-    }
-    runnerSessionId = session.sessionId;
     return { sessionId: session.sessionId };
   });
   /**
@@ -102,6 +96,7 @@ export function createAppleRunnerRuntime(options: {
         // The runner answers the target read itself; there is no detached discovery to wait on.
         isDiscoveryPending: () => false,
         targetFreshness: 'cached',
+        sessionChanged: bridge.resetTargets,
       },
       async (device, input) =>
         await withAppleRunnerProvider(
 
@@ -495,15 +495,20 @@ test('a wedged runner retires the bridge for the session across captures and app
   const { snapshot, fallbacks } = runtimeSnapshots(withHostStates(provider, 'notRunning'));
   await snapshot();
   state.refuseTarget = 'bridge-reader-wedged';
-  await snapshot();
+  const wedged = await snapshot();
   state.process = { pid: 77, processStartTime: '1700000100.000002' };
-  await snapshot();
-  await snapshot();
+  const later = await snapshot();
+  const last = await snapshot();
+  for (const result of [wedged, later, last]) {
+    expect(result.warnings).toEqual([
+      'Simulator AX snapshot unavailable (bridge-reader-wedged); used XCTest for this runner session.',
+    ]);
+  }
   expect(verbs(sent)).toEqual(['target', 'describe', 'target']);
   expect(fallbacks).toHaveLength(4);
 });
 
-test('a never-returning read costs one wedged refusal after the runner bound', async () => {
+test('a wedged refusal retires the session after a held read', async () => {
   const state: {
     process: RunnerProcess;
     holdNextDescribe?: Promise<void>;
@@ -545,3 +550,102 @@ test('a replacement runner retries a generation retired by the previous runner o
   expect(verbs(sent)).toEqual(['target', 'describe', 'describe']);
   expect(presented).toHaveLength(2);
 });
+
+test('a late presentation failure cannot retire the replacement session generation', async () => {
+  const state = { process: { pid: 41, processStartTime: '1700000000.000001' } };
+  const { provider, sent } = bridgeRunner(state);
+  const bridge = createRunnerSnapshotBridge({ device: IOS_SIMULATOR, provider });
+  let sessionId = 'first';
+  let release!: () => void;
+  let entered!: () => void;
+  const blocked = new Promise<void>((resolve) => {
+    release = resolve;
+  });
+  const presenting = new Promise<void>((resolve) => {
+    entered = resolve;
+  });
+  let presentationCount = 0;
+  const route = createSnapshotBridgeRoute(
+    {
+      snapshot: {
+        presentIosAcquisition: async (result) => {
+          if (++presentationCount === 1) {
+            entered();
+            await blocked;
+            throw new Error('old presentation failed');
+          }
+          return { ...runnerResult(), producer: result.acquisition.producer };
+        },
+      },
+      appleApplications: { hasLiveRunnerSession: async () => true },
+    },
+    {
+      source: bridge.source,
+      resolveTarget: bridge.resolveTarget,
+      isDiscoveryPending: () => false,
+      targetFreshness: 'cached',
+      sessionChanged: bridge.resetTargets,
+    },
+    async () => ({ foreground: 'background', sessionId }),
+  );
+  const snapshot = () =>
+    route.capture(
+      IOS_SIMULATOR,
+      { options: { appBundleId: APP, interactiveOnly: true } },
+      new AbortController().signal,
+      async () => runnerResult(),
+    );
+  const old = snapshot();
+  await presenting;
+  sessionId = 'second';
+  expect((await snapshot()).producer).toBe('simulator-ax-bridge');
+  release();
+  expect((await old).warnings).toContain(
+    'Simulator AX snapshot unavailable (presentation-invariant); used XCTest for this app generation.',
+  );
+  expect((await snapshot()).producer).toBe('simulator-ax-bridge');
+  expect(verbs(sent)).toEqual(['target', 'describe', 'target', 'describe', 'describe']);
+});
+
+test('a wedge before the runner id is known does not disable a newly identified session', async () => {
+  const state: { process: RunnerProcess; refuseTarget?: string } = {
+    process: { pid: 41, processStartTime: '1700000000.000001' },
+    refuseTarget: 'bridge-reader-wedged',
+  };
+  const { provider, sent } = bridgeRunner(state);
+  const bridge = createRunnerSnapshotBridge({ device: IOS_SIMULATOR, provider });
+  let sessionId: string | undefined = undefined;
+  const route = createSnapshotBridgeRoute(
+    {
+      snapshot: {
+        presentIosAcquisition: (result) => ({
+          ...runnerResult(),
+          producer: result.acquisition.producer,
+        }),
+      },
+      appleApplications: { hasLiveRunnerSession: async () => true },
+    },
+    {
+      source: bridge.source,
+      resolveTarget: bridge.resolveTarget,
+      isDiscoveryPending: () => false,
+      targetFreshness: 'cached',
+      sessionChanged: bridge.resetTargets,
+    },
+    async () => (sessionId ? { foreground: 'background', sessionId } : 'background'),
+  );
+  const snapshot = () =>
+    route.capture(
+      IOS_SIMULATOR,
+      { options: { appBundleId: APP, interactiveOnly: true } },
+      new AbortController().signal,
+      async () => runnerResult(),
+    );
+  expect((await snapshot()).warnings).toEqual([
+    'Simulator AX snapshot unavailable (bridge-reader-wedged); used XCTest for this runner session.',
+  ]);
+  sessionId = 'new';
+  state.refuseTarget = undefined;
+  expect((await snapshot()).producer).toBe('simulator-ax-bridge');
+  expect(verbs(sent)).toEqual(['target', 'target', 'describe']);
+});
@@ -60,8 +60,7 @@ export type RunnerSnapshotBridge = Readonly<{
 export function createRunnerSnapshotBridge(
   options: Readonly<{ device: DeviceInfo; provider: AppleRunnerProvider }>,
 ): RunnerSnapshotBridge {
-  const targets = new Map<string, RunnerSnapshotBridgeTarget>();
-  let targetEpoch = 0;
+  let targets = new Map<string, RunnerSnapshotBridgeTarget>();
   // The runner admits one bridge read at a time and refuses an overlapping one at once, so it alone
   // owns that order: a read a cancelled capture left running costs the next capture its bridge read,
   // and the route answers that refusal for that capture only.
@@ -95,7 +94,7 @@ export function createRunnerSnapshotBridge(
     if (cached && refresh !== 'refresh') return cached;
     // Only a resolved target replaces the cached one: a refresh that fails leaves the generation the
     // route planned against.
-    const epoch = targetEpoch;
+    const captureTargets = targets;
     const requestId = randomUUID();
     const envelope = await send(
       appBundleId,
@@ -107,7 +106,7 @@ export function createRunnerSnapshotBridge(
       AbortSignal.any([signal, AbortSignal.timeout(TARGET_READ_TIMEOUT_MS)]),
     );
     const target = readTarget(envelope, { requestId, appBundleId, targetId });
-    if (epoch === targetEpoch) targets.set(targetId, target);
+    captureTargets.set(targetId, target);
     return target;
   };
 
