@@ -68,15 +68,15 @@ compatibility.
 
 ### Frame transitions
 
-| Event | Frame transition | Plain refs | Pinned refs |
-| --- | --- | --- | --- |
-| Internal observation that returns no refs | None | Unchanged | Unchanged |
-| Complete frame activation | New active epoch, scope `all` | Accepted from this frame | Accepted when epoch matches |
-| Non-empty partial publication | New active epoch, scope = emitted refs | Rejected | Accepted only for an emitted ref at this epoch |
-| First possible device-side effect | Advance once to `expired` | Rejected | Previous epoch rejected |
-| Additional effects while already expired | Idempotent | Rejected | Rejected |
-| Sparse, failed, or unusable capture | None | Unchanged | Unchanged |
-| Session reopen | New random-seeded lifetime | Rejected until publication | Old lifetime rejected probabilistically as today |
+| Event                                     | Frame transition                       | Plain refs                 | Pinned refs                                      |
+| ----------------------------------------- | -------------------------------------- | -------------------------- | ------------------------------------------------ |
+| Internal observation that returns no refs | None                                   | Unchanged                  | Unchanged                                        |
+| Complete frame activation                 | New active epoch, scope `all`          | Accepted from this frame   | Accepted when epoch matches                      |
+| Non-empty partial publication             | New active epoch, scope = emitted refs | Rejected                   | Accepted only for an emitted ref at this epoch   |
+| First possible device-side effect         | Advance once to `expired`              | Rejected                   | Previous epoch rejected                          |
+| Additional effects while already expired  | Idempotent                             | Rejected                   | Rejected                                         |
+| Sparse, failed, or unusable capture       | None                                   | Unchanged                  | Unchanged                                        |
+| Session reopen                            | New random-seeded lifetime             | Rejected until publication | Old lifetime rejected probabilistically as today |
 
 A complete activation normally accompanies a command result that exposes the complete ref namespace
 for the stored frame, including an interactive or intentionally scoped snapshot. An intentionally
@@ -209,9 +209,7 @@ The command descriptor's daemon facet declares a request policy:
 ```ts
 type RefFrameEffect = 'preserve' | 'may-invalidate' | 'delegated';
 
-type DaemonRefFrameEffect =
-  | RefFrameEffect
-  | ((request: DaemonRequest) => RefFrameEffect);
+type DaemonRefFrameEffect = RefFrameEffect | ((request: DaemonRequest) => RefFrameEffect);
 ```
 
 The daemon registry exposes a named resolver. Every daemon command is classified, but the
@@ -223,12 +221,12 @@ resolver rather than pretending all subcommands behave alike.
 The registry is the exhaustive source of truth. The following table is non-exhaustive guidance for
 classifying representative actions; it must not become a second prose registry:
 
-| Effect | Commands/actions |
-| --- | --- |
-| `may-invalidate` | press, click, fill, longpress, type, focus, scroll, swipe, gesture, back, home, `tv-remote`, rotate, open/relaunch, trigger/push delivery, settings changes, install/reinstall, React Native overlay dismissal, and lifecycle operations that can replace the visible surface |
-| Conditional resolver | keyboard status preserves while dismiss/return/input invalidate; alert get/wait preserve while accept/dismiss invalidate; find reads preserve while click/fill/focus/type delegate to their leaf mutation |
-| `delegated` | batch, replay, and test/suite orchestrators; each nested leaf owns its transition |
-| `preserve` | snapshots and other observation, assertion, screenshot, recording, trace, logs, events, network inspection, performance, inventory, capability, lease, and transport-management operations unless a selected subaction directly manipulates the visible surface |
+| Effect               | Commands/actions                                                                                                                                                                                                                                                              |
+| -------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `may-invalidate`     | press, click, fill, longpress, type, focus, scroll, swipe, gesture, back, home, `tv-remote`, rotate, open/relaunch, trigger/push delivery, settings changes, install/reinstall, React Native overlay dismissal, and lifecycle operations that can replace the visible surface |
+| Conditional resolver | keyboard status preserves while dismiss/return/input invalidate; alert get/wait preserve while accept/dismiss invalidate; find reads preserve while click/fill/focus/type delegate to their leaf mutation                                                                     |
+| `delegated`          | batch, replay, and test/suite orchestrators; each nested leaf owns its transition                                                                                                                                                                                             |
+| `preserve`           | snapshots and other observation, assertion, screenshot, recording, trace, logs, events, network inspection, performance, inventory, capability, lease, and transport-management operations unless a selected subaction directly manipulates the visible surface               |
 
