[Jason Morse (JasonVMo)]

Platforms Impacted

• iOS
• macOS
• win32 (Office)
• windows
• android

Description of changes

Part of #4435. Stacked on #4490 (base user/jasonvmo/desktop-manifest-trust at aadc2f359); review only this layer's diff.

Reduces desktop E2E per-case overhead without weakening isolation. Remounts stay on by default, and every case keeps a fresh Node worker and WebDriver session, a fresh authenticated context, and native-marker verification.

• Attribution (storybook-desktop runDiagnostics, runWdioTests, worker; desktop-driver sessionStories/storybook):
  • Bounded per-case phase timings for attach, navigation, readiness, native verification, worker, receipts and cleanup.
  • Lifecycle observations: app PID/start, runtime epochs, preview generations, window/activation counters.
  • Process-history truncation is reported separately from possible per-case loss.
  • No credentials, nonces, args or app text are recorded.
• Direct navigation (StorybookChannelOrchestrator):
  • Driver-owned story selection uses authenticated direct socket dispatch. No competing upstream HTTP selection is sent, which removes the upstream same-story wait.
  • It awaits correlated runtime readiness plus the native marker.
  • Dispatch choice is now separate from the controlled protection policy. Normal args support and protected-agent args refusal/no-relay are preserved, and direct library consumers keep the legacy HTTP default.
• Run-owned extraction cache (wdioExtractionCache):
  • Complete extracted test maps are cached by source content plus the digests of observed helper modules, within the owning run (smoke calls the runner per story).
  • Manifest-digest checks are retained, and a changed helper invalidates the entry.
• macOS flashing: source-traced measurement and a compatible proposal only (desktop-driver/references/remaining-work.md). No safe activation dedupe was established, so this PR does not change activation.
• Not included:
  • Session/worker pooling. The measurements make it eligible, but it is deferred pending ownership and settlement qualification.
  • Preview reuse / per-test isolation metadata.

Docs: storybook-desktop README, references/{readiness,story-tests,current-status}.md; desktop-driver references/{protocol,remaining-work,current-status}.md. Changeset: calm-story-observations.md (patch: desktop-driver, storybook-desktop).

Verification

Local macOS, under a machine-wide native lock. Paired baseline (aadc2f359) and candidate runs used identical selected cases, ordering, input lane and renderer: eight runs per side and renderer, 24 passing callbacks plus eight declared unsupported. Times are runner-only, in ms.

Renderer	p50 / p95 before	p50 / p95 after	Aggregate before → after	Median change
Fabric	7939 / 8845	6680 / 6995	63951 → 53174	−15.9%
Paper	7916 / 8755	7219 / 7812	60909 → 57611	−8.8%

These are sequential blocks from a small cohort, so they make no reliability or startup claim. Native-verification p95 got worse. Window-scoped recordings could not support any claim of reduced flashing. The full statistics and their limits are in storybook-desktop/references/current-status.md.

Check	Result
Focused storybook-desktop / desktop-driver suites (yarn test …)	Passed (112 focused tests after review fixes; package runs: storybook-desktop 405 passed / 4 skipped, desktop-driver 1222 passed / 66 skipped)
macOS Fabric and Paper smokes, --input accessible and sparse physical	Passed (228 accessible and 238 physical canonical passes per renderer)
Strict Swift build, helper --self-test, FURN_NATIVE_DRIVER_TEST=1 contracts	Passed (448 checks; 87 tests, 16 skipped)
Paper manifest/bundle/smoke after review fixes	Passed (228 checks)
yarn oxfmt --check, yarn check-agent-instructions, yarn markdown-link-check on changed docs, yarn change:check	Passed
yarn clean-lage-cache && yarn lage buildci (plain, parallel Jest)	Failed, twice, on the pre-existing boundedCommand SIGKILL/SIGTERM assertion. The same command on base aadc2f359 fails the same way, plus a privateStorage timeout, so this predates this PR. Local Node 24, heavy machine load.
Hosted PR CI at 95a81290c (direct selection plus extraction cache on every Storybook lane)	Passed, 19/19: Windows Fabric smoke 255/255; Win32 accessible 233/233; Win32 physical 288/288 (+1 quarantined); macOS Fabric/Paper Storybook passed. The Windows lane's 49 bridge-unavailable stderr navigation lines also appear, at the same count, on base #4490 (existing log noise).
Local Windows/Win32 paired timing	Not run; Windows-side qualification pending, so no Windows speedup is claimed

One Opus 5.5 review: no blockers; five minor findings, all fixed in 95a81290c.

