From b85e796806aa986d37ea2e1845b3292078cd9c26 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 8 Oct 2026 20:17:07 -0400
Subject: [PATCH 1/5] Bump fast-uri in /collector (#64)

Bumps  and [fast-uri](https://github.com/fastify/fast-uri). These dependencies needed to be updated together.

Updates `fast-uri` from 3.1.7 to 3.1.8
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](https://github.com/fastify/fast-uri/compare/v3.1.7...v3.1.8)

Updates `fast-uri` from 4.1.4 to 4.2.1
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](https://github.com/fastify/fast-uri/compare/v3.1.7...v3.1.8)

---
updated-dependencies:
- dependency-name: fast-uri
  dependency-version: 3.1.8
  dependency-type: indirect
- dependency-name: fast-uri
  dependency-version: 4.2.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 collector/package-lock.json | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/collector/package-lock.json b/collector/package-lock.json
index eab6a2a..8a703cd 100644
--- a/collector/package-lock.json
+++ b/collector/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "fleet-collector",
-  "version": "0.5.0",
+  "version": "0.7.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "fleet-collector",
-      "version": "0.5.0",
+      "version": "0.7.0",
       "dependencies": {
         "bonjour-service": "^1.4.4",
         "fastify": "^5.4.0",
@@ -667,9 +667,9 @@
       }
     },
     "node_modules/ajv/node_modules/fast-uri": {
-      "version": "3.1.7",
-      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.7.tgz",
-      "integrity": "sha512-dOvZVzjdZdz7phd9v6jCbwxrBW3fK6n8Rc0CtdmM4bumzMnxywBYhuph6J819RRw/ku+rLbelwfMunktuzVVHg==",
+      "version": "3.1.8",
+      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.8.tgz",
+      "integrity": "sha512-GZMtZUTNRpOVIECoXwLNZS5xUGE+mVNbTB8h/7Rwh2TFWcBQiPzTgyZi05BF9UMZKkLJv8XBRJTlU7zg8+ZfMg==",
       "funding": [
         {
           "type": "github",
@@ -843,9 +843,9 @@
       }
     },
     "node_modules/fast-uri": {
-      "version": "4.1.4",
-      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-4.1.4.tgz",
-      "integrity": "sha512-dODXrIxlS9JSdgAnhIUKOosKV1oMtU2VtVw87QRaHzyl5jxO290Ii5tEZfCfzfWNHi3jKWwBSdQj0qIyshdZdQ==",
+      "version": "4.2.1",
+      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-4.2.1.tgz",
+      "integrity": "sha512-TmHQgewjHtMq1E5QKA0tOE0yeYGQs25KZC/ziJpubRtWI15W92e6vPFydWOeZBVROSHBYw/QhD9d5OefdD6LDg==",
       "funding": [
         {
           "type": "github",

From 83d9ca5f4a4633b817c29705a4810f70ff61c0f2 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 8 Oct 2026 20:26:12 -0400
Subject: [PATCH 2/5] Bump fastify from 5.12.1 to 5.12.5 in /collector (#71)

Bumps [fastify](https://github.com/fastify/fastify) from 5.12.1 to 5.12.5.
- [Release notes](https://github.com/fastify/fastify/releases)
- [Commits](https://github.com/fastify/fastify/compare/v5.12.1...v5.12.5)

---
updated-dependencies:
- dependency-name: fastify
  dependency-version: 5.12.5
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 collector/package-lock.json | 12 ++++++------
 collector/package.json      |  2 +-
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/collector/package-lock.json b/collector/package-lock.json
index 8a703cd..18c4d9e 100644
--- a/collector/package-lock.json
+++ b/collector/package-lock.json
@@ -1,15 +1,15 @@
 {
   "name": "fleet-collector",
-  "version": "0.7.0",
+  "version": "0.7.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "fleet-collector",
-      "version": "0.7.0",
+      "version": "0.7.2",
       "dependencies": {
         "bonjour-service": "^1.4.4",
-        "fastify": "^5.4.0",
+        "fastify": "^5.12.5",
         "pixelmatch": "^7.2.0",
         "playwright": "^1.62.1",
         "pngjs": "^7.0.0"
@@ -859,9 +859,9 @@
       "license": "BSD-3-Clause"
     },
     "node_modules/fastify": {
-      "version": "5.12.1",
-      "resolved": "https://registry.npmjs.org/fastify/-/fastify-5.12.1.tgz",
-      "integrity": "sha512-FWi+tQvwxR/PeRX7Z2mhfEF5ozJ3jn9asiiclzKXNSzJRHAYcU924aIOKAdHFJ+YIKieh3cqr1IwCOvTr41B3Q==",
+      "version": "5.12.5",
+      "resolved": "https://registry.npmjs.org/fastify/-/fastify-5.12.5.tgz",
+      "integrity": "sha512-OB2k1dlxs5/NAABqeKV2FUHkSD2BbENsCak8yULVcymn3fHIPDVa9TI3SDnJSWYSllZmSYuZXy2gTnsT+Sut1A==",
       "funding": [
         {
           "type": "github",
diff --git a/collector/package.json b/collector/package.json
index 7ed96ec..c3b35b3 100644
--- a/collector/package.json
+++ b/collector/package.json
@@ -29,7 +29,7 @@
   },
   "dependencies": {
     "bonjour-service": "^1.4.4",
-    "fastify": "^5.4.0",
+    "fastify": "^5.12.5",
     "pixelmatch": "^7.2.0",
     "playwright": "^1.62.1",
     "pngjs": "^7.0.0"

From 3f16e05601250ba19b9523876423bf73fdde5605 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 9 Oct 2026 13:33:59 -0400
Subject: [PATCH 3/5] Bump source-map-js from 1.2.1 to 1.2.2 in /collector/dash
 (#72)

Bumps [source-map-js](https://github.com/7rulnik/source-map-js) from 1.2.1 to 1.2.2.
- [Release notes](https://github.com/7rulnik/source-map-js/releases)
- [Changelog](https://github.com/7rulnik/source-map-js/blob/main/CHANGELOG.md)
- [Commits](https://github.com/7rulnik/source-map-js/compare/v1.2.1...v1.2.2)

---
updated-dependencies:
- dependency-name: source-map-js
  dependency-version: 1.2.2
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 collector/dash/package-lock.json | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/collector/dash/package-lock.json b/collector/dash/package-lock.json
index 67f9c76..6c9e795 100644
--- a/collector/dash/package-lock.json
+++ b/collector/dash/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "fleet-dash",
-  "version": "0.1.0",
+  "version": "0.7.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "fleet-dash",
-      "version": "0.1.0",
+      "version": "0.7.2",
       "dependencies": {
         "preact": "^10.29.0",
         "qrcode-generator": "^2.0.4"
@@ -1099,9 +1099,9 @@
       }
     },
     "node_modules/source-map-js": {
-      "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.1.tgz",
-      "integrity": "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==",
+      "version": "1.2.2",
+      "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.2.tgz",
+      "integrity": "sha512-KGj/8Y43x35aZVDtt+J4mK1hoLGHULMYfSkODJNQjNDC3oW1PqPoxMwo0pLUsWM/UEGzON/NxeHywEfNXNP3Vw==",
       "dev": true,
       "license": "BSD-3-Clause",
       "engines": {

From 9fd94167cadce3ad6f8c5f26ca2413d4dd390d5a Mon Sep 17 00:00:00 2001
From: Taylor Addison <addisdev@gmail.com>
Date: Thu, 22 Oct 2026 22:00:32 -0400
Subject: [PATCH 4/5] Reserve a device for one kind of work

A device reserved with `fleet device reserve <id> <label>` is offered only
to a job whose new `reservation` field is that label and that pins the
device by id (targets.device_id, or a targets.match such as
device_id == '<id>'). Fan-out, pools, unpinned matches, the composer's
preview, device-executor claims and host-executor routing pass it by, and
the host executor applies the same rule to the devices it can see, from the
`reserved_devices` map its claim now carries. A job that pins a reserved
device without the label is refused with device_reserved.

For the growth pilot's signed-in Instagram phone on ultra, which would
otherwise be open to any os ~ 'android' job, a fan-out or the explore night.

Reservations are a table in the brain's database (device_reservations), so a
phone can be reserved before it is cabled up and survives the registry
forgetting it. POST /api/v1/devices/{id}/reserve and /unreserve (admin);
reserved_for on /api/v1/devices, `fleet devices` and fleet_devices;
`fleet run --reservation`.

Also fixes the executor describing an Android target without device_id, so a
host job pinned by targets.match "device_id == '<serial>'" was routed to the
right executor and then matched nothing there.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 CHANGELOG.md                      |  27 ++++
 collector/openapi.json            | 247 +++++++++++++++++++++++++++++-
 collector/schemas/job.schema.json |   9 +-
 collector/scripts/smoke.ts        | 117 ++++++++++++++
 collector/src/api/devices.ts      |   7 +-
 collector/src/api/index.ts        |   1 +
 collector/src/api/mutations.ts    |   7 +-
 collector/src/api/v1/routes.ts    |  87 ++++++++++-
 collector/src/api/v1/schemas.ts   |   6 +-
 collector/src/client/api.gen.ts   |  62 +++++++-
 collector/src/db.ts               |  12 ++
 collector/src/executor.ts         |  66 ++++++--
 collector/src/queue.ts            | 113 ++++++++++++--
 collector/src/reserved.test.ts    |  84 ++++++++++
 collector/src/reserved.ts         |  90 +++++++++++
 collector/src/server.ts           |  30 +++-
 docs/agents.md                    |   4 +-
 docs/api.md                       |   7 +-
 docs/concepts.md                  |  54 ++++++-
 docs/protocol.md                  |   6 +
 fleet/src/mcp/tools.ts            |   6 +
 fleet/src/work.ts                 |  43 +++++-
 fleet/test/cli.test.ts            |  43 ++++++
 fleet/test/mcp.test.ts            |  11 +-
 skills/fleet-runner/SKILL.md      |   4 +
 25 files changed, 1094 insertions(+), 49 deletions(-)
 create mode 100644 collector/src/reserved.test.ts
 create mode 100644 collector/src/reserved.ts

diff --git a/CHANGELOG.md b/CHANGELOG.md
index f6a65d2..927e214 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -16,6 +16,33 @@ a CI job fails when they disagree.
 
 ## [Unreleased]
 
+### Added
+
+- **Reserved devices.** `fleet device reserve <id> <label>` (and
+  `unreserve`, or `POST /api/v1/devices/{id}/reserve` · `/unreserve`, admin)
+  keeps a device for one kind of work: it is offered only to a job whose new
+  `reservation` field is that label **and** that pins the device by id
+  (`targets.device_id`, or a `targets.match` such as
+  `device_id == '<id>'`). Fan-out, pools, unpinned matches, the composer's
+  preview, device-executor claims and host-executor routing all pass it by,
+  and the host executor's own device selection applies the same rule from the
+  `reserved_devices` its claim now carries — so an `os ~ 'android'` job or the
+  explore night cannot open other apps on the growth pilot's signed-in
+  Instagram phone on ultra. A job pinning a reserved device without the label
+  is refused with the new error code `device_reserved`; validate warns when a
+  reserved device was left out. Reservations live in the brain's database, so a
+  phone can be reserved before it is cabled up. `fleet devices` gains a
+  `RESERVED` column, `fleet_devices` and `/api/v1/devices` a `reserved_for`
+  field, and `fleet run` a `--reservation` flag.
+
+### Fixed
+
+- **A host job pinned by `targets.match "device_id == '<serial>'"` matched
+  nothing once claimed.** The brain evaluated `device_id` when routing it, but
+  the executor described an Android target without one, so the job reached the
+  right Mac and then skipped with no targets. The executor's descriptor now
+  carries `device_id`.
+
 ## [0.9.1] — 2026-10-18
 