 Clipboard reads and writes preserve the frame because pasteboard state alone does not change element
 identity. A later paste/type action is independently invalidating.
@@ -444,9 +442,14 @@ complete daemon classification and gate (2), the pre-side-effect seam at every l
 complete/partial publication with bounded scope, MCP pin retention, and pinned partial CLI text (4),
 Android freshness decoupled from positional ref authorization (5), the cross-platform contract and
 provider evidence (6), and fail-closed admission enforcement across platforms with typed reasons (7).
-Per-platform enablement is confirmed by the live-evidence runs required above; step 8's removal of the
-superseded coarse `snapshotRefsStale` marker follows that confirmation so read-only warnings are not
-disturbed before enforcement is proven on hardware.
+Fresh live evidence has exercised most production seams — Apple runtime-ref, direct/native selector,
+generation-pin, generic, and lifecycle paths, plus Android helper freshness (including proven
+non-retarget) and Android existing-session relaunch. Two seams remain UNEXERCISED and are therefore
+explicit release blockers, not confirmed enablement: Android blocking-dialog recovery, and a real
+provider-backed interaction plus provider-backed lifecycle operation. Enforcement stays enabled in
+code, but those two seams are not claimed as verified until their live runs exist. Step 8's removal of
+the superseded coarse `snapshotRefsStale` marker follows full confirmation, so read-only warnings are
+not disturbed before every enabled seam is proven on hardware.
 
 PR #1241 landed independently as a compatible transitional fix. It rejects a known iOS stale-marker
 case before this full lifecycle is implemented; it does not own the architecture migration.
 
@@ -883,6 +883,24 @@ test('client capture.snapshot preserves visibility metadata from daemon response
   });
 });
 
+test('client capture.snapshot preserves refsGeneration from daemon responses (ADR 0014)', async () => {
+  const setup = createTransport(async () => ({
+    ok: true,
+    data: {
+      nodes: [{ ref: 'e1', index: 0, depth: 0, type: 'Button', label: 'Go' }],
+      truncated: false,
+      refsGeneration: 752890,
+    },
+  }));
+  const client = createAgentDeviceClient(setup.config, { transport: setup.transport });
+
+  const result = await client.capture.snapshot();
+
+  // Node.js callers must retain the response-level generation to pin a plain ref
+  // (`@e1~s752890`) before a mutation.
+  assert.equal(result.refsGeneration, 752890);
+});
+
 test('client capture.snapshot preserves snapshot quality annotation from daemon responses', async () => {
   const snapshotQuality = {
     state: 'recovered',
 
@@ -499,6 +499,7 @@ function optionalSnapshotResponseFields(
     | 'warnings'
     | 'snapshotQuality'
     | 'snapshotDiagnostics'
+    | 'refsGeneration'
   >
 > {
   const visibility = readObject(data.visibility);
@@ -509,6 +510,9 @@ function optionalSnapshotResponseFields(
     ...readSerializedSnapshotCaptureAnnotations(data),
     ...(unchanged ? { unchanged: unchanged as CaptureSnapshotResult['unchanged'] } : {}),
     ...(snapshotDiagnostics ? { snapshotDiagnostics } : {}),
+    // ADR 0014: keep the response-level ref-frame generation on Node.js results
+    // so callers can pin refs (`@e12~s<refsGeneration>`) before a mutation.
+    ...(typeof data.refsGeneration === 'number' ? { refsGeneration: data.refsGeneration } : {}),
   };
 }
 
 
@@ -447,6 +447,12 @@ export type CaptureSnapshotResult = {
   unchanged?: SnapshotUnchanged;
   snapshotDiagnostics?: SnapshotDiagnosticsSummary;
   identifiers: AgentDeviceIdentifiers;
+  /**
+   * ADR 0014: the response-level ref-frame epoch the plain node refs were minted
+   * from. A ref-issuing snapshot carries it ONCE (nodes stay plain `@e12` for the
+   * token budget); pair a ref with it (`@e12~s<refsGeneration>`) before a mutation.
+   */
+  refsGeneration?: number;
 } & PublicSnapshotCaptureAnnotations;
 
 export type CaptureScreenshotOptions = AgentDeviceRequestOverrides & {
 
@@ -131,6 +131,19 @@ test('serializeSnapshotResult includes Android backend metadata', () => {
   });
 });
 
