@@ -19,6 +19,7 @@ const device: DeviceInfo = {
 
 const CLAIM: DeviceClaim = {
   schemaVersion: 3,
+  claimOwnerKind: 'open-session',
   deviceKey: 'local:apple:ios:SIM-1',
   device: { family: 'apple', id: device.id, name: device.name, kind: device.kind },
   session: 'cwd:/w:default',
 
@@ -147,6 +147,7 @@ const unavailable = Object.freeze({
 function makeClaim(stateDir: string): DeviceClaim {
   return {
     schemaVersion: 3,
+    claimOwnerKind: 'open-session',
     deviceKey: 'local:android:none:emulator-5554',
     device: { family: 'android', id: 'emulator-5554', name: 'Pixel', kind: 'emulator' },
     session: 'claimed-session',
 
@@ -30,7 +30,12 @@ function v2Claim(overrides: Record<string, unknown> = {}): Record<string, unknow
 }
 
 function currentClaim(overrides: Record<string, unknown> = {}): Record<string, unknown> {
-  return { ...v2Claim(), schemaVersion: 3, ...overrides };
+  return {
+    ...v2Claim(),
+    schemaVersion: 3,
+    claimOwnerKind: 'open-session',
+    ...overrides,
+  };
 }
 
 test('v1, v2, and v3 records decode to the process-owned claim with its process principal intact', () => {
@@ -47,35 +52,48 @@ test('v1, v2, and v3 records decode to the process-owned claim with its process
 });
 
 // Released v1/v2 recorded a command-scoped claim and an open session *named* `transient:<command>`
-// as the same record — no stored field separates them, so the kind of a legacy claim is not a
-// fact the decoder can read. Both decode kindless, which is safe by construction, not by guess:
-// the kind is consulted only for claims `isClaimOwnedByThisDaemon` accepts (same stateDir, pid,
-// and process start time), and a live process reads and writes only v3 records, whose kind is a
-// stored field. No in-flight command's claim is ever a legacy record; the original #3345 bypass
-// needs a current-process claim, which carries its kind.
-test('a legacy claim with a command-label session decodes kindless, not as a guessed command claim', () => {
+// as the same record, so no stored field can say which one a legacy record was. Such a record
+// still decodes — clearing, reconciliation, and stale settlement need its principal — but it
+// states no kind, so a migrated record can never cover a command.
+test('a migrated record normalizes to the current schema and states no claim kind', () => {
   for (const raw of [
     legacyClaim({ session: 'transient:install' }),
     v2Claim({ session: 'transient:install' }),
   ]) {
     const record = decodeStoredDeviceClaim(raw);
-    expect(record?.transientCommand).toBeUndefined();
-    expect(record?.session).toBe('transient:install');
+    expect(record).not.toBeNull();
+    if (!record) throw new Error('expected a decoded claim');
+    expect(record.schemaVersion).toBe(3);
+    expect(record.session).toBe('transient:install');
+    expect(record.claimOwnerKind).toBe('unstated');
+    expect(record.transientCommand).toBeUndefined();
   }
 });
 
