@@ -116,7 +116,8 @@
   is told, whichever give-back door a teardown used. The lock's own complaint used to replace it in a
   `finally` and the best-effort door then dropped it, leaving the symlink pointed at the agent-device
   simulator set with nothing said about why. A simulator whose set already is `XCTestDevices` is no
-  longer failed by a lock it could not verify, either.
+  longer failed by a lock it could not verify, either, and a redirect that could not be installed names
+  the path a failed restore left the host's device set at instead of only logging it.
 - Changed (sessions): the implicit session is now keyed by workspace **and platform**, so one checkout
 
   can drive iOS and Android without inventing a `--session` name for every command (#2580). An
 
@@ -26,13 +26,15 @@ const iosSimulator: DeviceInfo = {
 type RedirectPaths = {
   requestedSetPath: string;
   xctestDeviceSetPath: string;
+  backupPath: string;
   lockDirPath: string;
 };
 
 function makeRedirectPaths(root: string): RedirectPaths {
   return {
     requestedSetPath: path.join(root, 'requested'),
     xctestDeviceSetPath: path.join(root, 'Library', 'Developer', 'XCTestDevices'),
+    backupPath: path.join(root, 'Library', 'Developer', 'XCTestDevices.set-aside'),
     lockDirPath: path.join(root, '.agent-device', 'xctest-device-set.lock'),
   };
 }
@@ -222,6 +224,47 @@ test('a restore that was refused outranks the lock that could not be verified',
   }
 });
 
+test('the host’s device set is back before the lock is', async () => {
+  await withTempDir('device-set-hand-back-order-', async (root) => {
+    const paths = makeRedirectPaths(root);
+    fs.mkdirSync(paths.requestedSetPath, { recursive: true });
+    fs.mkdirSync(paths.xctestDeviceSetPath, { recursive: true });
+
+    // The lock is what lets another runner build read the host's `XCTestDevices`, so the order the
+    // give-back works in is the contract: releasing first would hand out a directory that is still a
+    // symlink into this simulator's set. The events record when each step actually happened.
+    const events: string[] = [];
+    const realRename = fs.renameSync;
+    const renameSpy = vi.spyOn(fs, 'renameSync').mockImplementation(((from, to) => {
+      const source = String(from);
+      const target = String(to);
+      if (target === paths.backupPath) events.push('renamed-aside');
+      else if (source === paths.backupPath) events.push('restored');
+      else if (target === paths.xctestDeviceSetPath) events.push('symlink-installed');
+      return realRename(from, to);
+    }) as typeof fs.renameSync);
+    const realRemoveDir = fs.rmdirSync;
+    const removeDirSpy = vi.spyOn(fs, 'rmdirSync').mockImplementation(((target, ...rest) => {
+      if (String(target) === paths.lockDirPath) events.push('lock-released');
+      return realRemoveDir(target, ...rest);
+    }) as typeof fs.rmdirSync);
+
+    try {
+      const handle = await acquireXcodebuildSimulatorSetRedirect(makeScopedSimulator(paths), {
+        ...redirectOptions(paths),
+        backupPath: paths.backupPath,
+      });
+      assert.ok(handle);
+      await handle.release();
+
+      assert.deepEqual(events, ['renamed-aside', 'symlink-installed', 'restored', 'lock-released']);
+    } finally {
+      renameSpy.mockRestore();
+      removeDirSpy.mockRestore();
+    }
+  });
+});
+
 test('a redirect that could not be installed reports the redirect, not the failed clean-up', async () => {
   await withTempDir('device-set-install-failure-', async (root) => {
     const paths = makeRedirectPaths(root);
@@ -230,7 +273,8 @@ test('a redirect that could not be installed reports the redirect, not the faile
     fs.writeFileSync(path.join(paths.xctestDeviceSetPath, 'host-device.txt'), 'the host owns this');
 
