[Jason Morse (JasonVMo)]

Platforms Impacted

• iOS
• macOS
• win32 (Office)
• windows
• android

Description of changes

Part of #4441
Part of #4435

• Refuse Windows legacy-only semantic activation before dispatch with activation-unsupported and effect none. A nonempty MSAA default action and S_OK did not prove that the React Native Pressable actually ran. Preserve Invoke, Toggle, SelectionItem, and ExpandCollapse paths; do not record delivery, quarantine, or retry physically on this refusal.
• Preserve the unsupported error class and machine-readable native reason through the public operation boundary.
• Register a Win32 untitled secondary tool popup only after exact-process ownership, native identity, visible positive bounds, helper-class exclusions, and bounded exact-root UIA content checks. Global title-based discovery stays conservative.
• Retain an admitted popup without another UIA probe while its lease/thread/class/native ownership still match. Share one 1,000 ms discovery deadline across new candidates, defer unproven candidates to later listings, and report admitted popups truthfully as both listed and tracked.
• Keep window listings available when a window closes between enumeration and geometry serialization. Omit only a no-such-window failure whose native handle is confirmed closed; errors for live handles and unrelated failures still propagate.
• Add the authenticated, session-scoped, read-only GET /session/{id}/furn/window/{window-id}/tree route and DesktopSessionClient.getWindowTree. Inspect a secondary without activating it or changing the selected window.
• Use that route in the Windows/Win32 legacy assertion guard: permit only a single menu root without a nested dialog/window, keep persistent unexpected windows failing, and keep unreadable windows rejecting. Treat no such window as closed; re-list before reporting an empty or unrecognized root, so a closing menu is not a false assertion.
• Add portable routing/error/adapter regressions and native activation, owned-popup, failed/hung-provider, shared-deadline/retry, publication, and close-race tests. Give legacy Callout focus/blur buttons stable test identities.
• Update Windows evidence, provider/protocol/operation references, and patch changesets. No private FDR1 schema, native registration name, or macOS provider implementation changes.
• Move the unchanged Windows qualification section before an existing Windows heading so upstream evidence can append independently. Preserve every other ledger byte and the original EOF; no merge, rebase, amend, or force-push.

Verification

Evidence boundaries

The final locally qualified source is 6c626602cf1eedd10425c8a63d794b1e12b1ff95. Evidence commit 2d987a86f46451c104e01d417c63b4a7080c3f91 adds only validated Windows evidence/tracking; publication 86be8531e5c42bd33e7c46a400f0d40890cf2784 only relocates the unchanged desktop-test Windows evidence to avoid an upstream append conflict. The implementation and review corrections received coordinator Opus reviews with no remaining findings.

Native qualification ran on Windows 11 x64 in an active, unlocked remote RDP session, under the W3 campaign/machine lock and -RequirePhysical. Session checks were eligible before and after every final run. This is not console-session evidence. App identity was checked before each run; Metro and bundles came from the W3 worktree. Apps, Metro, helpers, and fixtures were cleaned up between runs.

Endpoint supervisor commands below are retained local qualification tooling under ignored artifacts\desktop\w3-qualification, not newly published commands. Native suite commands ran from packages\agentic\desktop-driver with FURN_NATIVE_DRIVER_TEST=1; supervisor commands ran from the qualification worktree root.

Keep helper generations separate:

• Baseline 505a2187b, helper d8ee05e4…: the clear/capture/fencing/MCP measurements below.
• Initial implementation helper 29b67c2c…: 32 native contract passes and Fabric honest semantic-refusal checks.
• Pre-review exact-root helper b47212dc…: Paper secondary registration/observation/semantic-refusal/retirement passed.
• Earlier review helper eb91ef8a…, source 89cc81fb…: first final native sweep had 33 passed / 1 failed / 2 skipped. The failure was reproduced and isolated to closure between enumeration and geometry serialization, not labeled a flake.
• Final reviewed helper e0e6fc988fc9214b91e02bd0909c099b203d4f9bfd89c45db8f8c9f9397a05e0, source 7119f42fb101452990b7bea13daf685e90a67ad75840fba60968a5efe42f62d1: full native contracts and all requested final real-app reruns passed. The app supervisor used the source-verified cache with prebuilt-only policy.