-// The kind is a stored field from v3 on. A v3 open session may be named after a command, and a
-// v3 record without the field is exactly that session's claim; a malformed kind fails the record
-// closed instead of guessing.
-test('a v3 claim kind comes only from its stored field', () => {
-  expect(
-    decodeStoredDeviceClaim(currentClaim({ session: 'transient:install' }))?.transientCommand,
-  ).toBeUndefined();
+// A current record states its kind, and the kind fields have to agree. An open session may
+// legitimately be named after a command; a malformed kind fails the record closed.
+test('a current-version claim kind comes only from its stored fields', () => {
+  const named = decodeStoredDeviceClaim(currentClaim({ session: 'transient:install' }));
+  expect(named).not.toBeNull();
+  if (!named) throw new Error('expected a decoded claim');
+  expect(named.claimOwnerKind).toBe('open-session');
+  expect(named.transientCommand).toBeUndefined();
+
+  const scoped = decodeStoredDeviceClaim(
+    currentClaim({ claimOwnerKind: 'transient-command', transientCommand: 'install' }),
+  );
+  expect(scoped).not.toBeNull();
+  if (!scoped) throw new Error('expected a decoded claim');
+  expect(scoped.claimOwnerKind).toBe('transient-command');
+  expect(scoped.transientCommand).toBe('install');
+
+  expect(decodeStoredDeviceClaim(currentClaim({ transientCommand: 'install' }))).toBeNull();
   expect(
-    decodeStoredDeviceClaim(currentClaim({ transientCommand: 'install' }))?.transientCommand,
-  ).toBe('install');
-  expect(decodeStoredDeviceClaim(currentClaim({ transientCommand: '' }))).toBeNull();
-  expect(decodeStoredDeviceClaim(currentClaim({ transientCommand: 7 }))).toBeNull();
+    decodeStoredDeviceClaim(
+      currentClaim({ claimOwnerKind: 'transient-command', transientCommand: '' }),
+    ),
+  ).toBeNull();
+  expect(decodeStoredDeviceClaim(currentClaim({ claimOwnerKind: 'bogus' }))).toBeNull();
 });
 
 test('a record of an unknown schema version is unreadable', () => {
 
@@ -8,9 +8,24 @@ import { isRecord } from '@agent-device/kernel/record';
 
 import { canonicalLocalDeviceKey } from './device-claim-paths.ts';
 
-/** Schema version of a process-owned claim record; v1/v2 records migrate to it on read. */
+/** Schema version of a process-owned claim record; v1/v2 records normalize to it on read. */
 export const DEVICE_CLAIM_SCHEMA_VERSION = 3;
 
+/**
+ * What a claim's record states about who owns it. A current writer always states one.
+ * `unstated` is what a record migrated from the released v1/v2 schemas decodes to, because those
+ * schemas wrote a command-scoped claim and an open session *named* `transient:<command>`
+ * identically; the session label is never re-read as the discriminant. A claim that states no kind
+ * can hold and fence a device but can never cover a command.
+ */
+export type DeviceClaimOwnerKind = 'open-session' | 'transient-command' | 'unstated';
+
+const DEVICE_CLAIM_OWNER_KINDS: readonly DeviceClaimOwnerKind[] = [
+  'open-session',
+  'transient-command',
+  'unstated',
+];
+
 /**
  * A claim owned by one process: the session or the sessionless command that took it. Its principal
  * is `ownerPid`/`ownerStartTime`/`ownerToken`, which is what every clearing surface matches on.
@@ -28,13 +43,13 @@ export type DeviceClaim = {
   createdAtMs: number;
   updatedAtMs: number;
   /**
-   * Set when a `transient-exclusive` command took the claim: the command it is scoped to. This is
-   * the claim-kind discriminant (#3345) — a command-scoped claim is never an open session's claim,
-   * even when its `session` label reads `transient:<command>` and a caller copies that label into
-   * `--session`. Absent means an open session owns it, including every legacy record: a v1/v2
-   * record cannot prove which it was, and no kind decision is ever taken on one (see
-   * {@link decodeStoredDeviceClaim}).
+   * The persisted claim-kind discriminant (#3345). Coverage reads this and never the `session`
+   * label: an open session may legitimately be named `transient:<command>`, and any printed
+   * address can be pasted back into `--session`. It is stored rather than derived from the schema
+   * version so a record renewed or abandoned after migration keeps saying the same thing.
    */
+  claimOwnerKind: DeviceClaimOwnerKind;
+  /** The command a `transient-command` claim is scoped to; present for exactly that kind. */
   transientCommand?: string;
   /** Set by `abandonDeviceClaim`; absent while the claim still holds the device for its owner. */
   abandonedAtMs?: number;
@@ -62,50 +77,53 @@ export function ownershipFromClaim(claim: DeviceClaim): DeviceClaimSessionOwners
 }
 