     // The install breaks after the host's set is renamed into the backup, and the restore that the
-    // catch runs to undo it breaks too. Two failures, one report: the redirect that did not happen.
+    // catch runs to undo it breaks too. Two failures, one report: the redirect that did not happen,
+    // carrying the restore that could not run and naming where the host's device set is waiting.
     let restoreAttempted = false;
     const realRename = fs.renameSync;
     const renameSpy = vi.spyOn(fs, 'renameSync').mockImplementation(((
@@ -253,11 +297,17 @@ test('a redirect that could not be installed reports the redirect, not the faile
           acquireXcodebuildSimulatorSetRedirect(makeScopedSimulator(paths), {
             lockDirPath: paths.lockDirPath,
             xctestDeviceSetPath: paths.xctestDeviceSetPath,
+            backupPath: paths.backupPath,
           }),
         (error: unknown) => {
           assert.ok(error instanceof AppError);
           assert.equal(error.message, 'Failed to redirect XCTest device set path');
           assert.match(String(error.details?.error), /EPERM/);
+          assert.match(String(error.details?.restoreError), /EACCES/);
+          assert.ok(
+            String(error.details?.hint).includes(paths.backupPath),
+            `the hint must name where the host's device set is: ${String(error.details?.hint)}`,
+          );
           return true;
         },
       );
 
@@ -104,28 +104,19 @@ export async function acquireXcodebuildSimulatorSetRedirect(
     },
   });
 
-  const giveLockBack = async (): Promise<unknown> => {
-    try {
-      await releaseLock();
-      return null;
-    } catch (error) {
-      return error;
-    }
-  };
+  const paths = { xctestDeviceSetPath, backupPath };
 
-  try {
-    reconcileXcodebuildSimulatorSetRedirect({
-      xctestDeviceSetPath,
-      backupPath,
-    });
-    if (sameResolvedPath(requestedSetPath, xctestDeviceSetPath)) {
-      // Nothing was redirected, so nothing was displaced and this simulator needs no handle: the
-      // caller has no redirect to report, and a lock it never held must not arrive as one. The
-      // give-back records its own failure where the claim lives.
-      recordHandBackFailure(await giveLockBack(), lockDirPath);
-      return null;
-    }
+  if (sameResolvedPath(requestedSetPath, xctestDeviceSetPath)) {
+    // Nothing is displaced and the caller gets no handle, so this hand-back has no failure of its own
+    // to report: a lock this simulator never needed must not arrive as a redirect problem. Whatever it
+    // could not verify is recorded where the claim lives.
+    recordReleaseFailure((await handBackDeviceSet(paths, releaseLock)).releaseFailure, lockDirPath);
+    return null;
+  }
 
+  try {
+    // Clean up whatever an earlier run left, out of the way of the rename below.
+    reconcileXcodebuildSimulatorSetRedirect(paths);
     fs.mkdirSync(requestedSetPath, { recursive: true });
     if (fs.existsSync(xctestDeviceSetPath)) {
       fs.renameSync(xctestDeviceSetPath, backupPath);
@@ -135,56 +126,37 @@ export async function acquireXcodebuildSimulatorSetRedirect(
       xctestDeviceSetPath,
     });
   } catch (error) {
-    // The redirect failure outranks everything the hand-back does, including a restore that could not
-    // run on the way out. Both are recorded; the caller hears why the redirect failed.
-    try {
-      reconcileXcodebuildSimulatorSetRedirect({
-        xctestDeviceSetPath,
-        backupPath,
-      });
-    } catch (restoreError) {
-      emitDiagnostic({
-        level: 'warn',
-        phase: 'ios_runner_xctest_device_set_restore_failed',
-        data: { xctestDeviceSetPath, backupPath, error: String(restoreError) },
-      });
-    }
-    recordHandBackFailure(await giveLockBack(), lockDirPath);
+    const handBack = await handBackDeviceSet(paths, releaseLock);
+    recordReleaseFailure(handBack.releaseFailure, lockDirPath);
     throw new AppError('COMMAND_FAILED', 'Failed to redirect XCTest device set path', {
       requestedSetPath,
       xctestDeviceSetPath,
       backupPath,
       error: String(error),
+      ...(handBack.restoreFailure === null
+        ? {}
+        : {
+            restoreError: String(handBack.restoreFailure),
+            hint:
+              `The host's own device set is still renamed aside at ${backupPath}: restore it, ` +
+              'or remove that path, before another runner build redirects it.',
+          }),
     });
   }
 
