@@ -366,7 +366,7 @@ jobs:
         with: { gate: integration-node }
 
       - name: Run seeded concurrency torture lane (fast PR sweep)
-        # #1416's nightly torture lane lives under test/integration/nightly/, out
+        # #1416's nightly torture lane lives under packages/daemon/test/nightly/, out
         # of the test:integration:node glob, so this is a *deliberate* fast PR
         # sweep (TORTURE_RUNS default 128 seeds, ~sub-second) — not an accidental
         # glob inclusion. The Concurrency Torture Nightly workflow sweeps a much
 
@@ -2,6 +2,8 @@
 
 ## Unreleased
 
+- Behavior change: the CLI and MCP now call `ensureDaemon()` explicitly once their config is resolved, then attach to the daemon it leaves. A command that finds a daemon from another version or build replaces it only if the daemon reports no request, session, repair session or live lease. A resumable upload still streaming and a host human-control hold that names no lease are not counted, so a replacement can end them. A daemon that answers nothing on any transport is retired after repeated failed liveness probes, which cannot show it idle. A busy one fails the command with `details.reason: 'daemon-busy'` instead of being replaced with its sessions, and a daemon from a release that predates quiescing fails it with `'daemon-incompatible'`; stop either with `agent-device daemon stop --state-dir <path>`. The takeover notice moves from `Replacing daemon … : <reason>` to `Replaced idle daemon …` (an incompatible daemon) or `Replaced unreachable daemon …` (one that answered nothing). A request that times out no longer retires an unresponsive daemon from the CLI or MCP; the error names `agent-device daemon stop --state-dir <path>`. A one-shot `replay` or `test` with an explicit `--state-dir` leaves the daemon it started running until its idle reap instead of stopping it. Remote `--daemon-base-url` connections and replay on its private ephemeral daemon are unchanged. Node.js clients keep `daemonLifecycle: 'managed'` until 0.22.
+- Add `ensureDaemon({ stateDir })` and the client config `daemonLifecycle: 'attach' | 'managed'`. An `attach` client connects to the daemon registered in the state directory and never starts, replaces or kills one, including after a request times out. It fails with `details.reason: 'daemon-not-running'` (the hint points at `ensureDaemon()`) or `'daemon-incompatible'` (both identities in `details`, the hint names `agent-device daemon stop`). `ensureDaemon()` starts a missing daemon and replaces an incompatible one that answers only through an authenticated quiesce request the daemon answers itself (a resumable upload still streaming and a human-control hold that names no lease are not counted, so a replacement can end them): it refuses with `daemon-busy` while any request is in flight or any session, repair session or live lease exists, and a daemon from a release before this one is never replaced. A registered daemon that answers nothing is retired, as is one that times out on the quiesce request and then fails repeated liveness probes; neither can be asked. A remote `daemonBaseUrl` connection never starts or retires a local daemon in either mode. `managed` stays the default and behaves as before until 0.22.
 - Add `uninstall <app>` and `client.apps.uninstall({ app })` to remove an installed app on adb-backed Android targets, iOS simulators, and CoreDevice iOS devices. Both report `wasInstalled`. A package name or bundle id that is not installed succeeds with `wasInstalled: false`. Other targets, Appium and Limrun sessions included, refuse it before anything runs.
 - Add `settings mobile-data on|off` for adb-backed Android targets. It switches mobile data through `svc data` and reports the `mobileData` state stored in the global `mobile_data` row; multi-SIM read-back is not covered yet. Every other target refuses it before anything runs, and `--app` is refused because the switch is device-wide.
 - On iOS, a `fill` that runs under a degraded XCTest snapshot channel now aims at a point, including ref, selector and replay fills. When the runner identifies no text input under that point, it refuses with `NO_TEXT_INPUT_AT_POINT` (`error.details.reason: no_text_input_at_point`, `dispatched: no`) before dispatching its focus tap, and no field changes; when the input lookup itself cannot answer, it refuses with `TEXT_INPUT_PROBE_UNAVAILABLE` (`error.details.reason: text_input_probe_unavailable`). Previously such a fill cleared and typed through the app-level first responder, so it could rewrite a field the caller never named, or report a clear failure after emptying it. A ref or selector fill whose rect centre misses the real field (an outer container, a non-input node) now needs a point inside the input's own rect.
 