 A phone on the shelf is woken before it is driven, and one with a PIN says so
diff --git a/collector/openapi.json b/collector/openapi.json
index 24deb9f..a0de23b 100644
--- a/collector/openapi.json
+++ b/collector/openapi.json
@@ -288,6 +288,147 @@
         }
       }
     },
+    "/api/v1/devices/{id}/reserve": {
+      "post": {
+        "operationId": "reserveDevice",
+        "summary": "Keep a device for one kind of work: only jobs with this reservation label that pin the device may use it.",
+        "description": "A reserved device is skipped by fan-out, pools and every targets.match that does not pin its id, on the brain and in the host executor's own device selection. A job may use it only with `reservation` set to the label and the device named in targets.device_id or a targets.match such as device_id == '<id>'. The device need not have registered yet, so a phone can be reserved before it is cabled up; `registered` says whether it has. Reserving again with the same label updates the note; a different label is a conflict until the device is unreserved.",
+        "tags": [
+          "devices"
+        ],
+        "x-fleet-scope": "admin",
+        "x-fleet-idempotent": true,
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "description": "The device id.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "description": "The label, and an optional note for the people reading the shelf.",
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/ReserveInput"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Reserved.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Reservation"
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "The request was malformed or the spec is invalid.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "A token is required (FLEET_AUTH=tokens).",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
+              }
+            }
+          },
+          "403": {
+            "description": "The token lacks the scope, or the job is someone else's.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
+              }
+            }
+          },
+          "409": {
+            "description": "The state does not allow it (already finished, duplicate id).",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/api/v1/devices/{id}/unreserve": {
+      "post": {
+        "operationId": "unreserveDevice",
+        "summary": "Give a reserved device back to the shelf: every job that matches it may use it again.",
+        "description": "Not an error when the device was not reserved; `was` says what it was reserved for, or null.",
+        "tags": [
+          "devices"
+        ],
+        "x-fleet-scope": "admin",
+        "x-fleet-idempotent": true,
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "description": "The device id.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Released.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Unreservation"
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "A token is required (FLEET_AUTH=tokens).",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
+              }
+            }
+          },
+          "403": {
+            "description": "The token lacks the scope, or the job is someone else's.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
     "/api/v1/workloads": {
       "get": {
         "operationId": "listWorkloads",
@@ -620,7 +761,7 @@
             }
           },
           "400": {
-            "description": "Malformed or refused before queueing: invalid_spec, no_matching_devices (no registered device matches the targets), no_build (no artifact for app `latest`), invalid_match, invalid_dependency, secret_in_spec, bad_request.",
+            "description": "Malformed or refused before queueing: invalid_spec, no_matching_devices (no registered device matches the targets; reserved devices are left out), no_build (no artifact for app `latest`), invalid_match, invalid_dependency, secret_in_spec, bad_request.",
             "content": {
               "application/json": {
                 "schema": {
@@ -650,7 +791,7 @@
             }
           },
           "409": {
-            "description": "The state does not allow it (already finished, duplicate id).",
+            "description": "duplicate_job (that job_id exists), or device_reserved (the targets pin a device reserved for other work; set `reservation` to its label if this is that work).",
             "content": {
               "application/json": {
                 "schema": {
@@ -1742,6 +1883,7 @@
       "get": {
         "operationId": "nextJobForExecutor",
         "summary": "A host executor long-polling for host work.",
+        "description": "The claimed spec carries `reserved_devices` (device id to reservation label) beside the granted lease: the executor picks devices itself and must not run on a reserved one unless the job holds that reservation and pins it.",
         "tags": [
           "protocol"
         ],
@@ -2381,6 +2523,13 @@
             },
             "description": "null: an agent that predates capabilities, offered everything."
           },
+          "reserved_for": {
+            "type": [
+              "string",
+              "null"
+            ],
+            "description": "The reservation this device is kept for, or null. A reserved device is offered only to a job whose reservation is this label and that pins the device by id (targets.device_id, or a targets.match such as device_id == '<id>'); fan-out, pools and other matches skip it."
+          },
           "last_net": {
             "type": [
               "string",
@@ -2471,6 +2620,7 @@
           "pools_reported",
           "pools_override",
           "capabilities",
+          "reserved_for",
           "last_net",
           "ttl_s",
           "expired",
@@ -2780,6 +2930,7 @@
                   "duplicate_job",
                   "no_capable_agent",
                   "no_matching_devices",
+                  "device_reserved",
                   "secret_in_spec",
                   "no_build",
                   "invalid_match",
@@ -4473,6 +4624,11 @@
             },
             "description": "Job ids this one waits for. The job is enqueued as 'waiting' and becomes 'queued' when the last of them finishes; if any of them fails or is cancelled, this one fails with last_error naming it. While waiting, a spec may reference a dependency's output: \"${jobs.<id>.artifact}\" resolves to the first sha256 in that job's final row, and \"${jobs.<id>.metrics.<key>}\" to one of its metrics. A whole-string reference keeps the value's type, so a metric stays a number. Referencing a job not listed here is refused at enqueue."
           },
+          "reservation": {
+            "type": "string",
+            "pattern": "^[A-Za-z0-9][A-Za-z0-9._:-]{0,63}$",
+            "description": "The device reservation this job holds. A device reserved with `fleet device reserve <id> <label>` is offered only to a job whose reservation is that label and that names the device explicitly: targets.device_id, or a targets.match that pins its id (device_id == '<id>'). Fan-out, pools and every other match skip it, and a job that pins a reserved device without the label is refused with device_reserved. On an unreserved device the field changes nothing."
+          },
           "preemptible": {
             "type": "boolean",
             "description": "Whether a higher-priority job may ask this one to step aside. When true, a beacon is answered with preempt:true once a strictly higher-priority queued job would go to the same claimant; the runner is expected to checkpoint, upload its progress, and post a final row with preempted:true. That requeues the job with params.resume_from set to the uploaded sha256 and hands the attempt back, so stepping aside never counts against max_attempts. Equal priority does not preempt."
@@ -4525,11 +4681,11 @@
               },
               "device_id": {
                 "type": "string",
-                "description": "pin this job to exactly one device-executor agent"
+                "description": "pin this job to exactly one device (a device-executor agent, or a device a host executor drives); the way to name a reserved device"
               },
               "match": {
                 "type": "string",
-                "description": "descriptor expression, e.g. \"ram_mb >= 4000 && os ~ 'android'\" — fields: model, soc, ram_mb, os, app_ver, device_id, pools; ops == != < <= > >= ~(regex) && || ! ( )"
+                "description": "descriptor expression, e.g. \"ram_mb >= 4000 && os ~ 'android'\" — fields: model, soc, ram_mb, os, app_ver, device_id, pools; a reserved device is matched only by a job carrying its reservation whose expression pins its id; ops == != < <= > >= ~(regex) && || ! ( )"
               },
               "exclusive": {
                 "type": "boolean",
@@ -4759,6 +4915,70 @@
           "links"
         ]
       },
+      "Reservation": {
+        "type": "object",
+        "required": [
+          "device_id",
+          "reserved_for",
+          "note",
+          "reserved_by",
+          "reserved_at",
+          "registered"
+        ],
+        "properties": {
+          "device_id": {
+            "type": "string"
+          },
+          "reserved_for": {
+            "type": "string",
+            "description": "The label. A job holds the reservation by setting `reservation` to it."
+          },
+          "note": {
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "reserved_by": {
+            "type": [
+              "string",
+              "null"
+            ],
+            "description": "Who reserved it, when tokens are on; otherwise the source."
+          },
+          "reserved_at": {
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "registered": {
+            "type": "boolean",
+            "description": "Whether the device has registered yet. false is allowed (reserve before cabling) but is also what a typo looks like."
+          }
+        }
+      },
+      "ReserveInput": {
+        "type": "object",
+        "required": [
+          "label"
+        ],
+        "properties": {
+          "label": {
+            "type": "string",
+            "pattern": "^[A-Za-z0-9][A-Za-z0-9._:-]{0,63}$",
+            "description": "What the device is kept for; jobs carry it as `reservation`."
+          },
+          "note": {
+            "type": [
+              "string",
+              "null"
+            ],
+            "maxLength": 500,
+            "description": "Why, for whoever reads the shelf."
+          }
+        }
+      },
       "Result": {
         "type": "object",
         "properties": {
@@ -5070,6 +5290,25 @@
           "pages"
         ]
       },
+      "Unreservation": {
+        "type": "object",
+        "required": [
+          "device_id",
+          "was"
+        ],
+        "properties": {
+          "device_id": {
+            "type": "string"
+          },
+          "was": {
+            "type": [
+              "string",
+              "null"
+            ],
+            "description": "The label it was reserved for, or null."
+          }
+        }
+      },
       "Validation": {
         "type": "object",
         "properties": {
diff --git a/collector/schemas/job.schema.json b/collector/schemas/job.schema.json
index 09d68d6..83218ce 100644
--- a/collector/schemas/job.schema.json
+++ b/collector/schemas/job.schema.json
@@ -96,6 +96,11 @@
       "items": { "type": "string" },
       "description": "Job ids this one waits for. The job is enqueued as 'waiting' and becomes 'queued' when the last of them finishes; if any of them fails or is cancelled, this one fails with last_error naming it. While waiting, a spec may reference a dependency's output: \"${jobs.<id>.artifact}\" resolves to the first sha256 in that job's final row, and \"${jobs.<id>.metrics.<key>}\" to one of its metrics. A whole-string reference keeps the value's type, so a metric stays a number. Referencing a job not listed here is refused at enqueue."
     },
+    "reservation": {
+      "type": "string",
+      "pattern": "^[A-Za-z0-9][A-Za-z0-9._:-]{0,63}$",
+      "description": "The device reservation this job holds. A device reserved with `fleet device reserve <id> <label>` is offered only to a job whose reservation is that label and that names the device explicitly: targets.device_id, or a targets.match that pins its id (device_id == '<id>'). Fan-out, pools and every other match skip it, and a job that pins a reserved device without the label is refused with device_reserved. On an unreserved device the field changes nothing."
+    },
     "preemptible": {
       "type": "boolean",
       "description": "Whether a higher-priority job may ask this one to step aside. When true, a beacon is answered with preempt:true once a strictly higher-priority queued job would go to the same claimant; the runner is expected to checkpoint, upload its progress, and post a final row with preempted:true. That requeues the job with params.resume_from set to the uploaded sha256 and hands the attempt back, so stepping aside never counts against max_attempts. Equal priority does not preempt."
@@ -135,8 +140,8 @@
       "type": "object",
       "properties": {
         "pool": { "type": "string" },
-        "device_id": { "type": "string", "description": "pin this job to exactly one device-executor agent" },
-        "match": { "type": "string", "description": "descriptor expression, e.g. \"ram_mb >= 4000 && os ~ 'android'\" — fields: model, soc, ram_mb, os, app_ver, device_id, pools; ops == != < <= > >= ~(regex) && || ! ( )" },
+        "device_id": { "type": "string", "description": "pin this job to exactly one device (a device-executor agent, or a device a host executor drives); the way to name a reserved device" },
+        "match": { "type": "string", "description": "descriptor expression, e.g. \"ram_mb >= 4000 && os ~ 'android'\" — fields: model, soc, ram_mb, os, app_ver, device_id, pools; a reserved device is matched only by a job carrying its reservation whose expression pins its id; ops == != < <= > >= ~(regex) && || ! ( )" },
         "exclusive": { "type": "boolean", "description": "host jobs: hold collector device locks on all targets while running, starving device-executor agents until release" },
         "executor": { "type": "string", "description": "which host executor should claim this — a statement about which machine can reach the toolchain or the device, which no descriptor field can express" },
         "url": { "type": "string", "description": "web-test only: what to point the browser at; no device is involved and none is locked" },
diff --git a/collector/scripts/smoke.ts b/collector/scripts/smoke.ts
index 5a10b69..f26715f 100644
--- a/collector/scripts/smoke.ts
+++ b/collector/scripts/smoke.ts
@@ -21,6 +21,7 @@ import { runConfigChecks } from "../src/config.test.js";
 import { runDbChecks } from "../src/db.test.js";
 import { runAlertChecks } from "../src/alerts.test.js";
 import { runSkipChecks } from "../src/skip.test.js";
+import { runReservationChecks } from "../src/reserved.test.js";
 import { runReasonChecks } from "../src/result-reason.test.js";
 import { runRegistryHygieneChecks } from "../src/registry-hygiene.test.js";
 import { runBrowserChecks } from "../src/browser.test.js";
@@ -2849,6 +2850,121 @@ runConfigChecks(check);
   for (const j of [ANDROID, IOS, NOBODY, STATUS]) await json("POST", `/api/jobs/${j}/cancel`, {});
 }
 