+test('serializeSnapshotResult preserves the response-level refsGeneration (ADR 0014)', () => {
+  const data = serializeSnapshotResult({
+    nodes: [{ ref: 'e1', index: 0, depth: 0, type: 'Button', label: 'Go' }],
+    truncated: false,
+    refsGeneration: 752890,
+    identifiers: { session: 'qa' },
+  } as Parameters<typeof serializeSnapshotResult>[0]);
+
+  assert.equal(data.refsGeneration, 752890);
+  // The node tree stays plain — the generation rides once at the response level.
+  assert.equal((data.nodes as Array<{ ref?: string }>)[0]?.ref, 'e1');
+});
+
 test('serializeSnapshotResult maps capture quality annotation to public snapshotQuality', () => {
   const snapshotQuality = {
     state: 'healthy',
 
@@ -182,6 +182,9 @@ export function serializeSnapshotResult(result: CaptureSnapshotResult): Record<s
     ...publicSnapshotCaptureAnnotations(snapshotResultAnnotations(result)),
     ...(result.unchanged ? { unchanged: result.unchanged } : {}),
     ...(result.snapshotDiagnostics ? { snapshotDiagnostics: result.snapshotDiagnostics } : {}),
+    // ADR 0014: a ref-issuing snapshot retains its response-level generation so
+    // JSON callers can pair a plain `@e12` with `~s<refsGeneration>` before a mutation.
+    ...(result.refsGeneration !== undefined ? { refsGeneration: result.refsGeneration } : {}),
   };
 }
 
 
@@ -0,0 +1,96 @@
+import { test, expect, vi, beforeEach } from 'vitest';
+
+// ADR 0014 (evidence #13): Android blocking-dialog recovery is device-mutating
+// and expires the frame at its own seam. A ref action admitted against the
+// pre-recovery frame must ABORT after recovery mutates — it cannot continue
+// against the recovered UI — and the rejection must use the SHARED admission
+// shape (reason + ref + currentGeneration + scope), not a bespoke error.
+
+vi.mock('../../../core/dispatch.ts', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('../../../core/dispatch.ts')>();
+  return { ...actual, dispatchCommand: vi.fn(async () => ({})) };
+});
+
+vi.mock('../interaction-snapshot.ts', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('../interaction-snapshot.ts')>();
+  return {
+    ...actual,
+    captureSnapshotForSession: vi.fn(async () => ({ nodes: [], createdAt: 0, backend: 'android' })),
+  };
+});
+
+// Simulate recovery: the before-command readiness check taps a blocking dialog
+// (a device mutation) and reports `recovered`, expiring the frame.
+vi.mock('../../android-system-dialog.ts', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('../../android-system-dialog.ts')>();
+  const { expireRefFrame } = await import('../../ref-frame.ts');
+  return {
+    ...actual,
+    ensureAndroidBlockingSystemDialogReady: vi.fn(
+      async (params: { session: import('../../types.ts').SessionState; phase: string }) => {
+        if (params.phase === 'before-command') {
+          expireRefFrame(params.session);
+          return { status: 'recovered', warning: 'Recovered from a blocking system dialog' };
+        }
+        return { status: 'clear' };
+      },
+    ),
+  };
+});
+
+import { handleInteractionCommands } from '../interaction.ts';
+import { dispatchCommand } from '../../../core/dispatch.ts';
+import { attachRefs } from '../../../kernel/snapshot.ts';
+import { makeAndroidSession } from '../../../__tests__/test-utils/session-factories.ts';
+import { makeSessionStore } from '../../../__tests__/test-utils/store-factory.ts';
+
+const mockDispatch = vi.mocked(dispatchCommand);
+const contextFromFlags = () => ({});
+
+beforeEach(() => {
+  mockDispatch.mockReset();
+  mockDispatch.mockResolvedValue({});
+});
+
+test('a ref action aborts with the shared ref_frame_expired rejection after Android dialog recovery mutates', async () => {
+  const sessionStore = makeSessionStore();
+  const sessionName = 'android-recovery-abort';
+  const session = makeAndroidSession(sessionName);
+  session.snapshot = {
+    nodes: attachRefs([
+      {
+        index: 0,
+        type: 'android.widget.Button',
+        label: 'Continue',
+        rect: { x: 0, y: 0, width: 80, height: 80 },
+        enabled: true,
+        hittable: true,
+      },
+    ]),
+    createdAt: Date.now(),
+    backend: 'android',
+  };
+  session.snapshotGeneration = 900;
+  // A freshly issued complete frame is active.
+  sessionStore.set(sessionName, session);
+
+  const response = await handleInteractionCommands({
+    req: { token: 't', session: sessionName, command: 'press', positionals: ['@e1'], flags: {} },
+    sessionName,
+    sessionStore,
+    contextFromFlags,
+  });
+
+  expect(response?.ok).toBe(false);
+  if (response && !response.ok) {
+    expect(response.error.code).toBe('COMMAND_FAILED');
+    // The SHARED admission rejection shape — not a bespoke recovery error.
+    const details = response.error.details as Record<string, unknown> | undefined;
+    expect(details?.reason).toBe('ref_frame_expired');
+    expect(details?.ref).toBe('@e1');
+    expect(details?.currentGeneration).toBe(900);
+    expect(details?.scope).toBe('all');
+  }
+  // The outstanding ref action never dispatched a press against the recovered UI.
+  expect(mockDispatch.mock.calls.some((call) => call[1] === 'press')).toBe(false);
+});
@@ -57,6 +57,51 @@ test('open --relaunch closes and reopens active session app', async () => {
   expect(calls[1]).toEqual({ command: 'open', positionals: ['com.example.app'] });
 });
 