 /**
- * Legacy (v1/v2) records decode kindless — as open-session claims — because they cannot state a
- * kind: released v1/v2 recorded a command-scoped claim and an open session *named*
- * `transient:<command>` identically, so the label is no proof of kind. Decoding kindless is safe
- * by construction, not by guess: every consumer of a claim's kind first requires
- * `isClaimOwnedByThisDaemon` (same stateDir, pid, and process start time), and a current process
- * writes only v3 records whose kind is stored — a legacy record can only be one this process
- * could not have written, so its owner identity is proven not to match. Recovery for a legacy
- * record needs nothing special: the recording process still holds its token, and any other owner
- * is settled or conflicted by the principal-based paths, none of which reads a kind.
+ * Every stored record normalizes to the current schema so that a renewal or an abandon can write a
+ * decoded claim back without changing its shape. A v1/v2 record has no kind field, and the session
+ * label cannot supply one, so it decodes as `unstated`: it keeps its full principal for clearing,
+ * reconciliation, and stale settlement, and states no ownership kind.
  */
 export function decodeStoredDeviceClaim(value: unknown): DeviceClaim | null {
   if (!isRecord(value)) return null;
   if (value.schemaVersion === DEVICE_CLAIM_SCHEMA_VERSION) return decodeCurrentClaim(value);
-  if (value.schemaVersion === 2) return decodeClaimBody(value);
+  if (value.schemaVersion === 2) return decodeClaimBody(value, 'unstated');
   if (value.schemaVersion === 1) return migrateLegacyClaim(value);
   return null;
 }
 
 /**
- * The current schema states its claim kind explicitly: a missing `transientCommand` is an
- * open-session claim, never a pattern re-derived from the session label.
+ * A current record states its kind, and the two kind fields have to agree: a command claim names
+ * its command, any other kind names none. Anything else fails the record closed rather than
+ * guessing which owner a session label suggests.
  */
 function decodeCurrentClaim(raw: Record<string, unknown>): DeviceClaim | null {
-  const claim = decodeClaimBody(raw);
-  if (!claim) return null;
-  if (raw.transientCommand === undefined) return claim;
-  return isNonEmptyString(raw.transientCommand)
-    ? { ...claim, transientCommand: raw.transientCommand }
-    : null;
+  const { claimOwnerKind, transientCommand } = raw;
+  if (!isKnownOwnerKind(claimOwnerKind)) return null;
+  if (claimOwnerKind === 'transient-command') {
+    if (!isNonEmptyString(transientCommand)) return null;
+    const claim = decodeClaimBody(raw, claimOwnerKind);
+    return claim ? { ...claim, transientCommand } : null;
+  }
+  if (transientCommand !== undefined) return null;
+  return decodeClaimBody(raw, claimOwnerKind);
 }
 
-type DecodedClaimBody = Omit<DeviceClaim, 'transientCommand' | 'abandonedAtMs'> & {
-  schemaVersion: 3;
-  abandonedAtMs?: number;
-};
+function isKnownOwnerKind(value: unknown): value is DeviceClaimOwnerKind {
+  return (
+    typeof value === 'string' && (DEVICE_CLAIM_OWNER_KINDS as readonly string[]).includes(value)
+  );
+}
 
-function decodeClaimBody(raw: Record<string, unknown>): DecodedClaimBody | null {
+function decodeClaimBody(
+  raw: Record<string, unknown>,
+  claimOwnerKind: DeviceClaimOwnerKind,
+): DeviceClaim | null {
   if (!isRecord(raw.device) || !isNonEmptyString(raw.device.name)) return null;
   const identity = decodeDeviceIdentity(raw.device);
-  return identity ? decodeClaimFields(raw, identity, raw.device.name) : null;
+  return identity ? decodeClaimFields(raw, identity, raw.device.name, claimOwnerKind) : null;
 }
 