+// 41. a reserved device is offered only to the job that holds it, by name
+{
+  // The growth pilot's phone: signed in to a real account and cabled to an
+  // executor that also takes `os ~ 'android'` work. Fan-out, pools, unpinned
+  // matches and executor routing must all pass it by; only a job carrying the
+  // label AND pinning its id may have it.
+  const PHONE = `res-phone-${run}`, SPARE = `res-spare-${run}`, AGENT = `res-agent-${run}`;
+  const EXEC_P = `res-exec-p-${run}`, EXEC_S = `res-exec-s-${run}`, NEVER = `res-never-${run}`;
+  const POOL = `res-pool-${run}`, AGENT_POOL = `res-agent-pool-${run}`, MODEL = `SM-RES-${run}`;
+  const LABEL = `growth-${run}`;
+
+  const pre = await json("POST", `/api/v1/devices/${PHONE}/reserve`, { label: LABEL, note: "smoke" });
+  check("a device can be reserved before it has ever registered",
+    pre.status === 200 && pre.body?.reserved_for === LABEL && pre.body?.registered === false && pre.body?.note === "smoke",
+    JSON.stringify(pre.body));
+  const again = await json("POST", `/api/v1/devices/${PHONE}/reserve`, { label: LABEL });
+  check("reserving again with the same label is fine", again.status === 200, JSON.stringify(again.body));
+  const clash = await json("POST", `/api/v1/devices/${PHONE}/reserve`, { label: `other-${run}` });
+  check("a different label is a conflict until unreserved", clash.status === 409 && clash.body?.error?.code === "conflict",
+    JSON.stringify(clash.body));
+  const badLabel = await json("POST", `/api/v1/devices/${PHONE}/reserve`, { label: "two words" });
+  check("a label with a space is refused", badLabel.status === 400, JSON.stringify(badLabel.body));
+
+  for (const [id, exec] of [[PHONE, EXEC_P], [SPARE, EXEC_S]])
+    await json("POST", "/devices/register", {
+      device_id: id, pools: [POOL],
+      descriptor: { model: MODEL, os: "android-9", kind: "device", serial: id, attached_to: exec },
+    });
+  const listed = (await json("GET", `/api/v1/devices?q=res-&per_page=500`)).body?.items as { device_id: string; reserved_for: string | null }[] | undefined;
+  check("the shelf says which device is reserved, and for what",
+    listed?.find((d) => d.device_id === PHONE)?.reserved_for === LABEL &&
+      listed?.find((d) => d.device_id === SPARE)?.reserved_for === null,
+    JSON.stringify(listed));
+
+  const host = (job_id: string, extra: Record<string, unknown>) => ({
+    schema: 1, job_id, workload: "install", executor: "host",
+    app: { name: "x", build: "1", sha256: "0".repeat(64) }, lease: { ttl_s: 60, max_attempts: 1 }, ...extra,
+  });
+
+  // Fan-out over the pool, with and without the label: the phone is skipped
+  // both times, because neither names it.
+  const fan = await json("POST", "/jobs", host(`res-fan-${run}`, { fanout: true, targets: { pool: POOL, executor: NEVER } }));
+  check("fan-out skips a reserved device", fan.status === 201 &&
+    JSON.stringify(fan.body?.fanout) === JSON.stringify([`res-fan-${run}--${SPARE}`]), JSON.stringify(fan.body));
+  const fanL = await json("POST", "/jobs", host(`res-fanl-${run}`, {
+    fanout: true, reservation: LABEL, targets: { pool: POOL, executor: NEVER },
+  }));
+  check("fan-out carrying the label still skips it: the label alone is not a pin",
+    JSON.stringify(fanL.body?.fanout) === JSON.stringify([`res-fanl-${run}--${SPARE}`]), JSON.stringify(fanL.body));
+
+  // The dry run says why the phone is missing.
+  const dry = await json("POST", "/api/v1/jobs/validate", host(`res-dry-${run}`, { targets: { pool: POOL, executor: NEVER } }));
+  check("validate names the reserved device it left out",
+    dry.body?.valid === true && (dry.body?.warnings ?? []).some((w: string) => w.includes(PHONE) && w.includes(LABEL)),
+    JSON.stringify(dry.body?.warnings));
+
+  // Pinning it without the label is refused at the door, on both routes.
+  const pinV1 = await json("POST", "/api/v1/jobs", host(`res-pin-${run}`, { targets: { match: `device_id == '${PHONE}'`, executor: NEVER } }));
+  check("a match that pins a reserved device without the label is refused with device_reserved",
+    pinV1.status === 409 && pinV1.body?.error?.code === "device_reserved", JSON.stringify(pinV1.body));
+  const pinLegacy = await json("POST", "/jobs", host(`res-pin2-${run}`, { targets: { device_id: PHONE, executor: NEVER } }));
+  check("so is a targets.device_id pin on the older route", pinLegacy.status === 409, JSON.stringify(pinLegacy.body));
+  const wrongLabel = await json("POST", "/api/v1/jobs", host(`res-pin3-${run}`, {
+    reservation: `other-${run}`, targets: { device_id: PHONE, executor: NEVER },
+  }));
+  check("and so is a pin carrying someone else's label", wrongLabel.body?.error?.code === "device_reserved", JSON.stringify(wrongLabel.body));
+  const badField = await json("POST", "/api/v1/jobs", host(`res-bad-${run}`, { reservation: "no spaces allowed", targets: { executor: NEVER } }));
+  check("a malformed reservation is an invalid spec", badField.status === 400, JSON.stringify(badField.body));
+
+  // Routing. An unpinned job matching both phones must go to the executor
+  // holding the spare, not the one holding the reserved phone; the growth job
+  // goes to the phone's executor. EXEC_P polls first and must skip past the
+  // unpinned job to take its own.
+  const UNPINNED = `res-unpinned-${run}`, GROWTH = `res-growth-${run}`;
+  const u = await json("POST", "/jobs", host(UNPINNED, { priority: 100, targets: { match: `model == '${MODEL}'` } }));
+  const g = await json("POST", "/api/v1/jobs", host(GROWTH, {
+    priority: 100, reservation: LABEL, targets: { match: `device_id == '${PHONE}'`, exclusive: true },
+  }));
+  check("the growth job (label + pin) is accepted", u.status === 201 && g.status === 201, JSON.stringify([u.body, g.body]));
+  const p = await json("GET", `/executor/next-job?name=${EXEC_P}`);
+  check("the reserved phone's executor is not handed the unpinned job, only the growth job",
+    p.body?.job_id === GROWTH, JSON.stringify(p.body?.job_id));
+  check("and the claim carries the reservations for the executor's own device selection",
+    p.body?.reserved_devices?.[PHONE] === LABEL && p.body?.reservation === LABEL, JSON.stringify(p.body?.reserved_devices));
+  const sp = await json("GET", `/executor/next-job?name=${EXEC_S}`);
+  check("the unpinned job goes to the executor holding the unreserved phone", sp.body?.job_id === UNPINNED,
+    JSON.stringify(sp.body?.job_id));
+
+  // A device-executor agent: same rule at its own claim.
+  await json("POST", "/devices/register", { device_id: AGENT, pools: [AGENT_POOL], descriptor: { model: "Res", os: "android-14" } });
+  await json("POST", `/api/v1/devices/${AGENT}/reserve`, { label: LABEL });
+  const POOLED = `res-pooled-${run}`, MINE = `res-mine-${run}`;
+  const bench = (job_id: string, extra: Record<string, unknown>) => ({
+    schema: 1, job_id, workload: "benchmark", executor: "device", backend: "synthetic", priority: 100, ...extra,
+  });
+  await json("POST", "/jobs", bench(POOLED, { targets: { pool: AGENT_POOL } }));
+  await json("POST", "/jobs", bench(MINE, { reservation: LABEL, targets: { device_id: AGENT } }));
+  const a1 = await json("GET", `/devices/${AGENT}/next-job`);
+  check("a reserved agent passes over pool work and claims the job that holds it", a1.body?.job_id === MINE,
+    JSON.stringify(a1.body?.job_id));
+  await json("POST", "/results", { schema: 1, kind: "result", job_id: MINE, device_id: AGENT, iter: 0, final: true, ok: true });
+
+  const un = await json("POST", `/api/v1/devices/${AGENT}/unreserve`);
+  check("unreserve says what it was", un.status === 200 && un.body?.was === LABEL, JSON.stringify(un.body));
+  const a2 = await json("GET", `/devices/${AGENT}/next-job`);
+  check("and the device takes ordinary work again", a2.body?.job_id === POOLED, JSON.stringify(a2.body?.job_id));
+  const none = await json("POST", `/api/v1/devices/never-reserved-${run}/unreserve`);
+  check("unreserving a device that was not reserved is not an error", none.status === 200 && none.body?.was === null,
+    JSON.stringify(none.body));
+
+  for (const j of [GROWTH, UNPINNED, POOLED, `res-fan-${run}--${SPARE}`, `res-fanl-${run}--${SPARE}`])
+    await json("POST", `/api/jobs/${j}/cancel`, {});
+  await json("POST", `/api/v1/devices/${PHONE}/unreserve`);
+}
+
 
 // driver's error codes, and the migration path a fresh database never takes.
 runDbChecks(check);
@@ -2860,6 +2976,7 @@ runAlertChecks(check);
 // Honest green: how a job closes (done, failed, skipped), every failure saying
 // why, and the registry keeping to real things.
 runSkipChecks(check);
+await runReservationChecks(check);
 await runReasonChecks(check);
 runRegistryHygieneChecks(check);
 
diff --git a/collector/src/api/devices.ts b/collector/src/api/devices.ts
index 2cc1d99..986a809 100644
--- a/collector/src/api/devices.ts
+++ b/collector/src/api/devices.ts
@@ -16,10 +16,12 @@ type DeviceRow = {
   last_seen: string;
   last_beacon: string | null;
   age_s: number | null;
+  reserved_for: string | null;
 };
 
 const DEVICE_SELECT = `SELECT device_id, descriptor, pools, pools_override, capabilities, ttl_s, last_net, name, notes,
-                              last_seen, last_beacon, ${AGE("last_seen")} AS age_s
+                              last_seen, last_beacon, ${AGE("last_seen")} AS age_s,
+                              (SELECT label FROM device_reservations r WHERE r.device_id = devices.device_id) AS reserved_for
                        FROM devices`;
 
 function shapeDevice(d: DeviceRow) {
@@ -38,6 +40,9 @@ function shapeDevice(d: DeviceRow) {
     // null, not [], for an agent that predates capabilities: the dashboard says
     // "all" for that case rather than showing it as able to run nothing.
     capabilities: deviceCapabilities(d),
+    // The label of the work this device is kept for, or null. A reserved device
+    // is offered only to jobs carrying this label that pin it by id.
+    reserved_for: d.reserved_for,
     last_net: d.last_net,
     // An agent that declared itself temporary, and whether its window closed.
     ttl_s: d.ttl_s,
diff --git a/collector/src/api/index.ts b/collector/src/api/index.ts
index c1da2a6..9f34119 100644
--- a/collector/src/api/index.ts
+++ b/collector/src/api/index.ts
@@ -29,6 +29,7 @@ type MatchingDevices = (
   match?: string,
   workload?: string,
   backend?: string | null,
+  job?: { reservation?: unknown; targets?: { device_id?: string; match?: string } | null },
 ) => {
   device_id: string; pools: string; pools_override: string | null;
   descriptor: string; capabilities: string | null;
diff --git a/collector/src/api/mutations.ts b/collector/src/api/mutations.ts
index 4733ab9..479ae6f 100644
--- a/collector/src/api/mutations.ts
+++ b/collector/src/api/mutations.ts
@@ -22,6 +22,7 @@ const EXPLORE_RUN_KEEP_DAYS = 7;
 type Announce = (event: { type: string; [k: string]: unknown }) => void;
 type MatchingDevices = (
   pool?: string, match?: string, workload?: string, backend?: string | null,
+  job?: { reservation?: unknown; targets?: { device_id?: string; match?: string } | null },
 ) => {
   device_id: string; pools: string; pools_override: string | null;
   descriptor: string; capabilities: string | null;
@@ -424,7 +425,7 @@ export function registerMutations(app: FastifyInstance, announce: Announce, matc
     if (!requireToken(req, reply)) return;
     const body = (req.body ?? {}) as {
       targets?: { pool?: string; match?: string; device_id?: string };
-      workload?: string; backend?: string;
+      workload?: string; backend?: string; reservation?: string;
     };
     const t = body.targets ?? {};
     if (t.match && !isValidMatch(t.match))
@@ -433,7 +434,9 @@ export function registerMutations(app: FastifyInstance, announce: Announce, matc
     // The composer knows the workload it is about to enqueue, so the preview
     // counts the agents that can actually run it rather than every agent the
     // pool and match happen to select.
-    let devices = matchingDevices(t.pool, t.match, body.workload, body.backend ?? null);
+    // With the reservation the job would carry, so a reserved device is
+    // counted exactly when the job could have it.
+    let devices = matchingDevices(t.pool, t.match, body.workload, body.backend ?? null, { reservation: body.reservation, targets: t });
     if (t.device_id) devices = devices.filter((d) => d.device_id === t.device_id);
 
     return {
diff --git a/collector/src/api/v1/routes.ts b/collector/src/api/v1/routes.ts
index 919ec62..1608741 100644
--- a/collector/src/api/v1/routes.ts
+++ b/collector/src/api/v1/routes.ts
@@ -39,6 +39,7 @@ import { SCHEMAS } from "./schemas.js";
 import { isSkipError } from "../../skip.js";
 import { errorsOf, paramsValidator, validateSpec, type SchemaError } from "./spec-check.js";
 import { findingDetail, listFindings, parseVerdictBody, setVerdict } from "../../findings.js";
+import { RESERVATION_LABEL } from "../../reserved.js";
 
 // --- the table's types ------------------------------------------------------------
 
@@ -563,6 +564,51 @@ export const ROUTES: Route[] = [
     responses: [{ status: 200, description: "The device.", schema: "DeviceDetail" }, E404],
     handler: async ({ app, req, p }) => inner(app, req, "GET", `/api/devices/${encodeURIComponent(p.id)}`),
   },
+  {
+    operationId: "reserveDevice", method: "POST", path: "/api/v1/devices/{id}/reserve", tag: "devices", scope: "admin", idempotent: true,
+    summary: "Keep a device for one kind of work: only jobs with this reservation label that pin the device may use it.",
+    description:
+      "A reserved device is skipped by fan-out, pools and every targets.match that does not pin its id, on the brain and in " +
+      "the host executor's own device selection. A job may use it only with `reservation` set to the label and the device " +
+      "named in targets.device_id or a targets.match such as device_id == '<id>'. The device need not have registered yet, " +
+      "so a phone can be reserved before it is cabled up; `registered` says whether it has. Reserving again with the same " +
+      "label updates the note; a different label is a conflict until the device is unreserved.",
+    params: [{ name: "id", in: "path", type: "string", required: true, description: "The device id." }],
+    body: { schema: "ReserveInput", description: "The label, and an optional note for the people reading the shelf.", required: true },
+    responses: [{ status: 200, description: "Reserved.", schema: "Reservation" }, E400, E401, E403, E409],
+    handler: async ({ req, p }) => {
+      const body = (req.body ?? {}) as { label?: unknown; note?: unknown };
+      if (typeof body.label !== "string" || !RESERVATION_LABEL.test(body.label))
+        throw new ApiError(400, "bad_request", "label must be letters, digits, '.', '_', ':' or '-' (at most 64)", "for example growth-instagram");
+      if (body.note !== undefined && body.note !== null && typeof body.note !== "string")
+        throw new ApiError(400, "bad_request", "note must be a string");
+      const held = db.prepare("SELECT label FROM device_reservations WHERE device_id = ?").get(p.id) as { label: string } | undefined;
+      if (held && held.label !== body.label)
+        throw new ApiError(409, "conflict", `${p.id} is already reserved for '${held.label}'`, `fleet device unreserve ${p.id} first, if that work is over`);
+      const ctx = authOf(req);
+      db.prepare(
+        `INSERT INTO device_reservations (device_id, label, note, reserved_by) VALUES (?, ?, ?, ?)
+         ON CONFLICT(device_id) DO UPDATE SET note = excluded.note`,
+      ).run(p.id, body.label, typeof body.note === "string" && body.note ? body.note.slice(0, 500) : null, ctx.actor ?? ctx.source ?? null);
+      announce({ type: "device", device_id: p.id, event: "reserve", label: body.label });
+      return reservationView(p.id);
+    },
+  },
+  {
+    operationId: "unreserveDevice", method: "POST", path: "/api/v1/devices/{id}/unreserve", tag: "devices", scope: "admin", idempotent: true,
+    summary: "Give a reserved device back to the shelf: every job that matches it may use it again.",
+    description: "Not an error when the device was not reserved; `was` says what it was reserved for, or null.",
+    params: [{ name: "id", in: "path", type: "string", required: true, description: "The device id." }],
+    responses: [{ status: 200, description: "Released.", schema: "Unreservation" }, E401, E403],
+    handler: async ({ p }) => {
+      const held = db.prepare("SELECT label FROM device_reservations WHERE device_id = ?").get(p.id) as { label: string } | undefined;
+      if (held) {
+        db.prepare("DELETE FROM device_reservations WHERE device_id = ?").run(p.id);
+        announce({ type: "device", device_id: p.id, event: "unreserve", label: held.label });
+      }
+      return { device_id: p.id, was: held?.label ?? null };
+    },
+  },
 