Before	After
Driver-owned navigation sends an HTTP select and awaits the upstream same-story wait plus readiness; each smoke invocation re-extracts the story's tests	Authenticated direct select awaits readiness and the native marker only; extracted maps are reused within the run while digests are unchanged

Pull request checklist

This PR has considered (when applicable):

• Automated Tests
• Documentation and examples
• Keyboard Accessibility
• Voiceover
• Internationalization and Right-to-left Layouts

[github-actions]

Bundle size report

Tree-shaken, minified production esbuild bundles with React and React Native runtimes externalized.

Scenario	Modules-Mac (Δ)	Modules-Win (Δ)	Size-Mac (Δ)	Size-Win (Δ)
components-button	79 (+1)	80 (+1)	72.92k (-702b)	72.85k (-702b)
components-catalog	228 (+1)	229 (+1)	229.66k (+349b)	229.59k (+349b)
design-themed-root	55 (+4)	56 (+4)	56.26k (+998b)	56.18k (+998b)
design-color-lib	6 (+0)	6 (+0)	6.27k (+0b)	6.27k (+0b)
design-theme-state-legacy-source	49 (+1)	50 (+1)	52.96k (-841b)	52.89k (-841b)
design-legacy-theme	42 (+0)	42 (+0)	39.11k (+0b)	42.91k (+0b)
design-legacy-theme-from-flex	58 (+4)	58 (+4)	60.70k (+824b)	64.51k (+822b)
design-fluent-light-theme	7 (+0)	7 (+0)	18.74k (+0b)	22.59k (+0b)
design-fluent-theme	35 (+0)	35 (+0)	27.46k (+4b)	31.25k (-1b)
design-fluent-hc-theme	32 (+0)	32 (+0)	27.34k (+0b)	31.13k (+0b)
design-flex-theme	29 (-4)	29 (-4)	14.30k (-9.07k)	14.29k (-9.07k)
design-flex-cool-theme	26 (New)	26 (New)	12.51k (New)	12.50k (New)
design-flex-warm-theme	26 (-7)	26 (-7)	12.28k (-11.15k)	12.27k (-11.15k)

The job is advisory: size changes are reported but do not fail the pull request. Bundle or analysis errors still fail.

---

View bundle-size workflow run

[Jason Morse (JasonVMo)]

Windows portable finding — W5 (desktop measurements to follow)

Reproduced at 95a81290c77fc1028a8d2a645825fd6884beea84; no native/desktop run was needed. The new window-activity projection treats Windows WinEvent logs as though they contained macOS AX notifications and reports unsupported counters as observed zeros.

Source and reproduction

• packages/agentic/desktop-driver/native/windows/src/driver.cpp:334 advertises windowEvents: true, so Windows does enter the diagnostic collection path.
• packages/agentic/desktop-driver/native/windows/src/events.cpp:559,572 produces WinEvent notification names and source: 'WinEvent', including EVENT_SYSTEM_FOREGROUND and EVENT_OBJECT_CREATE.
• packages/agentic/storybook-desktop/src/testing/runDiagnostics.ts:90–108 does not branch on log.source: line 95 sets status: 'observed', while lines 99–104 count only AXApplicationActivated, AXApplicationDeactivated, AXFocusedWindowChanged, AXMainWindowChanged, AXWindowCreated, and AXUIElementDestroyed. Lines 106–108 also use macOS-specific provider-activation methods.