@@ -165,8 +164,7 @@ export function createRunnerSnapshotBridge(
     source,
     resolveTarget,
     resetTargets: () => {
-      targetEpoch++;
-      targets.clear();
+      targets = new Map();
     },
   };
 }
 
@@ -27,7 +27,7 @@ export type SurfaceHostRefusal = IosSystemSurfaceHost | 'unverified';
 
 /**
  * The one classification a bridge failure receives before the route acts on it. `code` travels
- * unchanged for diagnostics; the scope says whether the generation is implicated, and a
+ * unchanged for diagnostics; the scope identifies the capture, generation, or runner session, and a
  * capture-scoped verdict must name what it saw instead. A surface host refusal names the host, and
  * the route serves it from the runner before any fallback warning applies.
  */
@@ -68,15 +68,17 @@ const CAPTURE_SCOPED_REFUSALS: ReadonlyMap<string, CaptureScopedConsequence> = n
   ['snapshot-tree-changed', 'tree-changed'],
 ]);
 
+const RUNNER_SESSION_SCOPED: ReadonlySet<string> = new Set(['bridge-reader-wedged']);
+
 /**
  * Whether a bridge failure is evidence that this app generation cannot be served by the bridge.
- * The preparation and the table's screen refusals speak for this capture only; every other failure
- * retires the generation. That default is conservative on purpose: `code` is an open string from
+ * Preparation and screen refusals speak for this capture; a wedged reader retires its runner
+ * session. Other failures retire the generation. That default is conservative on purpose: `code` is an open string from
  * the guest, and an unknown code must not quietly keep a generation on a path that just refused
  * it. Do not widen the default; classify a new known refusal in the table.
  */
 export function bridgeFailureDisposition(failure: SnapshotSourceFailure): BridgeFailureDisposition {
-  if (failure.code === 'bridge-reader-wedged') {
+  if (RUNNER_SESSION_SCOPED.has(failure.code)) {
     return { scope: 'runner-session', code: failure.code };
   }
   if (failure.kind === 'preparing') {