[Jason Morse (JasonVMo)]

Platforms Impacted

• iOS
• macOS
• win32 (Office)
• windows
• android

Platform impact is not complete platform qualification.

Description of changes

Combined implementation of desktop foundation tracks F2, F3, F4, F5 and the F15 native qualification procedure. Relates to #4435, #4442, #4444, #4437, #4443 and #4441. References remain intentionally non-closing: review readiness does not close native acceptance or the remaining desktop program.

Main integration: normal merge ac6c9f661e2900ecba50932f4f5e5844f7ac072b incorporates main at 8574d22eec9b42c5c22d4d89a7a91c3e13c1aff3, including #4464's input/platform/scope declarations and selection. Conflict resolutions preserve both the new ./jasmine API and typed-resource exports, outer-config/alias registration identities and test scopes, and abortable waitForStop() shutdown. The incoming supervisor fixture now supplies its required registration identity. F1, F7, F8 and F12 implementation is already merged (#4455, #4454, #4457, #4456).

• F2 - typed resources and ownership (desktop-test): dependency-ordered resource contributions, cycle/duplicate/unknown-dependency rejection, reverse disposal, cancellation and late-cleanup accounting, and exact fenced workload claims. Failed or timed-out disposal retains the claim; no automatic reclaim. Public ./resources and ./ownership entries.
• F3 - process lifelines and readiness (desktop-test, storybook-desktop): cooperative service-only Node preload, parent lifeline, correlated typed readiness receipts, descriptor settlement and drain-confirmed shutdown. Readiness is service-ready, not app-ready or context-ready. Incomplete withdrawal remains failed and fenced. Public ./process-control entry.
• F4 - story lifetimes (storybook-desktop-runtime, storybook-desktop, desktop-driver): provider lifetime/cancellation context, authenticated connection epochs, versioned native markers, durable bridge-epoch records and exact application-incarnation checks. A verified same-live-app restart requires renderer-specific relaunch; uncertain/replaced identities fail closed. Old preview refs stay stale after select/reset, even after re-observing a surviving native element. Chrome/window refs and immutable PNG resources keep their distinct lifetimes. No transparent reconnection promise.
• F5 - exclusive agent ingress (storybook-desktop, desktop-driver): the controlled channel serves only GET /index.json, returns value-free 403 responses elsewhere, never relays client WebSocket frames, and keeps authenticated connections alive with bounded heartbeats. Driver-owned selection and manifest-backed traversal respect settlement/cancellation and never fall back to HTTP after driver failure. Protected args are refused. Non-agent mode is deliberately legacy/unprotected.
• F15 - qualification and documentation: a 24-case real-descriptor runbook now covers macOS Fabric/Paper, Windows Fabric and Win32 Paper, with per-probe source, reference kind/identity/generation/session continuity, failure/retry history, cleanup evidence and artifact paths. The harness, driver and MCP status ledgers retain the results. Patch changesets cover the changed published packages.

CI and qualification repairs included in the branch

• Win32 shutdown: self-directed process.kill(..., 'SIGTERM') hard-terminated Windows child services before the producer terminal-result/flush handshake. The lifeline dispatches installed SIGTERM listeners first so reporting and owned-service settlement can complete; missing handshakes remain errors.
• Windows Fabric startup: a listening Metro port and visible window preceded authenticated runtime hello plus first storyRendered. Smoke now waits for authenticated readiness before initial and relaunched traversal, retrying only bridge-unavailable, which proves no dispatch occurred. Ambiguous mutations are not retried.
• Qualification exposed two bridge/relaunch retirement races, fixed with regression coverage. Windows report persistence now retries only transient EPERM/EACCES atomic-rename sharing conflicts, with ten 25 ms waits, preserved prior snapshots and explicit warning/failure history. Persistent errors still fail; the original conflicting handle owner is unknown. Node loader paths use file URLs and the link runner preserves argv boundaries.

Remaining limitations are assigned, not waived. #4435 and the existing follow-up issues now record current acceptance and actual dependency gates. Status: Blocked is applied to #4443, #4444, #4445, #4446, #4447, #4448, #4449, #4450 and #4451, with their native blocked-by relationships verified. F3/F5 can co-land with their prerequisites here; delivered F1 is not retained as an active blocker merely because its issue remains open. F15 is not globally blocked.