Final reviewed-source qualification

Exact command	Result
yarn test --runInBand operations.contract win32Fixture.contract nativeDriver --verbose	PASSED: three suites / 34 tests; two macOS-only signing/build cases SKIPPED, not Windows passes. Includes the real native self-test, the formerly failing tool-content closure case, failed-probe retention, hung-popup listing, shared deadline/deferred retry, truthful publication, and mutation/containment/capture/retention contracts. Log: artifacts\desktop\w3-buildci\final-native-contracts-fixed.log.
node artifacts\desktop\w3-qualification\run-endpoint.mjs windows --secondary-only --modern-only --activation-diagnostics	PASSED: honest pre-dispatch semantic refusal on main Pressable/Button and the exact secondary, effect none, unchanged app state/receipts, no quarantine or implicit physical fallback. Run 8f6d457c-c0d3-4ab5-9204-6dbf66383dbd.
node artifacts\desktop\w3-qualification\run-endpoint.mjs windows --secondary-only --modern-only --physical-secondary	PASSED: distinct secondary, complete 11-node sample, applied physical-pointer click, actual public focus: confirmed, then handle retirement. Run 94c0b321-cebd-4e9b-99e2-3404bbbd80c3.
node artifacts\desktop\w3-qualification\run-endpoint.mjs win32 --secondary-only --physical-secondary	PASSED for native delivery: exact owned tool secondary, complete eight-node sample, applied physical-pointer click, then handle retirement. Run f46d008a-d310-4e6e-98fd-e85941879edd. The legacy story has no native-command outcome, so this is not proof of the RN focus command.
cmd.exe /d /c "yarn clean-lage-cache && yarn lage buildci" (root, W3 machine lock, default TEMP/concurrency, native opt-in unset)	PASSED on the first attempt at the reviewed source: all 178 tasks; zero failed, aborted, pending, or skipped tasks. No readiness-flake rerun was needed. Native tests remain opt-in in this aggregate and are qualified by the separate native run above. Log: artifacts\desktop\w3-buildci\final-buildci-fixed.log.

The aggregate completed at 22:33:27 UTC on November 12, 2026. Its supervisor held the lock until owned descendants drained. Campaign and post-aggregate audits passed: FURN-AUDIT: no FURN desktop processes found. No W3 native runtime or campaign remains.

The close-race native test was confirmed red before the guard with yarn test --runInBand nativeDriver --testNamePattern 'handshakes with the Windows helper'. After the guard, yarn test --runInBand nativeDriver win32Fixture.contract --testNamePattern 'handshakes with the Windows helper|registers only owned untitled tool roots' passed two native cases, with 26 unselected cases skipped. Six isolated real-fixture lifecycle replays also passed. The deterministic self-test additionally proves that live-handle errors and unrelated errors propagate, and direct commands for the omitted closed window still refuse.