From the candidate checkout root in PowerShell:

Push-Location .\packages\agentic\storybook-desktop
yarn build
Pop-Location
@'
import { strict as assert } from 'node:assert';
import { summarizeWindowActivity } from './packages/agentic/storybook-desktop/lib/testing/runDiagnostics.js';
const activity = summarizeWindowActivity({
  source: 'WinEvent', observing: true, eventsTruncated: false,
  events: [
    { ageMs: 1, element: 'fixture-window', notification: 'EVENT_SYSTEM_FOREGROUND', sequence: 1 },
    { ageMs: 0, element: 'fixture-window', notification: 'EVENT_OBJECT_CREATE', sequence: 2 },
  ],
});
console.log(JSON.stringify(activity, null, 2));
assert.ok(
  activity.status !== 'observed' || typeof activity.windowsCreated !== 'number',
  'An unsupported AX-only counter must not be presented as an observed Windows number',
);
'@ | yarn node --input-type=module

Observed: status: 'observed', events: 2, but windowsCreated: 0, applicationActivations: 0, applicationDeactivations: 0, focusedWindowChanges: 0, mainWindowChanges: 0, elementsDestroyed: 0, and providerActivations: 0. The assertion fails.

Expected: retain genuinely supported generic observations such as the two events, but omit unsupported AX-only counters or explicitly mark them unsupported. Alternatively, conservatively return { status: 'not-supported' } for a source the current summary cannot interpret. No particular Windows creation/activation count is established by this fixture: EVENT_OBJECT_CREATE is not automatically equivalent to a window creation.

Gate and suggested fix

This fails the diagnostic-degradation gate: Windows-only gaps must be absent or explicitly unsupported, never fabricated numeric zeros under an “observed” status. It is not evidence that Windows had zero activity and is not, by itself, a story-navigation failure.

Make the projection source-aware. Preserve the existing AX projection for source: 'AX'; for source: 'WinEvent', retain only semantically supported generic counters and explicitly represent unsupported categories, or use the conservative unsupported result above. Do not silently map arbitrary WinEvent object notifications to AX/window semantics. Add a focused WinEvent regression alongside runDiagnostics.test.ts, retain AX regression coverage, and cover the runner's Windows result shape.

The existing focused portable suites passed (209 tests, one Windows SIGHUP skip), but lack this WinEvent assertion. Windows Fabric / Win32 Paper desktop measurements and live correctness results remain Not run, awaiting the Windows coordinator's W5 campaign grant. Those results will follow in a separate comment. No source change or push was made to this branch.

[Jason Morse (JasonVMo)]

PARTIAL — Windows Fabric paired qualification, W5

No speedup is claimed on Windows Fabric. The scoped prepared-lifecycle
measurements below are slower on B, predominantly during cold first-navigation
startup; they do not establish a uniform direct-selection regression.
The precise cause of that startup difference remains unidentified.

The RDP session disconnected/locked during the restart experiment at
2026-11-13 00:39:47Z. Desktop work stopped, the campaign ended, and the
final audit was clean. All Win32 live qualification is Not run
(session disconnected 00:39:47Z). Win32 results will follow in a second
measurements comment if the eligible desktop returns.

Pins, protocol and scope

• A: 041ac8b9894aeaa7e1aa273baa2ece4e46298b94.
• B: 389a518ee9ffbdc3164295864855222427685b82; still the PR head when
  checked for this comment. Neither branch was changed or pushed.
• Windows Fabric packaged app; Active/unlocked remote RDP for every accepted
  observation. The verified native payload was reused because relevant native,
  app and runtime inputs are identical between A and B; this is not a new
  native-build qualification.
• Eight ABBA pairs initially, extended by the predeclared noise rule to
  16 pairs / 32 complete accessible lifecycles. Untimed A/B warm-ups are
  excluded. The head was checked at pair boundaries; every lifecycle cleaned
  up its own app, Metro and helper.
• All 215 stories were traversed in identical order. The authored callback
  filter was components-{button,dropdown}--{default,appearance}:
  Button Default, Dropdown Appearance, Dropdown Default. Each accessible run
  passed 218/218 = 215 traversals + three callbacks, with eight input
  exclusions, zero declared gaps and no retries.
• The prepared lifecycle omits equal already-completed bundle/prep/native
  build operations. Every Fabric run re-registered from the selected arm,
  verified identity/install location, and recorded registration separately.
  Lifecycle figures below subtract that registration time; they are not
  wall times of the unmodified shipping smoke command.
• Per-run TEMP/TMP/TMPDIR isolation also isolated Metro file-map/transform and
  Node compile caches. Retained scratch directories show those caches on both
  arms: these are cold per-run cache lifecycles, not persistent-cache warm
  runs. The untimed warm-ups did not prewarm those later private cache roots.

