test(desktop-test): honor the void application recovery contract

Correct the native consumer expectation without changing the host API or helper behavior. Preserve replacement-survival and matching-start identity refusal assertions, and record old-helper RED plus complete Fabric/REX GREEN qualification and default-environment validation.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 3be5f341-831b-40d4-9582-337c8ea65709

Author: JasonVMo

packages/agentic/desktop-driver/references/current-status.md

@@ -1019,3 +1019,136 @@ No app or native contract was launched. The desktop remained disconnected;
 both endpoints' corrected native recovery qualification remains **Not run**
 pending an active/unlocked session and a separate grant. No push occurred.
 Part of #4447 and #4435.
+
+## Windows Fabric and Win32 Paper — recovery native re-verification — 2026-11-12 UTC
+
+**Observed source:** native implementation
+`dbaf558939db31b4a3935ad68b1eb20d25d90d3e`, stacked on pinned #4492
+`6489386956c0485cb91b478a8f4adc4828f4178b`. The helper and public host API
+were unchanged in this phase. The harness consumer needed a test-only fix:
+`recoverApplication` checks native `{ state: 'exited' }` internally and resolves
+`Promise<void>`, so the consumer must expect `undefined`. That one-line
+assertion correction is committed with this evidence and needs review before
+publication; no production, protocol or F11 file changed.
+
+**Observed granted native session:** active/unlocked **remote** session 1,
+input desktop `Default`, with eligible before/after checks for every native
+wrapper. Both W2 campaigns used the machine lock and `-RequirePhysical`; no
+exit 75 or session change occurred. The final consumer wrapper ran
+`21:54:54Z–21:57:02Z`. Fabric registration was checked before each phase and
+remained the `furn-81` Debug/x64 build at `bdeb0b291`, with no relevant native
+source difference and executable SHA-256
+`df9cb3559843fcfb0158ee4ab5edbae78890c4e231ebd895cbb636c24b18cd45`.
+The exact AUMID remained
+`40411fc5-8e92-4d46-b68d-b62df44b1366_syyqehzwccsyy!App`.
+REX Paper used the canonical worktree image `0.81.1-6828073195`, exact launch
+arguments, a fresh Win32 bundle and owned worktree Metro. A Win32 native-app
+build remains **Unsupported**.
+
+**Observed native RED/GREEN:** the retained pre-review helper's source was
+`ea76e931dc4cdebc87e0621a7d730f81faabce5ef902063a0512cd7c2b100f2d`,
+executable SHA-256
+`863cc2dbfc8f5792d22c8606376d226affbf8655fe4ded62ba78c23a29c516c7`.
+It produced **4 expected failures / 0 passed / 7 filtered skips** across the
+two endpoints' stale-start and crashed-recoverer cases:
+`recoverApplication` rejected with `identity-start-mismatch`.
+
+The selected review-fixed consumer helper had source
+`3558e8597f6cfe1ee3f4e38dca2137710b80d193a5c30bf946d54065bf8bc153`
+and executable SHA-256
+`97f0072ce22449bc5c87c05de259d3e4c46eca666e6135977432b30fa16053b2`.
+Its first consumer run had **9 passed / 2 failed**, solely because the test
+expected the wire object rather than the host's void resolution.
+After correcting only that assertion, all **11 consumers passed / 0 failed /
+0 skipped**. Native recovery settles a different recorded start without
+control/termination access or replacement signals; matching-start
+session/executable/AUMID mismatches still fail closed. Unreadable native starts
+remain fenced; no real protected-process access-denial case was induced here.
+
+**Exact provider command:** from the driver package, inside the granted
+physical-gated machine lock, with `FURN_NATIVE_DRIVER_TEST=1`,
+`FURN_NATIVE_PHYSICAL_INPUT_TEST=1`, Debug configuration and worktree-local
+scratch/cache. `$W2` denotes the assigned worktree; `$E` is its ignored
+`artifacts\desktop\f10w\review-native-20261112` directory.
