[Haoming9527]

Refs #872. Stacked on #908; this is the independently runnable driver slice, not closure of the full feature.

What was wrong

The process substrate could own and stop a shell range but could not safely send multiple commands, retain state, or determine command completion independently of shell exit. Fast Niubash metadata opens also exposed a named-pipe connection-registration race before the real writer arrived.

The change

Add a Windows persistent-shell driver and one fixed bootstrap template. Each call uses authenticated private command, output and receipt channels. Completion requires the private receipt, real writer EOF and the exact held bootstrap identities; control loss, retained descriptors or ordinary background descendants reset the owned shell. State and options persist, stdin defaults to EOF per call, and startup-script environment entries are rejected before launch.

Pipe construction waits until every connection is armed. A repository-only executable exercises the production driver through the public host subprocess and confinement APIs. Bilingual documentation and changelog entries describe the contract and remaining runtime limitation.

The shipped Niubash pin and published tools are unchanged. Stock Niubash 1.5 has a reproduced asynchronous output-routing defect. The full local proof uses an explicitly hashed backport candidate; the Windows CI proof covers the supported stock boundary and explicitly asserts that known defect. Neither result claims the complete persistent-shell feature is ready. Session queues, public integration, recoverable output spill, DSH jobs and complete lifecycle/performance acceptance remain required by #872.

Validation

The local integration checkout, including the pending queue slice, passes native workspace tests: 702 passed across emitted test summaries, zero failed, three ignored fixtures/platform cases. The two process child fixtures are explicitly invoked by their lifecycle tests; the existing UNC case is exercised separately in Windows CI. Workspace/all-target Clippy, formatting, TypeScript build and all 117 workflow checks pass. The local Cargo cache reports hard-link fallback warnings; compilation succeeds without weakening checks. CI below validates this exact PR independently.

The deterministic connection-registration test passes with the wait and fails in an external source copy with only that wait removed: 0 passed / 1 failed in the negative control. Earlier pipe ACL failures under the outer tool sandbox and the reproduced ERROR_NO_DATA integration failures remain recorded; the final ownership checks run on the normal host with the requested nested DSH confinement intact.

The independently runnable driver passes 18/18 checks with the candidate and 19/19 with the stock boundary contract. Observed processes are absent before emergency cleanup in both runs. The stock negative-capability assertion requires the unexpected original stdout/stderr diagnostic, an explicit reset and confirmed cleanup; it never accepts silent output loss as completion. Both runs use example SHA-256 3b8193efcb40383739be1930b901df4dacee281cff34ec7e86cea3404e9a942a.

Local candidate executable SHA-256: 7c4332044ac5fd1b789f30b29c155a62f12f07f8dd3495244bda3ce4e0e84664. This is a local candidate, not a published runtime or cross-build reproducibility claim.

A later deterministic reader-gated probe confirms an additional limit of the incompatible stock runtime: 23 escaped bytes had been read from its original OS stdout but were held before capture accounting. The unchanged driver returned exit 0 with private stream EOF and no reset; only releasing that reader gate made the next liveness check detect the unexpected output. Diagnostic counter snapshots therefore cannot certify stock asynchronous output completeness. The copied probe preserves the production driver/example bytes and finishes without observed survivors. Production session admission must keep this runtime ineligible; stronger atomic ordering or a silence delay is not a remedy.

The required pull_request CI run is green for b32e8f5b2ed99a9617694e26352ebf9a9b6c7b96: https://github.com/T-Auto/dsh-ops/actions/runs/43468815681 . All required jobs passed, including Windows, Linux, both macOS architectures, Node floor, lint, size and tool trials. Local size checking passes all 866 tracked code files.

Environment

Windows x64, Node 26.12.1, Rust 1.99.0 locally; CI uses the repository-pinned toolchain. Base: 02b9368b116b317b2734a89d2151fa267189f795. Public DSH packages from the unchanged lockfile. No package-version or dependency changes.