@@ -41,6 +41,30 @@
   lock-policy caller, the exact audience that avoids naming sessions, would land on the wrong leaf.
   Explicit `--session <name>` is untouched and still addresses one session verbatim.
 
+- Fixed: a `record stop` that could not produce its export no longer destroys what its own retry reads
+  back (#2591). The shared coordinator compensated every failed finish by force-cleaning the resource,
+  which on Android deleted the device-side MP4 and the native manifest the hint just told you to re-pull:
+  the second `record stop` had nothing left to collect and the recording was gone. Each durable kind now
+  declares what its retry needs. `screen-recording` and `perf-capture` preserve, so a failed stop keeps
+  the device artifact, keeps the manifest `open`, returns its own error, and the next `record stop` in
+  that session exports it — proven on an emulator whose `adb pull` failed its first attempts and then
+  exported the 90 KB the first stop left on the device. `app-log` and `audio-probe` say
+  `dispose-on-failed-finish` themselves, because their retries re-read a log file and a status file that
+  cleanup never touches. A finish also states why it was asked for: `capture` may preserve, while
+  `disposal` — session teardown, the one caller that owns forced cleanup — disposes whatever a failed
+  finish left. Two Apple paths had to become genuinely retryable for that to be true: the runner path
+  memoized its refused stop and handed the same rejection to every later `record stop` without asking
+  the runner again, and the simulator path rejected a recording purely because `simctl recordVideo` had
+  exited non-zero — discarding a video the recorder had already written and leaving an exit code no
+  retry could change. A stopped recorder is now an observation rather than a failure: the exit is
+  disclosed on the completion and the file is collected, so those recordings export instead of erroring.
+  Expect one trade: while a preserved recording is open, `record start` on that device is refused until
+  its session runs `record stop` or closes. A simulator recording no retry can rescue now names the
+  exit that made it unreadable — `simctl recordVideo exited with code 1`, `was killed by SIGKILL`, plus
+  the recorder's stderr — drops its retriable flag, and points at closing the session, while a recorder
+  still finalizing its file keeps the retry hint. `perf stop` no longer memoizes a refused finish, so its
+  second attempt re-pulls the trace the first one preserved.
+
 - Changed: `record stop` no longer carries a start-trim step no recorder could arm. The trim cut the
   interval between recorder start and target-app readiness, but the runner's `recordStart` answer has
   never carried either timing and the simulator path supplies none, so every built-in recording took
 
@@ -29,6 +29,31 @@ export type DurableCaptureSessionSlot<K extends string, H extends AsyncDisposabl
   replace(session: S, resource: DurableCaptureSessionResource<K, H> | undefined): S;
 }>;
 
+/**
+ * What a failed capture finish may do to a kind's material (ADR 0024 rule 6). A kind declares here
+ * whether the shared coordinator's failed capture finish still earns a forced cleanup; a disposal
+ * finish ignores this and always disposes.
+ */
+export type DurableCaptureFailedFinishPolicy =
+  /**
+   * The retry needs material forced cleanup would destroy, so a failed finish keeps every artifact
+   * and leaves the record open for the next attempt.
+   */
+  | 'preserve-retry-material'
+  /**
+   * The retry needs nothing forced cleanup destroys, so a failed finish still disposes. A kind that
+   * wants this says so where its definition is built.
+   */
+  | 'dispose-on-failed-finish';
+
+/**
+ * Why a finish is asked for. A `capture` finish tries to produce the resource's export and may keep
+ * retry material under a preserving kind's policy; a `disposal` finish hands the resource back for
+ * good — session teardown, or a start that replaces the resource — and disposes whatever a failed
+ * finish left, because whatever follows expects the record settled rather than waiting for a retry.
+ */
+export type DurableCaptureFinishIntent = 'capture' | 'disposal';
+
 /**
  * The session-free half of a definition. Recovery reattaches and terminalizes a persisted
  * record with no session in hand, so it names this and never the session type.
@@ -38,6 +63,7 @@ export type DurableCaptureRecordDefinition<K extends string, C> = Readonly<{
   displayName: string;
   store: DurableCaptureResourceStore<K>;
   completionMetadata(result: C): JsonObject;
+  failedFinishPolicy: DurableCaptureFailedFinishPolicy;
   messages: Readonly<{
     noActive: string;
     cleanupPendingHint: string;
 