@@ -107,6 +107,12 @@
     "trigger": "a device-bound command with no active session and no device selector: requireSessionOrExplicitSelector refuses before any target resolves, carrying details.reason session_or_device_selector_required",
     "dispatched": "no"
   },
+  {
+    "id": "daemon.route.named-session-refusal",
+    "producer": "daemon",
+    "trigger": "a command naming a session this daemon does not hold and no device selector: requireNamedSessionHoldsDevice refuses with SESSION_NOT_FOUND and details.reason named_session_not_found before any device is listed or resolved",
+    "dispatched": "no"
+  },
   {
     "id": "daemon.route.find-type-refused-after-focus",
     "producer": "daemon",
 
@@ -84,3 +84,29 @@ the gap and its reason instead of implying coverage. See `test/wire-compat/READM
 Legacy remote daemons without `rpcProtocolVersion` remain reachable. This keeps the first release of
 the proxy compatible with older HTTP daemons, but it means absence of the marker is not proof of
 compatibility.
+
+## Daemon capabilities and quiesce
+
+A daemon on the local state directory publishes `capabilities` in `daemon.json`. This is the
+command-level metadata the decision above prefers to a protocol bump. A daemon that predates a
+capability omits it, so a client treats absence as "cannot do this" and never infers it from the
+package version.
+
+`quiesce` is how a client replaces an incompatible daemon without destroying other clients' work.
+The client sends `daemon_quiesce` with the daemon token and the pid and start time recorded in
+`daemon.json`. The daemon checks the token and that it is that instance, refuses a request that
+reached it as a remote-origin one, then closes admission and counts what it holds in a single
+synchronous step: requests in flight, sessions, repair sessions and live leases, and whether the
+daemon is still starting up (`startingUp`), because before that it has no drain path. Any of them
+refuses with `daemon-busy` and reopens admission in that same step. Otherwise it answers
+`draining`, keeps admission closed, and shuts down. The request is answered before dispatch, so
+it joins neither the in-flight count nor the command registry.
+
+The daemon accepts a quiesce only when it can prove its own start time and the request names both
+the pid and that start time; a daemon that cannot is never addressed. A client never signals a
+daemon that did not accept one, except to retire it after it answered `draining`.
+
+The census counts what the contract names and nothing else. A resumable upload still streaming and
+a host-administration human-control hold that names no lease are outside it, the same boundary
+idle reap draws, so a quiesce can end them. A daemon started with an HTTP auth hook marks every
+HTTP request remote-origin and so refuses a quiesce over HTTP; the socket transport is unaffected.
@@ -208,7 +208,7 @@
     "test:integration:node": "node --experimental-strip-types scripts/node-test-tmpdir.ts --test --experimental-test-isolation=none test/integration/*.test.ts",
     "test:integration:macos-coverage": "node --experimental-strip-types scripts/node-test-tmpdir.ts --test test/integration/smoke-macos-coverage.test.ts",
     "test:integration": "pnpm test:integration:node && pnpm test:integration:provider",
-    "test:concurrency-torture": "node --experimental-strip-types scripts/node-test-tmpdir.ts --test test/integration/nightly/concurrency-torture.test.ts",
+    "test:concurrency-torture": "node --experimental-strip-types scripts/node-test-tmpdir.ts --test packages/daemon/test/nightly/concurrency-torture.test.ts",
     "test:replay:ios": "node --experimental-strip-types src/bin.ts test test/integration/replays/ios/simulator",
     "test:replay:ios-device": "node --experimental-strip-types src/bin.ts test test/integration/replays/ios/device",
     "test:replay:android": "node --experimental-strip-types src/bin.ts test test/integration/replays/android/emulator",
 
@@ -8,7 +8,12 @@ import type {
   ScreenRecordingCompletion,
 } from '@agent-device/contracts/screen-recording-runtime';
 import type { DurableResourceEnvelope } from '@agent-device/contracts/durable-resource-envelope';
-import { deviceIdentity, sameDeviceIdentity, type DeviceInfo } from '@agent-device/kernel/device';
+import {
+  deviceIdentity,
+  sameDeviceIdentity,
+  type DeviceIdentity,
+  type DeviceInfo,
+} from '@agent-device/kernel/device';
 import { AppError } from '@agent-device/kernel/errors';
 import { isRecord } from '@agent-device/kernel/record';
 import { emitDiagnostic } from '@agent-device/host-kit/diagnostics';
@@ -70,6 +75,21 @@ export function screenRecordingManifestIsTerminal(params: ScreenRecordingManifes
   return record.status === 'decoded' && record.envelope.lifecycle === 'completed';
 }
 
