Infrastructure: Implement settled desktop lifecycle supervision and fenced ownership records #4442

Current status - 2026-11-07

Implementation in #4463; F1 is already delivered by #4455, so no active prerequisite blocker. Typed resource ordering, late acquisition cleanup, guarded shutdown, exact fenced owner records and alias-specific registered identities are implemented. Main's #4464 lane/test-scope support must coexist with those identities; aliases do not become proof of physical application identity.

The Windows/Win32 follow-up proved failed disposal retained the exact channel generation/effect and refused replacement before acquiring resources. Cleanup used the original recorded stop callbacks, proved exact resource exit, and only then reconciled the owner/claim.

Remaining limitations: automatic reclaim stays disabled; dead owner/service PIDs are not cleanup proof. Cross-service exact-application exclusion and input-mutex qualification remain open with #4446/#4447/#4451. Complete macOS live failed-cleanup/restart and integrated generic-app ownership evidence under #4441/#4444. Portable generic fixtures are not a native non-React lifecycle qualification. This issue remains open for its acceptance review; PR readiness does not silently discharge these gates.

Goal

The supervisor's guard does not await abandoned work, resources acquired after cancellation are not accounted, and workload records hold a PID and run ID rather than exact owner identity and a resource ledger. Reporting delegation can imply skipping workload acquisition, and registered target IDs can collide across configured apps. #4434 added a conservative fence that retains the workload claim when cleanup fails; this item replaces that coarse fence with typed resource contributions and exact, fenced ownership records.

Part of #4435 (plan item F2).

Scope

• Owner: neutral lifecycle in desktop-test.
• Paths (under packages/agentic/): desktop-test/src/{supervisor,services,integration,config}.ts, a new ownership and claim implementation, and neutral lifecycle contract tests.
• Typed resource contributions with a stable ID, dependencies, ownership mode (owned or borrowed), readiness state, generation, and a settled disposal contract, exercised by real generic fixtures.
• Reject unknown serializable fields, duplicate IDs, cycles, and invalid target or suite references before starting resources. Register acquisition cleanup before effects, including resources acquired after cancellation.
• Separate explicit workload delegation from reporting delegation, and keep presentation owned by the collector.
• Record exact owner identity, resource generation and identity, ownership mode, and unresolved effects.
• Correct registered target-ID collisions without treating target aliases as physical identity.
• Keep automatic reclaim disabled until survivor handling is qualified by F3 Infrastructure: Add owned-process lifelines and typed desktop service readiness #4444 and the matching native backend (F10-M Infrastructure: Implement neutral macOS desktop application ownership and identity recovery #4446 or F10-W Infrastructure: Implement neutral Windows desktop application ownership and containment #4447).

Dependencies

• Blocked by: no active prerequisite; the F1 Infrastructure: Unify desktop driver-service composition and wire durable recovery #4436 composition contract landed in Unify desktop driver-service composition and wire durable recovery #4455.
• Unblocks: F3 integration, F6 Infrastructure: Tighten Storybook manifest provenance and native helper trust handoff #4445, F9 Infrastructure: Convert Storybook lifecycle takeover into desktop-test resource contributions #4449, F10-M, F10-W, and F11 Infrastructure: Add scoped runner grants and drain-confirmed desktop controller handoff #4448.
• Parallel with: F4 Infrastructure: Settle Storybook story-provider cancellation and reconnect epochs #4437 and F5 Infrastructure: Authorize and settle every controlled Storybook mutation entrance #4443, F8 Infrastructure: Expose bounded persisted desktop test-run and artifact queries #4439, and F12 Infrastructure: Attenuate desktop driver grants and isolate MCP connections #4440. F3 process work can be prepared against F1 while this lands.
• Coordination: one lifecycle integration owner edits supervisor.ts, integration.ts, and config.ts. Platform contributors propose shared changes rather than editing those files concurrently.

Acceptance

• Cancellation during acquisition cannot orphan a late resource.
• A required-service failure aborts its dependants.
• Shutdown awaits guarded work.
• Failed or timed-out disposal retains a fenced claim with an exact ownership record.
• Reporting inheritance does not grant workload ownership.
• Live, unknown, or PID-reused owner probes fail closed, and concurrent reconcilers cannot both acquire.
• New interfaces are exercised by a real generic consumer; no placeholder interfaces are frozen.

Validation

• Iterate with focused yarn test <name> in each changed package, then run its yarn format, yarn lint, yarn build, and yarn test. Finish with yarn clean-lage-cache then yarn lage buildci; run yarn lage test-links --verbose --grouped after markdown changes.
• Add a patch changeset for each changed published package. Update the owning references/current-status.md rows (done, work in progress, unsupported) and affected README/AGENTS guidance in the same change.
• Native, provider, or process-topology changes need matching-OS native contracts and the affected consumer lane. JavaScript tests and bundles do not qualify native behavior; hosted capability skips are not passes. Report each check as passed, failed, skipped, not run, or unsupported.

Evidence

• Current state: "Cleanup failure fence", "Complete lifecycle settlement", and "Cross-service/multi-target claims" in packages/agentic/desktop-test/references/current-status.md; packages/agentic/desktop-test/references/lifecycle.md.
• Retired plan: driver-next.md at 0569e1b86, sections 6 and 8 (F2).