Historical qualification retained with its original boundaries

Exact command	Result
yarn test --runInBand nativeDriver win32Fixture operations.contract	PASSED, baseline matching-OS contracts: three suites / 27 tests; two macOS-only cases SKIPPED.
node .\artifacts\desktop\w3-qualification\run-endpoint.mjs windows	PASSED clear/capture subcases on baseline: actual nonempty RN physical keyboard clear (keyboard receipts 1 → 2), initially-empty accessible clear, readonly refusal (effect none, unchanged receipts), minimized-capture refusal without implicit restore, then explicit restore and valid 586 × 793 capture. Retained separate secondary-probe failures are not relabeled passes.
node .\artifacts\desktop\w3-qualification\run-endpoint.mjs win32	PASSED clear/capture subcases on baseline: the same three clear checks and receipt policy; minimized refusal without restore, explicit restore, valid 1010 × 761 capture. The baseline separately registered secondary remained NOT RUN / PARTIAL, not a pass.
node .\artifacts\desktop\w3-qualification\run-endpoint.mjs windows --secondary-only --modern-only --physical-secondary	PASSED on baseline: distinct secondary, complete 11-node observation, applied physical-pointer click, actual focus: confirmed, handle retirement. Run 7fbe3b0b-df33-476b-80e3-95b97bf19f02.
node .\artifacts\desktop\w3-qualification\run-endpoint.mjs win32 --fence-only	PASSED injected fresh-preview fencing: old preview refused ref-region-changed; fresh unique native preview refused story-context-stale; both effect none, unchanged state, same chrome reference usable. Run 60751352-c158-40a2-b4f9-9251e15fec95. Real provider retirement with socket/native UI preserved, not crash or network-reconnect proof.
node .\artifacts\desktop\w3-qualification\run-endpoint.mjs windows --mcp-only --with-secondary	PASSED MCP case: six physical-pointer checkbox clicks, each state-checked, final unchecked. Run f188fae5-67c9-47e4-9800-ea584185fed9. The enclosing run's separate semantic-secondary assertion failed and remains recorded.
node .\artifacts\desktop\w3-qualification\run-endpoint.mjs win32 --mcp-only	PASSED MCP case: six physical-pointer checkbox clicks, each state-checked, final unchecked. Run 6d474fd4-61cb-41f6-824e-7a80df68db45.
yarn test --runInBand operations.contract win32Fixture.contract --testNamePattern 'nonactionable legacy|legacy-only|untitled tool roots'	EXPECTED RED, then PASSED: five behavioral failures before the fix; five new cases passed after the initial fix.
yarn test --runInBand operations.contract win32Fixture.contract nativeDriver	PASSED on initial implementation helper: 32 tests; two macOS-only cases SKIPPED. Distinct from the final 34-test run.
node artifacts\desktop\w3-qualification\run-endpoint.mjs windows --secondary-only --modern-only --activation-diagnostics	PASSED on initial implementation helper: main/secondary honest semantic refusal, unchanged app state/receipts, no quarantine/fallback. Run a583840b-7ad5-4691-9e60-f4f83d49fd48.
node artifacts\desktop\w3-qualification\run-endpoint.mjs win32 --secondary-only --activation-diagnostics	PASSED on pre-review exact-root helper: secondary registration, complete eight-node content sample, unique focus button, activation-unsupported / effect none, retirement; main controls refused honestly. Run 7edaa34a-fefd-4a8b-846b-dc8aa8c3880e.

Nonempty semantic strict clear is matching-OS native self-test evidence. The live accessible RN clear case started empty; it is not claimed as nonempty semantic removal.

MCP SDK 1.32.2, tokenizer 4.1.0 / o200k_base; six samples per endpoint. Discovery was 4,691 tokens / 20,277 bytes on each. RPC timing ends before tokenization and excludes startup/discovery.

MCP measurement	Windows Fabric	Win32 Paper
Click response text	99–106 tokens / 313–314 bytes	96–103 tokens / 311–312 bytes
User-facing request JSON, separately	56–63 tokens / 186 bytes	57–64 tokens / 186 bytes
Request + response-text pair	155–169 tokens / 499–500 bytes	153–167 tokens / 497–498 bytes
Click RPC p50	299.107 ms	308.003 ms
Click RPC p90 / max	369.976 ms	318.208 ms
Default observe	Incomplete: maxNodes, 13 omitted; 100 emitted / 113 matched / 115 visited	Complete; 99 emitted/matched / 124 visited

Counts describe independently encoded response text and separately serialized user-facing request JSON, not JSON-RPC wire or model-billing totals. Default observations and budgets were retained; no reduced scope or omitted observation is claimed.