Windows Fabric measurements

All values in this table are seconds. Each arm has 16 lifecycle samples.
Differences are B minus A; positive is slower. Intervals are fixed-seed
10,000-resample paired-bootstrap 95% CIs.

Phase	A p50 / p95	B p50 / p95	Median of paired differences [95% CI]	Difference of arm medians
Prepared lifecycle, registration excluded	78.903 / 86.389	86.132 / 93.471	+5.410 [2.623, 7.594]	+7.230 (+9.16%)
Render stories	52.951 / 58.403	56.832 / 65.546	+4.617 [2.379, 6.697]	+3.881
Story tests	3.511 / 3.731	3.601 / 3.923	+0.050 [0.020, 0.137]	+0.090
Registration, excluded above	1.581 / 1.643	1.558 / 1.651	-0.018 [-0.073, 0.062]	-0.022

The median paired difference is not the difference of the two arm medians.
For prepared lifecycle, the arm-p50 delta is +7.230 s [2.333, 9.051], and
the arm-p95 delta is +7.082 s [3.413, 9.912]. For traversal those deltas
are +3.881 s [2.021, 8.222] and +7.143 s [5.210, 9.299], respectively.
Small-sample p95 intervals are descriptive, not a tail-reliability claim.

Authored cases are a separate pooled comparison, 48 cases per arm:
A p50/p95 1100 / 1156.90 ms, B 1120 / 1186.95 ms.
The pooled p50 delta is +20 ms [5, 28.5]; pooled p95 delta
+30.05 ms [13.89, 373.25]. These intervals resample paired lifecycle
clusters, not independent callbacks; these are not median-paired-case deltas.

Metric	A total / sample SD / IQR, seconds	B total / sample SD / IQR, seconds
Prepared lifecycle, registration excluded	1286.621 / 3.341 / 5.341	1370.911 / 5.294 / 8.431
Render stories	861.686 / 2.493 / 3.034	936.591 / 4.709 / 7.279
Story tests	56.742 / 0.110 / 0.119	58.379 / 0.265 / 0.112
Authored cases	53.134 / 0.0572 / 0.0490	54.857 / 0.1263 / 0.0383

Root-cause analysis from retained artifacts only

High confidence: this is concentrated in the first navigation, not a
~20 ms tax on each story. All 215 navigation IDs, attempts and ordering
were matched across all 16 pairs.

Traversal component	A p50	B p50	Median paired delta [95% CI]
First navigation: primitives-layout-stable-text--default	25.134 s	29.407 s	+4.861 s [2.533, 6.502]
Remaining 214 navigations combined	27.223 s	27.200 s	-0.264 s [-0.514, 0.104]
Mean per later navigation, paired by lifecycle	127.208 ms	127.100 ms	-1.234 ms [-2.402, 0.486]

Among the later 214 stories, 138 have negative paired-median deltas, 54
positive and 22 zero; their median delta is -1 ms. The largest positive
later-story median is Button Size at +22.5 ms, not seconds. These
per-story inspections are exploratory, without multiple-comparison claims.
The first-navigation paired median grows from +2.487 s in the initial
eight pairs to +6.662 s in the extension; the remaining-story medians
are -0.227 and -0.323 s. ABBA does not remove arm-specific startup drift.

Observed localization within that cold first navigation: producer-timestamped
Metro output separates the following landmarks, in seconds:

Existing-output interval	A p50	B p50	Median paired delta [95% CI]
Navigation start → first Metro BUNDLE ... 0% (0/1) line	9.799	13.260	+3.789 [2.805, 6.523]
First bundle progress line → bundle-complete line	13.325	14.034	+0.540 [-0.152, 1.141]
Bundle-complete line → native-verified first navigation result	2.159	2.143	+0.020 [-0.038, 0.069]

Using means, which can be added, +4.283 s of the +4.786 s first-navigation
difference (~89.5%) lies before the first bundle progress line; +0.494 s
lies in the progress interval and +0.009 s after completion. Component
medians must not be added. Progress output is not request-arrival,
dependency-graph, JS-initialization or scheduler instrumentation.