@@ -12,6 +12,7 @@ import { createDurableResourceEnvelope } from '../durable-resource-envelope.ts';
 import { mkdtempForTestSync } from '../tmp-dir.fixtures.ts';
 import type {
   DurableCaptureCleanupOutcome,
+  DurableCaptureFailedFinishPolicy,
   DurableCaptureResourceDefinition,
   DurableCaptureSessionResource,
   DurableCaptureSessionStore,
@@ -47,6 +48,7 @@ export const testCaptureStore = createDurableCaptureResourceStore({
 
 export function createTestCaptureDefinition(
   store: DurableCaptureResourceStore<typeof TEST_CAPTURE_KIND> = testCaptureStore,
+  failedFinishPolicy: DurableCaptureFailedFinishPolicy = 'dispose-on-failed-finish',
 ): DurableCaptureResourceDefinition<
   typeof TEST_CAPTURE_KIND,
   TestCaptureHandle,
@@ -57,6 +59,7 @@ export function createTestCaptureDefinition(
     resourceKind: TEST_CAPTURE_KIND,
     displayName: 'test capture',
     store,
+    failedFinishPolicy,
     sessionSlot: {
       read: (session) => session.capture,
       replace: (session, capture) => ({ ...session, capture }),
 
@@ -70,6 +70,7 @@ export async function finishRecoveredDurableCapture<
           handle: authority.reattached.handle,
           fence: envelope.fence,
           resourcePath: params.resourcePath,
+          intent: 'capture',
         });
       case 'completed': {
         const result = authority.reattached.result;
 
@@ -10,6 +10,7 @@ export { createDurableCaptureResourceStore } from './store.ts';
 export { finishLiveDurableCapture, forceCleanupLiveDurableCapture } from './transitions.ts';
 export type {
   AdoptStartedDurableCaptureParams,
+  DurableCaptureFinishIntent,
   DurableCaptureRecordDefinition,
   DurableCaptureResourceDefinition,
   DurableCaptureSessionStore,
 