+The direct-helper override is unset for the cache-resolution contract.
+
+```powershell
+yarn test --runInBand `
+  --cacheDirectory "$W2\artifacts\desktop\f10w\jest-driver" `
+  --runTestsByPath src\native\nativeDriver.test.ts src\native\windows\applicationOwnership.contract.test.ts `
+  --testNamePattern 'Windows exact application ownership|builds, reuses, resolves, and handshakes with the Windows helper' `
+  --json --outputFile "$E\driver-green-results.json"
+```
+
+| Provider/self-test case                                                                          | Outcome         |
+| ------------------------------------------------------------------------------------------------ | --------------- |
+| Build, reuse, resolve, handshake and Windows helper self-test                                    | **Passed**      |
+| Noncontrolling inspection and exclusion of another independent helper                            | **Passed**      |
+| Reused recorded start settles without signalling the live replacement; other mismatches rejected | **Passed**      |
+| Multiple matching process/window candidates rejected                                             | **Passed**      |
+| Five contained exact-identity launch/close cycles                                                | **Passed**, 5/5 |
+| Independent applications serialize through the physical input mutex                              | **Passed**      |
+
+Final provider result: **6 passed / 0 failed / 10 unrelated filtered skips**.
+The first invocation mistakenly set a direct-helper path, so the five ownership
+cases passed but the isolated cache test resolved that explicit artifact
+instead of its temporary build. Removing the conflicting invocation override,
+without changing source, produced the full passing result. Both receipts are
+preserved; this was not a resolver fix or an additional production defect.
+
+**Observed real consumer results:** both endpoints passed five distinct
+PID/start incarnations, exact independent-service exclusion, native mismatch
+refusals, crashed-recoverer barrier retirement, crashed-owner journal
+reconciliation and three concurrent pairs. Fabric consistently reported
+`uncontained` and exact survivor cleanup; REX reported `job-object` and
+reconciled its job drain. The cross-endpoint physical-mutex case passed with
+cancellation, release and transfer. All recorded application sessions were
+`windows-session:1`. The crash fixtures verified each owned child's native
+identity before literal-PID termination; the new dead-recoverer PIDs were
+**54440** and **55808**. Live replacements survived stale-record retirement.
+The harness's matching section records all 11 cases and exact consumer
+commands.
+
+Ignored evidence root: `artifacts\desktop\f10w\review-native-20261112`.
+`driver-green-results.json`, `red-consumer-results.json`,
+`green-initial-consumer-results.json`, `green-consumer-results.json`,
+`green-consumer-evidence.json`, `consumer-assertion-fix.diff` and
+`qualification-summary-final.json` retain the failures, corrected results,
+digests and actual test-source provenance. Final consumer evidence:
+`windows-application-ownership-3BLzLV`; lifecycle report
+`32f3d6be-c4b0-4792-aeb6-a5d7df165fc0` has no test counts.
+
+**Observed portable/aggregate closeout:** harness format/lint/build and
+**453** portable tests **Passed** (**28** native skips). Existing driver
+`NativeDesktopHost.applicationIdentity` contracts **Passed**, **31/31**.
+Locked default-environment `yarn clean-lage-cache` then `yarn lage buildci`
+initially **Failed** the reported intermittent Storybook `serverIntegration`
+readiness assertion, `A stopping command cannot publish readiness`
+(`176` successful tasks, one failed). The cause remains unproven.
+After the fail-fast test children settled and a clean audit, the sole unchanged
+full rerun **Passed**, **178 successful / 0 failed / 0 skipped**, 2m 38.65s.
+No TEMP, concurrency, timeout, dependency or guidance workaround was applied.
+Both W2 campaigns ended and the final audit **Passed**:
+`FURN-AUDIT: no FURN desktop processes found`.
+
+**Publication/remaining limits:** no push or PR-body update occurred because
+the test-only correction needs review. Initial PR #4494 CI at `dbaf558939`
+was observed green: run `43282149276`, all **19/19** checks successful.