• Infrastructure: Live-qualify the desktop driver and MCP foundation on macOS, Windows, and Win32 #4441 / Infrastructure: Settle Storybook story-provider cancellation and reconnect epochs #4437: Windows physical foreground/input failure; launch-capable discovery; separately registered secondary windows; Win32 fresh-preview lost-context fencing; outstanding macOS descriptor/fault cases, capture/environment qualification and Windows/Paper measurements.
• Infrastructure: Implement settled desktop lifecycle supervision and fenced ownership records #4442 / Infrastructure: Add owned-process lifelines and typed desktop service readiness #4444: conservative failed-cleanup claim retention, exact-resource/operator reconciliation, remaining macOS survivor evidence and no automatic reclaim.
• Infrastructure: Tighten Storybook manifest provenance and native helper trust handoff #4445 / Infrastructure: Implement neutral macOS desktop application ownership and identity recovery #4446 / Infrastructure: Implement neutral Windows desktop application ownership and containment #4447 / Infrastructure: Convert Storybook lifecycle takeover into desktop-test resource contributions #4449: manifest trust/nonce separation, neutral native application ownership/containment, cross-service claims and replacement of Storybook's transitional lifecycle takeover.
• Infrastructure: Add scoped runner grants and drain-confirmed desktop controller handoff #4448 / Infrastructure: Add the generalized desktop-mcp management facet #4450: drain-confirmed MCP/WDIO handoff and bounded management tools. Input-lane selection is not ownership transfer. Cross-connection resume and automatic mutation replay are unsupported.
• Infrastructure: Qualify desktop lifecycle failure paths and maintain a support matrix #4451 / Infrastructure: Complete Desktop Driver production release qualification #4345 / Infrastructure: Qualify Windows/Win32 capture fidelity and provenance #4348 / Infrastructure: Qualify and require native Storybook CI coverage #4349: support/reliability baseline, non-React integration, release/signing, actual capture fidelity and authoritative native CI. Hosted input/capture skips are not passes.

Verification

Merged tree: the following local checks passed before pushing ac6c9f661e2900ecba50932f4f5e5844f7ac072b. Full interactive/native descriptor qualification was not rerun for this main merge. JavaScript tests, declared lanes and hosted smoke do not replace that evidence.

Exact command	Result
yarn install --immutable	Passed; existing peer-dependency warnings retained.
yarn build	Passed after correcting the incoming supervisor test fixture's missing registrationId; the first TS2322 failure is retained.
yarn --cwd packages\agentic\desktop-test test 'contracts|supervisor|collector|lane'	Passed: 4 suites, 49 tests.
yarn --cwd packages\agentic\storybook-desktop test 'DesktopStorybookCli|sourceConfig|inputLane|storySelection|agentIngress'	Passed: the 3 matching suites, 79 tests.
In packages\agentic\desktop-test: yarn format && yarn lint && yarn build && yarn test	Passed; complete tests: 186 passed, 4 skipped, 13 suites.
In packages\agentic\storybook-desktop: yarn format && yarn lint && yarn build && yarn test	Passed; complete tests: 308 passed, 22 suites.
yarn clean-lage-cache && yarn lage buildci --concurrency 4	Passed: 178 successful tasks, 0 skipped/pending/aborted/failed. Cache cleared once for the completed final aggregate.
yarn lage test-links --verbose --grouped	Passed: 90 successful tasks, 0 failed.
yarn change:check	Passed after the normal merge commit; coverage validated across 14 packages.
git diff --cached --check, git diff --check, git status --short	Passed; clean committed worktree. The initial pre-aggregate check stopped on three incoming generated-changelog whitespace lines, which were normalized before validation.

Hosted checks on the merge SHA: gh pr checks 4463 --repo microsoft/fluentui-react-native --watch --interval 30 passed: all 18 checks succeeded at ac6c9f661e2900ecba50932f4f5e5844f7ac072b, including Windows Fabric, Win32 Paper, macOS Fabric and macOS Paper Storybook. PR run 42354573970 and CodeQL run 42354574053 both succeeded. The earlier passing checks at 7b7ef4c5a remain historical.

Historical native qualification, not an all-pass claim

The harness ledger, driver ledger and MCP ledger record additive probes at their exact source revisions. Publication in 7b7ef4c5a does not mean every probe ran on that SHA.