+test('open --relaunch leaves the old frame expired when the close dispatch fails after dispatch (ADR 0014)', async () => {
+  const sessionStore = makeSessionStore();
+  const sessionName = 'android-session';
+  sessionStore.set(sessionName, {
+    ...makeSession(sessionName, {
+      platform: 'android',
+      id: 'emulator-5554',
+      name: 'Pixel Emulator',
+      kind: 'emulator',
+      booted: true,
+    }),
+    appName: 'com.example.app',
+    snapshotGeneration: 400,
+  });
+  // A freshly issued frame is active before the relaunch.
+  expect(sessionStore.get(sessionName)?.refFrameState).toBeUndefined();
+
+  // The relaunch close dispatches and then fails/times out AFTER the app may
+  // already have been torn down.
+  mockDispatch.mockImplementation(async (_device, command) => {
+    if (command === 'close') throw new Error('adb: close timed out after dispatch');
+    return {};
+  });
+
+  const response = await handleSessionCommands({
+    req: {
+      token: 't',
+      session: sessionName,
+      command: 'open',
+      positionals: [],
+      flags: { relaunch: true },
+    },
+    sessionName,
+    logPath: path.join(os.tmpdir(), 'daemon.log'),
+    sessionStore,
+    invoke: noopInvoke,
+  }).catch(() => null);
+
+  // Whether the failure surfaced as an error response or a throw, the existing
+  // session's frame was expired BEFORE the close dispatch and stays expired — a
+  // post-dispatch close failure never restores it (there is no rollback).
+  expect(response?.ok ?? false).toBe(false);
+  expect(sessionStore.get(sessionName)?.refFrameState).toBe('expired');
+});
+
 test('open --relaunch on iOS stops runner before close/open', async () => {
   const sessionStore = makeSessionStore();
   const sessionName = 'ios-session';
Original file line number	Diff line number	Diff line change
`@@ -182,6 +182,9 @@ export function serializeSnapshotResult(result: CaptureSnapshotResult): Record<s`
`182`	`182`	`...publicSnapshotCaptureAnnotations(snapshotResultAnnotations(result)),`
`183`	`183`	`...(result.unchanged ? { unchanged: result.unchanged } : {}),`
`184`	`184`	`...(result.snapshotDiagnostics ? { snapshotDiagnostics: result.snapshotDiagnostics } : {}),`
	`185`	`+ // ADR 0014: a ref-issuing snapshot retains its response-level generation so`
	`186`	+ // JSON callers can pair a plain `@e12` with `~s<refsGeneration>` before a mutation.
	`187`	`+ ...(result.refsGeneration !== undefined ? { refsGeneration: result.refsGeneration } : {}),`
`185`	`188`	`};`
`186`	`189`	`}`
`187`	`190`