Infrastructure: Enforce session input policy and attribute delivered input mechanisms #4467

Goal

The input-selection work so far declares what each desktop test needs and selects which cases run in each input lane: #4464 (declare and select) and #4466 (migrate stories and split CI lanes). Today, though, only the harness and host masks keep a lane honest. This item makes the driver enforce a session's input modality. It also records which input mechanisms each session actually delivered, so a declaration is checked against what actually ran rather than trusted.

Part of #4435 (plan item F16). This is Part 2 of the input-selection plan, "enforce and attribute."

Scope

• Session policy. An immutable furn:inputMode capability: accessible, physical, or compatibility (the default). The session returns it, and the runner checks it after creating the session and fails closed if it's wrong. An accessible session forces accessibility clicks. A physical session forces physical clicks, but no longer needs the physical-click feature, so a host with only a keyboard can run keyboard cases.
• Enforcement before dispatch. Covers element click, clear and send-keys; W3C Actions with key, pointer or wheel sources; named accessibility actions; and the agent act operation. An accessible session cannot inject physical input, and a forbidden request dispatches nothing. Host masks still apply, so the effective policy is the union of the session policy and the masks.
• Strict clear. Every clear reports which mechanism carried it out. An accessible session clears only semantically; a physical session clears only by keyboard deletion. Both native helpers gain a mechanism parameter behind a negotiated feature. On a helper without that feature, strict clear is unsupported rather than ambiguous.
• Named actions from WDIO. A driver route and a WDIO command, plus the perform-accessibility-action requirement.
• Mechanism receipts. Per-session counts of each delivered mechanism, read from a furn route. The Storybook runner and the Jasmine adapter compare each case's receipts with its declaration. A mechanism the case didn't declare fails the case. A declared requirement that went unused is reported but doesn't fail the case.
• Mixed physical cases. A case that declares input: 'physical' may also declare accessible transports; receipts verify each one.
• Authoring and runner.
  • The direct-call lint follows relative helper imports.
  • --input all runs the lanes one after another, with each lane accounted separately. If the run is interrupted, the remaining cases are reported as not run.
• Follow-ups from Desktop testing: declare and select WDIO cases by input lane, platform and scope #4464:
  • re-check rn.renderer against the session's furn:renderer;
  • record the lane in delegated (DESKTOP_REPORT_CONTEXT) sessions;
  • list stories whose cases are all excluded.

Out of scope

• macOS physical lanes need a managed Mac that can be granted input permissions. They follow Infrastructure: Qualify and require native Storybook CI coverage #4349, and hosted macOS CI stays in compatibility mode.
• Qualifying or promoting any physical lane (the Infrastructure: Qualify and require native Storybook CI coverage #4349 window), the Windows physical foreground failure (Infrastructure: Live-qualify the desktop driver and MCP foundation on macOS, Windows, and Win32 #4441), and the guard against all-skipped WDIO runs (Infrastructure: Reject all-skipped WDIO runs as completed coverage #4342, fix(storybook-desktop): report all-skipped WDIO runs as incomplete instead of passed #4369).

Dependencies

• Blocked by: Desktop testing: migrate stories and split CI input lanes #4466, the second part of Part 1. Builds on the merged Desktop testing: declare and select WDIO cases by input lane, platform and scope #4464.
• Shares files with Desktop driver: typed resources, process lifelines, story lifetimes, exclusive agent ingress, and native qualification runbook #4463: desktop-driver/src/server/createDesktopDriverServer.ts, SessionManager.ts, operations/act.ts and operations/runtime.ts. Edits there stay surgical, and whichever PR lands second rebases.
• Unblocks: delivered-input evidence for lane promotion under Infrastructure: Qualify and require native Storybook CI coverage #4349 and for release qualification under Infrastructure: Complete Desktop Driver production release qualification #4345.
• Related: Infrastructure: Live-qualify the desktop driver and MCP foundation on macOS, Windows, and Win32 #4441; Infrastructure: Reject all-skipped WDIO runs as completed coverage #4342; Infrastructure: Add scoped runner grants and drain-confirmed desktop controller handoff #4448 and Infrastructure: Add the generalized desktop-mcp management facet #4450 (agent act under MCP); CI: require full Win32 Storybook accessibility and physical-input lanes #4431 (the pilot that Desktop testing: migrate stories and split CI input lanes #4466 supersedes).

Acceptance

• Fake-host tests prove that forbidden requests dispatch nothing in every mode, across click, clear, value, Actions, named actions and agent act.
• An accessible session cannot inject physical input, even on a host with no masks.
• A declaration mismatch fails the case, in both the Storybook runner and the Jasmine adapter.
• Receipts are read before teardown, and deleting a session still releases input.
• An interrupted --input all reports the remaining lane as not run.
• The matching-OS native contracts for strict clear pass, or are recorded as not run, with the reason.
• No report claims qualification before the native contracts, consumer cells and Infrastructure: Qualify and require native Storybook CI coverage #4349 reliability window exist.

Validation

• Run focused tests while iterating; then each changed package's yarn format, yarn lint, yarn build and yarn test; then yarn clean-lage-cache and yarn lage buildci, plus yarn lage test-links for markdown changes.
• Run native contracts with FURN_NATIVE_DRIVER_TEST=1 on the matching OS only. JavaScript tests and bundles do not qualify native behavior. Report each check as passed, failed, skipped, not run or unsupported.