   let givenBack = false;
-  // One ordered give-back: restore the host's own device set, then hand the lock back. A restore that
-  // could not run is a fact about this machine — the symlink stays pointed at this simulator's set and
-  // every later `simctl` run sees the wrong devices — so its failure always outranks the release, and
-  // the lock goes back anyway so the next acquire does not wait on it. Whatever the release could not
-  // do is recorded either way; the two doors differ only in whether the caller also throws it.
   const giveBack = async (reportUnverifiedRelease: boolean): Promise<void> => {
     if (givenBack) {
       return;
     }
     givenBack = true;
-    let restoreFailure: unknown = null;
-    try {
-      reconcileXcodebuildSimulatorSetRedirect({
-        xctestDeviceSetPath,
-        backupPath,
-      });
-    } catch (error) {
-      restoreFailure = error;
+    const handBack = await handBackDeviceSet(paths, releaseLock);
+    recordReleaseFailure(handBack.releaseFailure, lockDirPath);
+    if (handBack.restoreFailure !== null) {
+      throw handBack.restoreFailure;
     }
-    const releaseFailure = await giveLockBack();
-    recordHandBackFailure(releaseFailure, lockDirPath);
-    if (restoreFailure !== null) {
-      throw restoreFailure;
-    }
-    if (releaseFailure !== null && reportUnverifiedRelease) {
-      throw releaseFailure;
+    if (handBack.releaseFailure !== null && reportUnverifiedRelease) {
+      throw handBack.releaseFailure;
     }
   };
   return {
@@ -193,11 +165,45 @@ export async function acquireXcodebuildSimulatorSetRedirect(
   };
 }
 
+type DeviceSetHandBack = {
+  /** The host's own `XCTestDevices` could not be put back, so the symlink is still in its place. */
+  restoreFailure: unknown;
+  /** The lock could not be given back, or could not be verified as ours when it was. */
+  releaseFailure: unknown;
+};
+
+/**
+ * The one ordered hand-back, used by every path that leaves this redirect behind: restore the host's
+ * own device set, then release the lock. Neither step can hide the other, because a restore that could
+ * not run is a fact about this machine that outlives the request — every later `simctl` run sees the
+ * wrong devices — and the lock going back is what keeps the next acquire from waiting on a claim nobody
+ * is acting on. Deciding which of the two the caller hears is left to the caller that has a report to
+ * make: the redirect failure, the restore failure, or neither.
+ */
+async function handBackDeviceSet(
+  paths: { xctestDeviceSetPath: string; backupPath: string },
+  releaseLock: () => Promise<void>,
+): Promise<DeviceSetHandBack> {
+  let restoreFailure: unknown = null;
+  let releaseFailure: unknown = null;
+  try {
+    reconcileXcodebuildSimulatorSetRedirect(paths);
+  } catch (error) {
+    restoreFailure = error;
+  }
+  try {
+    await releaseLock();
+  } catch (error) {
+    releaseFailure = error;
+  }
+  return { restoreFailure, releaseFailure };
+}
+
 /**
- * Records a hand-back failure that no caller is being made to throw. A release whose ownership could
- * not be verified is already recorded where the claim lives, so only the rest reaches the log.
+ * Records a lock release that no caller is being made to throw. A release whose ownership could not be
+ * verified is already recorded where the claim lives, so only the rest reaches the log.
  */
-function recordHandBackFailure(error: unknown, lockDirPath: string): void {
+function recordReleaseFailure(error: unknown, lockDirPath: string): void {
   if (error === null || isOwnerReleaseUnverified(error)) {
     return;
   }