@@ -38,7 +38,12 @@ test('finish failure remains primary when cleanup and cleanup-pending persistenc
     await expect(
       finishLiveDurableCapture(
         definition,
-        { session: active, sessionName: context.sessionName, sessionStore: context.sessionStore },
+        {
+          session: active,
+          sessionName: context.sessionName,
+          sessionStore: context.sessionStore,
+          intent: 'capture',
+        },
         context.resourcePath,
       ),
     ).rejects.toBe(finishError);
@@ -64,7 +69,12 @@ test('an uncertain finish preserves its error after confirmed compensating clean
   await expect(
     finishLiveDurableCapture(
       testCaptureDefinition,
-      { session: active, sessionName: context.sessionName, sessionStore: context.sessionStore },
+      {
+        session: active,
+        sessionName: context.sessionName,
+        sessionStore: context.sessionStore,
+        intent: 'capture',
+      },
       context.resourcePath,
     ),
   ).rejects.toMatchObject({ details: { reason: 'cleanup-unconfirmed' } });
@@ -95,7 +105,12 @@ test('an uncertain finish retains live evidence when compensating cleanup is unc
     await expect(
       finishLiveDurableCapture(
         testCaptureDefinition,
-        { session: active, sessionName: context.sessionName, sessionStore: context.sessionStore },
+        {
+          session: active,
+          sessionName: context.sessionName,
+          sessionStore: context.sessionStore,
+          intent: 'capture',
+        },
         context.resourcePath,
       ),
     ).rejects.toBe(finishError);
@@ -111,3 +126,108 @@ test('an uncertain finish retains live evidence when compensating cleanup is unc
     },
   });
 });
+
+test('a preserved finish leaves the record open without disposing what its retry reads back', async () => {
+  const context = makeDurableCaptureContext();
+  const finishError = new Error('collect failed');
+  const definition = createTestCaptureDefinition(testCaptureStore, 'preserve-retry-material');
+  const start = makeDurableCaptureStartResult(context, { finishError });
+  await adoptStartedDurableCapture(
+    definition,
+    { ...context, ...start, throwIfCanceled: () => {} },
+    context.resourcePath,
+  );
+  const active = context.sessions.get(context.sessionName);
+  if (!active) throw new Error('Expected adopted test capture session');
+
+  await withDiagnosticsScope({ command: 'record' }, async () => {
+    await expect(
+      finishLiveDurableCapture(
+        definition,
+        {
+          session: active,
+          sessionName: context.sessionName,
+          sessionStore: context.sessionStore,
+          intent: 'capture',
+        },
+        context.resourcePath,
+      ),
+    ).rejects.toBe(finishError);
+    expect(countDiagnosticEventsByPhase(['test_capture_finish_evidence_preserved'])).toBe(1);
+  });
+  expect(start.forceCleanup).not.toHaveBeenCalled();
+  expect(context.sessions.get(context.sessionName)?.capture?.handle).toBe(start.handle);
+  expect(testCaptureStore.read(context.resourcePath)).toMatchObject({
+    status: 'decoded',
+    envelope: { lifecycle: 'open', metadata: { phase: 'completing' } },
+  });
+});
+
+test('a preserved finish that reports uncertainty still leaves the record retryable', async () => {
+  const context = makeDurableCaptureContext();
+  const definition = createTestCaptureDefinition(testCaptureStore, 'preserve-retry-material');
+  const start = makeDurableCaptureStartResult(context, {
+    finish: { status: 'cleanup-pending', reason: 'cleanup-unconfirmed' },
+  });
+  await adoptStartedDurableCapture(
+    definition,
+    { ...context, ...start, throwIfCanceled: () => {} },
+    context.resourcePath,
+  );
+  const active = context.sessions.get(context.sessionName);
+  if (!active) throw new Error('Expected adopted test capture session');
+
+  await expect(
+    finishLiveDurableCapture(
+      definition,
+      {
+        session: active,
+        sessionName: context.sessionName,
+        sessionStore: context.sessionStore,
+        intent: 'capture',
+      },
+      context.resourcePath,
+    ),
+  ).rejects.toMatchObject({ details: { reason: 'cleanup-unconfirmed' } });
+  expect(start.forceCleanup).not.toHaveBeenCalled();
+  expect(testCaptureStore.read(context.resourcePath)).toMatchObject({
+    status: 'decoded',
+    envelope: {
+      lifecycle: 'open',
+      metadata: { phase: 'cleanup-pending', cleanupPendingReason: 'cleanup-unconfirmed' },
+    },
+  });
+});
+
+test('a disposal finish disposes a preserving kind’s material too', async () => {
+  const context = makeDurableCaptureContext();
+  const finishError = new Error('teardown collect failed');
+  const definition = createTestCaptureDefinition(testCaptureStore, 'preserve-retry-material');
+  const start = makeDurableCaptureStartResult(context, { finishError });
+  await adoptStartedDurableCapture(
+    definition,
+    { ...context, ...start, throwIfCanceled: () => {} },
+    context.resourcePath,
+  );
+  const active = context.sessions.get(context.sessionName);
+  if (!active) throw new Error('Expected adopted test capture session');
+
+  await expect(
+    finishLiveDurableCapture(
+      definition,
+      {
+        session: active,
+        sessionName: context.sessionName,
+        sessionStore: context.sessionStore,
+        intent: 'disposal',
+      },
+      context.resourcePath,
+    ),
+  ).rejects.toBe(finishError);
+  expect(start.forceCleanup).toHaveBeenCalledOnce();
+  expect(context.sessions.get(context.sessionName)?.capture).toBeUndefined();
+  expect(testCaptureStore.read(context.resourcePath)).toMatchObject({
+    status: 'decoded',
+    envelope: { lifecycle: 'completed', metadata: { phase: 'completed' } },
+  });
+});
@@ -8,11 +8,12 @@ import { AppError } from '@agent-device/kernel/errors';
 import { emitDiagnostic } from '@agent-device/host-kit/diagnostics';
 import { withDurableCaptureResourceFence, type DurableCaptureResourceFenceLease } from './fence.ts';
 import type {
+  DurableCaptureFinishIntent,
   DurableCaptureRecordDefinition,
   DurableCaptureResourceDefinition,
   DurableCaptureSessionStore,
 } from './definition.ts';
-import { capitalizeDurableCaptureLabel } from './labels.ts';
+import { capitalizeDurableCaptureLabel, durableCaptureDiagnosticPrefix } from './labels.ts';
 