-/** Released schema-v1 advisory claims are normalized into the canonical v3 model on read. */
-function migrateLegacyClaim(raw: Record<string, unknown>): DecodedClaimBody | null {
+/** Released schema-v1 claims differ only in device shape; they state no claim kind. */
+function migrateLegacyClaim(raw: Record<string, unknown>): DeviceClaim | null {
   if (!isRecord(raw.device)) return null;
   const legacy = raw.device;
   const name = legacy.name;
@@ -126,14 +144,15 @@ function migrateLegacyClaim(raw: Record<string, unknown>): DecodedClaimBody | nu
       ? {}
       : { iosPhysicalDeviceBackend: legacy.iosPhysicalDeviceBackend }),
   });
-  return identity ? decodeClaimFields(raw, identity, name) : null;
+  return identity ? decodeClaimFields(raw, identity, name, 'unstated') : null;
 }
 
 function decodeClaimFields(
   raw: Record<string, unknown>,
   identity: DeviceIdentity,
   name: string,
-): DecodedClaimBody | null {
+  claimOwnerKind: DeviceClaimOwnerKind,
+): DeviceClaim | null {
   const location = decodeClaimLocation(raw);
   const owner = decodeClaimOwner(raw);
   const timestamps = decodeClaimTimestamps(raw);
@@ -145,13 +164,13 @@ function decodeClaimFields(
     device: { ...identity, name },
     ...owner,
     ...timestamps,
+    claimOwnerKind,
   };
 }
 
 /**
  * The claim `session` recorded for a command-scoped claim. Lives with the record so the label and
- * its inverse stay one owner; admission decides on {@link DeviceClaim.transientCommand}, never on
- * this shape.
+ * its inverse stay one owner; `claimOwnerKind` is what decides a kind, never this shape.
  */
 export function transientDeviceClaimSession(command: string): string {
   return `${TRANSIENT_CLAIM_LABEL_PREFIX}${command}`;
 
@@ -128,8 +128,8 @@ export async function acquireTransientDeviceClaim(params: {
    * Whether the live claim under {@link coveredBySession} was taken by this request's
    * workspace rather than merely recorded under the same session string. Session
    * addresses are copyable (#3345), so session equality alone lets a caller that
-   * pasted another workspace's address act as that workspace's owner. Only open
-   * sessions' claims are ever candidates: a claim's `transientCommand` kind, not its
+   * pasted another workspace's address act as that workspace's owner. Only an
+   * `open-session` claim is ever a candidate: the record's `claimOwnerKind`, not its
    * label, decides whether it can cover anything.
    */
   coveredClaimIsOwnedByRequest: (claim: DeviceClaim) => boolean;
@@ -146,18 +146,19 @@ export async function acquireTransientDeviceClaim(params: {
       !isAbandonedDeviceClaim(existing.claim) &&
       isClaimOwnedByThisDaemon(existing.claim, params.stateDir, readCurrentOwnerIdentity())
     ) {
+      const claimKind = existing.claim.claimOwnerKind;
       if (
-        existing.claim.transientCommand === undefined &&
+        claimKind === 'open-session' &&
         existing.claim.session === params.coveredBySession &&
         params.coveredClaimIsOwnedByRequest(existing.claim)
       ) {
         return { status: 'covered-by-owned-claim' };
       }
-      // A command-scoped claim belongs to the one request in flight, and the request that holds
-      // it is covered by its release token at the admission layer — never by an address match.
-      // The kind decides this, so a caller that copies the claim's `transient:<command>` label
-      // into `--session` is refused instead of adopting it (#3345).
-      if (existing.claim.transientCommand !== undefined) {
+      // Only a record that states its kind can take part in a kind decision. A migrated record
+      // states none, and `isClaimOwnedByThisDaemon` matches pid plus start time — which two
+      // processes can share once a start time is unreadable — so coverage has to refuse rather
+      // than assume an old record was not some other owner's command claim (#3345).
+      if (claimKind !== 'open-session') {
         return { status: 'conflict', conflict: existing };
       }
       // A session literally named this command's label is not this command's claim either:
@@ -217,6 +218,7 @@ async function claimHeldDevice(params: {
     ownerToken: crypto.randomUUID(),
     createdAtMs: now,
     updatedAtMs: now,
+    claimOwnerKind: params.transientCommand === undefined ? 'open-session' : 'transient-command',
     ...(params.transientCommand === undefined ? {} : { transientCommand: params.transientCommand }),
   };
   writeDeviceClaim(claim);