   // workloads
   {
@@ -655,11 +701,12 @@ export const ROUTES: Route[] = [
       {
         status: 400,
         description:
-          "Malformed or refused before queueing: invalid_spec, no_matching_devices (no registered device matches the targets), " +
+          "Malformed or refused before queueing: invalid_spec, no_matching_devices (no registered device matches the targets; reserved devices are left out), " +
           "no_build (no artifact for app `latest`), invalid_match, invalid_dependency, secret_in_spec, bad_request.",
         schema: "Error",
       },
-      E401, E403, E409,
+      E401, E403,
+      { status: 409, description: "duplicate_job (that job_id exists), or device_reserved (the targets pin a device reserved for other work; set `reservation` to its label if this is that work).", schema: "Error" },
       {
         status: 422,
         description: "Valid, but cannot be queued: no_capable_agent (nothing declares the workload), unresolved_reference (a template reference that does not resolve).",
@@ -989,6 +1036,9 @@ export const ROUTES: Route[] = [
   {
     operationId: "nextJobForExecutor", method: "GET", path: "/executor/next-job", tag: "protocol", scope: "protocol", documentOnly: true,
     summary: "A host executor long-polling for host work.",
+    description:
+      "The claimed spec carries `reserved_devices` (device id to reservation label) beside the granted lease: the executor " +
+      "picks devices itself and must not run on a reserved one unless the job holds that reservation and pins it.",
     responses: [{ status: 200, description: "A claimed job spec.", schema: null }, { status: 204, description: "No work.", schema: null }],
   },
   {
@@ -1031,11 +1081,44 @@ export const ROUTES: Route[] = [
 // --- request bodies too small to deserve a component of their own -----------------------
 
 SCHEMAS.CancelInput = { type: "object", properties: { reason: { type: "string", maxLength: 500 } } };
+SCHEMAS.ReserveInput = {
+  type: "object",
+  required: ["label"],
+  properties: {
+    label: { type: "string", pattern: RESERVATION_LABEL.source, description: "What the device is kept for; jobs carry it as `reservation`." },
+    note: { type: ["string", "null"], maxLength: 500, description: "Why, for whoever reads the shelf." },
+  },
+};
+SCHEMAS.Reservation = {
+  type: "object",
+  required: ["device_id", "reserved_for", "note", "reserved_by", "reserved_at", "registered"],
+  properties: {
+    device_id: { type: "string" },
+    reserved_for: { type: "string", description: "The label. A job holds the reservation by setting `reservation` to it." },
+    note: { type: ["string", "null"] },
+    reserved_by: { type: ["string", "null"], description: "Who reserved it, when tokens are on; otherwise the source." },
+    reserved_at: { type: ["string", "null"] },
+    registered: { type: "boolean", description: "Whether the device has registered yet. false is allowed (reserve before cabling) but is also what a typo looks like." },
+  },
+};
+SCHEMAS.Unreservation = {
+  type: "object",
+  required: ["device_id", "was"],
+  properties: { device_id: { type: "string" }, was: { type: ["string", "null"], description: "The label it was reserved for, or null." } },
+};
 SCHEMAS.RetryInput = {
   type: "object",
   properties: { pool: { type: "string" }, device_id: { type: "string" }, priority: { type: "integer" } },
 };
 
+/** A reservation as the API answers it. */
+function reservationView(deviceId: string) {
+  const r = db.prepare("SELECT label, note, reserved_by, reserved_at FROM device_reservations WHERE device_id = ?").get(deviceId) as
+    { label: string; note: string | null; reserved_by: string | null; reserved_at: string };
+  const registered = db.prepare("SELECT 1 FROM devices WHERE device_id = ?").get(deviceId) !== undefined;
+  return { device_id: deviceId, reserved_for: r.label, note: r.note, reserved_by: r.reserved_by, reserved_at: iso(r.reserved_at), registered };
+}
+
 // --- registration ---------------------------------------------------------------------------
 
 const fastifyPath = (p: string) => p.replace(/\{(\w+)\}/g, ":$1");
diff --git a/collector/src/api/v1/schemas.ts b/collector/src/api/v1/schemas.ts
index 07076f1..95537a8 100644
--- a/collector/src/api/v1/schemas.ts
+++ b/collector/src/api/v1/schemas.ts
@@ -67,7 +67,7 @@ export const SCHEMAS: Record<string, Schema> = {
             description: "Stable and machine-readable. Branch on this, not on the message.",
             enum: [
               "bad_request", "invalid_spec", "not_found", "duplicate_job", "no_capable_agent",
-              "no_matching_devices", "secret_in_spec", "no_build", "invalid_match", "invalid_dependency",
+              "no_matching_devices", "device_reserved", "secret_in_spec", "no_build", "invalid_match", "invalid_dependency",
               "unresolved_reference", "conflict", "unauthorized", "insufficient_scope", "forbidden",
               "rate_limited", "internal",
             ],
@@ -125,6 +125,10 @@ export const SCHEMAS: Record<string, Schema> = {
       pools: { ...strs, description: "Effective pools: the override when set, otherwise what the runner reported." },
       pools_reported: strs, pools_override: { type: ["array", "null"], items: str },
       capabilities: { type: ["array", "null"], items: str, description: "null: an agent that predates capabilities, offered everything." },
+      reserved_for: {
+        type: ["string", "null"],
+        description: "The reservation this device is kept for, or null. A reserved device is offered only to a job whose reservation is this label and that pins the device by id (targets.device_id, or a targets.match such as device_id == '<id>'); fan-out, pools and other matches skip it.",
+      },
       last_net: nstr, ttl_s: nint, expired: bool, platform: str, kind: nstr, simulator: bool,
       status: { enum: ["online", "stale", "offline"] }, age_s: nint, last_seen: nstr,
       beacon: ref("Beacon"), current_job: nstr,
diff --git a/collector/src/client/api.gen.ts b/collector/src/client/api.gen.ts
index f6d883c..25e1aa6 100644
--- a/collector/src/client/api.gen.ts
+++ b/collector/src/client/api.gen.ts
@@ -118,6 +118,8 @@ export type Device = {
   pools_override: string[] | null;
   /** null: an agent that predates capabilities, offered everything. */
   capabilities: string[] | null;
+  /** The reservation this device is kept for, or null. A reserved device is offered only to a job whose reservation is this label and that pins the device by id (targets.device_id, or a targets.match such as device_id == '<id>'); fan-out, pools and other matches skip it. */
+  reserved_for: string | null;
   last_net: string | null;
   ttl_s: number | null;
   expired: boolean;
@@ -195,7 +197,7 @@ export type DeviceOutcome = {
 export type Error = {
   error: {
     /** Stable and machine-readable. Branch on this, not on the message. */
-    code: "bad_request" | "invalid_spec" | "not_found" | "duplicate_job" | "no_capable_agent" | "no_matching_devices" | "secret_in_spec" | "no_build" | "invalid_match" | "invalid_dependency" | "unresolved_reference" | "conflict" | "unauthorized" | "insufficient_scope" | "forbidden" | "rate_limited" | "internal";
+    code: "bad_request" | "invalid_spec" | "not_found" | "duplicate_job" | "no_capable_agent" | "no_matching_devices" | "device_reserved" | "secret_in_spec" | "no_build" | "invalid_match" | "invalid_dependency" | "unresolved_reference" | "conflict" | "unauthorized" | "insufficient_scope" | "forbidden" | "rate_limited" | "internal";
     message: string;
     /** What to do about it, when there is something to do. */
     hint?: string;
@@ -558,6 +560,8 @@ export type JobSpecInput = {
   params?: Record<string, unknown>;
   /** Job ids this one waits for. The job is enqueued as 'waiting' and becomes 'queued' when the last of them finishes; if any of them fails or is cancelled, this one fails with last_error naming it. While waiting, a spec may reference a dependency's output: "${jobs.<id>.artifact}" resolves to the first sha256 in that job's final row, and "${jobs.<id>.metrics.<key>}" to one of its metrics. A whole-string reference keeps the value's type, so a metric stays a number. Referencing a job not listed here is refused at enqueue. */
   depends_on?: string[];
+  /** The device reservation this job holds. A device reserved with `fleet device reserve <id> <label>` is offered only to a job whose reservation is that label and that names the device explicitly: targets.device_id, or a targets.match that pins its id (device_id == '<id>'). Fan-out, pools and every other match skip it, and a job that pins a reserved device without the label is refused with device_reserved. On an unreserved device the field changes nothing. */
+  reservation?: string;
   /** Whether a higher-priority job may ask this one to step aside. When true, a beacon is answered with preempt:true once a strictly higher-priority queued job would go to the same claimant; the runner is expected to checkpoint, upload its progress, and post a final row with preempted:true. That requeues the job with params.resume_from set to the uploaded sha256 and hands the attempt back, so stepping aside never counts against max_attempts. Equal priority does not preempt. */
   preemptible?: boolean;
   /** How long a claim stays valid without proof of life. The runner renews it by posting POST /results kind=beacon with this job_id; a lapsed lease is requeued by the collector's sweep, and failed once max_attempts is spent. Omit for the defaults: 600 s, or 14400 s for drain/soak, which run for hours between beacons. */
@@ -574,9 +578,9 @@ export type JobSpecInput = {
   });
   targets?: {
     pool?: string;
-    /** pin this job to exactly one device-executor agent */
+    /** pin this job to exactly one device (a device-executor agent, or a device a host executor drives); the way to name a reserved device */
     device_id?: string;
-    /** descriptor expression, e.g. "ram_mb >= 4000 && os ~ 'android'" — fields: model, soc, ram_mb, os, app_ver, device_id, pools; ops == != < <= > >= ~(regex) && || ! ( ) */
+    /** descriptor expression, e.g. "ram_mb >= 4000 && os ~ 'android'" — fields: model, soc, ram_mb, os, app_ver, device_id, pools; a reserved device is matched only by a job carrying its reservation whose expression pins its id; ops == != < <= > >= ~(regex) && || ! ( ) */
     match?: string;
     /** host jobs: hold collector device locks on all targets while running, starving device-executor agents until release */
     exclusive?: boolean;
@@ -646,6 +650,25 @@ export type JobSummary = {
   };
 };
 
+export type Reservation = {
+  device_id: string;
+  /** The label. A job holds the reservation by setting `reservation` to it. */
+  reserved_for: string;
+  note: string | null;
+  /** Who reserved it, when tokens are on; otherwise the source. */
+  reserved_by: string | null;
+  reserved_at: string | null;
+  /** Whether the device has registered yet. false is allowed (reserve before cabling) but is also what a typo looks like. */
+  registered: boolean;
+};
+
+export type ReserveInput = {
+  /** What the device is kept for; jobs carry it as `reservation`. */
+  label: string;
+  /** Why, for whoever reads the shelf. */
+  note?: string | null;
+};
+
 export type Result = {
   job_id: string;
   device_id: string;
@@ -726,6 +749,12 @@ export type TemplateList = {
   pages: number;
 };
 
+export type Unreservation = {
+  device_id: string;
+  /** The label it was reserved for, or null. */
+  was: string | null;
+};
+
 export type Validation = {
   valid: boolean;
   job_id?: string;
@@ -837,6 +866,33 @@ export class FleetClient extends Transport {
     return this.request<DeviceDetail>("GET", `/api/v1/devices/${enc(id)}`, { ...opts });
   }
 
+  /**
+   * Keep a device for one kind of work: only jobs with this reservation label that pin the device may use it.
+   *
+   * A reserved device is skipped by fan-out, pools and every targets.match that does not pin its id, on
+   * the brain and in the host executor's own device selection. A job may use it only with `reservation`
+   * set to the label and the device named in targets.device_id or a targets.match such as device_id ==
+   * '<id>'. The device need not have registered yet, so a phone can be reserved before it is cabled up;
+   * `registered` says whether it has. Reserving again with the same label updates the note; a different
+   * label is a conflict until the device is unreserved.
+   *
+   * `POST /api/v1/devices/{id}/reserve` · scope: admin
+   */
+  reserveDevice(id: string, body: ReserveInput, opts?: CallOptions): Promise<Reservation> {
+    return this.request<Reservation>("POST", `/api/v1/devices/${enc(id)}/reserve`, { ...opts, body });
+  }
+
+  /**
+   * Give a reserved device back to the shelf: every job that matches it may use it again.
+   *
+   * Not an error when the device was not reserved; `was` says what it was reserved for, or null.
+   *
+   * `POST /api/v1/devices/{id}/unreserve` · scope: admin
+   */
+  unreserveDevice(id: string, opts?: CallOptions): Promise<Unreservation> {
+    return this.request<Unreservation>("POST", `/api/v1/devices/${enc(id)}/unreserve`, { ...opts });
+  }
+
   /**
    * What the fleet can be asked to do, with an example spec each and whether anything live can claim it.
    *
diff --git a/collector/src/db.ts b/collector/src/db.ts
index d7cecc5..a00067f 100644
--- a/collector/src/db.ts
+++ b/collector/src/db.ts
@@ -375,6 +375,18 @@ CREATE TABLE IF NOT EXISTS device_locks (
   acquired_at TEXT NOT NULL DEFAULT (datetime('now'))
 );
 
+-- Devices only one kind of job may touch (see src/reserved.ts). A table of its
+-- own rather than a column on devices: a reservation has to exist before the
+-- phone is first cabled up, and has to outlive the registry forgetting the row
+-- -- a device that re-registered unreserved would be open to every job again.
+CREATE TABLE IF NOT EXISTS device_reservations (
+  device_id   TEXT PRIMARY KEY,
+  label       TEXT NOT NULL,
+  note        TEXT,
+  reserved_by TEXT,
+  reserved_at TEXT NOT NULL DEFAULT (datetime('now'))
+);
+
 -- Pipeline event rails: publish/subscribe without an external broker. Old
 -- devices publish trigger events; capable devices subscribe, process, and
 -- publish results to a sibling topic.
diff --git a/collector/src/executor.ts b/collector/src/executor.ts
index 0098347..d4e6a7f 100644
--- a/collector/src/executor.ts
+++ b/collector/src/executor.ts
@@ -31,6 +31,7 @@ import {
 import { targetsFrom } from "./drivers/devicectl.js";
 import { describeRoku, rokuDevPassword, rokuDevices, rokuPresenceHere, rokuTarget, type RokuDevice } from "./drivers/roku.js";
 import { evalMatch } from "./match.js";
+import { reservationAllows } from "./reserved.js";
 import { keychainPassword, redact, KEYCHAIN_SERVICE } from "./secrets.js";
 import { withNetwork, withNetworkAll, restoreAttached } from "./network-shape.js";
 import {
@@ -100,6 +101,11 @@ export type Job = {
   };
   params?: Record<string, unknown>;
   lease?: { ttl_s?: number };
+  // The device reservation this job holds, and every reservation on the
+  // fleet (device id to label) as the brain sent it with the claim. See
+  // src/reserved.ts and selectTargets.
+  reservation?: string;
+  reserved_devices?: Record<string, string>;
 };
 