Endpoint / evidence	Pass	Partial	Fail	Not run
Windows Fabric, cumulative recorded Windows follow-up	21	2	1	0 whole rows
Win32 Paper, cumulative recorded Windows follow-up	21	3	0	0 whole rows
macOS Fabric, latest recorded combined candidate a19fd3e1	4	5	0	15
macOS Paper, latest recorded combined candidate a19fd3e1	2	2	0	20

No wholly unrun Windows row means neither full subcase coverage nor physical-input acceptance. Broader input/capture, console Ctrl+C, mixed/200% DPI, minimized/negative-origin windows, lock/RDP/elevation, popups, capture cancellation and containment remain unqualified. Windows/Win32 doctor --permissions and Win32 production-bundle Metro reload are Unsupported.

Final historical hosted-style local smoke commands from apps\storybook:

• yarn storybook smoke --windows --mode stories-and-tests - Passed: 312 selected, 234 executed/passed, 78 skipped, no failed tests; one recovered report-sharing warning. Report: apps/storybook/artifacts/desktop/1825d9aa-2c25-4a2c-8524-ceadcf52ad68/run.json.
• yarn storybook smoke --win32 --mode stories-and-tests - Passed: 266 selected, 214 executed/passed, 52 skipped, no failed tests. Report: apps/storybook/artifacts/desktop/8c6f58e1-3591-4f1b-b008-c52a718d3ca2/run.json.
• These non-agent lanes disabled keyboard/physicalClick/wheel. They are not physical-input or protected-ingress qualification. Manual descriptor MCP probes have zero suite-selected/executed tests in their companion reports; those are not passing test counts.
• Applicable descriptor runs verified grant revocation and attached-app preservation. After each completed pass, exact owned processes were absent, ports free, and the interactive lock/default descriptor absent. Failed-cleanup claims were reconciled only after exact recorded resources exited; this is not automatic recovery. No OS privacy/input settings were changed.

Failure and retry history retained

• Windows physical input failed with foreground acquisition rejected; smoke 9506772a-d3f9-4f53-966e-b6c75799b463 failed its physical test. Win32's later descriptor click passed but does not erase the earlier failing physical smoke 7a737861-c31b-4eeb-ac6d-b21b8a96739d.
• Earlier macOS 3c780cfd1: Fabric 2 Pass, 5 Partial, 1 Inconclusive, 1 Fail, 15 Not run; Paper 4 Pass, 8 Partial, 12 Not run. Missing reference-kind/session-continuity evidence keeps the accepted-old-ref probe Inconclusive, not attributed to the deterministic reference fix. Foreign-WebSocket and protected-args retries remain in the ledger with unknown cause.
• At a19fd3e1, Fabric physical input remained Partial (no retained per-step proof); same-port replacement/live restart remained Partial because fail-closed rejection was shown but rediscovery was not. Legacy macOS smoke passed 211/211 on both renderers, not protected-ingress acceptance. Grant revocation and protected args passed on earlier Paper but were not rerun on that candidate.
• Earlier privateStorage 10000 ms and wdioRunner 7000 ms aggregate deadlines passed on isolated/retry runs; their causes remain unconfirmed. Corrected iteration failures included missing dependencies, unmatched selection, temporary type/lint/Knip/format issues, Windows file-URL/argv failures, native stimulus/control failures and atomic-report sharing failures. Later passes do not erase them; exact native retries and cleanup remain in the ledgers.

Before	After
Services were tracked individually; shutdown waiters could not drain; no typed resource plans or exact fenced workload claims.	Dependency-ordered resources dispose in reverse, abortable waiters drain, and failed/timed-out disposal retains claims.
Owned Node services lacked a parent lifeline; the agent trusted a generated ready file; Windows self-SIGTERM could skip reporting handshakes.	Cooperative lifelines and typed readiness/settlement preserve reporting; incomplete withdrawal remains failed and fenced.
Story lifetime and bridge readiness were not proven before traversal, and surviving native preview IDs could revive expired public refs.	Authenticated runtime readiness and epochs fence navigation; fresh observation issues a new public preview ref rather than reviving the old one.
Agent-served Storybook exposed alternate HTTP/WebSocket mutation ingress.	Controlled agent channels and manifest-backed traversal use driver-owned selection; legacy mode stays explicitly separate.
No integrated cross-renderer, cross-platform descriptor qualification procedure.	A 24-case runbook and truthful historical ledgers record source, result, retries, refs, cleanup and remaining issue-owned gaps.

Pull request checklist

This PR has considered (when applicable):

• Automated Tests
• Documentation and examples
• Keyboard Accessibility
• Voiceover
• Internationalization and Right-to-left Layouts

Accessibility/localization UI checklist items are not applicable to this tooling change. Physical-input qualification is reported separately and is not complete.