+Windows job `131405956387` selected the ownership provider suite
+(`PASS applicationOwnership.contract.test.ts`; **4** nonphysical ownership
+cases selected, physical case gated off; full driver **1,281 passed /
+46 skipped**). The Win32 jobs did not select that ownership step, and the
+actual-endpoint consumer opt-in was absent: **0/11** consumers hosted.
+These are historical hosted counts, not new CI for the local test correction
+or substitutes for this physical campaign. F11 claim naming is deferred and
+untouched. Actual kernel PID recycling and shared-PID activation were
+**Not induced**; all concurrent winners were distinct. Arbitrary uncontained
+descendants and mixed-graph recovery remain unqualified. The existing
+`windows-exact-application-ownership.md` patch changeset remains applicable.
+Part of #4447 and #4435.
+
+**Observed reference checks:** Markdown links in both edited ledgers
+**Passed** (6 driver links, 15 harness links). Root `yarn oxfmt --check`
+(3,163 files), `yarn check-agent-instructions`, `yarn change:check`, and
+`git diff --check` **Passed**. Their receipts are in the same ignored evidence
+directory.

packages/agentic/desktop-test/references/current-status.md

@@ -1773,3 +1773,150 @@ No application/native contract was launched, no desktop campaign started,
 and no push occurred. Corrected native recovery re-verification remains
 **Not run**, awaiting an active/unlocked session and its separate grant.
 Part of #4447 and #4435.
+
+## Windows Fabric and Win32 Paper — recovery native re-verification — 2026-11-12 UTC
+
+**Observed source:** native helper and harness implementation
+`dbaf558939db31b4a3935ad68b1eb20d25d90d3e`, still stacked on #4492 at
+`6489386956c0485cb91b478a8f4adc4828f4178b`. The consumer test alone had
+the one-line assertion correction committed with this section: the public
+`NativeDesktopHost.recoverApplication` returns `Promise<void>`, after checking
+the native `{ state: 'exited' }` verdict. Its consumer must expect an undefined
+resolution, not the wire-level result. No production, protocol or F11
+file changed in this phase. The exact test diff and test-file digest are retained
+in ignored `artifacts\desktop\f10w\review-native-20261112`.
+
+**Observed session and application provenance:** both granted W2 campaigns ran
+in active/unlocked **remote** session 1, input desktop `Default`. Every native
+wrapper used the machine lock and `-RequirePhysical`; before/after gates stayed
+eligible, with no exit 75 or session change. The final consumer wrapper ran
+`21:54:54Z–21:57:02Z`. Registration and image hash were checked before each
+phase: packaged Fabric remained the `furn-81` Debug/x64 build from `bdeb0b291`,
+with no relevant native-app/source difference. Its executable SHA-256 remained
+`df9cb3559843fcfb0158ee4ab5edbae78890c4e231ebd895cbb636c24b18cd45`.
+The AUMID was
+`40411fc5-8e92-4d46-b68d-b62df44b1366_syyqehzwccsyy!App`.
+Win32 Paper used the worktree's canonical prebuilt REX
+`0.81.1-6828073195` image, its exact arguments and a fresh Win32 bundle;
+a Win32 native application build remains **Unsupported**.
+
+Fresh Win32 and Windows bundles **Passed**, with run IDs
+`3830f2d5-30b1-405b-a205-71f45dcc9490` and
+`e2fb42e1-c5ec-41b3-bae3-64cedad0aeb6`. Each consumer invocation owned a
+fresh Metro, verified its listener's native PID/start/session and worktree
+command line, and stopped it in `finally`. No preexisting Metro was adopted.
+Native scratch/cache paths stayed inside the worktree.
+
+**Observed test-first sequence:**
+
+1. Retained old helper `863cc2dbfc8f5792d22c8606376d226affbf8655fe4ded62ba78c23a29c516c7`,
+   source `ea76e931dc4cdebc87e0621a7d730f81faabce5ef902063a0512cd7c2b100f2d`:
+   **4 expected failures / 0 passed / 7 filtered skips**. Both endpoints rejected
+   stale-start recovery, including interrupted-recoverer journal settlement,
+   with `identity-start-mismatch`. This was the required native RED, not an
+   environment failure.