 // The generic XCUITest bundle lives in the iOS runner repo; one scheme tests
@@ -207,7 +213,7 @@ async function simctlDevices(): Promise<Record<string, { udid: string; name: str
  * whatever it is" -- which no descriptor field expresses honestly, because
  * `kind` is a property of how the device is attached rather than of the device.
  */
-async function selectTargets(job: Job, all: Target[]): Promise<Target[]> {
+export async function selectTargets(job: Job, all: Target[]): Promise<Target[]> {
   const t = job.targets ?? {};
   let out = all;
 
@@ -245,16 +251,53 @@ async function selectTargets(job: Job, all: Target[]): Promise<Target[]> {
     out = owned;
   }
 
+  // Descriptors cost adb, simctl and devicectl calls, so nothing is queried
+  // unless a match expression or a reservation actually needs one, and each
+  // target is described at most once. `device_id` is added because the brain
+  // evaluates `targets.match` with it: without it here, a job pinned by
+  // `device_id == '<serial>'` was routed to the right executor and then
+  // matched nothing on it.
+  let tooling: { sims: Awaited<ReturnType<typeof simctlDevices>>; ios: IosDeviceInfo[] | null } | null = null;
+  const described = new Map<string, Record<string, unknown>>();
+  const descriptorOf = async (target: Target) => {
+    tooling ??= {
+      sims: await simctlDevices(),
+      ios: out.some((x) => x.platform === "ios") ? await devicectlDevices() : null,
+    };
+    let d = described.get(target.id);
+    if (!d) {
+      d = { ...(await describeTarget(target, tooling.sims, tooling.ios)), device_id: target.id };
+      described.set(target.id, d);
+    }
+    return d;
+  };
+
+  // Reservations, before the match: a reserved device is not offered to this
+  // job at all unless it holds the reservation and names the device, which is
+  // the same rule the brain applied when it routed the claim. Without it the
+  // executor would run an `os ~ 'android'` job on every Android phone it can
+  // see, the reserved one included.
+  const reserved = job.reserved_devices ?? {};
+  if (out.some((x) => reserved[x.id])) {
+    const kept: Target[] = [];
+    const held: string[] = [];
+    for (const target of out) {
+      const label = reserved[target.id];
+      // A device_id pin needs no descriptor; a match pin does.
+      const d = label && !t.device_id && t.match ? await descriptorOf(target) : {};
+      if (reservationAllows(job, target.id, label, d)) kept.push(target);
+      else held.push(`${target.id} (reserved for ${label})`);
+    }
+    if (held.length > 0) log(`leaving out ${held.length} reserved device(s): ${held.join(", ")}`);
+    out = kept;
+  }
+
   if (t.match) {
-    // Descriptors cost adb, simctl and devicectl calls, so nothing is queried
-    // unless a match expression actually needs one.
-    const sims = await simctlDevices();
-    const ios = out.some((x) => x.platform === "ios") ? await devicectlDevices() : null;
     const kept: Target[] = [];
     for (const target of out) {
-      const d = await describeTarget(target, sims, ios);
+      const d = await descriptorOf(target);
       try {
-        if (evalMatch(t.match, d as Record<string, unknown>)) kept.push(target);
+        if (evalMatch(t.match, d)) kept.push(target);
       } catch (e) {
         // A malformed expression must not silently select everything.
         throw new Error(`targets.match is invalid: ${(e as Error).message}`);
@@ -1986,7 +2029,7 @@ type WebProfile = {
   missing?: string;
 };
 
-async function expandWebProfiles(names: string[]): Promise<WebProfile[]> {
+async function expandWebProfiles(names: string[], job: Pick<Job, "reservation" | "targets" | "reserved_devices">): Promise<WebProfile[]> {
   const out: WebProfile[] = [];
   let all: Target[] | null = null;
   const targets = async () => (all ??= await listTargets());
@@ -1994,6 +2037,11 @@ async function expandWebProfiles(names: string[]): Promise<WebProfile[]> {
     if (name === "android-device") {
       const owned: Target[] = [];
       for (const t of (await targets()).filter((t) => t.platform === "android")) {
+        // A reserved phone is not a browser for the screenshot matrix. Only a
+        // device_id pin can release one here: there is no descriptor to judge
+        // a match against, and a web-shots job is not the work it is kept for.
+        const label = job.reserved_devices?.[t.id];
+        if (label && !reservationAllows(job, t.id, label, {})) continue;
         if (await fleetOwnedTarget(t, null)) owned.push(t);
       }
       if (owned.length === 0) out.push({ profile: name, missing: `no fleet-owned Android device attached to ${NAME}` });
@@ -2214,7 +2262,7 @@ async function runWebShots(job: Job) {
   // profiles: the lease budgets one profile's capture, not the whole matrix.
   const timeoutS = leaseBudgetS(job);
 
-  const expanded = await expandWebProfiles(profiles);
+  const expanded = await expandWebProfiles(profiles, job);
 
   // Device-backed captures drive hardware the device-executor also hands work
   // to, so they hold collector locks for the whole run — a benchmark starting
diff --git a/collector/src/queue.ts b/collector/src/queue.ts
index 823d83a..4040374 100644
--- a/collector/src/queue.ts
+++ b/collector/src/queue.ts
@@ -13,6 +13,7 @@
  */
 import { db, isUniqueViolation } from "./db.js";
 import { evalMatch, isValidMatch } from "./match.js";
+import { pinsDevice, RESERVATION_LABEL, reservationAllows, reservedReason, type ReservationSubject } from "./reserved.js";
 import { announce } from "./announce.js";
 import { AGE, capabilityMatches, deviceCapabilities, effectivePools, isExpired, parse } from "./api/shared.js";
 import {
@@ -88,9 +89,22 @@ export type JobSpec = {
   // for the same claimant. Honoured by the collector's beacon reply; a runner
   // that ignores it simply keeps running, which is the old behaviour.
   preemptible?: boolean;
+  // The label of the device reservation this job holds. A reserved device is
+  // only offered to a job carrying its label that also pins it by id; on an
+  // unreserved device the field changes nothing. See src/reserved.ts.
+  reservation?: string;
   [k: string]: unknown;
 };
 
+/** Every reservation, device id to label. Read per call: a reservation made a
+ *  second ago must hold on the very next claim. */
+export function deviceReservations(): Map<string, string> {
+  return new Map(
+    (db.prepare("SELECT device_id, label FROM device_reservations").all() as { device_id: string; label: string }[])
+      .map((r) => [r.device_id, r.label]),
+  );
+}
+
 // web-test and web-shots are host-executed like ui-test, but their target is a
 // URL rather than a device: no phone is involved and none is locked. web-test
 // runs Playwright suites; web-shots captures the screenshot matrix the
@@ -133,7 +147,14 @@ export const WORKLOADS = new Set([
 /** Devices a `targets` clause selects. Shared by fan-out and by the composer's
  *  "N devices match" preview, so the preview cannot disagree with what fan-out
  *  will actually do. */
-export function matchingDevices(pool?: string, match?: string, workload?: string, backend?: string | null) {
+export function matchingDevices(
+  pool?: string, match?: string, workload?: string, backend?: string | null,
+  // Whose reservations to honour. Omitted, a reserved device is never selected:
+  // a caller that cannot say which reservation it holds holds none.
+  job: ReservationSubject = {},
+  opts: { ignoreReservations?: boolean } = {},
+) {
+  const reserved = opts.ignoreReservations ? new Map<string, string>() : deviceReservations();
   return (
     db.prepare(
       `SELECT device_id, pools, pools_override, descriptor, capabilities, ttl_s,
@@ -159,11 +180,19 @@ export function matchingDevices(pool?: string, match?: string, workload?: string
     // Checked before the expression, so a match expression can narrow the set
     // but never widen an agent past what its own code can run.
     if (workload && !capabilityMatches(capabilities, workload, backend)) return false;
+    let descriptor: Record<string, unknown>;
+    try {
+      descriptor = { ...JSON.parse(d.descriptor), device_id: d.device_id, pools, capabilities: capabilities ?? [] };
+    } catch {
+      return false;
+    }
+    // A reserved device is out of every pool and every match unless this job
+    // holds its reservation and names it. This is what keeps a fan-out, the
+    // composer's preview and an `os ~ 'android'` job off the growth phone.
+    if (!reservationAllows(job, d.device_id, reserved.get(d.device_id), descriptor)) return false;
     if (match) {
       try {
-        return evalMatch(match, {
-          ...JSON.parse(d.descriptor), device_id: d.device_id, pools, capabilities: capabilities ?? [],
-        });
+        return evalMatch(match, descriptor);
       } catch {
         return false;
       }
@@ -172,6 +201,33 @@ export function matchingDevices(pool?: string, match?: string, workload?: string
   });
 }
 
+/**
+ * The reserved device this job pins without holding its reservation, if any.
+ *
+ * Asked at enqueue so a pinned job that could never run is refused while the
+ * caller is still there to read why, instead of sitting queued (a device job)
+ * or skipping with "no targets" (a host job). A reservation can exist before
+ * its device has ever registered, so an unregistered one is judged on its id
+ * alone.
+ */
+function reservedConflict(spec: JobSpec): { device_id: string; label: string } | null {
+  const targets = spec.targets;
+  if (!targets?.device_id && !targets?.match) return null;
+  const reserved = deviceReservations();
+  if (reserved.size === 0) return null;
+  const rows = new Map(
+    (db.prepare(
+      `SELECT device_id, descriptor FROM devices WHERE device_id IN (${[...reserved.keys()].map(() => "?").join(",")})`,
+    ).all(...reserved.keys()) as { device_id: string; descriptor: string }[])
+      .map((r) => [r.device_id, parse<Record<string, unknown>>(r.descriptor, {})]),
+  );
+  for (const [deviceId, label] of reserved) {
+    if (spec.reservation === label) continue;
+    if (pinsDevice(targets, deviceId, rows.get(deviceId) ?? {})) return { device_id: deviceId, label };
+  }
+  return null;
+}
+
 /**
  * Is there any agent on the fleet that could run this workload? The built-in
  * set is always serviceable — those workloads live in the executor, which does
@@ -244,6 +300,7 @@ export type ErrorCode =
   | "duplicate_job"
   | "no_capable_agent"
   | "no_matching_devices"
+  | "device_reserved"
   | "secret_in_spec"
   | "no_build"
   | "invalid_match"
@@ -387,6 +444,9 @@ export function enqueueJob(
   if (spec.preemptible !== undefined && typeof spec.preemptible !== "boolean")
     return refuse(400, "invalid_spec", "preemptible must be a boolean");
 
+  if (spec.reservation !== undefined && (typeof spec.reservation !== "string" || !RESERVATION_LABEL.test(spec.reservation)))
+    return refuse(400, "invalid_spec", "reservation must be a label of letters, digits, '.', '_', ':' or '-' (at most 64)");
+
   // Dependencies. Refused at enqueue rather than discovered later: a chain that
   // names a job nobody ever posted would otherwise sit in 'waiting' forever,
   // looking exactly like a chain whose build is merely slow.
@@ -415,6 +475,15 @@ export function enqueueJob(
   if (spec.targets?.match && !isValidMatch(spec.targets.match))
     return refuse(400, "invalid_match", `invalid targets.match expression: ${spec.targets.match}`);
 
+  {
+    const conflict = reservedConflict(spec);
+    if (conflict)
+      return refuse(
+        409, "device_reserved", reservedReason(conflict.device_id, conflict.label),
+        `add "reservation": "${conflict.label}" if this job is that work; otherwise target another device`,
+      );
+  }
+
   const pool = spec.targets?.pool;
   const match = spec.targets?.match;
   // Same predicate the claim uses, so neither fan-out nor a preview can name a
@@ -423,8 +492,8 @@ export function enqueueJob(
   // applied.
   const selected = () =>
     spec.executor === "device"
-      ? matchingDevices(pool, match, spec.workload, spec.backend ?? null)
-      : matchingDevices(pool, match);
+      ? matchingDevices(pool, match, spec.workload, spec.backend ?? null, spec)
+      : matchingDevices(pool, match, undefined, undefined, spec);
 
   const existing = db.prepare("SELECT 1 FROM jobs WHERE job_id = ?").get(spec.job_id);
 
@@ -441,13 +510,15 @@ export function enqueueJob(
       return refuse(400, "invalid_spec", "fanout.distinct must be a descriptor field name");
 
     let devices = selected();
-    if (devices.length === 0)
+    if (devices.length === 0) {
+      const held = reservedLeftOut(spec, devices);
       return refuse(
         400, "no_matching_devices",
         `no registered devices${pool ? ` in pool ${pool}` : ""}${match ? ` matching ${match}` : ""}` +
-          ` can run ${spec.workload}`,
+          ` can run ${spec.workload}` + (held.length ? ` (left out as reserved: ${held.join(", ")})` : ""),
         "list devices with GET /api/v1/devices",
       );
+    }
 
     // "One per distinct OS" is the canary shape: a smoke pass on every OS on
     // the shelf without paying for every phone. Newest-seen wins within a
@@ -478,7 +549,7 @@ export function enqueueJob(
       return {
         ok: true, http: 200, status: depState.status, job_id: spec.job_id,
         fanout: children.map((c) => c.job_id),
-        preview: { spec, candidates: devices.map(candidate), warnings: warningsFor(spec, devices.length, depState) },
+        preview: { spec, candidates: devices.map(candidate), warnings: warningsFor(spec, devices, depState) },
       };
     }
 