+/**
+ * The device a stop without a held session must be answered on: the one the session's durable
+ * manifest names, when a decodable manifest exists. `undefined` means there is nothing to recover
+ * from, and a caller that addressed a session answers on the session instead of choosing a device.
+ * The caller still resolves this identity against the host to recover the live device fields, and
+ * `assertManifestBelongsToRequest` still fails the request closed when the resolved device or the
+ * session address does not match what the manifest recorded.
+ */
+export function screenRecordingManifestDevice(
+  params: ScreenRecordingManifestParams,
+): DeviceIdentity | undefined {
+  const { record } = readSessionManifest(params);
+  return record.status === 'decoded' ? record.envelope.device : undefined;
+}
+
 function readSessionManifest(params: ScreenRecordingManifestParams): Readonly<{
   resourcePath: string;
   record: DurableCaptureResourceRecord<'screen-recording'>;
 
@@ -58,6 +58,47 @@ function batchRequest(commands: string[], responseLevel?: ResponseLevel): BatchR
   };
 }
 
+// #3674: the daemon refuses a request that names a session it does not hold. A batch step is
+// addressed through `session:`, so only a caller who named a session may see one in `flags`:
+// stamping every step would hand that refusal to sessionless batches, whose steps are meant to
+// resolve their device from the session or the selectors.
+test('sessionless batch steps carry no session flag, so they stay sessionless at the daemon', async () => {
+  const seen: Array<Record<string, unknown> | undefined> = [];
+  const request: BatchRequest = {
+    token: 't',
+    command: 'batch',
+    positionals: [],
+    flags: { batchSteps: [{ command: 'snapshot' }] },
+  };
+  const response = await runBatch(request, 'cwd:1a2b3c4d5e6f7a8b:default', async (req) => {
+    seen.push(req.flags as Record<string, unknown> | undefined);
+    return { ok: true, data: {} };
+  });
+
+  assert.equal(response.ok, true);
+  assert.equal(seen[0]?.session, undefined);
+});
+
+test('a batch whose caller named a session stamps that address onto every step', async () => {
+  const seen: Array<Record<string, unknown> | undefined> = [];
+  const request: BatchRequest = {
+    token: 't',
+    command: 'batch',
+    positionals: [],
+    session: 'e2e-ios-0',
+    meta: { sessionExplicit: true },
+    flags: { batchSteps: [{ command: 'snapshot' }, { command: 'get' }] },
+  };
+  const response = await runBatch(request, 'e2e-ios-0', async (req) => {
+    seen.push(req.flags as Record<string, unknown> | undefined);
+    return { ok: true, data: {} };
+  });
+
+  assert.equal(response.ok, true);
+  assert.equal(seen[0]?.session, 'e2e-ios-0');
+  assert.equal(seen[1]?.session, 'e2e-ios-0');
+});
+
 // #2997: `testIme` joined INHERITED_PARENT_FLAG_KEYS for the flow command's session
 // opens; batch shares that list, so its steps inherit the parent's opt-in the same way.
 // Pinning it here keeps the shared-list addition deliberate for both consumers.
 
@@ -6,6 +6,7 @@ import {
   type DaemonResponse,
   type ResponseLevel,
   isNonDefaultResponseLevel,
+  namesSessionExplicitly,
 } from '@agent-device/kernel/contracts';
 import { AppError, asAppError, type DaemonError } from '@agent-device/kernel/errors';
 import { isRecord } from '@agent-device/kernel/record';
@@ -320,7 +321,11 @@ async function runBatchStep(
   const isFinalStep = stepNumber === totalSteps;
   const stepStartedAt = Date.now();
   const stepFlags = buildBatchStepFlags(req.flags, step.flags);
-  if (stepFlags.session === undefined) {
+  // The step is already addressed through `session:` below. Stamp the flag only when the caller
+  // genuinely named a session: an unconditional stamp would make a sessionless batch look
+  // caller-addressed to the daemon's named-session refusal, which no caller of this surface asked
+  // for (#3674). A step's own recorded flag always wins, explicit parent or not.
+  if (stepFlags.session === undefined && namesSessionExplicitly(req)) {
     stepFlags.session = sessionName;
   }
   const response = await invoke(
 