+2. Review-fixed helper
+   `97f0072ce22449bc5c87c05de259d3e4c46eca666e6135977432b30fa16053b2`,
+   source `3558e8597f6cfe1ee3f4e38dca2137710b80d193a5c30bf946d54065bf8bc153`:
+   the first complete run had **9 passed / 2 failed / 0 skipped**. Both failures
+   were the consumer's wrong return-value assertion; recovery resolved
+   successfully, but the test expected the native wire object. The existing
+   host identity unit contract already expects `undefined`.
+3. Correct only that assertion to `.resolves.toBeUndefined()`, retaining the
+   independent assertion that the real replacement is alive and all
+   matching-start mismatch refusals. Rerun the whole native consumer suite:
+   **11 passed / 0 failed / 0 skipped**.
+
+| Consumer case                                                                          | Windows Fabric packaged                  | Win32 Paper REX                          |
+| -------------------------------------------------------------------------------------- | ---------------------------------------- | ---------------------------------------- |
+| Exact identity, independent-service exclusion, five launches/teardowns without leaks   | **Passed**, 5/5 distinct PID/start pairs | **Passed**, 5/5 distinct PID/start pairs |
+| Stale-start settlement; matching-start session/executable/AUMID mismatches fail closed | **Passed**                               | **Passed**                               |
+| Crashed recoverer, stale journal and dead recovery barrier; live replacement preserved | **Passed**                               | **Passed**                               |
+| Crashed owner/helper and exact application journal recovery                            | **Passed**, packaged survivor recovered  | **Passed**, job-object drain reconciled  |
+| Concurrent pairs, ambiguity refusal, pinned exclusion and independent teardown         | **Passed**, 3/3 pairs                    | **Passed**, 3/3 pairs                    |
+| Physical input mutex, cancellation without effect, release and transfer                | **Passed**, one cross-endpoint case      | Same cross-endpoint case                 |
+
+Every repeated identity reported `windows-session:1`. Fabric consistently
+reported `uncontained`; REX consistently reported `job-object`. All three
+concurrent pairs on each endpoint acquired two distinct incarnations: the
+shared-PID packaged activation race was **Not induced**. Interrupted recoverers
+were identity-verified Node processes stopped by literal PIDs **54440** and
+**55808**, with recorded native starts
+`2026-11-12T21:55:28.3844388Z` and
+`2026-11-12T21:56:07.0500082Z`. The subsequent supervisor retired the dead
+recovery barrier and injected stale application record without signalling the
+real replacement. These injected recorded-start mismatches are **not** actual
+kernel PID recycling.
+
+**Exact consumer commands:** `$W2` denotes the assigned worktree and `$E`
+its `artifacts\desktop\f10w\review-native-20261112` directory. From `$W2`,
+inside the granted campaign and physical-gated machine lock:
+
+```powershell
+node -- artifacts\desktop\f10w\review-native-20261112\run-consumer.mjs red artifacts\desktop\f10w\native-20261112\selected-helper.json
+node -- artifacts\desktop\f10w\review-native-20261112\run-consumer.mjs green artifacts\desktop\f10w\review-20261112\selected-helper.json
+```
+
+The retained bounded orchestration uses `NodeDesktopCommandRunner`, the two
+explicit application descriptors, all three native/application/physical
+opt-ins, the selected immutable helper and `buildPolicy=never`. Its GREEN
+Jest child command is:
+
+```powershell
+yarn workspace @fluentui-react-native/desktop-test test --runInBand `
+  --cacheDirectory "$W2\artifacts\desktop\f10w\jest-harness" `
+  --runTestsByPath src\windowsApplicationOwnership.contract.test.ts `
+  --json --outputFile "$E\green-consumer-results.json"
+```
+
+RED adds `--testNamePattern 'native start|crashed recoverer'` and uses
+`red-consumer-results.json`. The final real consumer evidence directory is
+`windows-application-ownership-3BLzLV`; outer command report
+`32f3d6be-c4b0-4792-aeb6-a5d7df165fc0` is lifecycle-only, not the test-count
+source. `green-consumer-results.json`, `green-consumer-evidence.json`,
+`green-invocation.json`, registration receipts and `consumer-assertion-fix.diff`
+retain the actual counts, identities and dirty-test provenance. Expected RED
+and first-GREEN failures are preserved separately, not overwritten.
