refactor(move): extract the daemon server into @agent-device/daemon (11b)

.device-evidence/CHECKLIST.md

@@ -99,9 +99,11 @@ appended warning:
 ### Proof the review asked for on this lane
 
 The false-attribution class is covered by unit tests rather than a device run, because the device
-cannot show a cache hit on command: `src/daemon/__tests__/capture-disclosure-target-activation.test.ts`
-pins that a cache-reused tree discloses nothing, and
-`src/daemon/interaction/internal/__tests__/interaction-target-activation-disclosure.test.ts` pins that
+cannot show a cache hit on command: `packages/daemon/src/__tests__/selector-capture-runtime.test.ts`
+drives a session-snapshot cache hit and pins that the consumed tree earns no repair proof and
+discloses nothing, `packages/daemon/src/__tests__/capture-disclosure-target-activation.test.ts`
+pins that the response builder never borrows a repair the stored snapshot happens to carry, and
+`src/__tests__/daemon-composition/interaction/interaction-capture-disclosure.test.ts` pins that
 a press which consumed no capture is not disclosed against an older tree.
 
 ## Why the live activation lane is manual

.fallowrc.json

@@ -29,9 +29,6 @@
     "scripts/patch-xcuitest-runner-icon.ts",
     "scripts/write-xcuitest-cache-metadata.ts",
     "scripts/xcuitest-build-settings.ts",
-    // The 11a-4 residue scan runs by hand (and from CI prose until R11 in #3546 owns
-    // the rule); nothing in the dependency graph imports it.
-    "scripts/daemon-edge-residue-scan.mjs",
     "packages/capture-kit/src/ios-snapshot-engine/replay.ts",
     // #1596 regression fixture: runs as a real `node --experimental-strip-types`
     // subprocess (test/integration/daemon-replace-exit-flush.test.ts), so
@@ -68,7 +65,7 @@
     "scripts/help-conformance-sample-outputs.d.mts",
     "scripts/help-conformance-runner-output.d.mts"
   ],
-  "dynamicallyLoaded": ["src/daemon/interaction/index.ts"],
+  "dynamicallyLoaded": ["packages/daemon/src/interaction/index.ts"],
   "ignoreDependencies": [
     "@theme",
     // @agent-device/maestro owns the source import, while the published root
@@ -158,7 +155,7 @@
     },
     {
       // Daemon route handlers are reached only through the dynamic `import()` table in request-handler-chain.ts, which --production analysis cannot follow to a consumer.
-      "file": "src/daemon/handlers/{human-control,lease,session,snapshot,react-native,record-trace}.ts",
+      "file": "packages/daemon/src/handlers/{human-control,lease,session,snapshot,react-native,record-trace}.ts",
       "exports": [
         "handleHumanControlCommand",
         "handleLeaseCommands",
@@ -170,7 +167,7 @@
     },
     {
       // The interaction facade exposes #2178's deferred route handlers plus the existing ref mutation response consumed by help conformance. Fallow's production graph cannot follow the request-handler-chain dynamic imports, so this exact list is the facade contract.
-      "file": "src/daemon/interaction/index.ts",
+      "file": "packages/daemon/src/interaction/index.ts",
       "exports": ["refMutationAdmissionResponse", "handleFindCommands", "handleInteractionCommands"]
     },
     {
@@ -243,7 +240,7 @@
       "exports": ["IS_PREDICATE_USAGE_HINT"]
     },
     {
-      // Workspace-package symbols whose only consumers are test-tree files, which --production analysis does not see. Each import is the package specifier, so the façade entry is load-bearing: parseTargetAnnotationV1Payload from src/daemon/__tests__/session-target-evidence.test.ts, MAESTRO_COMPAT_* from src/cli/parser/__tests__/maestro-support-matrix.test.ts, SCRIPT_FLAG_COMMANDS/scriptFlagEntries from src/commands/replay/script-flag-admission.test.ts (the #3197 two-way drift guard between the .ad grammar and the CLI schema).
+      // Workspace-package symbols whose only consumers are test-tree files, which --production analysis does not see. Each import is the package specifier, so the façade entry is load-bearing: parseTargetAnnotationV1Payload from packages/selectors/src/target-evidence.test.ts, MAESTRO_COMPAT_* from src/cli/parser/__tests__/maestro-support-matrix.test.ts, SCRIPT_FLAG_COMMANDS/scriptFlagEntries from src/commands/replay/script-flag-admission.test.ts (the #3197 two-way drift guard between the .ad grammar and the CLI schema).
       "file": "packages/{ad-script,maestro,capture-kit}/src/index.ts",
       "exports": [
         "parseTargetAnnotationV1Payload",
@@ -254,7 +251,7 @@
       ]
     },
     {
-      // src/daemon/__tests__/request-runtime-binding.test.ts drives the daemon's exact bind through the recovery authority, whose cancellation race is what rejects; production reaches it only through finishRecoveredDurableCapture and recoverDurableCaptureResource in the same package.
+      // packages/daemon/src/__tests__/request-runtime-binding.test.ts drives the daemon's exact bind through the recovery authority, whose cancellation race is what rejects; production reaches it only through finishRecoveredDurableCapture and recoverDurableCaptureResource in the same package.
       "file": "packages/capture-kit/src/durable-capture/index.ts",
       "exports": ["acquireDurableCaptureRecoveryAuthorityBeforeDeadline"]
     },