@@ -2,6 +2,8 @@
 
 import type {
   DaemonLockPolicy,
+  DaemonServerMode,
+  DaemonTransportPreference,
   DaemonRequest,
   DaemonResponse,
   LeaseBackend,
@@ -15,8 +17,58 @@ import type {
   RemoteConnectionProfileFields,
 } from './remote-config-fields.ts';
 
+/**
+ * Who owns the daemon on a client's state directory.
+ *
+ * - `managed`: the client starts a missing daemon and replaces an incompatible one itself, and may
+ *   retire a hung one after a timeout. This is the default until 0.22.
+ * - `attach`: the client only connects to the daemon registered in the state directory. It never
+ *   starts, replaces or kills one. A missing daemon fails with `details.reason: 'daemon-not-running'`
+ *   and an incompatible one with `'daemon-incompatible'`; `ensureDaemon()` is the explicit way to
+ *   start or replace one.
+ *
+ * Independent of `daemonTransport`, `daemonServerMode` and `daemonBaseUrl`: a remote connection
+ * never starts or retires a local daemon in either mode.
+ */
+export type DaemonLifecycle = 'attach' | 'managed';
+
+/** What a client can learn about a daemon without talking to it: how it identifies itself on disk. */
+export type DaemonIdentity = {
+  pid: number;
+  version?: string;
+  /** `installed` for a published package, `checkout` for a source tree. */
+  codeOrigin?: 'installed' | 'checkout';
+  codeSignature?: string;
+  processStartTime?: string;
+};
+
+export type EnsureDaemonOptions = {
+  /** The state directory the daemon owns; defaults to `AGENT_DEVICE_STATE_DIR`, then the user default. */
+  stateDir?: string;
+  daemonTransport?: DaemonTransportPreference;
+  daemonServerMode?: DaemonServerMode;
+  /**
+   * Called when this call started a daemon, before `ensureDaemon` returns. `missing` means no
+   * usable daemon was registered; `incompatible` means a daemon this client cannot use was
+   * replaced after it agreed to leave. `previous` is the daemon that was replaced, when there was
+   * one: a `missing` start with a `previous` replaced a registered daemon that answered nothing,
+   * either unreachable or hung and force-retired.
+   */
+  onStart?: (reason: 'missing' | 'incompatible', previous?: DaemonIdentity) => void;
+};
+
+/** A reachable local daemon. It carries no credentials. */
+export type DaemonConnection = {
+  stateDir: string;
+  daemon: DaemonIdentity;
+  /** True when this call started the daemon. */
+  started: boolean;
+};
+
 export type AgentDeviceDaemonTransportContext = {
   authToken?: string;
+  /** How this request treats the local daemon; `managed` when omitted. */
+  daemonLifecycle?: DaemonLifecycle;
   /**
    * Cancels this one in-flight request. A built-in transport that sees an abort destroys the
    * request's connection, which makes the daemon mark the request canceled; the promise rejects
@@ -33,6 +85,8 @@ export type AgentDeviceDaemonTransport = (
 
 export type AgentDeviceClientConfig = RemoteConnectionProfileFields &
   CloudProviderProfileFields & {
+    /** See `DaemonLifecycle`. */
+    daemonLifecycle?: DaemonLifecycle;
     session?: string;
     lockPolicy?: DaemonLockPolicy;
     lockPlatform?: PlatformSelector;
 
@@ -34,7 +34,11 @@ export type {
   AgentDeviceIdentifiers,
   AgentDeviceRequestOverrides,
   AgentDeviceSelectionOptions,
+  DaemonConnection,
+  DaemonIdentity,
+  DaemonLifecycle,
   DeviceCommandBaseOptions,
+  EnsureDaemonOptions,
 } from '../client-connection.ts';
 export type {
   AgentDeviceCapabilitiesResult,