Code-based interpretation, not a proven candidate-code cause:
the first timer includes cold-runtime availability. The common
config/storybook-control.cjs:11,90–94 gives the first selection a startup
budget; storyTraversal.ts:36–55
retries only proven pre-dispatch bridge-unavailable, at 500 ms intervals.
That shared startup-wait path, not steady-state per-story selection,
contains the observed delay.

The candidate chooses direct transport at config/server.cjs:276.
In StorybookChannelOrchestrator.ts:123–194,
requireBridge() at line 129 precedes the prepare/direct-select sends
at lines 158–175. Native-marker verification follows provider readiness
in desktop-driver/src/server/sessionStories.ts:37–49.
The data does not support blaming that direct-send path for a uniform
20 ms delay, nor naming any candidate-only line as the startup cause.
The pre-progress interval cannot distinguish native request scheduling
from Metro/cache/file-map/worker initialization or other host/worktree
effects. Confidence is high in the timing location, moderate in the
cold-start interpretation, and insufficient for that precise causal split.

Additional phase checks:

• The retained traversal reports have end-to-end attempt timings, not
  separate dispatch/HTTP, readiness and native-verification timers. The
  fixed-category HTTP instrumentation proves transport choice but records
  counts, not latency. An exact A/B split of those inner traversal stages
  is therefore not observed, rather than assumed zero.
• Fabric has no configured per-traversal settle in these runs; the 250 ms
  settle belongs to Win32 and cannot explain the Fabric difference.
• Context-generation runtime/app sources are unchanged. Extraction/cache
  and callback workers execute in Story tests after traversal/restart,
  so they cannot explain the cold first traversal growth.
• For the smaller authored-case difference, common external WDIO command
  spans grow +18.7 ms [7.7, 31.8] per-case mean, paired by lifecycle;
  printed test-body durations change +1.0 ms [-0.5, 2.9]. This localizes
  most of that small difference outside the body. Baseline has no internal
  startup/settlement split, so startup versus teardown is not identified.
• Candidate-only authored-case p50/p95: runtime readiness 60.89/79.10 ms,
  native verification 23.41/26.61 ms, worker startup 718/749.25 ms.
  These are not baseline deltas, and nested phases must not be summed.
  Each candidate lifecycle reports two source extractions and one cache
  hit. Baseline extraction counters are absent, not zero.

If desktop work resumes, a separately declared warm-runtime/cache-balanced
control is needed to distinguish product dispatch effects from cold-start
effects; it must not replace or relabel these retained cold-lifecycle data.

Windows correctness

Every Win32 entry below means Not run (session disconnected 00:39:47Z),
not a skip or pass.

Check	Windows Fabric	Win32 Paper
Direct selection / no upstream HTTP select	Passed: B 0 selects per run with two index requests; A positive control 219 selects per run	Not run
Exact coverage, ordering and accounting parity	Passed: 215 traversals + three accessible callbacks; eight exclusions	Not run
Scoped physical A and B	Passed: 226/226 each = 215 traversals + 11 callbacks; zero exclusions/gaps	Not run
Missing/foreign grant select and reset refusal	Passed: unauthorized / invalid session ID	Not run
Protected public HTTP and foreign-socket mutation refusal	Passed: HTTP 403; native-verified current story unchanged	Not run
Authorized owner select/reset and protected args refusal	Passed: real generations 1 → 2; args refused	Not run
Stale/foreign readiness rejected	Passed: live driver/native probe, stale request/run/epoch callback injection, foreign-socket wire readiness; only delayed genuine delivery settled	Not run
Diagnostics degrade truthfully	Failed: D1 still open at 389a518ee	Live Not run; portable Windows finding applies
Actual Win32 preview scroll/reset	Not applicable	Not run

Normal candidate accessible context generations are 2, 3, 4; scoped
physical generations 2–12. Both normal arms have two observed application
incarnations per lifecycle: one traversal-to-tests restart.
JS initializations remain explicitly not-observed; generations are not
independent React effect-mount counts.