AGENTS.md

@@ -49,11 +49,11 @@ Read the declaration rather than maintaining a prose copy:
 
 - commands and their surface, runtime-use, batch, and timeout traits:
   `packages/command-registry/src/registry.ts`
-- daemon route ownership and request-policy traits: `src/daemon/daemon-command-registry.ts`
+- daemon route ownership and request-policy traits: `packages/daemon/src/daemon-command-registry.ts`
 - interaction paths and guarantees: `packages/contracts/src/interaction-guarantees.ts`
 - canonical command names: `packages/command-registry/src/catalog.ts`
 - device runtime-use declarations and fact admission:
-  `packages/command-registry/src/registry.ts`, `src/daemon/runtime-admission.ts`, and
+  `packages/command-registry/src/registry.ts`, `packages/daemon/src/runtime-admission.ts`, and
   `src/platform-runtime-gateway.ts`
 - common command input fields, and which surface may write an input key (model, operator, retired):
   `src/commands/common-input-fields.ts` and `src/commands/input-audience.ts`
@@ -110,7 +110,7 @@ under `contracts/fixtures/`.
 ## Runtime and diagnostics seams
 
 Diagnostics use `@agent-device/host-kit/diagnostics`. Request diagnostics belong in the session request log;
-session artifact paths come from `src/daemon/session-artifact-paths.ts`. App/device logs remain in `app.log`;
+session artifact paths come from `packages/daemon/src/session-artifact-paths.ts`. App/device logs remain in `app.log`;
 Apple runner and xcodebuild output remains in `runner.log`.
 
 Normalize failures with `normalizeError` and preserve `hint`, `diagnosticId`, `logPath`, and typed

docs/adr/0003-daemon-command-registry.md

@@ -21,7 +21,7 @@ to public command identity, and it required duplicate command sets to stay align
 Keep public command identity in `src/command-catalog.ts` and public input/output contracts in
 `src/commands/**`.
 
-Add `src/daemon/daemon-command-registry.ts` as the daemon-side source of truth for command route
+Add `packages/daemon/src/daemon-command-registry.ts` as the daemon-side source of truth for command route
 ownership and daemon request-policy traits. Request modules consume predicate functions from the
 registry instead of recreating command string sets. Handler modules own execution logic only; they do
 not export duplicate coverage tables to prove route membership.
@@ -67,7 +67,7 @@ exposed through named predicates — a property that survives a projected/derive
 derived daemon registry is therefore permitted **only if** it preserves all of the following invariants:
 