Portable/build and review validation

Exact command	Result
yarn test --runInBand desktopDriver.test DesktopDriverClient.test (desktop-driver)	PASSED: 52 tests, including non-activation and unknown/closed-window refusal for the explicit-window tree route.
yarn test --runInBand (desktop-driver, native opt-in unset)	PASSED at the read-only-route correction: 73 suites / 1,203 tests; eight suites / 95 native tests SKIPPED. The final clean-cache aggregate above also passed.
yarn workspace @fluentui-react-native/e2e-testing test	PASSED: all 14 adapter tests, including closing menus, a vanished menu followed by a real unexpected window, persistent unexpected roots, and unreadable windows. Two new closing-menu tests failed before the correction.
yarn workspace @fluentui-react-native/e2e-testing build and yarn workspace @fluentui-react-native/e2e-testing lint	PASSED for the adapter corrections.
yarn test (native-core)	PASSED: build/story typecheck, 18 Node checks, 56 Jest checks, one snapshot.
yarn workspace @fluentui-react-native/desktop-driver format	PASSED.
yarn workspace @fluentui-react-native/desktop-driver lint	PASSED.
yarn workspace @fluentui-react-native/desktop-driver build	PASSED.
yarn oxfmt --check	PASSED at final publication.
yarn markdown-link-check -c .github/markdown-link-check-config.json packages/agentic/desktop-test/references/current-status.md	PASSED after the evidence-only anchor move: 15 links.
yarn check-agent-instructions	PASSED after the evidence-only anchor move.
git merge-tree --write-tree HEAD origin/main	PASSED: exit 0 at publication 86be8531e, fetched main 041ac8b98. No branch/history merge was performed.
git merge-tree --write-tree HEAD origin/user/jasonvmo/desktop-runner-handoff	Desktop-test ledger check PASSED: no conflict in the moved file. The command exits 1 for the other branch's pre-existing desktop-driver and desktop-driver-mcp ledger append conflicts, outside this text-move scope.
yarn markdown-link-check -c .github\markdown-link-check-config.json <changed-file>	PASSED for changed references, provider/protocol documentation and E2E README. Final evidence/tracking checks passed seven and 38 links respectively.
git diff --check	PASSED.
yarn change:check	PASSED for committed changesets, including quiet-menu-windows.md and brave-popup-listings.md.

Earlier default-environment aggregate comparison remains separate: the unchanged cad25f8c5 retry passed all 178 tasks; the clean 505a2187b baseline reproduced the WDIO 7,000 ms deadline and server-stop readiness race. The final reviewed-source aggregate passed first attempt without any timeout, TEMP, concurrency, policy, or guidance workaround. Owned descendants drained before lock release.

Hosted Windows/Win32 coverage

Current publication 86be8531e5c42bd33e7c46a400f0d40890cf2784 is MERGEABLE. The coordinator-authorized evidence-only anchor move removes the conflict with main 041ac8b98 (#4490); the local integration-tree check exits 0. PR workflow 43324722221 PASSED on attempt 1, including every Windows/Win32 job, all macOS/iOS jobs, and aggregate PR job 131567170196. CodeQL workflow 43324722189 PASSED. No hosted rerun was needed.

Current-head hosted job	Job ID	Observed result and changed-path evidence
Windows Storybook PR	131554190142	PASSED: the full native-enabled desktop-driver package ran with FURN_NATIVE_DRIVER_TEST=1: 79 suites / 1,254 tests passed; two suites / 45 tests skipped, not passes. Logs explicitly pass win32Fixture.contract.test.ts, operations.contract.test.ts, and nativeDriver.test.ts, covering the changed fixture and self-test paths. Accessible Storybook smoke: 255/255 passed, zero retries/flakes.
Win32 Storybook PR (accessible)	131554190022	PASSED: 233/233, zero failed, unsupported, incomplete, retries or flakes; uses the changed Windows native provider.
Win32 Storybook PR (physical)	131554190330	PASSED: 288 passed of 289 selected; one unsupported quarantined case, not a pass: #4373, Win32 does not forward onPressOut after Space with an intervening key. Zero failed, incomplete, retries or flakes; uses the changed Windows native provider.
Win32 PR (legacy E2E)	131554190353	PASSED: 201/201, zero retries/flakes. Includes the Menu specs and the corrected non-activating assertion guard; the ten earlier false assertion failures are no longer present.
Windows PR (legacy E2E)	131554190412	PASSED: 39/39, zero failed, skipped, unsupported, incomplete, retries or flakes.
JS PR	131554190166	PASSED: all 178 buildci tasks.

Downloaded Windows and Win32 physical doctor reports both say ready: true, provider windows, and source digest 7119f42fb101452990b7bea13daf685e90a67ad75840fba60968a5efe42f62d1, exactly matching the final locally qualified helper source.

The Win32 accessible channel also logged one non-failing authenticated bridge-epoch/missing-lease diagnostic. Its terminal report still records zero failed or incomplete work. The diagnostic's cause is unisolated; it is disclosed rather than claimed fixed or classified as a flake.

The branch was fetched and pulled with --ff-only before the successful push. Only one normal text-move commit was added; no merge, rebase, amend, force-push, workflow workaround, or rerun of an old-source job was attempted.