@@ -513,7 +584,7 @@ export function enqueueJob(
     if (spec.targets?.device_id) devices = devices.filter((d) => d.device_id === spec.targets?.device_id);
     return {
       ok: true, http: 200, status: depState.status, job_id: spec.job_id,
-      preview: { spec, candidates: devices.map(candidate), warnings: warningsFor(spec, devices.length, depState) },
+      preview: { spec, candidates: devices.map(candidate), warnings: warningsFor(spec, devices, depState) },
     };
   }
 
@@ -539,8 +610,9 @@ export function enqueueJob(
  * queued. Every one of these has cost somebody an afternoon of waiting on a job
  * that was never going to start.
  */
-function warningsFor(spec: JobSpec, candidates: number, deps: { status: string; reason?: string }): string[] {
+function warningsFor(spec: JobSpec, selected: { device_id: string }[], deps: { status: string; reason?: string }): string[] {
   const out: string[] = [];
+  const candidates = selected.length;
   if (deps.status === "failed") out.push(`a dependency already failed (${deps.reason ?? "unknown"}); the job would be failed at once`);
   if (deps.status === "skipped") out.push(`a dependency already skipped (${deps.reason ?? "unknown"}); the job would be skipped at once, since there is nothing for it to run on`);
   if (deps.status === "waiting") out.push("waiting on depends_on; it starts when those jobs are done");
@@ -556,5 +628,24 @@ function warningsFor(spec: JobSpec, candidates: number, deps: { status: string;
     else if (wanted && !live.some((e) => e.name === wanted))
       out.push(`targets.executor is '${wanted}', which has not polled in the last two minutes (live: ${live.map((e) => e.name).join(", ")})`);
   }
+  // A reservation is silent by design at claim time -- the device is simply
+  // not offered -- so the dry run is where it gets said.
+  const held = reservedLeftOut(spec, selected);
+  if (held.length) out.push(`left out as reserved for other work: ${held.join(", ")}`);
+  if (spec.reservation && ![...deviceReservations().values()].includes(spec.reservation))
+    out.push(`no device is reserved for '${spec.reservation}'; the field only matters on a device that is`);
   return out;
 }
+
+/** Reserved devices these targets would otherwise have selected, as "id (label)". */
+function reservedLeftOut(spec: JobSpec, selected: { device_id: string }[]): string[] {
+  const reserved = deviceReservations();
+  if (reserved.size === 0) return [];
+  const kept = new Set(selected.map((d) => d.device_id));
+  const workload = spec.executor === "device" ? spec.workload : undefined;
+  const backend = spec.executor === "device" ? spec.backend ?? null : undefined;
+  return matchingDevices(spec.targets?.pool, spec.targets?.match, workload, backend, spec, { ignoreReservations: true })
+    .filter((d) => reserved.has(d.device_id) && !kept.has(d.device_id))
+    .filter((d) => !spec.targets?.device_id || d.device_id === spec.targets.device_id)
+    .map((d) => `${d.device_id} (${reserved.get(d.device_id)})`);
+}
diff --git a/collector/src/reserved.test.ts b/collector/src/reserved.test.ts
new file mode 100644
index 0000000..c235e78
--- /dev/null
+++ b/collector/src/reserved.test.ts
@@ -0,0 +1,84 @@
+/**
+ * Reserved devices: the rule, and the host executor applying it.
+ *
+ * The case is the growth pilot's phone on ultra: signed in to Instagram, and
+ * cabled to a Mac whose executor also runs the explore night and anything else
+ * that says `os ~ 'android'`. The brain-side half (claims, fan-out, routing,
+ * enqueue refusals) is exercised over HTTP in smoke.ts; this is the pure rule
+ * and the executor's own device selection, which never talks to the brain's
+ * database.
+ */
+import { selectTargets, type Job } from "./executor.js";
+import { pinsDevice, reservationAllows, RESERVATION_LABEL } from "./reserved.js";
+
+type Check = (name: string, cond: boolean, detail?: string) => void;
+
+const PHONE = "988a1b3541354f565a";
+const LABEL = "growth-instagram";
+const android = { model: "SM-G955U", os: "android-9", serial: PHONE };
+
+export async function runReservationChecks(check: Check) {
+  // --- the rule ---------------------------------------------------------------
+  check("an unreserved device takes any job", reservationAllows({}, PHONE, null, android));
+  check("a reserved device refuses a job with no reservation",
+    !reservationAllows({ targets: { match: "os ~ 'android'" } }, PHONE, LABEL, android));
+  check("a reserved device refuses the label without a pin (a fan-out or pool carrying it)",
+    !reservationAllows({ reservation: LABEL, targets: { match: "os ~ 'android'" } }, PHONE, LABEL, android));
+  check("a reserved device refuses a pin without the label (a stale script, a retry --device)",
+    !reservationAllows({ targets: { device_id: PHONE } }, PHONE, LABEL, android));
+  check("a reserved device refuses another reservation's label",
+    !reservationAllows({ reservation: "other", targets: { device_id: PHONE } }, PHONE, LABEL, android));
+  check("label + targets.device_id is allowed",
+    reservationAllows({ reservation: LABEL, targets: { device_id: PHONE } }, PHONE, LABEL, android));
+  check("label + targets.match device_id == '<id>' is allowed (the kit's shape)",
+    reservationAllows({ reservation: LABEL, targets: { match: `device_id == '${PHONE}'` } }, PHONE, LABEL, android));
+  check("a pin narrowed further still pins",
+    pinsDevice({ match: `device_id == '${PHONE}' && os ~ 'android'` }, PHONE, android));
+  check("a serial pin counts, since the serial is the id",
+    pinsDevice({ match: `serial == '${PHONE}'` }, PHONE, android));
+  check("an || that would match the phone under any name does not pin",
+    !pinsDevice({ match: `device_id == '${PHONE}' || os ~ 'android'` }, PHONE, android));
+  check("a negated pin does not pin", !pinsDevice({ match: `device_id != 'something-else'` }, PHONE, android));
+  check("a pin on another device does not pin this one", !pinsDevice({ device_id: "emulator-5554" }, PHONE, android));
+  check("a malformed match pins nothing", !pinsDevice({ match: "device_id ==" }, PHONE, android));
+  check("labels: a sane label passes", RESERVATION_LABEL.test(LABEL) && RESERVATION_LABEL.test("pilot:ig.2"));
+  check("labels: spaces, quotes and empty are refused",
+    !RESERVATION_LABEL.test("growth phone") && !RESERVATION_LABEL.test("x'") && !RESERVATION_LABEL.test(""));
+
+  // --- the host executor's own selection --------------------------------------
+  // Two cabled phones (serials, not emulator-NNNN, so membership asks no adb).
+  // The executor picks devices from what it can see, so this is the half the
+  // brain cannot enforce for it.
+  const OTHER = "R58M12ABCDE";
+  const attached = [
+    { id: PHONE, platform: "android", kind: "device" as const },
+    { id: OTHER, platform: "android", kind: "device" as const },
+  ];
+  const reserved_devices = { [PHONE]: LABEL };
+  const job = (j: Partial<Job>): Job => ({ job_id: "t", workload: "ui-test", reserved_devices, ...j });
+  const ids = (ts: { id: string }[]) => ts.map((t) => t.id).join(",");
+
+  const unpinned = await selectTargets(job({}), attached);
+  check("executor: an unpinned job runs on everything but the reserved phone", ids(unpinned) === OTHER, ids(unpinned));
+
+  const pinnedNoLabel = await selectTargets(job({ targets: { device_id: PHONE } }), attached);
+  check("executor: a pin without the label gets nothing", pinnedNoLabel.length === 0, ids(pinnedNoLabel));
+
+  const labelledFanout = await selectTargets(job({ reservation: LABEL, targets: {} }), attached);
+  check("executor: the label alone does not unlock the phone", ids(labelledFanout) === OTHER, ids(labelledFanout));
+
+  const growth = await selectTargets(job({ reservation: LABEL, targets: { device_id: PHONE } }), attached);
+  check("executor: label + device_id gets exactly the phone", ids(growth) === PHONE, ids(growth));
+
+  // The kit's job: targets.match "device_id == '<id>'". This also proves the
+  // executor evaluates device_id at all -- it used to describe an Android
+  // target without it, so this pin matched nothing once claimed.
+  const kit = await selectTargets(job({ reservation: LABEL, targets: { match: `device_id == '${PHONE}'` } }), attached);
+  check("executor: label + a device_id match gets exactly the phone", ids(kit) === PHONE, ids(kit));
+
+  const plainPin = await selectTargets({ job_id: "t", workload: "ui-test", targets: { match: `device_id == '${OTHER}'` } }, attached);
+  check("executor: targets.match can name device_id on an unreserved device", ids(plainPin) === OTHER, ids(plainPin));
+
+  const oldBrain = await selectTargets({ job_id: "t", workload: "ui-test" }, attached);
+  check("executor: with no reservations sent, nothing is held back", oldBrain.length === 2, ids(oldBrain));
+}
diff --git a/collector/src/reserved.ts b/collector/src/reserved.ts
new file mode 100644
index 0000000..c321780
--- /dev/null
+++ b/collector/src/reserved.ts
@@ -0,0 +1,90 @@
+/**
+ * Reserved devices: hardware that only one kind of job may touch.
+ *
+ * The case that made this necessary is a phone signed in to a real account --
+ * the growth pilot's Instagram phone on ultra -- where any other job that
+ * happens to match it opens other apps on top of a logged-in session. Pools and
+ * match expressions cannot protect it: they say what a job WANTS, and an
+ * unpinned `os ~ 'android'`, a fan-out or the explore night wants every Android
+ * device it can see. A reservation turns it round and says what the DEVICE
+ * accepts.
+ *
+ * A reserved device is given only to a job that
+ *
+ *   1. carries the same label in `reservation`, and
+ *   2. names the device explicitly: `targets.device_id`, or a `targets.match`
+ *      that pins its id (it matches this device and would stop matching if the
+ *      device had any other id -- `device_id == '<id>'` is the usual form).
+ *
+ * Both, because each alone fails open. A label alone lets a fan-out carrying it
+ * land on every reserved device with that label as well as the rest of the
+ * shelf; a pin alone is what a stale script or a retry with `--device` already
+ * has.
+ *
+ * Pure on purpose: the brain judges claims and fan-out with it, and the host
+ * executor -- a separate process that must not open the brain's database --
+ * applies the same rule to the devices it can see.
+ */
+import { evalMatch } from "./match.js";
+
+/** A reservation label: short, and safe to print in a table or a log line. */
+export const RESERVATION_LABEL = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,63}$/;
+
+/** The parts of a job spec a reservation is judged on. */
+export type ReservationSubject = {
+  reservation?: unknown;
+  targets?: { device_id?: string; match?: string } | null;
+};
+
+/** Stands in for "some other device" when testing whether a match pins an id. */
+const ANOTHER_DEVICE = "\u0000another-device";
+
+/**
+ * Does this job name this device explicitly?
+ *
+ * `targets.device_id` is the plain answer. For `targets.match` the test is
+ * behavioural rather than textual: the expression must select this device, and
+ * must stop selecting it once every field carrying the device's id (device_id,
+ * and serial or udid where they are the same string) is swapped for another
+ * id. That accepts `device_id == 'X' && os ~ 'android'` and refuses
+ * `device_id == 'X' || os ~ 'android'`, which would have matched this phone
+ * whatever it was called.
+ */
+export function pinsDevice(
+  targets: ReservationSubject["targets"],
+  deviceId: string,
+  descriptor: Record<string, unknown>,
+): boolean {
+  if (!targets) return false;
+  if (targets.device_id) return targets.device_id === deviceId;
+  if (!targets.match) return false;
+  const self = { ...descriptor, device_id: deviceId };
+  const other: Record<string, unknown> = {};
+  for (const [k, v] of Object.entries(self)) other[k] = v === deviceId ? ANOTHER_DEVICE : v;
+  try {
+    return evalMatch(targets.match, self) && !evalMatch(targets.match, other);
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * May this job run on this device? Always yes for an unreserved device (`label`
+ * null or undefined); for a reserved one, only with the same label and an
+ * explicit pin.
+ */
+export function reservationAllows(
+  job: ReservationSubject,
+  deviceId: string,
+  label: string | null | undefined,
+  descriptor: Record<string, unknown>,
+): boolean {
+  if (!label) return true;
+  return job.reservation === label && pinsDevice(job.targets, deviceId, descriptor);
+}
+
+/** Why a reserved device was not offered, in the words a skip or a warning uses. */
+export function reservedReason(deviceId: string, label: string): string {
+  return `${deviceId} is reserved for '${label}': only a job with reservation '${label}' that pins it ` +
+    `(targets.device_id, or targets.match "device_id == '${deviceId}'") may use it`;
+}
diff --git a/collector/src/server.ts b/collector/src/server.ts
index 1fb43f1..f522fa7 100644
--- a/collector/src/server.ts
+++ b/collector/src/server.ts
@@ -42,7 +42,8 @@ import { firstArtifactSha, settleWaiters, type DepSettlement } from "./api/mutat
 import { announce } from "./announce.js";
 import { closingStatus, type Closing } from "./skip.js";
 import { forgetStaleSimulators, retireRokuIpDuplicate } from "./registry-hygiene.js";
-import { enqueueJob, matchingDevices, resolveLatestBuild, type JobSpec } from "./queue.js";
+import { deviceReservations, enqueueJob, matchingDevices, resolveLatestBuild, type JobSpec } from "./queue.js";
+import { reservationAllows } from "./reserved.js";
 import { authOf, authWarnings, provenanceOf, registerAuth } from "./auth.js";
 import { needsAdmin } from "./api/policy.js";
 import { registerDeprecations } from "./api/v1/deprecations.js";
@@ -222,10 +223,12 @@ type ClaimantContext = {
   descriptor: Record<string, unknown>;
   beacon: Record<string, unknown> | null;
   beaconAgeS: number | null;
+  /** The label this device is reserved for, or null. See src/reserved.ts. */
+  reservedFor: string | null;
 };
 
 function claimantContext(executor: "device" | "host", claimant: string): ClaimantContext {
-  const empty = { executor, claimant, pools: [] as string[], capabilities: null, descriptor: {}, beacon: null, beaconAgeS: null };
+  const empty = { executor, claimant, pools: [] as string[], capabilities: null, descriptor: {}, beacon: null, beaconAgeS: null, reservedFor: null };
   // A host executor has no device row: it is judged only on targets.executor.
   if (executor !== "device") return empty;
   const dev = db
@@ -239,6 +242,9 @@ function claimantContext(executor: "device" | "host", claimant: string): Claiman
         descriptor: string; last_beacon: string | null; age_s: number | null }
     | undefined;
   if (!dev) return empty;
+  const reservation = db.prepare("SELECT label FROM device_reservations WHERE device_id = ?").get(claimant) as
+    | { label: string }
+    | undefined;
   const pools = effectivePools(dev);
   const capabilities = deviceCapabilities(dev);
   let beacon: Record<string, unknown> | null = null;
@@ -253,6 +259,7 @@ function claimantContext(executor: "device" | "host", claimant: string): Claiman
     },
     beacon,
     beaconAgeS: dev.age_s ?? null,
+    reservedFor: reservation?.label ?? null,
   };
 }
 