Scoped physical run IDs are A c23869cf-f0a5-4593-ad01-770e9a681505,
B ccedded5-e328-40d7-a66c-5b33825ed20a; protected probe
00f42587-dc0b-401a-a4d6-d6b2c3d91e71.
This does not qualify the full Fabric physical suite or clear W4's
Input FocusTreatment toolbar occlusion. Win32's full physical lane retains
the #4373 declared quarantine.

D1 remains reproduced: the early Windows finding
is unchanged at this pin.
storybook-desktop/src/testing/runDiagnostics.ts:90–112 counts AX-only
notification names despite Windows returning source: 'WinEvent'.
The foreground/object-create fixture reports events: 2,
status: 'observed', but unsupported AX counters including
windowsCreated: 0. Live physical reports likewise contain nonzero event
counts with these zero AX counters; that is not proof of zero window
activity. Unsupported counters must be absent or explicitly unsupported.
Do not equate every EVENT_OBJECT_CREATE with window creation.

Delay proposals — both shipping defaults retained

• Fabric restart: four complete pairs, not qualification. Stock/no-restart
  prepared p50/p95: 94.271/95.230 s versus 91.659/93.299 s.
  Preliminary paired median difference -2.808 s [-3.757, -1.467];
  difference of arm medians -2.612 s (-2.77%). Direct stop/relaunch
  timer p50 was 1.612 s, separate from first readiness/control cost.
  No-restart retained one app incarnation and contexts 217–219, versus
  stock two incarnations and contexts 2–4. Four pairs are below the
  eight-pair minimum, the gain is below the predeclared 5% threshold,
  no no-restart physical qualification ran, and D1 fails the full gate.
  Retained; no removal/reduction implemented.
• The ninth restart-experiment lifecycle
  9562b775-dc2c-4c54-ae8d-c75717e85123 printed a test-pass summary but
  failed the session eligibility after-check. It is Not run for
  qualification, excluded from statistics and preserved, not silently
  replaced.
• Win32 250 ms settle: Not measured; retained. No nominal wait-count
  multiplication is presented as an observed saving, and no scroll/reset
  qualification is claimed.

Reproduction and retained evidence

Under the W5 campaign, run-batch.ps1 ran Windows main blocks 1–4
(passed eight pairs), then 5–8 (passed sixteen total); run-one.ps1
ran physical A/B (passed); protected probes passed eight explicit checks.
Restart blocks 1–4 stopped during block 3 after four valid pairs.
All live owners used the native lock/session checks; no desktop work
was performed during this portable analysis.

Portable reanalysis commands, from the candidate worktree:

node artifacts\desktop\w5-campaign-20261112\analyze-navigation.mjs
node artifacts\desktop\w5-campaign-20261112\analyze-cold-start.mjs
node artifacts\desktop\w5-campaign-20261112\analyze-common-workers.mjs

All passed on retained reports only. Each asserts the expected cohort and
required landmarks. Local ignored evidence root:
artifacts\desktop\w5-campaign-20261112:
analysis-windows-main{,-initial8}.json, analysis-windows-navigation.json
(all 215 story comparisons and all 16 pair decompositions),
analysis-windows-cold-start.json (32 timestamped landmark sets),
analysis-windows-common-workers.json, analysis-windows-restart.json,
per-run observation/HTTP/metric/session/audit logs and canonical report
locators, plus protected-windows outcomes. Two initial probe harness
setup failures (Yarn PATH and explorer exit handling) are separately
preserved outside timing samples; neither required a product fix.

The campaign is ended, the W5 grant remains unchanged, and the recorded
post-end audit is FURN-AUDIT: no FURN desktop processes found.
No product changes, commits, pushes, changesets or implementation PR.

[Jason Morse (JasonVMo)]

Copilot resolve the merge conflicts on this branch.

[Copilot]

Copilot resolve the merge conflicts on this branch.

The branch already includes current main (c57dcd8) as the second parent of merge commit 3aeae2c. I verified that base is an ancestor and the merge tree is clean, so no additional conflict resolution is needed.