 export async function finishLiveDurableCapture<
   K extends string,
@@ -21,7 +22,12 @@ export async function finishLiveDurableCapture<
   S,
 >(
   definition: DurableCaptureResourceDefinition<K, H, C, S>,
-  params: { session: S; sessionName: string; sessionStore: DurableCaptureSessionStore<S> },
+  params: {
+    session: S;
+    sessionName: string;
+    sessionStore: DurableCaptureSessionStore<S>;
+    intent: DurableCaptureFinishIntent;
+  },
   resourcePath: string,
 ): Promise<C> {
   const active = definition.sessionSlot.read(params.session);
@@ -31,6 +37,7 @@ export async function finishLiveDurableCapture<
       handle: active.handle,
       fence: active.envelope.fence,
       resourcePath,
+      intent: params.intent,
     });
     clearLiveSlot(definition, params);
     return result;
@@ -53,6 +60,7 @@ export async function finishDurableCaptureHandle<
     handle: H;
     fence: DurableCaptureResourceFenceLease<K>['envelope']['fence'];
     resourcePath: string;
+    intent: DurableCaptureFinishIntent;
   },
 ): Promise<C> {
   return await withDurableCaptureResourceFence({
@@ -65,7 +73,7 @@ export async function finishDurableCaptureHandle<
       try {
         finishOutcome = await params.handle.finish();
       } catch (finishError) {
-        await compensateFailedFinish(definition, lease, params, finishError);
+        await respondToFailedFinish(definition, lease, params, finishError, params.intent);
         throw finishError;
       }
       if (finishOutcome.status === 'completed') {
@@ -74,18 +82,23 @@ export async function finishDurableCaptureHandle<
       }
       transitionFinishOutcome(definition, lease, finishOutcome);
       const finishError = cleanupPendingError(definition, finishOutcome);
-      await compensateFailedFinish(definition, lease, params, finishError);
+      await respondToFailedFinish(definition, lease, params, finishError, params.intent);
       throw finishError;
     },
   });
 }
 
-async function compensateFailedFinish<K extends string, H extends LiveResourceHandle<C>, C>(
+async function respondToFailedFinish<K extends string, H extends LiveResourceHandle<C>, C>(
   definition: DurableCaptureRecordDefinition<K, C>,
   lease: DurableCaptureResourceFenceLease<K>,
   params: { handle: H; resourcePath: string },
   finishError: unknown,
+  intent: DurableCaptureFinishIntent,
 ): Promise<void> {
+  if (intent === 'capture' && definition.failedFinishPolicy === 'preserve-retry-material') {
+    emitFailedFinishPreservedDiagnostic(definition, params, finishError);
+    return;
+  }
   let cleanup: CleanupOutcome;
   try {
     cleanup = await params.handle.forceCleanup();
@@ -134,6 +147,22 @@ function persistCleanupPendingBestEffort<K extends string>(
   }
 }
 
+function emitFailedFinishPreservedDiagnostic<K extends string, C>(
+  definition: DurableCaptureRecordDefinition<K, C>,
+  params: { resourcePath: string },
+  finishError: unknown,
+): void {
+  emitDiagnostic({
+    level: 'error',
+    phase: `${durableCaptureDiagnosticPrefix(definition.resourceKind)}_finish_evidence_preserved`,
+    data: {
+      resourcePath: params.resourcePath,
+      finishError: errorMessage(finishError),
+      failedFinishPolicy: definition.failedFinishPolicy,
+    },
+  });
+}
+
 function emitFailedFinishCleanupDiagnostic<K extends string, C>(
   definition: DurableCaptureRecordDefinition<K, C>,
   params: { resourcePath: string },
@@ -143,7 +172,7 @@ function emitFailedFinishCleanupDiagnostic<K extends string, C>(
 ): void {
   emitDiagnostic({
     level: 'error',
-    phase: `${definition.resourceKind.replaceAll('-', '_')}_finish_cleanup_failed`,
+    phase: `${durableCaptureDiagnosticPrefix(definition.resourceKind)}_finish_cleanup_failed`,
     data: {
       resourcePath: params.resourcePath,
       finishError: errorMessage(finishError),
 
@@ -9,6 +9,9 @@ import type { ResourceOwnershipFence } from './platform-runtime.ts';
 
 export const SCREEN_RECORDING_RESOURCE_KIND = 'screen-recording' as const;
 
+/** The recording's file exists and is not a video, which only a still-finalizing recorder can undo. */
+export const RECORDING_OUTPUT_UNPLAYABLE_REASON = 'recording-output-unplayable';
+
 type RecordingTelemetryBase = Readonly<{
   tMs: number;
   x: number;
 
@@ -646,10 +646,11 @@ export function requireExecSuccess(
 /**
  * COMMAND_FAILED details for a non-zero exec result. `processExitError: true`
  * lets normalizeError surface the first meaningful stderr line as the user-facing
- * message instead of the generic wrap message.
+ * message instead of the generic wrap message. A process killed by a signal reports
+ * no exit code, so the raw child_process null is accepted as well.
  */
 export function execFailureDetails(
-  result: Pick<ExecResult, 'stdout' | 'stderr' | 'exitCode'>,
+  result: Pick<ExecResult, 'stdout' | 'stderr'> & Readonly<{ exitCode: number | null }>,
   extra?: Record<string, unknown>,
 ): Record<string, unknown> {
   return {