 1. **Daemon-owned declaration.** Route and request-policy traits are declared in a daemon-owned facet
-   (under `src/daemon/`) and *composed* into the registration — never inlined as fields on the public
+   (under `packages/daemon/src/`) and *composed* into the registration — never inlined as fields on the public
    command contract in `src/commands/**` or `src/command-catalog.ts`. Co-locating a registration *call*
    is fine; co-locating *ownership* of daemon policy in the public surface is the contamination this ADR
    rejected (see Alternatives, "Keep daemon groups in `src/command-catalog.ts`").
@@ -85,5 +85,5 @@ derived daemon registry is therefore permitted **only if** it preserves all of t
 A single flat public descriptor whose daemon fields leak into public views is **not** permitted — that is
 the "collapse daemon policy into a public command registry" failure this ADR exists to prevent. Compose
 facets owned by their domains; derive the registry from them. Until that derivation lands and is pinned
-by the registry tests, the hand-authored `src/daemon/daemon-command-registry.ts` remains the source of
+by the registry tests, the hand-authored `packages/daemon/src/daemon-command-registry.ts` remains the source of
 truth and the operating rule in `AGENTS.md` is unchanged.

docs/adr/0004-ios-snapshot-backend-strategy.md

@@ -115,7 +115,7 @@ facet in `@agent-device/capture-kit` owns snapshot policy generally rather than
   stated as a duration budget; the loop derives the deadline from the window's `markedAt` itself, so
   the budget is always spent from the action and a caller has no absolute instant it could get
   wrong.
-  `src/daemon/session-snapshot-freshness.ts` keeps only what needs a session: reading and retiring
+  `packages/daemon/src/session-snapshot-freshness.ts` keeps only what needs a session: reading and retiring
   the window on store-owned `SessionState`, and choosing the comparison baseline from snapshot
   lineage. It remains the declared R7 owner of `androidSnapshotFreshness`.
 - **Timeout evidence.** Whether a capture failed because the hierarchy never arrived is decided
@@ -145,12 +145,12 @@ facet in `@agent-device/capture-kit` owns snapshot policy generally rather than
 
 `scripts/layering/snapshot-presentation-boundary.test.ts` enforces the direction, but only across
 the roots `snapshot-policy` declares in `scripts/layering/architecture-ownership.ts`: nothing in
-that snapshot tree may import `src/daemon/`, while the overlay modules beside the tree sit outside
+that snapshot tree may import `packages/daemon/src/`, while the overlay modules beside the tree sit outside
 those roots and are outside that gate. It carries a positive control, because a filter that stopped
 matching would look identical to a boundary being obeyed.
 
 The residual call sites #1983 also named are audited and deliberately left in place.
-`src/daemon/direct-ios-selector.ts` carries no presentation policy: `isLocalIosRunnerSession` and
+`packages/daemon/src/direct-ios-selector.ts` carries no presentation policy: `isLocalIosRunnerSession` and
 `readSimpleIosSelectorTarget` are session routing (device family, provider ownership, the
 stabilization window), while `deriveDirectIosNodeSelector` and `isDirectIosSelectorFallbackError`
 are selector derivation and ADR 0011 delegation-on-error. The latter two are pure and

docs/adr/0008-command-descriptor-registry.md

@@ -24,7 +24,7 @@ Accepted
 A command's identity is restated, by hand, across roughly ten tables that must stay aligned by
 convention: `PUBLIC_COMMANDS` (`src/command-catalog.ts`), the per-command metadata and family facets
 (`src/commands/**`), the capability matrix (`src/core/capabilities.ts`), the daemon command registry
-(`src/daemon/daemon-command-registry.ts`, ADR 0003), the structured-batch allowlist
+(`packages/daemon/src/daemon-command-registry.ts`, ADR 0003), the structured-batch allowlist
 (`src/batch-policy.ts`), the MCP exposure sets, the Node client interface and impl (`src/client-types.ts`,
 `src/client.ts`), and the generic-dispatch `switch` (`src/core/dispatch.ts`, whose `default: throw` makes a
 missing or renamed command a runtime error, not a compile error). Adding one command touches ~24 files, the