The earlier workflow 43284991535 exercised the earlier native helper in Windows Storybook job 131415902791 and Win32 physical Storybook job 131415903272, but its Win32 legacy E2E job 131415903355 had ten false assertion failures (191/201 passed). Those historical jobs are not current-source qualification; the new-head results above qualify the corrections.

Windows Storybook PR enables the full native package contract, which includes the changed fixture and self-test paths. Win32 jobs provision and use the same changed Windows native provider. Generic Storybook/E2E smokes are not by themselves proof of the separately registered physical secondary cases; those are qualified locally above. The hosted results and capability skips above come from actual job/step logs. No hosted rerun has been requested.

NOT RUN / qualification limits

• NOT RUN: 200% DPI; changing the 100% RDP scaling setting was not authorized.
• NOT RUN: mixed DPI and negative-origin monitor layout; only one origin-zero monitor was attached.
• NOT RUN here: physical console Ctrl+C; handled separately by Add scoped attach-only runner grants and drain-confirmed desktop handoff #4491. Cooperative supervisor stop is not physical Ctrl+C evidence.
• The legacy Paper story does not publish an RN focus-command outcome; its final physical receipt proves native delivery, not that separate command effect.
• Keep this PR draft. Hosted coverage is reported from actual execution, not inferred from compilation or skipped tests.

Before

After

Legacy-only semantic activation could report applied/accessibility while app status stayed Idle; the Paper Callout was shown but absent from registered windows. Once admitted, menus could be mistaken for assertion dialogs, and closure could race tree reads or window geometry serialization.

Unsupported semantic activation refuses before dispatch. Proven owned tool content registers and remains listable through provider failures; discovery is bounded and diagnostics truthful. Closed-window geometry is omitted narrowly, and the non-activating assertion guard distinguishes expected menus from persistent unexpected windows. Final native contracts and all requested real-app reruns passed.

Pull request checklist

This PR has considered (when applicable):

• Automated Tests
• Documentation and examples
• Keyboard Accessibility
• Voiceover
• Internationalization and Right-to-left Layouts

[github-actions]

Bundle size report

Tree-shaken, minified production esbuild bundles with React and React Native runtimes externalized.

Scenario	Modules-Mac (Δ)	Modules-Win (Δ)	Size-Mac (Δ)	Size-Win (Δ)
components-button	79 (+1)	80 (+1)	72.92k (-702b)	72.85k (-702b)
components-catalog	228 (+1)	229 (+1)	229.66k (+349b)	229.59k (+349b)
design-themed-root	55 (+4)	56 (+4)	56.26k (+998b)	56.18k (+998b)
design-color-lib	6 (+0)	6 (+0)	6.27k (+0b)	6.27k (+0b)
design-theme-state-legacy-source	49 (+1)	50 (+1)	52.96k (-841b)	52.89k (-841b)
design-legacy-theme	42 (+0)	42 (+0)	39.11k (+0b)	42.91k (+0b)
design-legacy-theme-from-flex	58 (+4)	58 (+4)	60.70k (+824b)	64.51k (+822b)
design-fluent-light-theme	7 (+0)	7 (+0)	18.74k (+0b)	22.59k (+0b)
design-fluent-theme	35 (+0)	35 (+0)	27.46k (+4b)	31.25k (-1b)
design-fluent-hc-theme	32 (+0)	32 (+0)	27.34k (+0b)	31.13k (+0b)
design-flex-theme	29 (-4)	29 (-4)	14.30k (-9.07k)	14.29k (-9.07k)
design-flex-cool-theme	26 (New)	26 (New)	12.51k (New)	12.50k (New)
design-flex-warm-theme	26 (-7)	26 (-7)	12.28k (-11.15k)	12.27k (-11.15k)

The job is advisory: size changes are reported but do not fail the pull request. Bundle or analysis errors still fail.

---

View bundle-size workflow run

[Jason Morse (JasonVMo)]

Copilot resolve the merge conflicts on this branch.

[Copilot]

Copilot resolve the merge conflicts on this branch.

Merged origin/main and resolved the conflicts in merge commit a7389529. Also fixed the CodeQL stack-trace exposure in d9a5ffcc; tests/build checks could not run because workspace dependencies are absent.