Some more investigation. I'm hoping that this rings a bell for someone or that David is able to respond. Mercury.exe is loading at the default image base, so all addresses are the same as in the exe file.
At location 0x41c4ef, there's a function that checks a bunch of stuff including, at location 0x41c546, a particular byte at offset 0x1d0 in a structure describing the daemon plug-in. The structure contains the daemon name, the dll path, and seemingly some status info, including the byte at offset 0x1d0 and the dll hmod at offset 0x1d8. For some reason, that byte is a zero for my DLL. If the value was 4 (or at least that bit set), then mercury would continue and do GetProcAddr on _daemon, daemon, and DAEMON; and call the first one of those found (at location 0x41c5c9). In other places in Mercury, there are other checks of this byte (against the values of 0, 1, 2, and 0x10). I haven't yet figured out why my damon dll isn't getting a value of 4 in this structure. If I manually change the value to 4 in a debugger, the daemon function is called.
From the asm, my guess is that the source code looks like this:
if(!global_ptr)
if(global_ptr->pDaemon->status & 0x4)
GetProcAddress (global_ptr->pDaemon->hmod, "daemon");
...
I'd really like to know what causes the status byte to have that bit set...