Infrastructure: Unify desktop driver-service composition and wire durable recovery #4436

Current status - 2026-11-07

Implementation merged in #4455; not an active prerequisite blocker for F2/F3/F9/F11. Both service paths use the shared factory and durable recovery wiring. This issue stays open for acceptance review and the remaining native qualification rather than implying automatic recovery.

The ledger recorded through 7b7ef4c5a now includes Windows/Win32 quarantine, failed-cleanup claim retention, exact survivor reconciliation, and fresh-service recovery. Operator reconciliation occurred only after exact recorded resources exited; a restarted service or dead PID alone was never recovery proof.

Remaining native macOS restart/failed-cleanup and survivor cases are tracked in #4441 and #4444. Automatic reclaim remains disabled until F3 and the matching F10 native ownership backend are qualified. Historical macOS evidence and failures are retained at their original revisions.

Goal

The generic (desktop-test serve) and Storybook (channel child in storybook-desktop/config/server.cjs) paths construct the protected driver service through different composition code. Neither shipped path passes the driver's durable settlement recovery options, so a service restart can erase an uncertain-mutation quarantine. Consolidate service construction into one real implementation used by both paths and wire durable recovery through it.

Part of #4435 (plan item F1).

Scope

• Owner: harness service composition.
• Paths (under packages/agentic/): a new real module desktop-test/src/driverService.ts, desktop-test/src/supervisor.ts, the recovery APIs in desktop-driver/src/server, and the factory call in storybook-desktop/config/server.cjs.
• Consolidate helper policy, authority, durable recovery storage and probes, descriptor publication and withdrawal, and settled shutdown.
• Add bounded offline inspection or operator recovery only if needed. It must hold the exclusive workload claim and refuse a live service.
• Keep the channel/driver child process where it is. A shared resource owner does not require one process.

Dependencies

• Blocked by: nothing. The Desktop driver: bounded agent operations, protected service, and MCP adapter #4434 foundation contracts are in place.
• Unblocks: F2 Infrastructure: Implement settled desktop lifecycle supervision and fenced ownership records #4442, F3 Infrastructure: Add owned-process lifelines and typed desktop service readiness #4444, F9 Infrastructure: Convert Storybook lifecycle takeover into desktop-test resource contributions #4449, and F11 Infrastructure: Add scoped runner grants and drain-confirmed desktop controller handoff #4448.
• Parallel with: F4 Infrastructure: Settle Storybook story-provider cancellation and reconnect epochs #4437, F7 Infrastructure: Guard neutral desktop package dependency and import boundaries #4438, F8 Infrastructure: Expose bounded persisted desktop test-run and artifact queries #4439, F12 Infrastructure: Attenuate desktop driver grants and isolate MCP connections #4440, and F15 Infrastructure: Live-qualify the desktop driver and MCP foundation on macOS, Windows, and Win32 #4441.
• Coordination: F12 server integration must not collide with recovery exports. server.cjs integration commits are ordered F1, F3, F5, F6, then F9.

Acceptance

• An indeterminate attached-target mutation remains blocked across a service restart in both the generic and Storybook paths.
• Unreadable or corrupt recovery storage fails closed.
• Application-exit recovery requires exact probe evidence; advisory exit events are not recovery proof.
• Operator listings are bounded and contain no grants or application text.
• Both composition paths call the same real implementation, not parallel copies.
• The driver and harness status references no longer list durable recovery wiring as work in progress.

Validation

• Iterate with focused yarn test <name> in each changed package, then run its yarn format, yarn lint, yarn build, and yarn test. Finish with yarn clean-lage-cache then yarn lage buildci; run yarn lage test-links --verbose --grouped after markdown changes.
• Add a patch changeset for each changed published package. Update the owning references/current-status.md rows (done, work in progress, unsupported) and affected README/AGENTS guidance in the same change.
• Native, provider, or process-topology changes need matching-OS native contracts and the affected consumer lane. JavaScript tests and bundles do not qualify native behavior; hosted capability skips are not passes. Report each check as passed, failed, skipped, not run, or unsupported.

Evidence

• Current state: "Durable settlement storage and trusted recovery API" in packages/agentic/desktop-driver/references/current-status.md; "Native service and helper composition" and "Durable quarantine wiring" in packages/agentic/desktop-test/references/current-status.md.
• Retired plan: driver-next.md at 0569e1b86, section 8 (F1).