@@ -279,11 +286,16 @@ function executorsHolding(spec: JobSpec): Set<string> {
     )
     .all() as { device_id: string; descriptor: string; age_s: number | null }[];
   const holders = new Set<string>();
+  const reserved = deviceReservations();
   for (const r of rows) {
     if (r.age_s === null || r.age_s > ONLINE_S) continue;
     if (spec.targets?.device_id && spec.targets.device_id !== r.device_id) continue;
     let d: Record<string, unknown>;
     try { d = JSON.parse(r.descriptor) as Record<string, unknown>; } catch { continue; }
+    // A reserved device draws no job to its executor unless the job may use
+    // it: otherwise an `os ~ 'android'` job would route to ultra because the
+    // growth phone is cabled there, and then skip with nothing to run on.
+    if (!reservationAllows(spec, r.device_id, reserved.get(r.device_id), d)) continue;
     if (spec.targets?.match) {
       try { if (!evalMatch(spec.targets.match, { ...d, device_id: r.device_id })) continue; } catch { continue; }
     }
@@ -308,6 +320,9 @@ function specEligibleFor(ctx: ClaimantContext, spec: JobSpec): boolean {
   }
 
   if (spec.targets?.device_id && spec.targets.device_id !== ctx.claimant) return false;
+  // Before pools and capabilities: a reserved device is not available to this
+  // job at all, whatever else it would be suited for.
+  if (!reservationAllows(spec, ctx.claimant, ctx.reservedFor, ctx.descriptor)) return false;
   const pool = spec.targets?.pool;
   if (pool && !ctx.pools.includes(pool)) return false;
   // An agent is never handed a workload it did not say it could run. This sits
@@ -599,7 +614,16 @@ app.get("/executor/next-job", async (req, reply) => {
   // beacon with) can only budget itself if it is told the real number.
   const granted = db.prepare("SELECT lease_ttl_s FROM jobs WHERE job_id = ?").get(spec.job_id) as
     { lease_ttl_s?: number } | undefined;
-  return { ...spec, lease: { ...(spec.lease ?? {}), ttl_s: granted?.lease_ttl_s ?? spec.lease?.ttl_s } };
+  return {
+    ...spec,
+    lease: { ...(spec.lease ?? {}), ttl_s: granted?.lease_ttl_s ?? spec.lease?.ttl_s },
+    // Every reservation, device id to label, handed over with the claim. The
+    // executor picks the devices it runs on itself, from what it can see, so
+    // it has to apply the same rule the brain does -- and getting the list in
+    // the claim's own answer means there is no second request to fail and no
+    // window in which it ran on a phone it should not have.
+    reserved_devices: Object.fromEntries(deviceReservations()),
+  };
 });
 
 // --- jobs ---
diff --git a/docs/agents.md b/docs/agents.md
index acea22a..e5f1e56 100644
--- a/docs/agents.md
+++ b/docs/agents.md
@@ -48,6 +48,7 @@ the file name to write. `--out -` writes to stdout.
 | `--param k=v` | A workload param; repeatable, dotted keys nest, values parsed as JSON where they parse |
 | `--fanout` | One child job per matching device |
 | `--backend B` · `--priority N` · `--id JOB_ID` | The spec fields of the same names; `--id` is an idempotency key |
+| `--reservation LABEL` | The spec's `reservation`: required, with a pin, to run on a [reserved device](concepts.md#reserved-devices) |
 | `--validate` | Validate, print where it would land, and stop |
 | `--no-validate` | Skip the dry run and let the enqueue refuse it instead |
 | `--no-wait` | Print the job id and exit 0 |
@@ -55,7 +56,8 @@ the file name to write. `--out -` writes to stdout.
 
 | Other commands | |
 |---|---|
-| `fleetr devices [--all] [--platform P] [--pool P]` | Online devices, or the whole shelf |
+| `fleetr devices [--all] [--platform P] [--pool P]` | Online devices, or the whole shelf; `RESERVED` names a device kept for other work |
+| `fleetr device reserve ID LABEL [--note T]` · `fleetr device unreserve ID` | Keep a device for jobs with `"reservation": LABEL` that pin it by id ([Reserved devices](concepts.md#reserved-devices)); admin scope |
 | `fleetr workloads [NAME] [--available]` | What the fleet can run; NAME prints the params schema and an example spec |
 | `fleetr job ID` · `fleetr wait ID [--timeout S]` | The verdict now, or when it finishes (default 1800 s); exits with the verdict |
 | `fleetr cancel ID [--reason R]` | Cancel; cascades over a fan-out and fails whatever waited on it |
diff --git a/docs/api.md b/docs/api.md
index 61494c5..2e3e26f 100644
--- a/docs/api.md
+++ b/docs/api.md
@@ -21,11 +21,12 @@ disagree: the test suite fails if they do.
 |---|---|---|
 | `GET /api/v1/health` | none | Version, auth mode, `api: "v1"` |
 | `GET /api/v1/whoami` | none | Who the collector thinks you are, and your scopes |
-| `GET /api/v1/devices` · `/devices/{id}` | read | The shelf, with status (`online`, `stale`, `offline`) and current job. The list carries `facets` (`pools`, `platforms`, `kinds`) over every device, not only the filtered ones |
+| `GET /api/v1/devices` · `/devices/{id}` | read | The shelf, with status (`online`, `stale`, `offline`), current job and `reserved_for`. The list carries `facets` (`pools`, `platforms`, `kinds`) over every device, not only the filtered ones |
+| `POST /api/v1/devices/{id}/reserve` · `/unreserve` | admin | `{label, note?}`: keep a device for jobs whose `reservation` is that label and that pin it by id; see [Reserved devices](concepts.md#reserved-devices). The device need not have registered (`registered: false`). A different label while reserved is 409 `conflict`; unreserve answers `{was}` |
 | `GET /api/v1/workloads` · `/workloads/{name}` | read | What the fleet can run: executor, params schema, a valid example spec, how many live agents can take it |
 | `GET /api/v1/templates` | read | Saved job templates |
 | `GET /api/v1/jobs` | read | Jobs; filter by `status` (`waiting`, `queued`, `claimed`, `done`, `failed`, `cancelled`, `skipped`), `workload`, `executor` (`device` or `host`), `device`, `pool`, `source`, `requested_by`, `mine=true`, `q` (substring of the job id), `from`/`to`, `has_error=true`. The list carries `facets` over the whole table: `status_counts`, `workloads`, `pools` |
-| `POST /api/v1/jobs` | run | Enqueue. 201 with the job id, its status, and links to its summary and wait URLs. 422 `no_capable_agent` when no live agent declares the workload (or backend), or `unresolved_reference`; 400 `no_matching_devices` when the targets match no registered device, `no_build` when `latest` names no published build, and `invalid_spec`, `invalid_match`, `invalid_dependency`, `secret_in_spec`. The OpenAPI document lists the same |
+| `POST /api/v1/jobs` | run | Enqueue. 201 with the job id, its status, and links to its summary and wait URLs. 422 `no_capable_agent` when no live agent declares the workload (or backend), or `unresolved_reference`; 400 `no_matching_devices` when the targets match no registered device, `no_build` when `latest` names no published build, and `invalid_spec`, `invalid_match`, `invalid_dependency`, `secret_in_spec`; 409 `device_reserved` when the targets pin a reserved device and the spec does not carry its `reservation`. The OpenAPI document lists the same |
 | `POST /api/v1/jobs/validate` | run | Dry run: schema errors by path, the devices it would land on, warnings. Always 200 |
 | `GET /api/v1/jobs/{id}` | read | One job, with its spec |
 | `GET /api/v1/jobs/{id}/summary` | read | The verdict across every device, per-device outcomes and artifact refs. Works for a fan-out parent |
@@ -45,7 +46,7 @@ disagree: the test suite fails if they do.
 
 **Errors** are `{error: {code, message, hint?, details?}}`. `code` is one of
 `bad_request`, `invalid_spec`, `not_found`, `duplicate_job`,
-`no_capable_agent`, `no_matching_devices`, `secret_in_spec`, `no_build`,
+`no_capable_agent`, `no_matching_devices`, `device_reserved`, `secret_in_spec`, `no_build`,
 `invalid_match`, `invalid_dependency`, `unresolved_reference`, `conflict`,
 `unauthorized`, `insufficient_scope`, `forbidden`, `rate_limited`, `internal`.
 `hint` says what to do next, for a person or an agent.
diff --git a/docs/concepts.md b/docs/concepts.md
index 57164d6..020b130 100644
--- a/docs/concepts.md
+++ b/docs/concepts.md
@@ -97,6 +97,58 @@ published eval actually demonstrates, on a 3922 MB emulator.
 named executor; unset stays permissive, so anything not pinned is claimable by
 whichever executor is free.
 
+### Reserved devices
+
+Some hardware must only ever do one thing. The case that added this is the
+growth pilot's phone on ultra: signed in to a real Instagram account, cabled to
+a Mac whose executor also takes the explore night and any job that says
+`os ~ 'android'`. Every one of those would open its own app on top of the
+signed-in session. Pools and matches cannot prevent that, because they say what
+a job *wants*; a reservation says what the *device* accepts.
+
+```sh
+fleet device reserve 988a1b3541354f565a growth-instagram --note "Instagram pilot, signed in"
+fleet device unreserve 988a1b3541354f565a
+```
+
+A reserved device is offered only to a job that does **both**:
+
+- carries the label: `"reservation": "growth-instagram"`, and
+- names the device: `targets.device_id`, or a `targets.match` that pins its id
+  (`"device_id == '988a1b3541354f565a'"`, optionally narrowed with `&&`).
+
+```json
+{
+  "workload": "ui-test", "executor": "host", "reservation": "growth-instagram",
+  "targets": { "executor": "ultra-phone", "match": "device_id == '988a1b3541354f565a'", "exclusive": true },
+  "lease": { "max_attempts": 1 }
+}
+```
+
+Either alone fails open, which is why it is both. A label on its own would let
+a fan-out carrying it spread across the whole shelf; a pin on its own is what a
+stale script or a `fleet retry --device` already has. "Pins its id" is tested by
+behaviour, not by reading the expression: the match has to select the device,
+and has to stop selecting it once the device's id (and a `serial` equal to it)
+is swapped for any other. `device_id == 'X' || os ~ 'android'` therefore does
+not pin `X`.
+
+Everything else passes the device by. Fan-out leaves it out (and says so when
+that leaves nothing), the composer's "N devices match" does not count it, a
+device-executor agent that is reserved does not claim other work, and an
+unpinned host job is not routed to the executor holding it. The executor picks
+its own devices from what it can see, so the claim hands it every reservation
+(`reserved_devices`) and its target selection applies the same rule; the
+`web-shots` Android-Chrome profile skips a reserved phone too. A job that pins a
+reserved device without the label is refused at enqueue with `device_reserved`
+rather than left to queue or skip, and `POST /api/v1/jobs/validate` warns when
+targets would have selected a reserved device.
+
+A reservation lives in the brain's database (`device_reservations`), not on the
+device row, so a phone can be reserved before it is first cabled up and stays
+reserved when the registry forgets and re-learns it. `fleet devices` and
+`fleet_devices` show it as `reserved_for`.
+
 ## Belonging to more than one fleet
 
 An agent may register with several collectors. Two people with two collectors
@@ -210,7 +262,7 @@ while someone is typing.
 
 `"fanout": true` enqueues one child per matching device, pinned with
 `targets.device_id` and suffixed `--<device_id>`. A whole-shelf benchmark is one
-request.
+request. [Reserved devices](#reserved-devices) are never among them.
 