+
+**Observed additional validation:**
+
+- `yarn workspace @fluentui-react-native/desktop-test format`, `lint`, and
+  `build`: **Passed**.
+- `yarn workspace @fluentui-react-native/desktop-test test --runInBand
+--cacheDirectory "$W2\artifacts\desktop\f10w\jest-harness"
+--json --outputFile "$E\harness-portable-results.json"`:
+  **Passed**, **453 passed / 28 native skipped**.
+- `yarn workspace @fluentui-react-native/desktop-driver test --runInBand
+NativeDesktopHost.applicationIdentity
+--cacheDirectory "$W2\artifacts\desktop\f10w\jest-driver"
+--json --outputFile "$E\host-identity-portable-results.json"`:
+  **Passed**, **31 passed**, including the existing void-return and unsettled
+  native-verdict contracts.
+- The driver's matching native selection: **Passed**, **6 passed / 10
+  unrelated filtered skips**, including native build/cache/handshake/self-test
+  and the physical mutex. Its ledger records the exact invocation.
+- Locked default-environment `yarn clean-lage-cache` followed by
+  `yarn lage buildci`: initial attempt **Failed**, 176 successful tasks and one
+  Storybook task failure, `A stopping command cannot publish readiness` in
+  `serverIntegration`. The reported intermittent readiness failure was observed
+  again; its cause remains unproven. After remaining fail-fast test children
+  settled and the audit was clean, the **one** unchanged full rerun **Passed**:
+  **178 successful / 0 failed / 0 skipped**, 2m 38.65s. Neither attempt changed
+  default TEMP, concurrency, timeouts, dependencies or repository guidance.
+  Logs are `buildci-default.log` and `buildci-default-rerun.log`.
+
+**Closeout and limits:** both W2 campaigns ended. Native and final aggregate
+audits **Passed**: `FURN-AUDIT: no FURN desktop processes found`. No W2 app,
+helper, fixture or Metro survived. The existing three-package patch changeset
+`windows-exact-application-ownership.md` remains applicable. The test-only
+correction requires coordinator review before push; this phase has not pushed,
+edited the PR body, or started new hosted CI. Initial PR #4494 CI at `dbaf558939`
+was observed green; it does not qualify this new local test correction.
+F11 claim naming remains deferred and untouched. Real kernel PID recycling,
+shared-PID activation, arbitrary uncontained descendants and mixed-graph
+recovery remain unqualified. Part of #4447 and #4435.
+
+**Observed reference checks:** Markdown link checks for both edited ledgers
+**Passed** (15 harness links, 6 driver links). Root `yarn oxfmt --check`
+(3,163 files), `yarn check-agent-instructions`, `yarn change:check`, and
+`git diff --check` **Passed**. Receipts are retained beside the native results.

packages/agentic/desktop-test/src/windowsApplicationOwnership.contract.test.ts

@@ -230,7 +230,7 @@ for (const endpoint of endpoints) {
         try {
           await expect(pinned.inspectApplication({ ...registration(endpoint), host: pinned })).rejects.toMatchObject({ data: { reason } });
           if (reason === 'identity-start-mismatch') {
-            await expect(pinned.recoverApplication(processIdentity)).resolves.toEqual({ state: 'exited' });
+            await expect(pinned.recoverApplication(processIdentity)).resolves.toBeUndefined();
           } else {
             await expect(pinned.recoverApplication(processIdentity)).rejects.toMatchObject({ data: { reason } });
           }