 `"fanout": { "distinct": "os" }` enqueues one child per distinct value of that
 descriptor field, newest-seen first. That is the canary shape: a smoke pass on
diff --git a/docs/protocol.md b/docs/protocol.md
index 1b1046d..a80d9c5 100644
--- a/docs/protocol.md
+++ b/docs/protocol.md
@@ -121,6 +121,12 @@ running.
 }
 ```
 
+A host executor's claim also carries `reserved_devices`, device id to label.
+An executor chooses its own devices from what it can reach, so it must leave out
+a reserved one unless the job's `reservation` is that label and the job pins the
+device by id ([Reserved devices](concepts.md#reserved-devices)). The field is
+new and optional; an executor that predates it simply does not know.
+
 **Enforce `constraints.require_charging` and `min_battery_pct` yourself, before
 you start**, and refuse with a failed result if they are not met. Those are the
 two the runner owns; the collector enforces the rest before it ever offers you
diff --git a/fleet/src/mcp/tools.ts b/fleet/src/mcp/tools.ts
index b8388bb..9eb5b4e 100644
--- a/fleet/src/mcp/tools.ts
+++ b/fleet/src/mcp/tools.ts
@@ -63,6 +63,7 @@ const NEXT: Record<string, string> = {
   invalid_spec: "fleet_workloads with name=<workload> returns a valid example; fleet_validate shows each problem.",
   no_capable_agent: "No live agent declares this workload. fleet_workloads with available_only=true lists what can run now.",
   no_matching_devices: "Nothing matches the targets. fleet_devices lists what is online and what each can run.",
+  device_reserved: "That device is kept for other work (fleet_devices shows reserved_for). Target another device; do not add the reservation to get it.",
   duplicate_job: "That job_id exists. Omit job_id to have one generated, or fleet_job to read the existing one.",
   no_build: "No artifact is published under that app name. Check app.name, or pin app.sha256.",
   not_found: "Check the id. fleet_results lists recent jobs.",
@@ -175,6 +176,10 @@ const DEVICE_OUT: Record<string, Json> = {
           platform: { type: ["string", "null"] }, kind: { type: ["string", "null"] }, model: { type: ["string", "null"] },
           os: { type: ["string", "null"] }, pools: { type: "array", items: { type: "string" } },
           capabilities: { type: ["array", "null"], items: { type: "string" } }, current_job: { type: ["string", "null"] },
+          reserved_for: {
+            type: ["string", "null"],
+            description: "Kept for one kind of work: only a job with this reservation label that pins the device by id may use it. Do not target it otherwise.",
+          },
         },
       },
     },
@@ -293,6 +298,7 @@ export const TOOLS: Tool[] = [
             model: (ds.model as string) ?? null, os: (ds.os as string) ?? null,
             ...(ds.attached_to ? { attached_to: ds.attached_to as string } : {}),
             pools: d.pools, capabilities: d.capabilities, current_job: d.current_job ?? null,
+            reserved_for: d.reserved_for ?? null,
           };
         });
       const out = { devices, total: devices.length };
diff --git a/fleet/src/work.ts b/fleet/src/work.ts
index 39a1572..08d7931 100644
--- a/fleet/src/work.ts
+++ b/fleet/src/work.ts
@@ -1,5 +1,5 @@
 /**
- * The work commands: `fleet devices`, `run`, `job`, `wait`, `results`...
+ * The work commands: `fleet devices`, `device`, `run`, `job`, `wait`, `results`...
  *
  * The same /api/v1 operations the MCP tools call, through the same generated
  * client, for the two users who prefer a shell: a person, and a coding agent
@@ -187,6 +187,7 @@ async function buildSpec(client: FleetClient, a: Args): Promise<JobSpecInput> {
     };
   }
   if (str(a, "backend")) spec.backend = str(a, "backend");
+  if (str(a, "reservation")) spec.reservation = str(a, "reservation");
   if (str(a, "priority")) spec.priority = num(a, "priority", 0);
   if (str(a, "id")) spec.job_id = str(a, "id");
   if (a.flags.fanout === true) spec.fanout = true;
@@ -216,13 +217,42 @@ async function devices(client: FleetClient, a: Args) {
   table(
     page.items.map((d) => {
       const ds = d.descriptor as Record<string, unknown>;
-      return [d.device_id, d.status, d.platform, String(ds.model ?? ""), String(ds.os ?? ""), d.pools.join(","), d.current_job ?? "", ago(d.last_seen)];
+      return [d.device_id, d.status, d.platform, String(ds.model ?? ""), String(ds.os ?? ""), d.pools.join(","), d.reserved_for ?? "", d.current_job ?? "", ago(d.last_seen)];
     }),
-    ["DEVICE", "STATUS", "PLATFORM", "MODEL", "OS", "POOLS", "RUNNING", "SEEN"],
+    ["DEVICE", "STATUS", "PLATFORM", "MODEL", "OS", "POOLS", "RESERVED", "RUNNING", "SEEN"],
   );
   return EXIT.passed;
 }
 
+/**
+ * `fleet device reserve <id> <label>` and `fleet device unreserve <id>`.
+ *
+ * A reserved device is given only to jobs whose `reservation` is the label and
+ * that pin the device by id; everything else -- fan-out, pools, an unpinned
+ * match, the explore night -- skips it. Admin scope, because it decides who
+ * may use a piece of hardware.
+ */
+async function device(client: FleetClient, a: Args) {
+  const [action, id, label] = a.positional;
+  if (action === "reserve") {
+    if (!id || !label) throw new UsageError("usage: fleet device reserve <device_id> <label> [--note TEXT]");
+    const r = await client.reserveDevice(id, { label, ...(str(a, "note") ? { note: str(a, "note") } : {}) });
+    if (a.flags.json) return printJson(r), EXIT.passed;
+    out(`${r.device_id} reserved for ${r.reserved_for}`);
+    out(`  only jobs with "reservation": "${r.reserved_for}" that pin it (targets.device_id, or targets.match "device_id == '${r.device_id}'") will use it`);
+    if (!r.registered) err(`  note: ${r.device_id} has not registered with this collector yet -- right if it is not cabled up, a typo otherwise`);
+    return EXIT.passed;
+  }
+  if (action === "unreserve") {
+    if (!id) throw new UsageError("usage: fleet device unreserve <device_id>");
+    const r = await client.unreserveDevice(id);
+    if (a.flags.json) return printJson(r), EXIT.passed;
+    out(r.was ? `${r.device_id} is no longer reserved (was ${r.was})` : `${r.device_id} was not reserved`);
+    return EXIT.passed;
+  }
+  throw new UsageError("usage: fleet device reserve <device_id> <label> [--note TEXT] | fleet device unreserve <device_id>");
+}
+
 async function workloads(client: FleetClient, a: Args) {
   if (a.positional[0]) {
     const w = await client.getWorkload(a.positional[0]);
@@ -562,8 +592,10 @@ function skill(a: Args) {
 
 export const WORK_USAGE = `
   fleet devices [--all] [--platform P] [--pool P]     What is on the shelf.
+  fleet device reserve ID LABEL [--note TEXT] | fleet device unreserve ID
+                          Keep a device for jobs with "reservation": LABEL that pin it by id (admin).
   fleet workloads [NAME] [--available]                What it can run; NAME prints an example spec.
-  fleet run WORKLOAD [--device ID|--pool P|--match EXPR] [--app NAME] [--param k=v]...
+  fleet run WORKLOAD [--device ID|--pool P|--match EXPR] [--reservation LABEL] [--app NAME] [--param k=v]...
             [--spec FILE|-] [--fanout] [--validate] [--no-wait] [--timeout S]
                           Validate, queue, wait, print the verdict. Exit code is the verdict.
   fleet job ID | fleet wait ID [--timeout S]          A job's verdict, now or when it finishes.
@@ -584,7 +616,7 @@ export const WORK_USAGE = `
   Exit codes: 0 passed, 1 failed, 2 usage/invalid spec, 3 still running, 4 skipped (nothing ran), 5 refused/unreachable.
 `;
 
-export const WORK_COMMANDS = new Set(["devices", "workloads", "run", "job", "wait", "cancel", "retry", "results", "flaky", "artifact", "findings", "finding", "verdict", "login", "logout", "whoami", "token", "skill"]);
+export const WORK_COMMANDS = new Set(["devices", "device", "workloads", "run", "job", "wait", "cancel", "retry", "results", "flaky", "artifact", "findings", "finding", "verdict", "login", "logout", "whoami", "token", "skill"]);
 
 export async function workCommand(command: string, argv: string[]): Promise<number> {
   const a = parseArgs(argv);
@@ -596,6 +628,7 @@ export async function workCommand(command: string, argv: string[]): Promise<numb
     const client = connect({ url: str(a, "url"), token: str(a, "token"), source: "cli" });
     switch (command) {
       case "devices": return await devices(client, a);
+      case "device": return await device(client, a);
       case "workloads": return await workloads(client, a);
       case "run": return await run(client, a);
       case "job": return await job(client, a, false);
diff --git a/fleet/test/cli.test.ts b/fleet/test/cli.test.ts
index d74077a..ab8a57a 100644
--- a/fleet/test/cli.test.ts
+++ b/fleet/test/cli.test.ts
@@ -195,3 +195,46 @@ test("findings, finding --flow and verdict: the morning brief and a finding beco
   const notABug = await fleet(["verdict", String(id), "not-a-bug"]);
   assert.match(notABug.stdout, /retired/);
 });
+
+test("device reserve keeps a phone for one job; devices shows it; unreserve gives it back", async () => {
+  const early = await fleet(["device", "reserve", "cli-not-cabled-yet", "growth-ig"]);
+  assert.equal(early.code, 0, early.stderr);
+  assert.match(early.stderr, /has not registered/);
+
+  const r = await fleet(["device", "reserve", "cli-phone", "growth-ig", "--note", "signed in to the pilot account"]);
+  assert.equal(r.code, 0, r.stderr);
+  assert.match(r.stdout, /cli-phone reserved for growth-ig/);
+
+  const list = await fleet(["devices"]);
+  assert.match(list.stdout, /RESERVED/);
+  assert.match(list.stdout.split("\n").find((l) => l.startsWith("cli-phone")) ?? "", /growth-ig/);
+  const listed = json(await fleet(["devices", "--json"])).items.find((d: { device_id: string }) => d.device_id === "cli-phone");
+  assert.equal(listed.reserved_for, "growth-ig");
+
+  const clash = await fleet(["device", "reserve", "cli-phone", "someone-else"]);
+  assert.equal(clash.code, 5);
+  assert.match(clash.stderr, /conflict/);
+
+  // Pinned without the label: the validation step refuses it before anything
+  // is queued (exit 2, like any spec the collector would not take), and
+  // queueing it anyway is refused with the code.
+  const refused = await fleet(["run", "benchmark", "--device", "cli-phone", "--timeout", "30"]);
+  assert.equal(refused.code, 2, refused.stderr);
+  assert.match(refused.stderr, /reserved for 'growth-ig'/);
+  const forced = await fleet(["run", "benchmark", "--device", "cli-phone", "--no-validate", "--no-wait"]);
+  assert.equal(forced.code, 5, forced.stderr);
+  assert.match(forced.stderr, /device_reserved/);
+
+  // With it: runs on the phone.
+  const held = await fleet(["run", "benchmark", "--device", "cli-phone", "--reservation", "growth-ig", "--timeout", "30", "--json"]);
+  assert.equal(held.code, 0, held.stderr);
+  assert.equal(json(held).verdict, "passed");
+
+  const un = await fleet(["device", "unreserve", "cli-phone"]);
+  assert.equal(un.code, 0, un.stderr);
+  assert.match(un.stdout, /no longer reserved \(was growth-ig\)/);
+  await fleet(["device", "unreserve", "cli-not-cabled-yet"]);
+
+  const usage = await fleet(["device", "reserve", "cli-phone"]);
+  assert.equal(usage.code, 2);
+});
diff --git a/fleet/test/mcp.test.ts b/fleet/test/mcp.test.ts
index b503c44..d0edf82 100644
--- a/fleet/test/mcp.test.ts
+++ b/fleet/test/mcp.test.ts
@@ -68,7 +68,16 @@ test("a notification gets no reply; an unknown method is method-not-found; an un
 test("fleet_devices lists the device with structured content", async () => {
   const r = await call("fleet_devices");
   assert.ok(!r.isError, r.content[0].text);
-  assert.ok(r.structuredContent.devices.some((d: { device_id: string }) => d.device_id === "mcp-phone"));
+  const phone = r.structuredContent.devices.find((d: { device_id: string }) => d.device_id === "mcp-phone");
+  assert.ok(phone);
+  assert.equal(phone.reserved_for, null, "an unreserved device says so rather than leaving the field out");
+  const post = (action: string, body?: unknown) => fetch(`${c.base}/api/v1/devices/mcp-phone/${action}`, {
+    method: "POST", headers: body ? { "content-type": "application/json" } : {}, body: body ? JSON.stringify(body) : undefined,
+  });
+  assert.equal((await post("reserve", { label: "growth-ig" })).status, 200);
+  const reserved = (await call("fleet_devices")).structuredContent.devices.find((d: { device_id: string }) => d.device_id === "mcp-phone");
+  assert.equal(reserved.reserved_for, "growth-ig");
+  assert.equal((await post("unreserve")).status, 200);
   const none = await call("fleet_devices", { platform: "roku" });
   assert.match(none.content[0].text ?? "", /No devices are online/);
 });
diff --git a/skills/fleet-runner/SKILL.md b/skills/fleet-runner/SKILL.md
index 691c863..2de6dc2 100644
--- a/skills/fleet-runner/SKILL.md
+++ b/skills/fleet-runner/SKILL.md
@@ -102,6 +102,10 @@ flow so you can reproduce it.
 - **Target a pool or a match, not a device id**, unless the user named the
   device: other people's jobs are pinned to devices too. `--pool P` or
   `--match "os ~ 'android' && ram_mb >= 4000"`.
+- **Leave reserved devices alone.** A device whose `reserved_for` is set is
+  kept for one kind of work (a phone signed in to a real account, say). Pools,
+  matches and fan-out skip it, and pinning it is refused with
+  `device_reserved`. Do not add `reservation` to a job to get one.
 - **Retry at most once, and only after reading the error.** A failure that
   repeats on the same device and build is the app, not the lab;
   `fleetr flaky` shows tests known to flip.

From 193d94264353b264b1ae0758ba12cb21edbc18b8 Mon Sep 17 00:00:00 2001
From: Taylor Addison <addisdev@gmail.com>
Date: Thu, 22 Oct 2026 22:01:20 -0400
Subject: [PATCH 5/5] changelog: #106

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 CHANGELOG.md | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 927e214..c96897b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -34,6 +34,7 @@ a CI job fails when they disagree.
   phone can be reserved before it is cabled up. `fleet devices` gains a
   `RESERVED` column, `fleet_devices` and `/api/v1/devices` a `reserved_for`
   field, and `fleet run` a `--reservation` flag.
+  ([#106](https://github.com/addisdev/fleet-runner/pull/106))
 
 ### Fixed
 
@@ -41,7 +42,7 @@ a CI job fails when they disagree.
   nothing once claimed.** The brain evaluated `device_id` when routing it, but
   the executor described an Android target without one, so the job reached the
   right Mac and then skipped with no targets. The executor's descriptor now
-  carries `device_id`.
+  carries `device_id`. ([#106](https://github.com/addisdev/fleet-runner/pull/106))
 
 ## [0.9.1] — 2026-10-18